diff --git a/native/jni/core/bootstages.cpp b/native/jni/core/bootstages.cpp
index 5182dc611..181fc4654 100644
--- a/native/jni/core/bootstages.cpp
+++ b/native/jni/core/bootstages.cpp
@@ -301,19 +301,17 @@ static int bind_mount(const char *from, const char *to, bool log) {
 	return ret;
 }
 
-char *system_block;
-char *vendor_block;
-char *data_block;
-static char *&system_root_block = system_block;
+#define MIRRMNT(part)   MIRRDIR "/" #part
+#define PARTBLK(part)   BLOCKDIR "/" #part
 
-#define MIRRPNT(part) MIRRDIR "/" #part
-
-#define mount_mirror(part, flag) \
-sscanf(line.data(), "%s %*s %s", buf, buf2); \
-part##_block = strdup(buf); \
-xmkdir(MIRRPNT(part), 0755); \
-xmount(part##_block, MIRRPNT(part), buf2, flag, nullptr); \
-VLOGI("mount", part##_block, MIRRPNT(part))
+#define mount_mirror(part, flag) { \
+	sscanf(line.data(), "%s %*s %s", buf, buf2); \
+	xstat(buf, &st); \
+	mknod(PARTBLK(part), S_IFBLK | 0600, st.st_rdev); \
+	xmkdir(MIRRMNT(part), 0755); \
+	xmount(PARTBLK(part), MIRRMNT(part), buf2, flag, nullptr); \
+	VLOGI("mount", PARTBLK(part), MIRRMNT(part)); \
+}
 
 static bool magisk_env() {
 	LOGI("* Initializing Magisk environment\n");
@@ -348,7 +346,8 @@ static bool magisk_env() {
 	symlink(MODULEMNT, MAGISKTMP "/img");
 
 	// Directories in tmpfs overlay
-	xmkdirs(MIRRPNT(system), 0755);
+	xmkdir(MIRRDIR, 0);
+	xmkdir(BLOCKDIR, 0);
 	xmkdir(BBPATH, 0755);
 	xmkdir(MODULEMNT, 0755);
 
@@ -360,10 +359,11 @@ static bool magisk_env() {
 
 	LOGI("* Mounting mirrors");
 	bool system_as_root = false;
+	struct stat st;
 	file_readline("/proc/mounts", [&](string_view line) -> bool {
 		if (str_contains(line, " /system_root ")) {
 			mount_mirror(system_root, MS_RDONLY);
-			bind_mount(MIRRPNT(system_root) "/system", MIRRPNT(system));
+			xsymlink(MIRRMNT(system_root) "/system", MIRRMNT(system));
 			system_as_root = true;
 		} else if (!system_as_root && str_contains(line, " /system ")) {
 			mount_mirror(system, MS_RDONLY);
diff --git a/native/jni/include/magisk.h b/native/jni/include/magisk.h
index f375a77cb..fc9bca31b 100644
--- a/native/jni/include/magisk.h
+++ b/native/jni/include/magisk.h
@@ -11,6 +11,7 @@
 #define DISABLEFILE     "/cache/.disable_magisk"
 #define MAGISKTMP       "/sbin/.magisk"
 #define MIRRDIR         MAGISKTMP "/mirror"
+#define BLOCKDIR        MAGISKTMP "/block"
 #define BBPATH          MAGISKTMP "/busybox"
 #define MODULEMNT       MAGISKTMP "/modules"
 #define SECURE_DIR      "/data/adb"
diff --git a/native/jni/magiskhide/proc_monitor.cpp b/native/jni/magiskhide/proc_monitor.cpp
index 99c7e88b6..437ed3241 100644
--- a/native/jni/magiskhide/proc_monitor.cpp
+++ b/native/jni/magiskhide/proc_monitor.cpp
@@ -28,10 +28,6 @@
 
 using namespace std;
 
-extern char *system_block;
-extern char *vendor_block;
-extern char *data_block;
-
 static int inotify_fd = -1;
 
 static void term_thread(int sig = SIGTERMTHRD);
@@ -202,11 +198,9 @@ static void hide_daemon(int pid) {
 		lazy_unmount(s.data());
 	targets.clear();
 
-	// Unmount everything under /system, /vendor, and data mounts
+	// Unmount all Magisk created mounts
 	file_readline("/proc/self/mounts", [&](string_view s) -> bool {
-		if ((str_contains(s, " /system/") || str_contains(s, " /vendor/")) &&
-			(str_contains(s, system_block) || str_contains(s, vendor_block) ||
-			 str_contains(s, data_block))) {
+		if (str_contains(s, BLOCKDIR)) {
 			char *path = (char *) s.data();
 			// Skip first token
 			strtok_r(nullptr, " ", &path);