Database Develop

Apps refuse to start because phone being rooted but it isn't!

At least 2 of my Apps refuse to start. One is my banking app and they do not offer any other way of interaction.
The problem is that the phone in fact is not rooted! It's just "OEM unlocked" to be prepared for root (which I need for E.g. titanium backup, but only maybe once a month).
Please give me a way out of this vicious circle!
I cannot remove the OEM unlock because it requires full wipe every time. Or is there a way?
Or what can I possibly tell the App Provider to improved their Code so that Oneplus phone state is being recognized (more) correctly?
Any help would be greatly appreciated.

Use Magisk I guess? Use it to hide root from that app.

Reeb_Lam said:
Use Magisk I guess? Use it to hide root from that app.
Click to expand...
Click to collapse
In fact I already flashed an official image and still (with no zip installed via TWRP) I'm getting refusals from these apps.
So for sure some apps decide from something else then simply an installed "root" manager or the installed "su" binaries.
What else could they decide from? "OEM unlock" was my first guess (and it would also be the worst, because as far as I know it can't be "hidden" temporarily, or can it?), but maybe there are other settings. Does anybody know more?

ako673de said:
In fact I already flashed an official image and still (with no zip installed via TWRP) I'm getting refusals from these apps.
So for sure some apps decide from something else then simply an installed "root" manager or the installed "su" binaries.
What else could they decide from? "OEM unlock" was my first guess (and it would also be the worst, because as far as I know it can't be "hidden" temporarily, or can it?), but maybe there are other settings. Does anybody know more?
Click to expand...
Click to collapse
You need to do some reading about Safetynet. If you're OEM unlocked you fail Verified Boot checks. Most custom Kernels include a bypass for this. Magisk alone should also work. I think you missed one important step:
Open Play Store Settings. Scroll down. It says 'Uncertified' at the bottom, right? Now install and set up Magisk. Go to system App Settings and clear Data and Cache for Play Store. Return to the Play Store Settings and scroll down. Now it should say 'Certified'. It might not be immediate, but it will happen. Now your Banking Apps work.
If you don't want, or have no luck with Magisk, simply flash a Custom Kernel that bypasses Verified Boot, and works with OOS.
Simple.

Thank you. That was for sure a major part of the overall issue. Unfortunately it didn't yet fix it. I'm now certified in play store and magisk succeeds with both safety net checks (which however it also did before). And root is disabled in magisk. dm-verity does not show the warning during Boot and the Check itself should be disabled (I followed the recommendation in another Thread to Patch the Boot Image).
Anything else you can imagine?

ako673de said:
Thank you. That was for sure a major part of the overall issue. Unfortunately it didn't yet fix it. I'm now certified in play store and magisk succeeds with both safety net checks (which however it also did before). And root is disabled in magisk. dm-verity does not show the warning during Boot and the Check itself should be disabled (I followed the recommendation in another Thread to Patch the Boot Image).
Anything else you can imagine?
Click to expand...
Click to collapse
Link to other Thread?
I don't know Magisk but are you hiding Root from your Banking App? Have you cleared Data and Cache for the Banking App since getting Certified?

First my phone did not Boot any more after installing superSU. Fixed that by patching Boot.img (to disable dm-verity) according to this thread: https://forum.xda-developers.com/oneplus-3t/how-to/disable-dm-verity-force-encryption-op3t-t3688748
Now data and cache of all (now) 3 affected Apps has been cleared and Magisk is configured to be hidden for them, but still no change.
However, in Magisk there is the "extended" option "AVB 2.0/keep dm-verity", which is unticked. I'm not sure, should I try to set it?
Any other idea?

ako673de said:
Any other idea?
Click to expand...
Click to collapse
Nope. If Play Store says Certified you should be good to go. I can only imagine it's a Magisk issue. Post screenshots of your config and let the Magisk experts pick through them. Maybe there's something not set up correctly.

ako673de said:
First my phone did not Boot any more after installing superSU. Fixed that by patching Boot.img (to disable dm-verity) according to this thread: https://forum.xda-developers.com/oneplus-3t/how-to/disable-dm-verity-force-encryption-op3t-t3688748
Now data and cache of all (now) 3 affected Apps has been cleared and Magisk is configured to be hidden for them, but still no change.
However, in Magisk there is the "extended" option "AVB 2.0/keep dm-verity", which is unticked. I'm not sure, should I try to set it?
Any other idea?
Click to expand...
Click to collapse
Hide Magisk Manager. I had to do that to get my banking app to work.
Edit: you may need to reboot after hiding Magisk Manager and clear you banking app's data before it works.
Sent from my OnePlus3T using XDA Labs

Thank you, indeed that WORKED! Well, at least for 2 out of 3 Apps. I think I can tell which one: "HVB banking". Maybe could somebody cross-check this one on his/her phone?

After firmware update to OOS 5.0.5 I now have the problem that my PlayStore can no longer be convinced in any way to show that it's certified. But interestingly my banking Apps work (currently really no root app installed). I even waited for one day because earlier in this thread somebody mentioned that it might take awhile. Is there anything special I need to care about under the new OS version?

ako673de said:
After firmware update to OOS 5.0.5 I now have the problem that my PlayStore can no longer be convinced in any way to show that it's certified. But interestingly my banking Apps work (currently really no root app installed). I even waited for one day because earlier in this thread somebody mentioned that it might take awhile. Is there anything special I need to care about under the new OS version?
Click to expand...
Click to collapse
Did you reflash custom kernel after update?

I'm not using any. What I did right after the update is to disable dm-verity (with a patched boot.img), like I did last time. But magisk is not yet re-installed because I wanted to see at least once the HypoVereinsbank App working, which it in fact does (different to last time when the phone was not rooted as well, and the store not certified!).

ako673de said:
But magisk is not yet re-installed
Click to expand...
Click to collapse
That's why... You can't pass the ctsProfile check if your bootloader is unlocked, and if you can't pass the ctsProfile check the Play Store won't be certified. You need Magisk for that...

Now I'm getting confused. The initial mail of this thread explains the situation as it was when I opened this thread:
--> Original ROM, no root, and banking apps didn't work <--
The advice to clear data of the PlayStore immediately brought the PlayStore back to "certified".
This is clearly in contrast to what you're saying now.
I can imagine only one reason: Maybe the older PlayStore had a bug and therefore was able to "certify" even with unlocked bootloader?
Sidenote: My main intention to do the firmware upgrade was that the "safety net checks" in Magisk suddenly stopped working one day (with the error message "invalid response", most probably you know what I'm talking about, I've read some comments from you on this issue). Therefore it's maybe really not too unlikely that Google has changed something very basic. Could you please confirm?
Edit: Now magisk is back, version 16.7, and in fact PlayStore is back to "certified" AND now even the HypoVereinsbank App works. Just one thing remains: magisk safety net check still says "invalid response" (after it downloaded some "FOSS" code, which it didn't do last time, when it was still working).

ako673de said:
Edit: Now magisk is back, version 16.7, and in fact PlayStore is back to "certified" AND now even the HypoVereinsbank App works. Just one thing remains: magisk safety net check still says "invalid response" (after it downloaded some "FOSS" code, which it didn't do last time, when it was still working).
Click to expand...
Click to collapse
https://www.didgeridoohan.com/magisk/MagiskHide#hn_The_response_is_invalid

Sorry, now comes a probably often asked question: do I need the safetynet check option in magisk for something real? Or do the alternative apps fulfill all possible needs? What are these needs? Isn't that exactly what the PlayStore does to determine "certified"?

After quite some months of absolutely no "root" problems with any of my apps, since today o2banking again doesn't work.
I tried to update Magisk, but after update of the Magisk manager app to v7.1.1(203) it reports that Magisk is not installed at all, and any update of Magisk itself resulted in just the same. So I reverted back to v6.1.0(165) and everything seems to be okay, except that o2banking doesn't work. SafetyNet is clean, Magisk is hidden for o2banking and Magisk manager is repacked.
Does anybody know what the problem might be? Especially with that new version of the manager app, but also with Magisk v19.0 which cannot be installed from v6.1.0 (max. is v18.1). Any ideas welcome! I'm now on OOS 5.0.8 by the way.
SOLVED it myself: As mentioned somewhere in the update FAQ of Magisk there was a bug in manager v6.1.0 that causes the updated v7.1.1 to co-exist with the old version if the old version has been re-packed. If anybody encounters the same problem, the solution is at the bottom of this page: https://www.didgeridoohan.com/magisk/ManagerIssues.
o2banking will then still not work. Update to v19.0 is mandatory. But that is no problem then any more...

probably your banking app identified oxygen os as custom rom and have root. 1 out of 3 banking app in my phone doesn't work with lineageos even though i already hide magisk, but when running oxygen os with magisk hide, and also hide magisk manager (turn it on in magisk manager setting) all 3 banking app work just fine. maybe try sending a message to bank app developer to add oxygen os as exception.

Did you notice my edit? It was a problem with magisk manager update and magisk main version. Now everything is back up and running.

why do I keep losing root until I reboot?

I have the latest Magisk and Magisk Manager installed and it works perfectly for a while until it says "Magisk not installed." in red letters. When I reboot I have root again. Any ideas what is happening here? I'm on the latest OTA of stock ROM.

This happens since xx.13 version of Stock ROM, at least on my device.
I have fully uninstalled Magisk 7 hours ago, and reinstalled again. Currently still having root. Reinstalled the same version 17.4 (Beta)
Whatever the problem may be i suspect its Magisk hide. Since I am on a different "experiment" at the moment, would you volunteer in disabling Magisk hide?

I am here to report that a fresh reinstallation of Magisk did not solve the issue

Trying latest canary as of writing

Yeah, it's a weird issue. It hasn't happened since I made the original post. I do use Magisk Hide for a few apps so that may be what's triggering it. I'm not sure. I haven't noticed a pattern yet as to what seems to trigger the loss of root.

I am on Canary and root loss still happens. Ok going to disable Magisk Hide and hopefully i need not to use the bank apps for two days

It just happened again on my device. :-\

I have disabled Magisk Hide since i made the last post. I can confirm root loss did not happen.
It's counter intuitive to use Magisk without Magisk Hide. Hmm.

JFYI: never happened here in 3 weeks on stock 10.0.14.0 with Magisk 19.4 and MagiskManager 7.3.4; was regularly happening on stock 10.0.13.0 with Magisk 19.3 and MagiskManager 7.3.2.

I just started to happen with me. I've found out that it's something with magisk hide, once deactivated the problem stopped, but now I have a new one xD

Since my last post, I enabled Magisk hide, but stopped hiding magisk from Play Services. So far no root loss. Perhaps OP could try this too, if play services is indeed in your hide list.
---------- Post added at 03:27 PM ---------- Previous post was at 03:27 PM ----------
Aerobatic said:
JFYI: never happened here in 3 weeks on stock 10.0.14.0 with Magisk 19.4 and MagiskManager 7.3.4; was regularly happening on stock 10.0.13.0 with Magisk 19.3 and MagiskManager 7.3.2.
Click to expand...
Click to collapse
I have this issue since 10.0.13.0, and after updated to 10.0.14.0. In fact, I have even clean flashed stock 10.0.14.0 and the issue persisted regardless.
xdxita said:
I just started to happen with me. I've found out that it's something with magisk hide, once deactivated the problem stopped, but now I have a new one xD
Click to expand...
Click to collapse
What is the new problem? ?

I just noticed my error in writing just now. I didn't clean flash .14, but rather formatted /data (hard reset).
Posting as a new post instead of edit because it has been hours [emoji3061]
And yes, as of writing this one, i still have root.

Note9 Randomly Reboots and Partly Goes Back to a Previous State

Hey guys!
I recently flashed my Galaxy Note9 (SM-N960F, One UI 2.5) with TWRP and Magisk, all being the latest version. However my phone would just reboot randomly and I could barely find a pattern. I could only infer that the reboot is system level since most of the time I was launching a system-level app like Bixby, Torch, or just simply swipe down the notification panel. If related, 19:30 seems to be the time my phone would definitely reboot recently.
By ''partly goes back to a previous state' I mean some of my apps would be replaced to their factory version. Like I used YouTube Vanced, and after this one reboot it went back to its factory version. And Gboard was exiled of all its permissions once. My Edge Panel was reset after one boot. Some of the adb tweaks were reset.
I'm half sure this is a kernel problem, and the only modifications I did to my kernel were Magisk and Universal DM-Verity. I don't know if it's a DM-Verity problem.
I tried to disable my root permission for apps but it didn't help. Also Googled how to catch system logs but none of these worked.
If you're experiencing the same problem or have an idea of how to solve this issue please feel free to leave a comment!

Maspon said:
Hey guys!
I recently flashed my Galaxy Note9 (SM-N960F, One UI 2.5) with TWRP and Magisk, all being the latest version. However my phone would just reboot randomly and I could barely find a pattern. I could only infer that the reboot is system level since most of the time I was launching a system-level app like Bixby, Torch, or just simply swipe down the notification panel. If related, 19:30 seems to be the time my phone would definitely reboot recently.
By ''partly goes back to a previous state' I mean some of my apps would be replaced to their factory version. Like I used YouTube Vanced, and after this one reboot it went back to its factory version. And Gboard was exiled of all its permissions once. My Edge Panel was reset after one boot. Some of the adb tweaks were reset.
I'm half sure this is a kernel problem, and the only modifications I did to my kernel were Magisk and Universal DM-Verity. I don't know if it's a DM-Verity problem or I just disabled too many system apps (Galaxy Themes, Bixby Service, Galaxy Friends and stuff).
I tried to disable my root permission for apps but it didn't help. Also Googled how to catch system logs but none of these worked.
Whether you're experiencing the same problem or have an idea of how to solve this issue please feel free to leave a comment!
Click to expand...
Click to collapse
Happened to me as well few months ago.
I suspect it is related to safetynetfix or hideprop. I used safetynetfix for samsung, and update latest hideprop, now i never experienced the random reboot.

xfakexbloodx said:
Happened to me as well few months ago.
I suspect it is related to safetynetfix or hideprop. I used safetynetfix for samsung, and update latest hideprop, now i never experienced the random reboot.
Click to expand...
Click to collapse
Thanks for the reply! I just flashed Universal SafetyNet Fix. Now my phone is stuck in bootloop. It would just reboot infinitely. May I possibly get the SafetyNet Fix you're using?

Maspon said:
Thanks for the reply! I just flashed Universal SafetyNet Fix. Now my phone is stuck in bootloop. It would just reboot infinitely. May I possibly get the SafetyNet Fix you're using?
Click to expand...
Click to collapse
Based on this post
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Try to read each page, some people say it works, some people say it doesn't. I've tried and updating my magiskhide prop and it works.

xfakexbloodx said:
Based on this post
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Try to read each page, some people say it works, some people say it doesn't. I've tried and updating my magiskhide prop and it works.
Click to expand...
Click to collapse
Thanks a lot! My phone now boots normaly and it's a Success on SafetyNet. Hope no more random reboots afterwards.
I'm particularly curious what variant of DM-Verity did you use? I googled for DM-Verity for Samsung this morning and did get a Samsung-only patch. I'm not sure if DM-Verity patch could contribute to these reboots.

Maspon said:
Thanks a lot! My phone now boots normaly and it's a Success on SafetyNet. Hope no more random reboots afterwards.
I'm particularly curious what variant of DM-Verity did you use? I googled for DM-Verity for Samsung this morning and did get a Samsung-only patch. I'm not sure if DM-Verity patch could contribute to these reboots.
Click to expand...
Click to collapse
Sorry no idea about that. I'm using alexis rom though..

xfakexbloodx said:
Sorry no idea about that. I'm using alexis rom though..
Click to expand...
Click to collapse
Sadly my phone still rebooted this morning. I caught the last kernel message and I hope it will help

The right A12 ROMs rooting procedure

After searching the forum thoroughly, trying multiple found solutions and trying to find the answer on my own I decided to ask here. What is the right procedure to clean flash A12 AOSP-based roms and getting root?
Some time ago, after updating to A11 rom, I noticed I can't use Magisk the way I used to to root my device - 'no ramdisk' status made me forget about rooting for a while. Now I want it back at any cost. This is why I want you to answer some of my questions, including the one above:
1. Is 'ramdisk: no' status caused by A11 and above versions?
2. Is there a way to have ramdisk status 'yes' on A12 ROM to root the device without having to patch boot.img?
3. Magisk installation doc has totally different way of rooting in my situation. According to it, for ramdisk status 'no' the only solution is 'Magisk in Recovery'. However, every time I saw someone talk about no ramdisk magisk patching, they were patching the boot image - it works fine and is even suggested by Magisk app. Who is wrong here and which solution is the right one?
4. Is there a way to get SafetyNet to pass on patched boot.img? Is there a way to get it to pass on a rooted A12 rom?
5. Some time ago, I have accidentally flashed european vendor instead of chinese one (I own chinese K20 Pro). I had no problems with it so I ran it for a few months and then flashed it back to chinese. Might this be the source of ramdisk issue?
Big thank you to anyone who replies. I have no important data on my device so there is no need for a data-safe solution. I feel like existing flashing/rooting guides seem outdated as they mention A10 at best. After more than 2 years of owning this device I still love it and am not going to replace it anytime soon and I hope there are still people like me! Cheers!

deadw0lf said:
After searching the forum thoroughly, trying multiple found solutions and trying to find the answer on my own I decided to ask here. What is the right procedure to clean flash A12 AOSP-based roms and getting root?
Some time ago, after updating to A11 rom, I noticed I can't use Magisk the way I used to to root my device - 'no ramdisk' status made me forget about rooting for a while. Now I want it back at any cost. This is why I want you to answer some of my questions, including the one above:
1. Is 'ramdisk: no' status caused by A11 and above versions?
2. Is there a way to have ramdisk status 'yes' on A12 ROM to root the device without having to patch boot.img?
3. Magisk installation doc has totally different way of rooting in my situation. According to it, for ramdisk status 'no' the only solution is 'Magisk in Recovery'. However, every time I saw someone talk about no ramdisk magisk patching, they were patching the boot image - it works fine and is even suggested by Magisk app. Who is wrong here and which solution is the right one?
4. Is there a way to get SafetyNet to pass on patched boot.img? Is there a way to get it to pass on a rooted A12 rom?
5. Some time ago, I have accidentally flashed european vendor instead of chinese one (I own chinese K20 Pro). I had no problems with it so I ran it for a few months and then flashed it back to chinese. Might this be the source of ramdisk issue?
Big thank you to anyone who replies. I have no important data on my device so there is no need for a data-safe solution. I feel like existing flashing/rooting guides seem outdated as they mention A10 at best. After more than 2 years of owning this device I still love it and am not going to replace it anytime soon and I hope there are still people like me! Cheers!
Click to expand...
Click to collapse
Although Magisk official guide on Github is not clear about, for MIUI you should patch boot.img, not recovery, and do not pay attention to Ramdisk no.
However, when patching boot.img, watch to the log window and you will see it reports there that it found Ramdisk
And that procedure works fine on A11 as well - I have it (MIUI 12.5.2 on my side)
I suppose you have the official A11 and you installed over custom A12 ROM).
Old Magisk v23 was released before A12, hence you should IMO go for the new Canary or Alpha 23016
Btw, you will be IMO better askung in the Magisk General XDA thread

zgfg said:
Although Magisk official guide on Github is not clear about, for MIUI you should patch boot.img, not recovery, and do not pay attention to Ramdisk no (when patching boot.img, watch to the log window and you will see it reports that it found Ramdisk)
And that procedure works fine on A11 as well - I have it (I suppose you have the official A11 and you installed over custom A12 ROM)
However, old Magisk v23 was released before A12, hence you should IMO go for the new Canary or Alpha 23016
Btw, you will be IMO better askung in the Magisk General XDA thread
Click to expand...
Click to collapse
Thank you for replying.
I am aware of Magisk Canary, I used it to root my current A12 rom. Yes, I flashed it over the latest chinese MIUI firmware. Is there any way to pass SafetyNet with it though?

deadw0lf said:
Thank you for replying.
I am aware of Magisk Canary, I used it to root my current A12 rom. Yes, I flashed it over the latest chinese MIUI firmware. Is there any way to pass SafetyNet with it though?
Click to expand...
Click to collapse
If you are on Canary 23016 (latest), you must enable Zygisk, and reboot
Then enable Enforce DenyList and go to Configure DenyList, enable Show System and OS apps, find Google Play Services and checkmark com.google.android.gms and
com.google.android.gms.unstable, and reboot again
If you were on the official, certified ROM, that would be enough to pass SafetyNet (since new Magisk app has no more the built-in SN checker, use one from PlayStore like YASNAC)
With your custom ROM you would probably need Universal Safety Net Fix= USNF 2.2.1 (latest).
Maybe even Magisk Hide Props Config (if USNF not enough) to spoof your unofficial/not Google certified ROM fingerprints - you will need to figure out (pain in the ass with custom ROMs)

zgfg said:
If you are on Canary 23016 (latest), you must enable Zygisk, and reboot
Then enable Enforce DenyList and go to Configure DenyList, enable Show System and OS apps, find Google Play Services and checkmark com.google.android.gms and
com.google.android.gms.unstable, and reboot again
If you were on the official, certified ROM, that would be enough to pass SafetyNet (since new Magisk app has no more the built-in SN checker, use one from PlayStore like YASNAC)
With your custom ROM you would probably need Universal Safety Net Fix= USNF 2.2.1 (latest).
Maybe even Magisk Hide Props Config (if USNF not enough) to spoof your unofficial/not Google certified ROM fingerprints - you will need to figure out (pain in the ass with custom ROMs)
Click to expand...
Click to collapse
This is exactly what I needed, thank you!

I dont have this model phone but i faced the same problem, i just flashed ArrowOS S along with magisk but i didnt realised it has now ramdisk no, before i was using AICP and it has ramdisk yes, so i installed latest version of magisk and the system updated but i dont have root anymore, what can i do?
I use OrangeBox for flashing
Edit: also it does replace the custom recovery?

Question [issue] GrapheneOS, Magisk and June update [SOLVED]

The latest OTA update made my phone bootloop if i re-flash magisk patched init_boot image...
After I asked Stock users, it looks like it's a GrapheneOS june update + Magisk specific issue.
Do someone else also have this issue?
Phone boots normally, then reboot to recovery instead of reaching lock screen.
For now, I re-flashed panther-factory-2023061402 init_boot.

Have you tried Magisk canary version? or maybe GrapheneOS doesn't like june update and newest Magisk and you need to either go back down to stable Magisk or an older version of Magisk?
Actually, after re-reading your OP, a module might be the cause of the bootloop -- I've recently seen similar behavior from other members where device bootloops or crashes during/right-after loading & starting up -- if you were on the stock ROM I would suggest you loading up in Safe Mode to see if it is a module issue; I don't know anything about GrapheneOS so I don't know if it offers anything similar. I wonder if the adb command to remove modules at boot would work....

mhh, right, i don't have a lot of modules aside hosts, fdroid and busybox, but it may be module-related.
Until now, I did everything with TWRP, but now, well, let's say it's a little more difficult =)
... safe mode works with GrapheneOS, good =)
re-enabling modules one by one until i find the culprit.
... and the failing module was... Magisk built-in Busybox 1.0.5 \o/

Albirew said:
mhh, right, i don't have a lot of modules aside hosts, fdroid and busybox, but it may be module-related.
Until now, I did everything with TWRP, but now, well, let's say it's a little more difficult =)
... safe mode works with GrapheneOS, good =)
re-enabling modules one by one until i find the culprit.
... and the failing module was... Magisk built-in Busybox 1.0.5 \o/
Click to expand...
Click to collapse
knew it....
glad I helped get you there!