I would advise, however, that others don't share the same concerns, or their use case requires this approach. But it is substantially more difficult/impossible to prove the lack of malicious code definitively.Įach of the listed concerns is valid, and if one is a dealbreaker, it's understandable to choose a different approach and communicate your concerns. disagreements on working in user space vs kernel spaceĪs far as I can tell (not being an expert in development), there has been no evidence of malicious code in Kitsune.concerns that original magisk + certain modules accomplishes what kitsune aspired to.developer immaturity, particularly in response to upstream drama (lsposed/xposed).As far as I could tell from the Reddit thread you referenced and some branching searches from there, there are three broad concerns: Never a bad question, especially given the recent events with xz/Linux. Disabling Verity and running Shimako seems to be my winning ticket. Auto-patches for verity do not work on my phone. Running avbctl get-verity in TWRP's shell verified I disabled that. I re-flashed all my stock VBmetas with 'fastboot -disable-verity -disable-verification flash vbmeta_a vbmeta.img'. Also, the root method for my phone in another XDA thread only partially disables verity (by hexxing out VBMeta) - TWRP was showing verity still enforcing. This leads me to believe Company Portal/InTune is using localhost TCP/UDP connections with the apps, and also there could be a method it uses with how it interacts with the TCP/IP stack in detecting root also.Įdit 2: Got lockouts with using Zygist's Enforce Deny list, whereas with Shimako the lockouts were easily dealt with - before I fixed verity from enforcing. Certain things wouldn't load up in the apps, but the apps would run/work enough and I wouldn't get the rooted phone warning - once logged in sufficiently I could unrestrict Company Portal in AFWall+ and continue about my business. Observations: Blocking Company Portal/InTune from the phone's LAN (but allowed non-local address Wifi and mobile data) using AFWall+ yielded interesting results before above working modules were loaded into my Magisk setup. I didn't swap bootloaders this time around (yes this sometimes caused a no boot until I formatted data - I had backups). I did not delete any app data (including Company Portal). What I didn't need to do: I didn't remove accounts. I suspect Magisk 'forgets' the settings, a re-toggle may work with the stock enforcement module vs the LSPosed/Shimako combo, but my setup has worked across multiple reboots and a TWRP backup session thrown in the mix so I am not removing the combo of modules yet. The way I always have my deny list is if the app doesn't need root, it gets everything denied. Disabled enforce deny list (so Shimako kicks in blacklist mode, which is its default) and re-toggled ALL 'Microsoft' apps in the deny list config (Shimako uses it also). Did a combo of putting in LSPosed (Zygisk version, v1.8.3 (6552)), Shimako (0.5.1 (115)), Universal Safety net fix v2.2.1. What seems to work: Got InTune/Company Portal with Teams going with Magisk 25.1 (v25100) and secure boot Android 11. (Booting a a magisk free loader after this still brought out the red flag). I suspect I broke Verity/secure boot (had issues) with the universal TWRP patch Disable_Dm-Verity_ForceEncrypt and a format Data with TWRP (was having a separate issue with Magisk v25100) and a format Data from TWRP. Following the instructions here I copied the Detach.txt in my root /sdcard/ and added this line in the end: Īfter doing this it's just a matter of installing the magisk module and it will detach the app from Play Store.ĮDIT: It seems that after a while the apps appears again in the Play Store looking for update so the Detach v5.3 did not do its job :S Detach it from PlayStore using the Magisk Detach module v5.3. Download the previous version from APK Mirror (as suggested earlier) v.0 I'm not sure what they use to verify it (and I'd love to know it) but to solve I had to:

All other apps pass SafetyNet check and Device integrity check (I also changed fingerprints).Īnyway with the latest version Teams and other MS apps keeps telling the device is rooted.

Hello, I can confirm that the newest version of MSFT Intune (Company Portal) breaks something.

Opera mini beta 5.2 free download