A Riru module tries to make Magisk more hidden.

Overview

Riru - MomoHider (aka IsolatedMagiskHider)

Background

Many applications now detect Magisk for security, Magisk provided "Magisk Hide" to hide the modified traces but not completely hidden, magisk still can be detected by MagiskDetector. This module tries to make it more hidden.

Features:

Config name Description
isolated Apply Magisk Hide for isolated process and app zygotes. This feature is deprecated because it will unmount Magisk modified files for every isolated processes, and the unmounting time cannot be well controlled, which may cause some modules to not work. For almost apps, Magisk Alpha or the latest Magisk canary + Riru-Unshare is enough.
setns Faster new way to hide Magisk in isolated processes. Requires config "isolated" is enabled.
app_zygote_magic Make a app named "Momo" cannot detect Magisk hide is running.
initrc Hide the modified traces of init.rc

Note: Since 0.0.3, all features are disabled by default, you need to create a file named /data/adb/(lite_)modules/riru_momohider/config/<config name> to enable it.

Requirement

Rooted Android 7.0+ devices with Magisk and Riru V25+.

Test

Momo is the strongest detection app known.

Troubleshoot

Find the "config dir"

The really config dir is $MODULES/riru_momohider/config. For magisk lite, the $MODULES is /data/adb/lite_modules; For the original and almost everything, the $MODULES is /data/adb/modules.

If the module doesn't work, please check the config dir first. You should see a file called magisk_tmp under the config dir.

Momo shows "environment is broken, service not responding"

Please check your "overlay modules" first. Iterate through $MODULES and check each of its subfolders. For overlay modules, you should see system/vendor/overlay or system/product/overlay under it.

If you can't find any overlay modules, please go to the "without overlay modules" section.

With overlay modules

  1. Check your android version. For Android < 10, Magisk Alpha or the latest Magisk canary + Riru-Unshare is almost enough. After installing the recommended things, you can turn off isolated and try again.
  2. Disable overlay modules if possible. Or, we can't support this case yet.
  3. Try again. If the problem not solved, please try the "without overlay modules" section.

Note: We needs more info to try to support overlay modules, please file a issue with the full log and stacktrace to help me to solve it even if you have solved the problem.

Without overlay modules

  1. Turn on setns and try again.
  2. If the problem not solved, please file a bug with your device info and full log.

Momo still shows "environment is modified"

MomoHider only hide "MagiskHide is enabled", "Found su file", "Found Magisk" and "init.rc is modified" for momo. If you not see these, this is not our problem, please hide it yourself.

But if you see these after enabling these features... please check the following steps:

  1. Try run magiskhide exec which su, if you see something found, this usually indicates that there are other superuser programs in your system that cause magiskhide not work properly. Please remove other superuser programs.
  2. Try installing MagiskDetector, if you see "magiskhide not working", then report to Magisk.
  3. Report to me with your device info and logs.

There is our suggestion:

  1. Always keep SELinux is enforcing and make sure any sepolicy rules is necessary.
  2. Use modern Xposed framework implementations (like LSPosed or Dreamland ) and do not use "global mode", only enables Xposed for actually needed apps.

Build

Run gradle task :module:assembleMagiskRelease from Android Studio or command line, magisk module zip will be saved to module/build/outputs/magisk/.

Discussion

Credits

License

The project uses Magisk's source code, so its license follows Magisk's license.

Magisk, including all git submodules are free software:
you can redistribute it and/or modify it under the terms of the
GNU General Public License as published by the Free Software Foundation,
either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program.  If not, see <http://www.gnu.org/licenses/>.
Comments
  • [Fixed] Chrome not working

    [Fixed] Chrome not working

    OS: Nougat Xposed: Rovo's 89

    Log:

    2021-03-06 00:14:39.002 9909-9909/? E/Zygote: Failed open(/system/framework/XposedBridge.jar, 0) : No such file or directory
    2021-03-06 00:14:39.045 9909-9909/? A/art: art/runtime/runtime.cc:404]   at com.android.internal.os.Zygote.nativeForkAndSpecialize [XposedOriginal](Native method)
    2021-03-06 00:14:39.045 9909-9909/? A/art: art/runtime/runtime.cc:404]   at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative!(Native method)
    2021-03-06 00:14:39.045 9909-9909/? A/art: art/runtime/runtime.cc:404]   at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:360)
    2021-03-06 00:14:39.045 9909-9909/? A/art: art/runtime/runtime.cc:404]   at com.android.internal.os.Zygote.nativeForkAndSpecialize [XposedHooked](<Xposed>:-2)
    2021-03-06 00:14:39.046 9909-9909/? A/art: art/runtime/runtime.cc:404]   at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:107)
    2021-03-06 00:14:39.046 9909-9909/? A/art: art/runtime/runtime.cc:404]   at com.android.internal.os.Zygote.nativeForkAndSpecialize [XposedOriginal](Native method)
    2021-03-06 00:14:39.046 9909-9909/? A/art: art/runtime/runtime.cc:404]   at de.robv.android.xposed.XposedBridge.invokeOriginalMethodNative!(Native method)
    2021-03-06 00:14:39.046 9909-9909/? A/art: art/runtime/runtime.cc:404]   at de.robv.android.xposed.XposedBridge.handleHookedMethod(XposedBridge.java:360)
    2021-03-06 00:14:39.046 9909-9909/? A/art: art/runtime/runtime.cc:404]   at com.android.internal.os.Zygote.nativeForkAndSpecialize [XposedHooked](<Xposed>:-2)
    2021-03-06 00:14:39.046 9909-9909/? A/art: art/runtime/runtime.cc:404]   at de.robv.android.xposed.XposedBridge.main(XposedBridge.java:107)
    
    bug 
    opened by Stillhard 15
  • Momo shows

    Momo shows "environment is broken, service not responding"

    Hi bro i need a solution for this problem Momo shows "environment is broken, service not responding" Device : note 8 pro ( begonia ) - android 11 Miui china beta mod 21.11.10 Magisk : 24.1 stable Zygisk : yes Shamiko : flashed Everything is ok and i can't know the problem

    Screenshot_2022-02-21-03-35-59-783_io github vvb2060 mahoshojo

    not enough info spam 
    opened by maahmoudsamir 7
  • Hide

    Hide "Magisk su processes"

    Hiiii, Great app so far. The last thing It can't hide from "magisk detector" is "magisk su processes". Is there a way to hide it now?

    IMG_20210415_050140

    question not our issue 
    opened by Mark-Joy 6
  • [Only in Momo 4.4.1] Found Zygisk

    [Only in Momo 4.4.1] Found Zygisk

    Hi, I updated Momo to v4.4.1 and get the "Found Zygisk" warning, but it wasn't detected in previous versions. What has changed, and how to hide zygisk ? Thanks for your help Screenshot_20220824-150542_Momo

    not our issue 
    opened by j0110 3
  • Magisk24.1 MOMO 🤧

    Magisk24.1 MOMO 🤧

    I have issue in MOMO it shows checksum and boatloader unlocked while, zygisk is enable denylist is done, Shamiko installed yet facing this issue in magisk 24.1Screenshot_2022-02-23-16-50-13-216_io.github.vvb2060.mahoshojo.jpg

    not our issue 
    opened by aamirwaseem439 3
  • Documentation for Shamiko?

    Documentation for Shamiko?

    I have created config for it but it seems to not take any effect after reboot. Is there a documentation for Shamiko or it's pretty much same as Riru-MomoHider?

    question not our issue 
    opened by ghost 3
  • Init.rc test failed

    Init.rc test failed

    Hi, I'm running on a miatoll phone running arrowos (andorid 11) and magisk 23.0 + Riru 26.1.1.r500 + Momohider 0.0.7. I've created the empty files in /data/adb/modules/riru_momohider/config app_zygote_magic, initrc, isolated, magisk_tmp, setns if I run magiskdetector 2.3, su file, system file, selinux tests are passet, but the initrc is detected as modified by magisk.

    Do I miss something? or there is an issue? Hope someone could help me

    not our issue 
    opened by pippo73 3
  • [Fixed] Error in log can't unmount

    [Fixed] Error in log can't unmount

    2021-01-24 18:45:06.310 1349-2486/? D/AMS: isProcStartable in LRU io.github.vvb2060.magiskdetector return true
    2021-01-24 18:45:06.329 1349-2486/? I/ActivityManager: AMS: *** Start proc 4613:io.github.vvb2060.magiskdetector/u0i1 for service io.github.vvb2060.magiskdetector/.RemoteService
    2021-01-24 18:45:06.359 4613-4613/? I/IsolatedMagiskHider: Created isolated process 4613, starting magisk hide...
    2021-01-24 18:45:06.436 4613-4613/? D/IsolatedMagiskHider: hide_policy: Unmounted (/system/xbin)
    2021-01-24 18:45:06.486 4613-4613/? D/IsolatedMagiskHider: hide_policy: Unmounted (/system/usr/share/zoneinfo)
    2021-01-24 18:45:06.536 4613-4613/? D/IsolatedMagiskHider: hide_policy: Unmounted (/system/media/audio/ui)
    2021-01-24 18:45:06.577 4613-4613/? D/IsolatedMagiskHider: hide_policy: Unmounted (/system/lib64)
    2021-01-24 18:45:06.619 4613-4613/? D/IsolatedMagiskHider: hide_policy: Unmounted (/system/lib)
    2021-01-24 18:45:06.688 4613-4613/? D/IsolatedMagiskHider: hide_policy: Unmounted (/system/framework)
    2021-01-24 18:45:06.702 2392-2407/? D/GasService: FG app changed: from com.transsion.XOSLauncher to io.github.vvb2060.magiskdetector
    2021-01-24 18:45:06.727 4613-4613/? D/IsolatedMagiskHider: hide_policy: Unmounted (/system/etc/permissions)
    2021-01-24 18:45:06.767 4613-4613/? D/IsolatedMagiskHider: hide_policy: Unmounted (/system/bin)
    2021-01-24 18:45:06.807 4613-4613/? D/IsolatedMagiskHider: hide_policy: Unmounted (/sbin)
    2021-01-24 18:45:06.808 4613-4613/? E/IsolatedMagiskHider: hide_policy: can't unmount /system/etc/mkshrc: Permission denied
    2021-01-24 18:45:06.808 4613-4613/? I/IsolatedMagiskHider: Unmounted magisk file system.
    

    Is this a problem? @canyie

    bug 
    opened by Stillhard 3
  • next time, check your messages

    next time, check your messages

    instead of waiting 2 months and trolling me on telegram like a petualant child

    ive removed my mod from XDA, where i openly credited you for your original module and noted distinctly my additions to your script on that page, so that others could add it if they wanted, while i also attached a working module.

    that thread is one of the most active on XDA, and watched like a hawk for any post which dont make the grade or correctly credit people, and in 2 months no one saw an issue with my post.

    You decided to act like a child tonight on Telegram, so my post reflects that

    Enjoy whats now there explaining your poor behaviour:

    https://forum.xda-developers.com/t/magisk-general-support-discussion.3432382/post-85187739

    Also as a reference see here in my own modules how i credit people, i did no different on that post AND i notified you, not my fault if you ignored it...

    https://github.com/stylemessiah/GPay-SQLite-Fix/blob/master/common/install.sh

    stupid spam 
    opened by stylemessiah 2
  • Need some guidance

    Need some guidance

    Firstly your module really highly appreciated. I have read troubleshoot and i know following detections are not related to this module

    SElinux rules are modified Partition mounted abnormally Art parameters are abnormal

    But as these problems are detected by momo can you please send me some relavent to stuff to study and fix these problems . Thankyou

    Device : Samsung A70 Rom : Offical Magisk version : 24.1 stable (zygisk enabled) Android version : 10 Modules : lsposed, shamiko, safetynet SElinux : enforce

    not our issue 
    opened by Abdullah3119 1
  • Crave TV issues

    Crave TV issues

    Crave TV can still detect root, and almost all setups I've tried also result in Momo showing "broken environment". I've tried variations of all following modules/toggles

    Riru-MomoHider (tried variations of all 4 settings) Riru-Unshare HideMyApplist (LSposed, with Magisk module) Magisk (newest pre-MagiskHide removal canary and latest canary with Zygisk) Universal SafetyNet Fix (UNSF) (2.2 and 2.1 accordingly for the proper Magisk version, also tried with this off on both Magisk versions however for 2.2 MagiskHide functionally is lost entirely without this module so even if that did work SafetyNet wouldn't pass which would defeat the purpose) Sui MagiskHide (as for UNSF even if disabling this could fix Momo I'd still fail SafetyNet without it so unless there's another fix for that won't be turning it off)

    I do not have any overlay modules installed to the best of my knowledge

    My main intention is to get Crave TV working however I'd also like to pass Momo, it has not for any config not stated "Device is rooted" when I try to watch a movie or TV show on it

    MagiskDetector passes all tests but init.rc at the moment (it fails that consistently, only passed it for 1 config that I can't reproduce. I'm fairly sure it was on latest Magisk)

    Device Info: OnePlus 7 Pro 12GB (GM1917) Latest Vendor crDroid 7.11 Official (Android 11)

    Please let me know if I've left anything out

    not our issue 
    opened by Nolij 1
  • Bounty for maintain the opensource magisk hider

    Bounty for maintain the opensource magisk hider

    I really appreciated your effort in making the open source app fight against root detection. I highly dislike the behaviour of shamiko to make it not only closed source, but also no code audit at all. I saw you recently pushed some commits, so I guess you are still interested in this project. I offer a $100 bounty, for now, to keep this project updated. I believe there are more people demanding this and are willing to offer more. I will pay in one of the following methods if you can make this work for zygisk: Liberapay, Bountysource, XMR and USDT trc20. Thanks for your effort.

    opened by himekifee 3
Releases(0.0.8)
Owner
残页
残页
This is a library that can bypass the hidden api restriction on Android 9-12.

BypassHiddenApiRestriction This is a library that can bypass the restrictions on non-SDK interfaces on Android 9-12.

Wind 64 Dec 26, 2022
Hidden Eye is an all in one tool that can be used to perform a variety of online attacks on user accounts

Hidden Eye is an all in one tool that can be used to perform a variety of online attacks on user accounts. It’s well loaded, therefore it can be used as keylogger (keystroke logging), phishing tool, information collector, social engineering tool, etc.

Muhammad Qazi 0 Jun 24, 2022
Make screenshot every few minutes to make your small history!

Screenlapse Fun CPP application (which isn't well-made, can be optimized) that automatically make screenshots of your screen every few minutes and sto

raywave's junk projects 3 Aug 18, 2021
Make your Pop!_OS (Ubuntu Linux) shortcut key experience more like Mac OS

Meta Mac Enables a Mac OS-like shortcut key experience on Pop!_OS (and most Ubuntu-based Linux distros). Installation Download or git clone this repos

Duane Johnson 14 Dec 31, 2022
Phan Sang 17 Dec 29, 2022
3D scanning is becoming more and more ubiquitous.

Welcome to the MeshLib! 3D scanning is becoming more and more ubiquitous. Robotic automation, self-driving cars and multitude of other industrial, med

null 121 Dec 31, 2022
Ranges that didn't make C++20

ranges Implementations of ranges that didn't make C++20. Coded live on Twitch. Types tl::enumerate_view/tl::views::enumerate A view which lets you ite

Sy Brand 64 Dec 20, 2022
Some hypervisor research notes. There is also a useful exploit template that you can use to verify / falsify any assumptions you may make while auditing code, and for exploit development.

Introduction Over the past few weeks, I've been doing some hypervisor research here and there, with most of my focus being on PCI device emulation cod

Faith 130 Nov 18, 2022
A continuation of FSund's pteron-keyboard project. Feel free to contribute, or use these files to make your own! Kits and PCBs are also available through my facebook page.

pteron-pcb Intro This project is the evolution of the Pteron-Keyboard project, an incredible ergonomic keyboard that was handwired only. I aimed to in

null 17 Oct 11, 2022
C+- is a personal project trying to make a programming language.

C+- A personal project trying to be a programming language with close resemblence to C/C++ (probably gonna fail at that).

Arin 5 Nov 22, 2022
mimikatz is a tool I've made to learn C and make somes experiments with Windows security

mimikatz is a tool I've made to learn C and make somes experiments with Windows security

Benjamin DELPY 16.6k Dec 31, 2022
让Etwhook再次伟大! Make InfinityHook Great Again!

MakeInfinityHookGreatAgain Make InfinityHook Great Again 图片测试(2004系统两个小时): 怎么做 https://key08.com/index.php/2021/06/23/1170.html windows 20h1 x64 18个小时

Huoji's 99 Nov 19, 2022
sipeed opensource mechanical keyboard make with BL706

sipeed_keyboard sipeed opensource mechanical keyboard make with BL706 矽π 开源双模机械键盘 目录结构 ./ ├── LICENSE ├── README.md ├── firmware // 存放键盘固件 ├── hardwar

Sipeed 58 Dec 23, 2022
VinyGo is an open hardawe, meca, and source project to make a vinyl recorder.

The goal of this project is to refresh the gramophone concept to build a vinyl recorder, easier, more accessible, and affordable. Is made for artists, vinyl stores, recording studios, or music lovers.

null 10 Dec 16, 2022
Simple EFI runtime driver that hooks GetVariable function and returns data expected by Windows to make it think that it's running with secure boot enabled (faking secure boot)

SecureFakePkg is a simple EFI runtime driver that hooks GetVariable function and returns data expected by Windows to make it think that it's running with secure boot enabled. In other words, it fakes secure boot status.

Samuel Tulach 80 Dec 30, 2022
Fast unidirectional synchronization - make or efficiently update a copy of a database, without slow dumping & reloading

Fast unidirectional synchronization - make or efficiently update a copy of a database, without slow dumping & reloading

Will Bryant 267 Dec 23, 2022
ApeX is a static library for C++ software. Originally it was created to make C++ studying easier,

ApeX is a static library for C++ software. Originally it was created to make C++ studying easier, so it has functions to complete common tasks with just one line of code. But who knows, maybe this library will get bigger some day

null 0 Jan 18, 2022
kbuild is a build tool that works "like make" targetted at kernel/os development

kbuild : a kernel (and os) builder kbuild is a build tool that works "like make" targetted at kernel/os development Installing and building kbuild kbu

Valentin HAUDIQUET 1 Dec 11, 2021
a work in progress try to make an IDE with the CSFML

EatSleepCode A work in progress for educational purpose. To help better understanding the CSFML lib. Installation clone this repo and do make Use case

Saverio 1 Nov 20, 2022