this is absolutely terrible!!!
Apparently none other than LSPosed released a easy way for any app (including Google, WhatsApp, banks etc.) to detect root by checking for certain SeLinux Policies. It’s really clean and ready to implement. It’s probably just a matter of time till gplay implements it!
They claim they had it for 2 years and didn’t release till now when someone else anyway already released it. Point is, terrible news for rooted Android users!
As they say, it’s unfixable unless you modify the kernel. (Risky, hard, per device)
Maybe blocking app store from updating via host files would help but many apps will refuse if you’re too backdated.
Check it out:
https://github.com/LSPosed/DirtySepolicy
Currently trying to compile a kernel module specifically for my phone. Will update soon but if successful, the same idea should work on many phones that allow unsigned kernel modules with little code modification
You can’t have a Magisk or Xposed module block or spoof it?
No. It’s in the kernel. Magisk only patches init not kernel binary itself. Modding kernel is device specific and much more risky.
Some phones allow installing kernel module like mine and I’m trying… But so far no success. Sometimes it kernel panics and the other times it just doesn’t work as expected. Still working on it.
Yeah, but Xposed is supposed to be able to modify how Android respond to apps API calls in real time.
Full Bypass
This is not my project. I was working on something else and it was failing and it was only for my device.
This is a project that someone who’d like to stay anonymous gave me to release.
Works on all devices. Just a simple zygisk module you can install in magisk!
Read the README for more
https://github.com/flipphoneguy/DirtySepolicy_Bypass
Download zip
but it’s really terrible!