Live data from Hacker News

Shizuku: App that lets you use system APIs with higher privileges without root

shizuku.rikka.app

21–29 of 29 posts

Re: Shizuku: App that lets you use system APIs with higher privileges without root

#21
post #16
post #2

Shizuku is a boon to get around Android's limited app auto-update capabilities, which helps when using non-Google Play apps. See [1] for a list of apps leveraging Shizuku. I use: - Droid-ify [2] as a F-Droid alternative, to have auto-updating apps - Mihon [3] as a Manga reader, with auto-updating extensions - Canta [4] to remove bloat [1]: https://github.com/timschneeb/awesome-shizuku [2]: https://f-droid.org/package…

Add to that Island[1] which unlocks work profiles on phoned where the manufacturer didn't. (And is an easy way to hide apps from other apps without rooting. This is required for some baking apps throwing a tantrum if you use your phone). Also Ambient Music Mod[2] which gets you constant low power background music recognition a la Pixel on non pixels. [1] https://gitlab.com/secure-system/Insular [2] https://github.com…

> This is required for some baking apps throwing a tantrum if you use your phone.

Is this a common behavior? Do you know why?

Re: Shizuku: App that lets you use system APIs with higher privileges without root

#22
post #21
post #16

Earlier quoted context omitted.

Add to that Island[1] which unlocks work profiles on phoned where the manufacturer didn't. (And is an easy way to hide apps from other apps without rooting. This is required for some baking apps throwing a tantrum if you use your phone). Also Ambient Music Mod[2] which gets you constant low power background music recognition a la Pixel on non pixels. [1] https://gitlab.com/secure-system/Insular [2] https://github.com…

> This is required for some baking apps throwing a tantrum if you use your phone. Is this a common behavior? Do you know why?

My suspicion is that these banking apps are running root detection code that look for the presence of certain other apps that signal "rootedness".

The stated reason is always "we don't want malware being able to steal your account information".

The non-stated reason is often "it makes our threat modeling easier if we can rely on the OS' defenses existing and working so we assumed. As a consequence of that assumption we are not entirely sure that what we are doing is safe from ordinary adversarial behavior on a device without these guardrails. So we don't want to run in such an environment and find out that our concerns were justified".

Re: Shizuku: App that lets you use system APIs with higher privileges without root

#23
post #21
post #16

Earlier quoted context omitted.

Add to that Island[1] which unlocks work profiles on phoned where the manufacturer didn't. (And is an easy way to hide apps from other apps without rooting. This is required for some baking apps throwing a tantrum if you use your phone). Also Ambient Music Mod[2] which gets you constant low power background music recognition a la Pixel on non pixels. [1] https://gitlab.com/secure-system/Insular [2] https://github.com…

> This is required for some baking apps throwing a tantrum if you use your phone. Is this a common behavior? Do you know why?

It might be. The library my banking app uses is called Promon Shield. It was broken in 2018 as part of this paper: https://obfuscator.re/nomorp-paper-dimva2018.pdf

> Promon Shield protects most of the banking apps on the German market. As of April 23, 2018, four out of the top ten financial apps in Germany make use of Promon’s solution.

I'm switching banks now to find one that lets me use my non rooted phone in peace.

As for why? I'm not sure. My guess is to prevent clueless people running their banking app with malware installed. preventing roots might just be a side-effect.

Re: Shizuku: App that lets you use system APIs with higher privileges without root

#24
post #20

I have to use it to make my non-US phone work in the US. Sony Xperia 1 VI, a new top of the line flagship phone from Sony, has all the necessary hardware to be compatible with US carriers, but simply lacks config files for the US because it is not sold in the US. Shizuku and another app combine to get a few of the settings set which brings it most of the way there. (Brand new 2024 flagship with headphone jack and SD…

I thought the config files were downloaded over the air. I don’t understand how you could have a flagship phone not work everywhere. The people with the most money generally travel the most.

That's a nice theory but no.

There are several different kinds of configs.

The phone is global and not carrier locked, and you can make calls and sms and data.

It "works", just poorly. It works at a basic level, just not full coverage, not full speed, and not all features available.

Different countries use different radio bands, and so a phone that is nominally sold in a given country only enables those bands that are legal in that country.

So this phone is nominally for HK, which is the model with greatest overlap of supported bands with at least some US carriers. The hardware can do everything but the config that prevents it is sort of like a virtual hardware difference. In the past there might be different radio hardware, and now there is one hardware that is made to act like different hardware through firmware.

Without all available bands, you get less coverage and more contention with other users for available bandwidth. And your choice of carrier makes a big difference. Some of the mvnos only provide 2 or 3 bands total, while others might have a dozen.

Shizuku can not fix that particular problem. For that you have to be able to root the phone and edit some files in the rom. The term to search is "mbn hacking".

This has not been done for this phone yet, but apparently all the pieces are there to make it possible because the bootloader is unlockable and there is a way to unpack and repack a firmware.

I have unlocked my bootloader and tried to flash a modified bootloader to get magisk working, but it refused to flash the partition even though it's supposedly unlocked. So I don't have root and can't edit anything in the rom.

For another example, although basic 4g gsm works, there is no volte, vowifi, or vonr, simply because the carrier doesn't explicitly recognize or support the make & model.

But you can use Shizuku and Pixel IMS to enable all of those and they work fine. The settings in this case are tied to the sim. Once you set the settings they survive reboots and you can even uninstall the apps, but if you change your sim you lose the settings.

Re: Shizuku: App that lets you use system APIs with higher privileges without root

#25
post #21
post #16

Earlier quoted context omitted.

Add to that Island[1] which unlocks work profiles on phoned where the manufacturer didn't. (And is an easy way to hide apps from other apps without rooting. This is required for some baking apps throwing a tantrum if you use your phone). Also Ambient Music Mod[2] which gets you constant low power background music recognition a la Pixel on non pixels. [1] https://gitlab.com/secure-system/Insular [2] https://github.com…

> This is required for some baking apps throwing a tantrum if you use your phone. Is this a common behavior? Do you know why?

[deleted]

Re: Shizuku: App that lets you use system APIs with higher privileges without root

#28
post #22
post #21

Earlier quoted context omitted.

> This is required for some baking apps throwing a tantrum if you use your phone. Is this a common behavior? Do you know why?

My suspicion is that these banking apps are running root detection code that look for the presence of certain other apps that signal "rootedness". The stated reason is always "we don't want malware being able to steal your account information". The non-stated reason is often "it makes our threat modeling easier if we can rely on the OS' defenses existing and working so we assumed. As a consequence of that assumption…

Thank you; that makes sense. The original quote referred to "baking apps," and it honestly didn't occur to me that it was a typo!

Re: Shizuku: App that lets you use system APIs with higher privileges without root

#29
In a very unusual requirement, unless you compile it yourself you're forced to use Chinese-provided binaries.

The app has almost root access; it's too juicy an opportunity, I think it's extremely likely to contain some bad stuff.

It's a disgrace that it's become so popular, someone should make an API-compatible FOSS alternative.

Post reply on HN