yashsingh1/xdaforums huggingface dataset:
[Magisk] strikeir13:
I want to add my experience to this thread since I'm having issues recently as well: I unrooted ~2 weeks ago via SuperSU "Full Unroot" command, then I updated to NBD90X via adb sideload shortly thereafter. I had no issues using PokemonGO, but then yesterday, when I tried to use Android Pay, it gave me an error message. I downloaded the SafetyNet helper app and, lo and behold, I got the "CTS profile match: False" status. In an effort to fix the problem, I manually flashed the NBD90X factory images WITHOUT wiping userdata (everything in the image, including bootloader, radio, boot, cache, system, and vendor), rebooted, and SafetyNet PASSED! That was just last night (10/18/16). This morning (10/19/2016), I attempted to add a new card to Android Pay AND IT GAVE ME THE SAME ERROR: "Android Pay can't be used Google is unable to verify that your device or the software running on it is Android compatible." I did reboot after flashing factory images, but a simple reboot shouldn't change my device status for SafetyNet detection...?

TL;DR: Android Pay gave me the "can't verify device software" message, I manually flashed NBD90X (without wiping userdata) on 10/18/16 around 9:30 PM CST, SafetyNet passed successfully. The next morning (10/19/16), SafetyNet did NOT pass despite no changes to my device overnight.

Edit: In another thread, it appears some people are commenting that unlocked bootloaders are tripping SafetyNet: http://xdaforums.com/apps/supersu/supersu-safetynet-android-pay-t3298115/page65 I may try to lock my bootloader and see if that fixes it, even though it will requiring setting up my device again...
[Magisk] Moony22:
Similar issue with me, except safetynet didn't start passing after flashing the factory images (not userdata). Let us know if anything changes or you find a solution!

I would suggest flashing userdata as a last resort, just completely wiping your device. I hope there's a better solution than that though.
[Magisk] Crepusculi:
So Magisk was just updated to v.8, and topjohnwu mentioned this in his updated post:

It looks like there was an update to SafetyNet that is causing failures across the board. I am also seeing the same issue, but have not yet wiped userdata. I'm REALLY hesitant to do that (because duh) as there's no guarantee that it will work.
[Magisk] sakis_the_fraud:
[MENTION=5383238]Moony22[/MENTION] [MENTION=2147991]biggiestuff[/MENTION] [MENTION=6497465]Herohtar[/MENTION]

All those with stock rom, do you have dm-verity on?

It's very strange to fail even with stock rom and recovery
[Magisk] Moony22:
Well I hope it's not something like having to lock your bootloader, because I wouldn't like that at all.

It is just a case now of someone flashing userdata to see if that sorts it out, and if not then we're in deep trouble.

---------- Post added at 04:11 PM ---------- Previous post was at 04:09 PM ----------

I believe so, it's stock kernel and ROM so dm-verity should be on, let me know if there's a more sure way to check.
[Magisk] strikeir13:
There are enough reports in r/Android and r/Nexus6P about unlocked bootloader Nexus devices failing the SafetyNet checks that I am going to wait for a bit before I try anything. If I have to factory reset, I might as well lock my bootloader at the same time to minimize how much device setup I have to do.
[Magisk] Crepusculi:
However, for testing purposes, you may want to do one, then if that fails, then do the other.
[Magisk] Moony22:
True, but we need somebody to make the jump and see if it's purely unlocked bootloader or if just wiping userdata works as well. I may do it on Friday but I'm hoping somebody else tries before then.
[Magisk] strikeir13:
True, once factory reset, it wouldn't be that bad to then relock the bootloader if I just didn't set it up in the meantime.

But FWIW, I have seen anecdotal reports where simply factory resetting isn't actually enough to fix SafetyNet issues. I don't know why that would be, if all the other partitions are fully stock, too, so take that with a grain of salt.
[Magisk] Moony22:
Are those reports with a locked bootloader? If not, we really need someone to factory reset, test safetynet, lock bootloader, test safetynet. Obviously it should work after locking the bootloader, if not then there's literally nothing other than them recording who's ever failed safetynet before.
[Magisk] Crepusculi:
So it was reported in another thread that a wipe of userdata has been tested to no avail.

Just had a coworker test for me. Locked bootloader, never rooted, stock everything N6 on MOB31H, and passes SafetyNet. Not good....
[Magisk] strikeir13:
Saw this in that same other thread:

"So, I flashed everything back to stock yesterday and relocked the bootloader, and passed SafetyNet every single time I tested over the last 24 hours (probably 30 times). I decided for ****s and giggles to unlock the bootloader again. I did a test right before unlocking and passed fine. I haven't done anything else other than unlock the bootloader. Started phone back up, did a fresh setup (didn't restore apps or settings), let everything update, and then tried testing SafetyNet, and am failing again. It is definitely the unlocked bootloader, as there are no other factors at play.

I am using a Nexus 6p."
[Magisk] Moony22:
That quote is absolutely the most helpful. It pretty much confirms at this point that it's the bootloader...I really don't want to lock my bootloader, I've never really had a locked bootloader and I don't know how easy it is to either unlock or deal with any issues while locked (I.e. can I flash system images etc while locked?)
[Magisk] Crepusculi:
You cannot flash system images while it is locked. Additionally, when you unlock your bootloader, it wipes your device

INCLUDING

userdata. Every time. That's why people have been so hesitant to test this step, as it really puts you back to square one, pure stock.
[Magisk] Moony22:
I see, I guess you can only sideload official OTAs and that's it... completely understand why people don't want to do it, honestly I'd rather not use android pay than lock my bootloader, it's just a step too far...I'm willing to wipe userdata, willing to miss root, willing to keep dm-verity, but locking my bootloader... it just removes what I love about Android.
[Magisk] sakis_the_fraud:
From my experience, I don't think that the problem is the bootloader.

I have unlocked bootloader with stock ROM and Kernel, without root, and it passes all SafetyNet tests. Please note that I am on MM.

My problem is none of the suggested methods that hide root is working for me.

I don't know for sure, maybe try this:

From: http://stackoverflow.com/questions/38304435/how-to-enable-and-disable-dm-verity-on-android-devices

here is an answer from John Kozyrakis on his blog post

Anyone tried with magisk v8?
[Magisk] Herohtar:
So I just ran the SafetyNet check again and everything is good. I haven't done anything to my phone. In light of the comment about the CTS check being on Google's end, maybe something was going wrong with the server?
[Magisk] scorpion667:
OnePlus 3 user here - unlocked bootloader/twrp/no root - this setup worked fine last weekend but has been failing SafetyNet verification for a few days (CTS profile match false).

It's the first time since my first smartphone in 2011 that I have used a non rooted phone for two weeks - learning how to do all the things I need via ADP just to have Android Pay working. At this point, I'm ready to throw in the towel and root it. I'll just throw in my credit card between the phone and the silicone case for wireless payments lol. I'll call it the Ghetto Pay

It's too bad - it was extremely convenient using Apple Pay when I had an iPhone 6. Oddly enough even jailbroken I never had a single issue with NFC payments.
[Magisk] Moony22:
Maybe something was wrong with the server when you just passed safetynet, for me it's still failing and I could bet that it might start failing for you as well.
[Magisk] Herohtar:
Unfortunately it seems that might have been the case... it's back to failing again. :\
[Magisk] eXeLes:
I'll add my 5 cents.

Sony Xperia Z2 with MM.

Bootloader was unlocked ~2 month ago, didn't check SafetyNet, but apps like PokemonGo that requires SafetyNet works fine till yesterday.

My phone start glitching a week ago (freezing for 10min) so I decided to do a factory reset.

But yesteray I get another phone (Xperia Z3) and decided not to reset the phone, but install some castom ROM.

And I failed. I could only get root with Kingroot (OneClickRoot doesn't work for me) and it works only till reboot. But I can't install TWRP recovery - it says about errors every time I try. Using ADB doesn't work either - connection (transmitting data) breaks at the point I'm trying to flush TWRP in fastboot.

It was late night so I decided to give up and at that time checked Pokemon GO and it didn't work anymore.

Today on the work I did factory reset but it still doesn't work.

I checked root status and it says root not properly installed (I assume it means no root).

SafetyNet helper says "CTS profile match: false".

So in summary:

Bootloader unlocked (2 month ago).

Stock kernel.

Stock ROM.

Stock recovery (can't verify, but I pretty sure it didn't changed because TFRV failed. I tried to install stock recovery too from TFRM but it says the same - "already installed or other error").

No root (phone been rooted but root resets after restart and I did factory reset after rooting, cleared su in /system/bin, /system/xbin).

CTS profile match: false.
[Magisk] emuandco:
Works flawless here with the current setup in my sig. IMPORTANT is that you have SELinux set to enforcing and disabled root, anything else does not change anything as it seems. I have a custom ROM and a custom Kernel and TWRP and .... everything custom and it is all green now when I use SELinuxModeChanger to set enforcing on bootup and disable root.
[Magisk] sakis_the_fraud:
It's weird to quote yourself :p

Today I had time to test it and it works!

here is my setup:

Sony Xperia Z5 fw 32.2.A.224

stock kernel (dm-verity off)

SELinux enforcing

-------------------------------------------SafetyNet: PASS but NO root

Magisk v8

phh-superuser-magisk-r259

phh's superuser app (from play store)

MagiskManager-v2.1 app

Magisk Hide enabled

-------------------------------------------SafetyNet: PASS WITH ROOT :laugh:
[Magisk] mike2246:
anyone get this to pass with a Nexus 6P?
[Magisk] slickromeo:
Want to hear about something even weirder?

Here is a scenario which you might think is impossible, yet it happened anyways.

Pixel XL ordered from Google Store arrived to me a few days ago.

I'm the first owner

No ROMs installed,

not rooted

bootloader never unlocked.

yet still Android Pay does not allow me to add a debit card because SafetyNet CTS Profile Match fails !!!

Even after a factory data rest !!!

I am completely baffled, and dumbfounded......... Especially since this device is brand spanking new and unaltered.

Google told me to submit a bug report (Which I did), but that isn't fixing anything so far.... Any Ideas anyone?
[Magisk] Yanai1701:
Quote from [MENTION=4125608]sakis_the_fraud[/MENTION]:

This did it for me! I have a custom ROM with custom kernel (SELinux permissive) and SafetyNet failed - even if Pokémon Go worked. After disabling the reading permissions of both files for others (user and group remain readable), SafetyNet passes. :good:

Edit: After a restart the permissions are back to read for others, maybe there is a way to set them automatically at each boot?
[Magisk] DR_HAX34:
How did you change permissions? I can't even change them through terminal using chmod!
[Magisk] jrod3737:
You have all convinced me that Android Pay isn't worth the hassle. You listening Google?
[Magisk] Yanai1701:
I assume you're rooted? I used X-plore, which did it without problems. For root i currently have Magisk v9 in hidden mode with phh's SuperUser r266-2, which are not detected by SafetyNet.
[Magisk] xJovs:
Thanks. If I didn't read your post, I'd be stuck using a Stock Rom with root. (Which is better than nothing but I really dislike stock.)

Anyways, I was able to make an automatic script on boot using Tasker. What I did was make a new profile which gets activated by "Device Boot." (Events -> System -> Device Boot). Then I made a new task called "Permissions" (not that it matters.) and made it run two shell commands.

The first command is: chmod 640 /sys/fs/selinux/enforce

The second command is: chmod 440 /sys/fs/selinux/policy

Made sure both commands use root. Saved everything and double checked that the profile will run the "Permissions" task. Rebooted and SafetyNet Passed without opening any file manager.
[Magisk] mattnin:
Running an LG G4 with CM13. I get CTS profile match false. I tried TWRP into /system/bin and xbin and deleted su and still getting this error :( Is there any way to clear this using CM13? Safetynet blows donkey
[Magisk] MoDat:
I have the exact same issue. Did you find a fix.
[Magisk] danlo:
Add me to this situation as well. Google Support has been useless so far. I saw someone else had the same issue but flashed factory image to resolve it. But don't you need an unlocked bootloader to flash the factory image???
[Magisk] harg0055:
First time poster here, but I had the same problem of having a completely stock unrooted phone fail the SafetyNet check out of nowhere. Was working one day, and then just magically stopped the next.

I tried everything including factory resetting to no avail, so I decided to unlock my bootloader, flash stock recovery, and then instantly relocked it. It's been a couple days now, and I haven't had any issues with SafteyNet or Android Pay since.
[Magisk] slickromeo:
If any of you would like to contact Google specialists referring this, please reference "Re: Your Google Support Inquiry: Case ID [3-5759000014700] " because this CASE ID allows them to access my month-long back and forth conversational dialogue about this Android Pay Bug, it'll also show them that I am not the only one with this bug...

I'm still waiting for a response from them but they keep responding to me every time I message them saying the specialists are still looking into it.
[Magisk] Flint2:
I have a OnePlus 2 with Resurrection Remix 5.8.0 (Nougat 7.1.1) [8/12] http://xdaforums.com/oneplus-2/development/rom-resurrection-remix-5-7-3-t3440731

The steps I did to make it work are:

1-Flash Rom

2-Set Selinux to Enforce (Settings/Configuration/Misc/SELinux Mode)

3-Install Supersu from Play Store, open it and ignore all warnings (don´t update binaries)

4-Complete unroot from Supersu

5-SafetyNet Helper success / success / CTS profile match: true
[Magisk] bega2707:
guys have same issue with this:

my phone fully unrooted no xposed. but cts fail any fix?

selinux enforced. stock kernel
[Magisk] Flint2:
Which Phone? ROM? How did you unrooted?

Enviado desde mi ONE A2005 mediante Tapatalk
[Magisk] bega2707:
Sgs s5, Stock based rom; kernel stock , unroot from super Su then flashed from recovery EnSu.zip
[Magisk] Tsukiyohikage:
I have my htc 10 rooted with marshmallow base rom and I get cts false and I have my old htc one m7 that is unrooted and gets it as well. I have google and reddit and can't find any answers, any fixes yet
[Magisk] selectormoldy:
I am also experiencing this on a completely unmodified stock Pixel XL, after receiving the 7.1.1 OTA, Android Pay stopped working and SafetyNet checks fail. Submitted a an Android Pay support request which has gone unanswered for almost a week.
[Magisk] Oki:
The issue is that since October, safetynet is also checking whether the bootloader has been unlocked. This check is only enforced in new devices with new Kernels, this is why some users are able to continue using systemless root and others have problems, like me. I have a new ZTE Axon 7 and it comes with a Kernel supporting this new safenet feature. The result is a CTS test failure as soon as the bootloader is unlocked.

For more info please refer to this article https://www.xda-developers.com/sult...otloader-check-on-latest-cm13-builds-for-op3/
[Magisk] deftdrummer:
Well isn't that just marvelous u/Oki. Thanks for the info. Has been failing for me as well on a completely stock Pixel since October.
[Magisk] Pedroc1999:
Anyway of getting Xposed working with this method too?
[Magisk] Hic_Svnt_Dracones:
As far as my understanding of this, it can be ANY system app causing it. The CTS profile match, verifies the cert keys between the /System apps and an Android server that handles certificates. The route I am taking at fixing my phone, is to try to get my own CTS key for the ROM I am using. (XOSP), I had an app that did just that, but it had issues. Once the key is registered, it should be fine.

Am I correct on this?
[Magisk] andy levenson:
I'd like to add my comments, I too have had the safetyNet failures on an unrooted, stock rom phone with the bootloader locked. I finally figured out the issue. The phone came from Vodafone with the Vodafone branding. I tried to update it to Nougat using a "stock" rom. When I decided to return to Marshmallow stock rom, I still couldn't get Android Pay working. Finally figured out that although I had a stock C900 rom back on my phone and a locked bootloader, the only way to get AP working and SafetyNet to pass CTS Profile match was to install the Vodafone specific stock rom. After doing that, everything is working again.
[Magisk] NoobMalkavian:
I know it sound childish.

Do I have to go back to stock to play pokemon go?

I was using custom superman rom on an s7 unrooted.

Since I couldn't launch the game anymore, I flashed magisk and installed magisk manager.

The status is: SafetyNet CTS profile match false.

Flashing magisk rooted the phone by the way.
[Magisk] Flint2:
Did you selected Magisk Hide in Magisk Manager app settings?
[Magisk] NoobMalkavian:
safety net check is passing now, thanks and also the game stopped to complain.

i will donate to magisk more than to the game ^_^
[Magisk] Julianinho:
Hi,

I have the same problem, what do you make to have the safety net check on passing ?
[Magisk] Lazio51:
I had the same, thank's for telling us we have to go to "settings" then "Magisk Hide"...now : SafetyNet Pass !
[Magisk] SiliconBug:
I have systemless Xposed installed.

When Xposed enabled, I get CTS failed, but if I disable (not uninstall) it and reboot, Safetynet pass.
[Magisk] AzzidReign:
So Sultan says that it can work on any device. I'm unsure how to move forward with the code given in his github. Is there an easy way to do this? I've searched for guides but I'm only seeing links to that article and 1 youtube video that has no voice and is quite blurry so I can't see what they are doing but I don't think it is his method since the guy is going into xposed and installing fakegapps.

EDIT: For those still having issues, this is my set up:

Note 3 Sprint

Android 5

SuperSU 2.79

Xposed v85

With this setup I was getting a different type of failure than the CTS and basic integrity, I don't recall now.

Magisk could not install, no matter what I do (I haven't resorted to flashing stock fw, so that could be the issue) it always bootloops. Hidesu also wouldn't install for some reason (error) so I resorted to a Playstore app that didn't work at passing Safetynet.

I uninstalled xposed and retried magisk and hidesu, still nothing. After uninstalling xposed, I couldn't pass basic integrity or CTS profile match.

I then uninstalled supersu. Still couldn't pass.

I was reading too many threads and couldn't find the right help so I tried flashing the stock boot.img. BAM, passed! For me, it's no big deal to not have root as it is easy enough to install and uninstall now if I ever need something. This was for my non-mobile data phone that my daughter uses and I wanted to give her the ability to find pokemon while staying at my side (she's 3 and she'll be in my office for the next week...and she only sits still for pokemon when we go on walks with my new phone lol).
[Magisk] technomooney:
can this be done on a stock rom?
[Magisk] xJovs:
Not needed anymore due to MagiskHide auto setting permissions. If you use Magisk and MagiskHide it should work on stock.
[Magisk] MajorPlayz:
Hi there, simple fix here:

==Does not work with BusyBox!==

Uninstall SuperSU

Flash Magisk-12.0.zip (Just Google its XDA thread)

Download Magisk Manager and install magisk framework.

Google Univeral SafetyNet Fix magisk and flash that

Reboot

Done! This works on any ROM (mostly) and any device (I think)

(I have to put a disclaimer because some noob will come along and do it wrong! Haha)

Disclaimer

I am not responsible for any bricked devices, perform these tasks at your own risk!
[Magisk] Daniel_Lechu:
Hello,

I'm getting the same error about CTS profile match even with a clean install of my ROM (Carbon nougat Weekly for Z3 without root and Xposed), but the apps that fails when the phone is rooted are working (at least Pokemon Go and HBO). When I install root with Magisk 12/13 then is when it stop working.

Greetings!!
[Magisk] nickny:
Nexus 6P, TWRP, Locked Bootloader - Failing SafetyNet

I am having issues as well. Nexus 6P with July 2017 updates. Totally stock ROM. Unlocked bootloader with TWRP seems to trip up SafetyNet for me. After wiping everything and re-locking, used TWRP filemanager to mount System partition, moved an app to system, reboot. I was able to pass SafetyNet, locked bootloader, stock ROM, but TWRP was still there. I was playing PoGo, GooglePay, everything. Fast forward maybe 12 hours later, and Basic Integrity:Fail and CTS Profile: Fail . I went to re-flash stock angler recovery img, but forgot my device is locked (duh!). I dont want to unlock bootloader again to flash stock recovery, because it will wipe the change I made with the system app, correct?

Does anyone have a working setup with Nexus 6p?
[Magisk] Daman5202:
SOLUTION

Hi there everyone, i have faced this "cts false" problem as well and I've found the solution ! Im on magisk root and i faced this problem few days ago,

Why did this happend?

Because of Busybox! Busybox is probably broken or not properly installed! The busybox you installed might be having less applets! The one below you need to flash have over 400+ applets!

How to fix?

Download "busybox by yds"(search in xda) (supports almost all architectures) flash it in magisk as magisk module. Then you need to install one more module named "universal safetynet fix" which is available in xda or in magisk manager app, after that reboot! And voila! Safetynet passed again! Enjoy! If any problems, quote/mention me here or PM!

Link for Busybox: https://xdaforums.com/android/software-hacking/tool-busybox-flashable-archs-t3348543
[Magisk] LeSchurke:
hi Daman,

i download busybox-master.zip at

https://redirect.viglink.com/?forma...ing&txt=https://github.com/yashdsaraf/busybox

I would like to install it with magisk module, but magsik says "the zip data is not a magisk-module!"

Can you help me?
[Magisk] jabu:
It's far more likely that because the community recently verified that unlocked bootloaders were the final trigger, John patched MagiskBoot.
[Magisk] Daman5202:
Read full post and Flash this=>>

https://xdaforums.com/android/software-hacking/tool-busybox-flashable-archs-t3348543

---------- Post added at 02:54 PM ---------- Previous post was at 02:51 PM ----------

Might be
[Magisk] mfaizyy:
I found a solution to make ctsprofile: true and basicIntegrity: true and after that, I am able to use tez app and snapchat app. The solution is pretty simple

1. open magisk manager and go to download section.

2.Search and install "Universal SafetyNet Fix" and reboot the phone

3. Open magisk manager and tap to "tap to start safetynetcheck"

4. Make sure you have turned on "Magisk Hide" option in magisk setting.
[Magisk] crester:
deleted
[Magisk] dav1129:
Don't try this. I did and my phone would not boot past the boot logo. I'll have to reinstall a backup and start again.

---------- Post added at 05:33 PM ---------- Previous post was at 05:31 PM ----------

This file is not available using Manager v5.4.3.

But I have found other threads referring to same file. Is it still safe to try?
[Magisk] Elixyr666:
U can use files on the official website ;)
[Magisk] cbbella:
this works for me on my galaxy s8+ with Renovate ICE rom 7.2,

thanks