yashsingh1/xdaforums huggingface dataset:
[Magisk] sapansahu:
cts profile match fail but not root

xda member ,

many many thanks

i have install play store on my flame 3 with just 3 simple steps kingroot ,flashify apk ,twrp and play store flash zip lollipop version one year ago with your help , & clean unroot my mobile for safety net pass but when i test, it show only just cts profile match fail. basic integrity pass,

can any xda guys guide me pls bcoz i dont want to use Magisk & i think only you guys can help me

i read some open source code articles about cts from google wiki

one thing i have not use su, busybox nothing else the mobile comes without preinstall play store i just flash play store flash zip

please help me xda dev is there any chances

thanks in advance
[Magisk] Didgeridoohan:
If your device doesn't come with Google Play services from the start, that probably means it isn't certified by Google and it won't be able to pass the CTS profile check. You'd have to edit your build.prop and change the device fingerprint to match a device that has been certified.

The CTS profile check failing and basic integrity passing can also occur if your bootloader is unlocked or if you're using a custom ROM.

You can find some more info on what triggers the two checks in the table here (scroll down a little):

https://developer.android.com/training/safetynet/attestation.html#compat-check-response
[Magisk] makes2068@gmail.com:
Same to me - ctsprofile: false

Xperia Z3 unlocked bootloader

OmniROM 8.1

Magisk 16.0

Magisk Manager 5.62

Any hints? Or is this depended on Sony device?

EDIT: Could this be a solution?

It seems to set these lines to the build.prop making the device appear as if it is on Stock Marshmallow .291:

setprop ro.build.description=D6603-user\ 6.0.1\ 23.5.A.1.291\ 2769308465\ release-keys

setprop ro.build.fingerprint=Sony\/D6603\/D6603\:6.0.1\/23.5.A.1.291\/2769308465\:user\/release-keys

Not working... ;-( Back-Slash not shown in build.prop after saving.

Result:
[Magisk] Didgeridoohan:
Seems like you've already got the fingerprint you need. Now you can use this method:

https://xdaforums.com/showpost.php?p=75489540&postcount=1636

Just remove all those backslashes though...
[Magisk] makes2068@gmail.com:
Thank you.

But did not know waht this means, sorry.

Which fingerprint should i use? The stock one from Z3? The one from the link? The one after installing the rom?

EDIT: Done with the original settings.

After boot, there is no changed entry. Just the old one from before. 755 applied.

Safetynet test = ctsprofile:false
[Magisk] Didgeridoohan:
Follow the instructions from that post, but use the fingerprint you posted here. Like so:

resetprop ro.build.fingerprint Sony/D6603/D6603:6.0.1/23.5.A.1.291/2769308465:user/release-keys
[Magisk] makes2068@gmail.com:
Done without success ;-( ==> see screens

Found this info:

resetprop ro.boot.warranty_bit 0

resetprop ro.warranty_bit 0

Both are not available in my build.prop
[Magisk] Didgeridoohan:
Don't bother with those props. MagiskHide already does that if necessary.

It's imperative that you enter the fingerprint exactly as it is on a certified device. From your screenshot you've entered it wrong... You've used semicolons instead of colons. Try again.
[Magisk] makes2068@gmail.com:
Thank you.

Changed the semi colons = without success ;-(

Hip Hip Hooray!!! There was a "1" missing in rom version.

Now it works, thank you.
[Magisk] SaveMEH92:
Note edge 915T rooted

Hello this Rom is great! I love the new features. I installed Magisk through recovery along with the installation of rom and gapps. However, I seem to be having an issue with ctsprofile:false on Magisks's safetynet check.

Basic integrity shows as "true" though.

Coming from latest stock T-mobile firmware sm- 915T (previously rooted with magisk as well but it was successful on safety net check) Once I wiped and freshly installed this room is seems maybe there is SU leftover from last install?Idk. Please help! Also, could it be due to Permissive Selinux?:eek:
[Magisk] zealotfan58:
Hello! Tell me how you can get rid of CTSProfile - false on the phone Motorola g5s XT1799-2? What do you need to register in a build.prop?
[Magisk] manoj.mharana:
Hello, please help me to get rid of CTSProfile - false on Lenovo K6 Power (Karate).
[Magisk] Didgeridoohan:
Take a look in the link provided in the post right before yours...
[Magisk] HeroCC:
Thanks! I'll try getting rid of SuperSU and switching to MagiskSU.
[Magisk] Eleiyas:
re-flashed leagoo shark 1 stock rom

flashed magisk 11.1

turned off usb debugging

turned on magisk hide and added system ui

still get cts profile mismatch
[Magisk] halfvast:
Uninstall Magisk manager and try to reinstall it from Play Store. Fixed error with my Galaxy S7 :)
[Magisk] Didgeridoohan:
Start by checking if Magisk Hide works at all on your device. Try adding a root checker to the Hide list. If it finds root when off the list but can't when added, Hide works.

After that it's time to start troubleshooting. I've collected a bunch of tips here:

https://xdaforums.com/apps/magisk/magisk-magisk-hide-troubleshooting-tips-t3561828
[Magisk] knapz:
Just wanted to say tat this worked for me. Thanks.
[Magisk] royal_eagle:
Many people have reported the same problem since yesterday,i'm among of them
[Magisk] 123jhoww:
I've simple reboot and safetynet passed hahaha
[Magisk] westkone:
Thanks it works !
[Magisk] vigneshnm:
I think that's why Airwatch isn't working and I'm getting Safety Net failed.

Since I already have MagiskSU, is getting rid of SuperSU just a simple matter of uninstalling the app? Ever since I installed Magisk, SuperSU gives an error that SU binary needs to be updated.

In case it's not as simple as an uninstall app technique, would really appreciate if someone could detail out the steps.

Thanks,

Vignesh
[Magisk] jhedfors:
Just need to uninstall SuperSU app.
[Magisk] vigneshnm:
Yeah, that worked.

I also did the following steps but I still can't get SafetyNet to pass.

1. Uninstall all Xposed Modules

2. Uninstall Xposed Framework and installer

3. Disable ADB debugging

4. Clear cache and dalvik cache

5. Enable Magisk Hide

Do let me know if I'm missing something here.

Thanks,

Vignesh
[Magisk] Didgeridoohan:
I've collected a bunch of tips here:

https://xdaforums.com/apps/magisk/magisk-magisk-hide-troubleshooting-tips-t3561828

See if some of them work...
[Magisk] ..::Matr!x::..:
discovered also custom kernel with permanently selinux set to permissive gives crc verification fail ... (not switchable to enforcing with selinux mode changer app)

so check also custon kernel features before flash it over your rom... selinux must to be Enforcing
[Magisk] Didgeridoohan:
Magisk has a pseudo enforcing mode built into Magisk Hide that should take care of that (hiding SELinux being permissive). From a few user reports, it seems like there may be some devices that are incompatible, but I've tested it on my Nexus 6 and it works perfectly.
[Magisk] vigneshnm:
I didn't get SafetyNet to work but I managed to get Aiwatch to work...for a while. I added it to the Magisk Hide list and I was able to enrol my device. However, after some time, it recognized there's a root, gave a notification that my phone is compromised and stopped working.

Any clue what could be triggering it?

---------- Post added at 06:25 PM ---------- Previous post was at 06:22 PM ----------

This could be crDroid CM13 specific but I get an option to set SElinux as enforcing in Settings > Security itself. And it stays that way.
[Magisk] Didgeridoohan:
If I remember correctly you need to add "Settings" (com.android.settings) to the Hide list as well.

That's ROM specific.

[MENTION=4470081]topjohnwu[/MENTION] talks a bit about his psedo enforce mode here: https://xdaforums.com/showpost.php?p=70897029&postcount=12
[Magisk] vigneshnm:
Interesting. Good to know that, will try and let you know.
[Magisk] lolimaster:
Did u enable magisk hide?
[Magisk] fierymind:
Works for me too. Thanks!
[Magisk] Hyflex:
Hi,

My phone was passing this up until yesterday, as far as I remember I haven't done anything to make it fail other than maybe installing gapps with the Aroma installer to remove some of Lineage/CM parts... I tried to install everything again but the Lineage/CM parts are being excluded still.
[Magisk] Didgeridoohan:
Have you checked the logs to make sure the Magisk daemon restarts after a reboot? Sometimes you need to toggle Hide off and on again.
[Magisk] Hyflex:
Somehow systemless hosts is triggering it, it never used to. Any ideas?
[Magisk] Shrey14:
Hello everyone,

Kindly help me.

I am using Samsung Galaxy S6 Edge G925I. I am on the stock samsung rom. I am using arter kernel. I have flashed magisk zip and then installed magisk through the app. Everything is working fine. Even the Magisk hide is working as selected some root checker apps and checked.

The problem is that it says CTS profile mismatch and I think that due to this I am unable to use Samsung Pay.

I have tried everything mentioned in the posts above.

Any advice would be appreciated. :)

Regards,

Shreyans Jain
[Magisk] Didgeridoohan:
Could also be that you've tripped Knox... Have you checked (there are apps you can use for that in the Play store)?
[Magisk] Shrey14:
Yes, I just checked Knox is tripped. I guess nothing can be done now..or is there any hope? :angel:
[Magisk] Didgeridoohan:
Nothing to do with Magisk then (except, of course, it might have been tinkering with Magisk and stuff that triggered the efuse)...

I have no idea if it's possible to reset Knox if it's been triggered. Check the Samsung forums.
[Magisk] Shrey14:
I'll do that. Thanks!
[Magisk] nipun03:
Thank you so much.. Worked for me. Though I have enabled USB debugging and it still passes. Device: Bacon. Lineage OS 14.1 (Build 20170306)
[Magisk] DudeThatsErin:
Happening on my 3t with both super su and phh's supersu. Not sure how to fix.

Edit. Just tried to uninstall and reinstall the app. About to see if a restart will help but I doubt it.
[Magisk] Warbeast350:
Hello guys!

So this is what I did...

Factory reset

Flash pure nexus for 6p

No custom kernel

Flash magisk 11.1

It's working now!

No need to turn off usb debbug
[Magisk] asc366:
I saw this too. Did you find a fix for this?
[Magisk] DudeThatsErin:
https://goo.gl/photos/3vR1ns7MWMkE83DT6

I'm still having issues. Either with CTS Mismatch or 'magisk hide' in general. I just can't seem to get Magisk to work. Can someone help?
[Magisk] cyan pac:
No fix yet just can't have systemless host checked in magisk manager or change DPI on OnePlus 3. You can use the adaway zip that changes the host file from TWRP but still not sure if that works either.

---------- Post added at 02:05 AM ---------- Previous post was at 02:02 AM ----------

You need to unroot from the su app and hit not when it ask you for the boot.img then you need to pull the boot.img from your rom's zip and flash that then flash the magisk zip
[Magisk] xkhen0017:
Apparently the systemless host makes the Safetynet fails @.@ How come?

Mine is working great now with systemless host disabled.
[Magisk] Didgeridoohan:
I'm a bit curious about this one... Why does systemless hosts support break Magisk Hide for some users (working great on my device, Nexus 6)? Could you upload a Magisk log (verbose logging enabled) where you have systemless hosts enabled (I think a reboot is necessary) and after a SafetyNet check? Magisk Hide might not be unmounting all the necessary folders...

And about changing your screen density: How are you doing it?

And lastly: have you guys tried the latest beta snapshot (a lot has happened on GitHub since v11.1)?

https://xdaforums.com/apps/magisk/unofficial-magisk-v10-beta-built-t3521901
[Magisk] cyan pac:
There's the log. On OnePlus 3 you can go into display options and change your screen size and font size. But changing either of these triggers the safetynet to say CTS profile mismatch. Basically saying it failed. I have not tried the snapshot yet. Kinda new to magisk . Just switched from #superSU
[Magisk] Didgeridoohan:
Looks like /system/etc is unmounted properly, but did you reboot like I mentioned in my last post?

When you change your screen size, does Basic integrity still pass (use an app like SafetyNet Helper)? If so, Magisk Hide is still functioning but the change causes your device to not be recognized by the Google certification process.

You could try making a Magisk module to change screen density instead. Works great... Basically what you'd need to do is to downoad the module template, follow the instructions in readme.md and config.sh and add the following line to system.prop in /common. If you're on windows, don't use Notepad, use Notepad++ instead or just do it on your device with your favourite File Explorer (I use FX).

ro.sf.lcd_density=###

Change ### to whatever you want the density to be. Lower number means more screen real estate. Zip up the files and install it through the Manager or flash in TWRP. More details: https://xdaforums.com/apps/magisk/magisk-details-dummies-to-developers-t3473486
[Magisk] cyan pac:
Yes I rebooted. Safetynet helper failed too. I'm not to worried about changing DPI I just need so my grandma could read something.
[Magisk] Didgeridoohan:
Ok, that's interesting because there's a few lines missing in that log that I'd have liked to see if you had rebooted your device between enabling systemless hosts and doing the SafetyNet check and saving the log. And you have verbose logging enabled in the Manger settings?
[Magisk] cyan pac:
Last time I turned it on and also turned systemless host on then did the safetynet test then rebooted then did the test again and copied the log. Is that the way I'm supposed to do it?
[Magisk] Didgeridoohan:
There should be something in your log around the same place as "Enabling Busybox" about "Enabling systemless hosts file support" and that'll only show up after you've enabled systemless hosts and rebooted...

Anyway... If you haven't already, maybe try out the latest beta snapshot and see if that works better.
[Magisk] cyan pac:
So I enabled everything and rebooted but when I rebooted I went to check if it passed and it did but I toggled systemless host off and on and after doing that it failed. Anyway it doesn't bother me since I'm assuming systemless host work in the snapshot and I'll be upgrading to that in a few
[Magisk] Didgeridoohan:
Don't hold your breath about the snapshot... There's a chance it'll work, but it isn't certain.

Lastly: why do you have so many apps added to the hide list? Do you really need all of those on there? Having to many added may even be detrimental to the effects of Magisk Hide. Only add the absolutely necessary apps/processes and keep the list short.
[Magisk] cyan pac:
I only have 4 added?
[Magisk] cyan pac:
I went back and toggled through them
[Magisk] Didgeridoohan:
Yeah... Your log showed 10 apps added to the list apart from the default SafetyNet.
[Magisk] cyan pac:
I'm so mad so I figured out why I kept getting CTS mismatch. So apparently you have to toggle magisk off and on hide after enabling systemless host and then reboot and it passes Everytime. Don't know why it wouldn't catch from just enabling it and rebooting though.
[Magisk] Bowmanspeer:
My first experience with majisk was installing the latest res remix on my 3T. Fueled safety net off the bat. I turned off usb debugging and rebooted. Root not recognized. Downloaded majisk zip then went to recovery and installed. After reboot majisk was all good. Hope it sticks.
[Magisk] istrebitjel:
I just had to turn on the Hide option in settings...
[Magisk] The_LC:
I came back just to say THANK YOU . I could not get this to pass for the life of me and your solution worked.

1. Disable Magisk, Magisk Hide, Systemless Hosts

2. Reboot

3. Enable Magisk

4. Reboot

5. Enable systemless hosts

6. Enable Magisk Hide

7. Reboot

7. Safetynet passes
[Magisk] typhoonikan:
Followed these steps and it did not work for me. I'm unsure what else to do. Goodbye Super Mario Run. ;-;

HTC 10, SuperSU
[Magisk] ken2802:
Hmm, not sure if it works on HTC too, but many Samsung devices it helps too emulated init.d with kernel auditor (There is a thread about it). There VB you add them following routine:

#!/system/bin/sh

chmod 640 /sys/fs/selinux/enforce

chmod 440 /sys/fs/selinux/policy
[Magisk] Didgeridoohan:
Magisk Hide actually does this by default since Magisk v11.5. Which on the other hand is causing SELinux issues on other devices than Samsung...
[Magisk] The_LC:
Works for me. Did it again this morning. Has to be done on any restart apparently.
[Magisk] unibombz:
Hello, sorry to ask. I am trying to clarify what SaftyNet is for? Is it like a 'Root Cloak' Hides root for applications that will not run when 'root' is detected?

I am just curious if I need to care about the 'Failed CTS' on my device.

Also I have been reading that Magisk works?? with Xposed Framework ?

Magisk was built into my current custom ROM I am using, trying to understand it as I have been use to running :

SuperSU + Xposed in the past
[Magisk] Didgeridoohan:
SafetyNet is Googles API for detecting if a device is safe, as in not rooted, doesn't have Xposed and so on. Any app can use it. On many devices Magisk Hide can make a device pass SafetNet, even though it's rooted. There's no way to hide Xposed though...

If you're not using apps that utilise SafetyNet (Android Pay, Pokemon Go, etc) you don't have to worry.
[Magisk] unibombz:
Excellent follow-up! Thank you. Now that I understand that concept I will try it enabled and disabled or "pass device safe"

I do not use applications that utilize SafetyNet. However I am sure as we progress through time and device security, we will see more applications use these API's.

I may have some other questions... but let me test the 'hide' feature etc, and go from there.

I saw Xposed in the download 'section' however I didn't think Xposed was released yet for Android 7 (N).

I brought up Xposed as I saw it withing Magisk and I would like to use Xposed framework again if possible on Android-N

Thanks again.
[Magisk] Didgeridoohan:
There's no Xposed for Nougat... There's a systemless Magisk version of Xposed for Lollipop and Marshmallow, that's what you saw.

If you don't have any luck with getting Magisk Hide to work, take a look in this thread for some collected tips and tricks:

https://xdaforums.com/apps/magisk/magisk-magisk-hide-troubleshooting-tips-t3561828
[Magisk] unibombz:
Wonderful. That explains that :) Right now I am trying to learn how to update the application. Someone told me you click on the big green 'check mark' but nothing seems to function when I click anywhere on the main page. The research continues....
[Magisk] HeroCC:
So, no Xposed and SafetyNet? That's disappointing, someone ping me when this changes!
[Magisk] Didgeridoohan:
Sure, I'll make a note...
[Magisk] jhedfors:
LOL:laugh:
[Magisk] korxil:
So I'm having the same error, CTS Profile mismatch. I have magisk 12, no xposed, SuperSU was uninstalled with UnSU, usb debugger turned off, magisk hide turned on, systemless hosts turned off. I have a HTC Desire 610 with cyanogenmod 12 rom. Only app that is checked in the magisk hide settings is pokemon go, everything else is unchecked.
[Magisk] justjr:
On my LG (signature) the SafetyNet check keeps running and never gives me a result. Anyone faced it? What should I do? On moto G works fine.
[Magisk] Didgeridoohan:
Could be a problem with Play services. Try force stopping it, clearing it's data and rebooting.
[Magisk] justjr:
I tried it, despite having reinstalled OS some times, clean and dirty, always the same, and unfortunately it still the same, as I thought. :/

It keeps testing and never end with or without magisk hide. :/
[Magisk] Facebooook:
I use oneplus 3 with stock rom rooted with chainfire super user sr3 and custom kernel blue spark.

My steps are..

1 unroot with supersu app.

2 reboot to recovery and flash unsu zip by osmosis.

3 flash stock boot.img.

4 flash magisk v12 zip and reboot.

5 Open magisk and update its..

6 Go to magisk and tick hide su and reboot....

After reboot check safty net its pass....

After that i change kernel..
[Magisk] gius0161:
i have the same problem and i haven't find a solution.

LG G4 H815 (int) - Genisys Rom 4.9, i've tried with superSU, PHH's Superuser, but nothing
[Magisk] cyan pac:
How are you getting root? With supersu or phh or magisksu?
[Magisk] justjr:
Magisk on both phones.
[Magisk] cyan pac:
Send a screenshot of screen while it's on the statues please and thank you.
[Magisk] Citizen_Snips:
Nexus 6P unrooted, flashed v12 (which roots the phone). Enabled hide, BusyBox & systemless hosts from settings. Rebooted. I pass SafetyNet and can use AP at terminals. Unlocked bootloader, ADB enabled & so is unknown sources and it all works fine. It was literally as simple as flashing Magisk v12 in TWRP. Didn't even have to check Android Pay or any Googe services in the Magisk Hide tab. Just worked.
[Magisk] justjr:
Here

View attachment 4100618

On Moto G it just works, like above guys said.

Enviado de meu LG-D295 usando Tapatalk
[Magisk] cyan pac:
Enable busy box magisk hide and host and then toggle hide off and on again and reboot. Test it first thing after rebooting
[Magisk] justjr:
Sorry to say it still the same...
[Magisk] metrize:
I find just turning it on doesn't work but if you turn it on then off then on again. And try safety net it works
[Magisk] cyan pac:
Maybe time to buy a new phone lol
[Magisk] reversegear:
Me too have same problem.

safetynet check keeps running infinetly

[MENTION=5188092]justjr[/MENTION] can u try this app to check safetynet https://play.google.com/store/apps/details?id=com.scottyab.safetynet.sample&hl=en

for me it returns token - blank, timestamp 1970. letme see u also have same issue..
[Magisk] justjr:
CTS false Basic Integrity false

One time request token blank, timestamp 1969-12-31 20:00:00.000
[Magisk] reversegear:
We are on same boat :svetius:

Edit
[MENTION=5188092]justjr[/MENTION] check my screenshot
[Magisk] miniadri:
Hi, after a few problems with Magisk and SuperSU (i had SuperSU and i can't change it with UnSu or similar), i've just flash my rom again and i've checked that it hasn't root from the begining, so i've flash Magisk 12.0 and then update the app to 4.3.1

Now i've the problem with SafetyNet:

The first time i open the app i check it and it says the error SafetyNet failed: Profile CTS didn't match

If i check Magisk Hide the error is still here, even with Magisk's busybox, with restarts and so on...

What can i do? My rom is Official madOS - Jiayu S3 [7.1.1]

Thanks for your help

EDIT:

I installed the last week Magisk to my brother and he can pass SafetyNet, Magisk11.6, Motorola Moto G2 (2014) with Mokee 7.1.1

EDIT2:

I've flash again my rom to Jiayu RC5, the official rom of the company, and it didn't pass SafetyNet (i attach the screenshot), so this means that i can't use properly Mgisk Hide???
[Magisk] justjr:
Yes, from a first look, it looks like it have something to do with that dates?
[Magisk] Whinegum:
Same here. I'm using Nitrogen OS on a Nexus 4.
[Magisk] TheDevFreak:
Do you have magisk hide enabled?
[Magisk] Whinegum:
Yes - it's enabled. Inside of Magisk I've also got the same problem with an infinetly running SafetyNet Check...
[Magisk] TheDevFreak:
Not entirely sure but I think some kernels just don't work well with Magisk, try a custom kernel and flash magisk again?
[Magisk] Whinegum:
Flashing the Quanta V21 Kernel solved the problem with the infinitely pending SafetyNet Check. :good: Now I'm also able to pass the basic integrity check. But the CTS-Check still fails. I think I that's due to the rom which I use.