[Bug] root detected in game Limbus Company

[rhjdvsgsgks]

Steps to reproduce/复现步骤

1. add game to deny list
2. lauch game
3. root been detected

Expected behaviour/预期行为

root not been detected

Actual behaviour/实际行为

root been detected

Root implementation/Root 方案

magisk

System Module List/系统模块列表

neozygisk
lsposed

NeoZygisk version/NeoZygisk 版本

aae20a8

Android version/Android 版本

16

Version requirement/版本要求

• I am using the latest debug build from GitHub Actions./我正在使用 GitHub Actions 中最新的调试版本。

Logs/日志

please tell me what log is required to diagnose this detection.

simply turn on "enforce denylist" in magisk would make the game unable to detect root, even with neozygisk & lsposed enabled. i guess there are some trace neozygisk didnt hide properly, but "enforce denylist" did

[VisionR1]

Also, you know need a module to hide the root trace, like zygisk assistant.

[rhjdvsgsgks]

Also, you know need a module to hide the root trace, like zygisk assistant.

after some debug. i confirmed it is a bug of neozygisk. it will umount module files in app process (as expected). but left app zygote process unchanged (in magisk deny list, it called pkg_name:zygote or something like that). which lead significant trace in zygote process' /proc/self/mounts or /proc/self/maps

[JingMatrix]

For the logs, please installed debug versions of LSPosed and NeoZygisk (latest CI build) and upload the logs generated by LSPosed manager.

@VisionR1 Nope, we don't need it unless users are using some metamodule with KernelSU.

[rhjdvsgsgks]

i found it is been detected even if lsposed disabled. here is the filtered log when app been started.

Zygote  : Forked child process 8192
zygisk-core64: pre specialize [com.ProjectMoon.LimbusCompany]
zygiskd64: zygiskd::zygiskd: New daemon action: GetProcessFlags
zygiskd64: zygiskd::zygiskd: Flags for UID 10273: ProcessFlags(PROCESS_ON_DENYLIST | PROCESS_ROOT_IS_MAGISK)
zygisk-core64: [com.ProjectMoon.LimbusCompany] is on the denylist
zygiskd64: zygiskd::zygiskd: New daemon action: ReadModules
zygisk-core64: updating mount namespace to type Clean
zygiskd64: zygiskd::zygiskd: New daemon action: UpdateMountNamespace
Zygote  : Process 8192 created for com.ProjectMoon.LimbusCompany
zygisk-core64: post specialize [com.ProjectMoon.LimbusCompany]
zygisk-core64: replaced com/android/internal/os/Zygote!nativeSpecializeAppProcess @0x770192804c
zygisk-core64: replaced com/android/internal/os/Zygote!nativeForkSystemServer @0x77019285f0
LSPlt   : RegisterHook 1778 fork
LSPlt   : RegisterHook 1778 unshare
LSPlt   : RegisterHook 1778 strdup
LSPlt   : RegisterHook 55 pthread_attr_setstacksize
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79c72b6000 79c72d9000-2a1000
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 79c71e4000 79c7215000-a00000
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79a51c6000 79a51c7000-2c4000
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79a4ff2000 79a51a3000-f0000
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79a4f02000 79a4ff2000-0
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 7703600000 7703604000-c00000
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 7702c00000 77033e8000-200000
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 7702a00000 7702b9a000-0
LSPlt   : restoring 4 functions
LSPlt   : found matching hook for symbol [fork] at address 0x79a51c5210.
LSPlt   : hooking 0x79a51c5210
LSPlt   : found matching hook for symbol [unshare] at address 0x79a51c5300.
LSPlt   : hooking 0x79a51c5300
LSPlt   : found matching hook for symbol [strdup] at address 0x79a51c0610.
LSPlt   : hooking 0x79a51c0610
LSPlt   : restore 0x79a51a3000 from 0x79c72b6000
LSPlt   : found matching hook for symbol [pthread_attr_setstacksize] at address 0x7703430b58.
LSPlt   : hooking 0x7703430b58
LSPlt   : restore 0x7703400000 from 0x79c71e4000
zygisk-core64: unmap libzygisk.so loaded at 0x7701885000 with size 1417216
Zygote  : Forked child process 8268
zygisk-core64: pre specialize [com.android.vending]
zygiskd64: zygiskd::zygiskd: New daemon action: GetProcessFlags
zygiskd64: zygiskd::zygiskd: Flags for UID 10313: ProcessFlags(PROCESS_ROOT_IS_MAGISK)
zygiskd64: zygiskd::zygiskd: New daemon action: ReadModules
Zygote  : Process 8268 created for com.android.vending
zygisk-core64: post specialize [com.android.vending]
zygisk-core64: replaced com/android/internal/os/Zygote!nativeSpecializeAppProcess @0x770192804c
zygisk-core64: replaced com/android/internal/os/Zygote!nativeForkSystemServer @0x77019285f0
LSPlt   : RegisterHook 1778 fork
LSPlt   : RegisterHook 1778 unshare
LSPlt   : RegisterHook 1778 strdup
LSPlt   : RegisterHook 55 pthread_attr_setstacksize
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79c72b6000 79c72d9000-2a1000
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 79c71e4000 79c7215000-a00000
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79a51c6000 79a51c7000-2c4000
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79a4ff2000 79a51a3000-f0000
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79a4f02000 79a4ff2000-0
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 7703600000 7703604000-c00000
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 7702c00000 77033e8000-200000
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 7702a00000 7702b9a000-0
LSPlt   : restoring 4 functions
LSPlt   : found matching hook for symbol [fork] at address 0x79a51c5210.
LSPlt   : hooking 0x79a51c5210
LSPlt   : found matching hook for symbol [unshare] at address 0x79a51c5300.
LSPlt   : hooking 0x79a51c5300
LSPlt   : found matching hook for symbol [strdup] at address 0x79a51c0610.
LSPlt   : hooking 0x79a51c0610
LSPlt   : restore 0x79a51a3000 from 0x79c72b6000
LSPlt   : found matching hook for symbol [pthread_attr_setstacksize] at address 0x7703430b58.
LSPlt   : hooking 0x7703430b58
LSPlt   : restore 0x7703400000 from 0x79c71e4000
zygisk-core64: unmap libzygisk.so loaded at 0x7701885000 with size 1417216
ApplicationLoaders: Returning zygote-cached class loader: /system/framework/android.test.base.jar
ApplicationLoaders: Returning zygote-cached class loader: /system_ext/framework/androidx.window.extensions.jar
ApplicationLoaders: Returning zygote-cached class loader: /system_ext/framework/androidx.window.sidecar.jar
Zygote  : Forked child process 8389
zygisk-core64: pre specialize [com.ProjectMoon.LimbusCompany:alert_dialog]
zygiskd64: zygiskd::zygiskd: New daemon action: GetProcessFlags
zygiskd64: zygiskd::zygiskd: Flags for UID 10273: ProcessFlags(PROCESS_ON_DENYLIST | PROCESS_ROOT_IS_MAGISK)
zygisk-core64: [com.ProjectMoon.LimbusCompany:alert_dialog] is on the denylist
zygiskd64: zygiskd::zygiskd: New daemon action: ReadModules
zygisk-core64: updating mount namespace to type Clean
zygiskd64: zygiskd::zygiskd: New daemon action: UpdateMountNamespace
Zygote  : Process 8389 created for com.ProjectMoon.LimbusCompany:alert_dialog
zygisk-core64: post specialize [com.ProjectMoon.LimbusCompany:alert_dialog]
zygisk-core64: replaced com/android/internal/os/Zygote!nativeSpecializeAppProcess @0x770192804c
zygisk-core64: replaced com/android/internal/os/Zygote!nativeForkSystemServer @0x77019285f0
LSPlt   : RegisterHook 1778 fork
LSPlt   : RegisterHook 1778 unshare
LSPlt   : RegisterHook 1778 strdup
LSPlt   : RegisterHook 55 pthread_attr_setstacksize
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79c72b6000 79c72d9000-2a1000
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 79c71e4000 79c7215000-a00000
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79a51c6000 79a51c7000-2c4000
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79a4ff2000 79a51a3000-f0000
LSPlt   : match hook info /system/lib64/libandroid_runtime.so:1778 79a4f02000 79a4ff2000-0
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 7703600000 7703604000-c00000
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 7702c00000 77033e8000-200000
LSPlt   : match hook info /apex/com.android.art/lib64/libart.so:55 7702a00000 7702b9a000-0
LSPlt   : restoring 4 functions
LSPlt   : found matching hook for symbol [fork] at address 0x79a51c5210.
LSPlt   : hooking 0x79a51c5210
LSPlt   : found matching hook for symbol [unshare] at address 0x79a51c5300.
LSPlt   : hooking 0x79a51c5300
LSPlt   : found matching hook for symbol [strdup] at address 0x79a51c0610.
LSPlt   : hooking 0x79a51c0610
LSPlt   : restore 0x79a51a3000 from 0x79c72b6000
LSPlt   : found matching hook for symbol [pthread_attr_setstacksize] at address 0x7703430b58.
LSPlt   : hooking 0x7703430b58
LSPlt   : restore 0x7703400000 from 0x79c71e4000
zygisk-core64: unmap libzygisk.so loaded at 0x7701885000 with size 1417216
Zygote  : Process 8192 exited due to signal 9 (Killed)
Zygote  : Process 8389 exited due to signal 9 (Killed)

as you can see, didnt say anything about com.ProjectMoon.LimbusCompany_zygote been specialized. but when enforce denylist enabled, revert_unmount will be called

[JingMatrix]

Please provide the log archive as required, otherwise I cannot help.

[rhjdvsgsgks]

Please provide the log archive as required, otherwise I cannot help.

you mean i need to get log from LSPosed manager even if it is disabled?

[rhjdvsgsgks]

but when enforce denylist enabled, revert_unmount will be called

i found in magisk, this kind of umount is called from logcat (1 2) rather than normal specialize process. is such of logic missing in neozygisk?

[JingMatrix]

Please activate LSPosed and upload logs. Ensure that both LSPosed and NeoZygisk are debug versions.

[JingMatrix]

I cannot reproduce the claimed behavior with Magisk option Enforced denylist.

This game do detect root. I suggest that you change your root solution, Magisk is very easy to be detected.

[rhjdvsgsgks]

@JingMatrix

This game do detect root. I suggest that you change your root solution, Magisk is very easy to be detected.

it is also been detected on kernelsu (with neozygisk). but it is not detected on magisk (using neozygisk with Enforced denylist) or rezygisk (without Enforced denylist).

seems like a logic flaw in neozygisk. therefore i made a detector for it. hope that would help your debugging