What is Magisk?

[bitheerani93]

Android apps are a common target for threat actors to modify the behavior of applications, and tools like Magisk have gained popularity due to their extendability and ability to remain considerably hidden. A module called Shamiko has emerged as a popular choice for further hiding Magisk, highlighting the importance of security solutions that can detect these sophisticated hiding techniques.

In this post, we’ll dive into what Magisk is, explore Magisk modules in general—what they are, an overview of how they’re built, and france mobile database integration into the Android system—and later discuss Shamiko. We will also address the claims around circumventing security measures, how application hardening solutions provide comprehensive protection against evolving threats, and the broader impact of such tools on Android app security.

Overview of Magisk
Magisk is a popular tool that allows Android users to gain root access without altering the core system files. By modifying the boot image rather than the system image, Magisk remains “systemless,” meaning it hides modifications from typical system integrity checks. This capability allows users to root their devices while still running apps that typically block rooted devices, making Magisk particularly powerful for both customization and maintaining app compatibility. Magisk modifies key partitions like boot.img and replaces the init executable with magiskinit, which loads its custom configurations during the boot process without directly tampering with Android’s core system files¹.

Magisk Installation
When Magisk is installed, it ensures persistence across reboots by replacing the init executable with its own magiskinit. The init executable is a native Linux binary that is the first executable to run during the boot process. By intercepting this stage, Magisk can modify system behavior from the very start.

Additionally, Magisk modifies the init.rc file, which is a text-based configuration file Android uses to define commands to be executed at different stages of the boot process. The syntax of init.rc allows it to issue commands during boot, and Magisk patches it to introduce custom boot actions, ensuring its own operations integrate seamlessly.

What is Zygisk?
Zygisk, part of the Magisk framework, allows developers to inject custom code into the Zygote process after it forks new app or system_server processes. This injection happens after the specialization stage, ensuring any modifications occur inside the newly forked processes rather than within the Zygote daemon itself.