Thanks pokemon go. How pokemon go and safety net makes super su and xposed better!? - Xposed General

Oh... some people use fly gps... lets block everyone that has xposed/root/customroms!
-2 million everyday players...
some people still use fly gps or hacks...
Ok but that doesnt matter, we still need to fight agaisnt root! Lets block magisk...
sigh**(Hello, I'm windows 10, everyone has administrator in my S.O and the games allow you to play even if you're the administrator)
Another history: Hello I'm a android user, and I can't be the owner of my own phone! Pokemon go don't allow me to log-in...
(google update safety net api: A optional api that help a app to know if you're root or with a custom rom..)
So How pokemon go and safety net makes super su and xposed better!?
SystemLess :laugh::laugh::laugh::laugh::laugh::laugh::silly:
How root and xposed SystemLess works?
Its like a ninja, instead of directly installing files to the system of your phone. /modifiying
It simple runs virtually.. use like a separate folder, it helps about compatibility, and performance!
The root will run based of permissions... SystemLess
Ok.. and what about custom rom and unlocked bootloader?
The devs are patching the custom roms with signatures, to spoof and pass the safetynet...
They are also working with bootlooader flag. It's possible to mask your bootloader state in most cases...
Other option is to buy a phone from a manufacturer that allow easily unlocking the bootloader without encriptation. Like OnePlus One unlocking process.
What you think? Root is administrator, but we can't be the owner of our phones.. -- by pokemon go

The thread title should have read "How Pokemon GO and SafetyNet work together to sell your location data".

Related

Fix dec 2016/jan 2017: Snapchat on rooted android device running xposed.

POST IS UPDATED REGULARLY.
LINK 1 - Parallel Space: https://play.google.com/store/apps/details?id=com.lbe.parallel.intl&hl=en[/URL][/URL]
LINK 2 - Parallel Space 64-Bit Support: https://play.google.com/store/apps/details?id=com.lbe.parallel.intl.arm64&hl=en[/URL][/URL]
Salutations. (That means 'Hello').
NOTE: For those who are interested, I will include background information about how I came to the solution. All that other jazz too. First and foremost however; the fix!
SOLUTION:
Right at the top of the post, you will find two links. This being a new account and all (don't ask), until I create 10 posts I cannot include any outside links. So once I've done so, I will update the post.
STEP **: So at the top of the post, there are clearly two links. 64-Bit Android devices are becoming increasingly common. This architecture may pose a few problems. give the application framework. Should you own a 64-Bit device, I recommend installing this application too (LINK 2). This will theoretically prevent any obstacles.
Pre-requisite(s): Make sure you have the 'Snapchat' application installed. It is recommended to have installed the latest update from the Google Play Store.
STEP ONE: Download the application appended to LINK 1. This is called Parallel Space. You might recognize the name (its creators are the same who allow you to seamlessly virtualize Windows OS on Mac OS).
STEP TWO: Launch the application.
STEP THREE: You should be prompted with a grid-like interface. Here you will be greeted with a range of familiar icons. In the top right corner of each icon, you will notice a blue check-mark. Make sure that there is one next to the 'Snapchat' icon. This will ensure that the app is 'cloned'.
STEP FOUR: In the 'Parallel Space' app, tap on the 'Snapchat' icon. This will launch the application.
STEP FIVE: From here it is pretty self-explanatory. You are greeted by the standard 'Snapchat' interface. Tap on 'Log In'. Then proceed to do so.
STEP SIX: 'Snapchat' should be functioning as normal.
STEP SEVEN (BONUS): During testing, this worked on and off. --
Remain logged-in to the 'cloned' 'Snapchat' application within the 'Parallel Space' application.
Then proceed to launch the stock 'Snapchat' application.
Next attempt to 'Log-In'.
Should this operation be successful, you are then free to uninstall 'Parallel Space' and any related assets from your device.
HOWEVER, I personally do not recommend this. When logging out or updating the 'Snapchat' application, errors may be re-encountered.
Instead, I recommend that if possible, do use the stock application, but leave 'Parallel Space' installed. Using the stock app will improve efficiency and reduce the load on system resources. But keeping the 'Parallel Space' application on the device, well; you get the point.
Enjoy the fix! If it does not work, please let me know [Device Name and Model No.]. I've tested on various devices, succeeded every-time. Do keep in mind that this is a loop-hole, so may be patched in future or not work at all for some devices.
Background (Because I know someone will ask): The idea came to mind while using a LG G5 as a daily driver. I had tested every custom ROM available for the device. The problem was that with custom ROM's, there was always an issue, Malfunctioning sensors, camera's not working persistently, etc , etc.
The G5's stock ROM left me wanting more. The overbearing interface made it a living hell. Plus, the device just being rooted (NO XPOSED) meant that 'Snapchat' did not work. I looked for fixes for a time, but could not find any.
Development of ROM's for the device is on-going, and I am an active member. But I just couldn't handle not being able to use the camera (one of the device's best features) and no accelerator, screen-rotation, etc. So I went back to stock again. Do keep in mind that I was alternating/dual-booting between custom and stock ROM's just because of the camera; mainly.
This most recent time. instead of flashing stock MM, I flashed stock N for the G5. For 850, it has been officially released in some countries, and a manual flash via TWRP was a peice of cake.
This update is a lot better. I am running Nova Launcher again. So it makes it look a little better. Themes have also been improved. I am using an in-built dark one which makes the device look a lot better aesthetically. Additionally, I'm rocking a white carbon-fibre skin on the exterior; improving grip and overall security. The only issue was again, no 'Snapchat'.
After a few days, I had the idea to attempt this. I tested my theory and it worked! That's it.
Please do keep in mind that I will update this post as often as possible.
P.S This was tested just after updating to the latest version of 'Snapchat' which was a significant update. It included Shazam, Groups, etc. So you know, pretty cool that it worked.
Did not work on Google Nexus 5 running Android 7.1.1. Still gives error message saying that I can't connect to the server.
Same here, not working on freshly reinstalled and rooted 7.1.1 Nexus 5x. No Xposed, no nothing. I get the infuriating "temporarily failed" message in both cloned and regular modes.
It didn't worked. S7 edge exynos (6.0.1)
Holyphe said:
It didn't worked. S7 edge exynos (6.0.1)
Click to expand...
Click to collapse
I'm pretty sure if you get Xposed framework, there's a module that allows you to hide root from apps. Problem is that there is no Xposed framework for Android 7 yet. Hope this helps.
hot_potato said:
I'm pretty sure if you get Xposed framework, there's a module that allows you to hide root from apps. Problem is that there is no Xposed framework for Android 7 yet. Hope this helps.
Click to expand...
Click to collapse
Whats the name of it?
Holyphe said:
Whats the name of it?
Click to expand...
Click to collapse
I personally tried the module on cm13 but it doesnt work for me. I think that somehow snapchat knows when you use xposed too.
The thing is that on aosp roms with root already build in sometimes snapchat do not catch it but if you have xposed, no way you can get in. For that freaky snapchat app here is what i did: install any rom, if if had root build in i then install su uninstaller zip with twrp then log in into snapchat and after that, rooting with super su zip again. The catch is that once you log out of the app and attempt to log in again, you cant get in and you have to repeat the proccess. It's annoying as hell!!! They need to disable the security check, if people want to cheat che system somehow they will, so whats the point. Also there are much more tweaks for jailbroken iphones and they have no problem with it .
Sorry for the rant here buqt im super frustrated.
AndroidFL said:
I personally tried the module on cm13 but it doesnt work for me. I think that somehow snapchat knows when you use xposed too.
The thing is that on aosp roms with root already build in sometimes snapchat do not catch it but if you have xposed, no way you can get in. For that freaky snapchat app here is what i did: install any rom, if if had root build in i then install su uninstaller zip with twrp then log in into snapchat and after that, rooting with super su zip again. The catch is that once you log out of the app and attempt to log in again, you cant get in and you have to repeat the proccess. It's annoying as hell!!! They need to disable the security check, if people want to cheat che system somehow they will, so whats the point. Also there are much more tweaks for jailbroken iphones and they have no problem with it .
Sorry for the rant here buqt im super frustrated.
Click to expand...
Click to collapse
That's the only solution I've seen working so far. unroot and reroot. Root cloak doesn't work, parallel doesn't work. I should've logged in before rooting and I hate to do it again.
Any work arounds yet? I've seen ppl do it using titanium backup but I'm not sure if that works. Can anybody help?
Samsung s5 G900v Not working
I have been searching and searching and still haven't found a way to sign into snapcat. It took me about 6 months to be able to find out how to root my phone.
Dukeboyty said:
I have been searching and searching and still haven't found a way to sign into snapcat. It took me about 6 months to be able to find out how to root my phone.
Click to expand...
Click to collapse
Well todays your lucky day.
Step one turn off xposed.
Step two reboot
Step three sign into snapchat
Step four turn xposed back on
Step five reboot
You should be able to snap now.
Okay. I will try this on monday and will let youknow how it goes. Right now I decided to unroot to use snapchat, so I didn't loose my streaks. Thanks in advane will let you know how it goes.
immorality said:
Well todays your lucky day.
Step one turn off xposed.
Step two reboot
Step three sign into snapchat
Step four turn xposed back on
Step five reboot
You should be able to snap now.
Click to expand...
Click to collapse
Now that i think of it, when i uninstalled xposed it didn't work still. but after i "fully unrooted" through Super su and tried to sign in it worked. so it has to do with root or maybe both but the xposed didnt work for me. Thanks even though it didn't/wouldn't have worked for me!
Dukeboyty said:
Now that i think of it, when i uninstalled xposed it didn't work still. but after i "fully unrooted" through Super su and tried to sign in it worked. so it has to do with root or maybe both but the xposed didnt work for me. Thanks even though it didn't/wouldn't have worked for me!
Click to expand...
Click to collapse
Snapchat detects xposed framework.
Though at a time they did do root they since moved to blocking xposed due to the security concerns with money and also privacy of the user.
Though with certain phones and ect that could be the case I am using a s5 and have no issues.
just install magisk and systemless xposed and turn on magisk hide in magisk manager now snapchat won't detect root
then when u wanna log in just turn off xposed in xposed installer and reboot "it won't take time booting optimizing app when reactivated now" so reboot is easy
and u can have multiple accounts by backing up snapchat with titanium backup and don't ever log out just wibe its data and when u want to relog just restore the backup
and if u want to have multiple accounts access just patch the titanium backup with luckypatcher and have multiple backups (accounts)
ahmedsasker said:
just install magisk and systemless xposed and turn on magisk hide in magisk manager now snapchat won't detect root
then when u wanna log in just turn off xposed in xposed installer and reboot "it won't take time booting optimizing app when reactivated now" so reboot is easy
and u can have multiple accounts by backing up snapchat with titanium backup and don't ever log out just wibe its data and when u want to relog just restore the backup
and if u want to have multiple accounts access just patch the titanium backup with luckypatcher and have multiple backups (accounts)
Click to expand...
Click to collapse
Can u make a instructions how to do it step by step? How can i turn off xposed in xposed installer? It also works when SuperSu is installed or i have to unistall it first?
Fnn.09 said:
Can u make a instructions how to do it step by step? How can i turn off xposed in xposed installer? It also works when SuperSu is installed or i have to unistall it first?
Click to expand...
Click to collapse
make a nandroid backup if u want
1- full unroot by opening supersu and going to settings and press Full unroot and wait till it finishes and restart
2- download xposed uninstaller if u have xposed framework installed and flash it
3- install magisk manager from playstore
4- download and flash last magisk which is (12v) now from : https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
5- flash magisk v12.0 which you downloaded now your phone will have systemless root
6- go into magisk manager app and go to settings and toggle "Magisk Hide" (ON) and restart now your root is hidden
7- remove your current xposed app and install this one : https://forum.xda-developers.com/xposed/material-design-xposed-installer-t3137758
8- flash systemless xposed : https://forum.xda-developers.com/xposed/unofficial-systemless-xposed-t3388268
9- reboot and go to the xposed installer app and toggle the xposed off or on as you want when u restart it won't take time optimizing apps like before so fast now
your root is hidden now but xposed is not but you can disable it and enable it easily
Instead of using Parallel Space (which I believe to be insecure) use Island to clone your apps. It's a little more advanced to setup, but it's a lot more secure. It works for rooted and non-rooted devices. On the 1st page of the thread, it explains how Parallel Space and others repack the apk file locally, which is dangerous. https://forum.xda-developers.com/android/apps-games/closed-beta-test-incoming-companion-app-t3366295
Island never repack apk file locally, which is inherently insecure for users, since all your app data (including password input) are technically in the hand of MoboClean. (The same applies to other similar tools, e.g. LBE Parallel Space)
Instead, Island takes advantage of the underlying mechanism used by "Android for Work". This ensures that all your apps run natively in Android system and their data are securely stored in internal location of Android which is never accessible by Island. It has the same level of security as "Android for Work".
Click to expand...
Click to collapse
Be sure to read the disclaimer!!! The app is still only available in closed beta at the time of writing this, and could possibly cause you're device to bootloop or even possibly brick it, but root, xposed, or other modifications {in my opinion) has a higher chance of bootloops or bricking your device.
You follow the same steps in island to clone snapchat as you would in Parallel Space to login to snapchat. It might be possible to use the play store inside island to download snapchat inside island and login that way. I can't remember exactly how it works. I believe that island is a good way to test apps in a "sandbox environment" to keep the data excluded, safe and secure from the regular apps that you have installed outside of island.
I use Magisk now which bypasses SafetyNet which is what snapchat uses to "block access" to modified/rooted devices.
Probably the easiest method is to download Casper which is an alternative snapchat client that allows you to save snaps, and many other features that the official snapchat client can't do. Find Casper at www.casper.io
FYI Netflix has started to change how they do things as well by hiding the app's play store page from devices that have been modified or rooted, but it's still possible to simply sideload Netflix for now.

[2017.10.01] suhide-lite v1.09 [EXPERIMENTAL/UNSUPPORTED]

suhide-lite is an experimental (and officially unsupported) mod for SuperSU that can selectively hide root (the su binary) from other applications. It can also toggle visibility of packages (such as SuperSU).
SafetyNet verified passing on 2017.08.10.
This is ultimately a losing game (see the next post). suhide may stop working at any time.
Requirements
- SuperSU v2.82 SR2 or newer (link)
- SuperSU installed in SBIN mode (default on O+)
- Android 6.0 or newer
- TWRP (3.0.2 or newer with access to /data), FlashFire is not (yet) supported.
Xposed
Not supported.
CyanogenMod/LineageOS
Not currently tested or supported. Might work, might not.
Custom kernels/ROMs
If they changed build props, they will probably fail SafetyNet check (for now).
Installation
First make sure you are using SuperSU in SBIN mode on Android 6.x and 7.x
- Boot into TWRP
--- adb shell: echo "BINDSBIN=true">/data/.supersu
--- OR: flash SuperSU Config and select Systemless SBIN mode
- Reflash SuperSU v2.82 SR2 or newer
- Reboot into Android at least once
With SuperSU in SBIN mode
- Flash the suhide ZIP in TWRP
- Reboot into Android
If your TWRP does not fully decrypt /data, reflashing the SuperSU ZIP and immediately flashing the suhide ZIP without rebooting in between may sometimes allow suhide to be installed as well where it would otherwise throw an error.
Usage
The suhide GUI available from your app drawer should be fairly self-explanatory. The About tab lists further instructions.
Advanced usage
You can manually add/remove/list entries to suhide's blacklist by using these commands:
/sbin/supersu/suhide/add UID-or-processname
/sbin/supersu/suhide/rm UID-or-processname
/sbin/supersu/suhide/list
App package names are usually the same as the process name, but not always. Using the UID is safer. You can find the UID by running 'ps -n' (6.x/7.x) or 'ps -An' (8.x). The UID is the first column, and is a 5-digit number starting with 10: 10xxx.
Uninstall
Remove /data/adb/su/suhide folder in TWRP's file manager. You can uninstall the suhide app through Android's settings.
Download
UPDATE-suhide-v1.09-20171001222116.zip
In case that bootloops, try the old v1.00 version, and let me know your device and firmware:
UPDATE-suhide-v1.00-20170809130405.zip
Sauce @ https://github.com/Chainfire/suhide-lite
Hiding root: a losing game - rant du jour
Quoting myself from the OP of the old suhide thread:
Chainfire said:
Most apps that detect root fall into the payment, banking/investing, corporate security, or (anit cheating) gaming category.
While a lot of apps have their custom root detection routines, with the introduction of SafetyNet the situation for power users has become worse, as developers of those apps can now use a single API to check if the device is not obviously compromised.
SafetyNet is of course developed by Google, which means they can do some tricks that others may not be able to easily do, as they have better platform access and control. In its current incarnation, ultimately the detection routines still run as an unprivileged user and do not yet use information from expected-to-be-secure components such as the bootloader or TPM. In other words, even though they have slightly more access than a 3rd party app, they still have less access than a root app does.
Following from this is that as long as there is someone who is willing to put in the time and effort - and this can become very complex and time consuming very quickly - and SafetyNet keeps their detection routines in the same class, there will in theory always be a way to beat these detections.
While reading that may initially make some of you rejoice, this is in truth a bad thing. As an Android security engineer in Google's employ has stated, they need to "make sure that Android Pay is running on a device that has a well documented set of API’s and a well understood security model".
The problem is that with a rooted device, it is ultimately not possible to guarantee said security model with the current class of SafetyNet tamper detection routines. The cat and mouse game currently being played out - SafetyNet detecting root, someone bypassing it, SafetyNet detecting it again, repeat - only serves to emphasize this point. The more we push this, the more obvious this becomes to all players involved, and the quicker SafetyNet (and similar solutions) will grow beyond their current limitations.
Ultimately, information will be provided and verified by bootloaders/TrustZone/SecureBoot/TIMA/TEE/TPM etc. (Samsung is already doing this with their KNOX/TIMA solutions). Parts of the device we cannot easily reach or patch, and thus there will come a time when these detection bypasses may no longer viable. This will happen regardless of our efforts, as you can be sure malware authors are working on this as well. What we power-users do may well influence the time-frame, however. If a bypass attains critical mass, it will be patched quickly.
More security requires more locking down. Ultimately these security features are about money - unbelievably large amounts of money. This while our precious unlocked bootloaders and root solutions are more of a developer and enthusiast thing. While we're all generally fond of shaking our fists at the likes of Google, Samsung, HTC, etc, it should be noted that there are people in all these companies actively lobbying to keep unlocked/unlockable devices available for us to play with, with the only limitation being that some financial/corporate stuff may not work if we play too hard.
It would be much easier (and safer from their perspective) for all these parties to simply plug that hole and fully lock down the platform (beyond 3rd party apps using only the normal APIs). Bypassing root checks en masse is nothing less than poking the bear.
Nevertheless, users want to hide their roots (so do malware authors...) and at least this implementation of suhide is a simple one. I still think it's a bad idea to do it. Then again, I think it's a bad idea to do anything financial related on Android smartphone that isn't completely clean, but that's just me.
Note that I have intentionally left out any debate on whether SafetyNet/AndroidPay/etc need to be this perfectly secure (most people do their banking on virus ridden Windows installations after all), who should get to decide which risk is worth taking, or even if Google and cohorts would be able to design the systems more robustly so the main app processor would not need to be trusted at all. (the latter could be done for Android Pay, but wouldn't necessarily solve anything for Random Banking App). While those are very interesting discussion points, ultimately it is Google who decides how they want this system to work, regardless of our opinions on the matter - and they want to secure it.
Click to expand...
Click to collapse
I still stand behind this statement I made a year ago.
I will add to this another concern that I've posted before: on the A/B layout devices such as the Google Pixel (XL), it is possible to detect the device is rooted with a handful of lines of code, and I do not see any way to beat this detection aside from custom kernels. As soon as this detection is added to SafetyNet, it is pretty much game over. Frankly I'm surprised it hasn't been added yet.
The new suhide-lite vs the old suhide
The old suhide was completely different under the hood. It proxied zygote and created two different process trees for the real zygote and descendants (apps), one with root and one without, and multiplexed app instantiation calls between them. The new suhide-lite uses a completely different mechanism to achieve a similar outcome (some apps with and some apps without root).
One thing the old suhide had and the new suhide-lite version does not, is full binder interception. It could listen to and change most API calls and responses between apps and the Android system dynamically. While this may not sound like a big deal to some, from a malware-perspective this is almost a holy-grail class hack. suhide only used it to hide application packages (such as SuperSU) from apps selectively, so for example the launcher could still find it, but to some games it was completely invisible.
The binder interception code was the part that really interested me and the desire to get that working was the driving force behind the old suhide implementation. The security measures in Android's November 2016 security update blocked the old mechanism and with it the binder interceptor. Of course, I have actually written the code to bypass those (naive) protections in turn, but since that implementation of suhide was possible to detect in other ways, I kept that patch private. It may still prove useful in other projects, so it didn't make any sense to burn those work-arounds.
It may be possible to port the interceptor to the new mechanism, but it would be a lot of work and I don't think I'll be doing it any time soon, if ever. The lack of this intercepter is what makes the new suhide lite. The new suhide is able to hide packages such as SuperSU from other apps and games, but it does so via a toggle mechanism (3x alternating volup/voldown) that hides and unhides them, rather than handling the whole thing transparently.
Changelogs
2017.10.01 - v1.09
- Remove ODM and OEM mounts
- Setpropex: set multiple properties
- Cleanup: remove /boot
2017.08.15 - v1.08
- Fix a process freeze issue
- Fix framework restart survival (stop && start)
- Fix double free crash
2017.08.11 - v1.07
- Startup: Fix parallelism
2017.08.10 - v1.06
- Startup: Disable parallelism (temporary?), causes things to break sometimes
2017.08.10 - v1.05
- GUI: Synchronize changing items with the same UID
- GUI: Hide system apps (UID < 10000)
- GUI: Fix UID / package display line to ellipsize instead of wrap
- Properties: Adjust various build, adb, debug and security properties
- Startup: Improve performance by running operations in parallel
- ZIP: Allow flashing directly after SuperSU switch from image to SBIN mode, without reboot in between
2017.08.09 - v1.00
- Initial release of new code
- For old code, see https://forum.xda-developers.com/apps/supersu/suhide-t3450396
FIRST! new suhide yay. My 6p is currently running N 7.1.2. STOCK ANDROID, NO customisation whatsoever. Will 2.82 SR2 automatically update the root to sbin mode? If yes is the echo command still needed then?
Sent from my Nexus 6P with Tapatalk
Ch3vr0n said:
FIRST! new suhide yay. My 6p is currently running N 7.1.2. will 2.82 SR2 automatically update the root to sbin mode? If yes is the echo command still needed then?
Sent from my Nexus 6P with Tapatalk
Click to expand...
Click to collapse
Sbin mode is only activated by default on O (as per OP). Everything else requires the echo command.
Cool. I was avoiding using Magisk so far and was without root to be able to use certain apps like Netflix. I have a Pixel XL. Will SuperSU 2.82 SR2 alongwith suhide-lite work on my phone? Will I have to give the commands in TWRP as given in op? I intend to flash August security patch and try this during that update process. Currently I am stock (no root) with ElementalX kernel which I intend to continue using to be able to hide bootloader unlocked status.
Wow.. this works!
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
Shamusent
@Chainfire
hi,
maybe you can do something about this :crying:
i'm on nougat 7.1.2 (July security patch) been trying for long time to get this to work on citrix secure hub (by zenprise- formally known as worx)
attaching my logs and pics.
this is what i found from the logs attached:
Code:
"com.citrix.work.MAM.PolicyCheck:Found an APK requiring rooted device: eu.chainfire.supersu"
"com.citrix.work.MAM.PolicyCheck:BuildTag Test advisory ----- > is probably rooted"
SuperUser APKs Test advisory ---- > is probably rooted
the only one thing it didnt find:
Code:
D/"SecureHub"(16939): su In Path Test --- > is NOT rooted
i manged to pass safety net as you can see.
please if you can help.
Hi all and Chainfire. Thank you for this app! I tested it with a search if the Netflix app in the Playstore, but it wasn't found. I hided Playstore app in the list. Is there something I have overseen?
Otherwise I am also passing Safety Net. Thank you Chainfire!
rocky78 said:
@Chainfire
hi,
maybe you can do something about this :crying:
i'm on nougat 7.1.2 (July security patch) been trying for long time to get this to work on citrix secure hub (by zenprise- formally known as worx)
attaching my logs and pics.
this is what i found from the logs attached:
Code:
"com.citrix.work.MAM.PolicyCheck:Found an APK requiring rooted device: eu.chainfire.supersu"
"com.citrix.work.MAM.PolicyCheck:BuildTag Test advisory ----- > is probably rooted"
SuperUser APKs Test advisory ---- > is probably rooted
the only one thing it didnt find:
Code:
D/"SecureHub"(16939): su In Path Test --- > is NOT rooted
i manged to pass safety net as you can see.
please if you can help.
Click to expand...
Click to collapse
Does citrix secure hub run constantly in the background, or do you just need it now and then ?
Have you read the instructions in the About screen as stated ?
Have you tried hiding the SuperSU GUI ? (3x volup/voldown alternate) Because that is what it's detecting.
It's not detecting the su binary, I assume you already hid root from the hub ?
TR2N said:
Hi all and Chainfire. Thank you for this app! I tested it with a search if the Netflix app in the Playstore, but it wasn't found. I hided Playstore app in the list. Is there something I have overseen?
Otherwise I am also passing Safety Net. Thank you Chainfire!
Click to expand...
Click to collapse
Try clear Google Play Store and Google Play Services app data.
Netflix shows for me on a freshly installed device.
Chainfire said:
Does citrix secure hub run constantly in the background, or do you just need it now and then ?
Have you read the instructions in the About screen as stated ?
Have you tried hiding the SuperSU GUI ? (3x volup/voldown alternate) Because that is what it's detecting.
It's not detecting the su binary, I assume you already hid root from the hub ?
Click to expand...
Click to collapse
1. i can use it how ever i want (background or now and then). this is an email from my company.
2. yes. tried that.
3. yes i did. i attached a pic for you to see in the previous replay.
rocky78 said:
1. i can use it how ever i want (background or now and then). this is an email from my company.
2. yes. tried that.
3. yes i did. i attached a pic for you to see in the previous replay.
Click to expand...
Click to collapse
But is SuperSU still available from the app drawer? Did you actually press the volume button as instructed? The screenshot does not (can cannot) show that.
Chainfire said:
But is SuperSU still available from the app drawer? Did you actually press the volume button as instructed? The screenshot does not (can cannot) show that.
Click to expand...
Click to collapse
no.
When im pressing in the right order its hidden from app drawer. Also some other apps gets hidden.
p.s.
from the log i uploaded before it looks like "they" are running a search of supersu.apk in my device and mannage to find that.
is there a way to hide/stop that?
rocky78 said:
no.
When im pressing in the right order its hidden from app drawer. Also some other apps gets hidden.
p.s.
from the log i uploaded before it looks like "they" are running a search of supersu.apk in my device and mannage to find that.
is there a way to hide/stop that?
Click to expand...
Click to collapse
In that case I don't know what's going on. They shouldn't be able to iterate over APKs either. But it's all just guess work on my end at this point.
EDIT: actually I do know of a way they could still detect this even when hidden... but really the only way around that is to uninstall the SuperSU APK.
TR2N said:
... I tested it with a search if the Netflix app in the Playstore, but it wasn't found....
Click to expand...
Click to collapse
I think Safetynet is a server side check.Wait till tomorrow with su hided and check again.
Chainfire said:
In that case I don't know what's going on. They shouldn't be able to iterate over APKs either. But it's all just guess work on my end at this point.
EDIT: actually I do know of a way they could still detect this even when hidden... but really the only way around that is to uninstall the SuperSU APK.
Click to expand...
Click to collapse
do you mean if i clean flash my rom (custom) without root i will be able to use it?
And if so... Wft? No way! The hell with them.
rocky78 said:
do you mean if i clean flash my rom (custom) without root i will be able to use it?
And if so... Wft? No way! The hell with them.
Click to expand...
Click to collapse
No, just uninstall the SuperSU app from Android settings. Your apps will still have root access, you just wont have any way to manage it.
Chainfire said:
No, just uninstall the SuperSU app from Android settings. Your apps will still have root access, you just wont have any way to manage it.
Click to expand...
Click to collapse
look at this....
Do you see in the log-pic? After hiding from app drawer took a log file and suhide worked.
Only one more thing left to hide.
wtf is build tag? is it related to ro.build.tags in props?
rocky78 said:
look at this....
Do you see in the log-pic? After hiding from app drawer took a log file and suhide worked.
Only one more thing left to hide.
wtf is build tag? is it related to ro.build.tags in props?
Click to expand...
Click to collapse
Only citrix knows
Code:
getprop | grep build
may show some obvious problems.

Android Pay with SuperSU?

Is it possible to temporarily disable root on SuperSU????
I can't log into Snapchat, Pokemon Go (there's a new update okay...), or Android Pay with SuperSU root, and a full unroot would be a good amount of work, plus I don't even know if they'll continue to work if I reroot.
I tried unchecking "Enable superuser" and that seems to get rid of the root permissions but doesn't yield any results on those apps.
Thanks in advance.
Two options, if you want to keep root:
suhide-lite
Magisk, but then you'd have to change root solution.

Xposed causes Snapchat to temporarily lock account?

I have a Samsung Galaxy S6 SM-G920W8 with the UlTiMaTe NouGaT S8+ Full Port V3.1 ROM. I am rooted with Magisk V18.0, and have Snapchat enabled in Magisk Hide. Every time I install Xposed v89.3 by topjohnwu, I get a message from Snapchat team a few hours later saying that my account is being temporarily locked for 12+ hours. Is anyone else experiencing the same issue? Is there a way to stop this? Is this caused by Xposed?
Xposed or root, i dont know but i had to say goodbye to snapchat since there is no way to get it working on rooted devices,i unroot, login, then root and after a couple of hours or maybe a day cant log in...titanium backup didnt do the trick neither, it is server syncd so they find out and block u
Yes, you have to hide root from Snapchat using Magisk Hide and uninstall Snapchat.
Then flash Xposed uninstall by flashing the uninstaller zip in recovery, reboot to system, install Snapchat and hide root from it and login, once logged in reboot to recovery, flash Xposed, reboot to system and it should work and stay working.
Repeat process in future if necessary.
Redline said:
Yes, you have to hide root from Snapchat using Magisk Hide and uninstall Snapchat.
Then flash Xposed uninstall by flashing the uninstaller zip in recovery, reboot to system, install Snapchat and hide root from it and login, once logged in reboot to recovery, flash Xposed, reboot to system and it should work and stay working.
Repeat process in future if necessary.
Click to expand...
Click to collapse
That will work for MAYBE a few days. SC scans your phone now for xposed/root and will instantly ban it. Also, it keeps your device id stored on a blacklist so you'd have to change that too. They've gotten a lot sneaker about it. You can use an app like xprivacy lua or app ops to block this reading permission but it'll probably crash SC constantly. A few guys and I are trying to spoof the reading and device id and not get it to freak out but it's a slow process
agraceful said:
That will work for MAYBE a few days. SC scans your phone now for xposed/root and will instantly ban it. Also, it keeps your device id stored on a blacklist so you'd have to change that too. They've gotten a lot sneaker about it. You can use an app like xprivacy lua or app ops to block this reading permission but it'll probably crash SC constantly. A few guys and I are trying to spoof the reading and device id and not get it to freak out but it's a slow process
Click to expand...
Click to collapse
Can't say I've ever only had it work for a few days, or only ever had it maybe work. It's worked for months now without issue.
I've also not had Snapchat "scan my phone" and I don't do anything special in that department, just regular Magisk Hide.
I've had it stop working once, months ago as I said above, and I just did the process and it started working again, no device ID change or blocking of permissions.
Redline said:
Can't say I've ever only had it work for a few days, or only ever had it maybe work. It's worked for months now without issue.
I've also not had Snapchat "scan my phone" and I don't do anything special in that department, just regular Magisk Hide.
I've had it stop working once, months ago as I said above, and I just did the process and it started working again, no device ID change or blocking of permissions.
Click to expand...
Click to collapse
If you gave sc storage permission, then yes it does scan your phone periodically. It's declared in detail, in apps like app ops. Anyway though, without anyone capturing logs of when the ban is done (I'm talking to everyone that runs a sc mod of any sort) , nobody can really come up with the exact reason for them, only make educated guesses because it seems to not be one thing related \_(•-•)_/ Happy snapping!
Seems to be that Snapchat is detecting Xposed, whether it be non-systemless up to 8.1 oreo (v90 beta-3), systemless by topjohnwu, or systemless for 7.0-9.0 (EdXposed). I used Snapchat with non-systemless Xposed by rovo89 up till a month ago when I upgraded to PIE, then I used EdXposed. My new 9.0 PIE setup worked well with SnapFreedom and EdXposed until I upgraded EdXposed and Snapchat to 10.51.0.0 when I got my first ban.
Plan for attack (haven't tried, banned on alt) to use Snapchat and Xposed (Possibly also Xposed modules?) without ban:
-Use AppCloner to rebuild the snapchat apk with minimal permissions (I have premium version). I was going to go this route, but AppCloner rebuilds com.snapchat.android to com.snapchat.androie, breaking SnapFreedom. Bare permisisons: CAMERA, MICROPHONE, and maybe LOCATION? PHONE permission will give away your IMEI and other stuff, and STORAGE may trigger Xposed detection.
-Use LuckyPatcher to deny snapchat certain perissmions, including read external storage.
This thread got me thinking: https://forum.xda-developers.com/xposed/xposed-root-snapchat-uninstall-xposed-t3909199
I am using Pixen OS android 10 on oneplus 6. I have magisk root and want to install xposed. How to prevent snapchat account lock?

Safety Net Failed in Safe Mode

Hello. I have unlocked bootloader with TWRP installed with default Stock Kernel. Also I have Magisk 20.4 with Edxposed installed and I can't pass the Safety Net. Until before 2-3 months the problem was due to Edxposed. If I deactivate the Riru core from Magisk then I passed the Safety Net. Now something very strange happens and the Edxposed is not only the Suspicious. If I disable it then again I Failed the Safety Net. I tried in safe mode in which disables Magisk, Edxposed and all extra apps (it leaves only the Play Store and some default apps like Duo if I remember well) etc ... and I can't pass the Safety Net again. I tried to Reflash the rom via TWRP so that to have the default boot.img and default boot recovery but again can't pass the Safety Net. How can detect what is which makes the Safety Net to be failed ?
Note 1 : I know that if I make format so that to erase not only the system partition but and data with internal partition and flash the rom from beginning then I would pass the Safety Net as new user but all this process is NOT solution because I should install all the apps with settings and transfer all personal data from the beginning.
Also the sense is to understand for which reason something happens and NOT to make format to resolve all the problems because you will never become better and the unique solution would be the format which is some process, time consuming.
Note 2: The Valid Pass in Safety Net is NOT always from Magisk but from some other third party software like Root Checker which can do the same job. The reason is that the most usual to check Safety Net is from Magisk which make someone to make Magisk to Pass Safety Net but ONLY VISUAL. What I mean ? If you install the HiddenCore Module from Edxposed then the Magisk show that you Pass the Safety Net while any other similar software like Root Checker shows as result failed and if you go to search Netflix or Revolut in Google Play which is some quick way to check if you really pass or fail the Safety Net then you can't find them as result due to failing in Safety Net.
Johnn78 said:
Note 1: I know that if I make format so that to erase not only the system partition but and data with internal partition and flash the rom from beginning then I would pass the Safety Net as new user but all this process is NOT solution because I should install all the apps with settings and transfer all personal data from the beginning.
Click to expand...
Click to collapse
I don't have the solution for your issue specifically, but I have a tip for you in case you would need to reinstall the whole system in the end: you can use titanium backup, or oendbackup (this one you find at f-droid), or another root backup solution (either free, or paid like swift backup) to save your apps + data, so you can recover it later without having to go through the whole annoying process of doing/installing/configuring everything again. Making it a lot easier.
abacate123 said:
I don't have the solution for your issue specifically, but I have a tip for you in case you would need to reinstall the whole system in the end: you can use titanium backup, or oendbackup (this one you find at f-droid), or another root backup solution (either free, or paid like swift backup) to save your apps + data, so you can recover it later without having to go through the whole annoying process of doing/installing/configuring everything again. Making it a lot easier.
Click to expand...
Click to collapse
If I have the app which makes the perfect restore then I wouldn't have problem to make format so that to make restoring later. In past I had tried the twrp which has option for backup but the restore in system and data partition is not good. I couldn't restore the apps such it was when I had made the backup. C an the titanium or oandbackup restore the apps such it was when Imake the backup ?
If you boot into Android Safe Mode, Magisk and modules are still active (unless you use the current Canary, 20411+, in which case Magisk will disable all modules). It's just the Manager and other apps that are disabled.
First thing you should check is if MagiskHide is even enabled, and if it is you should toggle it off and on again.
Second thing is to see if it works. Add a root app or an app like Rootbeer to the Hide list and see if it detects root.
And more: https://www.didgeridoohan.com/magisk/MagiskHide#hn_SafetyNet
Didgeridoohan said:
If you boot into Android Safe Mode, Magisk and modules are still active (unless you use the current Canary, 20411+, in which case Magisk will disable all modules). It's just the Manager and other apps that are disabled.
First thing you should check is if MagiskHide is even enabled, and if it is you should toggle it off and on again.
Second thing is to see if it works. Add a root app or an app like Rootbeer to the Hide list and see if it detects root.
And more: https://www.didgeridoohan.com/magisk/MagiskHide#hn_SafetyNet
Click to expand...
Click to collapse
I don't know if finally happens something with hide of Magisk. I had until now the Root Checker to check about rooting and SafetyNet. If I run Root Checker then it tells me that I am rooted (and failed SafetyNet) and if I hide It then it refers that I am unrooted such the first image shows. But question is, is that correct or happens such with Magisk that may refers that you pass the Safety Net while is reality is NOT truth ? I say this, because I run the Root beer which you told me but if I hide it or not then in both situations, it refers that I am rooted (image 2 & 3). The hide isn't seem to not doing anything because If I don't hide Root beer then such you can see I have 6 "X" while if I hide it then I have only one in "Root Management Apps". Whats means this result ? I tried to turn off and on again from the settings of Magisk the hide but not any result.
That likely means that MagiskHide is working but that you haven't repackaged the Magisk Manager with a random package name. There's an option for that in the Manager settings.
That also means that the SafetyNet failure is because of your setup. Something is triggering it and you're going to have to figure out what. Use the information in the link I posted earlier to help you on your way.
Didgeridoohan said:
That likely means that MagiskHide is working but that you haven't repackaged the Magisk Manager with a random package name. There's an option for that in the Manager settings.
That also means that the SafetyNet failure is because of your setup. Something is triggering it and you're going to have to figure out what. Use the information in the link I posted earlier to help you on your way.
Click to expand...
Click to collapse
Now I saw this setting in settings about repacking with random name. Is this new setting in Magisk ? Because I don't remember to have seen it again in previous Magisk versions. If I go to repackage it, it has as default name "Manager". Should I leave this name or to change this to someother random name ?
Johnn78 said:
Now I saw this setting in settings about repacking with random name. Is this new setting in Magisk ? Because I don't remember to have seen it again in previous Magisk versions. If I go to repackage it, it has as default name "Manager". Should I leave this name or to change this to someother random name ?
Click to expand...
Click to collapse
It's not a new feature... I had to go back and check, but John showcased the first version of hiding the Manager in August 2017 and it was then included in the release of Magisk v14.0 in September 2017. The hiding mechanism has improved a lot since then, but the concept has been around for a while.
Some root detection methods actually do look for "Manager" in the app label (stupid way of detecting root, but hey), so renaming it to something else could be a good idea. It won't hurt, that's for sure.
Didgeridoohan said:
It's not a new feature... I had to go back and check, but John showcased the first version of hiding the Manager in August 2017 and it was then included in the release of Magisk v14.0 in September 2017. The hiding mechanism has improved a lot since then, but the concept has been around for a while.
Some root detection methods actually do look for "Manager" in the app label (stupid way of detecting root, but hey), so renaming it to something else could be a good idea. It won't hurt, that's for sure.
Click to expand...
Click to collapse
I repacked it with different name and the rootbeer appears as result not rooted but the safety net remained sa failed. After I unistalled completly the EdXposed with its modules, LuckyPatcher & Magisk. Also I run and the Magisk Unistaller via twrp and the Edxposed unistaller (this failed because it couldn't detect the edxposed as install due to unistallation of edxposed before) and safety Net remained as Failed. I tried and in safe Mode but the problem persists. Overmore I restore the original boot.img so that to unistall the twrp and go back to original recovery but the Failing in safety Net remains either I go from normal boot either from safe mode. The only which I haven't tried is to lock again the bootloader but I don't believe that this is the problem because in past I always have it unlocked and had passed the Safety Net. I have read that the snet is the process of play store service which decides if mobile will pass the safetynet or not. Can't we unistall this service ?
& something else if you know it, the result of safety Net is "decided" only one time in every boot ? Because If it is some process which make the safety net to be failed and I kill the process then will I get immediate the pass in safety Net or I should restart the mobile as result the process will come again because it will be located in boot list ?
SafetyNet doesn't check for the Manager. That was just for you to fully hide Magisk from other detection methods.
If you uninstall Magisk you can't pass SafetyNet with an unlocked bootloader (unless you are using a custom kernel that masks the bootloader state). MagiskHide helps hiding the unlocked bootloader, so uninstalling it will trigger SN.
If you want to figure things out you have to leave Magisk installed with MagiskHide active (or lock the bootloader, but that's likely not advisable since it can brick your device unless you first restore it to completely stock).
Edit: you can of course go without Google services, but if you are using the stock OEM ROM this could prove troublesome and not worth the effort. If you do, you can of course not use any apps or services that depend on SafetyNet. What is your reason for wanting to pass SafetyNet anyway? Do you actually need it?
Didgeridoohan said:
SafetyNet doesn't check for the Manager. That was just for you to fully hide Magisk from other detection methods.
If you uninstall Magisk you can't pass SafetyNet with an unlocked bootloader (unless you are using a custom kernel that masks the bootloader state). MagiskHide helps hiding the unlocked bootloader, so uninstalling it will trigger SN.
If you want to figure things out you have to leave Magisk installed with MagiskHide active (or lock the bootloader, but that's likely not advisable since it can brick your device unless you first restore it to completely stock).
Edit: you can of course go without Google services, but if you are using the stock OEM ROM this could prove troublesome and not worth the effort. If you do, you can of course not use any apps or services that depend on SafetyNet. What is your reason for wanting to pass SafetyNet anyway? Do you actually need it?
Click to expand...
Click to collapse
Now with default boot, I will go to install Magisk so that via hiding to hide the the unlcking of bootloader. Do you consider some Magisk version as best ? Stable or canary or something else ?
Lately I want to istall the Revolut & the Google Play store can't find it as result. After from many days I couldn't find etflix. Later I learnt that was due to failing in safety net. I found them as apk & installed them successfully but can't get updates from play store for these two apps because mark my device as failed in safety Net. Also if I go to update the os via fota (and with stock boot img) I got error & I suppose that is due to safety Net. In past I could update os only if I have boot stock img & passing the safety Net.
@Didgeridoohan hello bro. I resolved the problem. I cleared the data and cache of Google Play Store, Google Play Services and Google Framework Services and after from restarting I passed the Safety Net with Edxposed installed and activated. Thanks for your help !

Categories

Resources