From 62549d774168045d0eb121d454069e1b387dead6 Mon Sep 17 00:00:00 2001 From: bdeshi Date: Tue, 3 Nov 2026 20:37:23 +0600 Subject: [PATCH] Hide a fixed set of well-known root and hook packages With per-app configuration gone, the hidden list is the same for every app and can't be edited at runtime, so it carries the well-known names instead of only KernelSU, Magisk and Veil. 28 packages plus Veil, grouped in Features.kt: - root managers: Magisk, Magisk Delta, Magisk Alpha, KernelSU, KernelSU Next, SukiSU Ultra, APatch - module managers and helpers: MMRL (both variants), Magisk Module Manager, KsuWebUI - hook frameworks and managers: Vector, LSPosed, LSPatch, EdXposed, Xposed installer, Taichi, VirtualXposed, Substrate - older su apps and one-click root tools Packages that aren't installed match nothing, so a name that's wrong or absent is harmless. Most names were not checked against an install; only KernelSU and MMRL were present on the test device. Xposed modules in general have no common package name, so they stay uncovered by name. The settings screen shows the count and puts the list behind a toggle. Verified on device with Veil Probe: the installed ones (KernelSU and both MMRL packages) report HIDDEN across all ten lookups, no LEAK/FAIL/ERROR, and a scoped app still starts. Co-Authored-By: agent --- README.md | 6 ++- .../main/java/space/bdeshi/veil/Features.kt | 43 ++++++++++++++++++- .../space/bdeshi/veil/SettingsActivity.kt | 17 ++++++-- 3 files changed, 60 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 845146c..3fd4cfe 100644 --- a/README.md +++ b/README.md @@ -34,9 +34,13 @@ Every app in scope gets all of these. Veil's settings screen is a read-only summ | USB / wireless debugging | `adb_enabled` / `adb_wifi_enabled` | | Developer options | Developer Options enabled state | | Mock location | Legacy pre-Marshmallow flag only | -| Root / manager apps | Fixed list: KernelSU, Magisk, Veil itself | +| Root / manager apps | Fixed list of ~30 packages (see `Features.kt`) | | Build tags/type | Real build swapped for `release-keys` / `user` | +The package list covers root managers (Magisk and forks, KernelSU and forks, APatch), module +managers, hook frameworks and their managers, and older su apps, plus Veil itself. Xposed modules in general have no common package name, so they +aren't covered by name. + Doesn't cover native-level root/hook detection or remote attestation (Play Integrity, SafetyNet) — that's your Zygisk implementation's job, not Veil's. diff --git a/app/src/main/java/space/bdeshi/veil/Features.kt b/app/src/main/java/space/bdeshi/veil/Features.kt index b7d5fe2..fb716ca 100644 --- a/app/src/main/java/space/bdeshi/veil/Features.kt +++ b/app/src/main/java/space/bdeshi/veil/Features.kt @@ -35,9 +35,48 @@ object Features { // Fixed at build time; edit and rebuild to change. Veil itself is here too: an installed // hooking module is as much a tell as a root manager. + // + // Well-known root managers, module managers, hook frameworks and older su apps, by package + // name. Packages that aren't installed match nothing, so a name that's wrong or absent is + // harmless. Not covered: Xposed modules in general (they have no common package name; + // detectors find them by manifest metadata). val HIDDEN_PACKAGES: Set = setOf( - "me.weishu.kernelsu", - "com.topjohnwu.magisk", SELF_PACKAGE, + + // Root managers: Magisk and forks, KernelSU and forks, APatch + "com.topjohnwu.magisk", + "io.github.huskydg.magisk", + "io.github.vvb2060.magisk", + "me.weishu.kernelsu", + "com.rifsxd.ksunext", + "com.sukisu.ultra", + "me.bmax.apatch", + + // Module managers and helpers + "com.dergoogler.mmrl", + "com.dergoogler.mmrl.wx", + "com.fox2code.mmm", + "io.github.a13e300.ksuwebui", + + // Hook frameworks and their managers + "org.matrix.vector.manager", + "org.lsposed.manager", + "org.lsposed.lspatch", + "de.robv.android.xposed.installer", + "org.meowcat.edxposed.manager", + "com.solohsu.android.edxp.manager", + "me.weishu.exp", + "io.va.exposed", + "com.saurik.substrate", + + // Older su apps and one-click root + "eu.chainfire.supersu", + "com.koushikdutta.superuser", + "com.noshufou.android.su", + "com.noshufou.android.su.elite", + "com.thirdparty.superuser", + "com.yellowes.su", + "me.phh.superuser", + "com.alephzain.framaroot", ) } diff --git a/app/src/main/java/space/bdeshi/veil/SettingsActivity.kt b/app/src/main/java/space/bdeshi/veil/SettingsActivity.kt index c99f9fa..18b46da 100644 --- a/app/src/main/java/space/bdeshi/veil/SettingsActivity.kt +++ b/app/src/main/java/space/bdeshi/veil/SettingsActivity.kt @@ -105,14 +105,16 @@ class SettingsActivity : AppCompatActivity() { } root.addView(featureCard, marginTop(dp(8))) - root.addView(sectionTitle("Hidden packages"), marginTop(dp(16))) + root.addView(sectionTitle("Hidden packages (${Features.HIDDEN_PACKAGES.size})"), marginTop(dp(16))) root.addView(TextView(this).apply { - text = "Fixed in this build — edit Features.HIDDEN_PACKAGES and rebuild to change." + text = "Fixed in this build — edit Features.HIDDEN_PACKAGES and rebuild to change. " + + "Packages that aren't installed match nothing." textSize = 13f alpha = 0.8f setPadding(0, dp(4), 0, dp(8)) }) - root.addView(ChipGroup(this).apply { + val packageChips = ChipGroup(this).apply { + visibility = View.GONE for (pkg in Features.HIDDEN_PACKAGES.sorted()) { addView(Chip(this@SettingsActivity).apply { text = pkg @@ -120,7 +122,16 @@ class SettingsActivity : AppCompatActivity() { isCheckable = false }) } + } + root.addView(MaterialButton(this).apply { + text = "Show list ▾" + setOnClickListener { + val show = packageChips.visibility != View.VISIBLE + packageChips.visibility = if (show) View.VISIBLE else View.GONE + text = if (show) "Hide list ▴" else "Show list ▾" + } }) + root.addView(packageChips) setContentView(ScrollView(this).apply { addView(root); fitsSystemWindows = true }) }