yashsingh1/xdaforums huggingface dataset:
[Magisk] akhil093:
Game over! Passing both tests till this morning but google rolled out some patch. Now no more safety net pass (even with forced basic check).

Can anyone share some info about this new mysterious updated rolled out in background?
[Magisk] Didgeridoohan:
I wouldn't call it game over just yet...

First, have you made sure that MagiskHide is enabled and if it is to toggle it off and on again? Sometimes works wonders...

Second, no mods installed that could trigger SafetyNet?
[Magisk] pndwal:
Ah, well the timing is everything here.

Stable channel was updated from 20.4 (which was never going to work w/ A11) to 21.2 some 36 hours ago (from now). Your initial attempts and requests for help began well before that.

https://xdaforums.com/t/guide-how-to-root-n20-ultra-n986b-n9860.4147023/post-84257963

so you were initially trying to root Android 11 using incompatible v20.4.

By the time you posted a screenshot for @dr.ketan, this stable channel had updated to 21.2 and showed as latest on that channel, so he has simply missed the fact you had actually been using old stable 20.4 w/ A11 instead of the then-required BETA 21.2.

Now that the latest 21000 series (A11 compatible) Magisk is available on Stable channel, your later attempt has worked of course... PW
[Magisk] Lughnasadh:
There are several Pixel 4 XL users (actually, every Pixel 4 XL user I know) who started failing ctsProfile (with basic) this morning, with both stock and custom kernels, stock and custom roms, and MagiskHide enabled, where everyone was passing last night. It seems that Google did some sort of server side change overnight. Haven't tried to change fingerprint yet, but thought I'd pass this info along.

EDIT: Also, after updating Magisk Manager to 8.05 yesterday, I checked and it was still passing. Did not update to Stable 21.2 because I was already on Beta 21.2
[Magisk] nowster:
I went out for a walk earlier. Before I went out I was passing both. When I got back ctsProfile was failing. No reboot.

Toggling MagiskHide has no effect.
[Magisk] Didgeridoohan:
@Lughnasadh @nowster

There's been several reports here along the same lines right now, so it's very possible that Google for something.

I'm still passing on my devices, but they're old and have basic attestation out of the box. Maybe they're detecting the model change (wild guess)?
[Magisk] pndwal:
As long as you can 'force' basic attestation your issues can most likely be rectified fairly easily.

As John Wu has indicated, the 'Game Over' scenario is when Google implements HARDWARE key attestation across the board.

Then we will see evalType = HARDWARE, and no simple model prop mismatch, or similar trick, will cause the fallback to BASIC it does at present.

So, If Magisk be the food of love, play on;

Give me excess of it, that, surfeiting,

the attestation may sicken, and so die...

(What You Will)

Never Say Die... PW
[Magisk] nowster:
This is failing with forced BASIC. Passing one hour, failing the next.
[Magisk] MoL_82:
I have the very same issue, also since today. evalType: BASIC, but ctsProfile fails.
[Magisk] @kitokit:
Same here, failing safetynet ctsprofile..mi 9 custom rom. But still can use my banking apps..
[Magisk] aringler:
Awesome, hat worked for me!
[Magisk] J_Force:
So glad it finally worked out. Thanks a lot for explaining. Always interesting to learn how it all started and in the end worked.
[Magisk] pndwal:
Yes, this may be more difficult than I expect, and I was expecting to see evalType = HARDWARE as endgame...

Could still be a bluff though... I'm still hoping someone can call their's. 😬

Anyone with failed ctsProfile on stock ROM tried changing fingerprint using MagiskHide Props Config?... just in case?... PW
[Magisk] pndwal:
... Well they called mine!... ctsProfile Failing on Redmi Note 8T also... and was passing 30 minutes ago... 🤐 PW
[Magisk] zgfg:
Indeed, my Xiaomi Mi 9T is also failing as of today afternoon
[Magisk] nowster:
I'm on stock ROM on Pixel 3a.
[Magisk] HippoMan:
All the more reason for a significantly increasing amount of time and effort to be put into one or more mobile systems that are completely divorced from Google, IMHO. microG is one such solution, and although it generally functions, more work is necessary. And there are other possibilities which can be worked on.
[Magisk] Lughnasadh:
@Didgeridoohan

Just a little more info. I am, and have been, on basic attestation (without doing anything, stock rom and kernel) and have been for a while. And this morning's check says I'm still on basic attestation. It's only ctsProfile that's failing. I've never changed the fingerprint on my phone.

I see others have said similar things put I'll post this anyway.
[Magisk] ThrashWolf:
I'm running stock on my s20 and changing the fingerprint did nothing.

Man am I sick of Google forcing us to choose between having control of our devices and being able to actually use them.
[Magisk] kebong:
How ****ed am I
[Magisk] zgfg:
Haven't I seen somewhere today: use EdExposed (not Riru) and fix SafetyNet.

Not sure is it hoax - did somebody try
[Magisk] J.Michael:
You would need to convince a bank to let its app run on a device that does not provide Google's seal of approval. At which point you could run the app on Android. So developing a new mobile system doesn't solve anything.
[Magisk] Didgeridoohan:
Wouldn't be surprised if that's HiddenCore, and that is mainly cosmetical and doesn't really pass CTS (unless they've changed something recently)...

It might help with apps that doesn't do proper SafetyNet checks though.
[Magisk] woozie.2007:
hello, pleae help me, i updated magisk now and my phone is stuck in fastboot, i can't do anything, xiaomi mi 9t without twrp, please help me to start the phone, thank you
[Magisk] zgfg:
You have official TWRP 3.5_0.9

I don't know for custom ROMs, but I have no problem with Magisk 21.2 (Canary) on Xiaomi.eu A11 MIUI 12.5 beta, and didn't have previously on the official MIUI 12 (also Mi 9T)

You must have patched boot img, not recovery, with the Recovery unticked
[Magisk] woozie.2007:
i had patched boot before update magisk, after update the phone doesnt boot, only in fastboot, i have stock firmware, only root by magisk, worked very well before update magisk, what to do? Thanks you
[Magisk] woozie.2007:
i dont want to install twrp, i only want stock firmware with magisk, thats all
[Magisk] Mast3r.71:
after update some of my apps like ES File explore or Termux cannot detect root

im using huawei p10Lite EMUI8
[Magisk] HippoMan:
Part of my proposed efforts includes trying to convince banks of this very thing.

Right now, some of those banking apps' security measures are poorly thought out, at best. My banking app detects root even when SafetyNet is passing. However, if I use a browser app on that same device to go to that same bank's web site (after setting User-Agent properly), I have access to most, if not all of the banking functions that the app itself is not permitting.

My desktop computer is "rooted", like all of ours are. Software can be run as "root" or "Administrator" on these computers, and web access to banking sites is still permitted via my desktop machine. Banks need to be educated that having root alone is not intrinsically a risk, in and of itself. They are just too lazy to implement meaningful security, and they use root checking as the easy way out.

I want to try to convince banks to allow me to opt out of their security checks on my rooted device if I sign something agreeing to not hold them responsible if I am hacked. After all, my root-enabled desktop computer could also be hacked, and yet the banks are willing to let me use their web software from those computers.
[Magisk] J.Michael:
I understand your position. I agree with your position. But I believe the only change that will result from "educating" banks will be them closing off more options.
[Magisk] woozie.2007:
here i did the mistake, i had ticked recovery and i flash like that, how to reinstall or revive the phone ? please give me a solution if you have one, thanks
[Magisk] J.Michael:
Have you tried flashing the stock version of anything you patched-and-flashed? If you're not sure what you did, flash the entire stock ROM.
[Magisk] HippoMan:
You're probably right. But I still want to try.

Another possibility is someone selling some sort of super-cheap, specialized, limited-functionality smart device that let's people run banking apps and not much of anything else. Then, they could use that device for contactless payments and still run their normal Android devices in rooted mode.

Another possibility: someone creates a "dual" device that goes beyond the functionality of current A/B devices. On this proposed device, an entire Android system could run in each partition, and there could be some means for switching between the two Android systems in real time. This would have to be implemented via hardware, not software. Then, one such partition could be rooted and the other one not rooted, and the banking apps could run in the non-rooted partition. For all intents and purposes it would simply be two android devices in one container.
[Magisk] woozie.2007:
i succeeded to reflash recovery and the phone booted normaly, i patched again boot.img and flashed it via fastboot, now magisk works normally but cts profile not passed the test, but viper module works good and other apps that need root, what should i do to pass the cts profile test?

my bank app doesnt work, please help me, thanks
[Magisk] AndDiSa:
Since today all my (rooted) devices are falling SafetyNet with the following error:

"safetynet can't access google play services"

Did Google probably change the protocol ?!

Btw.: PlayStore is still certified and banking apps are working, too ... at least for the moment

Edit: looks that this message can be thrown when Google is limiting the requests for the API
[Magisk] Chaplan:
Buy a flying DeLorean and revert 24h. Only known fix at the time, but mileage may vary.

Now really, it's all over the thread, CTS not passing for HW attestation devices. We shall see what comes in the near or not so near future. Fingers crossed.
[Magisk] pndwal:
As of a few hours ago, this is EVERYONE'S problem it seems... Just watch this space... PW
[Magisk] pndwal:
Interesting... Where do you see error message? PW
[Magisk] AndDiSa:
A different SafetyNet Check:

SafetyNet Test - Apps on Google Play

SafetyNet device compatibility test

play.google.com
[Magisk] zgfg:
Flash your original, not-patched boot and recovery img, reboot and patch the original boot.img again

Edit: I see that you have resolved.

And CTS is failing, don't 'worry'
[Magisk] woozie.2007:
Thank you guys, i will wait for topjohnwu will fix this
[Magisk] sisqoboy:
Just updated my magisk from a recent version and saftynet - ctsProfile is not passing.

Hide magisk on and off - done

Reboot - done

:/ not sure what else I could do atm.
[Magisk] AndDiSa:
My Huawei tablet I did not touch for weeks now and SafetyNet is failing suddenly. Either there is a problem on Google's side or ... Google changed again the protocol/identification method.
[Magisk] nowster:
Not just you. Everyone's having this problem.
[Magisk] zgfg:
Why do you expect him to 'fix'?

Almost a year ago, when Google started then with Hardware CTS eval and failing CTS, he changed Magisk hide to become Off by default, commented on Twitter that who is turnning it On becomes responsible for himself does it 'work' or not and requested that Issues must not be reported for failing SafetyNet

The trick with Force Basic was not invented or promoted by him

Magisk still roots, even on read-only SAR you can enjoy its benefits.

SafetyNet does not declare that your phone is rooted (that's how banking apps and similar interpret to the average Joe), just that it does not pass a matrix of requirements as defined in the SafetyNet API
[Magisk] pndwal:
I don't care about mileage; do you know a RELIABLE agent? 😐

Anyone with stock / locked device and Magisk Manager: Please would you confirm Safetynet is still currently passing for these! 👍 PW
[Magisk] 14christ:
This may have been stated but please forgive me if so.

Ever since i updated magisk on the oneplus 7t stock rom my franco kernel manager and substratum status bar icons do not initiate until i start each of the apps.

For instance, franco kernep manager i have battery stat notifications and substratum i have custom status bar icons. But after a reboot my status bar icons nor my battery stat notification are active until i start each respective app.

I tried flashing back to magisk 20.4 and 8.0.4 and the problem went away. Im going to stick with 20.4 and 8.0.4 for now just thought i would let you know.
[Magisk] x.trinity:
I have same problem. Ive installed ES File Explorer with a root permission, and Ive faced a root access problem..
[Magisk] XtraWater:
Did you check manually in supersu if root rights are still on?
[Magisk] DiamondJohn:
A little OT, but I personally use MiX with no issues with root.
[Magisk] Tiemichael:
Same issue here on Poco F2 Pro with stock Android 11, Magisk 21.02 since a couple of hours:

Safety Net fails, Root working, banking apps seem working
[Magisk] J.Michael:
Have you checked Android Settings -> Apps -> Termux

There should be a section "Permissions", you might be able to grant permission there.

(I assume " Termux cannot detect root" means "Termux is not requesting and being granted root".)
[Magisk] zgfg:
You don't grant root permissions through Android settings

Instead, in Magisk Manager, Superuser, see iif that application is listed but not enabled - just enable and voila

It happened to me couple of times for some apps, I manually ensbled and everything will be ok
[Magisk] curiousrom:
I was a ES File Explorer Pro 1.1.4.1 user for a couple of years while blocking it's internet access to prevent it from sending data to the mothership but it's broken on my Galaxy S5 G900M LineageOS 17.1 klte build 2021-01-10 + Open GApps Pico + Magisk 21.2 Stable + Magisk Manager 8.0.5 + TWRP 3.5.0 recovery.

OTOH @HootanParsa's [APP][2.0+] MiXplorer v6.x Released (fully-featured file manager) rooted with Magisk works really well with advanced features & nice optional add-ons.

***

Maybe I'm nitpicking here but as seen in the screenshot it's > Magisk Manager > Superuser.

SuperSU was created many years ago by the famous dev Chainfire, sold & is now deprecated for recent Android versions.

***
[Magisk] zgfg:
I have Huawei Mate 9, but it's old, EMUI 9.1/Pie.

Bootloader never unlocked, and it still passes - screenshots
[Magisk] x.trinity:
Yes, sure..everything looks fine.. I needed ES just for the puropse of uninstaling a system file from the root (I remember ES never failed on uninstalling root/system files..now I resolved my problem, so Im MiExplorer user again.
[Magisk] Didgeridoohan:
That's a popular app for checking SafetyNet, and Google limits how many SafetyNet checks an app can make (unless you apply for and are granted more), so maybe the recent craze of Magisk users checking if they pass CTS have eaten up that apps allotted checks.
[Magisk] curiousrom:
Same here. The SafetyNet Test app (last updated October 2, 2018) is crap & also says "Can't access Google Play Services" Update 2021-01-15: the app now says Pass on my Galaxy S5 G900M LineageOS 17.1 klte build 2021-01-10 + Open GApps Pico + Magisk 21.2 Stable + Magisk Manager 8.0.5.

A bunch of other SafetyNet test apps all say Pass including Magisk Manager.

***

Interesting. Thanks. 👍

***
[Magisk] x.trinity:
Same scenario here. I was quite satisfied with ES, a bunch of options, beautiful GUI, then I read somewhere its a backdoor, so I changed it for MiExplorer which is a light year ahead in comparison to ES (Pro).
[Magisk] zgfg:
Yes, MiXPlorer is great app, Im using for three or four years on various rooted and not rooted phones

Even on my never rooted Huawei Mate 9 (Bootloader originally locked),Pie, SAR read-only, I can fully read (not write, ofc) System, Vendor, all except Data

However, if you have A11, check does MiXPlorer correctly see all folders in:

- Internal memory, /Android/data and /Android/obb

- /data/data aka /data/user/0, and /data/user/999

For me (MIUI 12.5, A11 beta), it opens the folders but doesn't display the full content (e.g., in /data/data displays only its own folder)

If it doesn't display those folders properly, then use MiXPlorer beta (actually, difference is strange, official is for SDK 30 aka A11, but beta is for SDK 29 aka A10), and with beta it displays properly.

The same was discussed/confirmed by some other A11 users in the MiXPlorer thread
[Magisk] curiousrom:
I agree & I'm nitpicking again but it's MiXplorer. ;)

***
[Magisk] x.trinity:
I'm rooted and still on A10.

I will wait for a time being ,till everything set down..
[Magisk] shchukax:
I got the ctsProfile failed this morning too. I think this was caused by google changing something in Google Play Services. I have pixel 4 with stock rom (apart from twrp). Here's an interesting observation: I have magiskhide enabled and previous selected Google Play Services as one of the apps to hide magisk. When I checked this morning, all other apps were still selected, however Play Services was unselected! This is rather strange. Google Play Services get updated automatically regardless of whether you want it or not. Maybe they changed some package names and that doesn't match what Magisk expects? That could also, potentially, explain why magisk isn't working any more - as it's trying to use the "old" version of GMS.
[Magisk] zagi988:
Same on Xperia XZ1 with latest Magisk and LOS 17.1... Failing from this morning. When I woke up I was greeted with a notification that my phone is no longer eligible for contactless payments. So something has changed obviously.
[Magisk] mx597turbo:
Is the cts fail also happening on Android 10? Seems like all the posts I've seen are A11.
[Magisk] zgfg:
Just checked on my side, but I still have correctly GMS enabled for Magisk hide but it doesn't help (CTS failing since yesterday).

I even enabled all activities, rebooted (they persist enabled) but CTS still failing
[Magisk] zgfg:
Thanks, I tried this morning again with that checker for my Mate 9, Pie, Bootloader locked and it happily passes
[Magisk] 7wells:
Hello, since the update from the Magisk framework v21.1 to v21.2 today (from the official Magisk manager), my Samsung S7 (stock ROM 8.0.0) hangs in the boot process, showing the pulsing Samsung logo.

I have flashed (back) to previous Magisk versions via TWRP 3.5.0_9-0 (tested Magisk framework versions 21.1, 21.0, and 20.4) but all to no avail.

PS1: After flashing Magisk-uninstaller-20201228.zip, the S7 boots again. :)

PS2: And after flashing Magisk 21.1 from TWRP, the S7 also boots, so everything is back to normal. :D
[Magisk] fubo73:
Here is a solution for safetynet (reported by Evo X team):

GitHub - kdrag0n/safetynet-fix: Google SafetyNet attestation workarounds for Magisk

Google SafetyNet attestation workarounds for Magisk - kdrag0n/safetynet-fix

github.com
[Magisk] zgfg:
Ok, so kind of expected - Google forces Hardware although showing Basic eval type (they are also faking now, trying to mask what they do) and they don't get tricked anymore with faking ro.product.model

keystore: Block key attestation for Google Play Services · ProtonAOSP/android_system_security@15633a3

In order to enforce SafetyNet security, Google Play Services is now using hardware attestation for ctsProfile validation in all cases, even when basic attestation is selected. The SafetyNet API res...

github.com
[Magisk] tasar01:
Hi,

today g-pay plopped up with root message and all my cards are now inactive on google pay, safeytnet test now with ctsprofile mismatch.

Xiaomi 10pro with latest Android10 Xiaomi.eu rom 20.6.18. Magisk V21.0, cant update to 21.2 because still ends in bootloop.

Any solution?
[Magisk] AndDiSa:
No, it's not only Android 11. My Huawei Tablet is on Android 9 and is failing since yesterday, too.
[Magisk] 7wells:
However, after flashing Magisk 21.1 from TWRP and botting the S7, Magisk manager (v8.0.5) shows no framework installed ("N/A"). When I flash v21.2 from Magisk manager and try to reboot my S7, it again hangs on the boot scren with the pulsing Samsung logo (i.e. the same as when flashing Magisk v21.2 from TWRP).

And despite there was no error message when flashing the previous Magisk framework version v21.1 from TWRP, the framework does not seem to get properly flashed, as shown with "N/A" in Magisk manager and also obvious because root-requirering apps do not seem to properly work.

Do you have any suggestions how I can drill down the root cause of the problem and eventually solve it? Thank you.

PS:

Updating the Magisk framework from v20.4 to v21.1 on a Google Nexus 4 (mako) via Magisk manager was without problems.
[Magisk] Gooch4130:
How do you implement the solution? Looking for exact steps :), pardon my ignorance on this.
[Magisk] dunderball:
Happening to me too on my 3a while using a fingerprint of the 4a. I hate to sound dramatic but I'm pretty certain we are getting close to the end. Most annoying thing will be relocking my bootloader which performs a wipe.
[Magisk] Didgeridoohan:
It's been discussed quite a lot the past 24 hours... Most users are experiencing the CTS failure.

But, if you're on Android 11 you can try this:

https://github.com/kdrag0n/safetynet-fix
[Magisk] Didgeridoohan:
You need the Magisk module that's linked in the post that the post you quoted quoted (wow). Or that I linked just above.
[Magisk] Fentadroid:
It perfectly works on my Pixel 3a.

Thank you very much!
[Magisk] pndwal:
This certainly looks promising 👍 ...And sheds much light to boot!

Seems Danny Lin (kdrag0n) is working on this as we speak... I'll be watching this space for sure!

Many thanks for heads-up. PW
[Magisk] bartleby999:
Not sure if it's particularly helpful but I'm still passing SafetyNet - Stock Rom, Unlocked Bootloader, Custom kernal & Recovery. Android 9. It's a Tab S6.

I think the most relevant thing here though may be that I do not have this GooglePay app installed that users reported being updated prior to failing CTS.
[Magisk] pndwal:
👍 Thanks!

Also, did evalType ever return HARDWARE? And have you 'forced' fallback to BASIC? PW
[Magisk] zgfg:
It has nothing with Google Pay - I don't have the Pay either on my A11 where it fails now.

It was explained in the other posts what Google changed (it affects new phones that support Hardware eval type) and in the MHPC thread (not in MHPC module) there is a link for fix
[Magisk] bartleby999:
No. Haven't had any problems passing CTS at all since the first time it eval'd as Hardware and I set a custom prop to force it to Basic a couple of months ago.
[Magisk] zgfg:
Thanks to safetynet-fix by kdragOn, back in business on the rooted Xiaomi Mi 9T, Xiaomi.eu A11 beta:

https://xdaforums.com/t/module-magi...p-edits-and-more-v5-3-6.3789228/post-84281267
[Magisk] Nuqlear:
I can confirm that safetynet-fix works for me on Pixel 4 Android 11.

Though I also had to clear the cache of google play and reboot to get rid of "device uncertified" error.
[Magisk] mx597turbo:
Another confirmation the kdragOn safetynet-fix works. This is on a Pixel 4a 5g with 3xl fingerprint running the January update.
[Magisk] Gooch4130:
C'mon - thanks for the 'wow', this is the answer I needed:

"Download the code as a zip and repack it so that the module files and folders are directly in the root of the zip rather in the "safetynet-fix-master" directory. "

I have not pulled code from git directly and usually download the prepacked zips. Once I knew the zip had to be repacked, installed with no issue. I supposed I deserved it. As an aside SafetyNet passes now on my Pixel 4 with Android 11 (January 2021 patch).
[Magisk] mx597turbo:
Android 11 Magisk Module. Passes Safetynet.
[Magisk] Didgeridoohan:
The wow was for the tongue twister of a sentence... Sorry, should have been more clear.

Glad you got things sorted despite my antics.
[Magisk] pndwal:
Path to zip from author, Danny Lin for Telegram Users:

https://xdaforums.com/t/rom-pixel-5-official-protonaosp-11-3-0.4188129/post-83887319

Click his Telegram link from OP here.

Direct link:

Telegram: Contact @proton_p5

t.me

Might be best to go here in case there's further updates; last is only an hour or so old!

Kinda wish I had A11... PW