What Is Shamiko? Hiding Root From Detection, Explained (2026)

TL;DR: Shamiko is a closed-source Zygisk module from the LSPosed team that strengthens Magisk's DenyList to hide root, the Zygisk framework and your installed modules from apps that scan for tampering. It reads the DenyList but needs "Enforce DenyList" switched off. On its own it hides root artifacts — it does not, by itself, pass Play Integrity.

By the PrivacyPortal team. Last updated July 2026.

If you have rooted your own Android phone, you have probably met apps that refuse to open the second they spot Magisk. That is the problem Shamiko is built to solve. So, what is Shamiko? It is a Zygisk module from the LSPosed team whose single job is to hide the traces root leaves behind — the Magisk daemon, the Zygisk framework and any modules you run — from apps that actively look for them. It is the modern, more aggressive successor to the old MagiskHide and a core part of the 2026 root-hiding stack. In this guide we explain how it works, how to install it, and — just as importantly — what it cannot do.

Shamiko explained: what it actually is

Shamiko explained in one line: it is a Zygisk module that hides root. Zygisk is Magisk's framework for loading code into Zygote — the parent process that spawns every Android app — so a Zygisk module can step in as an app launches and strip away the evidence of root before that app's detection code runs.

The module is developed by the LSPosed team (the same group behind the LSPosed framework) and is closed source. It is published only as prebuilt ZIP files on the LSPosed team's GitHub releases page; there is no source to compile yourself, which is worth knowing if you are careful about what you flash.

In practice, Shamiko works to hide:

• The Magisk app and its background daemon
• The Zygisk framework itself
• Any Zygisk modules you have enabled
• Common root file paths, mounts and properties

As of July 2026, the current release is Shamiko 1.2.5, distributed only as prebuilt ZIPs through the LSPosed team's GitHub releases page.

Above: the Magisk app showing the Zygisk toggle and the DenyList configuration screen where Shamiko gets its target list.

How Shamiko works with the DenyList

Here is the detail that trips most people up. Shamiko does not keep its own separate list of apps. Instead it reads Magisk's DenyList — the list you tick in the Magisk app — and uses that as its list of apps to hide from. But it only takes over if you turn one setting off.

The built-in DenyList hides by unmounting Magisk's changes for each listed process. Shamiko replaces that with a more thorough routine that also conceals Zygisk itself, the framework built into the official Magisk project. For Shamiko to run that routine, Magisk must not be enforcing its own list. The Shamiko–DenyList relationship comes down to three steps:

• Configure the DenyList — tick the apps you want to hide from.
• Turn Enforce DenyList OFF.
• Reboot and let Shamiko handle the hiding.

Shamiko reads the Magisk DenyList but requires "Enforce DenyList" to be switched off, so it — not Magisk — takes over hiding.

Blacklist mode vs whitelist mode

By default Shamiko runs in blacklist mode: it hides only from the apps you ticked. There is also a whitelist mode that flips the logic — Shamiko hides from every app except those on the list — which you enable by creating an empty file named whitelist inside /data/adb/shamiko/. Most people should ignore this and stay on the default blacklist mode.

Shamiko vs MagiskHide vs the built-in DenyList

People searching for "shamiko vs magiskhide" are usually asking which one to use. The honest answer: MagiskHide no longer exists, so the real choice today is Shamiko plus the DenyList versus the DenyList alone.

Magisk removed the built-in MagiskHide feature in version 24, leaving the DenyList and modules like Shamiko to handle root hiding.

Above: a simple diagram of where Shamiko sits in the Magisk root-hiding stack, between the DenyList and the apps doing detection.

What Shamiko cannot do: attestation and Play Integrity

This is the biggest misunderstanding, so let us be blunt: Shamiko does not pass Play Integrity on its own. It hides root artifacts, but it does not spoof the attestation that Google's Play Integrity API asks your device to produce.

Play Integrity returns verdicts in tiers — broadly a basic verdict, a device verdict and a strong verdict. Shamiko helps with the software-visibility side, but:

• For a basic or device pass you normally also need a Play Integrity module (the community "Play Integrity Fix"–style modules) that corrects the device fingerprint.
• The strong verdict is backed by hardware key attestation. Hiding cannot fake hardware, so Shamiko cannot provide the conditions a strong pass needs on a bootloader-unlocked phone.

And a warning we will not soften: we cannot promise this defeats any specific bank's or app's checks. Detection changes constantly, and a stack that works today can fail after a single app update. If you want the full picture, see our guide to passing Play Integrity.

How to install and use Shamiko: step by step

This modifies your own device, and it carries real risk. Back up everything first. Flashing modules can boot-loop a phone, and recovering can mean wiping it. Remember too that unlocking a bootloader — a prerequisite for Magisk — erases all data on the device, and that rooting can affect warranty, OTA updates and security.

Prerequisites:

• A phone you own, with an unlocked bootloader and a working Magisk install. New to this? Start with how to install Magisk.
• The official Shamiko ZIP (see the "Modules, apps & files to try" section below).
• A recent backup and enough charge to survive a couple of reboots.

1. Open the Magisk app, go to Settings and enable Zygisk. Reboot.
2. Back in Magisk, tap the DenyList/shield icon and open Configure DenyList. Tick each app you want to hide from. Expand entries like Google Play services and tick their sub-processes too, not just the top-level app.
3. Return to Settings and make sure Enforce DenyList is OFF. Leave the list itself configured — Shamiko needs the list, just not the enforcement.
4. Download the Shamiko ZIP, then in Magisk go to Modules → Install from storage and select it.
5. Reboot.
6. Optional: for whitelist mode, use a root file manager to create an empty file named whitelist in /data/adb/shamiko/, then reboot. Most users skip this.
7. Verify it worked. Open Magisk → Modules; Shamiko's description line reports its current mode and whether it detected the DenyList correctly. For a real-world check, add a root-detector or Play Integrity checker app to your DenyList, reboot, then run it — a correctly configured Shamiko should hide the Magisk and root indicators.

Above: the Magisk settings screen with Zygisk enabled and Enforce DenyList switched off — the exact combination Shamiko needs.

Common Shamiko pitfalls (and how to avoid them)

• Leaving Enforce DenyList ON. The number one mistake. With it on, Magisk keeps control and Shamiko never takes over.
• Not expanding Google Play services. Tick the sub-processes, not just the parent app, or integrity checks that run inside GMS will still see through.
• Expecting a strong integrity pass. Hardware attestation cannot be faked; no module changes that.
• Relying on Shamiko alone for Play Integrity. You still need a separate fingerprint/Play Integrity module.
• Forgetting to reboot after enabling Zygisk, editing the DenyList or flashing the module.
• OTA updates. A system update can disable Magisk and its modules; you may need to re-patch, and modules can break after major Android upgrades until they are updated.
• Flashing random forks. Only use the official LSPosed releases — closed-source binaries from unknown sources are a real risk.

Should you use Shamiko? A quick decision framework

• Use it if you root your own device, need certain apps to stop detecting root, and you are willing to also run a Play Integrity module and maintain the setup.
• You may not need it if a single simple app only checks for the Magisk app — the built-in DenyList alone might be enough.
• It will not help if you need a strong, hardware-backed integrity verdict on a bootloader-unlocked phone.
• Consider a different route if your real goal is privacy rather than winning a detection arms race — a de-Googled phone from PrivacyPortal sidesteps much of the Google-services cat-and-mouse from the start.

Frequently asked questions

Is Shamiko safe to use?

Functionally it is widely used and stable, but it is closed source, so you are trusting a prebuilt binary. Reduce the risk by downloading only from the official LSPosed releases, and always back up before flashing. Rooting and hiding root can still affect security, warranty and updates.

Does Shamiko work without Magisk?

No. Shamiko is a Zygisk module, and Zygisk is part of Magisk. You need Magisk installed with Zygisk enabled before Shamiko can do anything.

Will Shamiko hide root from my banking app?

It may hide the root artifacts a banking app looks for, but we cannot promise it defeats any specific app's checks. Bank and payment apps update their detection regularly, and results vary by device, app and the rest of your setup.

Do I still need a Play Integrity module if I use Shamiko?

Yes. Shamiko hides root but does not spoof attestation, so passing Play Integrity still needs a separate Play Integrity module. See Google's Play Integrity API documentation for how those verdicts are produced.

Can Shamiko pass STRONG integrity?

No. The strong verdict relies on hardware-backed key attestation that a bootloader-unlocked, rooted device cannot satisfy. Shamiko cannot provide those hardware conditions.

Where do I download Shamiko?

Only from the LSPosed team's official releases — never a random mirror. The verified link is in the "Modules, apps & files to try" section below.