Magisk Hide - Hiding Specific Binar(ies) from specific application(s) - Magisk

Hi,
We can hide root from specific applications by selecting them in magisk manager, however, it does not work well on my banking application.
After reverse engineering my banking application, i found that it was checking another binary in /system/xbin/. Is it possible to hide that binary file as well?
Can I write a module to achieve it? Or I need to modify the magisk hide source and recompile it?
Thanks.

What binary is it detecting? You can make a Magisk module to mount whatever binary it is to /system/xbin and then it should be hidden by MagiskHide.

Didgeridoohan said:
What binary is it detecting? You can make a Magisk module to mount whatever binary it is to /system/xbin and then it should be hidden by MagiskHide.
Click to expand...
Click to collapse
/system/xbin/which
Weird, huh?
Well, obviously /system/xbin/which is linked to busybox, so I think hiding the whole busybox should be better.
Do you mean by making a magisk module with that file, magisk hide will automatically hide the module (and hence the files inside the module)? I wonder doing this with busybox is a bit weird...

hopkinskong said:
/system/xbin/which
Weird, huh?
Well, obviously /system/xbin/which is linked to busybox, so I think hiding the whole busybox should be better.
Do you mean by making a magisk module with that file, magisk hide will automatically hide the module (and hence the files inside the module)? I wonder doing this with busybox is a bit weird...
Click to expand...
Click to collapse
In that case it should be easy... Uninstall whatever busybox you currently have and install the one from the Magisk Manager Downloads.

Related

CM-su still being detected by Magisk, Magisk Hide not working

Hi,
I'm currently so confused as to why my Magisk isn't working. I'm currently running the last CM 13 snapshot for the Galaxy S5 (G900F, klte), and root and Xposed work fine via Magisk.
However, what isn't working is Magisk Hide, and I'm not sure why. However, I'm noticing that even though I fully unrooted cm-su (using SuperSU, in a way that means the only root I can select in Dev Options is ADB only), I'm still getting cm-su detected by Magisk.
I'm confused -- is there anyway I can remove it? I've tried looking through TWRP file manager, but whenever I do so, I can't even see /system/ files, and mounting only mounts to USB, but that's unrelated.
Thanks for any help!
intcompetent said:
Hi,
I'm confused -- is there anyway I can remove it? I've tried looking through TWRP file manager, but whenever I do so, I can't even see /system/ files, and mounting only mounts to USB, but that's unrelated.
Click to expand...
Click to collapse
I don't think SuperSU removes the in-built CM superuser. Use the UNSU zip by osmosis instead. https://forum.xda-developers.com/showthread.php?t=2239421
Also magisk hide will NOT hide Xposed. Yes not even systemless 87.1 Xposed.
SuperSU removed its own root only, CM root is unaffected.
Also, Magisk hide only works with Magisk's own phh root.
And, as far as I know, it can't successfully hide Xposed either. Doesn't matter if it is systemless or not.
Cheers for the replies.
I wasn't aware that Magisk Hide didn't hide Xposed, that's my bad.
As for the presence of CM-SU, SuperSU did do something, as the Developer Options root option is now ADB only while previously it offered the option to Apps too. I'll try unsu.
Here's what I'm meaning btw: imgur.com /a /yTOTw (sorry for the link bypass, there's no other way for me to simply demonstrate the issue) (as you can see in the first screenshot, Magisk detects "cm-su" along with phh. When phh was disabled before I removed cm-su, it only detected cm-su, hence leading me to believe cm-su remains).
e: tried unsu, still cm-su remains. At this point, I'll leave it -- I presume that it's permanently ingrained into the ROM. I've gotten around the restriction I was facing anyway, and I'll adjust. Thanks anyway!
intcompetent said:
Cheers for the replies.
I wasn't aware that Magisk Hide didn't hide Xposed, that's my bad.
As for the presence of CM-SU, SuperSU did do something, as the Developer Options root option is now ADB only while previously it offered the option to Apps too. I'll try unsu.
Here's what I'm meaning btw: imgur.com /a /yTOTw (sorry for the link bypass, there's no other way for me to simply demonstrate the issue) (as you can see in the first screenshot, Magisk detects "cm-su" along with phh. When phh was disabled before I removed cm-su, it only detected cm-su, hence leading me to believe cm-su remains).
e: tried unsu, still cm-su remains. At this point, I'll leave it -- I presume that it's permanently ingrained into the ROM. I've gotten around the restriction I was facing anyway, and I'll adjust. Thanks anyway!
Click to expand...
Click to collapse
If there are SU files in /system/bin and /system/xbin, then CM root was not removed. Not completely.
To actually remove it you have to delete those files.
Pwnycorn said:
If there are SU files in /system/bin and /system/xbin, then CM root was not removed. Not completely.
To actually remove it you have to delete those files.
Click to expand...
Click to collapse
@intcompetent Osmosis's unsu zip removes those files. If those files are still there after flashing the unsu zip, I'd ask in his thread.
knpk13 said:
@intcompetent Osmosis's unsu zip removes those files. If those files are still there after flashing the unsu zip, I'd ask in his thread.
Click to expand...
Click to collapse
Or just remove them manually, jeez. It's just two files.
I've been doing it manually for months and everything works as intended.
As an a closer, there's nothing there. I presume that Magisk is picking up something freaky from somewhere, or something's up, but I'm good guys. I won't need anymore help.
Cheers!
I found this zip around somewhere. I believe it works to remove all root (systemless as well) and I've always flashed it before rooting normally. It should also remove CM root afaik.
As a test, after flashing, check and see if you pass safetynet before installing magisk
intcompetent said:
As an a closer, there's nothing there. I presume that Magisk is picking up something freaky from somewhere, or something's up, but I'm good guys. I won't need anymore help.
Cheers!
Click to expand...
Click to collapse
I
L

[Magisk][Module] su xbin_bind v1.2-20170417

Intro
Expose your su to standard location /system/xbin/su systemless-ly.
Though it helps grant root permission to some apps, this trick breaks safetynet.
Just made a simple module try to solve the /sbin/su not detectable problem. This module will look for existing su binary, and create a link as /magisk/su_xbin_bind/system/xbin/su pointing to the real su. The link will also be mounted as /system/xbin/su systemless-ly later.
Installation
Flash it in Magisk manager or through recovery, then reboot. You will find a link /system/xbin/su. All the work is done systemless-ly.
Uninstallation
Open Magisk Manager, go to Modules, disable or uninstall the module called "Su xbin_bind". Then it will disappear after reboot.
su-xbin-bind on github
Changelog
v1.2 20170417
Add Magisk v12 support.
v1.1 20170323
- make it compatible with Magisk v11.5/11.6
Update 20170228
- Since a little syntax error in the mounting script from Magisk v11.0-v11.5, mounting links systemless-ly won't success. Hence we choose to copy but not to link the su binary for v11.0-v11.5. Don't worry, both methods are systemless.
Reserved.
Hi, will this not make safetynet fail?
kartikb said:
Hi, will this not make safetynet fail?
Click to expand...
Click to collapse
It will obviously. Because su is exposed to /system/xbin/su and will be detected.
laggardkernel said:
It will obviously. Because su is exposed to /system/xbin/su and will be detected.
Click to expand...
Click to collapse
Wouldn't magiskhide unmount that and therefore pass safetynet?
I used your module to fix TiBackup freeze when restorins apps.
TiBackup troubleshooting (http://www.titaniumtrack.com/kb/tit...l#tb-hangs-while-freezing-apps-restoring-apps) reports that this issue is connected with wrong su permissions in /system/bin and /system/xbin. Since these are not available due to systemless root, I though that your module would represent an elegant fix... and it did!
Thanks!
leonardus_magnus said:
I used your module to fix TiBackup freeze when restorins apps.
TiBackup troubleshooting (http://www.titaniumtrack.com/kb/tit...#tb-hangs-while-freezing-apps-restoring-apps) reports that this issue is connected with wrong su permissions in /system/bin and /system/xbin. Since these are not available due to systemless root, I though that your module would represent an elegant fix... and it did!
Thanks!
Click to expand...
Click to collapse
Does ur safety net fail with this module?
Xennet said:
Does ur safety net fail with this module?
Click to expand...
Click to collapse
Oh c'mon, you cannot be serious... On Xda forums you have threads with hundreds of pages and I would admit you did not read all of them... but your answer has already been replied on post n. 4 in this page... I can' believe it...
leonardus_magnus said:
Oh c'mon, you cannot be serious... On Xda forums you have threads with hundreds of pages and I would admit you did not read all of them... but your answer has already been replied on post n. 4 in this page... I can' believe it...
Click to expand...
Click to collapse
Yah i saw it lol....
But magisk usually dismounts xbin folder...
Then it unusual to get it detected unless it is physically present der...
So just wanted to confirm it before flashing...
Xennet said:
Yah i saw it lol....
But magisk usually dismounts xbin folder...
Then it unusual to get it detected unless it is physically present der...
So just wanted to confirm it before flashing...
Click to expand...
Click to collapse
Ok safety net not passed on my device... but it's not an issue at all for me...
Unfortunately, doesn't fix the Titanium Backup issue (freezing or restoring app) for me on Galaxy S6 Android 6.0. This also broke SafetyNet for me, even after uninstalling the module from Xposed and rebooted.
chaoscreater said:
Unfortunately, doesn't fix the Titanium Backup issue (freezing or restoring app) for me on Galaxy S6 Android 6.0. This also broke SafetyNet for me, even after uninstalling the module from Xposed and rebooted.
Click to expand...
Click to collapse
If you mean you are using xposed, obviously safetynet will be broken. MagiskHide couldn't hide xposed.
This module tries to fix the su detectable problem. If your titanium backup could get root permission after installing the module, it means the module worked.
My TB is working fine, but I have another app that can't detect it, will give it a test run, thanks for your work!
HI! Just a quick feedback: this module works with Helium Backup that now correctly asks for root permission! :good:
Thank you!
Thanks for the module!! It was the key for me getting Termux su working ?
Hello, I flashed this without error and titanium backup as well as ES file explorer both report I do not have root. Magisk v12 states i do have root.
nevermind...i realized Magisk SU isn't installed as it didn't auto install. I had installed phh's superuser r266-2.
proceeded to rewipe and reflash everything.
Nexus 6P
[ROM][6P][7.1.2_r8]★ Pure Nexus ★ Substratum | Fi | WiFi Calling ★[05/09/17]
ex 4.09
Magisk v13 beta
no issues and all superuser root requests appear.
Big big BIG THANK YOU to you. Fixed the most important app for custom ROMs- Kernel adiutor:highfive: (Both play store:good: and modded versions:laugh and secure settings tasker plugin
Please update the script for the new template v4 for Magisk v13!
:good:
If *enabled* in magisk 13, titanium backup can't get root.
I had to disable it.
Hi,
Work with Magisk Version 13.3 ???

Tanix tx3 mini Magisk hide not working

hi guys,
i write you to have a support about magisk hide, on my Tanix Tx3 with firmware Build version: 20181210.
In particular i have installed magisk on my device with TWRP to hide the root permission at some application but this dosn't work correctly.
To hide the root permission on magisk I have make following steps:
to
installed magisk with TWRP
activated "magisk hide" from setting of magisk manager and then i have reboot the device;
inserted on section "migisk hide" the application "root checker" and then i have reboot the device;
checked with root checker application if magisk hide the root but the application (root checker) has detected root permissions
[/ LIST]
Furthemore, I tried to activated magisk hide from terminal emulator with "props" module but when i tried to verify the root permission on root check the result is the same.:crying:
in attach you can find the log by magisk, if it can help you to solve the problem
thanks lot
First thing to try is repackaging the Manager with a random name (it's in the Manager settings). More things to look at: https://www.didgeridoohan.com/magisk/MagiskHide#hn_Hiding_root_from_apps
And:
https://www.didgeridoohan.com/magisk/MagiskHide#hn_MagiskHide_Issues
And you'll have to upload your log some other way, since you can't attach files with so few posts.
Tanix TX3-H factory root hide?
I have Tanix TX3-H factory root device... It allows you to root device in android simply check option allow root...
So I installed magisk... Done all steps to hide root...
Even i hide it from playstore, playssrvices and framework...
So how to find that root access and hide it... Because here is not magisk problem.. Here is factory stock firmware root option.. If anybody have knowledge and expirience with stock root how to locate it and add it in magisk to hide...
BlueMan_86 said:
I have Tanix TX3-H factory root device... It allows you to root device in android simply check option allow root...
So I installed magisk... Done all steps to hide root...
Even i hide it from playstore, playssrvices and framework...
So how to find that root access and hide it... Because here is not magisk problem.. Here is factory stock firmware root option.. If anybody have knowledge and expirience with stock root how to locate it and add it in magisk to hide...
Click to expand...
Click to collapse
There's nothing Magisk can do about that. You would have to remove the built-in root.
How? No idea... If you're lucky @osm0sis' unSU script will work (all depends on how it's rooted):
https://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133/post63615067
Didgeridoohan said:
There's nothing Magisk can do about that. You would have to remove the built-in root.
How? No idea... If you're lucky @osm0sis' unSU script will work (all depends on how it's rooted):
https://forum.xda-developers.com/apps/supersu/2014-09-02-supersu-v2-05-t2868133/post63615067
Click to expand...
Click to collapse
It have system root option built in... So must be some way some sistem app that when is hidden by magisk will stop that...
BlueMan_86 said:
It have system root option built in... So must be some way some sistem app that when is hidden by magisk will stop that...
Click to expand...
Click to collapse
That's not how MagiskHide works. Magisk can't hide apps, it only hides itself from other apps and services.
Didgeridoohan said:
That's not how MagiskHide works. Magisk can't hide apps, it only hides itself from other apps and services.
Click to expand...
Click to collapse
There is option HIDE... And you can hide root from various apps.. Even from root checker
Sent from my BKL-L09 using Tapatalk
BlueMan_86 said:
There is option HIDE... And you can hide root from various apps.. Even from root checker
Sent from my BKL-L09 using Tapatalk
Click to expand...
Click to collapse
Yes there is, but again:
Magisk can only hide itself, it's own root and modules and the Manager. NOT any other root or other apps. Period.

Many app detecting root even saftynet pass

I am using oneplus 6 with latest oos magisk 19.3
Banking app like sbi anywhere, icici detecting root can't use upi.
Also adadhar app detecting root event safety net pass already done magisk hide
Can some help me there or use other versions of magisk
Please help
android_smater said:
I am using oneplus 6 with latest oos magisk 19.3
Banking app like sbi anywhere, icici detecting root can't use upi.
Also adadhar app detecting root event safety net pass already done magisk hide
Can some help me there or use other versions of magisk
Please help
Click to expand...
Click to collapse
Use Hide Magisk manager in settings or Core only mode.
Sent from my MI 8 using Tapatalk
Dexer125 said:
Use Hide Magisk manager in settings or Core only mode.
Sent from my MI 8 using Tapatalk
Click to expand...
Click to collapse
Didn't work either. I guess will have to wait for an update. I have tried so far:
Settings > Magisk Core Only More - On
Magisk Hide - Check against the banking app
Clear app cache
Reboot
Also - Magisk v19.3, Magisk Manager v7.3.1(222)
gagan007 said:
Didn't work either. I guess will have to wait for an update. I have tried so far:
Settings > Magisk Core Only More - On
Magisk Hide - Check against the banking app
Clear app cache
Reboot
Also - Magisk v19.3, Magisk Manager v7.3.1(222)
Click to expand...
Click to collapse
disable developer mode?
and you need to hide magisk manager itself.not just magisk hide.
Try executing
Code:
su -c chmod 000 /proc/net/unix
in a terminal. Several banking apps now use a very stupid and shaky root detection heuristic that is circumvented in this way.
(see https://github.com/Ingan121/UDSBypass).
A banking app on my phone (keytradebank, belgian bank) worked fine with Magisk Hide but after an update stopped working.
Disabling read access to /proc/net/unix did the trick for me!
Looked it up, this rootbeerFresh code is really brain-dead, even the presence of busybox will make isRooted() return true
No concern for false positives at all.
el_perro said:
A banking app on my phone (keytradebank, belgian bank) worked fine with Magisk Hide but after an update stopped working.
Disabling read access to /proc/net/unix did the trick for me!
Looked it up, this rootbeerFresh code is really brain-dead, even the presence of busybox will make isRooted() return true
No concern for false positives at all.
Click to expand...
Click to collapse
Remember that app says it COULD be root.
If anyone is paying attention to it yet.
Also
https://www.didgeridoohan.com/magis...and_other_apps_wont_install_or_doesnt_show_up
Busybox
Some apps detect Busybox and see this as a sign of your device being compromised (rooted). Magisk should be able to hide any Busybox installed as a Magisk module. osm0sis has a great Busybox module available in the Magisk repo (install from the Magisk Manager, under "Downloads").
Figuring out if an app has dependencies, looks for "sensitive props", Busybox, etc
It can be tricky figuring out if an app is dependent on another app or process for detecting root, expects certain prop values, doesn't like Busybox or whatever is triggering a root warning within the app. Apart from trying one thing/prop at a time, finding this out could mean you have to decompile the apk to look at the source code (use search), grab a logcat when the app is detecting root, etc.
Detecting apps requiring root
There are apps that detect known apps that require root and refuse to work properly or even start if that is the case. Usual suspects include (but aren't limited to) busybox apps, Xposed installer, root hiding apps, etc.
This can be worked around by uninstalling or possibly freezing (Titanium Backup can do this, among others) the offending root app when you need to use an app detecting root apps and reinstalling/unfreezing it afterwards. Cumbersome, but it might work. There are also some Xposed modules that can hide apps from other apps, but having Xposed installed might cause other issues with tampering detection...
@mrspeccy Thank you for pointing out that workaround. Works for me too for the Keytrade app
el_perro said:
A banking app on my phone (keytradebank, belgian bank) worked fine with Magisk Hide but after an update stopped working.
Disabling read access to /proc/net/unix did the trick for me!
Looked it up, this rootbeerFresh code is really brain-dead, even the presence of busybox will make isRooted() return true
No concern for false positives at all.
Click to expand...
Click to collapse
How did you do that?
su -c chmod 000 /proc/net/unix didn't work for me.
robuser007 said:
How did you do that?
su -c chmod 000 /proc/net/unix didn't work for me.
Click to expand...
Click to collapse
yes, in a terminal on your phone or using 'adb shell'
be aware it's not a permanent fix, a reboot will restore the old permissions on /proc/net/unix
so you have to remove read access after every reboot.
Quite clumsy.
To make this easier on the go, I installed termux, created in the home directory a small file 'hide' with the one-liner,
Code:
su -c chmod 440 /proc/net/unix
Note: 000 works just as well, but 440 is closer to the original permission and works too.
so after a reboot i open termux terminal and type the command
Code:
. hide
gagan007 said:
Didn't work either. I guess will have to wait for an update. I have tried so far:
Settings > Magisk Core Only More - On
Magisk Hide - Check against the banking app
Clear app cache
Reboot
Also - Magisk v19.3, Magisk Manager v7.3.1(222)
Click to expand...
Click to collapse
Thanks it work...
Got that app working successfully today. Hiding Magisk itself worked I guess. I locked bootloader also.
android_smater said:
I am using oneplus 6 with latest oos magisk 19.3
Banking app like sbi anywhere, icici detecting root can't use upi.
Also adadhar app detecting root event safety net pass already done magisk hide
Can some help me there or use other versions of magisk
Please help
Click to expand...
Click to collapse
Try these...
1. From your magisk, install these 2 modules: Riru - Core, and Riru - EdXposed (Sandbox or Yahfa is okay]
2. Reboot your device to activate both modules.
3. Install Xposed Installer APK by DVDandroid. You can get it here: https://dl-xda.xposed.info/modules/d...v33_36570c.apk
4. Reboot to activate the Xposed Installer app
5. Inside Xposed Installer app, go to downloads and install the HiddenCore Module.
6. Reboot and go back to Magisk, and hide.
7. Test to see if everything is now okay.
wittymav said:
Try these...
1. From your magisk, install these 2 modules: Riru - Core, and Riru - EdXposed (Sandbox or Yahfa is okay]
2. Reboot your device to activate both modules.
3. Install Xposed Installer APK by DVDandroid. You can get it here: https://dl-xda.xposed.info/modules/d...v33_36570c.apk
4. Reboot to activate the Xposed Installer app
5. Inside Xposed Installer app, go to downloads and install the HiddenCore Module.
6. Reboot and go back to Magisk, and hide.
7. Test to see if everything is now okay.
Click to expand...
Click to collapse
Nope! It Doesn't Work With SBI YONO Or BHIM.
My Cofidis app also keeps detecting root.
Have latest version magisk, latest version of magiskmanager and renamed it. Magisk is hidding. App is in magisk hide list.
chmod suggestion did not work
Running latest version of lineageos on my htc u11. I think the issues started when I installed the latest build (11/08).
Any suggestions to fix this?
Same issue here with this app:
https://play.google.com/store/apps/details?id=eu.mobeepass.nfcniceticket
Is there any way to troubleshoot what triggers the root detection?
Ps24u said:
Same issue here with this app:
https://play.google.com/store/apps/details?id=eu.mobeepass.nfcniceticket
Is there any way to troubleshoot what triggers the root detection?
Click to expand...
Click to collapse
Using my app VD INFOS you can see every detectable thing. (Root/Magisk/Xposed/Riru/and others.)
And then you can fix what needs to be fixed.
[APP][v1.10] VD Infos (Package: com.vitaodoidao.vdinfos)
(Para quem fala PORTUGUÊS, o próximo post está totalmente traduzido !) VD Infos v1.10 As we all know, Android is a super powerful and super versatile operating system. What nobody tells you is that all your personal details and confidential...
forum.xda-developers.com

[MODULE] InitRcHider

Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.
Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.
I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
mrspeccy said:
Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.
Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.
I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
Click to expand...
Click to collapse
Thanks a lot. I have been searching for a while since I moved to use Zygisk and finally found this post.
However, do you know if there is any reliable detector about init.rc hiding? I've been using MagiskDetector. While it correctly showed that init.rc was not modified after installing your module, after a day or two it would suddenly report modified init.rc. I've read posts saying MagiskDetector is not accurate as it sometimes reports this even if magisk is not installed. I just want to make sure init.rc has been correctly hidden. Thanks.
You're welcome. My module just runs the same code as riru-momohider for hiding init.rc modficiations. The sudden detection you mention may be a false positive of MagiskDetector. Since I installed the module (under Magisk Zygisk) the security app that checks for init.rc modifications never reported "root found" again. I do not know of any other detectors for init.rc modifications.
mrspeccy said:
You're welcome. My module just runs the same code as riru-momohider for hiding init.rc modficiations. The sudden detection you mention may be a false positive of MagiskDetector. Since I installed the module (under Magisk Zygisk) the security app that checks for init.rc modifications never reported "root found" again. I do not know of any other detectors for init.rc modifications.
Click to expand...
Click to collapse
I see. Thanks for your reply.
Hi, I begin to think it is not a false positive from MagiskDetector when it shows init.rc is modified by Magisk. Because the work profile in my phone has very strong root detection logic, and I just now it detected root and wiped out my work profile automatically
While other bank apps, root checkers, and even Momo could not detect at that moment, MagiskDetector did report init.rc modified.
I saved the logs from MagiskDetector when 1) it did not report init.rc modified and 2) it reported init.rc modified and compared the details. What I found is that there is a line in the log from 2) which is not there in 1) :
svc name init.svc.mdnsd
Any idea what this service is and is it supposed to be hidden by InitRcHider?
mrspeccy said:
....The sudden detection you mention may be a false positive of MagiskDetector.......I do not know of any other detectors for init.rc modifications.
Click to expand...
Click to collapse
dohanin said:
....I begin to think it is not a false positive from MagiskDetector when it shows init.rc is modified by Magisk....What I found is that there is a line in the log from 2) which is not there in 1): svc name init.svc.mdnsd...
Click to expand...
Click to collapse
i installed the module. it didn't work on reboot. i mean, MagiskDetector app reported 'modified'. i then cleared cache and data for MagiskDetector and ran the app; it asked me to 'reboot and try', which i did. now, it says 'not modified'. thanks!
mrspeccy said:
Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.
Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.
I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
Click to expand...
Click to collapse
It works, thanks.
yes, clearing data and cache of MagiskDetector sometimes work, but sometimes I had to re-install initrchider module in Magisk as well.
still puzzled on why after it worked, after a day or two, MagiskDetector would suddenly report Init.rc modified, without me changing anything or even reboot
dohanin said:
yes, clearing data and cache of MagiskDetector sometimes work, but sometimes I had to re-install initrchider module in Magisk as well.
still puzzled on why after it worked, after a day or two, MagiskDetector would suddenly report Init.rc modified, without me changing anything or even reboot
Click to expand...
Click to collapse
Apparently does this without magisk even installed which is why canyie commented that test in MagiskDetector is broken... When asked by @osm0sis if will be fixed vvb2060 said MD is deprecated / he she is working on Momo now... PW
mrspeccy said:
Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.
Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.
I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
Click to expand...
Click to collapse
On Android 11+, there maybe also init.svc_debug_pid.******
need resetprop --delete init.svc_debug_pid.$1
Work this Samsung Android 8.0, 9.0 Pie ?
This module does not work on Samsung Galaxy S7 edge Custom Pie 9.0 Rom, module active and magisk detector app and momo app shows nothing hidden
Zygisk - Shamiko lastest version now includes hiding init
huskydg said:
Zygisk - Shamiko lastest version now includes hiding init
Click to expand...
Click to collapse
Magisk Detector Test still show "init.rc has been modified by Magisk". Any configue.
z1022 said:
Magisk Detector Test still show "init.rc has been modified by Magisk". Any configue.
Click to expand...
Click to collapse
Detect modified init.rc is not always correct, so i think nearly there are no app detect it
Magisk detector shows once hidden init.rc and over time shows modified. The most reliable application detecting system modifications is MOMO 4.0.1 APP, it always shows if init.rc is modified, and if not it does not.
Spartacus500 said:
Magisk detector shows once hidden init.rc and over time shows modified. The most reliable application detecting system modifications is MOMO 4.0.1 APP, it always shows if init.rc is modified, and if not it does not.
Click to expand...
Click to collapse
I use MOMO 4.0.1 APP, it shows init.rc is modified. How can I fix it ? If I have already used Shamiko and InitRChider.
z1022 said:
I use MOMO 4.0.1 APP, it shows init.rc is modified. How can I fix it ? If I have already used Shamiko and InitRChider.
Click to expand...
Click to collapse
What phone model do you have ? I have Samsung Galaxy S7 edge 9.0 Pie and on Shamiko module it doesn't hide init.rc.
Just ignore because detect init.rc not always correct. I don't use initrc hider but momo don't detect it
mrspeccy said:
Several banking and security apps discover system modifications that Magisk injects through the init.rc file. These modifications can be successfully hidden with MomoHider (https://github.com/canyie/Riru-MomoHider), however, that module requires the Riru framework, which is incompatible with the upcoming Zygisk version of Magisk (e.g. Canary 23015). Therefore, I made a module that exclusively runs the init.rc hiding code from MomoHider without requiring Riru. See the attached file.
Just flash the module through the Magisk app. There are no configuration options. If the module is active, the init.rc hiding code is run.
I use the module to hide my custom Android ROM and Magisk from a recent app developed by the Danish Agency for Digitisation.
Click to expand...
Click to collapse
Hi @mrspeccy,
is your module source somewhere public? The Module is not working on my Device (AL10 Oreo 8.0.0) so I would like to look into it. Also it seems to be a good starting point for another Module Project. Injecting custom *.rc and fstab files without editing the ramdisk image.
Cheers
NewBit

Categories

Resources