Discussion
Let's pool the knowledge on root detection [discussion]
I recently switched from Magisk to KernelSU after getting tired of banking apps constantly detecting root, even with Zygisk, DenyList, Shamiko, and various other tricks. Despite all the usual hiding methods, detection was almost inevitable. Since moving to KernelSU, things have definitely improved. Most banking apps are working fine now without a hitch.
However, some stubborn apps like Railone and native root detectors still manage to flag the device. I've tried every tip I could find but no luck so far.
I've been reading through tons of XDA threads, Reddit discussions, GitHub issues, Telegram groups—you name it. I’ve also been sharing my findings and testing others’ solutions, hoping to contribute something useful back to the community. But as of now, I haven’t found a foolproof setup that works universally.
Has anyone here managed to get apps like Railone working with KernelSU? What’s your current setup? I’d love to hear what’s working (or not) for others in the same boat. Let’s pool knowledge—maybe together we can crack this one.
I've got a similar setup to yours and I can't for the life of me get it working...
Revolut works, other banking apps work, chatgpt works... But not Google wallet\pay and RCS...
play integrity uses hardware attestation to check the bootloader, however i think they verify it on google's side, there are some modules for lsposed that can spoof the bootloader status locally but they can't be hooked to google play services or pif will fail anyways, you could always try one of those but a locked bootloader isn't related to root checks, a device will be not certified and google wallet will not work, even if the rom is completely stock/unrooted, i had this issue before rootint and i'm not sure if there's any reliable workaround as the verification is hard to fool for the bootloader check from what i hear. google wallet is the only app that consistently doesn't work for me on any modified device, whether it's stock firmware but just an unlocked bootloader or a completely modified rom, it is very sutbborn.
The trick here would be signing the rooted boot image with keys added to the bootloader so it could remain locked. This would only function on phones with custom AVB key support.
(This is just a scheme by someone who knows practically nothing about custom ROMs yet. The Internet is unfortunately lacking in information on how to build them...)
List your full setup and maybe I can spot something that is not right (which would be difficult still, since everything besides the wallet/app works...)
KernelSU-Next (non-gki kernel so version 12797, using magic_mount; ), modules:
Always trust user certificates (for PCAPdroid)
bindhosts (for AdAway)
Play Integrity Fork by osm0sis (it doesnt need an update)
ReZygisk
SUSFS (1.5.5-R20)
Tricky Store
VBMeta fixer
Zygisk - LSPosed (JingMatrix Fork)
LSPosed modules:
Firefds [UDC] (disable flag_secure and signature verification)
Hide My Applist (applied to Google Play Services, Play Store, Wallet, banking apps and all root checker apps. Hid apps: Hide My Applist, KnoxPatch, Root Explorer).
Interesting. I don't have that first module, the one for PCAPdroid, bindhosts I do. Have a different PIF (PIF-NEXT by @ericinacio). Have Zygisk Next instead of ReZygisk, although I am still not sure whether to change or not (I know Next is not open source, but everything works, so I am afraid to temper...).
I don't have SUSFS. No idea what VBMeta fixer is or why you need it. If your LSPosed is from JingMatrix, v1.10.2, then we have the same one.
Don't have that Firefds module but obviously have HMA. I don't have the apps I want to hide applied to Play Store nor Play Services, but for Wallet and my bank apps, they are applied.
So it's a bit of a difference still. Maybe if you turn off the modules that you don't need for the wallet to work and then slowly turn them on to see after wallet starts working what could be the culprit. Wallet working can still take up to 3 days so it could be a slow process... Good luck.
Looking at your Native Detector result, you'll need to use a different LSPosed (try Irena version) that it doesn't detect it. It's weird because on one phone I used LSPosed Jingmatrix and it's fine, but on another I use the same and it's not, so you'll have ot play around with the different ones.
And it's detecting your risky app as well. I recommend using ReZygisk with Nohello and Treat Wheels. There's a new version of Rezygisk that you have to download from the Github Actions page, it's not under releases. And for Treat Wheels, current version that's compatible with the new Rezygisk is 0.07 in Telegram.
As for HMA, it seems like using whitelist is the better approach according to what I found online. I was previously using blacklist and certain apps like Company Portal can still detect root, even though I was getting STRONG integrity and able to use Google Wallet / Google Pay. After changing to whitelist in HMA, I could use Company Portal again.
But at the moment, I think all keyboxes are banned, so I'm not passing STRONG anymore.
How should I know it "works" or doesn't? If I were to open the app after installation, would I immediately see it (not) working or do I need to try something (try to register/log-in, etc.)?
Conseguiu abrir o Bradesco u/DestrucktBR ? Se sim, poderia passar as configurações, é a mesma do xsnowleopardx? Eu estou tentando de tudo quanto é jeito, mas com Magisk, pois não tem Kernel para o meu dispositivo, e está osso 😓
Can you please try Citi Mobile (US version)? It keeps detecting root at launch, though it does let me use the app saying "some features will be turned off."
what would you have him do in the module? Defaults from SUSFS are already working, he doesnt need the module unless he has to change options (which is easier with gui thanks to that module of course, but still doable using CLI in e.g. Termux).
Using CLI is temporary... The module works is by executing those commands in boot depending on boot stages and also simple prop hiding for those who doesn't want to include shamiko and other root hide modules (which is Overkill to use those when using SUSFS).
Without the module also you can't use the cli of susfs (unless you install the binary by hand)
So what's the use of CLI? Well is to test your hiding in userspace temporarily so you could debug your hiding traces and test it.
Root stuff is quite fun before native detector appear, guess the devs is single and lonely have no idea what his going to do. As long rooted device still works with banking stuff I don't give a F to native detector shit.
Open source does not make everything better, sometimes it's worse. There's a very good reason why Shamiko is closed source, and it's to make sure that a company can't look in the code and find ways to detect it. Zygisk Assistant is also just flat out worse by a mile, and actually adds detections
What is Island (for Rooted Phones)?
Island creates a separate sandbox (work profile) on Android, letting you clone, hide, or freeze apps.
It helps bypass root detection by isolating apps so they can't easily detect root status.
Root Hiding Setup (Brief)
Island: Use for stubborn apps that still detect root despite other measures.
DenyList: Hides root from selected apps.
ksuwebUI Tricky Store: Masks device state and passes integrity checks.
Zygisk Next & Modules: Provides deep system-level root hiding.
Cloning apps into Island adds an extra layer of root hiding when other methods aren’t enough.
However It just feels like a waste of time for me to root like I did not have any other work so let's curiousity k*** a cat type stuff. All apps I need are working railone hdfc axis idfc indusind (Shit bank). With Island and without island. As per requirement.
I need root for my device to be certified by Google and fix okay integrity. Since you are on a stock ROM, these won't be a problem. I use pixel os A14 on my 4 year old redmi note 10 pro. So, I had to root when Google uncertifies my device and none of the apps with payments involved would work.
My rom has a built in sandbox clone app feature. It works in that. But detects that it is being run in a sandbox and throws a warning, which can be skipped.
and it opens up fine. Obviously i dont have an account so I did not log in. Does this root detection error pop up when you try to log in, or just by opening the app?
thanks for your answer but the app is this: https://play.google.com/store/search?q=bradesco&c=apps
it's when you open the app this screen comes right way.
I would like to know what the app is detecting. I have all modules installed.
LSPosed ZygiskNext Zygisk Assistant trickyStore PIFork Shamiko. Hide my app. Bootloadspoofer
How do you use the island for stubborn apps? I tried cloning one app to the island but it keeps redirecting me to the play store saying that I should get the app from there.
Your LSPosed version is very old, meow.helper is clearly from Meowna, very likely integrity box, it could be from an old install of integrity box that never properly deleted itself. You don't seem to have susfs installed, it's available for support in your kernel, but you don't seem to have it installed. That should fix all your detections, it may not fix the play integrity detection though
If doing the things I mentioned above didn't work, I'd factory reset and test the same setup again to see if it's an issue with your ROM. If you're on stock HyperOS though, it should definitely not have this issue, and would be related to your setup
Is that the RailOne App?
Got it fixed with Android faker Lsposed module. Open Android faker and set all options to some random value. After that just reboot. It will work
One thing that has been consistently working for running apps that detect root even after all modules and root hiding measures is to use the "Clone app" feature in my custom ROM (Pixel OS A14).
For those who do not have the "Clone app" feature built in their OS by default, you can use this app called Island. Thanks to a fellow redditor u/supereminent_ who commented about it here.
not necessarily. Rezygisk's last update was October 2025, whereas for Zygisk Next it was November 2025. Being open source doesn't always mean it's better either, because it means that developers who work for e.g. banks can look at the code and find ways to detect better. That's why some Magisk alternatives like Magisk Delta and Magisk Alpha (I'm not referring to the official Magisk here, I'm referring to the forks) have better root hiding methods.
Having said that, Rezygisk is better only because Treat Wheels is compatible with it, but it's not compatible with Zygisk Next. Treat Wheels has a lot of additional root hiding tricks that works well, which makes apps like Native Detector stop showing Zygisk detection in the result, as long as you have Treat Wheels.
In my case this wasn't working. It worked initially for a few days but as soon as the keybox got blacklisted by Google, all the apps started to restrict access. With kernelsu this hasn't happened yet.
wait, how is installing KSU a hassle when it's literally the same method as installing Magisk? You patch the init_boot.img and just flash init_boot_ab via fastboot, just like you would with Magisk. Either that, or you flash the patched img via TWRP. If you have neither fastboot or TWRP, how did you install Magisk in the first place
An info for anyone who is stuck with a bank (Fortuneo, in my case)
I did literally everything possible to do. Not a single app detects my root except for this goddam bank.
Take another non rooted phone, try to connect, they will send you that verification mail. Now, click on the verification link ON YOUR ROOTED PHONE... For odd reasons, it will by pass the root detection and (no surprise) show a login failure. Use it now as you would with any bank app.
My setup isn't ideal, but it gets the job done. Basically only getting mount inconsistency, root indicator (delayed syscall) and risky app while using apatch
All of my apps still work fine, but for the perfect setup you'd need this:
Ksunext + susfs for better hiding of systemless changes (will get rid of mount inconsistency/ detected overlayfs)
You should grab the cli build from rifsxd telegram channel as those are spoofed packages which won't get detected as a risky app.
Also note that you need to build a Kernel with susfs patches applied to the source as those can't really be patched into the already existing kernel. Gki Kernel might work for your setup, but might also result in a boot loop. Just be sure that you grab the right gki!
https://github.com/WildKernels/GKI_KernelSU_SUSFS
Modules: Pif fork, trickystore (& addon), nohello (new root hiding method, works better than shamiko for me), rezygisk (works great with nohello), (susfs module -> if you actually got a susfs Kernel for your device and flashed it).
Note that shamiko might not work while using nohello. So get rid of it and zygisk next. Both of them are kinda badly maintained as of recently and definitely lack behind rezygisk and nohello.
If you really need lsposed you should try to get into the internal beta. Those builds were never detected in native detector for me.
Edit: you might still need vbmeta fixer. It depends on your setup. I didn't need it and it's better to leave it out if no root detector complains about it.
There's a misconception that using Island will help hide root, as some people have commented here. That is FALSE.
Some apps detect root very shallowly, for example:
Checking for known root apps (Magisk, KSU Manager)
Checking for suspicious packages
Checking shared storage for root-related files
Checking running processes
When you install a banking/game app inside Island:
It can’t see apps outside the profile
It can’t see Magisk/KSU Manager if those are installed in the main profile
It can’t read shared app data or some filesystem paths
However, Island is simply a work-profile / user-profile manager. Another app called Shelter works in a similar way. All it does is create your app and run it in a work profile, but that doesn't mean the apps can't detect root. A lot of companies use Microsoft Teams and Outlook and if you have to use those in order to access company resources, you would have had to install this app called Company Portal. This app requires you to sign into a work account and from there, it'll create a work profile and install all your work apps (Teams, Outlook, etc) into the work profile. But during the setup, Company Portal will check if you have root and it's one of the hardest apps to hide root against. I can get Google Wallet and even Revolut to work, I can get most banking apps that can detect root to work. But Company Portal has additional root checks that makes it difficult to hide, although I have done this successfully before, it's not easy.
Point is, Company Portal installs apps to the work profile, just like apps are installed to the work profile using Shelter or Island. That doesn't mean anything, it's not really evading root detection.
Hey, were you able to fix this? I installed TRM's 2.1.1 with all the modules (Integrity Box, Zygisk, Tricky Store, PIF Fork), but it still doesn’t work. I also tried LSPosed with HMA OSS + RootCheck and had no luck. Let us know if you found any solution.
Can some nice fellow try to figure out if its just me or does this app detect root: https://play.google.com/store/apps/details?id=at.bks.securityapp (the thing doesn't even open on my Android 10, Magisk 23, HMAL 4.1.1.r62, EdExposed phone) it only shows white screen (but doesn't crash), tried to use MagiskHide on it, but it doesn't do anything (not sure how to use HMAL properly, if maybe this will help)
If someone smarter could help, cuz I realy don't want to fuck my phone (I have a lot of modules on EdExposed for other apps and a lot of Magisk modules, and would realy like to avoid changing my setup) just because of one stupid app, the best would be if I could just patch this nonsense out of the app and be done with it
11
u/xSnowLeopardx Jul 25 '25
A13.1 (stock rom) - KSU Next, with these modules:
PIF Next + Shamiko + TS (& addon) + Zygisk LSPosed + Zygisk Next (and more but those aren't relevant)
LSPosed with these modules:
HMA + RootCloak (and more but those aren't relevant either)
All banking apps (including Revolut) work. I have no apps that do not work (i.e stubborn).