yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
Pretty much just reiterates what we already know however; other Google employees have been quoted here re. bounty etc...

And proper means to thwart SafetyNet bypass thru spoofing (aka faking, fudging, misrepresenting?...) is not only inevitable and understandable, it's been a wip for some years now (ie. Herdware Tee attestation), the full implementation of which is all that is really needed to effectively kill MagiskHide (outside of userspace) and additional spoofing solutions.

So it seems that G don't really need new measures / help in the long term as HKA will really mean all bets are off / 'funs over' as John Wu said 16 months ago... The surprise is that the term (for such device based spoofing) has not expired already, and the only real question is how much of that term is left! 😬

Still, some interesting insight from a 'leader of the Android Hardware-backed security team', the very team responsible for HKA rollout / testing / implementation, re. how a G team leader perceives Magisk SN bypass mechanisms as a useful indicator of items G need to address, custom mod and 'Magisk community members as part of a white hat community' (as opposed to 'people with nefarious goals'), and John himself as 'a valuable contributor to Android security even before he started working for Google'.

This is plainly no sanction of SN bypass methods, but still explains why such a G department head has 'no interest in shutting down Magisk'.

_______________________

As an aside, you may have noticed that I referred to 'device based spoofing' above.

Interestingly, server side (ie, Google's) spoofing also exists, and can also allow many features / services to be used on devices that wouldn't otherwise qualify. This too is a complex and diverse subject with security and other implications. As an example, here's a project which may be of interest / use to modders here, and the database of documentation is insightful:

https://raccoon.onyxbits.de/dummydroid-v2/about/#about-dummy-droid

Nb. This won't fix SafetyNet when HKA to TEE is working, but may still allow uncertified devices (China factory stock ROM / bootloader, etc) using ROMs without a device based certified fingerprint (custom or stock) to access PlayStore, and moreover, allow any device to be seen by PlayStore and apps as a different device, eg the default high-end Samsung shown (datasheet items listed):

https://raccoon.onyxbits.de/dummydroid-v2/troubleshooting/#device-not-compatible

This is achieved by altering a device profile datasheet bound to a GSF ID and uploaded to G's servers when the first G account after a factory reset is created.

The datasheet includes "your device’s hardware profile. A device profile is an elaborate description of your phone / tablet, listing hardware features, software versions, language options and even carrier information."

👀 PW
[Magisk] PickRickle:
Then the whitelist is created based on a profile of BlackBerry from UEM (Unified Endpoint Management). The administrator can then adjust a lot of parameters in relation to the phone. The UEM Client app uses Android Enterprise to gain control over the device. I unfortunately do not have the details of the whitelist apart from the applications that we want to analyze.

Luckily the profile didn't activate SafetyNet, so we are in MDM with the bootloader unlocked. So yeah I have already reflashed the firmware several times to test things.

I don't know how exactly the profiles apply to the phone yet. I could manipulate them from within TWRP if I knew. (Based on integrity check level) In addition, the BlackBerry application, as you might expect, is really well protected by obfuscation.

I tried Magisk Alpha, although it can install the stub locally and does not need internet, I still have to install the stub by pressing the app icon, which is not possible in my case.

Since stub.apk is provided on Magisk Alpha's Github, I still tried somewhat naively to install stub.zip in TWRP. Obviously it was not designed for this purpose. I'm trying to find a way to install this stub from TWRP. It will be incredible for our work. But I guess this stub needs a booted system to be replaced since it has to use values it can't get from the flashing process. Which would be the purpose of a stub.
[Magisk] PickRickle:
Your answer is exceptional. I completely forgot about Magisk recovery. I will try this.

Thank you for the details of the stub that I did not fully understand. To respond to the fact that https://cdn.jsdelivr.net would be blocked, it's simply that the phone will prompt a message when you press the app "This app is not authorized by your administrator".

it actually gives me more ideas!
[Magisk] zgfg:
Try to bypass jsdelivr:

Download Alpha app and json to your Github acc or other your 'trusted' place

Edit alpha.json by providing the proper URL for stub.apk

Switch the Update channel in your Magisk app to Custom and give it the URL for your customized alpha.json

With the older Magisk versions (before v21 or so) it worked flawlessly but later they embedded some addresses to the app (that's why link for the stub in json omits the full URL), hence no guarantee that it will work

Since Alpha downloads the stub differently than Stable/Canary, you can try your chances with both
[Magisk] PickRickle:
Thank you for your answer.

Unfortunately I was responding to ipdev asking me if the CDN would be whitelisted by the profile. I told him that it is precisely not the CDN that is blocked, but just the application. (Which must not match the application names / signatures authorized by the profile)

If you prefer, the application is "grayed out" and cannot be launched.

But your answers remain interesting to know.
[Magisk] zgfg:
There was something similar - scroll up in the given threads to follow the previous posts by @BattleRobot_HK47, he has even the Fairphone 3, too:
[Magisk] plepew:
Hey guys,

Need some assistance please. When I went to check SafetyNet this morning, I got this message (pic).

Now I know my device (OP6T), is still rooted and passed SafetyNet within Root Checker App I used to verify. Should I Download Proprietary Code as indicated or just leave it alone. I only ask cause I know TJW has left and there is no one developing update for Magisk now. I don't want to risk messing up my setup as my device works 100% and Google Pay & Samsung Pay are working perfectly for me right now.

Thanking you all in advance for your assistance.

✌️
[Magisk] zgfg:
This was always the case - nothing related to TJW moved to Google

When you install Magisk app and first time you want to test SN, it asks you to download.

Only once and this is only for SN checking part

If you wish, you can download the alternative SN checkers from Google Play

Don't forget to enable Magisk Hide from Magisk app Settings - without, SN will fail right away
[Magisk] J.Michael:
You said you have a phone of this type on which you can run Magisk Manager app.

Can you take the firmware of this unrestricted phone and boot it on a restricted phone? (Maybe "fastboot boot", maybe actually flash.) Then use Magisk Manager app to grant root. Then use restricted system, with data partition a.ready populated enough for Magisk to grant root as you specified. It would not allow you to easily change what apps are granted root privilege, but it might be enough in your situation, where apparently there is no casual installing of new apps.

Can you describe what you want to do with root access?
[Magisk] plepew:
The Magisk App itself has been installed forever... this is not a new setup...

It was working perfectly over a month ago.

Hmmm, would a restoring of TWRP backup reset the SN in Magisk?

I had done a full TWRP Backup one morning as I had to reset the device due to an abnormal battery drain that wouldn't correct itself.

Reinstalled OOS, and it fixed the battery issue and restored the TWRP Backup.

So I guess I just need to go ahead and download the API...right?
[Magisk] zgfg:
Yes, don't worry, do what SN checker asks you
[Magisk] pndwal:
My interest was peaked a while ago in the efforts of a member trying to install Magisk fully (w/ Magisk app and Universal SafetyNet Fix module) before ever booting to system, and we had a conversation in USNF thread.

I have a hunch it may get your interest too.

Spoiler:

The goal was to "bypass the activation (enrollment) to the MDM. In my case, the MDM is BlackBerry and the enrollment takes place right after filling the Google account on initial setup with "afw#blackberry" ". In his case, he also needed to bypass "the SafetyNet of the MDM":

He actually succeeded in installing Magisk app w/ ADB as well as USNF module from CLI:

I asked him in my next two posts to clarify his methods, especially for installing modules thru CLI (using TWRP Terminal as CLI to perform "magisk --install-module [path_to_your_module.zip]" I put link to John Wu's document here too):

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-1-1-0.4217823/post-85216365

My summary of his goal / achievement here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-1-1-0.4217823/post-85220033

and he responded with this:

So, seems you can achieve your goal w/ Android, but may be impossible w/ Apple! (Thanks for that Google! 😜)...

Really hope this helps.

Nb. I think you may need to abandon stub installation as already indicated, and try these methods to get Magisk App (pre)installed as per a normal installation. Generally you never download stub which is called if hiding Magisk App automatically via a json file. All that is really needed from GitHub assets is Magisk APK, even if you rename to a .zip for custom recovery install or uninstall.

🤠 PW

Edit: Pipped to the post (above).
[Magisk] zgfg:
See #46596 (was little faster 😍)

They have even the same phones (since it was relatively recent, they are maybe from the same company?!)
[Magisk] pndwal:
Proprietary just means it's not open source Apache etc licenced code and can't legally / properly be included with a custom package like Magisk...

Bit like LineageOS, John is crossing his Ts and dotting his Is.

Other custom ROMs (incl. unofficial LOS) do include proprietary Google Apps for example, but Google could issue them a Cease and Desist as they did with Steve Kondik's CyanogenMod.

Google since that clarified that while proprietary code cannot be bundled with a custom mod, it can be sideloaded by an individual user separately (device itself is licenced to use Google proprietary code, or whitelisted (in theory) to qualify if uncertified China region etc device on custom ROM, whereas a custom mod itself isn't) hence the existence of OpenGApps.org etc.

I think by asking for a decision from the user, this method would qualify (legally?) as a sideload. 😜 PW
[Magisk] pndwal:
Haha, yes just saw that, but thought you weren't so interested 😉 (only quicker cos I had no time earlier today, then spent time on the detail 😜).

Yup, same thoughts crossed my mind; same MDM program using blackberry? PW
[Magisk] PickRickle:
Very interesting since we did something very similar at first. (I suspect a colleague of having used this forum) In theory the process worked on our own fleet, but the targeted profile was more severe and prevented the enrollment if the boot was flashed with Magisk despite MagiskHide and SafetyNet Fix. This was probably a detection specific to UEM BlackBerry (application that is installed during enrollment) rather than that of SafetyNet. However, it did not detect the unlocked bootloader, so we joined the fleet without a flashed boot.

(Note: concerning that, at this moment, we were unable to install systemless from Magisk CLI, maybe thanks to that we could have bypassed the detection)

Therefore ADB can no longer be used to install the stub even when changing system files. (properties, global_settings.xml, persistent_properties)

So back to the starting point, we have to install the stub without going through the system. (Or understand enough how MDM works to re-enable ADB.)
[Magisk] PickRickle:
Interesting, but the problem is that MDM will install apps. We want to analyze these applications dynamically. But the MDM probably resides in part in the /data. So by transferring /data, we also transfer the MDM and its restrictions.

And it seemed to us very likely that some applications use IDs or keys (keystore) and would no longer work once installed in another phone. (A track explored in parallel)
[Magisk] PickRickle:
Okay that's definitely one of us. This method was perfect until the targeted MDM specific profile managed to stop the enrollment by detecting the flashed boot. (Or perhaps by detecting filenames or other since at the base, the SafetyNet test is bypassed, so it must be a detection specific to BlackBerry at the request of the administrator)

If you tell me that installing the stub without access to the application is impossible, we must return to this idea of bypassing enrollment, but looking for what "betrays" us. I don't think we tried to enable Magisk's "systemless" from the CLI, maybe that would be the last idea on that side.
[Magisk] PickRickle:
Unfortunately, I've tried to patch the recovery, but FP3 is a A/B device. So the recovery.img is integrated inside boot.img. It is not clear how to perform the recovery patching in this context.
[Magisk] pndwal:
I got my head around the previous users efforts to a limited degree, but I don't fully understand your obstacles (or MDM usage for that matter).

Not sure of the full workings of a stub either. @osmosis would know and might help... or @Didgeridoohan... I do know that stub is normally called by Magisk app if you select Hide Magisk App, and that Alpha builds will use a local version when the stub cannot be downloaded.

Not sure why you say SafetyNet test is bypassed but MDM detects flashed boot or something... I imagine that if you haven't installed USNF module either by CLI or other means, you will be failing SafetyNet, and MDM will almost certainly be seeing this if it checks SafetyNet at all....

But then a lot of this is going over my head. 😜 PW
[Magisk] pndwal:
Magisk in recovery is only for type III devices as described here:

https://topjohnwu.github.io/Magisk/boot.html#piecing-things-together

Yours is type IV, w/ hybrid ramdisk in boot partition so a) there is no need, and b), while some type IV devices do come w/ recovery_a/_b partitions, most are "USES_RECOVERY_AS_BOOT" devices and don't.

https://topjohnwu.github.io/Magisk/boot.html#some-history

👍 PW
[Magisk] Didgeridoohan:
I have not followed the going-ons in this thread for a couple it weeks, so I have no idea what the context is here... I'll try to read back and see what's going on.
[Magisk] PickRickle:
Thanks you for the links.

Actually I say "SafeNet is bypassed" because the method provides a successful test. But when the later is used against the target MDM, there is a flag. So the detection should come from the custom functions of the MDM application rather than the SafetyNet API. This is a hypothesis.

Actually the MDM can enable SafetyNet detection or not. (We have our own MDM to test profiles) The targeted MDM probably does not use it.
[Magisk] midgo12:
Hi Guys.

So I have stupidly hidden Magisk manager from view and did not take notice of the hidden file name.

I have searched but cannot find an answer on how to reverse this procedure.

How can I restore the advanced settings and unhide Magisk again.

Any help appreciated...

Edit.

I used the Uninstaller.zip to uninstall and then re install current Magisk 23.zip to solve the issue...
[Magisk] BillGoss:
It will have an icon like this in the App drawer (different name, possibly Settings)
[Magisk] midgo12:
Thanks for the reply.

I ended up uninstalling and re installing to solve the issue...
[Magisk] pndwal:
New name default is simply "Settings" if you didn't set your own. 😜

Just open that (once found; look thru apps list in device settings), and select Restore the Magisk app. 👍 PW
[Magisk] ipdev:
Side note:

To clear/reset Magisk, you need to delete /data/adb/magisk.db

Magisk will regenerate magisk.db on (re)boot.

Helpful if your Magisk install becomes corrupt, sometimes just regenerating magisk.db will fix the issue(s).​

Cheers. :cowboy:
[Magisk] Tkkg1994:
It was never made to pass safetynet. It is a way easier to make systemless mods instead of applying to system. Like this you can have a full custom rom without even touching /system partition

Sent from my SuperMan powered SM-G930F
[Magisk] dabenaute:
Pogo works again for me I just used selinoxchanger to get enforcing and then root switcher for disable root access and the last version of Pogo

Envoyé de mon SM-N930F en utilisant Tapatalk
[Magisk] Radit26:
How do I re enable a module? I disabled phh supersu so i can use my barclays app, how do i enable it again? I can't open magisk app cause it says i don't have root.
[Magisk] Papote3:
Go to the /magisk folder in your root directory and inside the phh folder there should be a file named "disable" delete that file and it should enable the module after a reboot

If you can access /magisk folder, try from recovery
[Magisk] cubandanger05:
Me doy por vencido. Nada me funciona XD.
[Magisk] Ninoh-FOX:
Ya te digo, con ese archivo tienes selinux enforce pero nada de nada. Safetynet funciona pero pokemon go dice que te peines.

I said that Selinux enforce work with my mod suhide 0.55 (0.56 2) and safetynet work too... But pogo (0.41.4 or 0.35.0) not works...

I have magisk v7, suhide mod, busybox systemless, xposed 86.2 mod for not check su version and supersu 2.78 sr1systemless.

Enviado desde mi E5603 mediante Tapatalk
[Magisk] dl200010:
I can get that. Would a backup of the boot partition help?
[Magisk] cubandanger05:
There is definitely something not working properly with safetynet.

-I switched roms, one that comes unrooted.

-Installed gapps

-Started Android Pay, and in the middle of adding the card it said that it couldn't verify (whatever it is it can't verify), so I closed it out, went back in it and was able to add the card

-I then opened Pogo, same story. So I tried a different account thinking I was banned and the new account worked. I logged out, tried the first account that didn't work the first time and it worked the second time.

-I opened Safetynet Helper and it gave me the CTS error. Then I it again and it passed.

-Same thing with Safetynet Playground. Works when it wants to.

What the F....?
[Magisk] tdurdenn:
Can you install this with 5.0 kernel but a 4.4.2 bootloader?
[Magisk] Artim_96:
It could work in some extend, since for my understanding the boot.img should be seperate from the bootloader, but it's never recommended since systems often have malfunctions with outdated bootloaders or modems etc
[Magisk] gudenau:
Is there any way that this could new installed without tripping the safety net thing?
[Magisk] edyny1:
are you running marshmallow? and which selinuxchanger did you used?
[Magisk] dabenaute:
I'm running on MM phronesis n7 port for n3 v3.i used SelinuxModChanger?

Envoyé de mon SM-N930F en utilisant Tapatalk
[Magisk] dabenaute:
All is OK with safetynet

Envoyé de mon SM-N930F en utilisant Tapatalk
[Magisk] Kursem:
I have a Galaxy Grand Duos (Gt-i9082) device. I'm using a custom rom, RR 5.7.4 (Marshmallow) and it has stock 4.2.2 bootloader. I have a problem but unfortunately I can't give a log. This is what I do:

Flash custom rom > Flash Gapps and SuperSU 2.78 SR1 > Install Magisk Manager 2.0 > Flash Magisk v7 > Flash topjohnwu's systemless Xposed v86.6

then, I lost my root access (superSU say no SU binary found). then, I flashed phh's superuser r259 and it causes bootloop. Any insight on what to do? I've recovered my phone and I'm going to check if it will lose my phone's root access again
[Magisk] teddy0209:
After you saw that notification, a reboot would fix it...
[Magisk] Exordos:
Is there any way to uninstall Magisk without wiping my phone?
[Magisk] Rhoban:
Have you tried... I don't know... Using the Magisk uninstaller zip?
[Magisk] Exordos:
Wait. There's an Uninstaller? If there is, I really apologize.
[Magisk] Kursem:
although Xposed work flawlessly, after a reboot superSU still say I still don't has SU binary (no root access). any other advice?
[Magisk] 73sydney:
That tricks saved my bacon many times over a few years

I also back it up and restore it on new ROM flashes, install magisk, put it back, reboot and then rename magisk app, before restoring my apps...then by default none of them can detect root on install. Its the partly (along with restoring the original Android ID i used on original ROM setup) how i keep everything (Galaxy Watch connection, Samsung Pay, banking apps etc) working across ROM flashes with my Migrate backups...

Oddly ive never corrupted one doing that :)
[Magisk] zgfg:
If the Installation of new ROM (like OTA update) does not delete Data (like Factory resetting), then you don't need to do any restore of /data/adb - just flash the new patched img to get Magisk (with all modules, root granted and MagiskHide enabled apps)
[Magisk] 73sydney:
Sadly/sorry im talking about clean flashing or switching between ROM's to test...that requires a factory reset after ROM flash
[Magisk] Tabs78:
Hi, i use now TV italian version but detect root. Is It possible solve?
[Magisk] pndwal:
An app? Please check hiding basics:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-85304985 🙂 PW
[Magisk] Tabs78:
hi,

i use oneplus 8 pro, magisk pass safetynet test, the italian app NOW detect the root.

i'm using magisk hide, in log under this up it say skip.

i tried to set off and on magisk hide, reboot, reinstall app
[Magisk] pndwal:
A few thoughts:

1) Please ping those helping you on XDA by using reply button (to quote) or by including a user mention, or they won't be informed of your reply.

2) Please clarify:

... and which Italian TV app? (If SkyGo ita or similar, 4) & 5) below should help you.)

3) You didn't mention if you

- have 'Device is certified' PlayProtect status in PlayStore settings.

- hid Magisk App in App settings.

- hid (tv) app from root in MagiskHide list.

- wiped (tv) app's data, set up & tried again AFTER all above.

- read the wiki.

... If you have done everything in my basics checklist, then:

4) you likely have issues with isolated process detection (specifically the Digital Rights Management related VGDRM Helper service).

There are a number of current efforts to hide isolated processes. I recommend trying these by canyie:

- Riru - MomoHider module (aka IsolatedMagiskHider)

- Momo app (Detection app: check verbose log too)

You can also try:

- riru-unshare module (Enhanced mode for Magisk Hide by vvb2060)

- Magisk Detector app (Detection app by vvb2060)

Links for these solutions and more comprehensive information here:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-85300227

5) You could try a more specific isolated process solution that simply blocks problem services, working for a number of TV apps if it uses VGDRM Helper service (or similar) Isolated process:

- Download AppManager

https://github.com/MuntashirAkon/AppManager

- Open and check Services tab for your app, and block the VGDRM Helper service (click on the crossed circle icon) and click 'apply rules' in top (3 dot) menu.

- Thanks to @Longhorn87 for this solution! 👍

https://xdaforums.com/t/skygo-app-detected-root.4128933/post-84688731

Nb. There may be other useful tips in that thread for detection issues w/ TV / streaming apps etc.

6) If you do have PlayProtect 'Device is certified', you may have a Widevine certification issue.

Use DRM Info app from PlayStore to check if Widevine CDM security is 'L1' (HDCP level 2.3?) on your device. If so, all should be good here.

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-85232477

Many tv / streaming apps work with limited functionality / lower video resolution if limited to 'L3' but some may require L1 to work at all.

If not on L1 you may need to search for a solution to restore this specific to your device. It seems some devices can be restored by flashing Vendor or other, but w/ other devices it may prove impossible to regain L1 once widevine is tripped even w/ bootloader lock, and some may not retain L1 at all (unsure about this) once unlocked.

Hope something here works for you. 🤠 PW