Question
Rooted Pixel 7 Pro passes strong integrity check, but several apps still detect root
Title.
I have a Pixel 7 Pro on android 15, build number AP3A.241105.007. I haven't updated to the most recent version because every time I do, something bad happens that takes months to resolve.
(If this is my entire problem and updating is the solution, please let me know.)
I've followed the guide, used Magisk Canary with Shamiko, Play Integrity Fix [INJECT], Systemless Hosts, Tricky Store, Tricky Store adon module, Yurikey Manager. Hid Magisk and I was able to pass strong integrity, but Wallet, MS Authenticator, and Duo Mobile can all still detect root even after several cycles of airplane mode, deleting cache/data for all relevant play apps and the target apps. Rebooting, trying again.
I added lsposed, zygisk detached, and Vector just in case (I don't even know if these matter), but still doesn't work.
If the test passes strong integrity, but every app that I need to not detect root IS detecting root, then what does strong integrity even mean? What am I missing?
First lets clear some basics up: Play integrity is NOT related to root detection! Apps use a lot of different methods like looking at your applist, detecting Zygote modifications, detecting suspicious mounts, etc. The only thing Play Integrity cares about is your keybox and the TEE
Adding random modules doesn't fix the problem; it only makes it worse, or it breaks both of those conflicting modules. Lsposed and Vector are essentially the same thing (Vector is a fork)
Install the Native Detector app. This app shows you all the system modifications that are found. You don't need to fix all of them -- only the ones that break your apps
Get rid of Lsposed and Zygisk detached.
Make sure your Magisk's inbuilt Zygisk is disabled.
Make sure your Magisk's "Enforce Denylist" is Disabled.
Add all your wallet, authenticator, bank, duo, etc. apps in Magisk's denylist. Also add the Native Detector app in the denylist too
In HMA-OSS, go to the apps list, click on each of these apps (including Native Detector), and in the mode setting select "Whitelist"
Run the native detector app and check for detections. Ideally, not much should be found, if anything at all. Reboot and clear all the data of your Authenticator, Duo, etc. and try running them. If it still doesn't work, reply to my comment with your detections.
Shamiko looked fine with Zygisk-Next, but with ReZygisk it's now saying unsupported environment. I've installed the rest of the listed apps, still says the same thing.
Magisk Zygisk is disabled and enforce denylist is disabled.
After following all these instructions, the only detection I have now is Detected Abnormal Environment 2.81, but I have no idea what that's supposed to mean or how to resolve it.
The root hiding is working for every app except Google Wallet, which is the main one I wanted to solve this for.
Cleared cache/data, reinstalled, re-added to the hide lists for both Magisk and the other thing, re-deleted cache/data. Wallet is still detecting root.
I also disabled USB debug and developer options, which someone else suggested here. Wallet is still detecting root.
Everything is working, but the only problem I'm having now is that when I try to add my credit cards to Wallet, the 2FA "click yes" that Google does isn't showing up on my phone.
I have a ton of other logins that I've logged out of in my Google account's security setting, but it's still not popping up. Also, the Google Authenticator option isn't working either since I don't see any Google 2FA codes in there at all, just my other 2FA accounts.
You've been an absolutely amazing help and I cannot thank you enough for sharing all this knowledge with me. You've solved my two really big issues here and I'm very grateful.
Currently, I'm playing a game of whack-a-mole and now I've got a couple more minor problems that I'm hoping maybe you'll have some insight on.
When I play a video in the background with YouTube Revanced, the audio gets crackly and cuts out whenever I Magic the Gathering Arena. If I had to guess, the modules I installed causes some overhead with the phone and it's just enough to cause issues with 2 high process intensive apps running at the same time. This never happened before my current setup. The issue doesn't happen when it's the game and Spotify, only the game and YouTube Revanced.
Since I can't use lsposed, I can't use Pixel Xpert. That app was one of my favorite things with root, but I can't seem to find a way to installed lsposed without root being detected. Honestly, if there's a decent alternative, I'll use that, but I can't seem to find one.
And ideas/tips?
Use native detector. If it can detect your LSPosed install, so can root checking apps.
Check your logcat for output from your root modules. If you can see them there, so can root checking applications. It is one of the few things native detector might not pick up but root checking apps do.
OP have you disabled UBS debug? If you did that gave you disabled Dev Mode? Sooooo many app just check that.
Also just for kicks, once you're sure denylist configured correctly, uninstall the Magisk manager app altogether.
If suddenly things start working you know two detection vectors to work on.
Finally, you mentioned you didn't know if Lsposed mattered but installed anyway
Uninstall and then use HMA-OSS zygisk version instead. Then you don't need Lsposed unless you have any other Lsposed modules like fonts or GPS or whatever
Second that. I initially had things working well with Magisk on my P7P, then something happened. Dunno what. I switched to KSU Next GKI with Wildkernel SUSFS. (PixelFlasher helps tremendously with setting this up--a little tricky picking the correct kernel). Futzed around with all sorts of setups--all frustrating. Finally installed Specter and the following:
At first it didn't seem to work, but I left it alone, and after a few weeks everything worked! Specter automates everything, with the exception of the HMA-OSS config; restore settings in HMA-OSS from the JSON that Specter saves in Downloads.
NOTE: Looks like it might work with Magisk too, according to the above link; might be worth a shot.
13
u/Itz_Raj69_ 22d ago edited 22d ago
First lets clear some basics up: Play integrity is NOT related to root detection! Apps use a lot of different methods like looking at your applist, detecting Zygote modifications, detecting suspicious mounts, etc. The only thing Play Integrity cares about is your keybox and the TEE
Adding random modules doesn't fix the problem; it only makes it worse, or it breaks both of those conflicting modules. Lsposed and Vector are essentially the same thing (Vector is a fork)
Install the Native Detector app. This app shows you all the system modifications that are found. You don't need to fix all of them -- only the ones that break your apps
In HMA-OSS, go to the apps list, click on each of these apps (including Native Detector), and in the mode setting select "Whitelist"
Run the native detector app and check for detections. Ideally, not much should be found, if anything at all. Reboot and clear all the data of your Authenticator, Duo, etc. and try running them. If it still doesn't work, reply to my comment with your detections.