How to Hide SU File and Magisk File

In this guide, we will show you the steps to hide the SU and Magisk files. Hiding root from banking and payment apps is no longer a child’s play. You’ll have to go through tons of hoops and loops and even then there’s no guarantee that you’re going to achieve success because the eyes of the Silicon Valley giant are always looming around [did someone say “ unrevoked keybox XML “].

With that said, I managed to find quite a few methods [10 to be precise] using which you can hide root from your banking app or even the Android device as a whole. After implementing those tweaks, I was able to use the banking app without any issues whatsoever. Likewise, I was passing the Strong Integrity Test as well. But just out of curiosity, I tried varying the device’s ecosystem via a root detection app.

So I installed the popular Ruru module and upon launching it, it took me by surprise. It still showed that I had quite a few rooted binaries present on my device, the Su File and the Magisk File to be precise. However, the fact that I could run the banking apps on my device without any issues is the perfect testimony that I have indeed hidden the root the right way. So what exactly is going on? Let’s find out! After this, I will also list the steps to address this issue once and for all. Follow along.

Why are SU and Magisk Files Still Present?

So let’s first address the elephant in the room- why are the SU and Magisk files still being detected by the root detection app? Well, it is because there are a few Magisk files that are infact present deep inside your system partition. For instance, I went through the codes of a popular root detection app Ruru, and found out that it performs a check at the following places:

/sbin/
/system/bin/
system/xbin/
/proc/self/root/bin/
/data/local/xbin/
/data/local/bin/
/system/sd/xbin/
/system/bin/failsafe/
/data/local/
/cache

Upon verifying the same, I found out that my device did have some root-related files at some of the aforementioned listed locations. So the app performed a check at these places, found a rooted binary, and hence flagged the same.