NO NETWORK · NO TELEMETRY · FAILS CLOSED · v0.3.0

A02

Root hiding (DenyList, Shamiko)Validated

Magisk DenyList hides su and the root mounts, but an unlocked bootloader and the Magisk app still give the device away.

Validatedandroid

How to read this page

A scenario is one test case: prepare the environment, run the steps, then compare the expected result (written before the run) with the observed result (copied from the run, with screenshots).

A02 · A
Run on a real phone that's been attacked or modified — rooted, jailbroken, hooked or hidden.
Validated
Run, and the result matched what was expected.

Why it matters

Client-side checks can be hidden. Publishing what evades them is part of an honest threat model.

Environment

App
Example app, library 0.3.0
Device
OnePlus Nord 3 (CPH2493), Android 15, bootloader unlocked
Root
Magisk 31 with Zygisk on and the example app in the DenyList

Setup

Prepare the environment.Then run the steps.

  1. 01Enable Zygisk in Magisk and reboot.
  2. 02Turn on Enforce DenyList and add the example app.
  3. 03Optional: Shamiko, for stronger hiding (not yet tested).

Testing guide

Set up the device.Step by step.

Rooting an Android test device →

A step-by-step, no-experience-needed walkthrough: root a Google Pixel you own with Magisk, check that it worked, and undo it. Then go further with KernelSU and APatch.

Steps

What to run.What to read.

  1. 01Open the app.
  2. 02Record which signals remain.

Expected result · written before the run

No single pass/fail status.No signals.

Outcome is a documented result, not a pass/fail.

Observed result · copied from the run

Status: compromisedObserved 2026-10-02.

DenyList unmounted Magisk's files for the app, so root_su_binary and root_magisk_files disappeared (both fire with no hiding). bootloader_unlocked (verified boot state orange) and root_management_apps (the Magisk app is installed) survived, so the device still reports compromised. Renaming the Magisk app and spoofing the boot properties with resetprop would hide those too.

evidence
Status: COMPROMISED · Duration: 115 ms · Ignored: 0 · Signals (2) · [environment] bootloader_unlocked: The device bootloader is unlocked · [root] root_management_apps: A root or privilege-management app is installed
Example app on the rooted OnePlus with Magisk DenyList on: status COMPROMISED, signals bootloader_unlocked (Environment, Strong) and root_management_apps (Root, Medium).
OnePlus Nord 3 · Magisk 31 + Zygisk DenyList · library 0.3.0

Limitations

  • Some or all root signals may be hidden. That is a known limitation of client-side detection.

  • Shamiko and a renamed (hidden) Magisk app have not been tested yet; they are expected to remove root_management_apps as well.

Checks this scenario covers

Every check this test case touches — including ones that aren't expected to fire here. The expected and observed results above say which ones should and did. Each links to how the check works.

All scenarios
← A01 Rooted Android with MagiskA03 Frida on Android →