Magisk is dropping support for hiding root access from apps

Back in May, topjohnwu, the developer of Magisk, announced that he had joined Google on the Android Platform Security Team. Given that Magisk is used to root Android devices and also circumvent root detection measures in apps, many were skeptical that Google would allow the developer to continue working on the project in its current form, or even at all. Fortunately, topjohnwu has been given the green light to continue developing Magisk, but this approval is contingent on the project dropping support for its root hiding feature called MagiskHide.

In a blog post, topjohnwu addresses the current state of Magisk development and what’s changing for the project moving forward. His first point refutes the accusations that his employer, Google, had banned him from working on the project, when in reality, he just had to cut through a lot of red tape to get the approval he needed to work on the project. It’s not unusual for tech companies like Google to scrutinize the external work that its employees do, especially when that external work directly impacts the product that the employee was hired to work on. In topjohnwu’s case, his job on the Android Platform Security Team gives him privileged insight into Android’s current and future security measures, which presents an obvious conflict of interest when MagiskHide — Magisk’s root-hiding component — is designed to circumvent one of Google’s current security measures, that being SafetyNet Attestation. For this reason, topjohnwu has no choice but to cease development on MagiskHide as well as remove most of its infrastructure.

MagiskHide reaches end-of-life

Ending development on MagiskHide was not a difficult decision for topjohnwu to make, though. On a personal level, the developer says that it’s been a while since he last found it enjoyable to work on circumventing root detection methods, which is understandable because it’s essentially a cat-and-mouse game. Sure, Magisk’s popularity can largely be credited to its success in circumventing root detection in Google Pay and Pokémon Go, but it gets tiring having to constantly patch the project just to keep up with the ever-changing landscape. Plus, with hardware-backed attestation in play, circumventing root detection becomes far more difficult, and current workarounds may not work forever.

Although MagiskHide is reaching end-of-life status, the tool will still be around in a very limited sense, as topjohnwu believes it’s important that apps have the ability to “opt-out” of modding. The developer says that users “will be able to assign a denylist of processes where Magisk denies further modifications and reverts all changes it had done. Magisk will not spoof/alter/manipulate any non-Magisk related signals or traces to circumvent any device state detection.” Basically, MagiskHide will no longer be hiding root access from apps and will instead be used to ensure that user-selected apps won’t be modified. Making it easier to revert changes will also speed up testing on emulators, as developers will no longer have to reboot or patch emulator images.

Of course, even though the official Magisk app is dropping support for hiding root access doesn’t mean it can’t be forked to bring back the feature, or that a root-hiding module can’t be released. Any developers that do this, though, will eventually run into the same problems that topjohnwu did, meaning they’ll have to play the same cat-and-mouse game that contributed to topjohnwu becoming disillusioned with Hide.

The end of the centralized Magisk Module Repo

Another upcoming change to Magisk is the removal of the Magisk module repo from the app. The integration of the Magisk-Modules-Repo into the Magisk app is what allows users to search and download modules from within the app. Its removal will mean that users will have to manually download module ZIP files and install them from within the app, which is a little inconvenient compared to the existing solution but not difficult at all to do. Plus, apps that come with a Magisk module component can easily install the module for the user by running the magisk --install-module ZIP command, taking the manual step out of the equation for users.

The bigger loss, though, is for discoverability of new modules through the centralized, curated repo, but topjohnwu says the GitHub organization will be transferred to “trusted community members” soon. This means the repo itself won’t be gone, but the app won’t point to it for now. Eventually, though, topjohnwu does want to let users point the Magisk app to whatever online module source they want, kind of like F-Droid, but this isn’t a high priority for him to implement at the moment.

This change wasn’t prompted by topjohnwu’s employment at Google but was instead bound to happen given the time investment required to moderate the repo.

Zygist – Magisk in Zygote

For the past several months, topjohnwu and several other developers have been working on something called “Zygisk,” which is Magisk in Zygote. Zygote is the OS process that handles forking each application process, so running parts of Magisk in the zygote process will make modules even more robust (including making root-hiding even more powerful). Topjohnwu says that Zygisk also meets his philosophy of Magisk “getting out of the way” of apps whose developers don’t approve of modding, as when a process is added to the MagiskHide denylist, Magisk “will cleanup the memory space of the process to ensure no modding is applied.”

This project is still a work-in-progress, but we’ll hear more implementation details when it’s ready for beta testing.

The future of Magisk development

Magisk started out and remains a hobbyist project for topjohnwu, but the developer wants to take the project more seriously. He has already started up continuous integration on GitHub and will start to regression test changes before each release by integrating with AVD.

Topjohnwu also notes that other talented developers have been submitting worthwhile code changes to the core of Magisk, fixing many bugs and expanding device compatibility. Despite being open source from the beginning, Magisk has been the sole domain of topjohnwu, so it’s nice to see other people contribute to the project when topjohnwu has less time and energy to devote to it himself.

The post Magisk is dropping support for hiding root access from apps appeared first on xda-developers.

from xda-developers https://ift.tt/3BjVani
via IFTTT