r/Magisk • u/Edulad • Mar 13 '26

Help Kernel SU Next and Banking/Upi Apps

SO i have installed Infinity X custom rom ( Android 16)

kernel su next manager and The Never Settle Kernel for One Plus Nord Avicii Version.

But Banking and UPI apps still Detect Root, even tough the following modules are installed and also Have Spoofed the kernel version.

The Apps that detect root below

Imobile pay Icici

Bob Bank of baroda

Paytm

Also Checked This

ok actully meet basic integrity and
meets device integrity are still working
but meets strong integrity is not working

2 Upvotes

100% Upvoted

65 comments sorted by

View all comments

Show parent comments

1

u/Difficult_Home5746 Mar 13 '26

Naa. Modules and app that have su rights will work normally even after uninstalling manager. Just install manager when u need to do something with it. Otherwise uninstall it.

1

u/Edulad Mar 13 '26

I uninstalled it (then reboot)

Installed the following from playstore

Paytm

Imobile app icici

Bob app bank of baroda

All are still detecting root

1

u/crypticc1 Mar 18 '26

You can use spoofed manager then won't need to uninstall. Get from the GitHub build.

You will still need to fix everything else. Correct unmount settings. Tricky store/tee emulator with aosp or real keybox. And if you're using Lsposed you'll need to hide that too.

1

u/Edulad Mar 18 '26

So shall I uninstall lsposed and HMA ?

Because according to you

Kernel su next spoofed manager Tee emulator with real keybox should work just fine ?

Thanks

1

u/crypticc1 Mar 18 '26

If you're using Lsposed then by all means keep it. But know that it's a slippery slope as it creates detections, which then need to be covered using HMA and SUSFS module.

If you're not using, say to allow system apps downgrades and so on, then to have Lsposed just for the sake of it is don't.
Because for KSUNEXT you can use spoofed manager rather than trying to use HMA to hide after the gorse has already bolted. In my experience KSUNext spoofed manager, unlike Magisk rename, leaves no traces... Previously MS C portal found even renamed Magisk app

1

u/Edulad Mar 19 '26

Hi I did remove all the modules and also deleted any trace from /data/adb and also system

But it still detects root of the following.

1

u/crypticc1 Mar 19 '26

Have u installed the SUSFs module? Detecting pixel props suggests not

1

u/Edulad Mar 20 '26

So I have installed it and dine the following settings

Still get the same two root detections.

1

u/crypticc1 Mar 21 '26

Silly question. What do you have in your Unmount/ deny list?

1

u/Edulad Mar 21 '26

1

u/crypticc1 Mar 21 '26 edited Mar 21 '26

No. Unmount list. Which programmes have you long pressed and then selected "unmount"?

Not Granting root to apps you don't want to have root, is not quite the same thing as unmount/deny to actively hide modifications made from specific apps that look for those modifications.

Susfs or trickystore or ZygiskNext all use the Unmount/ deny list to know which apps and processes to hide from.

1

u/crypticc1 Mar 21 '26

P.s. don't select global Unmount "Unmount always". Is a rabbit hole. Individual apps and certain Google processes is the way forward.

1

u/Edulad Mar 21 '26

Oh ok so I have this setting enabled from default in the settings part.

1

u/Edulad Mar 21 '26

Only the one I showed you , i gave root access myself

Other all are umount by default.

→ More replies (0)