Magisk: [Request] Add support for hiding root from KonyLabs' root detector

Created on 18 Oct 2018 · 32Comments · Source: topjohnwu/Magisk

Hi, it seems Go Mobile (by CIMB Niaga) is still able to detect root on the latest (17.2) Magisk, and based on info from @CrescendoFang at https://github.com/topjohnwu/Magisk/issues/619#issuecomment-430847106 it's using KonyLabs' root detector.
So i was hoping if root can be hidden from this new detection, if possible that is :)

Thanks in advance.

PS: Thanks to @CrescendoFang for digging it up :)

Source

ANR2ME

👍1

Most helpful comment

Instead of renaming or removing, try using this app:
https://play.google.com/store/apps/details?id=moe.shizuku.redirectstorage

Thanks it works too. Need to isolate it so it won't read the default path.

How did you get it to work? I can't get anything to show up in the app list because it only shows apps that request both read and write...

Nothing, just usual install of the storage isolation app and then the go mobile. Then setup the isolation for the app to just read inside the /Android/data/package instead of the default. It should work.

Then make sure to hide the magisk and hide the go mobile in magisk manager. The problematic twrp read should gone. I tried it in my 2 phone.

richiesamlie on 8 Mar 2020

👍2

All 32 comments

You're welcome @ANR2ME 👍

I tried to grasp the method of Kony's root detector but their documentary seems vague:

On Android devices, root detection dialog displays when the app is launched in the foreground. The detection happens through the Kony auto-generated launcher activity using KonyMain. If a user writes custom activities using FFI and Framework, root detection does not happen.

If an app is triggered by background sources (Push, GeoFence, SMS, etc.,) root detection dialog does not display. However, a process is created in the background for this app with no application data loaded in memory.

Default Error Message: This device does not meet the minimum security requirements for this application. Please contact the app publisher for more details. The application will exit when you press OK.

You can modify the Default Error Message using the i18N string defined with key ROOT_DETECTION_MESSAGE. If you do not have an i18n string, default standard error message appears.

Visualizer tries to respect the i18N key defined in a locale which matches current device locale and then the i18N key defined in a locale which matches Visualizer/IDE set default locale and then the Default Error Message in order of preference.

The following APIs are not respected as they are available only when JavaScript is loaded and JavaScript is never loaded when rooting of a device is detected.

kony.i18n.setCurrentLocaleAsync
kony.i18n.setDefaultLocaleAsync

No source code, unlike rootBeer which can easily blocked in Root Cloak command:
rootBeer.isRooted
rootBeer.isRootedWithoutBusyBoxCheck

Simply hiding using MagiskHide + blocking isRooted using Root Cloak doesn't work.

Also this Go Mobile gives nothing other than blank gray screen then closes itself.

Source: http://docs.kony.com/konylibrary/visualizer/visualizer_user_guide/Content/ApplicationSecurity.htm#Jailbrok

Crescendo-BLYAT on 18 Oct 2018

👍1

/com/kony/rooted/TestRoot.java

package com.kony.rooted;

import java.io.DataOutputStream;

public class TestRoot {
    public static int isRooted() {
        try {
            Process p = Runtime.getRuntime().exec("su");
            DataOutputStream os = new DataOutputStream(p.getOutputStream());
            os.writeBytes("echo \"Do I have root?\" >/system/sd/temporary.txt\n");
            os.writeBytes("exit\n");
            os.flush();
            p.waitFor();
            if (p.exitValue() != 255) {
                return 1;
            }
            return 0;
        } catch (Exception e) {
            return 0;
        }
    }
}

/com/konylabs/ffi/N_rootdetection.java

package com.konylabs.ffi;

import com.kony.rooted.TestRoot;
import com.konylabs.libintf.JSLibrary;
import com.konylabs.libintf.Library;

public class N_rootdetection extends JSLibrary {
    public static final String isRooted = "isRooted";
    Library[] libs = null;
    String[] methods = new String[]{isRooted};

    public Library[] getClasses() {
        this.libs = new Library[0];
        return this.libs;
    }

    public Object[] execute(int index, Object[] params) {
        Object[] ret = null;
        int paramLen = params.length;
        switch (index) {
            case 0:
                if (paramLen == 0) {
                    ret = isRooted();
                    break;
                }
                return new Object[]{new Double(100.0d), "Invalid Params"};
        }
        return ret;
    }

    public String[] getMethods() {
        return this.methods;
    }

    public String getNameSpace() {
        return "rootdetection";
    }

    public final Object[] isRooted() {
        return new Object[]{new Double((double) TestRoot.isRooted()), new Double(0.0d)};
    }
}

I don't find any other file that use these 2 classes.
Seems like it's pointing to isRooted function at TestRoot.java, is it possible to change the returned value? or prevent "su" from running and triggered the exception?

ANR2ME on 18 Oct 2018

👍2

Please try out the latest Canary Build with the updated MagiskHide. If it still don't work, try to uninstall Magisk Manager, and report the results after uninstalling. Thank you

topjohnwu on 26 Nov 2018

❤1 👍1

Thanks for the update :)

I tried the release version of canary build (updated magisk manager and then update magisk zip from 7.3) and still have the same issue.
However, after uninstalling magisk manager Go Mobile app can run now :D so i guess it worked without magisk manager.

In this case, what step should i do so it doesn't detect Magisk Manager?

Edit: Hiding magisk manager package seems to be working now :D Great!

Btw, the canary magisk manager doesn't have toggle for systemless what does it actually do when clicked?

ANR2ME on 26 Nov 2018

👍1

@ANR2ME how did you hide the Manager package?

Crescendo-BLYAT on 27 Nov 2018

@ANR2ME how did you hide the Manager package?

Through Magisk Manager's Settings, it will change the package name

ANR2ME on 27 Nov 2018

👍1

@ANR2ME how did you hide the Manager package?

Through Magisk Manager's Settings, it will change the package name

one question: do you use Xposed as well?

Crescendo-BLYAT on 29 Nov 2018

@ANR2ME how did you hide the Manager package?

Through Magisk Manager's Settings, it will change the package name

one question: do you use Xposed as well?

nope, because i heard it causes safetynet to be false, and since i'm using MIUI 10 i haven't found xposed module that worked with MIUI :D

ANR2ME on 29 Nov 2018

lol, so it's the root of the problem in my case.. I use xposed..

I already use the same Magisk setup as instructed here but the CIMB app is still stuck so I uses the old working one....

Crescendo-BLYAT on 30 Nov 2018

Now, it detects root again..

dwiprawira1989 on 24 Feb 2020

👍1

Now, it detects root again..

Yes, hide magisk manager is no longer working for CIMB GoMobile app :( did they specifically tried to detects magisk manager's files or something?

ANR2ME on 24 Feb 2020

This is also not working on Jack in the box which is also kony based. Seems they've changed something