Proof that it works: I wanted to be sure that this solution works before I adopt it. There is this Vietnamese banking app which I don't use being an Indian but was a test case since it evades "frontal" measures to hide root.
On my Pixel 4a, running Android 12, all the frontal measures were successful- Safety-net passed; developer options state hidden; device shows certified in Play Store and Magisk 24.1 "hidden" with a random name and package name.
Yet, this app detected that I was running a modded framework and on opening the app promptly sent me to it's portal (screenshot on left). With the Xposed module , it allowed me to open it (right).
Sneakily, I didn't name the module yet; it is Hide My Applist, which is deprecated, last update being end of last year. This module covers ways used by apps to detect modding such as:
Configuration instructions; I didn't find clear instructions on how to use this, so detailing the process below
- Install it through Magisk and when you open the app in LSposed manager, you get this view. Do not select/modify anything other than default (default being system framework)
- Click on the cog wheel at bottom right to open the module interface
First thing is to install Magisk extension (Riru or Zygisk, it was the second one for me being on Zygisk based LSposed set-up. Ignore this step and you will be rewarded with a boot loop.
Click on detection test, it will download an app Applist detector and when you run it , you would see red in most places all related to Xposed modules or LSposed framework
Manage Templates: You can create whitelist or blacklist templates. Select blacklist and add all Xposed module related package names like
eu.faircode.lua etc., and
com.tsng.hidemyapplist , which is the package name of this Xposed module. Save (icon at top right corner) Essentially, blacklist contains all the packages that show that the device is rooted.
You can create as many templates as you want (more about that later)
Select Effective Apps: This is a list of apps from which you want to hide the blacklist like your banking apps, for example
vn.com.techcombank.bb.app (Vietnamese banking app). Include in this list
com.vsng.applistdetector which is the package name for the app downloaded in Step 4. Configure as explained:
- Enable hide
- Work mode (Blacklist) -default setting
- Enable all hide methods.
- Copy this config to quickly pick and apply to all such apps
- In template config, choose the blacklist template you named and saved (Step 5)
Run the app list detector check, see all blue (in my case suspicious package in abnormal environment is related to Xprivacy Lua) but that was not a problem
You are good to go!
- Being LSposed, you would need to reboot device when a new app is added and you want to add that to this module. Changes you make within the module are real time ( don't need to reboot)
You can use templates for purposes of detaching an app from Play Store. For example you have YouTube Vanced installed but it gets replaced because regular YouTube gets updated. You can refer to this XDA post for more examples.