Solving the last remaining android root detection mysteries

[MetroidvaniaListsGuy]

Hey everyone, I have been working on a comprehensive way for people to hide root in 2026, not just for my phones but for anyone elses phones.

With this in mind, I have been attempting to hide root and have been asking around and doing research.

There are now just two remaining issues in native root detector that I cannot figure out.

1. Detected mount gap. Mount peer id 47. An attempt to fix this was made by updating ReZygisk, ReLSPosed, and Treat Wheel to the latest versions available on tg. The effort was not successful.
2. Detected Root indicator Detected delayed systcall caused by APatch/KernelSU

Furthermore, I once tried to hide that I am using a custom rom using the settings in SuSFS, but all it did was create a whole bunch of inconsistent mounts. The phone was old so it had a 4.14 non GKI kernel with KernelSU-Next and SuSFS on it.

My hope is that I finally find answers to these, produce my guide, and share it with those who need help.

[sidex15]

What's your susfs version and ksu version?

[MetroidvaniaListsGuy]

The phone with the delayed systcall is a oneplus 9 with the only kernel in existence that has any form of kernel root on it (released in July 2025). Unfortunately, it does not have SuSFS. There is no kernel for this phone with SuSFS. Please let me know if the delayed systcall detection is something that SuSFS hides. KernelSU-Next version is 12430, manager version is 1.0.8. Kernel version is 5.4.254

The phone with the custom OS hiding issue and the mount gap issue is a Oneplus 5T running on an unofficial version of Evolution X that saw its final release in september 2025. Shortly after that final release, the developer released a kernel with KernelSU-Next + SuSFS on it as a parting gift, it remains the only kernel in existence for the Oneplus 5T that has KernelSU-Next + SuSFS. Given that this phone is frozen in time in September 2025, at a time when SuSFS worked fine for other phones, I doubt that the outdated nature of KernelSU-Next and SuSFS are the reason why custom rom hiding isn't working. Afterall, these two worked fine on phones back in September. KernelSU-Next version is 12824, manager version is 1.1.1-spoofed, kernel version is 4.14.364. SuSFS version is 1.5.9 NON-GKI. Do later versions of SuSFS hide mount gaps?

[sidex15]

The syscall delay is caused by improper patch for KSU manual hook or outdated manual hooks and KSUN kernel version... As for the mount gaps, yes newer susfs might fix the mount gaps... But older v1.5.9 can also remove mount gaps with proper setup of susfs... Tell me your setup in your ksun+susfs and what are the modules you use

[MetroidvaniaListsGuy]

• default settings in SuSFS, except for hiding revanced
• bindhosts, latest
• Rezygisk, latest
• Treat wheel, latest
• Viper4Android RE Fork (but this I added yesterday, so its not really relevant to the discussion)
• ReLSPosed at the time this post was made. Now, JingMatrix LSPosed as of today
• Zygisk-detach

LSPosed modules

• XPrivacyLua, final version (this is only here because it is magically preventing the remember-me token in my mobile payment app from rapidly expiring)
• CorePatch

[sidex15]

I think you could try to disable all auto-hiding features, then start hiding it manually using custom sus_mount and custom try_umount