zimperium magisk root detection analysis

[jameshilliard]

This is a root detection framework used by some banking apps and employs a number of heuristics and appears to detect magisk on my android 10 device running lineageos which passes safetynet.

I've done some analysis and have identified some more info on how it appears to detect root.

This method is specifically designed to detect magisk:

• Iterate though properties using __system_property_find_nth()
• call __system_property_read() for each property
• check if property starts with "init.svc."
• check length of string after the "init.svc." prefix is 7
• check all characters after "init.svc." are alphanumeric using isalnum()
• check service state is "stopped"

The zimperium detector also appears to run analysis on many filepaths, I haven't done much analysis on these yet but there might be some obvious info leaks that magisk doesn't cover.

I've identified the following proc paths so far as being read by zimperium for analysis:

/proc/%d
/proc/%d/
/proc/%d/attr/current
/proc/%d/attr/prev
/proc/%d/cgroup
/proc/%d/cmdline
/proc/%d/comm
/proc/%d/stat
/proc/%d/status
/proc/%d/task
/proc/%d/task/%d/attr/current
/proc/%d/task/%d/stat
/proc/buddyinfo
/proc/diskstats
/proc/loadavg << it tries to read this one a bunch when doing actions in the app that triggers root detection
/proc/meminfo
/proc/net/arp
/proc/net/dev
/proc/net/netstat
/proc/net/route
/proc/net/rt_cache
/proc/net/snmp
/proc/net/snmp6
/proc/net/stat/arp_cache
/proc/net/stat/ndisc_cache
/proc/net/stat/rt_cache
/proc/net/tcp
/proc/net/tcp6
/proc/net/udp
/proc/net/udp6
/proc/net/unix
/proc/net/wireless
/proc/schedstat
/proc/self/maps
/proc/stat
/proc/sys/kernel/pid_max
/proc/uid_stat/
/proc/uptime
/proc/vmstat

It seems to use the following data paths for analysis:

/data/local/
/data/local/bin/
/data/local/xbin/
/data/data/kingoroot.supersu/files/supersu.cfg
/data/user/%d/kingoroot.supersu/files/supersu.cfg
/data/data/kingoroot.supersu/logs/
/data/user/%d/kingoroot.supersu/logs/
/data/data/kingoroot.supersu/requests/
/data/data/supersu/
/data/data/supersu/system/
/data/data/kingoroot.supersu/connections/
/data/data/kingoroot.supersu/connections/system/
/data/data/kingoroot.supersu
/data/user_de/%d/eu.chainfire.supersu/files/supersu.cfg
/data/user/%d/eu.chainfire.supersu/files/supersu.cfg
/data/data/eu.chainfire.supersu/files/supersu.cfg
/data/user_de/%d/eu.chainfire.supersu/logs/
/data/user/%d/eu.chainfire.supersu/logs/
/data/data/eu.chainfire.supersu/logs/
/data/user_de/0/eu.chainfire.supersu/requests/
/data/data/eu.chainfire.supersu/requests/
/data/data/eu.chainfire.supersu/connections/
/data/data/eu.chainfire.supersu/connections/system/
/data/data/eu.chainfire.supersu
/data/local/tmp/

and the following system paths:

/system/sd/xbin/
/system/bin/failsafe/
/system/bin/
/system/xbin/
/system/etc/
/system/bin/.ext/
/system/usr/we-need-root/
/system/xbin/supolicy
/system/xbin/su
/system/xbin/ku.sud
/system/bin/su
/system/usr/iku/isu
/system/bin/am
/system/xbin/daemonsu
/system/xbin/sugote
/system/bin/.ext/.su
/system/su.d/
/system/su.d/$i
/system/xbin/daemonsu
/system/xbin/sugote-mksh
/system/bin/%s
/system/bin/toolbox
/system/xbin/sush
/system/bin
/system/framework
/system/lib
/system/vendor/sns/sensors/registry/
/system/vendor/sns/sensors/registry/registry/
/system/vendor/mpt/
/system/vendor/vzw/

It looks at these sbin paths:

/sbin/
/sbin/adbd

and the following dev paths:

/dev/.su.d
/dev/.su.d.complete
/dev/socket/su-daemon/
/dev/urandom
/dev/urandom
/dev/random

I've identified the following paths being watched using inotify_add_watch():

/system/bin
/system/framework
/system/lib

[enovella]

Any sample APK to help you with the reversing?

[jameshilliard]

This app uses it.

[jawz101]

I imagine XPrivacyLUA could disable the ability to detect it. Or Android 11

[androidacy-user]

I imagine XPrivacyLUA could disable the ability to detect it. Or Android 11

Has anyone tried downloading the shell hooks and using those I'm combination with tracking and identifiers hooks? Might be a stopgap solution unless it checks for memory integrity

[jawz101]

there are also a few other community rules that may help as well. Some mention restricting an app from using certain cat commands

[topjohnwu]

Thanks for the details, but if hidden correctly, none of the files you mentioned can be detected. It might use some other known methods to detect Magisk, I'll "eventually" add them some time. Thanks for the report!

[bengalih]

Curious if there has been any movement on this.? Zimperium and zAnti are becoming more prevalent. I've personally been having problems with the Chase Mobile App. What is interesting is that it appears to take a few moments to perform it's checking when the app is first launched. I have about 5-8 seconds to open up a "protected" activity. After that I will get a message that the device is rooted.

[bengalih]

Just checking in to see if anyone else in the community is working on this? I last attempted while still on 10 using all known methods of obfuscating Magisk root (hide, repackage, etc.). I tried multiple hooks from XPrivacyLua and had no success. I believe some of my tests were skewed because of the delay that Zimperium has when launching an app on first run. There appears to be approximately 10 seconds (give or take) before it can detect and block and therefore all protected activities will be available until it has initialized. My testing app was Chase Mobile - and it is possible (even likely) that other apps delay startup until full scanning is done. With Chase however you can access the protected activities before scanning is complete. Due to this I believe I had some false positives when trying to bypass Zimperium. However I don't believe I found any method of hiding/obfuscating root, or blocking access via hooks that worked to foil the detection. We can only hope that Zimperium is too cost prohibitive for more vendors to start implementing, otherwise soon no apps will work with root. Additionally, methods that create a secure system like Work Profiles, Samsung Folder, Island, etc also fail to block the detection from Zimperium.

[dimm0k]

why is this closed??

[ReanimationXP]

@topjohnwu Why was this closed if it's something to be implemented eventually? Researching rooting and I hear popular apps like Chase are encountering this issue.

[ugurbor]

This bank app also has Zimperium and I couldn't get around the root detection. Tried latest canary + riru + riru-unshare and also with LSPosed and XPrivacyLUA.

This app directly says that the phone is rooted so it seems to be better to test with than the Chase one.

[soredake]

Anyone tried this with new denylist?

[paresh996]

Unable to get away with Zimperium detecting root. Disassembled the library it uses to detect root but the machine language goes above my head.

[enovella]

Unable to get away with Zimperium detecting root. Disassembled the library it uses to detect root but the machine language goes above my head.

which package name?

[enovella]

This bank app also has Zimperium and I couldn't get around the root detection. Tried latest canary + riru + riru-unshare and also with LSPosed and XPrivacyLUA.

This app directly says that the phone is rooted so it seems to be better to test with than the Chase one.

The official Magisk is not intended to be hidden. Use the Magisk Module Shamiko.

[paresh996]

Unable to get away with Zimperium detecting root. Disassembled the library it uses to detect root but the machine language goes above my head.

which package name?

Developed by Chase but privately shared with me. The experience is exactly same as people describe for the Chase Mobile app. The app opens, uses the internet for a couple of seconds and then it says the device is rooted. MagiskHide is enabled, HideMyApplist is hiding other apps and Universal SafetyNet FIx is in place. All other apps work. More details

[enovella]

Unable to get away with Zimperium detecting root. Disassembled the library it uses to detect root but the machine language goes above my head.

which package name?

Developed by Chase but privately shared with me. The experience is exactly same as people describe for the Chase Mobile app. The app opens, uses the internet for a couple of seconds and then it says the device is rooted. MagiskHide is enabled, HideMyApplist is hiding other apps and Universal SafetyNet FIx is in place. All other apps work. More details

Probably this app has more layers of protection. Did you run APKiD against the app?

[paresh996]

Probably this app has more layers of protection. Did you run APKiD against the app?

[+] APKiD 2.1.5 :: from RedNaga :: rednaga.io
[*] P0.apk
 |-> anti_vm : possible VM check
[*] P0.apk!classes.dex
 |-> anti_vm : Build.FINGERPRINT check, Build.MANUFACTURER check, network operator name check, possible VM check
 |-> compiler : dexlib 2.x
[*] P0.apk!classes2.dex
 |-> anti_vm : Build.FINGERPRINT check, Build.MANUFACTURER check, SIM operator check, network operator name check
 |-> compiler : dexlib 2.x
[*] P0.apk!classes3.dex
 |-> compiler : dexlib 2.x
[*] P0.apk!lib/arm64-v8a/libz9.so
 |-> anti_vm : possible VM check
[*] P0.apk!lib/armeabi-v7a/libz9.so
 |-> anti_vm : possible VM check

[enovella]

Probably this app has more layers of protection. Did you run APKiD against the app?

[+] APKiD 2.1.5 :: from RedNaga :: rednaga.io
[*] P0.apk
 |-> anti_vm : possible VM check
[*] P0.apk!classes.dex
 |-> anti_vm : Build.FINGERPRINT check, Build.MANUFACTURER check, network operator name check, possible VM check
 |-> compiler : dexlib 2.x
[*] P0.apk!classes2.dex
 |-> anti_vm : Build.FINGERPRINT check, Build.MANUFACTURER check, SIM operator check, network operator name check
 |-> compiler : dexlib 2.x
[*] P0.apk!classes3.dex
 |-> compiler : dexlib 2.x
[*] P0.apk!lib/arm64-v8a/libz9.so
 |-> anti_vm : possible VM check
[*] P0.apk!lib/armeabi-v7a/libz9.so
 |-> anti_vm : possible VM check

Can you list the native libraries? Just run: unzip -l apk

[paresh996]

Can you list the native libraries? Just run: unzip -l apk

libzcloud.so libz9.so libscp.so libmodpng.so libmodpdfium.so libmodft2.so libjniPdfium.so libc++_shared.so