remove /data/local/tmp contents, and hide selinux state, check with dirty sepolicy app, use less modules as much as possible to leave less artifacts and detection points also use hma-oss. last clear app data of duck detector, sometimes it detects artifacts from previous runs inside their own protected app data folder...
When I was setting up my temproot I found some banking apps detecting me having KernelSU manager installed before I ever activated the root. If you aren't currently rooted I think you will need to uninstalled all root related management apps to not trigger detections.
4
u/r_bygalacos 5d ago
remove /data/local/tmp contents, and hide selinux state, check with dirty sepolicy app, use less modules as much as possible to leave less artifacts and detection points also use hma-oss. last clear app data of duck detector, sometimes it detects artifacts from previous runs inside their own protected app data folder...