Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

MagiskHide - issue in mount namespace hiding for isolated processes #2406

Closed
kam821 opened this issue Feb 6, 2020 · 77 comments
Closed

MagiskHide - issue in mount namespace hiding for isolated processes #2406

kam821 opened this issue Feb 6, 2020 · 77 comments
Labels
confirmed Issue confirmed to exist and the reason is known

Comments

@kam821
Copy link
Contributor

kam821 commented Feb 6, 2020

First of all, I would like to say that I am aware of the fact that raising the issue of MagiskHide is usually irritable and I will understand if my thread will be ignored.

I recently read an article:
https://darvincitech.wordpress.com/2019/11/04/detecting-magisk-hide/

It describes issue in MagiskHide mount points hiding for isolated processes - and detect Magisk by exploiting this issue.

I tested it on my own by activating MagiskHide for Brave and all subprocesses.

For every sandboxed_processX, the mount list looks like MagiskHide is off, other processes (like main/privileged_processX) are property hidden.

Main process - mountstats:
https://pastebin.com/6t1p1wxs

Sandboxed_process - mountstats:
https://pastebin.com/YasyF3tV

Magisk/Magisk Manager: 20.4-ed58cf95.
Xiaomi Mi 8 / Android 10 / xiaomi.eu 20.1.21

Regards.

@skittles9823
Copy link

skittles9823 commented Feb 6, 2020

Yea I just built the app myself and gave it a test and it successfully found magisk on the latest canary build.

@surbiks
Copy link

surbiks commented Feb 12, 2020

yea i tested in latest release and detect magisk

@djechelon
Copy link

djechelon commented Feb 17, 2020

Go ahead @kam821 and discuss!
The main purpose of #1152 is to prevent crowds from opening tickets to certain apps, which should be chaffed, analyzed and decompiled to find out more. And maybe find (like the linked banking ticket) that the OP was do dumb that they never actually changed Magisk package name in the first chance.

This ticket discuss a novel technique of Magisk-busting, with a reproducibile case and is focused on the anti-root approach.

There is a huge difference between the two kinds of issues.

@kam821
Copy link
Contributor Author

kam821 commented Feb 19, 2020

@djechelon
I know what's the point of #1152 ;)
Too many "weneta fix" and "I didnt do anything to prevent Magisk detecting and X app detects Magisk, why?"
But I understand that MagiskHide itself is not a priority Magisk feature, but rather a very useful addition.

Unfortunately, at the moment I am not familiar enough with all the Magisk and Android mechanisms, so I can't do anything more than report it :(

@goodwin
Copy link

goodwin commented Mar 19, 2020

@topjohnwu Are you aware of that issue? Looks like HCE has already this check implemented, and I see other apps using the same check for detecting Magisk - so, this becomes as common detection method that breaks Hide in the root

@osm0sis osm0sis added regression Something works in previous versions but not in the current one confirmed Issue confirmed to exist and the reason is known labels Mar 23, 2020
@topjohnwu topjohnwu removed the regression Something works in previous versions but not in the current one label Mar 28, 2020
@Kovur
Copy link

Kovur commented Apr 22, 2020

Why removed? The problem is still here. I can't use government application, because it detects Magisk.
SafetyNet passed, hide enabled, package and app renamed - not helping.

@djechelon
Copy link

djechelon commented Apr 22, 2020

@Kovur removing the "bug" label doesn't mean "the bug is removed from code". Means that @topjohnwu confirmed the issue and might be working on it.

Also, even if you disclosed your "government app"'s name:

So, please, do not comment on this post basing that "one app is detecting root", because #1152

@Kovur
Copy link

Kovur commented Apr 22, 2020

Sorry, my bad.
The application is: https://play.google.com/store/apps/details?id=ua.gov.diia.app
It's already decompiled and the detection code is found: https://4pda.ru/forum/index.php?showtopic=976919&st=540#entry95456892
It's in Russian, so I'll translate it:
"It's the well-known Magisk flaw (mount leak).
It sits in smali / ua / gov / diia / app / e.smali
Line:
const-string v0, "/ proc /% d / mounts"

@djechelon
Copy link

That is ok. You shall wait at least until the issue is marked closed. When the author releases a new version of Magisk, they will tag this issue in the change log. Until then, your Ukrainian app won't still work because a patch for this has not been released.

@mthnry
Copy link

mthnry commented Apr 25, 2020

Can confirm the DKB Tan2go app also manages to detect root on the latest versions.
The banking app doesn't though or at least still works.

@Didgeridoohan
Copy link
Contributor

@mthnry That's got nothing to do with the method described here. I've tested v2.5.1 of DKB Tan2go and Magisk can hide from it just fine. You've got something else going on, but this is not the place for it.

@mthnry
Copy link

mthnry commented Apr 27, 2020

For what I've seen so far is there are other users experiencing problems with Tan2go 2.5.1. It worked fine until the latest update to the app, so I'm not blaming my configuration.

@Andreychik32
Copy link

The issue is still present. Is maintainer aware of it and doing something or still ignoring?

@Didgeridoohan
Copy link
Contributor

The issue is still present. Is maintainer aware of it and doing something or still ignoring?

Such a trolly way of getting a response... But I'll bite. The issue is still marked as open, which means it's still on the to-do list. It'll get addressed one way or another at some point, not a moment sooner. Cheers.

@piekay-zz
Copy link

@mthnry S-pushTan is detecting Magisk 20.4 (propably using this method)

@mthnry
Copy link

mthnry commented May 15, 2020

@mthnry S-pushTan is detecting Magisk 20.4 (propably using this method)

It doesn't detect Magisk canary, at least DKB doesn't.

@topjohnwu
Copy link
Owner

FYI for all those are concerned: hiding isolated process is non-trivial, and don't expect to see a fix for this in the near future. I do have big plans which makes hiding isolated processes possible, but that is still in the early planning stages.

@androidacy-user
Copy link

@topjohnwu

if isolatedProcess = true ;
then do hideRootPlus ;
else hideRoot ;
fi

If only right 🙃

Sent from my Pixel 3 XL using FastHub

@kam821 kam821 mentioned this issue May 27, 2020
@vvb2060
Copy link
Collaborator

vvb2060 commented May 27, 2020

I have a Magisk branch that solves this problem. Magisk Lite only has SU and no Magisk module function. If your banking apps detected Magisk, and you don't use Magisk module, you can try this branch.

Download: https://github.com/vvb2060/magisk_files
Source code: https://github.com/vvb2060/Magisk
Before installation, all modules must be disabled/removed!! Then, you can only use Magisk Lite's Magisk Manager.

Test detection app: https://github.com/vvb2060/MagiskDetector/releases/latest

@zx900930
Copy link

zx900930 commented May 29, 2020

I have a Magisk branch that solves this problem. Magisk Lite only has SU and no Magisk module function. If your banking apps detected Magisk, and you don't use Magisk module, you can try this branch.

Download: https://github.com/vvb2060/magisk_files
Source code: https://github.com/vvb2060/Magisk
Before installation, all modules must be disabled/removed!! Then, you can only use Magisk Lite's Magisk Manager.

Test detection app: https://github.com/vvb2060/MagiskDetector/releases/latest

Tested and working!
image
Before(The 20.4 version):
image
app package: com.stove.epic7.google

After install your magisk lite version, app can start with no problem.
image
image

Can you also upload the uninstaller.zip please? I can't flash back to the 20.4 version now.
It shows "unsupported boot image."

@Santhu195
Copy link

Santhu195 commented May 30, 2020

@vvb2060 the magisk you mentioned in new repo without modules seems not working with my Huawei emui 9 device, i could flash it but it is not booting into magisk system, rather it boots to recovery or system without magisk

@tn-17
Copy link

tn-17 commented May 31, 2020

@zx900930 Did you have to turn on magisk hide for epic seven as well? I can't get magisk hide to keep the on switch for the game.

@zx900930
Copy link

@tnguyenseo keep it OFF for epic seven. keep it ON for the apps need root.

@vvb2060
Copy link
Collaborator

vvb2060 commented May 31, 2020

@zx900930 Lite version is sync with the Canary version, uninstaller.zip can directly uses official uninstaller.zip. see https://github.com/vvb2060/magisk_files/blob/master/lite.json

@Santhu195 Lite version is sync with the Canary version, it did not modify what you said.

@Kovur
Copy link

Kovur commented Nov 6, 2020

Well, it's not in Russian, it's in Ukrainian, stop misinforming people please, English community thinks Ukraine is part of Russia because of that.

Sorry, but you wrong. I found that post about detection details on 4pda forum. The post is in Russian language, so I've translated it for everyone. That's all.

@sTiKyt
Copy link

sTiKyt commented Nov 7, 2020

Well, it's not in Russian, it's in Ukrainian, stop misinforming people please, English community thinks Ukraine is part of Russia because of that.

Sorry, but you wrong. I found that post about detection details on 4pda forum. The post is in Russian language, so I've translated it for everyone. That's all.

I misunderstood it, I was thinking you are referring to app description on play store or something…

@jh0bc
Copy link

jh0bc commented Jan 2, 2021

My bank app "C6 Bank" appears to be using this exploit to detect root even with hide + package rename

https://play.google.com/store/apps/details?id=com.c6bank.app

I'm using latest Magisk Canary on my Mi 9T Pro

Edit: On manifest file have a declaration of an isolated process "hj.Oj"

Edit 2: Maybe we will have great news soon 8e61080

@vvb2060
Copy link
Collaborator

vvb2060 commented Jan 14, 2021

vvb2060@ed3fb0c
need Android 11+

@wiidev
Copy link

wiidev commented Jan 16, 2021

With the canary build installed Sky Go can still detect root, despite magisk detecting the isolated process and hiding everything.

hide_list add: [isolated/com.bskyb.skygo:vgdrm_helper:com.nds.vgdrm.impl.generic.VGDRMHelperService]
hide_list add: [com.bskyb.skygo/com.bskyb.skygo]

2021-01-16

They updated their lib/drm last year and now it circumvents MagiskHide and detects /sbin/su. I know that because if I launch a file manager with root and temporarily rename the su binary then Sky Go lets me watch live TV and movies again.

@jh0bc
Copy link

jh0bc commented Jan 17, 2021

With the canary build installed Sky Go can still detect root, despite magisk detecting the isolated process and hiding everything.

hide_list add: [isolated/com.bskyb.skygo:vgdrm_helper:com.nds.vgdrm.impl.generic.VGDRMHelperService]
hide_list add: [com.bskyb.skygo/com.bskyb.skygo]

2021-01-16

They updated their lib/drm last year and now it circumvents MagiskHide and detects /sbin/su. I know that because if I launch a file manager with root and temporarily rename the su binary then Sky Go lets me watch live TV and movies again.

I think this feature (hiddind root from isolated process) is not yet fully implemented

@febryanasaperdana
Copy link

febryanasaperdana commented Jan 20, 2021 via email

@wiidev
Copy link

wiidev commented Jan 22, 2021

I think this feature (hiddind root from isolated process) is not yet fully implemented

It looks like it should be functioning, but maybe there's still issues that need to be worked out.

I do see this in the log...

proc_monitor: [com.bskyb.skygo] PID=[14355] UID=[10320]
hide: handling PID=[14355]
hide: Unmounted (/system/xbin)
hide: Unmounted (/system/lib64)
hide: Unmounted (/system/lib)
hide: Unmounted (/system/app)
hide: Unmounted (/sbin)
hide: Unmounted (/system/etc/hosts)

But there's no mention of the isolated process other than it being added to the hide list.

@i1itione
Copy link

i1itione commented Feb 9, 2021

I have a Magisk branch that solves this problem. Magisk Lite only has SU and no Magisk module function. If your banking apps detected Magisk, and you don't use Magisk module, you can try this branch.

Download: https://github.com/vvb2060/magisk_files
Source code: https://github.com/vvb2060/Magisk
Before installation, all modules must be disabled/removed!! Then, you can only use Magisk Lite's Magisk Manager.

Test detection app: https://github.com/vvb2060/MagiskDetector/releases/latest

Does Magisk Lite's Magisk Manager support hiding itself via repack/rename?
I tried the hide manager option in settings, but it seems doesn't work.

EDIT: It works, but download speed is slow (60 KB/s ~ 80 KB/s) when hiding.

@david8557
Copy link

I have a Magisk branch that solves this problem. Magisk Lite only has SU and no Magisk module function. If your banking apps detected Magisk, and you don't use Magisk module, you can try this branch.

Download: https://github.com/vvb2060/magisk_files
Source code: https://github.com/vvb2060/Magisk
Before installation, all modules must be disabled/removed!! Then, you can only use Magisk Lite's Magisk Manager.

Test detection app: https://github.com/vvb2060/MagiskDetector/releases/latest

Is there anyway we can use Riru Module with your Magisk?

@soredake
Copy link

5e56a6b

@vvb2060
Copy link
Collaborator

vvb2060 commented Feb 27, 2021

https://github.com/vvb2060/riru-unshare/actions
riru module, enable enhanced mode for Magisk Hide, allow Magisk Hide to handle isolated processes.
!!need 5e56a6b !!

@cibai7181
Copy link

Hi, my app suddenly detect my rooted device and it is not functioning anymore.

I tested MagiskDetector and found out Magisk Hide is not working.
I tried termux SU, nagiskhide disable, Magiskhide enable.
Toggle Off MagiskHide button, restart.
Toggle On MagiskHide button.

Still showing Magisk Hide is not working in detector.

Please kindly suggest solution and assist, thank you.

Screenshot_20210302-114802
Screenshot_20210302-114808
Screenshot_20210302-114818
Screenshot_20210302-114839
Screenshot_20210302-114850

@jh0bc
Copy link

jh0bc commented Mar 7, 2021

https://github.com/vvb2060/riru-unshare/actions
riru module, enable enhanced mode for Magisk Hide, allow Magisk Hide to handle isolated processes.
!!need 5e56a6b !!

Just a little feedback

Flashed latest Canary (22002) + Riru Core (v. 23.9) + Riru Unshare Module and boom!

Now Magisk fully hide from any root detection! Including Isolated Process 😏

Many thanks my friend! 😁😁😁

@redmare27
Copy link

@jh0bc can you guide me on how to install riru unshare module? I have searched on magisk manager module, but I can't get it

@jh0bc
Copy link

jh0bc commented Mar 8, 2021

@jh0bc can you guide me on how to install riru unshare module? I have searched on magisk manager module, but I can't get it

Flash latest Magisk Canary

Install the Riru core module v. 23.9 from Magisk repo.

Now download the zip from the link below:

https://github.com/vvb2060/riru-unshare/releases

Flash the zip trough Magisk Manager

Enable Magisk Hide for the app including their isolated process (if you don't know what is the correct one just mark all)

Enjoy! ;)

@Karanveer7921
Copy link

Karanveer7921 commented Mar 18, 2021

I successfully bypassed root detection using this method !!!

Thanks buddy 😀

Now I have some doubts :-

I was using a edxposed module before to bypass some other detections like usb debugging , developer options enabled or not ,etc .. I don't want to disable these settings while app is running

I have another fix for these settings without xposed but I need my exposed module working for that app for some other hooks

But now the problem is : after hiding, my xposed module doesn't work ( it doesn't trigger loadPackage)

So what I have assumed , magisk hidden apps can't use xposed coz thats also may be a workaround to check root using stack trace or something (just assumption , definately there would be other reasons )

At last my question is , can I somehow use xposed module on app which has magisk hide on ?

I know java and android so I was capable of building my own xposed but not magisk modules , but just imagine if I was able to build magisk modules , then can there be a solution to fake that Settings ?? Coz I think magisk hide unmounts all that redirected/fake paths for that app n it means we can't use fake props for that app ??

What I need is either make xposed work or magisk module that may do this ..

Before that main question is , Is that possible ?

@TheOnlyZii
Copy link

https://github.com/vvb2060/riru-unshare/actions
riru module, enable enhanced mode for Magisk Hide, allow Magisk Hide to handle isolated processes.
!!need 5e56a6b !!

Hello Thanks for the Extension
it was working great as indented until just yesterday one of my bank mobile app decided to push and update and it started detecting root again.
i also noticed that it has 2 processes in magic hide but one of the process i cant seem to enable magisk hide on. everytime i put a check on it go back to menu and open magisk hide again it keep unchecking it self.
Im not a dev, im just reporting this issue for now maybe someone will have a workaround

Here is the app if anyone is curious
https://play.google.com/store/apps/details?id=com.bankmandiri.mandirionline&hl=en&gl=US

@vvb2060
Copy link
Collaborator

vvb2060 commented Mar 18, 2021

@TheOnlyZii https://github.com/topjohnwu/Magisk/pull/4056/commits/5f0623332eb7331da34c30b77797514efcad7051

@emirefek
Copy link

emirefek commented Mar 18, 2021

@TheOnlyZii https://github.com/topjohnwu/Magisk/pull/4056/commits/5f0623332eb7331da34c30b77797514efcad7051

What this URL means? I'm also having problem while hiding root. My phone is OnePlus8Pro (Android 11+ Riru-unshare + Safetynet passed) installed. If you are interested My banking app (Yapı Kredi Mobil)

And I'm going to share my own story about it, If you someone want any logs or infos about this spesific root detection method I free I can share everything with some dev:

Device: OnePlus 8 Pro / OOS11_OB7(Android 11) / Magisk Canary (f152b4c,22005) / Kernel( Omega & Official stock both tried. )

Installed Magisk Modules: "ADB&Fastboot for Android NDK / MagiskHide Props Config / OOS Native Call Recording Enabler / Systemless Host / Riru / Riru - Enchand mode for Magisk Hide / Riru - LSPosed"

LSPosed modules: xPrivacyLua (Disabled app listing for Yapıkredi Mobil)

About the app: "Yapı Kredi Mobil" it is a well known Turkish bank. Google Play URL

SafetyNet is passed, "Rootbeer Sample" app is passing all tests.
Root is obtained with boot.img patching method, No custom Recoveries.
There is no root related apps, magisk app is repacked with random name.
I tried this xPrivacyLua method from here. App crashes when I enable "use tracking" checkbox. Not worked.
Then I tried Riru-unshare method. Also failed.
Tried vvb2060/MagiskDedector and it says "init.rc has been modified by Magisk" this app also can detect root."
In every process I made. I rebooted and cleared cache. FYI I can install Netflix in Google Play.

I tried App made by VD171@xda-forum called "VD Infos xda page" and app given this output to me. Output:

---------------------------------------
-> Quantities
Total Time: 23 minutes and 57 seconds.
Total of tries: 6,062,778.
Total found: 4.
* Emulator detected.
---------------------------------------
-> ROOT
#1. [* EMULATOR]: [ro.kernel.qemu.gles]: 0
#2. [Found]: /system/lib/libsigchain.so
#3. [Found]: /system/lib64/libsigchain.so
#4. [Found]: com.dolby.daxservice.DaxApplication
---------------------------------------

If it is not releated or is my bad I'm sorry I can delete my comment after that. Thanks.

@TheOnlyZii
Copy link

@emirefek for my particular case the fix is already been made just need to be implemented in the next releases by the dev

im not a dev i cant comment about your issue.
im just putting mine for awareness

@Mark-Joy
Copy link

Hi All,
Currently, is there a way to hide "Magisk su processes"?
IMG_20210415_050140

@sTiKyt
Copy link

sTiKyt commented Aug 31, 2021

Hi, my app suddenly detect my rooted device and it is not functioning anymore.

I tested MagiskDetector and found out Magisk Hide is not working.
I tried termux SU, nagiskhide disable, Magiskhide enable.
Toggle Off MagiskHide button, restart.
Toggle On MagiskHide button.

Still showing Magisk Hide is not working in detector.

Please kindly suggest solution and assist, thank you.

You realize your screenshots are taking too much space?

@osm0sis
Copy link
Collaborator

osm0sis commented Nov 8, 2021

I imagine this is resolved with MagiskHide's replacement with DenyList, which is powered by Zygisk? Try again in 23013.

@osm0sis osm0sis changed the title MagiskHide - issue in mount namespace hiding for isolated processes. MagiskHide/DenyList - issue in mount namespace hiding for isolated processes Nov 8, 2021
@osm0sis
Copy link
Collaborator

osm0sis commented Nov 8, 2021

@vvb2060 I also see the init.rc modification detection is the only Magisk Detector test which fails on 23013 on modern devices/Android with DenyList. Any fix for that?

@vvb2060
Copy link
Collaborator

vvb2060 commented Nov 8, 2021

@osm0sis Magisk Detector has been archived, I am currently working on momo: https://www.coolapk.com/apk/io.github.vvb2060.mahoshojo

@vvb2060 vvb2060 changed the title MagiskHide/DenyList - issue in mount namespace hiding for isolated processes MagiskHide - issue in mount namespace hiding for isolated processes Jan 17, 2022
@vvb2060
Copy link
Collaborator

vvb2060 commented Jan 17, 2022

MagiskHide has been removed

@vvb2060 vvb2060 closed this as completed Jan 17, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
confirmed Issue confirmed to exist and the reason is known
Projects
None yet
Development

No branches or pull requests