diff --git a/app b/app
index fd6cbb138..310b26625 160000
--- a/app
+++ b/app
@@ -1 +1 @@
-Subproject commit fd6cbb138c839ca77d4b99137911bb59f2f36876
+Subproject commit 310b266251da60e649922e11cd3af1455e48304a
diff --git a/core/jni/core/bootstages.c b/core/jni/core/bootstages.c
index f0c51654a..080daed24 100644
--- a/core/jni/core/bootstages.c
+++ b/core/jni/core/bootstages.c
@@ -507,23 +507,6 @@ void post_fs_data(int client) {
 	if (buf == NULL) buf = xmalloc(PATH_MAX);
 	if (buf2 == NULL) buf2 = xmalloc(PATH_MAX);
 
-	// Magisk binaries
-	char *bin_path = NULL;
-	if (access("/cache/data_bin", F_OK) == 0)
-		bin_path = "/cache/data_bin";
-	else if (access("/data/data/com.topjohnwu.magisk/install", F_OK) == 0)
-		bin_path = "/data/data/com.topjohnwu.magisk/install";
-	else if (access("/data/user_de/0/com.topjohnwu.magisk/install", F_OK) == 0)
-		bin_path = "/data/user_de/0/com.topjohnwu.magisk/install";
-	if (bin_path) {
-		rm_rf(DATABIN);
-		cp_afc(bin_path, DATABIN);
-		rm_rf(bin_path);
-	}
-
-	// Lazy.... use shell blob to match files
-	exec_command_sync("sh", "-c", "mv -f /data/magisk/stock_*.img.gz /data", NULL);
-
 	// Initialize
 	if (!is_daemon_init)
 		daemon_init();
diff --git a/core/jni/core/daemon.c b/core/jni/core/daemon.c
index 3e5d9c5f9..884a85c3c 100644
--- a/core/jni/core/daemon.c
+++ b/core/jni/core/daemon.c
@@ -106,8 +106,33 @@ void auto_start_magiskhide() {
 	free(hide_prop);
 }
 
- void daemon_init() {
+void daemon_init() {
 	is_daemon_init = 1;
+
+	 // Magisk binaries
+	char *bin_path = NULL;
+	if (access("/cache/data_bin", F_OK) == 0)
+		bin_path = "/cache/data_bin";
+	else if (access("/data/data/com.topjohnwu.magisk/install", F_OK) == 0)
+		bin_path = "/data/data/com.topjohnwu.magisk/install";
+	else if (access("/data/user_de/0/com.topjohnwu.magisk/install", F_OK) == 0)
+		bin_path = "/data/user_de/0/com.topjohnwu.magisk/install";
+	if (bin_path) {
+		rm_rf(DATABIN);
+		cp_afc(bin_path, DATABIN);
+		rm_rf(bin_path);
+	}
+
+	// Migration
+	rm_rf("/data/magisk");
+	unlink("/data/magisk.img");
+	unlink("/data/magisk_debug.log");
+
+	// Use shell glob to match files
+	exec_command_sync("sh", "-c",
+			"mv -f /data/adb/magisk/stock_*.img.gz /data;"
+			"rm -f /data/user*/*/magisk.db;", NULL);
+
 	LOGI("* Creating /sbin overlay");
 	DIR *dir;
 	struct dirent *entry;
@@ -128,7 +153,12 @@ void auto_start_magiskhide() {
 			unlinkat(sbin, entry->d_name, 0);
 	}
 	close(sbin);
-	xsymlink(MOUNTPOINT, FAKEPOINT);
+
+	// Backward compatibility
+	xsymlink(DATABIN, "/data/magisk");
+	xsymlink(MAINIMG, "/data/magisk.img");
+	xsymlink(MOUNTPOINT, "/magisk");
+
 	xmount(NULL, "/", NULL, MS_REMOUNT | MS_RDONLY, NULL);
 
 	xmount("tmpfs", "/sbin", "tmpfs", 0, NULL);
@@ -234,7 +264,7 @@ void start_daemon() {
 	// Start the log monitor
 	monitor_logs();
 
-	if ((is_daemon_init = access(MAGISKTMP, F_OK) == 0)) {
+	if ((is_daemon_init = (access(MAGISKTMP, F_OK) == 0))) {
 		// Restart stuffs if the daemon is restarted
 		exec_command_sync("logcat", "-b", "all", "-c", NULL);
 		auto_start_magiskhide();
diff --git a/core/jni/include/magisk.h b/core/jni/include/magisk.h
index 0c3f6ba3b..8ab218e25 100644
--- a/core/jni/include/magisk.h
+++ b/core/jni/include/magisk.h
@@ -15,7 +15,7 @@
 
 #define LOGFILE         "/cache/magisk.log"
 #define LASTLOG         "/cache/last_magisk.log"
-#define DEBUG_LOG       "/data/magisk_debug.log"
+#define DEBUG_LOG       "/data/adb/magisk_debug.log"
 #define UNBLOCKFILE     "/dev/.magisk.unblock"
 #define PATCHDONE       "/dev/.magisk.patch.done"
 #define DISABLEFILE     "/cache/.disable_magisk"
@@ -25,13 +25,12 @@
 #define MIRRDIR         MAGISKTMP "/mirror"
 #define BBPATH          MAGISKTMP "/busybox"
 #define MOUNTPOINT      MAGISKTMP "/img"
-#define FAKEPOINT       "/magisk"
 #define COREDIR         MOUNTPOINT "/.core"
 #define HOSTSFILE       COREDIR "/hosts"
 #define HIDELIST        COREDIR "/hidelist"
-#define MAINIMG         "/data/magisk.img"
-#define DATABIN         "/data/magisk"
-#define MANAGERAPK      MIRRDIR "/bin/magisk.apk"
+#define MAINIMG         "/data/adb/magisk.img"
+#define DATABIN         "/data/adb/magisk"
+#define MANAGERAPK      DATABIN "/magisk.apk"
 #define MAGISKRC        "/init.magisk.rc"
 
 
diff --git a/core/jni/magiskhide/proc_monitor.c b/core/jni/magiskhide/proc_monitor.c
index 75ba5eb93..991b3e2bd 100644
--- a/core/jni/magiskhide/proc_monitor.c
+++ b/core/jni/magiskhide/proc_monitor.c
@@ -42,7 +42,9 @@ static void hide_done(int sig) {
 	--hide_queue;
 	if (hide_queue == 0) {
 		xmount(NULL, "/", NULL, MS_REMOUNT, NULL);
-		xsymlink(MOUNTPOINT, FAKEPOINT);
+		xsymlink(DATABIN, "/data/magisk");
+		xsymlink(MAINIMG, "/data/magisk.img");
+		xsymlink(MOUNTPOINT, "/magisk");
 		xmount(NULL, "/", NULL, MS_REMOUNT | MS_RDONLY, NULL);
 	}
 }
@@ -243,15 +245,18 @@ void proc_monitor() {
 
 					LOGI("proc_monitor: %s (PID=%d ns=%s)\n", processName, pid, ns);
 
+					xmount(NULL, "/", NULL, MS_REMOUNT, NULL);
+					unlink("/magisk");
+					unlink("/data/magisk");
+					unlink("/data/magisk.img");
+					unlink(MAGISKRC);
+					xmount(NULL, "/", NULL, MS_REMOUNT | MS_RDONLY, NULL);
+					++hide_queue;
+
 					/*
 					 * The setns system call do not support multithread processes
 					 * We have to fork a new process, setns, then do the unmounts
 					 */
-					xmount(NULL, "/", NULL, MS_REMOUNT, NULL);
-					unlink(FAKEPOINT);
-					unlink(MAGISKRC);
-					xmount(NULL, "/", NULL, MS_REMOUNT | MS_RDONLY, NULL);
-					++hide_queue;
 					int selfpid = getpid();
 					if (fork_dont_care() == 0)
 						hide_daemon(pid, selfpid);
diff --git a/core/jni/utils/file.c b/core/jni/utils/file.c
index 8e6630fbc..1cb5dcba9 100644
--- a/core/jni/utils/file.c
+++ b/core/jni/utils/file.c
@@ -58,7 +58,8 @@ int mkdir_p(const char *pathname, mode_t mode) {
 void in_order_walk(int dirfd, void (*callback)(int, struct dirent*)) {
 	struct dirent *entry;
 	int newfd;
-	DIR *dir = xfdopendir(dirfd);
+	DIR *dir = fdopendir(dirfd);
+	if (dir == NULL) return;
 
 	while ((entry = xreaddir(dir))) {
 		if (strcmp(entry->d_name, ".") == 0 || strcmp(entry->d_name, "..") == 0)
@@ -86,12 +87,12 @@ static void rm_cb(int dirfd, struct dirent *entry) {
 }
 
 void rm_rf(const char *path) {
-	int fd = xopen(path, O_RDONLY | O_CLOEXEC);
-	if (fd < 0)
-		return;
-	frm_rf(fd);
-	close(fd);
-	rmdir(path);
+	int fd = open(path, O_RDONLY | O_NOFOLLOW | O_CLOEXEC);
+	if (fd >= 0) {
+		frm_rf(fd);
+		close(fd);
+	}
+	remove(path);
 }
 
 void frm_rf(int dirfd) {
diff --git a/scripts/addon.d.sh b/scripts/addon.d.sh
index cb2df2331..341d4061f 100644
--- a/scripts/addon.d.sh
+++ b/scripts/addon.d.sh
@@ -12,7 +12,7 @@
 
 main() {
   # Magisk binaries
-  MAGISKBIN=/data/magisk
+  MAGISKBIN=/data/adb/magisk
   # This script always runs in recovery
   BOOTMODE=false
 
@@ -56,14 +56,14 @@ main() {
 
   if [ -f stock_boot* ]; then
     rm -f /data/stock_boot* 2>/dev/null
-    is_mounted /data && mv stock_boot* /data
+    mv stock_boot* /data
   fi
 
   patch_dtbo_image
 
   if [ -f stock_dtbo* ]; then
     rm -f /data/stock_dtbo* 2>/dev/null
-    is_mounted /data && mv stock_dtbo* /data
+    mv stock_dtbo* /data
   fi
 
   cd /
diff --git a/scripts/flash_script.sh b/scripts/flash_script.sh
index dd7f26d9e..8c041af49 100644
--- a/scripts/flash_script.sh
+++ b/scripts/flash_script.sh
@@ -77,10 +77,17 @@ chmod -R 755 $CHROMEDIR $BINDIR
 
 ui_print "- Constructing environment"
 
-is_mounted /data && MAGISKBIN=/data/magisk || MAGISKBIN=/cache/data_bin
+if is_mounted /data; then
+  MAGISKBIN=/data/adb/magisk
+  mkdir -p /data/adb 2>/dev/null
+  chmod 700 /data/adb 2>/dev/null
 
-# Save our stock boot image dump before removing it
-mv /data/magisk/stock_boot* /data 2>/dev/null
+  # Some legacy migration
+  mv /data/magisk/stock_boot* /data 2>/dev/null
+  mv /data/magisk.img /data/adb/magisk.img
+else
+  MAGISKBIN=/cache/data_bin
+fi
 
 # Copy required files
 rm -rf $MAGISKBIN/* 2>/dev/null
diff --git a/scripts/magisk_uninstaller.sh b/scripts/magisk_uninstaller.sh
index 3b9dc7b83..48caa78d3 100644
--- a/scripts/magisk_uninstaller.sh
+++ b/scripts/magisk_uninstaller.sh
@@ -23,7 +23,7 @@
 
 [ -z $BOOTMODE ] && BOOTMODE=false
 
-MAGISKBIN=/data/magisk
+[ -d /data/adb/magisk ] && MAGISKBIN=/data/adb/magisk || MAGISKBIN=/data/magisk
 CHROMEDIR=$MAGISKBIN/chromeos
 
 if [ ! -f $MAGISKBIN/magiskboot -o ! -f $MAGISKBIN/util_functions.sh ]; then
diff --git a/scripts/uninstaller_loader.sh b/scripts/uninstaller_loader.sh
index 709023faa..c14f58ea8 100644
--- a/scripts/uninstaller_loader.sh
+++ b/scripts/uninstaller_loader.sh
@@ -54,8 +54,6 @@ BINDIR=$INSTALLER/$ARCH
 # Detection all done, start installing
 ##########################################################################################
 
-MAGISKBIN=/data/magisk
-
 if is_mounted /data; then
   recovery_actions
   # Save our stock boot image dump before removing it
diff --git a/scripts/util_functions.sh b/scripts/util_functions.sh
index 315a979c1..f5c7ce092 100644
--- a/scripts/util_functions.sh
+++ b/scripts/util_functions.sh
@@ -11,7 +11,7 @@ MAGISK_VERSION_STUB
 SCRIPT_VERSION=$MAGISK_VER_CODE
 
 # Default location, will override if needed
-MAGISKBIN=/data/magisk
+MAGISKBIN=/data/adb/magisk
 
 BOOTSIGNER="/system/bin/dalvikvm -Xnodex2oat -Xnoimage-dex2oat -cp \$APK com.topjohnwu.magisk.utils.BootSigner"
 BOOTSIGNED=false