[Android Software/Hacking General [Developers Only]] osm0sis:
PIFork v9 is here! The big headlines for this release are my reimplemented/improved USNF Scripts-only mode *and* the official inclusion of my updated autopif.sh and killgms.sh scripts to make it easier for people to get up and running by letting them download and extract the latest Xiaomi.eu working fingerprint values all directly on their own device.

There's intentionally no custom./pif.json in my fork by default, because the goal remains to be futureproof, and including something that could/will be banned and obsolete the next day would be contrary to that goal. I'm on my same new private fingerprint since March. If you don't have your own private fingerprint to use or don't have time to look for one currently then simply run the extraction script from a root prompt with: sh /data/adb/modules/playintegrityfix/autopif.sh but note that it also appears somehow restricted for RCS use despite otherwise passing PI DEVICE/SN ctsProfile verdict currently.

Scripts-only mode is intended for older Android <10 ROMs, mostly stock ROM or those with stock-like values, (and some other rare special cases), since they generally only need a few prop changes to pass PI DEVICE/SN ctsProfile verdict. Manually opt-in by creating a file named scripts-only-mode in the module directory (e.g. from a root prompt: mkdir -p /data/adb/modules/playintegrityfix; touch /data/adb/modules/playintegrityfix/scripts-only-mode) then re/flashing the module.

Once installed in Scripts-only mode, for best results, you should most likely enable Enforce DenyList if not also using Shamiko or Zygisk Assistant; the module will automatically put GMS unstable on the list. It was tested and working on my OnePlus 5 on Android 7-9 (but I couldn't get it to work once I updated it to Android 10, hence the cutoff).

Be aware of the updated Known Banned Kernel List, and that as of late May PI now requires a ROM to not be signed with the AOSP testkey in order to pass PI DEVICE/SN ctsProfile verdict.

To switch from chiteroman's module, simply move your pif.json to /data/adb/modules/playintegrityfix/custom.pif.json then flash my module zip. You'll see it detect the custom.pif.json during the flash, retain it through the upgrade, and migrate it to the new format. Make sure you're following normal json format with a single entry of quoted key and value per line, and for best results have SECURITY_PATCH and FIRST_API_LEVEL/DEVICE_INITIAL_SDK_INT present and correctly filled beforehand. Back up your newly upgraded custom.pif.json afterward! (y)

I work on these projects in my limited time off, so if you like the progress I'm making, or enjoy anything else I've done on xda, please consider sponsoring my ongoing work using my GitHub Sponsors profile. For a one-time donation you can hit the donate link from my profile. Thanks for your support!

GitHub - osm0sis/PlayIntegrityFork: Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - osm0sis/PlayIntegrityFork

github.com

Play Integrity Fork v9:

- improve migrate script handling of some formatting edge cases

- add migrate script manual option to override all values using the fingerprint values

- add an opt-in scripts-only-mode for Android <10 ROMs

- add autopif script to allow extracting the latest Xiaomi.eu custom.pif.json values

- add killgms script to allow manual DroidGuard process killing

Note the example.app_replace.list currently covers the Xiaomi.eu, EliteRoms, hentaiOS, Evolution X and PixelOS spoof injection apps but it is extremely easy to extend to any others that may pop up: https://raw.githubusercontent.com/osm0sis/PlayIntegrityFork/main/module/example.app_replace.list

When setting "verboseLogs": "100" in your json you will see every Build field your ROM supports as well as everything DroidGuard is checking in system properties on your ROM setup. The current list of checked properties I've seen of interest are as follows:

build.version.extensions.ad_services
build.version.extensions.r
build.version.extensions.s
build.version.extensions.t
build.version.extensions.u
build.version.extensions.v
init.svc.adbd
persist.graphics.egl
persist.sys.knox.userinfo
persist.sys.oplus.region
persist.sys.pif
persist.sys.pihooks.first_api_level
persist.sys.pihooks.security_patch
persist.sys.pixelprops.games
ro.board.api_level
ro.board.first_api_level
ro.boot.flash.locked
ro.boot.hardware.revision
ro.boot.vbmeta.digest
ro.boot.vbmeta.device_state
ro.boot.verifiedbootstate
ro.build.characteristics
ro.build.id
ro.build.release_type
ro.build.stock_fingerprint
ro.build.type
ro.build.version.oplus.api
ro.build.version.oplus.sub_api
ro.build.version.oplusrom
ro.build.version.oplusrom.confidential
ro.build.version.ota
ro.build.version.sdk
ro.build.version.security_patch
ro.config.tima
ro.config.timaversion
ro.debuggable
ro.gfx.driver.1
ro.hardware.egl
ro.oplus.image.my_stock.type
ro.product.first_api_level
ro.product.vndk.version
ro.secure
ro.separate.soft
ro.superior.device
ro.treble.enabled
ro.vendor.api_level
ro.vendor.build.version.sdk
ro.vendor.oplus.market.enname
ro.vendor.oplus.market.name
ro.vendor.oplus.regionmark
ro.version.confidential
ro.vndk.version
ro.zygote
sys.usb.state

Of course a lot of the list doesn't seem to be currently enforced, and the ones that are we handle globally or in the custom.pif.json, but just be aware that more could at some point and this is how you can check them. 🤘

Happy hacking! :cowboy: