yashsingh1/xdaforums huggingface dataset:
[Magisk] HippoMan:
I'm wondering if software and maybe an "un-googled" phone from the "e.foundation" will get us away from this new-and-improved worldview:

https://e.foundation/

I'm going to investigate further and see whether SafetyNet and related issues might indeed become moot in the /e/ world. We would initially give up many of our favorite Google-compliant apps, but if /e/ catches on and grows, it might eventually be possible that we can get enough apps that run in this environment to satisfy the needs of at least some of us.

.​
[Magisk] j4nn:
just wondering if we could bypass hardware backed attestation by proxying all the attestation related TEE requests from an unlocked phone to a still locked one? effectively getting locked state signed by use of TEE from different (locked) phone, but having the right challenge from the unlocked one?
[Magisk] zgfg:
Response from the second phone will not match the challenge from the first.

The method is by far from being so primitive/easy to break ?
[Magisk] JudgeDread11:
That is a same 'solution' as what was mentioned before about microG

Us all so using Google and safety net all together will not help us to use apps that require safety net to pass. They will simply not run on such devices.

And the amount of Android users that root their phones is a minority. Not enough to influence Google or the companies making use of safety net to abandon it.

They would have to put an effort in to even notice the difference.
[Magisk] j4nn:
[MENTION=7786725]zgfg[/MENTION], what I had in mind was truly forwarding it - that is request on phone A with random challenge would be forwarded to phone B (instead of use of attestation api of phone A), then it would get signed in TEE of still locked phone B by hardware attestation confirming it's still locked state and then that response would get send back to phone A which would simply use it as response to google server for check of the hw backed attestation.
[Magisk] bunklung:
Why not just emulate a phone which does not have a TPM? Then you could just run those apps within this VM environment and just bank on soft pass of Safety Net? In other words, Magisk Hide will now be a full blown VM.
[Magisk] AndDiSa:
I like the idea ... similar to enterprise managed devices which have two partitions: a work related one and a private one.
[Magisk] j4nn:
I guess that may work as long as google still allows such phones. The time when TPM will be required is coming sooner or later, considering the recent developments, probably sooner than later.
[Magisk] JudgeDread11:
Emulated devices automatically fail safety net. So you would need to hide the fact that it's an emulated devices, which is probably just as difficult as hiding the unlocked boot loader itself.
[Magisk] AndDiSa:
On my work phone which has two "partitions" safety net is working fine ... but probably because I can only install to the private partition and not to the work related one.
[Magisk] 81!:
PHUCK GOOGLE!!!

https://www.slashgear.com/google-sa...end-for-android-rooting-custom-roms-30627121/
[Magisk] palmbeach05:
Ffs damn you google
[Magisk] pndwal:
Dual Boot concept? Please critique merits. :) PW

https://xdaforums.com/apps/magisk/mod-magisk-v1-universal-systemless-t3432382/post82960555
[Magisk] palmbeach05:
Probably needs an unlocked bootloader or something. Unless we're taking it back to the days of bootstrap/safestrap?
[Magisk] HippoMan:
The e.foundation already sells Google-free phones and there are sources of Google-free software. We don't need major manufacturers to mass-produce millions of non-Google-based devices, and we don't need most developers to change the ways that their apps work. All we need is a niche where those of us who don't want to be tied to Android's or iOS's restrictions can run the software we want in the manners in which we want to run it.

I, for one, don't need or desire 99+ percent of the apps out there ... just a few that serve my needs and allow me to control the phone in the ways I want ... which includes features that currently are only available on rooted devices. But if I can get that without root, I'm also happy.

The e.foundation and other microG solutions offer ways in which this might be possible. And perhaps there are additional methods for achieving that goal. If more and more people are willing to go into a non-Google, non-Apple niche, the number of options (software and hardware) that are available to us who are willing to live in that niche are likely to increase.

PS: I can run pretty much any software I want on my linux box. Few, if any software packages that I can find will cease to run, simply because there is a working "root" account on the machine in which I can run any other software that I choose. There have been attempts to offer something like that on a mobile device, but they didn't get very far. Given Android's increasing restrictions, perhaps an "open" mobile-device platform like that will start to gain popularity. After all, Android was not very far from that, when it first came out.

.​
[Magisk] pndwal:
Most who want safety net pass or other benefits of MagiskHide want ability to use G Pay, bank and other security centric apps as well as the likes of Macdonald's, Pokémon Go and other game apps.

MicroG, as I understand it, and /e/ project, are aimed at 'de-Googling' phones because of how much info. is leaked to / collected by Google by stock apps, and even by subsystem.

https://xdaforums.com/android/help/to-root-huawei-y500-t2923318/post77670402

For security centric apps, I understand that MicroG (and possibly /e/?) has a safety net setting (though it's often broken) as well as framework allowing many Google proprietary apps to run in its environment while, ostensibly, avoiding data collection.

It's probably more likely that Maccas and gaming Devs will allow their apps to run on rooted devices before they make alternatives available for new niche platforms.

Sounds like you had no real use for safety net pass (or MagiskHide?) in the first place, so not sure if you'll really miss it. Not all have that luxury. :(

Not sure that /e/ has any more traction / support than Esperanto either, but it is a great concept, especially for the privacy concious (and those who don't trust Google)... But pigs may fly... PW
[Magisk] ipdev:
If you didn't care, what happened to me.

And I didn't care, for you.

We would, zigzag our way, through the boredom and pain.

Occasionally glancing up through the rain.

Wondering which of the buggers to blame.

And watching, for pigs on the wing.

Actually it might be a benefit with Google pushing stronger SafetyNet tests.

For the most part, since current work-a-round(s) are/were working, it was in the background.

Once SafetyNet is back in the foreground, who knows what will happen.. ;)

Older than I thought xda article - Link

Cheers. :cowboy:
[Magisk] pndwal:
Apt! ...because we do care. Some of us probably too much.

Still a question of what rights do we have using our own devices...

"Thinking again?" the Duchess asked, with another dig of her sharp little chin.

"I've a right to think," said Alice sharply, for she was beginning to feel a little worried.

"Just about as much right," said the Duchess, "as pigs have to fly ..." (Alice's Adventures in Wonderland - Lewis Carroll)

Interesting bit of history too, thanks... question is will history repeat. I'm off to search for pigs on the wing. But it ain't raining here. (And the future may be full of surprises). :) PW
[Magisk] Anupam Mahato:
My banking app not working even after magiks hide..my safetynet is also passed..can any one tell any solution? urgent
[Magisk] cojocar.andrei:
De-root or downgrade banking app (last solution worked for me) ...
[Magisk] AndDiSa:
Does anybody know what the SafetyNet state would be having a custom rom installed (e.g. similar GrapheneOS, (I know, GrapheneOS does not support Google Play Service) ) and having the bootloader locked?
[Magisk] zgfg:
Per Google's table about the SafetyNet attest results (posted here several times) CTS Profile should be ok (if you can really keep on your phone: custom ROM with Bootloader locked) but Basic Integrity may fail (depending on the device fingerprint declared by your ROM)
[Magisk] JudgeDread11:
Dualboot will not be able to bypass an unlocked bootloader.

On the OnePlus 7 there is a dualboot mod, which uses a customized TWRP version. But it still require an unlocked bootloader. So both installed ROMs won't pass safety net.
[Magisk] Wishmasterflo:
Exactly. I am using the TWRP dualboot on my Oneplus 7 but yes you need to have the bootloader unlocked.
[Magisk] pndwal:
Ah, so I'm guessing if a mechanism where used to lock / unlock depending on system booted, device would brick on locking even if custom system is not booted? And no possibility of dual bootloaders? Potentially? (...Hoping to see pigs fly. :) ) Thanks, PW
[Magisk] zgfg:
Only if dual-boot provided by stock, with one 'Bootloader' locked for the legit stock ROM (with GApps, GPay, for banking apps, etc) and the second, unlocked for hobbysts to flash custom ROMs.

But there must be a phone vendor who will find a business niche for developing such phones

I doubt what you get with. You will have to maintain apps and data on both ROMs, just like if maintaining two phones.

But having two phones - one with unlocked Bootloader, custom ROM, root and failing SafetyNet and the other with locked Bootloader, stock ROM, passing SafetyNet - provides some advantages, you don't need to reboot and loose the benefits of the first (if urgently need to use GPay or banking app), when you want to play with the second

For me, I would always opt for two phones, one for G and the other for flashing - to put it simple. There are always some spare, old phones, collecting dust in the drawer
[Magisk] AndDiSa:
I fully agree ... only it's not really a solution: the old phones (on which we need to install the banking apps) are no longer updated, e.g. having an old version of Android installed and (may) contain security holes. Custom roms (which most likely have a better security level) require an unlocked bootloader ... :(

I could live with this if Google / phone vendors would support a phone for at least 4 to 5 years, but buying every 2 years a new phone and thowing the old one into the trash bin is not a solution for me. Beside the money it's a waste of energy and resources.
[Magisk] Rootax:
If root & custom roms are not an option anymore, Pixel will become more attractive imo, since Google provide longer support than most of other oem (I said most).
[Magisk] zgfg:
I will probably go the other way, using my newer phone as 'official', during its warranty period and also while vendor is providing the official support (new firmwares), and using my older phone for flashoholic purposes.

I don't need to buy every year or two a new phone - for that second, 'unofficial' phone I can buy a one or two year old second-hand unit for a fraction of its original price
[Magisk] palmbeach05:
What about dragging bootstrap/safestrap back from the dead? My old droid x has a locked bootloader, bootstrap implemented, and magisk installed. Could that scenario be recreated on newer devices?
[Magisk] zgfg:
Probably only to another droid x.

By reading eg Magisk Wiki pages, things highly differ just between various Android 10 phones, SAR A/B, SAR A only with boot or only with recovery.

I doubt you could reuse from ten years old droid x to some new Android 10 or 11 phone
[Magisk] Khep:
Quick question:

Are the phone marked to participate in the attestation based on the phone ID or the Google account?

In other words, if I flash an old stock image on my phone + disable play store/every auto update + use another google account to connect, would that prevent it to enter into this wave of Hardware attestation again? Has anyone tried that?
[Magisk] cnjax:
Had safestrap on a Samsung note 3 and it worked great
[Magisk] HippoMan:
Another "pigs may fly" possibility is this:

The proposal is that some vendor offers a phone with all of the hardware configured so that Google can recognize it as a "valid" device that is subject to all of Google's SafetyNet restrictions, but also offers a piece of add-on hardware that can be plugged into the device to make it respond to Google's hardware and software checks in a way to make it look like the device is pristine. This could either be a piece of plug-in hardware or something controlled with a physical switch.

Then, we can root our devices and load whatever software we want, buf if we want to run our banking or other SafetyNet-sensitive apps, we plug in the chip or flip the switch, and the device will then appear to be "clean".

I know the chances of anything like this are low, but then again, if enough people want something like this, perhaps someone will offer a solution.

.​
[Magisk] zgfg:
Google does not send postcards - Hey Mr X, we'll now use hardware based attestation for CTS ?

It has nothing with Google account.

Not sure if flashing an older firmware can help since faking device fingerprints (model, firmware, Android version) did not help
[Magisk] palmbeach05:
I hear you, it was just a thought, using an old school method and updating it (bootstrap and safestrap) to be compatible with today's devices as a work around when it comes to google's latest move
[Magisk] pndwal:
Yes, I guess duplicating bootloader and other vital partitions by custom Devs is a tall ask, and likely unable to be applied as a universal solution anyway.

True, but I understand dual boot is already available (on OnePlus devices etc), and custom TWRP / repartitioned /data provides for an elegant working solution. Some apparently have a/b /data, and some a/b/c, a & b being exclusive to a or b OS, and c for common data.

Also phones restart reasonably fast today to boot!

Yes, of course the disadvantages of having two OS's on one device are a given. :(

Seems the biggest obstacles are dual bootloader related, but, if solved there's the advantage that this will likely be regarded as a legitimate setup satisfying Google's security model... I'm sure that XDA members will miss watching a frenetic game of cat-and-mouse however. PW
[Magisk] djdenki:
I need your help...

I updated Magisk Canvary via Magisk Manager... and always get boot loop... how to fix it?

Phone: Mi Note 10 Pro with Xiaomi.eu ROM / MIUI 12

Thank you!!!

[
[Magisk] knpk13:
Go to your device forum to find instructions on how to flash your stock boot.img

Or flash the magisk uninstaller from recovery and use magisk stable instead of canary.
[Magisk] hfam:
Pixel 2, stock 10 w/June 2020 update, Magusk 20.0, passes SN, no complaining apps, etc.

Just backreading the week or so Ive missed, guessing the whole key attestation is roaring back to life. Ugh....I knew this day would arrive, I guess. I better keep reading to see how bad this is gonna be.
[Magisk] djdenki:
I need your help...

I updated Magisk Canvary via Magisk Manager... and always get boot loop... how to fix it?

Phone: Mi Note 10 Pro with Xiaomi.eu ROM / MIUI 12

Thank you!!!
[Magisk] djdenki:
I tried with the uninstaller and also with magisk stable... but I haven't found the stock boot.img... can you help me?
[Magisk] knpk13:
I don't have your device so I can't. Ask/search in your device forum. And please don't make the exact same post 4 times in a row.
[Magisk] djdenki:
okay thank you.

I guess it was a bug, everytime I submitted the reply... I got an error...
[Magisk] m0han:
we need your help... please edit your post to remove the 'extras'. thank you.
[Magisk] vidumec:
got HARDWARE_BACKED on oneplus 6 running stock rom with magisk. The fun is over...
[Magisk] Watanabe_You:
How'd you see it?
[Magisk] vidumec:
ran safetynet helper check and "adb logcat -s SafetyNetResponse"
[Magisk] J.Michael:
How did you install Magisk?

The "stock boot.img" is whatever you handed to Magisk Manager, which it then patched to produce "magisk_patched.<something>".

How did you try stable without solving the boot loop?
[Magisk] zgfg:
For example, if device is Xiaomi Poco F1 (according to your profile).

Then stock boot.img must be part of the so called recovery/zip firmware file (that's the case for other Xiaomi phones, I don't have Poco)

Hence you must really check on XDA Poco forum, where from you can download recovery/zip image for your model, MIUI version, variant (Global, Indian, Russian, whatever) and maybe about other considerations for your phone regarding to (un)installing Magisk, modules, etc
[Magisk] Pheinte:
In my Mi 9 with the latest xiaomi.eu rom, i'm get evalutation type BASIC only, but it still not passing SafetyNet.

How can i find out what is causing SafetyNet to fail??

I have installed EdXposed before, but i've since uninstalled it as with all the magisk modules, but SafetyNet still not passing.

I have also use some vbmeta patcher right after installing twrp and before installing xiaomi.eu rom, not sure if it could have anything to do with it.
[Magisk] zgfg:
You didn't say if CTS Profile and/or Basic Integrity is failing.

Use e g. the app, posted earlier:

https://xdaforums.com/showpost.php?p=82930381&postcount=40342

to have more info (see screenshot)

Btw, did you enable Magisk Hide in Magisk Manager Settings?
[Magisk] Pheinte:
They're both failing.

And yes, I have enabled Magisk Hide.

EDIT: I managed to get SafetyNet working!

All it took was to do a cleanup with the app SD Maid and SafetyNet started passing right away. Weird, i know.
[Magisk] garylawwd:
You don't need to hide cod mobile.

Only hide necessary apps as topjohnwu himself mentions on his git that this can cause huge problems and may damage your system.

Also have you asked on your applicable device thread if CTS is failing just for you on xiaomi.eu rom or is everyone experience the issue because it could be a problem with the rom build itself
[Magisk] zgfg:
Ok, good for you:)

You said EU weekly, (not Global-ea like v12.0.1.0.QFAEUXM)?

Btw, how your device fingerprint looks like:

>> getprop ro.build.fingerprint
[Magisk] Pheinte:
I managed to get SafetyNet all green!

All it took was to do a cleanup with the app SD Maid (selected the 4 main options) and SafetyNet started passing right away. Weird, i know.

Maybe it deleted something that was triggering SafetyNet failing.
[Magisk] kaison320:
Anyone know how can i get green for the cts profile？ i am using the samsung a90. it dont have any custom rom or twrp so far. And i have try to flash the magisk hide props already but it does not have the a90 in the support drvices list:(

can anyone help me please
[Magisk] zgfg:
Did you read what was discussed here over the whole last week (hardware backed CTS attestation) - take your time, it will be interesting
[Magisk] Zergrinch:
Does it follow that under hardware attestation, ALL phones that were released with Android 7 or later will be affected, while all phones released with Android 6 or earlier are not even if you update them to later versions of Android (for example Samsung Galaxy 7)?
[Magisk] Tianhe:
I may be making a complete fool of myself but here it goes....

Is it possible that OEMs allow trustzone type security on a separate partition (hardware ?) for attesting safety net in its new avatar ?
[Magisk] sidamos77:
Did not see it here yet. There is a petition about the safety net change:

https://www.change.org/p/google-rev...sed-key-attestation-to-just-basic-attestation
[Magisk] Philnicolls89:
I think my s10+ is using hardware backed for safety net as it recently started failing cts profile check, however the play store is still certified and other apps like McDonald's, banking and most surprisingly gpay all still work.

Is there a chance I am still using basic for the safety net check? Is anyone else that has hardware backed and failing safety net able to use gpay?

It just seems strange that google would introduce this new safety check but still allow people to use gpay?

I'm not very tech savvy, is there an easy way to tell for sure if my device is hardware backed? (I don't really have much experience using adb)
[Magisk] AndDiSa:
I doubt that this will have much influence on Google's way how to deal with SafetyNet but at least we can give it a try ...
[Magisk] xdarasc:
HowTo? Replace files in /data/system

Hi,

I want to replace /data/system/users/0/package-restrictions.xml with an edited version but each time I do so and reboot the system the file is re-replaced by the old version.

How do I replace (or edit) above mentioned file so that the new file/version 'survives' the reboot?

Thank you!

Android 9 / MIUI 10.3.2

Magisk 20418
[Magisk] zgfg:
There are posts from the past week (search eg for Basic), with guides how to read from logcat or adb if Basic or Hardware CTS attestation is used.

However (posts with screenshots also present), new Canary Magisk Manager displays that information (the easiest way to read, no adb or logcat required

---------- Post added at 09:02 AM ---------- Previous post was at 08:59 AM ----------

You have missed the thread.

This one is about Magisk, not about WebView or adb debloating
[Magisk] Philnicolls89:
I am 99% certain that my device is using hardware backed key attestation. I am not to concerned about that. I guess the main part of my question was mainly out of curiosity. It is strange that I am failing safety net but still able to use gpay, banking apps, McDonald's etc and play store is certified (as in the past when i failed safety net then play store would not be certified).

So i was wondering if anyone else has experienced this??
[Magisk] zgfg:
I'm not using GPay (and my banking app is not affected) hence I'm not that much concerned about, but once CTS Profile started to fail, soon I obtainef Device not certified in Playstore

It can take time to sync. If you want Device not certified faster, you can provoje it by deleting Data for Google Play Store and Services ?
[Magisk] Philnicolls89:
Lol ??? I'll just ride it out as long as i can thanks! For now nothing has changed so it doesn't affect me.
[Magisk] zgfg:
OT about customized dual boot (Aquarius BQ) phones:

https://news.sky.com/story/encrocha...criminals-get-their-encrypted-phones-12019678

https://www.zdnet.com/article/police-take-down-encrypted-criminal-chat-platform-encrochat/
[Magisk] xdarasc:
Thank you, dear!

Nice, decent, people like you are always a pleasure to deal with, make up the heart of a welcoming community!

But I haven't: Magisk (20418) is dealing with my files in a manner that I cannot edit files in place. A question "Which file do I have to edit (in a Magisk 20418 environment) to make permanent changes to /a/b/c/d.xml ist clearly a Magisk-related question.

Have a great day, dear fried!
[Magisk] guest4711:
You either may edit a overlay (in /data/adb/modules/any-name/system/ or edit the file in filemanager of TWRP.

You may also flash your ROM again (dirty flashing should be enough).
[Magisk] ms_office_95:
RIP

My bank doesnt even care about root only the Google Pay portion.

McDonalds on the other hand nope cant have rooted Big Macs

Hardware level for me.. Samsung Note 9 (SM-N9600) Snapdragon
[Magisk] pndwal:
Interesting ZDNet article re EncroChat criminal encrypted chat use. Didn't see connection with dual boot phones, but I'm guessing these were issued to subscribers?

Of course, my query is whether there is any potential for a phone to boot both stock ROM with locked bootloader, and a custom OS with SU privileges / rooted (using dual bootloaders or other mechanism) in order to satisfy Googles security model and allow users to have an environment for apps requiring SafetyNet pass, as well as an OS with root privileges granted on the one device. It had no relation to encryption use or misuse, either end to end, or on device. But thanks for the info. :good: PW

Edit: Googling 'aquaris bq dual boot' turns up info re forensic investigation of these devices w/ dual OSs, one requiring special key combo to boot, and the other apparently a 'cover' to hide the existence of the first. As one investigator said, "something stinks", despite being unable to get past lock at that point... Interesting, if OT.