Database Develop

Question Banking apps still doesn't work after enabling Magisk Hide.

Just enabling on the "Magisk Hide" option will do the thing? Or are there any other steps I should do?
Magisk Hide is already enabled in the options. I tried rebooting my phone and it is still blocking ALL banking apps that I use (I live in the Philippines.)
My phone is Xiaomi Mi 11.
- I tried installing previous versions of Magisk
- Flashing different custom ROMs: EU ROM, Global and OneOS, still the same issue.

Did you install Universal Safetynet Fix module?
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com

Hide the Magisk Manager from Magisk - Options (the cog wheel) - Hide the Magisk App. This is how it works for me, my wife, my friends... Magisk Hide on it's own doesn't do the trick...

ohtoulouz said:
Did you install Universal Safetynet Fix module?
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Click to expand...
Click to collapse
Thanks a lot, this worked! I thought it didn't work at first. I have to manually enable Magisk Hide module per application/banking app.

If it doesn´t work, just uninstall the magisk manager.
In case you need it reinstall it.
Works great for me.

RebornCheiko said:
Thanks a lot, this worked! I thought it didn't work at first. I have to manually enable Magisk Hide module per application/banking app.
Click to expand...
Click to collapse
Glad it helps.
And yes, MagiskHide is required if rooted (this is mentioned in the module description)

I use the app airfrozen to freeze magisk. Do my banking things and after that I unfreeze it. It's faster than uninstall and reinstall.
The hide worked for me under lineage and my sagit.
But under mi11 it will not. No idea why.

make sure you set Magisk hide to the SUB-items in each app you want to hide it from. Also make sure you pass Safeynet.
I am running MIUImix weekly and can pass Safetynet, googlepay etc without running any special modules.

Please clarify how denylist works with other zygisk modules

With Magisk 24 a couple of things have changed and its got me confused maybe someone here can help me understand.
Previously, with MagiskHide I could select apps for which Magisk would be hidden. In addition, I had riru/lsposed with a couple of modules, afwall+ donate and xprivacyLua for example. I selected all user installed apps for both these modules. So I basically had hidden magisk, and magisk and lsposed modules worked on selected apps.
With Magisk 24 it seems differently, but maybe I misinterpret.
With Magisk 24, I enable zygisk with enforce deny list. The description says that selected processes will have all Magisk modifications reverted.
I installed lsposed canary version which works with zygisk on Magisk 24 (on 2/2 it will be pushed to the stable channel). I installed the same modules, afwall+ and xprivacylua. Except that now all the apps that are on the zygisk denylist are marked as such in the lsposed module list. I suspect this means lsposed as a zygisk module is also reverted on apps on the denylist.
So if thats correct, basically we cannot have Magisk hidden and still have LSPosed modules applied, such as AFWall and XprivacyLUA.
Is that correct or am I misinterpreting the denylist description?

droidvark said:
With Magisk 24 a couple of things have changed and its got me confused maybe someone here can help me understand.
Previously, with MagiskHide I could select apps for which Magisk would be hidden. In addition, I had riru/lsposed with a couple of modules, afwall+ donate and xprivacyLua for example. I selected all user installed apps for both these modules. So I basically had hidden magisk, and magisk and lsposed modules worked on selected apps.
With Magisk 24 it seems differently, but maybe I misinterpret.
With Magisk 24, I enable zygisk with enforce deny list. The description says that selected processes will have all Magisk modifications reverted.
I installed lsposed canary version which works with zygisk on Magisk 24 (on 2/2 it will be pushed to the stable channel). I installed the same modules, afwall+ and xprivacylua. Except that now all the apps that are on the zygisk denylist are marked as such in the lsposed module list. I suspect this means lsposed as a zygisk module is also reverted on apps on the denylist.
So if thats correct, basically we cannot have Magisk hidden and still have LSPosed modules applied, such as AFWall and XprivacyLUA.
Is that correct or am I misinterpreting the denylist description?
Click to expand...
Click to collapse
Your misinterpreting it, deny list just denies access to zygisk to the apps you selected, you have to use LSPosed zygisk version as Rieu will not work with it. Everything else works the same

Darkaeluz said:
Your misinterpreting it, deny list just denies access to zygisk to the apps you selected, you have to use LSPosed zygisk version as Rieu will not work with it. Everything else works the same
Click to expand...
Click to collapse
Thanks! Yes I am using the Zygisk version (and I think you meant riru, rieu sounds like an autocorrect mistake ).
Maybe I didn't explain it very well. I tested it with several apps in different situations and it works like I suspected. For example, XprivacyLua can deny apps access to the clipboard. When an app is on the denylist in Zygisk and has access to the clipboard denied in XprivacyLua, it still has access to the clipboard. Once I remove the app from the denylist, XprivacyLua starts working and selected apps are denied access to the clipboard.
In other words, LSPosed modules do not work on apps that are on the denylist. During my trials I also noticed the short popup message in LSPosed saying that it might not work on apps on the denylist.
I think this is a serious regression from previous versions.

The OP has a valid question. I hope someone can answer.

I have the same query as OP. How do we configure denylist in tandem with other modules?
If any bank app is selected in the denylist, then in XPrivacyLua the same app is given a label "On denylist"

droidvark said:
With Magisk 24 a couple of things have changed and its got me confused maybe someone here can help me understand.
Previously, with MagiskHide I could select apps for which Magisk would be hidden. In addition, I had riru/lsposed with a couple of modules, afwall+ donate and xprivacyLua for example. I selected all user installed apps for both these modules. So I basically had hidden magisk, and magisk and lsposed modules worked on selected apps.
With Magisk 24 it seems differently, but maybe I misinterpret.
With Magisk 24, I enable zygisk with enforce deny list. The description says that selected processes will have all Magisk modifications reverted.
I installed lsposed canary version which works with zygisk on Magisk 24 (on 2/2 it will be pushed to the stable channel). I installed the same modules, afwall+ and xprivacylua. Except that now all the apps that are on the zygisk denylist are marked as such in the lsposed module list. I suspect this means lsposed as a zygisk module is also reverted on apps on the denylist.
So if thats correct, basically we cannot have Magisk hidden and still have LSPosed modules applied, such as AFWall and XprivacyLUA.
Is that correct or am I misinterpreting the denylist description?
Click to expand...
Click to collapse
same here :v
so much confusion lol

droidvark said:
Thanks! Yes I am using the Zygisk version (and I think you meant riru, rieu sounds like an autocorrect mistake ).
Maybe I didn't explain it very well. I tested it with several apps in different situations and it works like I suspected. For example, XprivacyLua can deny apps access to the clipboard. When an app is on the denylist in Zygisk and has access to the clipboard denied in XprivacyLua, it still has access to the clipboard. Once I remove the app from the denylist, XprivacyLua starts working and selected apps are denied access to the clipboard.
In other words, LSPosed modules do not work on apps that are on the denylist. During my trials I also noticed the short popup message in LSPosed saying that it might not work on apps on the denylist.
I think this is a serious regression from previous versions.
Click to expand...
Click to collapse
In order to make this work before what you need to do is configure the dentist and enforce toggle on. Reboot phone. Search Magisk alpha thread on telegram. Download latest Shamiko Magisk module. Toggle the enforce toggle off then flash the Shamiko module and reboot. all will work like before
Ps riru doesn't work on zygisk yet as far as I know and there is lsposed zygisk version you will need to run attached below. Remove riru core and old lsposed prior to flashing new one
Also if you need more hiding ability use hidemyapplist xposed module for other stuff

toolhas4degrees said:
In order to make this work before what you need to do is configure the dentist and enforce toggle on. Reboot phone. Search Magisk alpha thread on telegram. Download latest Shamiko Magisk module. Toggle the enforce toggle off then flash the Shamiko module and reboot. all will work like before
Ps riru doesn't work on zygisk yet as far as I know and there is lsposed zygisk version you will need to run attached below. Remove riru core and old lsposed prior to flashing new one
Click to expand...
Click to collapse
Thanks gonna try this out.
edit: everything works fine. thanks!
looks like shamiko takes the denylist and enforces it while preserving the ability for the same list to be accessible for lsposed modules. nice thing.

EGYPT2021 said:
Thanks gonna try this out.
edit: everything works fine. thanks!
looks like shamiko takes the denylist and enforces it while preserving the ability for the same list to be accessible for lsposed modules. nice thing.
Click to expand...
Click to collapse
Been using it this way for 3 plus months
Shamiko is actually a zygisk hide itself

Thank you guys for offering a possible solution but after the tests i took i think this shamiko module is just a visual module. To share one of my test results i installed this app Device info pro and on the system tab it says root management app Magisk....
So there is no solution yet i think to have zygisk deny list configured for the some app and use for example xprivacylua lua on this app and have them both working toghether properly..

okwhateverok said:
Thank you guys for offering a possible solution but after the tests i took i think this shamiko module is just a visual module. To share one of my test results i installed this app Device info pro and on the system tab it says root management app Magisk....
So there is no solution yet i think to have zygisk deny list configured for the some app and use for example xprivacylua lua on this app and have them both working toghether properly..
Click to expand...
Click to collapse
Shamiko is not a visual mod... It hides zygisk.... Maybe read a little. Also did you turn denylist toggle off before flashing shamiko.

Exactly, if shamiko v0.4.3 was not a visual mod (at least on system level) i should not be able to see what app does provide root if i got this app enabled on the magisk denylist and got this same app completely blocked by xprivacylua using Lsposed 1.7.2 zygisk.
This means that this is a pure cosmetic mod, but thanks to the developers anyway.
I think i had done a little more than only read a little haha...

Nvm

Hi, I have a similar question. I use SeftyNet from kdrag0n, works fine with a banking app (denyList + enforce)
Can I add programs preventively? For example most of Google, all banking apps (before I run them)?
Could this slow down the system? Or make the applications will not work properly?
After reading this thread, I have a question. I wonder whether to use SeftyNet from kdrag0n, or Shamiko ?
PS I've had a lot of work lately and a long pause on Android systems, And I'm just catching up.

okwhateverok said:
Exactly, if shamiko v0.4.3 was not a visual mod (at least on system level) i should not be able to see what app does provide root if i got this app enabled on the magisk denylist and got this same app completely blocked by xprivacylua using Lsposed 1.7.2 zygisk.
This means that this is a pure cosmetic mod, but thanks to the developers anyway.
I think i had done a little than only read a little haha...
Click to expand...
Click to collapse
Did you find an answer? Lsposed modules + Denylist enforced or somehow else?

I did not find a solution nor the developers did so far...
This all while running the latest version of Shamiko v0.5.0 and Lsposed Zygisk v1.8.3.
But still i want to thank the developers for their hard work because it is actually the manufacturers android developers who does close these doors for their users to modify and control their own devices.

No delta anymore

FYI .... I found out that for some funny reason one banking app with a wierd name like /data/data/com.uniken.r2fa4a.boi will not add via GUI . If you add it to denylist via GUI it will auto uncheck. Its aint a system app why then does Magisk ( latest as I type ) refuse to add it ? Go Figure. In the meantime , found a workaround by using ---denylist add < package > on command line. So far it seemed to have worked. But dunno why GUI would'nt take my commands

huskydg said:
I have a fork that restore MagiskHide from DenyList. MagiskHide can be enabled no matter Zygis is enabled or disabled. After enable MagiskHide, zygisk module will still be loaded on denylist. I also add hide zygisk, hide for isolated process and app zygote into MagiskHide.
Where is this?
Click to expand...
Click to collapse
magiskhide is already inc in the magisk --denylist command just that there is no seperate bin for that in the new one .

Thanks @toolhas4degrees ! I also use XPrivacyLua and wanted to maintain security/privacy restrictions while also hiding root for certain apps. The Shamiko mod works!

Cant access local government app due to magisk root

Hi all
I have samsung galaxy a22 5g rooted with magisk and my local government app service nsw which carries a bunch of licenses and stuff I need for work is unaccessable now. It says die to not using official software.
Is there something I can do to get this app working with magisk root?
TIA

Try to use magisk hide, which is in the app

Champdroid said:
Is there something I can do to get this app working with magisk root?
Click to expand...
Click to collapse
I think Magisk v23 stable was the last release with MagiskHide. For newer releases Zygisk to the rescue...
[Discussion] Magisk - The Age of Zygisk.
This is a discussion and help thread for the newer versions of Magisk. The main goal of this thread is to help users migrate to Magisk v24+ SafetyNet Basic integrity Pass CTS profile match Pass Play Protect certification Device is certified...
forum.xda-developers.com
You'll probably need the safetynet-fix and Props Config modules.
In Magisk v24 enable Zygisk along with Enforce DenyList then Configure DenyList and select the app. You may need to uninstall the app and reinstall, then add it to DenyList before starting the app fresh. An alternative to reinstalling that usually works is clearing the app's storage in Settings/Apps.
If the app still won't play ball it may not be possible to spoof it.

manjaroid said:
I think Magisk v23 stable was the last release with MagiskHide. For newer releases Zygisk to the rescue...
[Discussion] Magisk - The Age of Zygisk.
This is a discussion and help thread for the newer versions of Magisk. The main goal of this thread is to help users migrate to Magisk v24+ SafetyNet Basic integrity Pass CTS profile match Pass Play Protect certification Device is certified...
forum.xda-developers.com
You'll probably need the safetynet-fix and Props Config modules.
In Magisk v24 enable Zygisk along with Enforce DenyList then Configure DenyList and select the app. You may need to uninstall the app and reinstall, then add it to DenyList before starting the app fresh. An alternative to reinstalling that usually works is clearing the app's storage in Settings/Apps.
If the app still won't play ball it may not be possible to spoof it.
Click to expand...
Click to collapse
^

manjaroid said:
I think Magisk v23 stable was the last release with MagiskHide. For newer releases Zygisk to the rescue...
[Discussion] Magisk - The Age of Zygisk.
This is a discussion and help thread for the newer versions of Magisk. The main goal of this thread is to help users migrate to Magisk v24+ SafetyNet Basic integrity Pass CTS profile match Pass Play Protect certification Device is certified...
forum.xda-developers.com
You'll probably need the safetynet-fix and Props Config modules.
In Magisk v24 enable Zygisk along with Enforce DenyList then Configure DenyList and select the app. You may need to uninstall the app and reinstall, then add it to DenyList before starting the app fresh. An alternative to reinstalling that usually works is clearing the app's storage in Settings/Apps.
If the app still won't play ball it may not be possible to spoof it.
Click to expand...
Click to collapse
Legend that did the trick. Thank you very much.

[Discussion] Magisk Delta - Another unofficial third-party Magisk fork

This is not an officially supported topjohnwu project.
If you are looking for official Magisk source, please go to this page
Introduction
Custom Magisk fork by HuskyDG. Sync with official Magisk adding back MagiskHide.
http://huskydg.github.io/magisk-files
REPORT BUG IS STILL ACCEPTED ON XDA THREAD BUT PLEASE INCLUDE ADDITIONAL INFORMATION SUCH AS LOGCAT AND MAGISK LOG

.

Good day @huskydg! Delta has been running all things smoothly on my end except for the Keytrade Bank application.
I've briefly mentioned it before over here but I think this might be a better place to find a solution. I'm trying to avoid LSPosed but if there's no other solution I'll go for that anyway.
Any ideas are most welcome! Thank you for your time.
OnePlus 6T
OOS 11.1.2.2
Hidden Magisk 25.1-delta (25100)
Zygisk disabled
MagiskHide enabled
DenyList checked for pretty much all Google/Gov/Financial apps and com.google.android.gms

Timmmmaaahh! said:
Good day @huskydg! Delta has been running all things smoothly on my end except for the Keytrade Bank application.
I've briefly mentioned it before over here but I think this might be a better place to find a solution. I'm trying to avoid LSPosed but if there's no other solution I'll go for that anyway.
Any ideas are most welcome! Thank you for your time.
OnePlus 6T
OOS 11.1.2.2
Hidden Magisk 25.1-delta (25100)
Zygisk disabled
MagiskHide enabled
DenyList checked for pretty much all Google/Gov/Financial apps and com.google.android.gms
Click to expand...
Click to collapse
Keytrade Bank is working with Delta / magiskhide
do you have enforce or permissive?
try to flash momohider module or join telegram group we have husky files to flash
you dont need to hide magisk app and you should flash safetynetfix 2.1.3 riru

Timmmmaaahh! said:
Good day @huskydg! Delta has been running all things smoothly on my end except for the Keytrade Bank application.
I've briefly mentioned it before over here but I think this might be a better place to find a solution. I'm trying to avoid LSPosed but if there's no other solution I'll go for that anyway.
Any ideas are most welcome! Thank you for your time.
OnePlus 6T
OOS 11.1.2.2
Hidden Magisk 25.1-delta (25100)
Zygisk disabled
MagiskHide enabled
DenyList checked for pretty much all Google/Gov/Financial apps and com.google.android.gms
Click to expand...
Click to collapse
It's working on OOS 11.0.8 on my OP7 Pro. Your problem comes very probably from the hidden Magisk. If that doesn't solve it, Riru + Riru MomoHider should do the trick

Timmmmaaahh! said:
Hidden Magisk 25.1-delta (25100)
Click to expand...
Click to collapse
Try not to use "Hide the Magisk app" option

Timmmmaaahh! said:
Good day @huskydg! Delta has been running all things smoothly on my end except for the Keytrade Bank application.
I've briefly mentioned it before over here but I think this might be a better place to find a solution. I'm trying to avoid LSPosed but if there's no other solution I'll go for that anyway.
Any ideas are most welcome! Thank you for your time.
OnePlus 6T
OOS 11.1.2.2
Hidden Magisk 25.1-delta (25100)
Zygisk disabled
MagiskHide enabled
DenyList checked for pretty much all Google/Gov/Financial apps and com.google.android.gms
Click to expand...
Click to collapse
I installed this app out of curiosity on two my devices: 1) Xiaomi Redmi Note 4 with custom ROM Android 10, rooted with Magisk Delta 25.1 (using Riru, LSPosed and MagiskHide); 2) Xiaomi Mi Note 10 with Xiaomi.eu ROM Android 11, rooted with official Magisk 25.1 (using Zygisk, LSPosed and Shamiko). And what I observed:
1) On the first device with custom ROM I was not able to fool Keytrade Bank app even with using MagiskHide enabled, repackaged Magisk Delta app, (I know it's rather redundant, but just in case , hidden LSPosed manager and using HideMyApplist properly configured. I suppose it may be involved with the old security patches because my ROM isn't being updated for Android 10 anymore.
2) On the second device I couldn't fool Keytrade app until I used HideMyApplist LSPosed module. It suggests that Keytrade is looking for a specific packages installed... Then by a process of elimination I determined it was the HideMyApplist app itself which causes the Keytrade app to crash! But since you dont have LSPosed installed at all, maybe there is another package which Keytrade app is looking for... Anyway, looks like running Keytrade is possible even with official Magisk and Shamiko (maybe even with Enforce DenyList as well)
EDIT: Pardon, it turned out that with only HideMyApplist app hidden Keytrade crashes after a while too. But I have 13 different apps with root access hidden with another template and with that applied to Keytrade I'm able to start a profile creation process

Sir, i tried using this app in zenfone max pro m1 with latest masgik v25 with zygisk enabled. So after giving super user request YES 2 times (it prompts for 2 prompts one after another) i opening settings and enabled "magisk hide" and did reboot device.
But after reboot the root request automatically resets and i've to redo procedure again
BUT after disabling zygisk the root request reset issue didn't happened. So i did add the "instabiz ,My jio" apps to test if it detects root or not , but it still detects root.
SO how do i make it work ?

akhil17kr said:
Sir, i tried using this app in zenfone max pro m1 with latest masgik v25 with zygisk enabled. So after giving super user request YES 2 times (it prompts for 2 prompts one after another) i opening settings and enabled "magisk hide" and did reboot device.
But after reboot the root request automatically resets and i've to redo procedure again
BUT after disabling zygisk the root request reset issue didn't happened. So i did add the "instabiz ,My jio" apps to test if it detects root or not , but it still detects root.
SO how do i make it work ?
Click to expand...
Click to collapse
after enable magiskhide
flash riru module
flash safetynetfix 2.1.3
go to denylist , add google services
reboot
add apps to denylist

pitelasssss said:
after enable magiskhide
flash riru module
flash safetynetfix 2.1.3
go to denylist , add google services
reboot
add apps to denylist
Click to expand...
Click to collapse
which riru module to flash ? also do i need to disable the zygisk in order to use this app as with zygisk enabled the root request resets.

akhil17kr said:
which riru module to flash ? also do i need to disable the zygisk in order to use this app as with zygisk enabled the root request resets.
Click to expand...
Click to collapse
if you want to use delta with magiskhide disable zygisk
https://github.com/RikkaApps/Riru/releases/download/v26.1.6/riru-v26.1.6.r527.cdcb9f34c6-release.zip
https://github.com/kdrag0n/safetynet-fix/releases/download/v2.1.3/safetynet-fix-v2.1.3.zip

work perfectly fine with Livin, but i can't open Jago app.
Magisk Hide enabled
safetynet-fix 2.1.3
Riru - MomoHider

Lord Sithek said:
(...) Then by a process of elimination I determined it was the HideMyApplist app itself which causes the Keytrade app to crash! (...)
Click to expand...
Click to collapse
OMG, that's it!! How stupid of me. I had reinstalled HideMyApplist but couldn't configure it as it needs LSPosed and forgot about it. After uninstalling, Keytrade immediately worked! Thank you!

Timmmmaaahh! said:
OMG, that's it!! How stupid of me. I had reinstalled HideMyApplist but couldn't configure it as it needs LSPosed and forgot about it. After uninstalling KeyTrade immediately worked! Thank you!
Click to expand...
Click to collapse
Haha, glad I could help!

LSPosed has released new Shamiko which fixed Found zygisk for latest Momo but the banking apps that won't run with zygisk enabled like Livin by Madiri still not open.
Releases · LSPosed/LSPosed.github.io
Contribute to LSPosed/LSPosed.github.io development by creating an account on GitHub.
github.com

razael25 said:
work perfectly fine with Livin, but i can't open Jago app.
Magisk Hide enabled
safetynet-fix 2.1.3
Riru - MomoHider
Click to expand...
Click to collapse
nvm, its worked now

Tried Magisk Delta and sure enough it did pass the Instapay app. Used magisk hide, randomize package name, riru, momohider, unshare, and safety net. Downside is even though I have safetynet module, still can't pass basic attestation and somehow I broke momo app. For the momo app, I should only have init.rc as the failed test 'cause somehow momo can't see device is custom ROM and unlocked bootloader. Weird.
Edit: Safetynet passed, I just forgot to add gms and gms unstable in denylist.

BigChungus321 said:
Tried Magisk Delta and sure enough it did pass the Instapay app. Used magisk hide, randomize package name, riru, momohider, unshare, and safety net. Downside is even though I have safetynet module, still can't pass basic attestation and somehow I broke momo app. For the momo app, I should only have init.rc as the failed test 'cause somehow momo can't see device is custom ROM and unlocked bootloader. Weird.
Click to expand...
Click to collapse
Hide google gms from magisk denylist ,
restore magisk app with original name ,
instapay you need Egypt location to fully load the app, use Vpn if you want to try
momo app will show environment is broken with magiskhide

Will Shamiko work with this custom Magisk? I know Shamiko needs Zygisk enabled. But it also needs "enforce denylist" disabled. However, this app doesn't have that option. So, does this app enforce denylist or does it not enforce it? Since there is no toggle for this setting.

AnonVendetta said:
Will Shamiko work with this custom Magisk? I know Shamiko needs Zygisk enabled. But it also needs "enforce denylist" disabled. However, this app doesn't have that option. So, does this app enforce denylist or does it not enforce it? Since there is no toggle for this setting.
Click to expand...
Click to collapse
MagiskHide toggle is DenyList toggle
MagiskHide will keep zygisk to be loaded for apps on denylist
Shamiko will work even it say it's not working. It say it is not working because it receives denylist_enabled flag sent by zygisk.
And.. If you use shamiko, why not use official magisk.
I think your banking app will work fine without shamiko if it doesn't detect zygisks. Shamiko cannot completely hide zygisk.

[HELP] How to make zygisk module run on app in DenyList?

I want to hide root but still want to run my zygisk module. how to do it?

You are gonna have to be more specific. I use zygisk. You can't use riru on zygisk, but you can use lsposed zygisk and shamiko to hide root and still use apps on denylist