yashsingh1/xdaforums huggingface dataset:
[Magisk] HippoMan:
Thank you.

Wouldn't that also work from the TWRP "terminal" shell? If so, I wouldn't even need adb nor a desktop computer.

However, I still like the idea of an automatic boot-loop eliminator (when the boot-loop is related to one or more Magisk modules), if such a thing is possible.

.​
[Magisk] chooks06:
English please?

Google translate..

Good stuff. The function that can completely replace the xposed framework and its plugins is perfect.

What is that "stuff"?

Google translate..

那是什么"东西"?
[Magisk] _mysiak_:
If you have working TWRP, the solution is even more simple. Just navigate to /data/adb and remove Magisk modules manually.. :) The command above is for people who don't have TWRP installed (or even available).
[Magisk] HippoMan:
Understood, and thank you.

However, I still would like some sort of automated Magisk-module-triggered-boot-loop eliminator, perhaps like the one I proposed above, if such a thing is possible.

Any ideas?

.​
[Magisk] Death I:
I have Pixel 2 with January 2020 Android, it doesnt pass ctsprofile and I just noticed there's a Google play system update installed and awaiting a restart. ctsProfile didn't pass neither before (Jan 2020 Android + Jan 2020 Google Play system) nor after restart (Jan 2020 Android + Feb 2020 Google Play system. If I remember correctly it did pass when I last looked (probably shortly after updating to Jan 2020 Android).
[Magisk] zgfg:
Yeah, welcome to the club (discussion since Friday)
[Magisk] Khep:
Also have the CTS profile check failing.

I recently downgraded my Xiaomi Mi A2 to the oldest stock 8.1 version, Play Store has not been updated.

Here is the information (also posted on the MagiskHide Props Config thread), in case it helps.

Xiaomi Mi A2 (Android ONE, no MIUI)

Stock 8.1 V9.6.9.0.ODIMIFE_8.1

Play Store: 18.9.22 (Device not certified)

NO fingerprints (just PIN), Unencrypted, USB debug OFF, TWRP + Magisk 20.3 (Busybox + MHide Props Config)

Hide list: Play Store + Play Services + Google + G Service Framework

PROPS:

[ro.oem_unlock_supported]: [true]

[sys.oem_unlock_allowed]: [0]

[ro.boot.flash.locked]: [1]

[ro.boot.secureboot]: [1]

[ro.boot.verifiedbootstate]: [green]

[ro.boot.veritymode]: [enforcing]

There is no ro.boot.secureboot.lockstate entry (because 8.1?).

I can enter into Ingress Prime game.
[Magisk] Micdu70:
Even with ctsProfile=false and "Uncertified" device on Google Play, I can search and install Netflix app... It's weird because you normally can't... What's wrong with SafetyNet???
[Magisk] Ssnurzel:
Netflix is functioning. Despite false CTS.
[Magisk] TraderJack:
That's not the behavior I see. Mine shows "uncertified" in Play Store. I have Netflix installed (I'm in the Beta program, but I don't think it makes a difference here.). If I browse for Netflix I can find it and it shows it installed in the store. If I uninstall it however, I am able to still browse and pull up Netflix in the store, but there are no buttons to install it.

Here is a good app to test to see if things are really working:

https://play.google.com/store/apps/details?id=id.co.cimbniaga.mobile.android&hl=en_US

Normally, if you Magisk Hide and pass SafetyNet, this app will run. You will see however with SafetyNet broken this app will either exit immediately or give you a security warning and exit.

---------- Post added at 01:54 PM ---------- Previous post was at 01:52 PM ----------

Well what do you mean by "functioning"? When the Google Play store is uncertified, Netflix will usually fail to show up for install.

However, if you install Netflix manually it will function.

Apparently there are some devices where Netflix won't even work and they need a special libdecrypt file...but I've never had that issue on Pixel 3 XL.

As long as the app is installed it will Play...problem is getting it installed (since a lot of the APKs are now split APKs, harder to install or restore with TiBU).
[Magisk] Micdu70:
I can reinstall Netflix without issue, and use Go Mobile app without error (applied Magisk Hide only)...
[Magisk] DiamondJohn:
I am surprised no-one pulled you up on this, but in case someone else gets similarly confused, and I know it bothers many. Magisk is NOT the same or a replacement of Xposed.
[Magisk] cxvbxcbxcvbxcb:
Pokemon Go issue again: hide enabled for all components, safetynet ok, renamed magisk manager (app name and random ID), removed magisk setup files, twrp folder, renamed or removed all Titanium Backup folders I found ...

Am pretty close to stop playing as this keeps happening, but I'm always curious what the new trick they found :D
[Magisk] TraderJack:
And you have failed SafetyNet and uncertified in store?

Can you provide details about your device model, ROM, patch level, Magisk version, etc ?
[Magisk] martyfender:
Google Play Services just updated to 20.09.13 beta on my Onn 8, Android 9 tablet and it still passes the cts profile. It. Must be on Googles back end where the new check is, or is it?

Then why do my devices pass cts?
[Magisk] wilsonhlacerda:
Similar here. But for me have just updated only Play Store instead. I pass CTS and device certified yet.

February patch.
[Magisk] joeo10:
Got the same issue too.
[Magisk] lilbrat:
Strange how it's not affecting all the rooted folks.. latest updates, playstore certified, cts is all good... OnePlus 6T, stock room and kernel on a10..
[Magisk] demonoidmaster:
What app is that in the 1st pic?
[Magisk] lilbrat:
Play Services Info, you can get it on playstore..

https://play.google.com/store/apps/details?id=com.weberdo.apps.serviceinfo
[Magisk] hyborian:
Is that an old model ? Seems like old models pass. Maybe Google also checking on the models. As for MartyFender, maybe his device is not checked, not being a standard phone.

---------- Post added at 04:50 AM ---------- Previous post was at 04:39 AM ----------

I have registered my phone with Google. If I browse for Netflix, there is a button to install. This is what I expected from being registered/whitelisted.

If I install Go Mobile, it does show a message that I am rooted, even if it is in MagiskHide. It must be checking for cts; hence the failure. Thankfully, my banks and other payment apps don't check cts but some other root stuff, so all good for me, I can live with cts failing for now.

Of course, I hope someone can fix cts failing. In the event it can't be fixed and I need cts for an app I cannot live without (none at the moment), I'll just use a separate unrooted phone for it, argh.
[Magisk] zgfg:
Two days and four pages back in this same thread - screenshot of that post below
[Magisk] Micdu70:
1) Yes.

2) Xiaomi Mi 9T, xiaomi.eu 20.3.5 (Beta) custom ROM, use latest Mi 9T Global ROM "ro.build.fingerprint"/"ro.build.version.security_patch" props => Patch level = 2020-01-01, Magisk 20.3 (with "Hide Magisk Manager app" option).
[Magisk] _mysiak_:
Well, it won't hurt anything if you try it.. :)

Use post-fs-data boot script and late_start service script -> https://github.com/topjohnwu/Magisk/blob/master/docs/guides.md#boot-scripts

You can use "touch /data/adb/modules/MODULE_DIR/disabled" to quickly disable modules.
[Magisk] HippoMan:
Thank you, but nothing is described in that document which explains how to run something *after* all of the modules have been initialized. That's when I would need to run my post-magisk-startup.sh script.

That's why I asked my question here. Does anyone know how to cause a script to run *after* module initialization is complete?
[Magisk] wangdaning:
I am not a good with this kind of think, but could you use tasker to run after everything is complete? Like an if what you want complete then tasker run my script.

---------- Post added at 08:02 PM ---------- Previous post was at 08:02 PM ----------

I am not a good with this kind of thing, but could you use tasker to run after everything is complete? Like an if what you want complete then tasker run my script.

---------- Post added at 08:05 PM ---------- Previous post was at 08:02 PM ----------

I am not a good with this kind of thing, but could you use tasker to run after everything is complete? Like an if what you want complete then tasker run my script.

---------- Post added at 08:08 PM ---------- Previous post was at 08:05 PM ----------

I am not a good with this kind of thing, but could you use tasker to run after everything is complete? Like an if what you want complete then tasker run my script.
[Magisk] HippoMan:
Thank you.

Yes, I guess I could run that post-magisk-startup.sh script after my device has been started, in a Tasker boot-up action.

My first preference is to run it during the system boot sequence, if possible, but running it in Tasker would be a good second choice.
[Magisk] _mysiak_:
You're overthinking it.

late_start service mode ->

#!/bin/sh

sleep 5m

#do the magic
[Magisk] wangdaning:
I am not a good with this kind of thing, but could you use tasker to run after everything is complete? Like an if what you want complete then tasker run my script.
[Magisk] aariss:
Hi

Recent magisk upd v20.3 unable to bypass my banking apps (attached)

SafetyNet check ok

No issue with previous version

HP : Redmi 4 Prime

ROM : xiaomi eu

Android v7
[Magisk] rodken:
Create a named task.

A1: Code >> Run Shell [Command: (insert any code you wish to run) Store Output: (insert any variable which will retain the value of ouput - stdout) Store errors in : (insert a variable which stores errors - stderr)]

Tap back to exit

Link your task to your profile.

Note: for shell commands that require root you have to the tick the 'use root' option
[Magisk] TraderJack:
So interesting. I had used the "Hide" option previously to test. It still failed ctsProfile, so I reverted as I had never had to run in that config before for things to work.

I went ahead and hid it again with a new package name and also cleared out my Play Store app data. After I did that I was able to both reinstall Netflix and launch the GoMobile app.

Even after 2 hours my Play Store is not listing anything for certified/uncertified status. Usually, once I clear the data and launch the store and let it sit for a few minutes I will either pass or fail based on the ctsProfile status. Now, even though the ctsProfile is false, Play store isn't giving me a reading and I can install Netflix. I will be interested to see what happens if and when it updates to "uncertified" if I can still install Netflix.

The GoMobile App *may not* be the best to rest with...it has really weird behavior and I'm not sure what it is using to verify a rooted device. On my Pixel 3XL it is working as I describe above after I have repackaged Magisk. I have a spare Nexus 5x running Android 6 (old I know, but I have some apps that run better on 6 than later versions) that I tried it on. Even though that device passes SafetyNet (both tests) and I have repackaged and hidden the apps, GoMobile still won't run with that warning.

It would be nice to identify some specific apps and/or features that definitively depend on SafetyNet passing or failing. Especially if we could narrow down specific test (ctsProfile/basicIntegrity). This way we can identify when the test fails if it is truly influencing the behavior of the apps.

In the past I thought that failing SafetyNet = Uncertified Store = No Netflix shown/install-able, but this might not be the case. Even if when the store shows as uncertified it you can still install it (as you say you can, but I can't test yet), then really what does it matter?

Even on my phone right now everything seems to work, including Google Pay, even though I am failing ctsProfile. Even Google Pay continues to work (I even added a new card just now to test). I would like to reset Google Pay and see if I can set it up fresh, but I'm not taking the risk :).

I've attached my services info below, just for reference.
[Magisk] TraderJack:
Did you hide the app in "Magisk Hide"? Also try repackaging "hide" Magisk with new name in Magisk -> Settings
[Magisk] xGarro:
I don't know if this information is of use but, I use my phone (Xiaomi Redmi Note 8) for gaming a lot, in the past, a cts fail would instantly lock me out of many games, but this time it doesn't, even the more nitpicky games like Pokemon Go and Masters (the kind of games that even check for Twrp folder and such to lock rooted users out) are working just fine, banking apps and work related apps too.

The lone exception being Dragalia Lost which is the game I play the most, after the title screen, the loading freeze for a few seconds twice before throwing a connection error caused by the safety net update, some people already reported fixing it by relocking the bootloader (as it also fixes the ctsProfile error). Dragalia Lost is the only app I use that seems to be affected.

Which is a bummer for me, the reason I got this phone was to play that game, if a fix is not found I'll have to relock my device.
[Magisk] TraderJack:
Unfortunately, I think there are just too many variables outside the individual apps (like OS version and device) to nail down for sure, but those are some good data points.

It's sad that in today's age the game developers are more concerned with hacking (so they don't loose out on purchases), than the banks are at actually protecting your accounts.

I want to say I read at least one account somewhere of someone stating they started to fail ctsProfile even though they were 100% with a locked bootloader. If that was true, I suppose it is possible there is some sort of temporary issue that Google is working out.

Additionally, I believe that it wasn't an update to our devices that caused this issue, but rather a server-end check. This is because many people seemed to be fine immediately following the March update on 3/2, but didn't start seeing issues until like 3/6. There are only 2 things that could have happened here:

1) Google pushed another SafetyNet update locally (as part of GSF). I don't think this was the case though, it is more likely that:

2) Google implemented a new back end check for unlocked bootloader.

What this means is that SafetyNet has probably been able to detect the unlocked bootloader using some newer method for a while now. This is evidenced by the fact that people appear to be having this issue even if they revert back to an earlier update (like February). But for some reason they weren't validating on that check, but only using the props file verification.

The search now becomes determining how SafetyNet is actually querying the bootloader on the local device. I believe this will require either reverse engineering the snet framework or perhaps being able to capture the SafetyNet network communication back to Google. The latter may be extremely difficult as it is encrypted (and I'm not sure it is still possible to construct a MitM attack with user certificates).

In any event, I know enough to know this is likely well over my knowledge level to figure out. The best we can hope for is that it gets worse...since that is the only way it will get attention from the community at large.
[Magisk] hyborian:
I agree, once it has reached pandemic levels (common phrases these days lol), it should get some attention.

In the Telegram groups, many don't know it yet and even advise those seeking help with the usual methods, until they learn they are also infected.
[Magisk] Frostbiter:
I got this too after the March Play Store update but running the safety net check a second time shows all green and everything is working fine, haven't checked more recently though.
[Magisk] rodken:
Is Telegram still considered a viable source/medium to utilize?
[Magisk] zgfg:
The official SafetyNet attestation guide:

https://developer.android.com/training/safetynet/attestation

- Table from the guide (screenshot attached) describes that Unlocked Bootloader yields to CTS failure (although not Basic Integrity failure - those apps that rely on the weaker Basic Integrity result don't bother with unlocked Bootloaders)

- Also, phones for whom vendors did not apply for certification - likely phones for Chinese market with no GApps, will also yield to CTS false even if Bootliader was locked

- Observe that root detection yields both with Basic Integrity and CTS failure

Last change of the document (at the bottom) reads Dec 27, 2019.

There maybe also phones where Google cannot correctly check that Bootloader is unlocked - on those phones CTS can still pass although Bootloader is unlocked

Instead of MM (showing only CTS and Basic Integrity results), use an app that utilizes SafetyNet API Advice result (an older, unpaid version is attached - make sure to disable irs auto-update in Gioogle Play):

https://play.google.com/store/apps/details?id=de.guenthers.safetynet

In my case (Mi 9T, stock global ROM, unlocked Bootloader, TWRP and Magisk) it passes Basic Integrity (which means that SafetyNet didn't detect root or other system integrity compromises) but fails CTS and 'advices' to lock Bootloader
[Magisk] Didgeridoohan:
[MENTION=7786725]zgfg[/MENTION] SafetyNet has always checked for an unlocked bootloader. That's not new...
[Magisk] doegeenon:
can someone tell me will the v20.3 causing bootloop on the March patch? Thanks
[Magisk] zgfg:
EDIT: Ok, maybe hiding the unlocked Bootloader is actually part of DM Verity preservation by Magisk, and previously Magisk was able to hide but now no more
[Magisk] Badger50:
https://xdaforums.com/showpost.php?p=81956301&postcount=38644
[Magisk] zgfg:
Are you referring to the post in the screenshot attached?

We all know that Google changed SOMETHING in SafetyNet API (CTS part) but in that referred post I don't see a word about detecting/hiding the unlocked Bootloader
[Magisk] dcarvil:
No problems with my Pixel 3. I have no modules installed. You may run into problems with some modules.
[Magisk] Badger50:
My apologies. Maybe this one might be more accurate. https://xdaforums.com/showpost.php?p=81980963&postcount=38705
[Magisk] zgfg:
Interesting one ?

I've read it while heading home from work, but re-read it now with more attention and concentration
[Magisk] HippoMan:
Thank you.

That's a race condition. Of course, it's extremely (!!!) unlikely that the module startup will take anywhere near 5 minutes, but I don't like to write code that depends on timing of events, where that timing is out of my control. Furthermore, if my device somehow comes up but then a reboot occurs before 5 minutes have elapsed, then it will get auto-rebooted again, based on the pre-magisk-startup.sh script that I posted.

The Tasker-based solution discussed above is cleaner, I think.

.​
[Magisk] guest4711:
Not sure but ...

1. How about putting it into the last module you install?

2. How about putting it into /system/etc/init.d/ directory?

3. How about putting it into /data/adb/post-fs-data.d/ directory?
[Magisk] DiamondJohn:
A hack, but a starting / test point.IO would *guess* the modules load in alphabetocal order, so if you create a module that is alphabetically last, maybe that would work, at ;least for testing purposes while you search for a better solution. The above of course assumes that the modules do not load asynchronously.

Another check, but more manuall/explicit would be to check for the changes each module actually does. But again, you are at a very early concept testing phase, so the 5m wait as suggested above might be a good compramise untill you have sorted everything else out.

also, have you checked if the logcat (kmsg and dmsg) has any flags telling you what you need to know?
[Magisk] HippoMan:
Do we know that modules are initialized in the same order that they are installed?

Do we know that scripts in that directory get run after the initialization of Magisk modules?

Same question as above.

These are sincere questions, and I am not being rhetorical or facetious.

Thank you very much.

---------- Post added at 11:56 PM ---------- Previous post was at 11:24 PM ----------

Thank you. I'm going to investigate these things. I tried already to check logcat, and I couldn't find enough info to help me get my answers, but I will check again.

I'll post my results here.
[Magisk] ectoanonymous:
Phone: Xperia M2 D2302

ROM: stock ROM ; Bootloader unlocked ; TWRP flashed

Magisk says while flashing through TWRP or through patching via Magisk manager : unsupported/unknown image format ; installation failed.

Any idea how to fix that? I want to root my phone with magisk.
[Magisk] HippoMan:
Thank you. I'm going to investigate these things. I tried already to check logcat, and I couldn't find enough info to help me get my answers, but I will check again.

I'll post my results here.
[Magisk] zzz2002:
Hi, am having trouble with banking apps on an Samsung S3. I know an s3 is a museum piece.

Running a third party Lineage 14.1 based ROM.

Anything known, any fix available.

TIA
[Magisk] aariss:
Yes aldy hide > unhide > hide

What do u mean with repackaging ?
[Magisk] ktmom:
Are you on a Android 6.0+ ROM? Magisk requires that as a minimum.

https://www.didgeridoohan.com/magisk/MagiskHide

Make sure to read all of the information in the links on that page.
[Magisk] mochamoo:
Any reason why I can't go back to the February security patch on my pixel 4xl? I am missing my root applications. Will reverting help?
[Magisk] TraderJack:
unlikely based on reports
[Magisk] wilsonhlacerda:
Your only chance is probably reverting Patch + Play Store + Play Services, all from February. Then lock Play Store/Services auto updates.
[Magisk] TraderJack:
Is there any way to actually prevent Play Services from auto updating? It is out-of-band from the "auto update" option in Play Store. Maybe if you freeze/disable Play store itself? Though that is an inconvenience as well as you would have to install/update all apps manually.

?
[Magisk] hyborian:
Some people there say xda is obsolete lol

Anyway, i use 2 mediums, as some devs of kernels or apps i use are more active in telegram, some here at xda
[Magisk] guest4711:
Magisk Manager - Settings - entry after "Clear Repo Cache" should read like "Hide Magisk Manager by repacking it to another package name" or something like that. If repacked, the entry reads "Restore Magisk Manager".
[Magisk] _mysiak_:
It is advised to use extra sleep timer for "boot complete" event in Tasker as well. "Boot complete" broadcasts as soon as phone starts, it's not really fully operational (SD card not mounted for example), many apps (system/user) still loading. Modules might cause a crash, until phone really fully starts and loads all apps and services. This is about 2-3 minutes after you log in. 5 minutes is a safe value to detect any crash due to incompatible module. Of course you need to be aware that you have some startup script running, so you either won't reboot phone soon after boot, or run the script manually and reboot only after that.

IMHO, it doesn't matter whether you use Tasker or script in Magisk, functionally they're same. By using another variable (Tasker, which might not start, or it crashes at startup, freezes,..) you're just adding complexity with no benefit. Obviously your script, your phone, your call.. :)
[Magisk] wilsonhlacerda:
Play Store there are some mod out there. If you install it, will not self update.

Play Services I have no idea how to avoid self updates. I have never tried that. Maybe some Xposed module?

One thing that may work with both is to resign the APKs and force install them. Then updates from Google with original sign probably will fail.
[Magisk] Quinny899:
If you re-sign Play Services you will hit serious problems with signature verification.
[Magisk] Golf c:
Bummer. Game over.

https://twitter.com/topjohnwu/status/1237656703929180160?s=19
[Magisk] ms_office_95:
Explains why i cant get my Mcdonalds promos though i did something lol only app that really gives a **** about safetynet for me Banking apps dont care because its all server side anyway.
[Magisk] pawn_broker004:
I flashed few modules related to safetynet (safetypatch and petnoire's safetynet spoofer) also ended up with false.. But at least my banking app works again for now, not sure which modules actually work
[Magisk] Didgeridoohan:
Now that Google is tightening up SafetyNet to actually work (and not be fooled by simple tricks like changing device fingerprint), I'm sure it's just a matter of time before every app that's worried about root starts implementing it.