en Hiding Root Common Methods - JackA1ltman/NonGKI_Kernel_Build_2nd GitHub Wiki
Hiding Root — Common Methods
A craftsman must first sharpen his tools before he can do his best work.
For rooted users, hiding root traces is an unavoidable topic. More and more apps are actively blocking root users, even when those users pose no actual financial harm to the companies involved. Life goes on — and so does the cat-and-mouse game we play to keep things working normally.
This guide focuses on methods available for Non-GKI / GKI 1.0 kernels. Additional approaches specific to GKI 2.0 kernels are not covered here.
This guide does not serve users seeking to cheat in games. We have no intention of and cannot provide assistance for such use cases.
Root Managers
This is a general guide and is not limited to KernelSU. Here are the major root manager options available today:
Magisk
The oldest and most widely compatible root manager, supporting a very broad range of kernel versions.
| Fork | Link |
|---|---|
| Magisk (official) | https://github.com/topjohnwu/Magisk |
| Kitsune Mask | |
| Kitsune Mask Fork | https://t.me/KitsuneUfork |
| Magisk Alpha | https://t.me/magiskalpha |
APatch
A rising star that gained recognition for its KPM kernel module support. It has seen rapid development and its module compatibility has improved substantially.
| Fork | Link |
|---|---|
| APatch (stable) | https://github.com/bmax121/APatch |
| APatch (beta) | https://t.me/APatchChannel |
| FolkPatch | https://t.me/FolkPatch |
KernelSU
The best balanced option. Embedded via kernel source or LKM, it offers solid default root concealment and module compatibility on par with Magisk, backed by a very active community.
The following forks all support Non-GKI kernels:
| Fork | Link |
|---|---|
| rsuntk | https://github.com/rsuntk/KernelSU |
| xxksu | https://github.com/backslashxx/KernelSU |
| Next | https://github.com/KernelSU-Next/KernelSU-Next |
| SukiSU-Ultra | https://github.com/SukiSU-Ultra/SukiSU-Ultra |
| ReSukiSU | https://github.com/ReSukiSU/ReSukiSU |
SKRoot
The strongest default root concealment of any option here, with broad kernel version support, but no module system. Available in Lite and Pro branches — Pro is the mainline but still under development and not yet fully open-source.
SKRoot users do not need the rest of this guide.
This guide uses KernelSU as its reference, but applies equally to Magisk and APatch users.
Preparing the Modules
We need additional helper modules to effectively conceal root traces.
Key principles:
- Do not blindly trust detection apps — always test against the specific apps you actually use
- The modules listed in each category are generally mutually exclusive — do not install all of them at once
1. TEE / Certificate Modules
Purpose: Address app detection of TEE status (common on OnePlus devices), Google Play certificate integrity, and bootloader unlock status.
| Module | Notes | Link |
|---|---|---|
| Tricky Store | Closed source, full-featured | https://github.com/5ec1cff/TrickyStore |
| Tricky Store OSS | Open-source implementation by beakthoven, no longer maintained | https://github.com/beakthoven/TrickyStoreOSS |
| TEE Simulator | Open-source alternative by JingMatrix, slightly less capable than Tricky Store | https://github.com/JingMatrix/TEESimulator |
| TEE Simulator RS | Enhanced fork by Enginex0 | https://github.com/Enginex0/TEESimulator-RS |
Companion modules (can be paired with any of the above):
| Module | Notes | Link |
|---|---|---|
| Integrity Box | Bundles Play Integrity Fix and other features, auto-fetches certificate info | https://github.com/MeowDump/Integrity-Box |
| Tricky Addon Update Target List | WebUI interface for managing certificates, app lists, security patch spoofing, etc. | https://github.com/KOWX712/Tricky-Addon-Update-Target-List |
| Tricky Addon Enhanced | Enginex0's enhanced fork — stronger concealment and improved certificate fetching | https://github.com/Enginex0/tricky-addon-enhanced |
2. Optional Modules
Zygisk
Zygisk is not required. In the simplest setup, the TEE / certificate modules alone are sufficient.
| Module | Notes | Link |
|---|---|---|
| Zygisk Next | Closed source | https://github.com/Dr-TSNG/ZygiskNext |
| NeoZygisk | Open-source implementation by JingMatrix, strong concealment, but drops zygote32 support | https://github.com/JingMatrix/NeoZygisk |
| NyaZygisk | HSSkyBoy's fork, focused on further improving concealment | https://github.com/HSSkyBoy/NyaZygisk |
| ReZygisk | Open-source implementation by PerformanC, rewritten in C for better performance, retains zygote32 support. Note: Magisk Alpha support was dropped in the latest release | https://github.com/PerformanC/ReZygisk |
LSPosed
Also not required. LSPosed provides comprehensive injection capabilities but may introduce additional root leak risks.
| Module | Notes | Link |
|---|---|---|
| LSPosed IT | Official release, partially open-source | https://t.me/LSPosed |
| Vector | Open-source alternative by JingMatrix, may have compatibility issues on some devices | https://github.com/JingMatrix/Vector |
| ReLSPosed | Open-source alternative by ThePedroo, no longer maintained, missing libxposed API 101 | https://github.com/ThePedroo/ReLSPosed |
Hide My Applist (HMA)
Hides specified apps or modules from app list scans. Recommended to use alongside the zero-width character vulnerability patch.
LSPosed implementations:
| Module | Notes | Link |
|---|---|---|
| HMA (official) | Official implementation by Dr-TSNG | https://github.com/Dr-TSNG/Hide-My-Applist |
| HMAL | Fork by pumPCin — renames the package to evade detection | https://github.com/pumPCin/HMAL |
Zygisk implementation:
| Module | Notes | Link |
|---|---|---|
| HMA OSS | Open-source implementation by frknkrc44, Zygisk-based, actively maintained, lower detection risk | https://github.com/frknkrc44/HMA-OSS |
Mount Modules / Meta Modules
APatch and KernelSU Fork only. Not needed unless you have specific mount requirements.
| Module | Notes | Link |
|---|---|---|
| mm overlays | Official KernelSU example by tiann, OverlayFS-based | https://github.com/tiann/KernelSU/actions/workflows/mm-overlay.yml |
| Meta Magic Mount | Magic Mount implementation by 7a72 | https://github.com/7a72/meta-magic_mount |
| Meta Magic Mount RS | Magic Mount implementation by Tools-cx-app, rewritten in Rust | https://github.com/Tools-cx-app/meta-magic_mount-rs |
| Meta Hybrid Mount | Hybrid OverlayFS + Magic Mount implementation; may have compatibility issues on some kernels | https://github.com/Hybrid-Mount/meta-hybrid_mount |
| Hymo | Implementation by Anatdx using HymoFS / Magic Mount / OverlayFS. HymoFS can replace SuSFS (requires manual kernel patching); may have compatibility issues on some kernels | https://github.com/Anatdx/hymo |
HymoFS: https://github.com/Anatdx/HymoFS
If you have already patched HymoFS into your kernel, there is generally no need to also patch SuSFS — unless you specifically need features like kernel version spoofing.
TreatWheel
ReZygisk only.
KPM Modules
Compatible with KernelSU and APatch. Not supported by Magisk. Recommended for APatch users only.
| Module | Link |
|---|---|
| NoHello | https://t.me/BlankAssistance |
SuSFS
KernelSU Fork only. Requires SuSFS to be injected into the kernel beforehand.
- SuSFS project: https://gitlab.com/simonpunk/susfs4ksu
Companion modules (note: your KernelSU manager may already have built-in SuSFS management):
| Module | Notes | Link |
|---|---|---|
| BRENE | Auto-manages the umount list and provides various automated hiding measures, addressing gaps since SuSFS 2.0 | https://github.com/rrr333nnn333/BRENE |
| SuSFS4ksu Module | Classic management module by sidex15, rich in customization options. Conflicts with BRENE — choose one | https://github.com/sidex15/susfs4ksu-module |
Basic Hiding Setups
We do not recommend using any all-in-one modules or shell scripts unless you are able to review their code yourself.
The following are recommended combinations for everyday use. They are not the only valid choices — treat them as a starting point.
Without Zygisk (Minimal)
Setup 1: TEE module + Tricky Addon Enhanced
- Install only these two modules
- Covers the majority of apps out of the box
- Tricky Addon Enhanced automatically adds apps to the target list — usually no manual action needed
Setup 2: TEE module + Integrity Box
- Integrity Box handles TEE module management and also bundles Play Integrity Fix
- You will need to manually maintain the app list, security patch, and boothash configuration
Setup 3: TEE module + Tricky Addon Enhanced/Tricky Addon Update Target List + Integrity Box
- Most complete TEE module management coverage
- Adds Play Integrity Fix capability on top
- Some TEE management functions overlap
Tricky Addon Update Target List — quick setup:
Open WebUI → tap the menu (top right) → tap the first button in the top row → uncheck non-essential apps → tap Save (bottom right). Also configure boothash and security patch spoofing.
With Zygisk
Setup 1: Any TEE module + Any TEE companion + Any Zygisk + HMA OSS
- The key addition here is HMA OSS for app list concealment
HMA module usage:
- Open the app → go to Template Management
- Create a blacklist template with any name
- Tap Edit invisible list → select the apps you want to hide → go back
- Tap Edit apps using this template → select the target apps that should see the hidden list → go back
- Done
Setup 2: Any TEE module + Any TEE companion + NeoZygisk Fork + HMA OSS
- Dropping zygote32 is a reasonable trade-off given how rare 32-bit apps are today
With LSPosed
Setup 1: Any TEE module + Any TEE companion + Any Zygisk + Any LSPosed + Any HMA
- The most common full-featured combination
Setup 2: Any TEE module + Any TEE companion + NeoZygisk + LSPosed IT / Vector + Any HMA
- NeoZygisk and Vector are both by JingMatrix — better compatibility when paired together
With SuSFS (KernelSU Fork only)
Setup 1: Any TEE module + Any TEE companion + Any Zygisk + HMA OSS + BRENE
- No LSPosed needed, reducing leak surface
- BRENE handles automatic umount management
Setup 2: Any TEE module + Any TEE companion + Any Zygisk + Any LSPosed + Any HMA + SuSFS4ksu Module / BRENE / built-in KernelSU manager support
- The most complete setup available
- The most common advanced combination
The combinations above are recommendations, not exhaustive best solutions. We trust you to find the setup that works best for your situation — there is no need to second-guess yourself endlessly.