Database Develop

Magisk 20.1 - Safetynet checks unsuccessful

Hi everyone,
I just rooted (my 1st root) my pixel 4 yesterday to activate the soli module as in my country it doesn't work otherwise.
Soli is now working, but some app (like Netflix) cannot be used even after installing the APK from some APK database.
After looking online I understood that this was because of the safetynet checks, which are both failed (ctsprofile and basicintegrity)
Unfortunatelly, I haven't found any thread to fix it except some old for older versions or mentioning TWRP which i didn't use.
I have only 3 modules installed: Riru Edxposed / Riru Core and MagiskHide props config (and the check of all google playservice addresses in the module)
Can someone help me on that?
Thanks !

Seems like Google started detecting EdXposed yesterday, but this can be worked around by adding some Google components to the EdXposed blacklist. Take a look on the EdXposed Github for details.

Didgeridoohan said:
Seems like Google started detecting EdXposed yesterday, but this can be worked around by adding some Google components to the EdXposed blacklist. Take a look on the EdXposed Github for details.
Click to expand...
Click to collapse
The check is now green for both, thanks
But i can't still use netflix (app will remain on the logo for ever).
I tried to rename the liboem file with a root explorer but the file is not present in the folder in system\lib\ or \lib64

frikadel said:
The check is now green for both, thanks
But i can't still use netflix (app will remain on the logo for ever).
I tried to rename the liboem file with a root explorer but the file is not present in the folder in system\lib\ or \lib64
Click to expand...
Click to collapse
Hi,
Coul you please tell me if you are on custom rom?
I am on custom and only way to pass is to use Props Module in Magisk. But the Props is not loading when Riru EdXposed is active.
Thank you,
amplatfus

I just posted this on Github, kinda curious if it helps with Google Pay. I had never heard of this module before:
Has anyone tried the Hidden Core module in EdXposed? It is passing SafetyNet for me without any blacklisting or switching modes, just install and reboot.
For posterity, I am running EdXposed YAHFA 0.4.5.1. EdXposed Manager 4.5.1 under Magisk v20.1 / Android Pie.
https://ibb.co/xLBxDDV
https://ibb.co/F6y1hcH

SmilingPerson said:
I just posted this on Github, kinda curious if it helps with Google Pay. I had never heard of this module before:
Has anyone tried the Hidden Core module in EdXposed? It is passing SafetyNet for me without any blacklisting or switching modes, just install and reboot.
For posterity, I am running EdXposed YAHFA 0.4.5.1. EdXposed Manager 4.5.1 under Magisk v20.1 / Android Pie.
https://ibb.co/xLBxDDV
https://ibb.co/F6y1hcH
Click to expand...
Click to collapse
Hi,
Tried. It is not working. Still searching.
Thanks!

amplatfus said:
Hi,
Tried. It is not working. Still searching.
Thanks!
Click to expand...
Click to collapse
Yep, I recently went from rooted stock to LineageOS 16 on my phone, and can no longer use Netflix. My rooted Android media boxes also run LOS and Netflix *does* work on them, so I am perplexed. I can run the (terrible) remote control app for my Toyota by simply hiding things in Magisk and adding it to the blacklist in EdXposed Manager, otherwise it will complain about the phone being rooted. That works, but Netflix does not.
I don't need Netflix on my daily driver telephone, so no loss, but it tells us that whatever Google is doing, it is beatable. I just don't see the common ground though, it almost seems like it is device dependant. Next time I install Netflix, I am going to face due north, chant the Canadian anthem, and touch my nose with my right index finger while clutching a rosary in my left hand. Maybe that will be the ticket.
Sent from my unknown using Tapatalk

SmilingPerson said:
I just posted this on Github, kinda curious if it helps with Google Pay. I had never heard of this module before:
Has anyone tried the Hidden Core module in EdXposed? It is passing SafetyNet for me without any blacklisting or switching modes, just install and reboot.
For posterity, I am running EdXposed YAHFA 0.4.5.1. EdXposed Manager 4.5.1 under Magisk v20.1 / Android Pie.
https://ibb.co/xLBxDDV
https://ibb.co/F6y1hcH
Click to expand...
Click to collapse
You're a great bro !! after having installed the module on EdXposed and restarted my redmi note 4x (mido) with EAX Os 6.7, both the ticks were of a magnificent green! many thanks! :victory::victory::victory:

edxposed v0.4.6.1 + EdXposed Manager = Safetynet Fail

Saw an update, thought cool finally out of beta, but upon upgrading, safetynet fails.
I didn't take a look too much into it, I did see on github that at least some users also had failing safetynet, but this was right at the same time as the google update to safetynet for magisk, so I couldn't rule that out for other users.
I've reverted back to v0.4.5.1 and edxposed installer and safetynet passes. I *think* it might be because edxposed installer has blacklist functionality. I couldn't find the equivalent setting on edxposed manager.

anonxlg said:
Saw an update, thought cool finally out of beta, but upon upgrading, safetynet fails.
I didn't take a look too much into it, I did see on github that at least some users also had failing safetynet, but this was right at the same time as the google update to safetynet for magisk, so I couldn't rule that out for other users.
I've reverted back to v0.4.5.1 and edxposed installer and safetynet passes. I *think* it might be because edxposed installer has blacklist functionality. I couldn't find the equivalent setting on edxposed manager.
Click to expand...
Click to collapse
Latest Xposed Manager try in settings menu scroll down to framework options enable:
App List mode
Pass Safetynet
To enable blacklist function - App List mode has to be enable. Then from main menu select Applications.

thanks, after some testing and restarting that did the trick.
I didn't see that the 'app list mode' is the blacklist and only turned on 'pass safetynet' thinking that was the only think I needed to do

I updated lineage and I can't get safetynet to pass again.
I verified that with edxposed disabled, it passes safetynet. I tried uninstalling/reinstalling edxposed and tried both sandhook and yahfa versions and it doesn't pass.
Scratching my head on how it doesn't working work anymore because from lineage update (my only guess).

anonxlg said:
I updated lineage and I can't get safetynet to pass again.
I verified that with edxposed disabled, it passes safetynet. I tried uninstalling/reinstalling edxposed and tried both sandhook and yahfa versions and it doesn't pass.
Scratching my head on how it doesn't working work anymore because from lineage update (my only guess).
Click to expand...
Click to collapse
In Edxposed Manager try downloading the canary release and flash through Magisk.
Also note that Google is starting to tighten it's grip in regards to Safety Net. Very basically it will fail with an unlocked bootloader.
https://mobile.twitter.com/topjohnwu/status/1237830555523149824

spawnlives said:
In Edxposed Manager try downloading the canary release and flash through Magisk.
Also note that Google is starting to tighten it's grip in regards to Safety Net. Very basically it will fail with an unlocked bootloader.
https://mobile.twitter.com/topjohnwu/status/1237830555523149824
Click to expand...
Click to collapse
I'm aware of that, but in my case, phone passed safetynet (with magisk, edxposed, and all modules the same) before updating lineage.
I should note that this is lineage 15.1 (A8.1) if it matters.
And that phones pre-pie are currently immune to that safetynet check because of old security hardware.

this work: https://repo.xposed.info/module/com.cofface.ivader

anonxlg said:
I'm aware of that, but in my case, phone passed safetynet (with magisk, edxposed, and all modules the same) before updating lineage.
I should note that this is lineage 15.1 (A8.1) if it matters.
And that phones pre-pie are currently immune to that safetynet check because of old security hardware.
Click to expand...
Click to collapse
On my spare S8 I've reinstall unofficial lineage 17.1 ( Android 10 ).
Using latest:
Stable version of magisk / manager
Edxposed manager - 4.5.7
Edxposed canary - 0.4.6.3 ( 4545 ) - Yahfa
Riru core - 19.8
This combination at the moment is passing safety net. Checked using magisk manager + two other apps from playstore. Also have Device is certified through play store. The latest play store version is 19.5.13 for my region.
Edxposed modules installed at moment
Xprivacylua
Minminguard
Resolver Activity Tweaks

installing HiddenCore Module did the trick, but i'm still curious why updating lineage broke safetynet or that using the older rirucore + edxposed passes safety net

I might have figured this problem, let me know if it helps you pass safetynet too as it did work on my device ( OP6T ):
Install everything just as the above steps,
-config magiskhide, install the fingerprints
-Install riru etc, install the canary version of sandhook
-put in airplane mode as soon as you reboot
-enable applist and blacklist google framework and services and playstore (also assuming you have done hidden these in magisk too)
-clear data from services, framework, playstore
- open playstore and check if youre logged in and its working
- Go check safetynet
Gpay is working for me flawlessly
As of april 25 this solution seems to work for me.

nousernamesorry said:
I might have figured this problem, let me know if it helps you pass safetynet too as it did work on my device ( OP6T ):
Install everything just as the above steps,
-config magiskhide, install the fingerprints
-Install riru etc, install the canary version of sandhook
-put in airplane mode as soon as you reboot
-enable applist and blacklist google framework and services and playstore (also assuming you have done hidden these in magisk too)
-clear data from services, framework, playstore
- open playstore and check if youre logged in and its working
- Go check safetynet
Gpay is working for me flawlessly
As of april 25 this solution seems to work for me.
Click to expand...
Click to collapse
I followed your order, but in magisk I have passed safetynet, but CTS and basicIntegrity is false
This the screenshot... S9 rooted + custom rom android 10 + kernel custom
Without xposed I had both positives

bmw320cd said:
I followed your order, but in magisk I have passed safetynet, but CTS and basicIntegrity is false
This the screenshot... S9 rooted + custom rom android 10 + kernel custom
Without xposed I had both positives
Click to expand...
Click to collapse
Sorry man, this solution no more works. It broke after April 27th.

So is there no current method to have edxposed/ru working while passing safetynet? Thanks

djjohnnyblaze said:
So is there no current method to have edxposed/ru working while passing safetynet? Thanks
Click to expand...
Click to collapse
At the moment still passing safety net using latest Riru core module + latest canary release of Edxposed.

System Crashes
nousernamesorry said:
I might have figured this problem, let me know if it helps you pass safetynet too as it did work on my device ( OP6T ):
Install everything just as the above steps,
-config magiskhide, install the fingerprints
-Install riru etc, install the canary version of sandhook
-put in airplane mode as soon as you reboot
-enable applist and blacklist google framework and services and playstore (also assuming you have done hidden these in magisk too)
-clear data from services, framework, playstore
- open playstore and check if youre logged in and its working
- Go check safetynet
Gpay is working for me flawlessly
As of april 25 this solution seems to work for me.
Click to expand...
Click to collapse
My system UI is crashing sometimes. Is it because of edxposed? I followed these steps and successfully passed the SafetyNet check. But my system is crashing sometimes!
I'm using sudohide module only!

romee_ahuja said:
My system UI is crashing sometimes. Is it because of edxposed? I followed these steps and successfully passed the SafetyNet check. But my system is crashing sometimes!
I'm using sudohide module only!
Click to expand...
Click to collapse
Hey, it could be that, maybe you have a module like gravitybox installed which is conflicting with your system configurations.
If not that, try disabling edxposed modules from magisk itself. If that fixes the solution, then it might be edxposed

One solution is disable module like gravitybox or update gravitybox

What is the go-to replacement for MagiskHide & the central module repo?

I just realized there was a new public Magisk release yesterday, v24, and reading through the changes I see there are two that kind of impact me: MagiskHide and the central module repository removals.
So far I had been using MagiskHide because of its ease of use, list apps, tick box, and that's it (I haven't encountered apps that detected Magisk or root status, although I know it's insufficient for some). For modules, for example, the one that moves user certs to the system store, I just searched directly from the Magisk app and it was all good as well.
But things change from now on with those things being deprecated and removed and because there isn't much to go about in the release notes I was wondering if someone could direct me to the way of doing things now.
- What's the most apt, prevalent, or recommended replacement for MagiskHide? From the release notes I gather its a module, but I'm clueless as to which one or whether there are more than one option.
- If searching for mods and directly installing them is not available through the app, is there anything like it? Or is it all manual now? I.e. look for a module around the net, download it, copy it / decompress it somewhere in the device and install it.
Thanks for everything!

KaoDome said:
I just realized there was a new public Magisk release yesterday, v24, and reading through the changes I see there are two that kind of impact me: MagiskHide and the central module repository removals.
So far I had been using MagiskHide because of its ease of use, list apps, tick box, and that's it (I haven't encountered apps that detected Magisk or root status, although I know it's insufficient for some). For modules, for example, the one that moves user certs to the system store, I just searched directly from the Magisk app and it was all good as well.
But things change from now on with those things being deprecated and removed and because there isn't much to go about in the release notes I was wondering if someone could direct me to the way of doing things now.
- What's the most apt, prevalent, or recommended replacement for MagiskHide? From the release notes I gather its a module, but I'm clueless as to which one or whether there are more than one option.
- If searching for mods and directly installing them is not available through the app, is there anything like it? Or is it all manual now? I.e. look for a module around the net, download it, copy it / decompress it somewhere in the device and install it.
Thanks for everything!
Click to expand...
Click to collapse
[Discussion] Magisk - The Age of Zygisk.
This is a discussion and help thread for the newer versions of Magisk. The main goal of this thread is to help users migrate to Magisk v24+ SafetyNet Basic integrity Pass CTS profile match Pass Play Protect certification Device is certified...
forum.xda-developers.com
Here. First 5 post and you should know all you need

So, I read through that thread. It certainly solved a few issues for me. Like getting safety net, getting a repository, etc.
But it didn't have anything I see to replace magisk hide, even in the Fox Magisk Module Manager.
Do I just need to know other terminology now? Or is there something else I'm missing?

Quantumrabbit said:
So, I read through that thread. It certainly solved a few issues for me. Like getting safety net, getting a repository, etc.
But it didn't have anything I see to replace magisk hide, even in the Fox Magisk Module Manager.
Do I just need to know other terminology now? Or is there something else I'm missing?
Click to expand...
Click to collapse
I don't get it, Magisk Hide is good for passing SafetyNet and you said you got it. Anyway, for SafetyNet you can use the Universal SafetyNet Fix module.
If you meant the hide list, there's now the Deny list. To quote:
The Deny list is similar but instead of hiding Magisk from the process, Magisk is unloaded so there is nothing to hide.
Click to expand...
Click to collapse

Porpet said:
I don't get it, Magisk Hide is good for passing SafetyNet and you said you got it. Anyway, for SafetyNet you can use the Universal SafetyNet Fix module.
If you meant the hide list, there's now the Deny list. To quote:
Click to expand...
Click to collapse
Yes, it's for some banking apps, Concur, and others, none of which have any business checking for root, but all check for Magisk and such in other ways, and prevent usage.
If the deny list is how to do that now, I'll give that a go. Thank you

Quantumrabbit said:
Yes, it's for some banking apps, Concur, and others, none of which have any business checking for root, but all check for Magisk and such in other ways, and prevent usage.
If the deny list is how to do that now, I'll give that a go. Thank you
Click to expand...
Click to collapse
And where did you find the deny list?

fusk said:
And where did you find the deny list?
Click to expand...
Click to collapse
Settings enforce deny list. You need to enable zygisk and reboot prior also in settings.
Also there is an add on module shamiko that has more hide features after you configure denylist

H
toolhas4degrees said:
Settings enforce deny list. You need to enable zygisk and reboot prior also in settings.
Also there is an add on module shamiko that has more hide features after you configure denylist
Click to expand...
Click to collapse
How to add modules shamiko & how to more hide features

Spartacus500 said:
H
How to add modules shamiko & how to more hide features
Click to expand...
Click to collapse
Shamiko is a flashable only need to slash magisk module. You can find it in the magisk alpha thread on telegram. You need to configure denylist first and reboot then turn off the enforce denylist toggle and flash the shamiko module.
If you are using lsposed download hide my applist xposed module and search how to use it if you want more coverage
Pm me if you want links

I'm having a lot of trouble. Duo Mobile (a 2FA app) is still able to detect that I'm rooted. Here's what I've done:
1) Installed Magisk & Manager app version 24.1 (24100)
2) Enabled Zygisk (and rebooted of course)
3) Enabled Enforce DenyList
4) Added com.duosecurity.duomobile and ALL Google Play Services submodules to the DenyList
5) Installed Universal SafetyNet Fix v2.2.1 from https://github.com/kdrag0n/safetynet-fix/releases/tag/v2.2.1
6) Hidden the Magisk app
7) Completely uninstalled & reinstalled Duo Mobile (and verified that it's still on the DenyList
This is incredibly annoying, is there anything I'm doing wrong? Is there a way to verify that the SafetyNet Fix is working as expected? Magisk doesn't have a "Check SafetyNet" option on the app anymore.

Drakinite said:
I'm having a lot of trouble. Duo Mobile (a 2FA app) is still able to detect that I'm rooted. Here's what I've done:
1) Installed Magisk & Manager app version 24.1 (24100)
2) Enabled Zygisk (and rebooted of course)
3) Enabled Enforce DenyList
4) Added com.duosecurity.duomobile and ALL Google Play Services submodules to the DenyList
5) Installed Universal SafetyNet Fix v2.2.1 from https://github.com/kdrag0n/safetynet-fix/releases/tag/v2.2.1
6) Hidden the Magisk app
7) Completely uninstalled & reinstalled Duo Mobile (and verified that it's still on the DenyList
This is incredibly annoying, is there anything I'm doing wrong? Is there a way to verify that the SafetyNet Fix is working as expected? Magisk doesn't have a "Check SafetyNet" option on the app anymore.
Click to expand...
Click to collapse
This is quite weird and definitely shows how different devices handle root detection. I a Samsung S10+ and just installed Magisk 24 with enforce DenyList earlier this week. Today I just installed Duo Mobile and it works fine. I do not have it in the DenyList, and Magisk is not hidden. I use a custom SafetyNet fix that was installed when I originally installed an AIO TWRP/Magisk/SafetyNet fix after unlocking my bootloader. I also fail SafetyNet checks.
Have you tried Shamiko? It didn't help me pass SafetyNet so I removed it.
Unfortunately I don't have any other fixes for you but you can check SafetyNet with apps from the play store, I use YASNAC and SafetyNet 'attest'.
What phone are you using?

Drakinite said:
This is incredibly annoying, is there anything I'm doing wrong? Is there a way to verify that the SafetyNet Fix is working as expected? Magisk doesn't have a "Check SafetyNet" option on the app anymore.
Click to expand...
Click to collapse
There are SafetyNet checker apps you can download from the Play Store or F-Droid such as YASNAC.

danbest82 said:
Have you tried Shamiko? It didn't help me pass SafetyNet so I removed it.
Unfortunately I don't have any other fixes for you but you can check SafetyNet with apps from the play store, I use YASNAC and SafetyNet 'attest'.
What phone are you using?
Click to expand...
Click to collapse
I'm using a Oneplus 6. At your suggestion, I tried Shamiko, but so far it hasn't worked.
anonymous-bot said:
There are SafetyNet checker apps you can download from the Play Store or F-Droid such as YASNAC.
Click to expand...
Click to collapse
I tried Momo from the Magisk alpha telegram channel, and it's been helpful so far, but it's detecting Magisk/TWRP files and I don't know where they are located. Is there a way to find where these files it's detecting are? This might be what Duo is detecting.
When I run YASNAC, it passes the SafetyNet check.

Drakinite said:
I'm using a Oneplus 6. At your suggestion, I tried Shamiko, but so far it hasn't worked.
I tried Momo from the Magisk alpha telegram channel, and it's been helpful so far, but it's detecting Magisk/TWRP files and I don't know where they are located. Is there a way to find where these files it's detecting are? This might be what Duo is detecting.
When I run YASNAC, it passes the SafetyNet check.
Click to expand...
Click to collapse
Get VD Infos and use it to scan your files. You can find it on XDA.

Drakinite said:
I'm using a Oneplus 6. At your suggestion, I tried Shamiko, but so far it hasn't worked.
Click to expand...
Click to collapse
Hmm ok. Like I said shimako didn't work for me either. I'm not sure why Duo is still detecting root. For reference this is what is on my DenyList:
Drakinite said:
I tried Momo from the Magisk alpha telegram channel, and it's been helpful so far, but it's detecting Magisk/TWRP files and I don't know where they are located. Is there a way to find where these files it's detecting are? This might be what Duo is detecting.
When I run YASNAC, it passes the SafetyNet check.
Click to expand...
Click to collapse
YASNAC is the replacement for Momo it looks like since Momo is Riru based (https://github.com/canyie/Riru-MomoHider)

simplydat said:
Get VD Infos and use use to scan your files. You can find it in XDA
Click to expand...
Click to collapse
Ok so this one is more helpful, but I'm not sure how to hide these that appeared. Any idea what ro.kernel.qemu.gles is? I looked through my list of installed apps and nothing like that showed up.
Should we switch to private messages to not spam the thread? Or perhaps staying in here can be helpful for those with the same problem?

Drakinite said:
Ok so this one is more helpful, but I'm not sure how to hide these that appeared. Any idea what ro.kernel.qemu.gles is? I looked through my list of installed apps and nothing like that showed up.
Should we switch to private messages to not spam the thread? Or perhaps staying in here can be helpful for those with the same problem?
Click to expand...
Click to collapse
OMG WAIT, it finally worked! I don't know what changed, but Duo is now no longer detecting root. Gotta love when things magically start working when you don't know what changed.

Drakinite said:
OMG WAIT, it finally worked! I don't know what changed, but Duo is now no longer detecting root. Gotta love when things magically start working when you don't know what changed.
Click to expand...
Click to collapse
Awesome. Hope it stays that way!

Hi,
I've switched to the new method with the DenyList & Shamiko (v0.5.0) on OnePlus 6 recently - Magisk (v24.3), however it doesn't seem to hide root from Google Pay. Can it still be a bug with Magisk, when it can't hide system apps? In the changelog of Shamiko it mentioned that it was fixed in Magisk "24102+", I'm not sure what version is this, but I imagine it's not released yet. If so, is there a way of installing this version early?
Thank you!

antivirtel said:
Hi,
I've switched to the new method with the DenyList & Shamiko (v0.5.0) on OnePlus 6 recently - Magisk (v24.3), however it doesn't seem to hide root from Google Pay. Can it still be a bug with Magisk, when it can't hide system apps? In the changelog of Shamiko it mentioned that it was fixed in Magisk "24102+", I'm not sure what version is this, but I imagine it's not released yet. If so, is there a way of installing this version early?
Thank you!
Click to expand...
Click to collapse
Version 24102 would be v24.102. So your Magisk 24.300 is newer.

How to hide my custom rom or simulate the stock rom for bank apps?

Well, a month ago I installed ArrowOS12 in my A30, but something I don't knew about custom roms is bank apps blocking cuz'... "SECURITY" (funny AF), At first it just was blocked cuz' i have magisk root, but i activated many things to hide magisk and I realize that was not my root, but the custom OS.
I can't use my UNIQUE bank account by a STUPID SECURITY POLICY, How i solve this? I tried magiskhide props config for change my fingerprint prop or whatever.
If i can emulate a fake device in my own device only for this i will, ciz that's anoying

Hi, try download this two magisk modules
Shmaiko - Direct Link | Link
Universal SafetyFix - Direct Link | Link
Hide you Magisk APP in Magisk Settings and Turn On ZYGISK install this two modules.
Open Magisk Settings and in Enforce Settings Apps, mark your Bank Apps.
It worked for me (Galaxy A40)

I already tried both, didn't worked

AysllanHiro said:
I already tried both, didn't worked
Click to expand...
Click to collapse
Pass safety before

SirKosichka said:
Pass safety before
Click to expand...
Click to collapse
i found a way to pass the app checker, but thx for your help, i already passed safetynet too

TELL US HOW!

AysllanHiro said:
i found a way to pass the app checker, but thx for your help, i already passed safetynet too
Click to expand...
Click to collapse
How?

acerfreak said:
TELL US HOW!
Click to expand...
Click to collapse
I think people are good asking questions but not sharing the solution when they get it.

for me it was:
downloading "Universal SafetyFix" (and reboot)
hidding Magisk with MagiskHide in Magisk settings
Enable Zygisk, enable"Enforce DenyList" (again in Magisk settings) and selecting banking app in it (don't forget to reboot).
Also check if you passed SafetyNet with app like YASNAC for example. And clear storage, cache of banking app.
This was working on my phone with original google services like gapps (custom ROM of course).
On my secondary phone with MicroG implementation it's not working (play store required and something more i guess).

darukutsu said:
On my secondary phone with MicroG implementation it's not working (play store required and something more i guess).
Click to expand...
Click to collapse
Were you passing safetynet on it?

ShaDisNX255 said:
Were you passing safetynet on it?
Click to expand...
Click to collapse
Of course there's the problem...I had microG installed with fakestore (passing safetynet) but I had to install playstore (to install bank app from it) and now i'm not passing safetynet even with magisk module installed.

Banking app (Starling) detecting Magisk

A banking app I've been using for years has always worked after putting it on the Deny List. I updated it recently and it now won't work with Magisk installed regardless of what I do.
As soon as I patch the boot image with Magisk it complains that the device is rooted and locks me out. That's without even installing the Magisk app, also without Zygisk etc.
I can pass SafetyNet and Play Protect certification with Universal Safety Net Fix and Magisk Hide Props Config modules. However that doesn't make the banking app work.
So far I've also tried:
* Magisk Delta, Zygisk off, with sulist on whitelist mode (also tried Delta's Magisk Hide)
* Shamiko
* Hide My Applist (various configs)
* Disabling root from Magisk app
* Renaming the Magisk app
* Downgrading the banking app (it no longer detects root but locks me out until I upgrade)
* Cloning the banking app to Work Profile with Shelter (this is the only thing that gets rid of the message about being rooted. But then it bizarrely claims it can't connect to the server to login!?)
I'm now at a loss as to what else to try. Any ideas please?

What's the banking app name?

Also install Ruru and see what might be the problem. Make the same steps you use to hide your banking apps. Also clear data of Ruru before each test.
Releases · byxiaorun/Ruru
An android sample app of detecting suspicious apps like magisk manager - byxiaorun/Ruru
github.com

makeyourself said:
A banking app I've been using for years has always worked after putting it on the Deny List. I updated it recently and it now won't work with Magisk installed regardless of what I do.
As soon as I patch the boot image with Magisk it complains that the device is rooted and locks me out. That's without even installing the Magisk app, also without Zygisk etc.
I can pass SafetyNet and Play Protect certification with Universal Safety Net Fix and Magisk Hide Props Config modules. However that doesn't make the banking app work.
So far I've also tried:
* Magisk Delta, Zygisk off, with sulist on whitelist mode (also tried Delta's Magisk Hide)
* Shamiko
* Hide My Applist (various configs)
* Disabling root from Magisk app
* Renaming the Magisk app
* Downgrading the banking app (it no longer detects root but locks me out until I upgrade)
* Cloning the banking app to Work Profile with Shelter (this is the only thing that gets rid of the message about being rooted. But then it bizarrely claims it can't connect to the server to login!?)
I'm now at a loss as to what else to try. Any ideas please?
Click to expand...
Click to collapse
I have found some banking apps are calling an external site and somehow they are detecting reporting back root. I had an issue with Halifax and Starling before.
Starling for me tripped over the last few days, and I used pcap droid to trace what hosts it was calling during app start up.
I found that when i blocked the following address:-
firebaseremoteconfig.googleapis.com
it all worked OK.
Try it if you use Adaway or a DNS provider and add this to your blacklist

spida_singh said:
I have found some banking apps are calling an external site and somehow they are detecting reportign back root. I had an issue with Haliafx and Starling before.
Starlign for me tripped over the last few days, and i used pcap droid to trace what hosts it was calling during app start up.
I found that when i blocked the following address:-
firebaseremoteconfig.googleapis.com
it all worked OK.
Try it if you use Adaway or a DNS provider and add this to your blacklist
Click to expand...
Click to collapse
I was wondering why Starling suddenly started failing - thanks!

Try hide root with some google apps on deny list. (u can search "html", "webview", "feedback" then enable hide them all apps which include these words.

giociampa said:
I was wondering why Starling suddenly started failing - thanks!
Click to expand...
Click to collapse
Ta
For ref - Process for Noobies is here;
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Files and all

spida_singh said:
I have found some banking apps are calling an external site and somehow they are detecting reportign back root. I had an issue with Haliafx and Starling before.
Starlign for me tripped over the last few days, and i used pcap droid to trace what hosts it was calling during app start up.
I found that when i blocked the following address:-
firebaseremoteconfig.googleapis.com
it all worked OK.
Try it if you use Adaway or a DNS provider and add this to your blacklist
Click to expand...
Click to collapse
Thanks. Worked for me on my 6t using LOS20 and Starling

surajpai524 said:
What's the banking app name?
Click to expand...
Click to collapse
Starling
surajpai524 said:
Also install Ruru and see what might be the problem. Make the same steps you use to hide your banking apps. Also clear data of Ruru before each test.
Releases · byxiaorun/Ruru
An android sample app of detecting suspicious apps like magisk manager - byxiaorun/Ruru
github.com
Click to expand...
Click to collapse
If I rename/repackage the Magisk app and use Deny List then the only things Ruru detects is the Magisk app itself (even though it's renamed) and TWRP. TWRP doesn't seem to be the problem because the banking app doesn't seem to care if I've got that installed so long as Magisk isn't installed to ramdisk. And the banking app is clearly detecting something other than just the Magisk app because it trips after flashing Magisk from recovery, even if the Magisk app isn't installed.
I think @spida_singh may have a solution though!

spida_singh said:
I have found some banking apps are calling an external site and somehow they are detecting reporting back root. I had an issue with Halifax and Starling before.
Starling for me tripped over the last few days, and I used pcap droid to trace what hosts it was calling during app start up.
I found that when i blocked the following address:-
firebaseremoteconfig.googleapis.com
it all worked OK.
Try it if you use Adaway or a DNS provider and add this to your blacklist
Click to expand...
Click to collapse
Thanks very much, yes it's Starling I'm having the problem with! Have not tried your solution yet but will do when I have time. Edit: Just tried and it works !!
I did have a look at the DNS requests from the Starling app and I think I may have even noticed the domain name you mention. But wouldn't have guessed it was that causing it! I'd be interested to know how that works... Are Google apps (I have minimal amount installed) spying on my applist and reporting it to my bank!? Kind of creepy! Also quite weird seeing as Google Pay/Wallet doesn't complain!

makeyourself said:
Thanks very much, yes it's Starling I'm having the problem with! Have not tried your solution yet but will do when I have time.
I did have a look at the DNS requests from the Starling app and I think I may have even noticed the domain name you mention. But wouldn't have guessed it was that causing it! I'd be interested to know how that works... Are Google apps (I have minimal amount installed) spying on my applist and reporting it to my bank!? Kind of creepy! Also quite weird seeing as Google Pay/Wallet doesn't complain!
Click to expand...
Click to collapse
Starling will manage the API in how it works for their app, only they will know, i honesltly have no idea, i know Halifax have done this in the past, and now Starling, and simply blocking it allows the app to work, but, as you, im intrigued to know what the app is 'reading' and sending back to report the device is rooted.
PCAP droid can check the payload and dump it to see what was happening with that request, and whats being sent back.

spida_singh said:
Starling will manage the API in how it works for their app, only they will know, i honesltly have no idea, i know Halifax have done this in the past, and now Starling, and simply blocking it allows the app to work, but, as you, im intrigued to know what the app is 'reading' and sending back to report the device is rooted.
PCAP droid can check the payload and dump it to see what was happening with that request, and whats being sent back.
Click to expand...
Click to collapse
Id like to know too - But use my file from post #7 and it should work

I think I spoke to soon. It's still showing up for me when I quit the Starling app.

I tried Starling app and at first it detected root but once I added to Deny list in Magisk. It didn't detect and went to login page.
My root detection bypass configs:-
Magisk (Not hidden/ Name unchanged / Not Frozen)
Magisk Deny List
Shamiko 0.7
Hide My AppList (LSPosed Module)
Universal SafetyNet Fix mod by Displex
I don't know other behaviour like after login and stuff, since I don't have an account.
Ruru screenshot: even with xposed modules and Magisk app not hidden

Prof. Yaffle said:
I think I spoke to soon. It's still showing up for me when I quit the Starling app.
Click to expand...
Click to collapse
Do you have the the domain mentioned above blacklisted in Adaway and the app on Magisk Deny List with Deny List enforcing? All working fine here now.
I also have USNF (kdrag0n) and Magisk Hide Props Config installed. Magisk 26.1
Also you have to clear the app's data before that message will go away.

Yes, I've tried it added manually and also with the file. Same result both ways. I have the Magisk app hidden, Starling in the Deny list but Enforce disabled as I'm using Shamiko.
Edit
I've just cleared the Starling app data and it seems okay at the moment

FYI - Latest May update for Pixel and Starling latest update now break the method in this thread - Searching for workaround

fkofilee said:
FYI - Latest May update for Pixel and Starling latest update now break the method in this thread - Searching for workaround
Click to expand...
Click to collapse
I'm running the latest starling absolutely fine on my Pixel 6. Same set-up (latest linesgeos nightly)
Magisk Delta
USNF by displax
PCAP block list still contains this host
What is your setup?

Official Magisk, UNSF from Displax, Fingerprint Props.
Adaway still contains the host file I made.

My OnePlus 6t on the latest Lineageos 20 nightly seems fine with Shamiko, USNF Mod and the blocked host in Adaway