From 8e59ce4252949a469fb35ced79973c83555b5387 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Thu, 18 Dec 2025 16:07:40 +0700 Subject: [PATCH 01/57] feat: bump v3.8-mb Signed-off-by: Cuynu --- module_new/CHANGELOG.md | 5 ++++- module_new/remoteupdate.json | 4 ++-- module_new/zdefend-fix/module.prop | 4 ++-- 3 files changed, 8 insertions(+), 5 deletions(-) diff --git a/module_new/CHANGELOG.md b/module_new/CHANGELOG.md index 25573e0..230bfe4 100644 --- a/module_new/CHANGELOG.md +++ b/module_new/CHANGELOG.md @@ -2,7 +2,10 @@ Bypass new stupid MB Bank zimperium root/hook detection (does not bypass VTAP root detection) ## Changelogs : - +- v3.8-mb +``` +fix: customize.sh: execute denylist fix before vtap check +``` - v3.7-mb ``` feat: bump v3.7-mb diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index 7cfd83c..192970a 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { - "version": "v3.7-mb", - "versionCode": "37", + "version": "v3.8-mb", + "versionCode": "38", "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v3.7-mb/mbzdefend_fix_7e94380.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } diff --git a/module_new/zdefend-fix/module.prop b/module_new/zdefend-fix/module.prop index 1409cea..886e50f 100644 --- a/module_new/zdefend-fix/module.prop +++ b/module_new/zdefend-fix/module.prop @@ -1,7 +1,7 @@ id=zdefend-fix name=MB ZDefend Bypass -version=v3.7-mb -versionCode=37 +version=v3.8-mb +versionCode=38 author=cuynu, xfirstnamelastname description=Bypass "Rooted device or JAILBROKEN" screen for MBCP App by trick the app detection libraries. \nNOTE : This does not bypass VTAP scrren, you have to fix it yourself is you are using Magisk. updateJson=https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/remoteupdate.json From b61bbd4dc471b301f96231d3b0df4ee544380c42 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Thu, 18 Dec 2025 16:21:27 +0700 Subject: [PATCH 02/57] fix: remoteupdate.json: invaild link Signed-off-by: Cuynu --- module_new/remoteupdate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index 192970a..a2db0f7 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { "version": "v3.8-mb", "versionCode": "38", - "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v3.7-mb/mbzdefend_fix_7e94380.zip", + "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v3.8-mb/mbzdefend_fix_8e59ce4.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } From 3e18ede229d0ba445ed8651cb3a25fb013203628 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 19 Dec 2025 16:35:57 +0700 Subject: [PATCH 03/57] feat: action.sh: also check vtap provision status for action script Signed-off-by: Cuynu --- module_new/zdefend-fix/action.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/module_new/zdefend-fix/action.sh b/module_new/zdefend-fix/action.sh index a0254f4..f128468 100644 --- a/module_new/zdefend-fix/action.sh +++ b/module_new/zdefend-fix/action.sh @@ -12,6 +12,12 @@ notmbcp() { # Check for original MB Bank app for library in $(find /data/app -name libvvb2060.so | grep com.mbmobile) ; do notmbcp ; done +# Check VTAP status to ensure that it must be provisioned +echo "Checking VTAP status..." +echo "VTAP status : " && cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || sh 'vtapnotinit.sh' +echo "Checking VTAP status again..." +cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || sh 'vtapstillfail.sh' || exit 169 + # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users echo "Deleting /data/magisk if it exists..." [[ -d /data/magisk ]] && rm -r /data/magisk From 8ac67468533eb2ab6731481c81af981e2faf5061 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 19 Dec 2025 16:39:40 +0700 Subject: [PATCH 04/57] feat: bump v3.9-mb Signed-off-by: Cuynu --- module_new/CHANGELOG.md | 5 +++++ module_new/remoteupdate.json | 4 ++-- module_new/zdefend-fix/module.prop | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/module_new/CHANGELOG.md b/module_new/CHANGELOG.md index 230bfe4..b220030 100644 --- a/module_new/CHANGELOG.md +++ b/module_new/CHANGELOG.md @@ -2,6 +2,11 @@ Bypass new stupid MB Bank zimperium root/hook detection (does not bypass VTAP root detection) ## Changelogs : +- v3.9-mb +``` +feat: action.sh: also check vtap provision status for action script +``` + - v3.8-mb ``` fix: customize.sh: execute denylist fix before vtap check diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index a2db0f7..b536350 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { - "version": "v3.8-mb", - "versionCode": "38", + "version": "v3.9-mb", + "versionCode": "39", "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v3.8-mb/mbzdefend_fix_8e59ce4.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } diff --git a/module_new/zdefend-fix/module.prop b/module_new/zdefend-fix/module.prop index 886e50f..e608969 100644 --- a/module_new/zdefend-fix/module.prop +++ b/module_new/zdefend-fix/module.prop @@ -1,7 +1,7 @@ id=zdefend-fix name=MB ZDefend Bypass -version=v3.8-mb -versionCode=38 +version=v3.9-mb +versionCode=39 author=cuynu, xfirstnamelastname description=Bypass "Rooted device or JAILBROKEN" screen for MBCP App by trick the app detection libraries. \nNOTE : This does not bypass VTAP scrren, you have to fix it yourself is you are using Magisk. updateJson=https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/remoteupdate.json From 47c17e4ed6191d34df7196bf8fcd048511e8bd6a Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 19 Dec 2025 16:44:48 +0700 Subject: [PATCH 05/57] fix: remoteupdate.json: invaild link Signed-off-by: Cuynu --- module_new/remoteupdate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index b536350..34c6d59 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { "version": "v3.9-mb", "versionCode": "39", - "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v3.8-mb/mbzdefend_fix_8e59ce4.zip", + "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v3.9-mb/mbzdefend_fix_8ac6746.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } From 3edb8c2050e543dc0676d60d03e7a63ec319bdfa Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 19 Dec 2025 16:56:13 +0700 Subject: [PATCH 06/57] readme: remove current module version i forgotten to change this version when bumping new module version many times, its need to be removed for good so i don't need to worry about it anymore Signed-off-by: Cuynu --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 70dde06..9e98f0f 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # MB ZDefend Bypass Module for MB/MBCP -- Current module version : `v3.6-mb` | Download from [releases tab](https://git.disroot.org/cuynu/mbzdefend-fix/releases) +- Download from [releases tab](https://git.disroot.org/cuynu/mbzdefend-fix/releases) - Author : [Cuynu](https://git.disroot.org/cuynu) and [backslashxx](https://github.com/backslashxx) for sed script From 0e76d406f06d00e6456cf608e8fb6296ed0bb4b7 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Sat, 10 Jan 2026 21:26:47 +0700 Subject: [PATCH 07/57] feat: customize.sh: depends on syslang to open right mbcpinstall page also only display deleting /data/magisk if it's actually found Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 6e745e6..65ec22c 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -3,10 +3,13 @@ SYSLANGVI="$(getprop persist.sys.locale | grep vi-VN)" ANDROIDSDK="$(getprop ro.build.version.sdk)" +INSTALLVI="https://git.disroot.org/mbcp/info_vi/wiki/mbcpinstall" +INSTALLEN="https://git.disroot.org/mbcp/info_en/wiki/mbcpinstall" + notmbcp() { echo "MB Bank [com.mbmobile] is installed, but it seems like that the app is NOT MBCP" echo "Please install MBCP v6.4.60+ in order to use this module !" - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info/wiki/mbcpinstall + [[ $SYSLANGVI ]] && am start -a android.intent.action.VIEW -d $INSTALLVI || am start -a android.intent.action.VIEW -d $INSTALLEN exit 1 } @@ -15,7 +18,7 @@ if [ -d /data/data/com.mbmobile ]; then echo "" else echo "MB/MBCP not found! Please install it!" - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info/wiki/mbcpinstall + [[ $SYSLANGVI ]] && am start -a android.intent.action.VIEW -d $INSTALLVI || am start -a android.intent.action.VIEW -d $INSTALLEN exit 1 fi @@ -64,8 +67,7 @@ chmod +x 'vtapstillfail.sh' chmod +x 'vtapnotinit.sh' # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users -echo Deleting /data/magisk if it exists... -[ -d /data/magisk ] && rm -r /data/magisk +[ -d /data/magisk ] && echo "Magisk folder found! deleting..." && rm -r /data/magisk echo --------------------------- if [ -d /data/adb/magisk ]; then From 3cc2cd590ce8301b7a0e73293ef139a4ed815b1a Mon Sep 17 00:00:00 2001 From: Cuynu Date: Sat, 10 Jan 2026 21:36:20 +0700 Subject: [PATCH 08/57] fix: customize.sh: unzip shortcut after termux bootstrap is found prevent copy error for users who don't use termux more effective Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 65ec22c..d4b2cac 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -27,6 +27,7 @@ if [ -d /data/data/com.termux ]; then if [[ -d /data/data/com.termux/files/home ]]; then echo "Termux bootstrap found!" appops set com.termux SYSTEM_ALERT_WINDOW allow + unzip -o "$ZIPFILE" 'script/MB_Bank.sh' -d '/data/user/0/com.termux/files/home/.shortcuts/' else echo "Termux bootstrap not found! Launching Termux..." am start -n com.termux/com.termux.app.TermuxActivity @@ -90,8 +91,6 @@ am force-stop com.mbmobile # Support for Biz MB Bank v2.0 (Flutter version) for library in $(find /data/app -name libholdingshadow.so | grep com.mbbank.biz.prod) ; do rm $library ; done sleep 2 - -unzip -o "$ZIPFILE" 'script/MB_Bank.sh' -d '/data/user/0/com.termux/files/home/.shortcuts/' rm -rf /data/data/com.mbmobile/files/0* rm -rf /data/data/com.mbmobile/files/1* rm -rf /data/data/com.mbmobile/files/2* From bafb98b6a500dc5bb82aa0b88fb4d8148102b333 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Tue, 13 Jan 2026 23:56:12 +0700 Subject: [PATCH 09/57] feat: redirect to fake IP instead also reference code Signed-off-by: Cuynu --- module_new/zdefend-fix/action.sh | 18 +++++++++--------- module_new/zdefend-fix/customize.sh | 11 +++++++---- module_new/zdefend-fix/script/MB_Bank.sh | 11 +++++++---- 3 files changed, 23 insertions(+), 17 deletions(-) diff --git a/module_new/zdefend-fix/action.sh b/module_new/zdefend-fix/action.sh index f128468..bcb3499 100644 --- a/module_new/zdefend-fix/action.sh +++ b/module_new/zdefend-fix/action.sh @@ -21,12 +21,9 @@ cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is prov # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users echo "Deleting /data/magisk if it exists..." [[ -d /data/magisk ]] && rm -r /data/magisk +find /data -name 'magisk_backup*' -delete echo Forcing stop MB Bank... am force-stop com.mbmobile - -echo Starting Flutter activity... -echo "ATTENTION : Network traffic will be redirected to [medium.com] for 20 seconds !!!" -echo "Press [Try again] after got 1005/1007 error on MB, so it's can bypass device not secure dialog !" rm -rf /data/data/com.mbmobile/files/0* rm -rf /data/data/com.mbmobile/files/1* rm -rf /data/data/com.mbmobile/files/2* @@ -40,14 +37,17 @@ echo "Press [Try again] after got 1005/1007 error on MB, so it's can bypass devi rm -rf /data/data/com.mbmobile/files/KNOV3PN* rm -rf /data/data/com.mbmobile/files/zxpolicyme* rm -rf /data/data/com.mbmobile/files/policyme* - -iptables -t nat -A OUTPUT -p tcp -d 0/0 -j DNAT --to-destination 162.159.153.4:443 - +echo "ATTENTION : Network traffic will be redirected to fake IP for 20 seconds !!!" +echo "Press [Try again] after got 1005/1007/VPN error on MB, so it's can bypass device not secure dialog !" +# Reference : https://superuser.com/questions/1248670/redirect-ip-to-another-ip-using-iptables +iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 122.122.0.122 am start -n com.mbmobile/io.flutter.plugins.MainActivity -# VPN connection requires 20 seconds, while normal one only requires 10 seconds sleep 20 echo "Restoring network traffic" -iptables -t nat -F OUTPUT +# Reference : https://gist.github.com/jstrosch/3190568 (Line 7) +iptables -t nat -F + + if [ $SYSLANGVI ]; then su -lp 2000 -c "cmd notification post -S bigtext -t 'MBZDefend-Fix' tag 'LƯU Ý : Vui lòng nhấn [Thử lại] tại màn hình báo lỗi 1005/1007/VPN để vào App MBCP.'" >/dev/null 2>&1 else diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index d4b2cac..03a74d7 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -69,6 +69,7 @@ chmod +x 'vtapnotinit.sh' # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users [ -d /data/magisk ] && echo "Magisk folder found! deleting..." && rm -r /data/magisk +find /data -name 'magisk_backup*' -delete echo --------------------------- if [ -d /data/adb/magisk ]; then @@ -105,13 +106,15 @@ sleep 2 rm -rf /data/data/com.mbmobile/files/zxpolicyme* rm -rf /data/data/com.mbmobile/files/policyme* echo Starting Flutter activity... -echo "ATTENTION : Network traffic will be redirected to [medium.com] for 20 seconds !!!" -echo "Press [Try again] after got 1005/1007 error on MB, so it's can bypass device not secure dialog !" -iptables -t nat -A OUTPUT -p tcp -d 0/0 -j DNAT --to-destination 162.159.153.4:443 +echo "ATTENTION : Network traffic will be redirected to fake IP for 20 seconds !!!" +echo "Press [Try again] after got 1005/1007/VPN error on MB, so it's can bypass device not secure dialog !" +# Reference : https://superuser.com/questions/1248670/redirect-ip-to-another-ip-using-iptables +iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 122.122.0.122 am start -n com.mbmobile/io.flutter.plugins.MainActivity sleep 20 echo "Restoring network traffic" -iptables -t nat -F OUTPUT +# Reference : https://gist.github.com/jstrosch/3190568 (Line 7) +iptables -t nat -F if [ $SYSLANGVI ]; then su -lp 2000 -c "cmd notification post -S bigtext -t 'MBZDefend-Fix' tag 'LƯU Ý : Vui lòng nhấn [Thử lại] tại màn hình báo lỗi 1005/1007/VPN để vào App MBCP. Sau khi thao tác xong, nên khởi động lại thiết bị ngay.'" >/dev/null 2>&1 diff --git a/module_new/zdefend-fix/script/MB_Bank.sh b/module_new/zdefend-fix/script/MB_Bank.sh index e230a96..cee4f2d 100755 --- a/module_new/zdefend-fix/script/MB_Bank.sh +++ b/module_new/zdefend-fix/script/MB_Bank.sh @@ -3,7 +3,7 @@ SYSLANGVI="$(getprop persist.sys.locale | grep vi-VN)" su -c am force-stop com.mbmobile echo "Starting flutter activity..." -echo "Network traffic will be redirected to [medium.com] for 20 seconds !!!" +echo "Network traffic will be redirected to fake IP for 20 seconds !!!" echo "Press [Try again] after got 1005/1007 error on MB, so it's can bypass device not secure dialog !" su -c rm -rf /data/data/com.mbmobile/files/0* su -c rm -rf /data/data/com.mbmobile/files/1* @@ -19,11 +19,14 @@ echo "Press [Try again] after got 1005/1007 error on MB, so it's can bypass devi su -c rm -rf /data/data/com.mbmobile/files/zxpolicyme* su -c rm -rf /data/data/com.mbmobile/files/policyme* -su -c iptables -t nat -A OUTPUT -p tcp -d 0/0 -j DNAT --to-destination 162.159.153.4:443 +# Reference : https://superuser.com/questions/1248670/redirect-ip-to-another-ip-using-iptables +iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 122.122.0.122 am start -n com.mbmobile/io.flutter.plugins.MainActivity -# VPN connection requires 20 seconds, while normal one only requires 10 seconds sleep 20 -echo "Restoring network traffic..." +echo "Restoring network traffic" +# Reference : https://gist.github.com/jstrosch/3190568 (Line 7) +iptables -t nat -F + su -c iptables -t nat -F OUTPUT if [ $SYSLANGVI ]; then su -lp 2000 -c "cmd notification post -S bigtext -t 'MBZDefend-Fix' tag 'LƯU Ý : Vui lòng nhấn [Thử lại] tại màn hình báo lỗi 1005/1007/VPN để vào App MBCP.'" >/dev/null 2>&1 From 3340176c104958f5921a6cdaa11c3f1a5e8d9741 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Wed, 14 Jan 2026 00:17:59 +0700 Subject: [PATCH 10/57] fix: wrong ip 122.122.0.122 worked from rooted shell, but not with module installation:( i'm going to use medium.com again Signed-off-by: Cuynu --- module_new/zdefend-fix/action.sh | 4 ++-- module_new/zdefend-fix/customize.sh | 7 +++++-- module_new/zdefend-fix/script/MB_Bank.sh | 4 ++-- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/module_new/zdefend-fix/action.sh b/module_new/zdefend-fix/action.sh index bcb3499..c218398 100644 --- a/module_new/zdefend-fix/action.sh +++ b/module_new/zdefend-fix/action.sh @@ -37,10 +37,10 @@ am force-stop com.mbmobile rm -rf /data/data/com.mbmobile/files/KNOV3PN* rm -rf /data/data/com.mbmobile/files/zxpolicyme* rm -rf /data/data/com.mbmobile/files/policyme* -echo "ATTENTION : Network traffic will be redirected to fake IP for 20 seconds !!!" +echo "ATTENTION : Network traffic will be redirected to [medium.com] for 20 seconds !!!" echo "Press [Try again] after got 1005/1007/VPN error on MB, so it's can bypass device not secure dialog !" # Reference : https://superuser.com/questions/1248670/redirect-ip-to-another-ip-using-iptables -iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 122.122.0.122 +iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 162.159.152.4 am start -n com.mbmobile/io.flutter.plugins.MainActivity sleep 20 echo "Restoring network traffic" diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 03a74d7..246300e 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -6,6 +6,9 @@ ANDROIDSDK="$(getprop ro.build.version.sdk)" INSTALLVI="https://git.disroot.org/mbcp/info_vi/wiki/mbcpinstall" INSTALLEN="https://git.disroot.org/mbcp/info_en/wiki/mbcpinstall" +# Clear old iptables +iptables -t nat -F + notmbcp() { echo "MB Bank [com.mbmobile] is installed, but it seems like that the app is NOT MBCP" echo "Please install MBCP v6.4.60+ in order to use this module !" @@ -106,10 +109,10 @@ sleep 2 rm -rf /data/data/com.mbmobile/files/zxpolicyme* rm -rf /data/data/com.mbmobile/files/policyme* echo Starting Flutter activity... -echo "ATTENTION : Network traffic will be redirected to fake IP for 20 seconds !!!" +echo "ATTENTION : Network traffic will be redirected to [medium.com] for 20 seconds !!!" echo "Press [Try again] after got 1005/1007/VPN error on MB, so it's can bypass device not secure dialog !" # Reference : https://superuser.com/questions/1248670/redirect-ip-to-another-ip-using-iptables -iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 122.122.0.122 +iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 162.159.152.4 am start -n com.mbmobile/io.flutter.plugins.MainActivity sleep 20 echo "Restoring network traffic" diff --git a/module_new/zdefend-fix/script/MB_Bank.sh b/module_new/zdefend-fix/script/MB_Bank.sh index cee4f2d..9c08e2b 100755 --- a/module_new/zdefend-fix/script/MB_Bank.sh +++ b/module_new/zdefend-fix/script/MB_Bank.sh @@ -3,7 +3,7 @@ SYSLANGVI="$(getprop persist.sys.locale | grep vi-VN)" su -c am force-stop com.mbmobile echo "Starting flutter activity..." -echo "Network traffic will be redirected to fake IP for 20 seconds !!!" +echo "Network traffic will be redirected to [medium.com] for 20 seconds !!!" echo "Press [Try again] after got 1005/1007 error on MB, so it's can bypass device not secure dialog !" su -c rm -rf /data/data/com.mbmobile/files/0* su -c rm -rf /data/data/com.mbmobile/files/1* @@ -20,7 +20,7 @@ echo "Press [Try again] after got 1005/1007 error on MB, so it's can bypass devi su -c rm -rf /data/data/com.mbmobile/files/policyme* # Reference : https://superuser.com/questions/1248670/redirect-ip-to-another-ip-using-iptables -iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 122.122.0.122 +iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 162.159.152.4 am start -n com.mbmobile/io.flutter.plugins.MainActivity sleep 20 echo "Restoring network traffic" From 9959338b388830e48357c55e4504ff0b1cd6bb72 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 16 Jan 2026 00:51:50 +0700 Subject: [PATCH 11/57] feat: customize.sh: enforce foss kitsune mask there's new proprietary magisk based on the original kitsune mask, named as kitsune mask revived this one is shit because it doesn't have source code and it's UI looks like vibe coded with liquid glass style im not going to allow use of this root impl, this commit should work and prevent proprietary kitsune mask users from install this module, as long as the app is not hidden with randomized packageName. Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 246300e..91e12f9 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -9,6 +9,13 @@ INSTALLEN="https://git.disroot.org/mbcp/info_en/wiki/mbcpinstall" # Clear old iptables iptables -t nat -F +nonfosskitsune() { + echo "Kitsune Mask v30.4+ is proprietary and is not compatible with this module!" + echo "Please install older FOSS Kitsune Mask!" + am start -a android.intent.action.VIEW -d https://github.com/1q23lyc45/KitsuneMagisk/releases + exit 1 +} + notmbcp() { echo "MB Bank [com.mbmobile] is installed, but it seems like that the app is NOT MBCP" echo "Please install MBCP v6.4.60+ in order to use this module !" @@ -16,6 +23,8 @@ notmbcp() { exit 1 } +[[ -d /data/data/io.github.x0eg0.magisk ]] && nonfosskitsune + # Check if MB is installed or nope if [ -d /data/data/com.mbmobile ]; then echo "" From c6539569af1396b5ffebcf8e0fc52ab03e187560 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 16 Jan 2026 01:46:22 +0700 Subject: [PATCH 12/57] feat: customize.sh: hide `com.tsng.hidemyapplist` package during module installation vtap is flagging this application as runtime tampering since this app is now outdated, there another fork for it like HMA-OSS or HMAL-OSS which is way lots better than the original one Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 91e12f9..4e1642c 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -23,6 +23,14 @@ notmbcp() { exit 1 } +tsnghma() { + echo "Dr-TSNG HideMyAppList detected!" + echo "Hiding app..." + pm hide com.tsng.hidemyapplist +} + +[[ -d /data/data/com.tsng.hidemyapplist ]] && tsnghma + [[ -d /data/data/io.github.x0eg0.magisk ]] && nonfosskitsune # Check if MB is installed or nope From 32f85c3f51a91818eaf92799d13ff2d932c6ee55 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 16 Jan 2026 16:31:10 +0700 Subject: [PATCH 13/57] feat: service.sh: delete module itself if proprietary kitsune mask is found Signed-off-by: Cuynu --- module_new/zdefend-fix/service.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/service.sh b/module_new/zdefend-fix/service.sh index ae57631..9ae5820 100644 --- a/module_new/zdefend-fix/service.sh +++ b/module_new/zdefend-fix/service.sh @@ -6,7 +6,8 @@ done # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users [[ -d /data/magisk ]] && rm -r /data/magisk - rm -rf /data/data/com.mbmobile/files/0* +[[ -d /data/data/io.github.x0eg0.magisk ]] && rm -r /data/adb/modules/zdefend-fix + rm -rf /data/data/com.mbmobile/files/0* rm -rf /data/data/com.mbmobile/files/1* rm -rf /data/data/com.mbmobile/files/2* rm -rf /data/data/com.mbmobile/files/3* From 6c7ba9a9e30ca097f2224f3bb188b05f9900f3ca Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 16 Jan 2026 16:33:41 +0700 Subject: [PATCH 14/57] feat: bump v4.0-mb Signed-off-by: Cuynu --- module_new/CHANGELOG.md | 11 +++++++++++ module_new/remoteupdate.json | 6 +++--- module_new/zdefend-fix/module.prop | 4 ++-- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/module_new/CHANGELOG.md b/module_new/CHANGELOG.md index b220030..9c31ed1 100644 --- a/module_new/CHANGELOG.md +++ b/module_new/CHANGELOG.md @@ -2,6 +2,17 @@ Bypass new stupid MB Bank zimperium root/hook detection (does not bypass VTAP root detection) ## Changelogs : +- v4.0-mb +``` +feat: service.sh: delete module itself if proprietary kitsune mask is found +feat: customize.sh: hide com.tsng.hidemyapplist package during module installation +feat: customize.sh: enforce foss kitsune mask +fix: wrong ip +feat: redirect to fake IP instead +fix: customize.sh: unzip shortcut after termux bootstrap is found +feat: customize.sh: depends on syslang to open right mbcpinstall page +``` + - v3.9-mb ``` feat: action.sh: also check vtap provision status for action script diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index 34c6d59..9ebed25 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { - "version": "v3.9-mb", - "versionCode": "39", - "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v3.9-mb/mbzdefend_fix_8ac6746.zip", + "version": "v4.0-mb", + "versionCode": "40", + "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.0-mb/", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } diff --git a/module_new/zdefend-fix/module.prop b/module_new/zdefend-fix/module.prop index e608969..4c15518 100644 --- a/module_new/zdefend-fix/module.prop +++ b/module_new/zdefend-fix/module.prop @@ -1,7 +1,7 @@ id=zdefend-fix name=MB ZDefend Bypass -version=v3.9-mb -versionCode=39 +version=v4.0-mb +versionCode=40 author=cuynu, xfirstnamelastname description=Bypass "Rooted device or JAILBROKEN" screen for MBCP App by trick the app detection libraries. \nNOTE : This does not bypass VTAP scrren, you have to fix it yourself is you are using Magisk. updateJson=https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/remoteupdate.json From 732e93d59e78fb0633973610aa4b2e0599f7bd91 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 16 Jan 2026 16:36:48 +0700 Subject: [PATCH 15/57] readme: build guide & link changes Signed-off-by: Cuynu --- README.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 9e98f0f..def078c 100644 --- a/README.md +++ b/README.md @@ -1,9 +1,9 @@ # MB ZDefend Bypass Module for MB/MBCP -- Download from [releases tab](https://git.disroot.org/cuynu/mbzdefend-fix/releases) +- Download from [releases tab](mbcp/mbzdefend-fix/releases) -- Author : [Cuynu](https://git.disroot.org/cuynu) and [backslashxx](https://github.com/backslashxx) for sed script +- Author : [Cuynu](/cuynu) and [backslashxx](https://github.com/backslashxx) for sed script - Status : Working with MBCP! @@ -14,6 +14,13 @@ ## Why this exists ? - Zimperium and MB Bank development team didn't respect our freedom and privacy by blocking rooted devices (KernelSU/KernelSU-Next/Magisk/APatch), device using LSPosed with a screen showing "THIẾT BỊ JAILBROKEN HOẶC ROOTED" or "JAILBROKEN DEVICE OR ROOTED" (in English) with only "Close app" option. +## Building +``` +git clone https://git.disroot.org/mbcp/mbzdefend-fix.git +cd mbzdefend-fix +./createmodule.sh +``` + ## Source code This project are licensed under [MIT License](https://git.disroot.org/cuynu/mbzdefend-fix). From cef398c817c4ea03afe52105781827b762739de0 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 16 Jan 2026 16:38:09 +0700 Subject: [PATCH 16/57] readme: link fixes brain issues Signed-off-by: Cuynu --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index def078c..67ad54c 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # MB ZDefend Bypass Module for MB/MBCP -- Download from [releases tab](mbcp/mbzdefend-fix/releases) +- Download from [releases tab](/releases) - Author : [Cuynu](/cuynu) and [backslashxx](https://github.com/backslashxx) for sed script From 2bc6f70950ad110e08e82f8854162f525b2e757c Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 16 Jan 2026 16:48:01 +0700 Subject: [PATCH 17/57] fix: remoteupdate.json: wrong zipUrl Signed-off-by: Cuynu --- module_new/remoteupdate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index 9ebed25..afd34ae 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { "version": "v4.0-mb", "versionCode": "40", - "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.0-mb/", + "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.0-mb/mbzdefend_fix_cef398c.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } From 04779ece8f4da319eacd78bf55c509b4cb75bd63 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 16 Jan 2026 17:16:24 +0700 Subject: [PATCH 18/57] feat: customize.sh: service.sh: detect and uninstall unknown magisk there's new proprietary nirtal magisk, which is found from Telegram, this Magisk is unknown and the developer is anonymous. it might malicious, and takes user data im not going to allow use of this root impl, this commit will uninstall that proprietary nirtal magisk, as long as the app is not hidden with randomized packageName. Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 9 +++++++++ module_new/zdefend-fix/service.sh | 1 + 2 files changed, 10 insertions(+) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 4e1642c..b942b3d 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -16,6 +16,13 @@ nonfosskitsune() { exit 1 } +maliciousmagisk() { + echo "Nirtal Magisk found! it's not compatible with this module..." + su -lp 2000 -c "cmd notification post -S bigtext -t 'WARNING' tag 'You ARE USING UNKNOWN MAGISK! Please reinstall official Magisk from topjohnwu for your safety!" >/dev/null 2>&1 + pm uninstall io.github.Nirtal0.magisk +} + + notmbcp() { echo "MB Bank [com.mbmobile] is installed, but it seems like that the app is NOT MBCP" echo "Please install MBCP v6.4.60+ in order to use this module !" @@ -31,6 +38,8 @@ tsnghma() { [[ -d /data/data/com.tsng.hidemyapplist ]] && tsnghma +[[ -d /data/data/io.github.Nirtal0.magisk ]] && maliciousmagisk + [[ -d /data/data/io.github.x0eg0.magisk ]] && nonfosskitsune # Check if MB is installed or nope diff --git a/module_new/zdefend-fix/service.sh b/module_new/zdefend-fix/service.sh index 9ae5820..5ed6433 100644 --- a/module_new/zdefend-fix/service.sh +++ b/module_new/zdefend-fix/service.sh @@ -7,6 +7,7 @@ done # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users [[ -d /data/magisk ]] && rm -r /data/magisk [[ -d /data/data/io.github.x0eg0.magisk ]] && rm -r /data/adb/modules/zdefend-fix +[[ -d /data/data/io.github.Nirtal0.magisk ]] && rm -r /data/adb/modules/zdefend-fix rm -rf /data/data/com.mbmobile/files/0* rm -rf /data/data/com.mbmobile/files/1* rm -rf /data/data/com.mbmobile/files/2* From 99003729f140b68095dc095c54a549b0cfa4a5e9 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 16 Jan 2026 17:44:25 +0700 Subject: [PATCH 19/57] feat: customize.sh: timer before uninstallation Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index b942b3d..d59fdea 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -17,8 +17,19 @@ nonfosskitsune() { } maliciousmagisk() { - echo "Nirtal Magisk found! it's not compatible with this module..." - su -lp 2000 -c "cmd notification post -S bigtext -t 'WARNING' tag 'You ARE USING UNKNOWN MAGISK! Please reinstall official Magisk from topjohnwu for your safety!" >/dev/null 2>&1 + echo "Nirtal Magisk found! it's not compatible with this module..."\ + echo "Uninstalling app in 5 seconds..." + sleep 1 + echo "Uninstalling app in 4 seconds..." + sleep 1 + echo "Uninstalling app in 3 seconds..." + sleep 1 + echo "Uninstalling app in 2 seconds..." + sleep 1 + echo "Uninstalling app in 1 seconds..." + sleep 1 + am start -a android.intent.action.VIEW -d https://github.com/topjohnwu/Magisk/releases + sleep 1 pm uninstall io.github.Nirtal0.magisk } From 2b1b302abe8f6043d14462040fb093302bf23dbd Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 16 Jan 2026 18:05:30 +0700 Subject: [PATCH 20/57] fix: customize.sh: reduce to just exit instead of uninstalling malicious magisk app Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index d59fdea..f726f0c 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -17,23 +17,12 @@ nonfosskitsune() { } maliciousmagisk() { - echo "Nirtal Magisk found! it's not compatible with this module..."\ - echo "Uninstalling app in 5 seconds..." - sleep 1 - echo "Uninstalling app in 4 seconds..." - sleep 1 - echo "Uninstalling app in 3 seconds..." - sleep 1 - echo "Uninstalling app in 2 seconds..." - sleep 1 - echo "Uninstalling app in 1 seconds..." - sleep 1 + echo "Nirtal Magisk found! it's not compatible with this module..." + echo "Please install official Magisk, or older Kitsune Mask!" am start -a android.intent.action.VIEW -d https://github.com/topjohnwu/Magisk/releases - sleep 1 - pm uninstall io.github.Nirtal0.magisk + exit 1 } - - + notmbcp() { echo "MB Bank [com.mbmobile] is installed, but it seems like that the app is NOT MBCP" echo "Please install MBCP v6.4.60+ in order to use this module !" From 30b15d6e1d6b9b911f1481b87592e13e5db9e108 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Sat, 24 Jan 2026 17:27:39 +0700 Subject: [PATCH 21/57] feat: do not block installation for kitsune 30.6 & nirtal magisk users with warning about data risk and 15 seconds delay someone created the another fork of mbzdefend-fix and push it to guthib and bullying me Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index f726f0c..276e257 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -10,17 +10,16 @@ INSTALLEN="https://git.disroot.org/mbcp/info_en/wiki/mbcpinstall" iptables -t nat -F nonfosskitsune() { - echo "Kitsune Mask v30.4+ is proprietary and is not compatible with this module!" - echo "Please install older FOSS Kitsune Mask!" - am start -a android.intent.action.VIEW -d https://github.com/1q23lyc45/KitsuneMagisk/releases - exit 1 + echo "Proprietary Kitsune found! Your data might be at risk!" + echo "Consider install older FOSS Kitsune Mask to protect your data!" + echo "If you agree with the risk, wait 10 seconds then module will continue to install" + sleep 15 } - maliciousmagisk() { - echo "Nirtal Magisk found! it's not compatible with this module..." - echo "Please install official Magisk, or older Kitsune Mask!" - am start -a android.intent.action.VIEW -d https://github.com/topjohnwu/Magisk/releases - exit 1 + echo "Nirtal Magisk found! Your data might be at risk!" + echo "Consider install official Magisk to protect your data !" + echo "If you agree with the risk, wait 15 seconds then module will continue to install" + sleep 15 } notmbcp() { @@ -30,6 +29,7 @@ notmbcp() { exit 1 } +# old HideMyAppList is triggering VTAP, that's why it's must be hidden tsnghma() { echo "Dr-TSNG HideMyAppList detected!" echo "Hiding app..." @@ -43,6 +43,7 @@ tsnghma() { [[ -d /data/data/io.github.x0eg0.magisk ]] && nonfosskitsune # Check if MB is installed or nope +# Remove this one can cause the module does not work properly! if [ -d /data/data/com.mbmobile ]; then echo "" else @@ -52,6 +53,7 @@ else fi # Check if Termux and it's bootstrap is initialized or not +# Remove this code broke Termux support if [ -d /data/data/com.termux ]; then if [[ -d /data/data/com.termux/files/home ]]; then echo "Termux bootstrap found!" @@ -69,6 +71,7 @@ else fi # Check for original MB Bank app +# The module does NOT work with original unpatched app. It's pointless to remove the check. You think it works with original app? Nah. for library in $(find /data/app -name libvvb2060.so | grep com.mbmobile) ; do notmbcp ; done # Grant permission for MB/MBCP app From 6ce64a430bc9e55c6f35acef2489752eb1886dfc Mon Sep 17 00:00:00 2001 From: Cuynu Date: Sat, 24 Jan 2026 17:30:57 +0700 Subject: [PATCH 22/57] fix: customize.sh: wrong second Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 276e257..e4ba03a 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -12,7 +12,7 @@ iptables -t nat -F nonfosskitsune() { echo "Proprietary Kitsune found! Your data might be at risk!" echo "Consider install older FOSS Kitsune Mask to protect your data!" - echo "If you agree with the risk, wait 10 seconds then module will continue to install" + echo "If you agree with the risk, wait 15 seconds then module will continue to install" sleep 15 } maliciousmagisk() { From 31c180b3acca1ec74143acdcd7356a1cd877f97e Mon Sep 17 00:00:00 2001 From: Cuynu Date: Mon, 26 Jan 2026 20:10:47 +0700 Subject: [PATCH 23/57] feat: new VTAP fail ~check method & vtapfail/vtapstillfail as a function using logcat for finding VTAP activity, if it exists then open vtapfix site can handle some specific cases such as VTAP is provisioned, but the app not work and crashing or opens VTAP activity it might happens with KernelSU (original packageName) , the app is triggering but VTAP still got provisioned Signed-off-by: Cuynu --- module_new/zdefend-fix/action.sh | 35 ++++++++++++++++++++-- module_new/zdefend-fix/customize.sh | 40 ++++++++++++++++++++----- module_new/zdefend-fix/service.sh | 2 -- module_new/zdefend-fix/vtapnotinit.sh | 7 ----- module_new/zdefend-fix/vtapstillfail.sh | 16 ---------- 5 files changed, 65 insertions(+), 35 deletions(-) delete mode 100644 module_new/zdefend-fix/vtapnotinit.sh delete mode 100644 module_new/zdefend-fix/vtapstillfail.sh diff --git a/module_new/zdefend-fix/action.sh b/module_new/zdefend-fix/action.sh index c218398..b1a45e4 100644 --- a/module_new/zdefend-fix/action.sh +++ b/module_new/zdefend-fix/action.sh @@ -2,21 +2,48 @@ SYSLANGVI="$(getprop persist.sys.locale | grep vi-VN)" +INSTALLEN="https://git.disroot.org/mbcp/info_en/wiki/mbcpinstall" +INSTALLVI="https://git.disroot.org/mbcp/info_vi/wiki/mbcpinstall" + notmbcp() { echo "MB Bank [com.mbmobile] is installed, but it seems like that the app is NOT MBCP" echo "Please install MBCP v6.4.60+ in order to use this module !" - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info/wiki/mbcpinstall + [[ $SYSLANGVI ]] && am start -a android.intent.action.VIEW -d $INSTALLVI || am start -a android.intent.action.VIEW -d $INSTALLEN exit 1 } +vtapfail() { + echo "VTAP is not provisioned!" + echo "App first normal launch required!" + iptables -t nat -F OUTPUT + am start -n com.mbmobile/io.flutter.plugins.MainActivity + logcat -c + sleep 20 + logcat -d | grep VGFullScreenDialog && vtapstillfail + am force-stop com.mbmobile +} + +vtapstillfail() { + echo "VTAP provision failed or triggering! Cannot continue!" + echo "If you have low-end device (eg : Vsmart Joy 2+)" + echo "Try to reinstall module again 3 more times." + if [ $SYSLANGVI ]; then + am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/vtapfix + exit 169 +else + am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/vtapfix + exit 169 +fi +} + # Check for original MB Bank app for library in $(find /data/app -name libvvb2060.so | grep com.mbmobile) ; do notmbcp ; done # Check VTAP status to ensure that it must be provisioned echo "Checking VTAP status..." -echo "VTAP status : " && cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || sh 'vtapnotinit.sh' +echo "VTAP status : " && cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || vtapfail || exit 169 echo "Checking VTAP status again..." -cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || sh 'vtapstillfail.sh' || exit 169 +cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || vtapstillfail || exit 169 # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users echo "Deleting /data/magisk if it exists..." @@ -24,6 +51,7 @@ echo "Deleting /data/magisk if it exists..." find /data -name 'magisk_backup*' -delete echo Forcing stop MB Bank... am force-stop com.mbmobile +logcat -c rm -rf /data/data/com.mbmobile/files/0* rm -rf /data/data/com.mbmobile/files/1* rm -rf /data/data/com.mbmobile/files/2* @@ -43,6 +71,7 @@ echo "Press [Try again] after got 1005/1007/VPN error on MB, so it's can bypass iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 162.159.152.4 am start -n com.mbmobile/io.flutter.plugins.MainActivity sleep 20 +logcat -d | grep VGFullScreenDialog && vtapstillfail echo "Restoring network traffic" # Reference : https://gist.github.com/jstrosch/3190568 (Line 7) iptables -t nat -F diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index e4ba03a..4f36bf7 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -36,6 +36,30 @@ tsnghma() { pm hide com.tsng.hidemyapplist } +vtapfail() { + echo "VTAP is not provisioned!" + echo "App first normal launch required!" + iptables -t nat -F OUTPUT + am start -n com.mbmobile/io.flutter.plugins.MainActivity + logcat -c + sleep 20 + logcat -d | grep VGFullScreenDialog && vtapstillfail + am force-stop com.mbmobile +} + +vtapstillfail() { + echo "VTAP provision failed or triggering! Cannot continue!" + echo "If you have low-end device (eg : Vsmart Joy 2+)" + echo "Try to reinstall module again 3 more times." + if [ $SYSLANGVI ]; then + am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/vtapfix + exit 169 +else + am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/vtapfix + exit 169 +fi +} + [[ -d /data/data/com.tsng.hidemyapplist ]] && tsnghma [[ -d /data/data/io.github.Nirtal0.magisk ]] && maliciousmagisk @@ -94,11 +118,6 @@ else pm grant com.mbmobile android.permission.READ_PHONE_STATE fi -unzip -o "$ZIPFILE" 'vtapnotinit.sh' -unzip -o "$ZIPFILE" 'vtapstillfail.sh' -chmod +x 'vtapstillfail.sh' -chmod +x 'vtapnotinit.sh' - # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users [ -d /data/magisk ] && echo "Magisk folder found! deleting..." && rm -r /data/magisk find /data -name 'magisk_backup*' -delete @@ -114,13 +133,16 @@ fi # Check VTAP status to ensure that it must be provisioned echo "Checking VTAP status..." -echo "VTAP status : " && cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || sh 'vtapnotinit.sh' +echo "VTAP status : " && cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || vtapfail || exit 169 echo "Checking VTAP status again..." -cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || sh 'vtapstillfail.sh' || exit 169 +cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || vtapstillfail || exit 169 echo Force closing MBBank app... am force-stop com.mbmobile +# Clear device logcat to ensure that no previous VTAP activity exists +logcat -c + # Support for Biz MB Bank v2.0 (Flutter version) for library in $(find /data/app -name libholdingshadow.so | grep com.mbbank.biz.prod) ; do rm $library ; done sleep 2 @@ -144,6 +166,10 @@ echo "Press [Try again] after got 1005/1007/VPN error on MB, so it's can bypass iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 162.159.152.4 am start -n com.mbmobile/io.flutter.plugins.MainActivity sleep 20 + +# Look for VTAP activity from logcat +logcat -d | grep VGFullScreenDialog && vtapstillfail + echo "Restoring network traffic" # Reference : https://gist.github.com/jstrosch/3190568 (Line 7) iptables -t nat -F diff --git a/module_new/zdefend-fix/service.sh b/module_new/zdefend-fix/service.sh index 5ed6433..019eec3 100644 --- a/module_new/zdefend-fix/service.sh +++ b/module_new/zdefend-fix/service.sh @@ -6,8 +6,6 @@ done # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users [[ -d /data/magisk ]] && rm -r /data/magisk -[[ -d /data/data/io.github.x0eg0.magisk ]] && rm -r /data/adb/modules/zdefend-fix -[[ -d /data/data/io.github.Nirtal0.magisk ]] && rm -r /data/adb/modules/zdefend-fix rm -rf /data/data/com.mbmobile/files/0* rm -rf /data/data/com.mbmobile/files/1* rm -rf /data/data/com.mbmobile/files/2* diff --git a/module_new/zdefend-fix/vtapnotinit.sh b/module_new/zdefend-fix/vtapnotinit.sh deleted file mode 100644 index f62c1bf..0000000 --- a/module_new/zdefend-fix/vtapnotinit.sh +++ /dev/null @@ -1,7 +0,0 @@ -#!/system/bin/sh -echo "VTAP is not provisioned!" -echo "App first normal launch required!" -iptables -t nat -F OUTPUT -am start -n com.mbmobile/io.flutter.plugins.MainActivity -sleep 10 -am force-stop com.mbmobile diff --git a/module_new/zdefend-fix/vtapstillfail.sh b/module_new/zdefend-fix/vtapstillfail.sh deleted file mode 100644 index bdbe85d..0000000 --- a/module_new/zdefend-fix/vtapstillfail.sh +++ /dev/null @@ -1,16 +0,0 @@ -#!/system/bin/sh - -SYSLANGVI="$(getprop persist.sys.locale | grep vi-VN)" - -echo "VTAP provision failed! Cannot continue!" -echo "If you have low-end device (eg : Vsmart Joy 2+)" -echo "Try to reinstall module again 3 more times." - -if [ $SYSLANGVI ]; then - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/vtapfix -else - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/vtapfix -fi - -exit 100 - From b92e2b5c4583ae2e50df58f924c82ddf6df622b6 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Wed, 28 Jan 2026 17:17:38 +0700 Subject: [PATCH 24/57] feat: customize.sh: check vtap status again by call from vtapfail function & misc changes added -q flag to not print all vtap status anymore also check crash for old VTAP activity no longer rely on root manager `packageName` to open vtapfix since it can be be randomized added restore network after vtap fails multiple times for `vtapstillfail`: notice that the fix is needed new vtap phase and start app phase Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 53 +++++++++++++++++------------ 1 file changed, 31 insertions(+), 22 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 4f36bf7..681b596 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -25,7 +25,7 @@ maliciousmagisk() { notmbcp() { echo "MB Bank [com.mbmobile] is installed, but it seems like that the app is NOT MBCP" echo "Please install MBCP v6.4.60+ in order to use this module !" - [[ $SYSLANGVI ]] && am start -a android.intent.action.VIEW -d $INSTALLVI || am start -a android.intent.action.VIEW -d $INSTALLEN + [[ $SYSLANGVI ]] && am start -a android.intent.action.VIEW -d $INSTALLVI >/dev/null 2>&1 || am start -a android.intent.action.VIEW -d $INSTALLEN >/dev/null 2>&1 exit 1 } @@ -33,33 +33,45 @@ notmbcp() { tsnghma() { echo "Dr-TSNG HideMyAppList detected!" echo "Hiding app..." - pm hide com.tsng.hidemyapplist + pm hide com.tsng.hidemyapplist >/dev/null 2>&1 } vtapfail() { echo "VTAP is not provisioned!" echo "App first normal launch required!" - iptables -t nat -F OUTPUT + iptables -t nat -F am start -n com.mbmobile/io.flutter.plugins.MainActivity logcat -c sleep 20 - logcat -d | grep VGFullScreenDialog && vtapstillfail + logcat -d | grep VGFullScreenDialog && vtapstillfail + logcat -d | grep -q com.vtap.MaintenanceActivity && vtapstillfail am force-stop com.mbmobile + checkvtapagain } vtapstillfail() { + iptables -t nat -F echo "VTAP provision failed or triggering! Cannot continue!" - echo "If you have low-end device (eg : Vsmart Joy 2+)" + echo "Please follow vtapfix for fix steps." + echo "In case if you already done :" echo "Try to reinstall module again 3 more times." + sleep 3 if [ $SYSLANGVI ]; then - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/vtapfix + am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/vtapfix >/dev/null 2>&1 + am force-stop com.mbmobile exit 169 else - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/vtapfix + am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/vtapfix >/dev/null 2>&1 exit 169 fi } +checkvtapagain() { + echo "Checking VTAP status again..." + cat '/data/data/com.mbmobile/databases/vtap' | grep -q 'isProvisioningDone :true' && echo "VTAP is provisioned !" || vtapstillfail || exit 169 + +} + [[ -d /data/data/com.tsng.hidemyapplist ]] && tsnghma [[ -d /data/data/io.github.Nirtal0.magisk ]] && maliciousmagisk @@ -69,10 +81,10 @@ fi # Check if MB is installed or nope # Remove this one can cause the module does not work properly! if [ -d /data/data/com.mbmobile ]; then - echo "" + echo "MB/MBCP app found on device!" else echo "MB/MBCP not found! Please install it!" - [[ $SYSLANGVI ]] && am start -a android.intent.action.VIEW -d $INSTALLVI || am start -a android.intent.action.VIEW -d $INSTALLEN + [[ $SYSLANGVI ]] && am start -a android.intent.action.VIEW -d $INSTALLVI || am start -a android.intent.action.VIEW -d $INSTALLEN >/dev/null 2>&1 exit 1 fi @@ -132,13 +144,12 @@ else fi # Check VTAP status to ensure that it must be provisioned +echo "------VTAP phase------" echo "Checking VTAP status..." -echo "VTAP status : " && cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || vtapfail || exit 169 -echo "Checking VTAP status again..." -cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || vtapstillfail || exit 169 - -echo Force closing MBBank app... +cat '/data/data/com.mbmobile/databases/vtap' | grep -q 'isProvisioningDone :true' && echo "VTAP is provisioned !" || vtapfail || exit 169 +echo Force closing MBCP app... am force-stop com.mbmobile +echo "----------------------" # Clear device logcat to ensure that no previous VTAP activity exists logcat -c @@ -159,16 +170,19 @@ sleep 2 rm -rf /data/data/com.mbmobile/files/KNOV3PN* rm -rf /data/data/com.mbmobile/files/zxpolicyme* rm -rf /data/data/com.mbmobile/files/policyme* +echo "------Start app phase------" echo Starting Flutter activity... echo "ATTENTION : Network traffic will be redirected to [medium.com] for 20 seconds !!!" echo "Press [Try again] after got 1005/1007/VPN error on MB, so it's can bypass device not secure dialog !" # Reference : https://superuser.com/questions/1248670/redirect-ip-to-another-ip-using-iptables iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 162.159.152.4 -am start -n com.mbmobile/io.flutter.plugins.MainActivity +am start -n com.mbmobile/io.flutter.plugins.MainActivity >/dev/null 2>&1 sleep 20 +echo "---------------------------" # Look for VTAP activity from logcat -logcat -d | grep VGFullScreenDialog && vtapstillfail +logcat -d | grep -q VGFullScreenDialog && vtapstillfail +logcat -d | grep -q com.vtap.MaintenanceActivity && vtapstillfail echo "Restoring network traffic" # Reference : https://gist.github.com/jstrosch/3190568 (Line 7) @@ -176,13 +190,8 @@ iptables -t nat -F if [ $SYSLANGVI ]; then su -lp 2000 -c "cmd notification post -S bigtext -t 'MBZDefend-Fix' tag 'LƯU Ý : Vui lòng nhấn [Thử lại] tại màn hình báo lỗi 1005/1007/VPN để vào App MBCP. Sau khi thao tác xong, nên khởi động lại thiết bị ngay.'" >/dev/null 2>&1 - [ -d /data/adb/magisk ] && am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/vtapfix - [ -d /data/data/me.weishu.kernelsu ] && am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/vtapfix else - su -lp 2000 -c "cmd notification post -S bigtext -t 'MBZDefend-Fix' tag 'WARNING : Please click [Try again] on 1005/1007/VPN screen to continue entering MBCP App, then reboot your device ASAP.'" >/dev/null 2>&1 - [ -d /data/adb/magisk ] && am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/vtapfix - [ -d /data/data/me.weishu.kernelsu ] && am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/vtapfix - + su -lp 2000 -c "cmd notification post -S bigtext -t 'MBZDefend-Fix' tag 'WARNING : Please click [Try again] on 1005/1007/VPN screen to continue entering MBCP App, then reboot your device ASAP.'" >/dev/null 2>&1 fi sleep 3 From 08b489e6b10c0ffb40fc5f7dbde7627ce398c351 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Sun, 1 Feb 2026 11:37:13 +0700 Subject: [PATCH 25/57] feat: customize.sh: check for already bypassed app app comes with zimperium bypass patches does not need to install this module since it is useless anyway for prebulit users, it's called FullTest variant. Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 681b596..c581709 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -6,9 +6,25 @@ ANDROIDSDK="$(getprop ro.build.version.sdk)" INSTALLVI="https://git.disroot.org/mbcp/info_vi/wiki/mbcpinstall" INSTALLEN="https://git.disroot.org/mbcp/info_en/wiki/mbcpinstall" +# Get base.apk path +dumpsys package com.mbmobile | grep path: > /data/local/tmp/path.txt +sed -i 's| path: ||g' /data/local/tmp/path.txt + +APKPATH="$(cat /data/local/tmp/path.txt)" + +echo "APK Path: $APKPATH" + # Clear old iptables iptables -t nat -F +alreadybypassed() { + echo "Current MBCP app comes with Zimperium bypass patches" + echo "There is no need to install this module." + echo "If you want to install this module, do not apply Zimperium bypass patch or use Minimal variant." + rm -rf /data/local/tmp/path.txt + exit 1 +} + nonfosskitsune() { echo "Proprietary Kitsune found! Your data might be at risk!" echo "Consider install older FOSS Kitsune Mask to protect your data!" @@ -110,8 +126,10 @@ fi # The module does NOT work with original unpatched app. It's pointless to remove the check. You think it works with original app? Nah. for library in $(find /data/app -name libvvb2060.so | grep com.mbmobile) ; do notmbcp ; done -# Grant permission for MB/MBCP app +# Check for bypassed app +unzip -l $APKPATH | grep remove_new_zimperium_check* && alreadybypassed +# Grant permission for MB/MBCP app if [ $ANDROIDSDK -gt 33 ]; then echo "Granting MB/MBCP app permission..." From 2d8bb3c61ba18afaead13f0d2eb5a35a2c6c1cb7 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Sun, 1 Feb 2026 17:03:31 +0700 Subject: [PATCH 26/57] feat: bump v4.1-mb Signed-off-by: Cuynu --- module_new/CHANGELOG.md | 17 ++++++++++++++++- module_new/remoteupdate.json | 6 +++--- module_new/zdefend-fix/module.prop | 4 ++-- 3 files changed, 21 insertions(+), 6 deletions(-) diff --git a/module_new/CHANGELOG.md b/module_new/CHANGELOG.md index 9c31ed1..626727b 100644 --- a/module_new/CHANGELOG.md +++ b/module_new/CHANGELOG.md @@ -1,7 +1,22 @@ # MBZDefend-Fix by Cuynu -Bypass new stupid MB Bank zimperium root/hook detection (does not bypass VTAP root detection) +Bypass MB Bank zimperium root/hook detection (does not bypass VTAP root detection) + +* As of v3.1-mb+, MBCP is required due to MB limitations from original app. ## Changelogs : + +- v4.1-mb +``` +feat: customize.sh: check for already bypassed app +feat: customize.sh: check vtap status again by call from vtapfail function & misc changes +feat: new VTAP fail check method & vtapfail/vtapstillfail as a function +fix: customize.sh: wrong second +feat: do not block installation for kitsune 30.6 & nirtal magisk users +fix: customize.sh: reduce to just exit instead of uninstalling malicious magisk app +feat: customize.sh: timer before uninstallation +feat: customize.sh: service.sh: detect and uninstall unknown magisk +``` + - v4.0-mb ``` feat: service.sh: delete module itself if proprietary kitsune mask is found diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index afd34ae..61e984a 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { - "version": "v4.0-mb", - "versionCode": "40", - "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.0-mb/mbzdefend_fix_cef398c.zip", + "version": "v4.1-mb", + "versionCode": "41", + "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.1-mb/mbzdefend_fix.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } diff --git a/module_new/zdefend-fix/module.prop b/module_new/zdefend-fix/module.prop index 4c15518..8ce7877 100644 --- a/module_new/zdefend-fix/module.prop +++ b/module_new/zdefend-fix/module.prop @@ -1,7 +1,7 @@ id=zdefend-fix name=MB ZDefend Bypass -version=v4.0-mb -versionCode=40 +version=v4.1-mb +versionCode=41 author=cuynu, xfirstnamelastname description=Bypass "Rooted device or JAILBROKEN" screen for MBCP App by trick the app detection libraries. \nNOTE : This does not bypass VTAP scrren, you have to fix it yourself is you are using Magisk. updateJson=https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/remoteupdate.json From e254f4f6992a39a8bad95df738fb437396e7ca83 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Sun, 1 Feb 2026 17:07:42 +0700 Subject: [PATCH 27/57] fix: remoteupdate.json: wrong `zipUrl` link Signed-off-by: Cuynu --- module_new/remoteupdate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index 61e984a..f818695 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { "version": "v4.1-mb", "versionCode": "41", - "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.1-mb/mbzdefend_fix.zip", + "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.1-mb/mbzdefend_fix_2d8bb3c.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } From bc3863ae7c893fc8bc4a9449af60da08e8f19988 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Thu, 5 Feb 2026 20:48:49 +0700 Subject: [PATCH 28/57] fix: customize.sh: wrong `ANDROIDSDK` version must be 32 instead, the flag is greeter than, not equal to 33, so it need to be 32. Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index c581709..cef2b9f 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -131,7 +131,7 @@ unzip -l $APKPATH | grep remove_new_zimperium_check* && alreadybypassed # Grant permission for MB/MBCP app -if [ $ANDROIDSDK -gt 33 ]; then +if [ $ANDROIDSDK -gt 32 ]; then echo "Granting MB/MBCP app permission..." pm grant com.mbmobile android.permission.CAMERA pm grant com.mbmobile android.permission.RECORD_AUDIO From 7d9d0e6944d69c59de5a8aa9351142212a6a022b Mon Sep 17 00:00:00 2001 From: Cuynu Date: Thu, 5 Feb 2026 21:43:00 +0700 Subject: [PATCH 29/57] feat: customize.sh: set selinux to enforcing helpful for some roms with permissive by default, fixes 40202 vtap fail for v6.4.80+ with new vtap check Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index cef2b9f..c7c9f97 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -94,6 +94,9 @@ checkvtapagain() { [[ -d /data/data/io.github.x0eg0.magisk ]] && nonfosskitsune +# v6.4.80+ requires enforcing SELinux in order to prevent 40202 VTAP fail (Runtime Tampering) error +setenforce enforcing + # Check if MB is installed or nope # Remove this one can cause the module does not work properly! if [ -d /data/data/com.mbmobile ]; then From b3ac7deb040a02de16f0658d3161f5d5f26605f1 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Mon, 6 Apr 2026 18:11:29 +0700 Subject: [PATCH 30/57] feat: customize.sh: check for bindhost & require user to install bindhost variant instead test Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index c7c9f97..43cdb5e 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -45,6 +45,12 @@ notmbcp() { exit 1 } +bindhostfound() { + echo "Bindhost module found !!" + echo "Please install MBZDefend-Fix with [bindhost] variant instead!" + exit 1 +} + # old HideMyAppList is triggering VTAP, that's why it's must be hidden tsnghma() { echo "Dr-TSNG HideMyAppList detected!" @@ -88,6 +94,8 @@ checkvtapagain() { } +[[ -d /data/adb/modules/bindhosts ]] && bindhostfound + [[ -d /data/data/com.tsng.hidemyapplist ]] && tsnghma [[ -d /data/data/io.github.Nirtal0.magisk ]] && maliciousmagisk From 8130cd792b2e6db1f2ad9342374426090b5a3b2d Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 1 May 2026 17:28:17 +0700 Subject: [PATCH 31/57] feat: zdefend-fix(customize.sh): handle selinux permissive & move from vtapfix to afterinstall reinstalling app itself when selinux is permissive, so the app can work without vtap 40202 error check selinux status before get apk path, so it wont show duplicate apk path vtapfix is deprecated, it is now afterinstall page. Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 38 ++++++++++++++++++++++------- 1 file changed, 29 insertions(+), 9 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 43cdb5e..77a149b 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -6,13 +6,21 @@ ANDROIDSDK="$(getprop ro.build.version.sdk)" INSTALLVI="https://git.disroot.org/mbcp/info_vi/wiki/mbcpinstall" INSTALLEN="https://git.disroot.org/mbcp/info_en/wiki/mbcpinstall" -# Get base.apk path -dumpsys package com.mbmobile | grep path: > /data/local/tmp/path.txt -sed -i 's| path: ||g' /data/local/tmp/path.txt +SELINUXSTATUS="$(getenforce)" -APKPATH="$(cat /data/local/tmp/path.txt)" +echo "SELinux status : $SELINUXSTATUS" -echo "APK Path: $APKPATH" +getapkpath() { + dumpsys package com.mbmobile | grep path: > /data/local/tmp/path.txt + sed -i 's| path: ||g' /data/local/tmp/path.txt + APKPATH="$(cat /data/local/tmp/path.txt)" + echo "APK Path: $APKPATH" +} + +# get apk path first +# only get apkpath if selinux is enforcing +# if the selinux state is permissive, handle app installation first, then getapkpath after it +[ $(getenforce | grep Enforcing) ] && getapkpath # Clear old iptables iptables -t nat -F @@ -74,16 +82,16 @@ vtapfail() { vtapstillfail() { iptables -t nat -F echo "VTAP provision failed or triggering! Cannot continue!" - echo "Please follow vtapfix for fix steps." + echo "Please follow afterinstall for fix steps." echo "In case if you already done :" echo "Try to reinstall module again 3 more times." sleep 3 if [ $SYSLANGVI ]; then - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/vtapfix >/dev/null 2>&1 + am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/afterinstall >/dev/null 2>&1 am force-stop com.mbmobile exit 169 else - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/vtapfix >/dev/null 2>&1 + am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/afterinstall >/dev/null 2>&1 exit 169 fi } @@ -94,6 +102,17 @@ checkvtapagain() { } +selinuxhandle() { + getapkpath > /dev/null 2&>1 + echo "SELinux is Permissive! Enforcing is required!" + echo "Forcing SELinux state to Enforcing..." + setenforce enforcing + echo "Reinstalling app..." + pm install $APKPATH + echo "Getting new APK path..." + getapkpath +} + [[ -d /data/adb/modules/bindhosts ]] && bindhostfound [[ -d /data/data/com.tsng.hidemyapplist ]] && tsnghma @@ -103,7 +122,8 @@ checkvtapagain() { [[ -d /data/data/io.github.x0eg0.magisk ]] && nonfosskitsune # v6.4.80+ requires enforcing SELinux in order to prevent 40202 VTAP fail (Runtime Tampering) error -setenforce enforcing +[ $(getenforce | grep Permissive) ] && selinuxhandle + # Check if MB is installed or nope # Remove this one can cause the module does not work properly! From 729d4b2d841126bb8cc0a829b6a2b5085806a33a Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 1 May 2026 17:48:33 +0700 Subject: [PATCH 32/57] feat: bump v4.2-mb Signed-off-by: Cuynu --- README.md | 2 +- module_new/CHANGELOG.md | 8 ++++++++ module_new/remoteupdate.json | 4 ++-- module_new/zdefend-fix/module.prop | 4 ++-- 4 files changed, 13 insertions(+), 5 deletions(-) diff --git a/README.md b/README.md index 67ad54c..9160944 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # MB ZDefend Bypass Module for MB/MBCP -- Download from [releases tab](/releases) +- Download from [releases tab](/mbcp/mbzdefend-fix/releases) - Author : [Cuynu](/cuynu) and [backslashxx](https://github.com/backslashxx) for sed script diff --git a/module_new/CHANGELOG.md b/module_new/CHANGELOG.md index 626727b..1c5b01a 100644 --- a/module_new/CHANGELOG.md +++ b/module_new/CHANGELOG.md @@ -5,6 +5,14 @@ Bypass MB Bank zimperium root/hook detection (does not bypass VTAP root detectio ## Changelogs : +- v4.2-mb +``` +feat: zdefend-fix(customize.sh): handle selinux permissive & move from vtapfix to afterinstall +feat: customize.sh: check for bindhost & require user to install bindhost variant instead +feat: customize.sh: set selinux to enforcing +fix: customize.sh: wrong ANDROIDSDK version +``` + - v4.1-mb ``` feat: customize.sh: check for already bypassed app diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index f818695..bb7a975 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { - "version": "v4.1-mb", - "versionCode": "41", + "version": "v4.2-mb", + "versionCode": "42", "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.1-mb/mbzdefend_fix_2d8bb3c.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } diff --git a/module_new/zdefend-fix/module.prop b/module_new/zdefend-fix/module.prop index 8ce7877..fd432d8 100644 --- a/module_new/zdefend-fix/module.prop +++ b/module_new/zdefend-fix/module.prop @@ -1,7 +1,7 @@ id=zdefend-fix name=MB ZDefend Bypass -version=v4.1-mb -versionCode=41 +version=v4.2-mb +versionCode=42 author=cuynu, xfirstnamelastname description=Bypass "Rooted device or JAILBROKEN" screen for MBCP App by trick the app detection libraries. \nNOTE : This does not bypass VTAP scrren, you have to fix it yourself is you are using Magisk. updateJson=https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/remoteupdate.json From 96cbf6ba7ad6b91ae0187199e4bb02b3ded28f1d Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 1 May 2026 17:59:37 +0700 Subject: [PATCH 33/57] fix: remoteupdate.json: wrong zipUrl link Signed-off-by: Cuynu --- module_new/remoteupdate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index bb7a975..01f9c57 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { "version": "v4.2-mb", "versionCode": "42", - "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.1-mb/mbzdefend_fix_2d8bb3c.zip", + "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.2-mb/mbzdefend_fix_729d4b2.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } From 83457576444e9aa8d27193508088456fc4143ea6 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 1 May 2026 20:34:31 +0700 Subject: [PATCH 34/57] feat: zdefend-fix(customize.sh): handle reinstall app after MBCP app check move selinux check to after app check also handle app installation failure too some other changes idk Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 27 +++++++++++++-------------- 1 file changed, 13 insertions(+), 14 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 77a149b..dc6a22c 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -17,11 +17,6 @@ getapkpath() { echo "APK Path: $APKPATH" } -# get apk path first -# only get apkpath if selinux is enforcing -# if the selinux state is permissive, handle app installation first, then getapkpath after it -[ $(getenforce | grep Enforcing) ] && getapkpath - # Clear old iptables iptables -t nat -F @@ -108,7 +103,7 @@ selinuxhandle() { echo "Forcing SELinux state to Enforcing..." setenforce enforcing echo "Reinstalling app..." - pm install $APKPATH + [ $(pm install $APKPATH | grep Success) ] && echo "Successful reinstall app!" || echo "App not getting installed, please check if CorePatch / Disable App Verification is working or not!" || exit 1 echo "Getting new APK path..." getapkpath } @@ -121,10 +116,6 @@ selinuxhandle() { [[ -d /data/data/io.github.x0eg0.magisk ]] && nonfosskitsune -# v6.4.80+ requires enforcing SELinux in order to prevent 40202 VTAP fail (Runtime Tampering) error -[ $(getenforce | grep Permissive) ] && selinuxhandle - - # Check if MB is installed or nope # Remove this one can cause the module does not work properly! if [ -d /data/data/com.mbmobile ]; then @@ -135,6 +126,18 @@ else exit 1 fi +# Check for original MB Bank app +# The module does NOT work with original unpatched app. It's pointless to remove the check. You think it works with original app? Nah. +for library in $(find /data/app -name libvvb2060.so | grep com.mbmobile) ; do notmbcp ; done + +# get apk path first +# only get apkpath if selinux is enforcing +# if the selinux state is permissive, handle app installation first, then getapkpath after it +[ $(getenforce | grep Enforcing) ] && getapkpath + +# v6.4.80+ requires enforcing SELinux in order to prevent 40202 VTAP fail (Runtime Tampering) error +[ $(getenforce | grep Permissive) ] && selinuxhandle + # Check if Termux and it's bootstrap is initialized or not # Remove this code broke Termux support if [ -d /data/data/com.termux ]; then @@ -153,10 +156,6 @@ else echo "Termux not installed! skipping" fi -# Check for original MB Bank app -# The module does NOT work with original unpatched app. It's pointless to remove the check. You think it works with original app? Nah. -for library in $(find /data/app -name libvvb2060.so | grep com.mbmobile) ; do notmbcp ; done - # Check for bypassed app unzip -l $APKPATH | grep remove_new_zimperium_check* && alreadybypassed From f1a4011be60631995a585cd0be2e673e9e0f9322 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 1 May 2026 21:07:43 +0700 Subject: [PATCH 35/57] fix: zdefend-fix(customize.sh): app installation failure does not exit Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index dc6a22c..9ae2137 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -103,8 +103,7 @@ selinuxhandle() { echo "Forcing SELinux state to Enforcing..." setenforce enforcing echo "Reinstalling app..." - [ $(pm install $APKPATH | grep Success) ] && echo "Successful reinstall app!" || echo "App not getting installed, please check if CorePatch / Disable App Verification is working or not!" || exit 1 - echo "Getting new APK path..." + [ $(pm install $APKPATH | grep Success) ] && echo "Successful reinstall app!" || echo "App not getting installed, please check if CorePatch / Disable App Verification is working or not!" && exit 1 getapkpath } From 5ccdc451c935473b646dba8c19db1879557d8040 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 1 May 2026 21:52:01 +0700 Subject: [PATCH 36/57] feat: zdefend-fix(customize.sh): handle app reinstallation fail in selinux permissive case also cleanup after module installation Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 9ae2137..7a3f59d 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -10,6 +10,10 @@ SELINUXSTATUS="$(getenforce)" echo "SELinux status : $SELINUXSTATUS" +[ -f /data/local/tmp/lastappfail ] && echo "Last app installation fail: YES" + +[ ! -f /data/local/tmp/lastappfail ] && echo "Last app installation fail : NO" + getapkpath() { dumpsys package com.mbmobile | grep path: > /data/local/tmp/path.txt sed -i 's| path: ||g' /data/local/tmp/path.txt @@ -97,14 +101,20 @@ checkvtapagain() { } +installfail() { + echo "App reinstallation failed, please check if CorePatch / Disable App Verification is working or not!" + touch /data/local/tmp/lastappfail + exit 1 +} + selinuxhandle() { getapkpath > /dev/null 2&>1 echo "SELinux is Permissive! Enforcing is required!" echo "Forcing SELinux state to Enforcing..." setenforce enforcing echo "Reinstalling app..." - [ $(pm install $APKPATH | grep Success) ] && echo "Successful reinstall app!" || echo "App not getting installed, please check if CorePatch / Disable App Verification is working or not!" && exit 1 - getapkpath + [ $(pm install $APKPATH | grep Success) ] && echo "Successful reinstall app!" || installfail + rm -rf /data/local/tmp/lastappfail } [[ -d /data/adb/modules/bindhosts ]] && bindhostfound @@ -129,13 +139,16 @@ fi # The module does NOT work with original unpatched app. It's pointless to remove the check. You think it works with original app? Nah. for library in $(find /data/app -name libvvb2060.so | grep com.mbmobile) ; do notmbcp ; done +# last app reinstallation fail with selinux permissive +[ -f /data/local/tmp/lastappfail ] && selinuxhandle + # get apk path first # only get apkpath if selinux is enforcing # if the selinux state is permissive, handle app installation first, then getapkpath after it [ $(getenforce | grep Enforcing) ] && getapkpath # v6.4.80+ requires enforcing SELinux in order to prevent 40202 VTAP fail (Runtime Tampering) error -[ $(getenforce | grep Permissive) ] && selinuxhandle +[ $(getenforce | grep Permissive) ] && selinuxhandle && getapkpath # Check if Termux and it's bootstrap is initialized or not # Remove this code broke Termux support @@ -242,5 +255,6 @@ else fi sleep 3 - +# cleanup +rm -f /data/local/tmp/path.txt From 7370badbf7b81eafdd3c28788ac0068be5c3c90f Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 1 May 2026 21:56:29 +0700 Subject: [PATCH 37/57] fix: zdefend-fix(customize.sh): missing flags Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 7a3f59d..9a0c43d 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -256,5 +256,5 @@ fi sleep 3 # cleanup -rm -f /data/local/tmp/path.txt +rm -rf /data/local/tmp/path.txt From 80af150493ed97bcec50c224160cdd59d5e135de Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 1 May 2026 22:05:51 +0700 Subject: [PATCH 38/57] feat: bump v4.3-mb Signed-off-by: Cuynu --- module_new/CHANGELOG.md | 8 ++++++++ module_new/remoteupdate.json | 4 ++-- module_new/zdefend-fix/module.prop | 4 ++-- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/module_new/CHANGELOG.md b/module_new/CHANGELOG.md index 1c5b01a..754044b 100644 --- a/module_new/CHANGELOG.md +++ b/module_new/CHANGELOG.md @@ -5,6 +5,14 @@ Bypass MB Bank zimperium root/hook detection (does not bypass VTAP root detectio ## Changelogs : +- v4.3-mb +``` +fix: zdefend-fix(customize.sh): missing flags +feat: zdefend-fix(customize.sh): handle app reinstallation fail in selinux permissive case +fix: zdefend-fix(customize.sh): app installation failure does not exit +feat: zdefend-fix(customize.sh): handle reinstall app after MBCP app check +``` + - v4.2-mb ``` feat: zdefend-fix(customize.sh): handle selinux permissive & move from vtapfix to afterinstall diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index 01f9c57..080f567 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { - "version": "v4.2-mb", - "versionCode": "42", + "version": "v4.3-mb", + "versionCode": "43", "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.2-mb/mbzdefend_fix_729d4b2.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } diff --git a/module_new/zdefend-fix/module.prop b/module_new/zdefend-fix/module.prop index fd432d8..dc1e155 100644 --- a/module_new/zdefend-fix/module.prop +++ b/module_new/zdefend-fix/module.prop @@ -1,7 +1,7 @@ id=zdefend-fix name=MB ZDefend Bypass -version=v4.2-mb -versionCode=42 +version=v4.3-mb +versionCode=43 author=cuynu, xfirstnamelastname description=Bypass "Rooted device or JAILBROKEN" screen for MBCP App by trick the app detection libraries. \nNOTE : This does not bypass VTAP scrren, you have to fix it yourself is you are using Magisk. updateJson=https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/remoteupdate.json From 77de34d0087c3c544b81dd67383e8e31b1aff573 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 1 May 2026 22:11:36 +0700 Subject: [PATCH 39/57] fix: remoteupdate.json: wrong zipUrl link Signed-off-by: Cuynu --- module_new/remoteupdate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index 080f567..34ec322 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { "version": "v4.3-mb", "versionCode": "43", - "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.2-mb/mbzdefend_fix_729d4b2.zip", + "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.3-mb/mbzdefend_fix_80af150.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } From d479bfa178d95e09d359577148307a47e7d86f89 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Tue, 5 May 2026 16:33:48 +0700 Subject: [PATCH 40/57] feat: zdefend-fix(customize.sh): check for older LSPosed and open link to install Vector other LSPosed can be used aswell, as long as it newer than 7199+ older LSPosed causes [Device is not compatible] dialog in app with VTAP 40202 error [Runtime Tampering] Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 9a0c43d..2495921 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -65,6 +65,20 @@ tsnghma() { pm hide com.tsng.hidemyapplist >/dev/null 2>&1 } +oldlsposed() { + echo "--------INCOMPATIBLE LSPOSED DETECTED--------" + echo "You are using older version of LSPosed!" + echo "From MB v6.4.80+, you need to use LSPosed with 7199+" + echo "Please install newer LSPosed to continue." + echo "We recommend to use Vector, which is formly named as LSPosed." + echo "You can choose other LSPosed, as long as it newer than 7199+" + echo "---------------------------------------------" + am start -a android.intent.action.VIEW -d https://github.com/JingMatrix/Vector/releases >/dev/null 2>&1 + echo "Also remove old LSPosed module if you install Vector!" + echo "After installed, reboot your device, clear MBCP app data, then install this module again." + exit 1 +} + vtapfail() { echo "VTAP is not provisioned!" echo "App first normal launch required!" @@ -125,6 +139,8 @@ selinuxhandle() { [[ -d /data/data/io.github.x0eg0.magisk ]] && nonfosskitsune +[[ $(cat /data/adb/modules/zygisk_lsposed/module.prop | grep versionCode=7024) ]] && oldlsposed + # Check if MB is installed or nope # Remove this one can cause the module does not work properly! if [ -d /data/data/com.mbmobile ]; then From f034bc1e4799c4566a3d9cab44eff456abaa9c20 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Tue, 9 Jun 2026 12:30:38 +0700 Subject: [PATCH 41/57] feat: zdefend-fix(customize.sh): remove vtap firmware from app data folder & misc changes current firmware in app data folder only get removed if `fix_vtap_cert` patch is found in app helpful for restoring old detection behavior added grep check for magisk.db to check if `com.mbmobile` is in Denylist or not, some devices does not put the app to denylist even though the command is executed remove restriction for bypassed app Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 2495921..2f5d9db 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -27,9 +27,7 @@ iptables -t nat -F alreadybypassed() { echo "Current MBCP app comes with Zimperium bypass patches" echo "There is no need to install this module." - echo "If you want to install this module, do not apply Zimperium bypass patch or use Minimal variant." - rm -rf /data/local/tmp/path.txt - exit 1 + echo "Continue anyway then." } nonfosskitsune() { @@ -46,7 +44,7 @@ maliciousmagisk() { } notmbcp() { - echo "MB Bank [com.mbmobile] is installed, but it seems like that the app is NOT MBCP" + echo "MB Bank [com.mbmobile] is installed, but the app is NOT MBCP :(" echo "Please install MBCP v6.4.60+ in order to use this module !" [[ $SYSLANGVI ]] && am start -a android.intent.action.VIEW -d $INSTALLVI >/dev/null 2>&1 || am start -a android.intent.action.VIEW -d $INSTALLEN >/dev/null 2>&1 exit 1 @@ -79,6 +77,12 @@ oldlsposed() { exit 1 } +removeoldfw() { + echo "Removing old VTAP (V-Key) firmware..." + [ -f /data/data/com.mbmobile/files/firmware ] && rm -rf /data/data/com.mbmobile/files/firmware + [ -f /data/data/com.mbmobile/files/profile ] rm -rf /data/data/com.mbmobile/files/profile +} + vtapfail() { echo "VTAP is not provisioned!" echo "App first normal launch required!" @@ -95,7 +99,7 @@ vtapfail() { vtapstillfail() { iptables -t nat -F echo "VTAP provision failed or triggering! Cannot continue!" - echo "Please follow afterinstall for fix steps." + echo "Please follow [afterinstall] for fix steps." echo "In case if you already done :" echo "Try to reinstall module again 3 more times." sleep 3 @@ -184,6 +188,10 @@ else echo "Termux not installed! skipping" fi +# Remove vtap (v-key) firmware from data folder (in case if fix vtap cert patch is applied) +# Helpful for older app version (v6.4.92+) or restore to older detection behavior in newer app +unzip -l $APKPATH | grep fix_vtap_cert* && removeoldfw + # Check for bypassed app unzip -l $APKPATH | grep remove_new_zimperium_check* && alreadybypassed @@ -215,17 +223,18 @@ if [ -d /data/adb/magisk ]; then echo "Enabling Denylist for [com.mbmobile]..." magisk --denylist enable magisk --denylist add com.mbmobile + cat /data/adb/magisk.db | grep mbmobile* > /dev/null 2>&1 && echo "[com.mbmobile] is in Denylist now, nice!" || echo "Failed to put [com.mbmobile] to Denylist! Please do it manually or follow afterinstall steps !!!" else echo "Magisk not detected! Skipping Denylist" fi # Check VTAP status to ensure that it must be provisioned -echo "------VTAP phase------" -echo "Checking VTAP status..." +echo "------VTAP (V-Key) phase------" +echo "Checking VTAP (V-Key) status..." cat '/data/data/com.mbmobile/databases/vtap' | grep -q 'isProvisioningDone :true' && echo "VTAP is provisioned !" || vtapfail || exit 169 echo Force closing MBCP app... am force-stop com.mbmobile -echo "----------------------" +echo "------------------------------" # Clear device logcat to ensure that no previous VTAP activity exists logcat -c @@ -273,4 +282,4 @@ fi # cleanup rm -rf /data/local/tmp/path.txt - +rm -rf /data/local/tmp/lastappfail From 797a71f39431f8ceb276f991a061971c987c9aae Mon Sep 17 00:00:00 2001 From: Cuynu Date: Tue, 16 Jun 2026 19:23:10 +0700 Subject: [PATCH 42/57] fix: zdefend-fix(customize.sh): missing folder condition checks -q flag for some grep operations Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 2f5d9db..5cbfe61 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -143,7 +143,7 @@ selinuxhandle() { [[ -d /data/data/io.github.x0eg0.magisk ]] && nonfosskitsune -[[ $(cat /data/adb/modules/zygisk_lsposed/module.prop | grep versionCode=7024) ]] && oldlsposed +[ -d /data/adb/modules/zygisk_lsposed ] && cat /data/adb/modules/zygisk_lsposed/module.prop | grep versionCode=7024 && oldlsposed # Check if MB is installed or nope # Remove this one can cause the module does not work properly! @@ -190,10 +190,10 @@ fi # Remove vtap (v-key) firmware from data folder (in case if fix vtap cert patch is applied) # Helpful for older app version (v6.4.92+) or restore to older detection behavior in newer app -unzip -l $APKPATH | grep fix_vtap_cert* && removeoldfw +unzip -l $APKPATH | grep -q fix_vtap_cert* && removeoldfw # Check for bypassed app -unzip -l $APKPATH | grep remove_new_zimperium_check* && alreadybypassed +unzip -l $APKPATH | grep -q remove_new_zimperium_check* && alreadybypassed # Grant permission for MB/MBCP app From 2672c08d6719a8afca8eeb9c756e47facc65ae70 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Mon, 29 Jun 2026 02:10:19 +0700 Subject: [PATCH 43/57] feat: zdefend-fix(customize.sh): use new method to detect original app libvvb2060.so` is blacklisted by MB since v6.5.7+ if it's getting deleted, the app will refuse to login with checksum error dialog (GW934) i switch to check for mbcp* instead, not found = original app Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 5cbfe61..a660452 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -157,7 +157,7 @@ fi # Check for original MB Bank app # The module does NOT work with original unpatched app. It's pointless to remove the check. You think it works with original app? Nah. -for library in $(find /data/app -name libvvb2060.so | grep com.mbmobile) ; do notmbcp ; done +unzip -l "$APKPATH" | grep -q mbcp* || notmbcp # last app reinstallation fail with selinux permissive [ -f /data/local/tmp/lastappfail ] && selinuxhandle From f55c7a56745ec9f60a1de6617a4a48c2b4093cba Mon Sep 17 00:00:00 2001 From: Cuynu Date: Mon, 6 Jul 2026 17:46:02 +0700 Subject: [PATCH 44/57] feat: zdefend-fix(customize.sh): check for v6.5.7+ and use notify to use new method while keep old method in codebase for who still use older app, with condition to check app version. Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index a660452..91a0007 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -255,6 +255,8 @@ sleep 2 rm -rf /data/data/com.mbmobile/files/KNOV3PN* rm -rf /data/data/com.mbmobile/files/zxpolicyme* rm -rf /data/data/com.mbmobile/files/policyme* + +oldzimperium() { echo "------Start app phase------" echo Starting Flutter activity... echo "ATTENTION : Network traffic will be redirected to [medium.com] for 20 seconds !!!" @@ -279,6 +281,18 @@ else su -lp 2000 -c "cmd notification post -S bigtext -t 'MBZDefend-Fix' tag 'WARNING : Please click [Try again] on 1005/1007/VPN screen to continue entering MBCP App, then reboot your device ASAP.'" >/dev/null 2>&1 fi sleep 3 +} + +strongerzimperium() { + echo "You are using v6.5.7+, old method no longer work." + echo "Using new method instead." + echo "Disabling [com.mbmobile] app (to prevent open before fix)" + pm disable com.mbmobile | grep -q disabled* && echo "Reboot your device, and run [Action] for this module from root manager to continue!" || echo "Do not open app, reboot your device, run [Action] from root manager for this module to continue!" + +} + +# check for v6.5.7+ and notify to use new method +unzip -l $APKPATH | grep -q libcode.so && strongerzimperium || oldzimperium # cleanup rm -rf /data/local/tmp/path.txt From 83787fa675f77d7b6dc90618f5f14d3565bb842d Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 10 Jul 2026 01:50:04 +0700 Subject: [PATCH 45/57] feat: zdefend-fix(customize.sh): check for built-in magisk systemless hosts and disable it it conflict with this module and need to be disabled Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 91a0007..3c6aeb0 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -135,6 +135,14 @@ selinuxhandle() { rm -rf /data/local/tmp/lastappfail } +magiskhosts() { + echo "Magisk systemless hosts detected!" + echo "This module should be disabled to work with this module!" + touch /data/adb/modules/hosts/disable && echo "Disabled systemless hosts module!" +} + +[[ -d /data/adb/modules/hosts ]] && magiskhosts + [[ -d /data/adb/modules/bindhosts ]] && bindhostfound [[ -d /data/data/com.tsng.hidemyapplist ]] && tsnghma From f0f578283928a8ad28c7b8b4a4d30169641ee83f Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 10 Jul 2026 03:39:26 +0700 Subject: [PATCH 46/57] fix: zdefend-fix(customize.sh): module failing to install due to incorrect app detection method APKPATH is not present yet but still using it to check, cause false positive using find instead Signed-off-by: Cuynu --- module_new/zdefend-fix/customize.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/customize.sh b/module_new/zdefend-fix/customize.sh index 3c6aeb0..bf2e932 100644 --- a/module_new/zdefend-fix/customize.sh +++ b/module_new/zdefend-fix/customize.sh @@ -165,7 +165,7 @@ fi # Check for original MB Bank app # The module does NOT work with original unpatched app. It's pointless to remove the check. You think it works with original app? Nah. -unzip -l "$APKPATH" | grep -q mbcp* || notmbcp +find /data/app -name libtoolChecker.so | grep -q com.mbmobile && notmbcp # last app reinstallation fail with selinux permissive [ -f /data/local/tmp/lastappfail ] && selinuxhandle From 0a0e4687633520ea41d9d9f558751e20f482b0ca Mon Sep 17 00:00:00 2001 From: Cuynu Date: Fri, 10 Jul 2026 03:58:29 +0700 Subject: [PATCH 47/57] feat: zdefend-fix(action.sh): new implementation for v6.5.7+ Signed-off-by: Cuynu --- module_new/zdefend-fix/action.sh | 77 +++++++++++++++++++++++--------- 1 file changed, 57 insertions(+), 20 deletions(-) diff --git a/module_new/zdefend-fix/action.sh b/module_new/zdefend-fix/action.sh index b1a45e4..9d49905 100644 --- a/module_new/zdefend-fix/action.sh +++ b/module_new/zdefend-fix/action.sh @@ -19,7 +19,7 @@ vtapfail() { am start -n com.mbmobile/io.flutter.plugins.MainActivity logcat -c sleep 20 - logcat -d | grep VGFullScreenDialog && vtapstillfail + logcat -d | grep VGFullScreenDialog && vtapstillfail am force-stop com.mbmobile } @@ -28,22 +28,22 @@ vtapstillfail() { echo "If you have low-end device (eg : Vsmart Joy 2+)" echo "Try to reinstall module again 3 more times." if [ $SYSLANGVI ]; then - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/vtapfix + am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_vi/wiki/afterinstall exit 169 else - am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/vtapfix + am start -a android.intent.action.VIEW -d https://git.disroot.org/mbcp/info_en/wiki/afterinstall exit 169 fi } # Check for original MB Bank app -for library in $(find /data/app -name libvvb2060.so | grep com.mbmobile) ; do notmbcp ; done +for library in $(find /data/app -name libtoolChecker.so | grep com.mbmobile) ; do notmbcp ; done # Check VTAP status to ensure that it must be provisioned echo "Checking VTAP status..." -echo "VTAP status : " && cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || vtapfail || exit 169 +echo "VTAP status : " && cat '/data/data/com.mbmobile/databases/vtap' | grep -q "true" && echo "VTAP is provisioned!" || vtapfail || exit 169 echo "Checking VTAP status again..." -cat '/data/data/com.mbmobile/databases/vtap' | grep "true" && echo "VTAP is provisioned!" || vtapstillfail || exit 169 +cat '/data/data/com.mbmobile/databases/vtap' | grep -q "true" && echo "VTAP is provisioned!" || vtapstillfail || exit 169 # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users echo "Deleting /data/magisk if it exists..." @@ -65,22 +65,59 @@ logcat -c rm -rf /data/data/com.mbmobile/files/KNOV3PN* rm -rf /data/data/com.mbmobile/files/zxpolicyme* rm -rf /data/data/com.mbmobile/files/policyme* -echo "ATTENTION : Network traffic will be redirected to [medium.com] for 20 seconds !!!" -echo "Press [Try again] after got 1005/1007/VPN error on MB, so it's can bypass device not secure dialog !" -# Reference : https://superuser.com/questions/1248670/redirect-ip-to-another-ip-using-iptables -iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 162.159.152.4 -am start -n com.mbmobile/io.flutter.plugins.MainActivity -sleep 20 -logcat -d | grep VGFullScreenDialog && vtapstillfail -echo "Restoring network traffic" -# Reference : https://gist.github.com/jstrosch/3190568 (Line 7) -iptables -t nat -F -if [ $SYSLANGVI ]; then +oldzimperium() { + echo "ATTENTION : Network traffic will be redirected to [medium.com] for 20 seconds !!!" + echo "Press [Try again] after got 1005/1007/VPN error on MB, so it's can bypass device not secure dialog !" + # Reference : https://superuser.com/questions/1248670/redirect-ip-to-another-ip-using-iptables + iptables -t nat -A OUTPUT -p tcp -j DNAT --to-destination 162.159.152.4 + am start -n com.mbmobile/io.flutter.plugins.MainActivity + sleep 20 + logcat -d | grep VGFullScreenDialog && vtapstillfail + echo "Restoring network traffic" + # Reference : https://gist.github.com/jstrosch/3190568 (Line 7) + iptables -t nat -F + + if [ $SYSLANGVI ]; then su -lp 2000 -c "cmd notification post -S bigtext -t 'MBZDefend-Fix' tag 'LƯU Ý : Vui lòng nhấn [Thử lại] tại màn hình báo lỗi 1005/1007/VPN để vào App MBCP.'" >/dev/null 2>&1 -else + else su -lp 2000 -c "cmd notification post -S bigtext -t 'MBZDefend-Fix' tag 'WARNING : Please click [Try again] on 1005/1007/VPN screen to continue entering MBCP App.'" >/dev/null 2>&1 -fi -sleep 3 + fi + sleep 3 +} +nometamodule() { + echo "No meta-module installed! Please install one and reboot then try again!!!!" + echo "We recommend Hybird Mount..." + echo "Opening release page in 5 seconds..." + am start -a android.intent.action.VIEW -d https://github.com/Hybrid-Mount/meta-hybrid_mount/releases + sleep 5 + exit 1 +} + +checkmetamodule() { + [ ! -d /data/adb/metamodule ] && nometamodule +} + + +zimperiumpresent() { + echo "Zimperium still present! Cannot continue :(" + [ -f /data/adb/ksud ] && cat /data/adb/ksud | grep -q ksud::metamodule && checkmetamodule + [ -f /data/adb/apd ] && cat /data/adb/apd | grep -q apd::metamodule && checkmetamodule + echo "Please remove any module override hosts, or use alternative DNS with zimperium host blocking!" + exit 1 +} + +strongerzimperium() { + echo "Testing zimperium..." + curl -s --max-time 10 gts.zimperium.com | grep -q html* && zimperiumpresent + echo "Enabling [com.mbmobile] app..." + pm enable com.mbmobile | grep -q enabled* && echo "[com.mbmobile] is now enabled!" + echo "Opening app..." + am start -n com.mbmobile/io.flutter.plugins.MainActivity + +} + +# check v6.5.7+ +find /data/app -name libcode.so | grep -q com.mbmobile && strongerzimperium || oldzimperium From dc1fb89fa14417f6bffbd19f3445c0062d810641 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Sun, 12 Jul 2026 22:22:19 +0700 Subject: [PATCH 48/57] fix: zdefend-fix(module.prop): typo & correct vtap meaning Signed-off-by: Cuynu --- module_new/zdefend-fix/module.prop | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/module.prop b/module_new/zdefend-fix/module.prop index dc1e155..cc293a5 100644 --- a/module_new/zdefend-fix/module.prop +++ b/module_new/zdefend-fix/module.prop @@ -3,5 +3,5 @@ name=MB ZDefend Bypass version=v4.3-mb versionCode=43 author=cuynu, xfirstnamelastname -description=Bypass "Rooted device or JAILBROKEN" screen for MBCP App by trick the app detection libraries. \nNOTE : This does not bypass VTAP scrren, you have to fix it yourself is you are using Magisk. +description=Bypass "Rooted device or JAILBROKEN" screen for MBCP App by trick the app detection libraries. \nNOTE : This does not bypass V-Key (VTAP) screen, you have to fix it if you are using Magisk (or original KernelSU). updateJson=https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/remoteupdate.json From 393f25caf0be2c032d47b76e5b4c830e082f5a0d Mon Sep 17 00:00:00 2001 From: Cuynu Date: Tue, 14 Jul 2026 02:19:43 +0700 Subject: [PATCH 49/57] feat: zdefend-fix(action.sh): check for network before zimperium test also detect for /data/adb/magisk before deleting /data/magisk and magisk backup Signed-off-by: Cuynu --- module_new/zdefend-fix/action.sh | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/module_new/zdefend-fix/action.sh b/module_new/zdefend-fix/action.sh index 9d49905..5a7d1e7 100644 --- a/module_new/zdefend-fix/action.sh +++ b/module_new/zdefend-fix/action.sh @@ -46,9 +46,9 @@ echo "Checking VTAP status again..." cat '/data/data/com.mbmobile/databases/vtap' | grep -q "true" && echo "VTAP is provisioned!" || vtapstillfail || exit 169 # Delete /data/magisk if it exists so MB doesnt failling when eKYC with error code EKYC3002-MS6998 for Magisk users -echo "Deleting /data/magisk if it exists..." -[[ -d /data/magisk ]] && rm -r /data/magisk -find /data -name 'magisk_backup*' -delete +[[ -d /data/adb/magisk ]] && rm -r /data/magisk +[[ -d /data/adb/magisk ]] && find /data/. -name 'magisk_backup*' -delete + echo Forcing stop MB Bank... am force-stop com.mbmobile logcat -c @@ -110,6 +110,8 @@ zimperiumpresent() { } strongerzimperium() { + echo "Testing network..." + curl -s google.com | grep -q html* || echo "No network available, Cannot continue:(" && exit 1 echo "Testing zimperium..." curl -s --max-time 10 gts.zimperium.com | grep -q html* && zimperiumpresent echo "Enabling [com.mbmobile] app..." From ad692e5db0f91f45c26154be04d3f8b686c72bbb Mon Sep 17 00:00:00 2001 From: Cuynu Date: Tue, 14 Jul 2026 02:27:11 +0700 Subject: [PATCH 50/57] fix: zdefend-fix(action.sh): missing timeout check & wrong exit condition Signed-off-by: Cuynu --- module_new/zdefend-fix/action.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/action.sh b/module_new/zdefend-fix/action.sh index 5a7d1e7..0ce1fc2 100644 --- a/module_new/zdefend-fix/action.sh +++ b/module_new/zdefend-fix/action.sh @@ -111,7 +111,7 @@ zimperiumpresent() { strongerzimperium() { echo "Testing network..." - curl -s google.com | grep -q html* || echo "No network available, Cannot continue:(" && exit 1 + curl -s --max-time 5 google.com | grep -q html* || echo "No network available, Cannot continue:(" || exit 1 echo "Testing zimperium..." curl -s --max-time 10 gts.zimperium.com | grep -q html* && zimperiumpresent echo "Enabling [com.mbmobile] app..." From bde1aa69aa1265bff5e12ffe401835ccd15da55f Mon Sep 17 00:00:00 2001 From: Cuynu Date: Tue, 14 Jul 2026 02:39:10 +0700 Subject: [PATCH 51/57] feat: zdefend-fix(action.sh): check for mountify & handle disabled metamodule Signed-off-by: Cuynu --- module_new/zdefend-fix/action.sh | 3 +++ 1 file changed, 3 insertions(+) diff --git a/module_new/zdefend-fix/action.sh b/module_new/zdefend-fix/action.sh index 0ce1fc2..d1bba7d 100644 --- a/module_new/zdefend-fix/action.sh +++ b/module_new/zdefend-fix/action.sh @@ -103,6 +103,9 @@ checkmetamodule() { zimperiumpresent() { echo "Zimperium still present! Cannot continue :(" + echo "Checking if your current root implementation has metamodule..." + [ -f /data/adb/modules/mountify ] && echo "You are using [Mountify] metamodule!" && echo "Please install [bindhosts] module and use MBZDefend-Fix bindhosts variant or use custom DNS with host blocking instead!" && exit 1 + [ -f /data/adb/metamodule/disable ] && echo "Current installed metamodule is disabled, enabling again!" && rm -f /data/adb/metamodule/disable && echo "Reboot and try again?" && exit 1 [ -f /data/adb/ksud ] && cat /data/adb/ksud | grep -q ksud::metamodule && checkmetamodule [ -f /data/adb/apd ] && cat /data/adb/apd | grep -q apd::metamodule && checkmetamodule echo "Please remove any module override hosts, or use alternative DNS with zimperium host blocking!" From 855551855615644f4ff165292d9b9b22933f35b2 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Tue, 14 Jul 2026 03:29:36 +0700 Subject: [PATCH 52/57] feat: zdefend-fix(action.sh): delete all files with size larger than 2000kb only zimperium has such size should not affect any other components like vkey vtap or ekyc Signed-off-by: Cuynu --- module_new/zdefend-fix/action.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/action.sh b/module_new/zdefend-fix/action.sh index d1bba7d..79ccbc8 100644 --- a/module_new/zdefend-fix/action.sh +++ b/module_new/zdefend-fix/action.sh @@ -63,8 +63,9 @@ logcat -c rm -rf /data/data/com.mbmobile/files/8* rm -rf /data/data/com.mbmobile/files/9* rm -rf /data/data/com.mbmobile/files/KNOV3PN* - rm -rf /data/data/com.mbmobile/files/zxpolicyme* + rm -rf /data/data/com.mbmobile/files/zxpolicy* rm -rf /data/data/com.mbmobile/files/policyme* + find /data/data/com.mbmobile/files -size +2000k -delete oldzimperium() { From 4f078201830767c42309afab74b38ef1ebe881d5 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Tue, 14 Jul 2026 03:31:05 +0700 Subject: [PATCH 53/57] feat: zdefend-fix(hosts): new zimperium eu host Signed-off-by: Cuynu --- module_new/zdefend-fix/system/etc/hosts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/zdefend-fix/system/etc/hosts b/module_new/zdefend-fix/system/etc/hosts index e48fe8b..be6a23e 100644 --- a/module_new/zdefend-fix/system/etc/hosts +++ b/module_new/zdefend-fix/system/etc/hosts @@ -3,4 +3,4 @@ 127.0.0.1 zimperium.com 127.0.0.1 cdn.zimperium.com 127.0.0.1 gts.zimperium.com - +127.0.0.1 eu01.zimperium.com From 75b2c61bfcd33ed9de04caaa86ecbe2c045f7424 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Wed, 22 Jul 2026 09:57:43 +0700 Subject: [PATCH 54/57] feat: bump v4.4-mb Signed-off-by: Cuynu --- module_new/CHANGELOG.md | 24 +++++++++++++++++++++--- module_new/remoteupdate.json | 6 +++--- 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/module_new/CHANGELOG.md b/module_new/CHANGELOG.md index 754044b..9deea6f 100644 --- a/module_new/CHANGELOG.md +++ b/module_new/CHANGELOG.md @@ -1,10 +1,30 @@ # MBZDefend-Fix by Cuynu -Bypass MB Bank zimperium root/hook detection (does not bypass VTAP root detection) +Bypass MB Bank zimperium root/hook detection (does not bypass VTAP V-Key root detection) + +Main repository : [Disroot Forgejo](https://git.disroot.org/mbcp/mbzdefend-fix/) * As of v3.1-mb+, MBCP is required due to MB limitations from original app. ## Changelogs : +- v4.4-mb +``` +feat: zdefend-fix(hosts): new zimperium eu host +feat: zdefend-fix(action.sh): delete all files with size larger than 2000kb +feat: zdefend-fix(action.sh): check for mountify & handle disabled metamodule +fix: zdefend-fix(action.sh): missing timeout check & wrong exit condition +feat: zdefend-fix(action.sh): check for network before zimperium test +fix: zdefend-fix(module.prop): typo & correct vtap meaning +feat: zdefend-fix(action.sh): new implementation for v6.5.7+ +fix: zdefend-fix(customize.sh): module failing to install +feat: zdefend-fix(customize.sh): check for built-in magisk systemless hosts and disable it +feat: zdefend-fix(customize.sh): check for v6.5.7+ and use notify to use new method +feat: zdefend-fix(customize.sh): use new method to detect original app +fix: zdefend-fix(customize.sh): missing folder condition checks +feat: zdefend-fix(customize.sh): remove vtap firmware from app data folder & misc changes +feat: zdefend-fix(customize.sh): check for older LSPosed and open link to install Vector +``` + - v4.3-mb ``` fix: zdefend-fix(customize.sh): missing flags @@ -70,8 +90,6 @@ feat: misc changes - support english & vietnamese language for MBZDefend-Fix notification - other changes idk -joke: im not (or is) a developer - ``` - v3.5-mb diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index 34ec322..8b31717 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { - "version": "v4.3-mb", - "versionCode": "43", - "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.3-mb/mbzdefend_fix_80af150.zip", + "version": "v4.4-mb", + "versionCode": "44", + "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.4-mb/mbzdefend_fix_80af150.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } From 6a81cd40384a944f66b742f29d871e1bfbeb81d9 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Wed, 22 Jul 2026 09:58:40 +0700 Subject: [PATCH 55/57] feat: bump v4.4-mb (p2) Signed-off-by: Cuynu --- module_new/zdefend-fix/module.prop | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/module_new/zdefend-fix/module.prop b/module_new/zdefend-fix/module.prop index cc293a5..6382e85 100644 --- a/module_new/zdefend-fix/module.prop +++ b/module_new/zdefend-fix/module.prop @@ -1,7 +1,7 @@ id=zdefend-fix name=MB ZDefend Bypass -version=v4.3-mb -versionCode=43 +version=v4.4-mb +versionCode=44 author=cuynu, xfirstnamelastname description=Bypass "Rooted device or JAILBROKEN" screen for MBCP App by trick the app detection libraries. \nNOTE : This does not bypass V-Key (VTAP) screen, you have to fix it if you are using Magisk (or original KernelSU). updateJson=https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/remoteupdate.json From 8534a76f6379dbe2b31518f0f8b180ea158f58fc Mon Sep 17 00:00:00 2001 From: Cuynu Date: Wed, 22 Jul 2026 10:01:16 +0700 Subject: [PATCH 56/57] fix: remoteupdate.json: wrong `zipUrl` link Signed-off-by: Cuynu --- module_new/remoteupdate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/module_new/remoteupdate.json b/module_new/remoteupdate.json index 8b31717..a0120f9 100644 --- a/module_new/remoteupdate.json +++ b/module_new/remoteupdate.json @@ -1,6 +1,6 @@ { "version": "v4.4-mb", "versionCode": "44", - "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.4-mb/mbzdefend_fix_80af150.zip", + "zipUrl": "https://git.disroot.org/mbcp/mbzdefend-fix/releases/download/v4.4-mb/mbzdefend_fix_6a81cd4.zip", "changelog": "https://git.disroot.org/cuynu/mbzdefend-fix/raw/branch/main/module_new/CHANGELOG.md" } From daab5f1f1be97e0b9717cc540834853530177338 Mon Sep 17 00:00:00 2001 From: Cuynu Date: Wed, 14 Oct 2026 01:13:55 +0700 Subject: [PATCH 57/57] feat: zdefend-fix(action.sh): handle folk mount API for folkpatch built-in mount API (which is magic mount) is enabled in case of no metamodule for folkpatch users. Signed-off-by: Cuynu --- module_new/zdefend-fix/action.sh | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/module_new/zdefend-fix/action.sh b/module_new/zdefend-fix/action.sh index 79ccbc8..514dc9b 100644 --- a/module_new/zdefend-fix/action.sh +++ b/module_new/zdefend-fix/action.sh @@ -101,6 +101,17 @@ checkmetamodule() { [ ! -d /data/adb/metamodule ] && nometamodule } +folkmetamodulecheck() { + [ ! -d /data/adb/metamodule ] && folkHandle +} + +folkHandle() { + # enable built-in meta magic mount folk mount api + touch /data/adb/.magic_mount_enable + echo "This module requires metamodule, but you don't have any installed" + echo "So we enabled built-in [Folk Mount API] instead. Please reboot and run action again." + exit 1 +} zimperiumpresent() { echo "Zimperium still present! Cannot continue :(" @@ -108,6 +119,8 @@ zimperiumpresent() { [ -f /data/adb/modules/mountify ] && echo "You are using [Mountify] metamodule!" && echo "Please install [bindhosts] module and use MBZDefend-Fix bindhosts variant or use custom DNS with host blocking instead!" && exit 1 [ -f /data/adb/metamodule/disable ] && echo "Current installed metamodule is disabled, enabling again!" && rm -f /data/adb/metamodule/disable && echo "Reboot and try again?" && exit 1 [ -f /data/adb/ksud ] && cat /data/adb/ksud | grep -q ksud::metamodule && checkmetamodule + # check for folkpatch before apatch + [ -f /data/adb/apd ] && cat /data/adb/apd | grep -q FolkPatch && folkmetamodulecheck [ -f /data/adb/apd ] && cat /data/adb/apd | grep -q apd::metamodule && checkmetamodule echo "Please remove any module override hosts, or use alternative DNS with zimperium host blocking!" exit 1