Is there way to hide module hook?

[PlatFlat]

I just noticed most apps (starbucks, revolut) is detecting LSPosed module hook. Example adding target app to an LSPosed module caused it to triggered some sort of crash.

[mywalkb]

Have you tried shamiko?
At this moment it is the only possible solution even if it is not perfect.
Is not easy hide injection in a process.
You can try to replace zygisk with Dr-TSNG/ZygiskOnKernelSU, it implement native bridge for injection, maybe this injection is not yet detected.
Is not only for kernelsu but is also a magisk's module.

[PlatFlat]

Yup, tested Riru/Zygisk on Magisk with MomoHider/Shamiko. My current test case here is on Shamiko with ZygiskOnKernelSU on A13.

The detection only occurred when the app was selected in the LSPosed scope of any LSPosed module.
Once it is removed from any LSPosed module scope, it won't crash.

It seems like LSposed/module injection is causing it. Another example to test out is by installing Memory Detector by HuskyDG and Stillhard, then having any LSPosed module add Memory Detector as a scope. You will see two injection processes found

[mywalkb]

You have 2 ways: to develope a LSPosed module which hook the detection and bypass it also with native hook if is required, as was done here or wait for shamiko to improve.

caused it to triggered some sort of crash.
It seems like LSposed/module injection is causing it

Crash or simply close the app without warning? Have you seen logcat?

Are there too many ways to detect injection so is very hard found a generic way to bypass.

[PlatFlat]

I think this is going to be a challenge for users, especially those who still care for privacy or uses XPrivacyLua, I am also not sure if dev of shamiko will help with the module detection of LSPosed, as indicated by them.

Crash or simply close the app without warning? Have you seen logcat?

Generally it just close the affected app. On a recent version, for example, Revolut v9.25. Once it detected root or lsposed, it instantly rebooted the phone until you remove any root or hooks. I tested this and there's has been similar reports

[PlatFlat]

I saw this article by HuskyDG.
and I also heard that you can check xposed api classes through reflection. I think this is how apps like Revolut and Singpass gets force closed when they get hooked.

Could these Xposed Hooks be hidden in any way?

[etnperlong]

In my opinion, the hide provided by Shamiko is imperfect. Have you tried HSBC UK or any other HSBC apps from different countries?
I think the newer detection is deployed everywhere.

I use KernelSU 0.6.8 + ZygiskOnKernelSU v4-0.7.1 + Shamiko v0.7.3
with LSPosed v1.9.1 and HideMyAppList v3.2 blacklist enabled.

I cannot open HSBC UK from today, but I definitely can open it yesterday.
There is no update from Play Store but I think there is some hotfix update.

Btw, Revolut, Chase UK and Starbucks work well on my rooted phone for a longer time.

[mywalkb]

In my opinion, the hide provided by Shamiko is imperfect. Have you tried HSBC UK or any other HSBC apps from different countries? I think the newer detection is deployed everywhere.

Is cat & mouse game. For each update a new method is created (for bypass and for detect).
Some months ago I started this project a similar module to shamiko but open source.
I tried to create a generic way to hide magisk and lsposed but I failed.
Now even the libraries are obfuscated so it's difficult to do analysis.

[mywalkb]

I still haven't found any way to fix it, so feel free to let me know if you have a solution. :)

Have you tried this? I do not have kernelsu so I can't test it.

[etnperlong]

No luck :( The HSBC apps are still crashing

[mywalkb]

No luck :( The HSBC apps are still crashing

@etnperlong could you test this action ?
There is a new option in settings "Enable watchdog logs", disable it and test HSBC.

[mywalkb]

there is a conversation here for this new option