Database Develop

Magisk Hide not working

I recently rooted my new Mi A2 Lite using Magisk.
So my current banking app detected the root and now I cannot use it anymore. I tried Root Cloak and MagiskHide but both of them did not work either. It still shows the message saying my phone is rooted.
How do I debug that now. I need it to be working anyhow.
App: K-Plus; play.google.com/store/apps/details?id=com.kasikorn.retail.mbanking.wap

https://didgeridoohan.com/magisk/MagiskHideHidingRoot

arunsharmaofficial said:
I recently rooted my new Mi A2 Lite using Magisk.
So my current banking app detected the root and now I cannot use it anymore. I tried Root Cloak and MagiskHide but both of them did not work either. It still shows the message saying my phone is rooted.
How do I debug that now. I need it to be working anyhow.
App: K-Plus; play.google.com/store/apps/details?id=com.kasikorn.retail.mbanking.wap
Click to expand...
Click to collapse
I recently had the same problem, but with a different banking app.
What helped me in the past was to hide Magisk Manager with a random package name. It is an option in Magisk Manager itself. Unfortunately it doesn't work anymore but i could mask Magisk Manager with the Samsung app S Secure and now it's working again .
This was included in my Galaxy S7 ROM so you probably need to find the apk for the app or find a similiar working app for your phone model.
Hope this helps.

Daci54 said:
I recently had the same problem, but with a different banking app.
What helped me in the past was to hide Magisk Manager with a random package name. It is an option in Magisk Manager itself. Unfortunately it doesn't work anymore but i could mask Magisk Manager with the Samsung app S Secure and now it's working again .
This was included in my Galaxy S7 ROM so you probably need to find the apk for the app or find a similiar working app for your phone model.
Hope this helps.
Click to expand...
Click to collapse
Alright! Can you clarify what on how to hide Magisk with a different package name. I am still pretty new to Magisk. Thanks.

arunsharmaofficial said:
Alright! Can you clarify what on how to hide Magisk with a different package name. I am still pretty new to Magisk. Thanks.
Click to expand...
Click to collapse
Open Magisk Manager, go to settings and tap on Hide Magisk Manager. If your banking app doesn't work right away try a restart. If it still doesn't work try to mask Magisk Manager with S Secure or similiar apps.

The magisk hide feature does not work

nm180618 said:
The magisk hide feature does not work
Click to expand...
Click to collapse
It does work, the steps I took were:
1) Install Banking app
2) Open it and get notified about the phone being rooted
3) Use Magisk Hide feature to hide the Banking app
4) Go to phone's app settings
5) Baking app settings
6) Clear storage data (Clearing only the cache could work too, I didn't test it)
7) Profit!
Hope that works for you.

Magisk hide doesn't seem to be working for me. Magisk says it's working and safety net passes, but I've tested multiple apps and they can see that I'm rooted. Hiding magisk with a random package name doesn't work either.

Yesterday I installed magisk and went to hide options and checked my banking app. I was amazed to see banking app allowing me to do everything without limited functionality due to "root" like before. But today banking app detected root again and limited all functions, how? There haven't been any updates for banking app yet it seemed to no longer be fooled by magisk.

Same goes for me with the K-Plus app as well. (สวัสดีคับผม) Use Magisk Hide to hide the root access but it crashes the bank app instead.

Not sure what I've missed.
Gpay and banking are still detecting root/custom rom
Magisk and manager installed.
module SaMoDXv1 installed.
Safteynet is showing green
gpay and banking apps hidden
Using hide magisk function
removed all Magisk related stuff from SD card.
Cleared cache from gpay and banking apps .
Turned off usb debugging.
What else is there?
Just installed root checker basic, it sees root. I hide magisk from it and it still sees root. Is that right?

beythas said:
Same goes for me with the K-Plus app as well. (สวัสดีคับผม) Use Magisk Hide to hide the root access but it crashes the bank app instead.
Click to expand...
Click to collapse
Try following the 'Promon' section in https://github.com/Ingan121/UDSBypass

Hi,
I'ould like installing Fde.ai on my One plus 6 rooted with Ice Renovate 11.1 rom, but I'm not sure that installation is compatible with "Rice tweaks", a tweak app for this rom no my device.
Peraphs there is someone who does know the answer?
Tks and regards.
Roberto

What I do
Go to setting -> Magisk Hide -> disable then enable.
This way worked with me .
I used Magisk Manager v 7.2.0 (213).
Magisk v 19.3 (19300).

What worked for me is using the "Hide Magisk Manager" feature in settings. Now apps are not promoting about device being rooted and are running fine now.

Anyone solved this problem?
I still have a banking app with this problem. I tried many times but still not working.
Magisk hide dont work for this app.

nguyenlinh said:
Anyone solved this problem?
I still have a banking app with this problem. I tried many times but still not working.
Magisk hide dont work for this app.
Click to expand...
Click to collapse
So far there are very few apps that I've seen that can not be tricked with tips from the guide linked in the second post of this thread. Give it a shot...

Can you try it?
https://play.google.com/store/apps/details?id=vietcombank.itcenter.smartotpcorp
I Cannot run this app.
Thanks

nguyenlinh said:
Can you try it?
https://play.google.com/store/apps/details?id=vietcombank.itcenter.smartotpcorp
I Cannot run this app.
Thanks
Click to expand...
Click to collapse
Runs fine with the app on the Hide list and the Magisk Manager repackaged with a random name.
More:
https://www.didgeridoohan.com/magisk/MagiskHide#hn_Hiding_root_from_apps

Can someone check this for me?
https://play.google.com/store/apps/details?id=no.apps.dnbnor&hl=en_US
Iam using MH v60 with 19.3 still nothing. Iam fighting with that about 4 months now((((

clubhouse on rooted devices

Hi
I have a problem in the clubhouse app that login not complete on any rooted device ... no problem on Non Root devices
I hide magisk app add clubhouse to magisk hide and EDExposed blacklist but still not working.
also, the same issue is in Mcdonald's app.
any idea how to solve these issues
Note: My Bank app works after adding it to magisk hide and hide magisk app, which means i did it right.
thanks

anyone help me please

Have you tried removing the Magisk app? That's a popular way of detecting Magisk, even with a repackaged app. It's practically impossible to completely hide it on anything below Android 11, and even then it's necessary for the app to target A11 for full hiding to work (which won't happen until Google enforces that, maybe later this year).
Of course, Xposed/EdXposed/LSPosed tools can probably be used to hide the app fully...

Didgeridoohan said:
Have you tried removing the Magisk app? That's a popular way of detecting Magisk, even with a repackaged app. It's practically impossible to completely hide it on anything below Android 11, and even then it's necessary for the app to target A11 for full hiding to work (which won't happen until Google enforces that, maybe later this year).
Of course, Xposed/EdXposed/LSPosed tools can probably be used to hide the app fully...
Click to expand...
Click to collapse
thanks for your reply
if i removed magisk .. everything that use root will stop and i don't want that
also can you please tell me how to hide the app fully using EDXposed

I did not say "remove Magisk"... I said "remove the Magisk app". Just uninstall the app and try and see if Clubhouse still triggers. If it works we know it's looking for the app and you'll have to either freeze/uninstall the Magisk app when using Clubhouse and then reinstall it again afterwards, or use one of the available isolation methods. I've got a few of those mentioned here, but I'm sure you can find more if you search (it's been covered a lot):
https://www.didgeridoohan.com/magisk/MagiskHide#hn_Isolation_apps

zamlkawy said:
Hi
I have a problem in the clubhouse app that login not complete on any rooted device ... no problem on Non Root devices
I hide magisk app add clubhouse to magisk hide and EDExposed blacklist but still not working.
also, the same issue is in Mcdonald's app.
any idea how to solve these issues
Note: My Bank app works after adding it to magisk hide and hide magisk app, which means i did it right.
thanks
Click to expand...
Click to collapse
for Mcdonald's try this
[MOD][XPOSED][4.1+] McRoot (McDonalds Global App)
McRoot McDonalds Global App security fix Remove checks of: root unacceptable apps unacceptable device properties (developer options etc) Note: The app requests SafetyNet pass! Use Magisk+Riru+Riru-Unshare etc Install notes: install apk...
forum.xda-developers.com

Hi. I also have Magisk installed on my device. I uninstalled Magisk app, tried logging into clubhouse again, but still the issue persists.
After receiving the missed call while trying to sign in, I get the notification, 'There was an error please try again'
Clearing the clubhouse app data, uninstalling and reinstalling the app again hasn't helped at all. I get the same issue.
I have Magisk 23.0 installed on my Oneplus5T running Android 10.

What is the go-to replacement for MagiskHide & the central module repo?

I just realized there was a new public Magisk release yesterday, v24, and reading through the changes I see there are two that kind of impact me: MagiskHide and the central module repository removals.
So far I had been using MagiskHide because of its ease of use, list apps, tick box, and that's it (I haven't encountered apps that detected Magisk or root status, although I know it's insufficient for some). For modules, for example, the one that moves user certs to the system store, I just searched directly from the Magisk app and it was all good as well.
But things change from now on with those things being deprecated and removed and because there isn't much to go about in the release notes I was wondering if someone could direct me to the way of doing things now.
- What's the most apt, prevalent, or recommended replacement for MagiskHide? From the release notes I gather its a module, but I'm clueless as to which one or whether there are more than one option.
- If searching for mods and directly installing them is not available through the app, is there anything like it? Or is it all manual now? I.e. look for a module around the net, download it, copy it / decompress it somewhere in the device and install it.
Thanks for everything!

KaoDome said:
I just realized there was a new public Magisk release yesterday, v24, and reading through the changes I see there are two that kind of impact me: MagiskHide and the central module repository removals.
So far I had been using MagiskHide because of its ease of use, list apps, tick box, and that's it (I haven't encountered apps that detected Magisk or root status, although I know it's insufficient for some). For modules, for example, the one that moves user certs to the system store, I just searched directly from the Magisk app and it was all good as well.
But things change from now on with those things being deprecated and removed and because there isn't much to go about in the release notes I was wondering if someone could direct me to the way of doing things now.
- What's the most apt, prevalent, or recommended replacement for MagiskHide? From the release notes I gather its a module, but I'm clueless as to which one or whether there are more than one option.
- If searching for mods and directly installing them is not available through the app, is there anything like it? Or is it all manual now? I.e. look for a module around the net, download it, copy it / decompress it somewhere in the device and install it.
Thanks for everything!
Click to expand...
Click to collapse
[Discussion] Magisk - The Age of Zygisk.
This is a discussion and help thread for the newer versions of Magisk. The main goal of this thread is to help users migrate to Magisk v24+ SafetyNet Basic integrity Pass CTS profile match Pass Play Protect certification Device is certified...
forum.xda-developers.com
Here. First 5 post and you should know all you need

So, I read through that thread. It certainly solved a few issues for me. Like getting safety net, getting a repository, etc.
But it didn't have anything I see to replace magisk hide, even in the Fox Magisk Module Manager.
Do I just need to know other terminology now? Or is there something else I'm missing?

Quantumrabbit said:
So, I read through that thread. It certainly solved a few issues for me. Like getting safety net, getting a repository, etc.
But it didn't have anything I see to replace magisk hide, even in the Fox Magisk Module Manager.
Do I just need to know other terminology now? Or is there something else I'm missing?
Click to expand...
Click to collapse
I don't get it, Magisk Hide is good for passing SafetyNet and you said you got it. Anyway, for SafetyNet you can use the Universal SafetyNet Fix module.
If you meant the hide list, there's now the Deny list. To quote:
The Deny list is similar but instead of hiding Magisk from the process, Magisk is unloaded so there is nothing to hide.
Click to expand...
Click to collapse

Porpet said:
I don't get it, Magisk Hide is good for passing SafetyNet and you said you got it. Anyway, for SafetyNet you can use the Universal SafetyNet Fix module.
If you meant the hide list, there's now the Deny list. To quote:
Click to expand...
Click to collapse
Yes, it's for some banking apps, Concur, and others, none of which have any business checking for root, but all check for Magisk and such in other ways, and prevent usage.
If the deny list is how to do that now, I'll give that a go. Thank you

Quantumrabbit said:
Yes, it's for some banking apps, Concur, and others, none of which have any business checking for root, but all check for Magisk and such in other ways, and prevent usage.
If the deny list is how to do that now, I'll give that a go. Thank you
Click to expand...
Click to collapse
And where did you find the deny list?

fusk said:
And where did you find the deny list?
Click to expand...
Click to collapse
Settings enforce deny list. You need to enable zygisk and reboot prior also in settings.
Also there is an add on module shamiko that has more hide features after you configure denylist

H
toolhas4degrees said:
Settings enforce deny list. You need to enable zygisk and reboot prior also in settings.
Also there is an add on module shamiko that has more hide features after you configure denylist
Click to expand...
Click to collapse
How to add modules shamiko & how to more hide features

Spartacus500 said:
H
How to add modules shamiko & how to more hide features
Click to expand...
Click to collapse
Shamiko is a flashable only need to slash magisk module. You can find it in the magisk alpha thread on telegram. You need to configure denylist first and reboot then turn off the enforce denylist toggle and flash the shamiko module.
If you are using lsposed download hide my applist xposed module and search how to use it if you want more coverage
Pm me if you want links

I'm having a lot of trouble. Duo Mobile (a 2FA app) is still able to detect that I'm rooted. Here's what I've done:
1) Installed Magisk & Manager app version 24.1 (24100)
2) Enabled Zygisk (and rebooted of course)
3) Enabled Enforce DenyList
4) Added com.duosecurity.duomobile and ALL Google Play Services submodules to the DenyList
5) Installed Universal SafetyNet Fix v2.2.1 from https://github.com/kdrag0n/safetynet-fix/releases/tag/v2.2.1
6) Hidden the Magisk app
7) Completely uninstalled & reinstalled Duo Mobile (and verified that it's still on the DenyList
This is incredibly annoying, is there anything I'm doing wrong? Is there a way to verify that the SafetyNet Fix is working as expected? Magisk doesn't have a "Check SafetyNet" option on the app anymore.

Drakinite said:
I'm having a lot of trouble. Duo Mobile (a 2FA app) is still able to detect that I'm rooted. Here's what I've done:
1) Installed Magisk & Manager app version 24.1 (24100)
2) Enabled Zygisk (and rebooted of course)
3) Enabled Enforce DenyList
4) Added com.duosecurity.duomobile and ALL Google Play Services submodules to the DenyList
5) Installed Universal SafetyNet Fix v2.2.1 from https://github.com/kdrag0n/safetynet-fix/releases/tag/v2.2.1
6) Hidden the Magisk app
7) Completely uninstalled & reinstalled Duo Mobile (and verified that it's still on the DenyList
This is incredibly annoying, is there anything I'm doing wrong? Is there a way to verify that the SafetyNet Fix is working as expected? Magisk doesn't have a "Check SafetyNet" option on the app anymore.
Click to expand...
Click to collapse
This is quite weird and definitely shows how different devices handle root detection. I a Samsung S10+ and just installed Magisk 24 with enforce DenyList earlier this week. Today I just installed Duo Mobile and it works fine. I do not have it in the DenyList, and Magisk is not hidden. I use a custom SafetyNet fix that was installed when I originally installed an AIO TWRP/Magisk/SafetyNet fix after unlocking my bootloader. I also fail SafetyNet checks.
Have you tried Shamiko? It didn't help me pass SafetyNet so I removed it.
Unfortunately I don't have any other fixes for you but you can check SafetyNet with apps from the play store, I use YASNAC and SafetyNet 'attest'.
What phone are you using?

Drakinite said:
This is incredibly annoying, is there anything I'm doing wrong? Is there a way to verify that the SafetyNet Fix is working as expected? Magisk doesn't have a "Check SafetyNet" option on the app anymore.
Click to expand...
Click to collapse
There are SafetyNet checker apps you can download from the Play Store or F-Droid such as YASNAC.

danbest82 said:
Have you tried Shamiko? It didn't help me pass SafetyNet so I removed it.
Unfortunately I don't have any other fixes for you but you can check SafetyNet with apps from the play store, I use YASNAC and SafetyNet 'attest'.
What phone are you using?
Click to expand...
Click to collapse
I'm using a Oneplus 6. At your suggestion, I tried Shamiko, but so far it hasn't worked.
anonymous-bot said:
There are SafetyNet checker apps you can download from the Play Store or F-Droid such as YASNAC.
Click to expand...
Click to collapse
I tried Momo from the Magisk alpha telegram channel, and it's been helpful so far, but it's detecting Magisk/TWRP files and I don't know where they are located. Is there a way to find where these files it's detecting are? This might be what Duo is detecting.
When I run YASNAC, it passes the SafetyNet check.

Drakinite said:
I'm using a Oneplus 6. At your suggestion, I tried Shamiko, but so far it hasn't worked.
I tried Momo from the Magisk alpha telegram channel, and it's been helpful so far, but it's detecting Magisk/TWRP files and I don't know where they are located. Is there a way to find where these files it's detecting are? This might be what Duo is detecting.
When I run YASNAC, it passes the SafetyNet check.
Click to expand...
Click to collapse
Get VD Infos and use it to scan your files. You can find it on XDA.

Drakinite said:
I'm using a Oneplus 6. At your suggestion, I tried Shamiko, but so far it hasn't worked.
Click to expand...
Click to collapse
Hmm ok. Like I said shimako didn't work for me either. I'm not sure why Duo is still detecting root. For reference this is what is on my DenyList:
Drakinite said:
I tried Momo from the Magisk alpha telegram channel, and it's been helpful so far, but it's detecting Magisk/TWRP files and I don't know where they are located. Is there a way to find where these files it's detecting are? This might be what Duo is detecting.
When I run YASNAC, it passes the SafetyNet check.
Click to expand...
Click to collapse
YASNAC is the replacement for Momo it looks like since Momo is Riru based (https://github.com/canyie/Riru-MomoHider)

simplydat said:
Get VD Infos and use use to scan your files. You can find it in XDA
Click to expand...
Click to collapse
Ok so this one is more helpful, but I'm not sure how to hide these that appeared. Any idea what ro.kernel.qemu.gles is? I looked through my list of installed apps and nothing like that showed up.
Should we switch to private messages to not spam the thread? Or perhaps staying in here can be helpful for those with the same problem?

Drakinite said:
Ok so this one is more helpful, but I'm not sure how to hide these that appeared. Any idea what ro.kernel.qemu.gles is? I looked through my list of installed apps and nothing like that showed up.
Should we switch to private messages to not spam the thread? Or perhaps staying in here can be helpful for those with the same problem?
Click to expand...
Click to collapse
OMG WAIT, it finally worked! I don't know what changed, but Duo is now no longer detecting root. Gotta love when things magically start working when you don't know what changed.

Drakinite said:
OMG WAIT, it finally worked! I don't know what changed, but Duo is now no longer detecting root. Gotta love when things magically start working when you don't know what changed.
Click to expand...
Click to collapse
Awesome. Hope it stays that way!

Hi,
I've switched to the new method with the DenyList & Shamiko (v0.5.0) on OnePlus 6 recently - Magisk (v24.3), however it doesn't seem to hide root from Google Pay. Can it still be a bug with Magisk, when it can't hide system apps? In the changelog of Shamiko it mentioned that it was fixed in Magisk "24102+", I'm not sure what version is this, but I imagine it's not released yet. If so, is there a way of installing this version early?
Thank you!

antivirtel said:
Hi,
I've switched to the new method with the DenyList & Shamiko (v0.5.0) on OnePlus 6 recently - Magisk (v24.3), however it doesn't seem to hide root from Google Pay. Can it still be a bug with Magisk, when it can't hide system apps? In the changelog of Shamiko it mentioned that it was fixed in Magisk "24102+", I'm not sure what version is this, but I imagine it's not released yet. If so, is there a way of installing this version early?
Thank you!
Click to expand...
Click to collapse
Version 24102 would be v24.102. So your Magisk 24.300 is newer.

How to hide my custom rom or simulate the stock rom for bank apps?

Well, a month ago I installed ArrowOS12 in my A30, but something I don't knew about custom roms is bank apps blocking cuz'... "SECURITY" (funny AF), At first it just was blocked cuz' i have magisk root, but i activated many things to hide magisk and I realize that was not my root, but the custom OS.
I can't use my UNIQUE bank account by a STUPID SECURITY POLICY, How i solve this? I tried magiskhide props config for change my fingerprint prop or whatever.
If i can emulate a fake device in my own device only for this i will, ciz that's anoying

Hi, try download this two magisk modules
Shmaiko - Direct Link | Link
Universal SafetyFix - Direct Link | Link
Hide you Magisk APP in Magisk Settings and Turn On ZYGISK install this two modules.
Open Magisk Settings and in Enforce Settings Apps, mark your Bank Apps.
It worked for me (Galaxy A40)

I already tried both, didn't worked

AysllanHiro said:
I already tried both, didn't worked
Click to expand...
Click to collapse
Pass safety before

SirKosichka said:
Pass safety before
Click to expand...
Click to collapse
i found a way to pass the app checker, but thx for your help, i already passed safetynet too

TELL US HOW!

AysllanHiro said:
i found a way to pass the app checker, but thx for your help, i already passed safetynet too
Click to expand...
Click to collapse
How?

acerfreak said:
TELL US HOW!
Click to expand...
Click to collapse
I think people are good asking questions but not sharing the solution when they get it.

for me it was:
downloading "Universal SafetyFix" (and reboot)
hidding Magisk with MagiskHide in Magisk settings
Enable Zygisk, enable"Enforce DenyList" (again in Magisk settings) and selecting banking app in it (don't forget to reboot).
Also check if you passed SafetyNet with app like YASNAC for example. And clear storage, cache of banking app.
This was working on my phone with original google services like gapps (custom ROM of course).
On my secondary phone with MicroG implementation it's not working (play store required and something more i guess).

darukutsu said:
On my secondary phone with MicroG implementation it's not working (play store required and something more i guess).
Click to expand...
Click to collapse
Were you passing safetynet on it?

ShaDisNX255 said:
Were you passing safetynet on it?
Click to expand...
Click to collapse
Of course there's the problem...I had microG installed with fakestore (passing safetynet) but I had to install playstore (to install bank app from it) and now i'm not passing safetynet even with magisk module installed.

Banking app (Starling) detecting Magisk

A banking app I've been using for years has always worked after putting it on the Deny List. I updated it recently and it now won't work with Magisk installed regardless of what I do.
As soon as I patch the boot image with Magisk it complains that the device is rooted and locks me out. That's without even installing the Magisk app, also without Zygisk etc.
I can pass SafetyNet and Play Protect certification with Universal Safety Net Fix and Magisk Hide Props Config modules. However that doesn't make the banking app work.
So far I've also tried:
* Magisk Delta, Zygisk off, with sulist on whitelist mode (also tried Delta's Magisk Hide)
* Shamiko
* Hide My Applist (various configs)
* Disabling root from Magisk app
* Renaming the Magisk app
* Downgrading the banking app (it no longer detects root but locks me out until I upgrade)
* Cloning the banking app to Work Profile with Shelter (this is the only thing that gets rid of the message about being rooted. But then it bizarrely claims it can't connect to the server to login!?)
I'm now at a loss as to what else to try. Any ideas please?

What's the banking app name?

Also install Ruru and see what might be the problem. Make the same steps you use to hide your banking apps. Also clear data of Ruru before each test.
Releases · byxiaorun/Ruru
An android sample app of detecting suspicious apps like magisk manager - byxiaorun/Ruru
github.com

makeyourself said:
A banking app I've been using for years has always worked after putting it on the Deny List. I updated it recently and it now won't work with Magisk installed regardless of what I do.
As soon as I patch the boot image with Magisk it complains that the device is rooted and locks me out. That's without even installing the Magisk app, also without Zygisk etc.
I can pass SafetyNet and Play Protect certification with Universal Safety Net Fix and Magisk Hide Props Config modules. However that doesn't make the banking app work.
So far I've also tried:
* Magisk Delta, Zygisk off, with sulist on whitelist mode (also tried Delta's Magisk Hide)
* Shamiko
* Hide My Applist (various configs)
* Disabling root from Magisk app
* Renaming the Magisk app
* Downgrading the banking app (it no longer detects root but locks me out until I upgrade)
* Cloning the banking app to Work Profile with Shelter (this is the only thing that gets rid of the message about being rooted. But then it bizarrely claims it can't connect to the server to login!?)
I'm now at a loss as to what else to try. Any ideas please?
Click to expand...
Click to collapse
I have found some banking apps are calling an external site and somehow they are detecting reporting back root. I had an issue with Halifax and Starling before.
Starling for me tripped over the last few days, and I used pcap droid to trace what hosts it was calling during app start up.
I found that when i blocked the following address:-
firebaseremoteconfig.googleapis.com
it all worked OK.
Try it if you use Adaway or a DNS provider and add this to your blacklist

spida_singh said:
I have found some banking apps are calling an external site and somehow they are detecting reportign back root. I had an issue with Haliafx and Starling before.
Starlign for me tripped over the last few days, and i used pcap droid to trace what hosts it was calling during app start up.
I found that when i blocked the following address:-
firebaseremoteconfig.googleapis.com
it all worked OK.
Try it if you use Adaway or a DNS provider and add this to your blacklist
Click to expand...
Click to collapse
I was wondering why Starling suddenly started failing - thanks!

Try hide root with some google apps on deny list. (u can search "html", "webview", "feedback" then enable hide them all apps which include these words.

giociampa said:
I was wondering why Starling suddenly started failing - thanks!
Click to expand...
Click to collapse
Ta
For ref - Process for Noobies is here;
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Files and all

spida_singh said:
I have found some banking apps are calling an external site and somehow they are detecting reportign back root. I had an issue with Haliafx and Starling before.
Starlign for me tripped over the last few days, and i used pcap droid to trace what hosts it was calling during app start up.
I found that when i blocked the following address:-
firebaseremoteconfig.googleapis.com
it all worked OK.
Try it if you use Adaway or a DNS provider and add this to your blacklist
Click to expand...
Click to collapse
Thanks. Worked for me on my 6t using LOS20 and Starling

surajpai524 said:
What's the banking app name?
Click to expand...
Click to collapse
Starling
surajpai524 said:
Also install Ruru and see what might be the problem. Make the same steps you use to hide your banking apps. Also clear data of Ruru before each test.
Releases · byxiaorun/Ruru
An android sample app of detecting suspicious apps like magisk manager - byxiaorun/Ruru
github.com
Click to expand...
Click to collapse
If I rename/repackage the Magisk app and use Deny List then the only things Ruru detects is the Magisk app itself (even though it's renamed) and TWRP. TWRP doesn't seem to be the problem because the banking app doesn't seem to care if I've got that installed so long as Magisk isn't installed to ramdisk. And the banking app is clearly detecting something other than just the Magisk app because it trips after flashing Magisk from recovery, even if the Magisk app isn't installed.
I think @spida_singh may have a solution though!

spida_singh said:
I have found some banking apps are calling an external site and somehow they are detecting reporting back root. I had an issue with Halifax and Starling before.
Starling for me tripped over the last few days, and I used pcap droid to trace what hosts it was calling during app start up.
I found that when i blocked the following address:-
firebaseremoteconfig.googleapis.com
it all worked OK.
Try it if you use Adaway or a DNS provider and add this to your blacklist
Click to expand...
Click to collapse
Thanks very much, yes it's Starling I'm having the problem with! Have not tried your solution yet but will do when I have time. Edit: Just tried and it works !!
I did have a look at the DNS requests from the Starling app and I think I may have even noticed the domain name you mention. But wouldn't have guessed it was that causing it! I'd be interested to know how that works... Are Google apps (I have minimal amount installed) spying on my applist and reporting it to my bank!? Kind of creepy! Also quite weird seeing as Google Pay/Wallet doesn't complain!

makeyourself said:
Thanks very much, yes it's Starling I'm having the problem with! Have not tried your solution yet but will do when I have time.
I did have a look at the DNS requests from the Starling app and I think I may have even noticed the domain name you mention. But wouldn't have guessed it was that causing it! I'd be interested to know how that works... Are Google apps (I have minimal amount installed) spying on my applist and reporting it to my bank!? Kind of creepy! Also quite weird seeing as Google Pay/Wallet doesn't complain!
Click to expand...
Click to collapse
Starling will manage the API in how it works for their app, only they will know, i honesltly have no idea, i know Halifax have done this in the past, and now Starling, and simply blocking it allows the app to work, but, as you, im intrigued to know what the app is 'reading' and sending back to report the device is rooted.
PCAP droid can check the payload and dump it to see what was happening with that request, and whats being sent back.

spida_singh said:
Starling will manage the API in how it works for their app, only they will know, i honesltly have no idea, i know Halifax have done this in the past, and now Starling, and simply blocking it allows the app to work, but, as you, im intrigued to know what the app is 'reading' and sending back to report the device is rooted.
PCAP droid can check the payload and dump it to see what was happening with that request, and whats being sent back.
Click to expand...
Click to collapse
Id like to know too - But use my file from post #7 and it should work

I think I spoke to soon. It's still showing up for me when I quit the Starling app.

I tried Starling app and at first it detected root but once I added to Deny list in Magisk. It didn't detect and went to login page.
My root detection bypass configs:-
Magisk (Not hidden/ Name unchanged / Not Frozen)
Magisk Deny List
Shamiko 0.7
Hide My AppList (LSPosed Module)
Universal SafetyNet Fix mod by Displex
I don't know other behaviour like after login and stuff, since I don't have an account.
Ruru screenshot: even with xposed modules and Magisk app not hidden

Prof. Yaffle said:
I think I spoke to soon. It's still showing up for me when I quit the Starling app.
Click to expand...
Click to collapse
Do you have the the domain mentioned above blacklisted in Adaway and the app on Magisk Deny List with Deny List enforcing? All working fine here now.
I also have USNF (kdrag0n) and Magisk Hide Props Config installed. Magisk 26.1
Also you have to clear the app's data before that message will go away.

Yes, I've tried it added manually and also with the file. Same result both ways. I have the Magisk app hidden, Starling in the Deny list but Enforce disabled as I'm using Shamiko.
Edit
I've just cleared the Starling app data and it seems okay at the moment

FYI - Latest May update for Pixel and Starling latest update now break the method in this thread - Searching for workaround

fkofilee said:
FYI - Latest May update for Pixel and Starling latest update now break the method in this thread - Searching for workaround
Click to expand...
Click to collapse
I'm running the latest starling absolutely fine on my Pixel 6. Same set-up (latest linesgeos nightly)
Magisk Delta
USNF by displax
PCAP block list still contains this host
What is your setup?

Official Magisk, UNSF from Displax, Fingerprint Props.
Adaway still contains the host file I made.

My OnePlus 6t on the latest Lineageos 20 nightly seems fine with Shamiko, USNF Mod and the blocked host in Adaway