yashsingh1/xdaforums huggingface dataset:
[OnePlus 3 & 3T Cross Device Development] fhloston:
Root detected after crossing firmware boundary and switch to nlos

Yesterday I decided to finally cross the firmware boundary with my op3 and switch from lineage 16 to nlos 16.

I was running lineage 16 from May with caesium kernel, open-gapps-stock and Magisk 20. Magisk Hide was working for pogo, banking app (comdirect phototan) and DOM electronic lock management app (eniq). Bootloader unlocked, encrypted.

I did the following, after reading this thread for a while:

- updated TWRP to latest twrp-3.3.1-1-oneplus3.img, rebooted to recovery

- updated Firmware to 9.0.6, rebooted to recovery

- formated /data, wiped /system, dalvik and cache, rebooted to recovery

- flashed nlos-16.0-20191210_133508-release-oneplus3t.zip

- flashed sec-patch-2019-08-01_v02.zip

- flashed open_gapps-arm64-9.0-nano-20191221.zip

- booted, verified things work

- flashed Magisk-v20.1.zip

- install Magisk Manager, repackage Manager

- setup Magisk Hide for games, gpay, eniq and phototan

- verified Playstore shows certified, Magisk Safetynet check shows all green.

- Bootloader still unlocked

Weirdly enough Pogo works, eniq and phototan do not.

Phototan just closes, eniq tells me I am rooted.

What did I miss?

To my understanding of this thread, playstore is certified, safety net passes and Magisk Hide should hide root. This should be enough?

For eniq I also verified that the version of the app itself did not change, it was and is the last version from November (1.1.4.0.3864, de.dom.android.master).

:rolleyes:

update:

thank you [MENTION=2911853]BillGoss[/MENTION], it was indeed not intended to be unencrypted. I thought I had the encryption step in the list. Anyways, it is encrypted.

I tried deleting storage/cache.

I tried uninstalling/reinstalling.

I tried app+data restore from Titanium Backup for eniq.

I tried reinstalling Magisk, restore Manager, repackage Manager, disable Hide, enable Hide.

I do not know what more to try.
[OnePlus 3 & 3T Cross Device Development] BillGoss:
I don't think you missed anything. You could try clearing the storage for the two apps that see root and then start them again.

I note that you started with an encrypted phone. Looking at the steps you followed your phone should now be unencrypted. Was this your desired end state?
[OnePlus 3 & 3T Cross Device Development] :
The install procedure looks good and passing safetynet api and having a play protect certifoed device should be enough.

I'm using magisk 20109 and manager 262 (Canary (Debug)).

eniq detects root - it's always a race between root hiding and root detection. Perhaps you can help improving magisk hide.

phototan isn't biunique. I've tested com.db.pbc.phototan.db (Deutschen Bank AG), version 3.0.3. I can set a pin and register a fp; I can't register the device due to no banking account at Deutsche Bank, but it seems working - at least it's not crashing.

Since magisk 20.1 breaks signing of the boot image (shouldn't matter, since the nlos kernel as well as magisk throw away the tripped verity flag - on the other hand: who knows...), I suggest you flash the bootsigner zip from #4 before updating magisk to 20109 (check the output if the repacked boot image is signed with verity key).
[OnePlus 3 & 3T Cross Device Development] BillGoss:
So, here's a possible solution for you. I assume you kept a backup of your Los 16 installation? If so, you can restore that backup and then (do NOT mention this to [MENTION=4405529]nvertigo67[/MENTION] :D) dirty flash Nlos (don't wipe anything and just flash the rom) and then you'll have your original setup but now on Nlos.

Since you had everything working previously, you should be fine after the dirty flash.
[OnePlus 3 & 3T Cross Device Development] fhloston:
It is the comdirect phototan app, com.comdirect.phototan, 7.3.19, that keeps crashing.

Hrm. I actually noticed the "- Signing boot image with verity keys" message when reinstalling Magisk 20.1 in Manager. This is broken in 20.1?

But it should not matter because NLOS masks this aswell as the "Preserve AVB 2.0/dm-verity" setting in Manager Advanced Settings?

So most likely this is not a ROM issue but a Magisk issue.

Update:

I decided to try downgrade Magisk first, as this was the previous working version. Restore Manager, uninstall Magisk 20.1, reboot recovery, install Magisk 20.0:

"(...)

- Boot Image is signed with AVB 1.0

(...)

- Sign image with test keys

(...)"

Repackage Manager, activate Hide, set Hide for phototan/gpay/eniq.

Phototan starts up now after storage/cache reset after force stop.

Eniq still claims device is rooted. This happens directly after startup of freshly installed app. Can someone else with a working NLOS/Magisk setup try [1], please?

Thanks!

[1] https://play.google.com/store/apps/details?id=de.dom.android.master
[OnePlus 3 & 3T Cross Device Development] :
Starts, but I've no document to scan, of course - so I can't get any further then the startup screen. At this point it's not crashing.

Only on the first install:

https://github.com/topjohnwu/Magisk/issues/2013

It shouldn't matter - as stated in my last posting: nlos kernel should handle this as well as magisk...

EDIT: for the next steps: try 20109 (canary debug). That's more promising then 20.0.
[OnePlus 3 & 3T Cross Device Development] :
Restoring a nandroid and deleting locksettings breaks some banking apps.

Dirty changing from los to nlos isn't supported in this thread. Recommending to not tell that, is not fair: trying to get support by hiding information from me really wastes my time: not told mods/custom kernels have wasted accumulated over 100 h of my time in the last 5 years. Please consider this when joking! People can take it for real...
[OnePlus 3 & 3T Cross Device Development] BillGoss:
I had no intention of hiding anything. That's why I decided to post the reply here rather than send a pm. That way it's all out in the open.

I know how hard you work at supporting us and I'd never want to minimise your help or effort.

What I didn't do, and should have, was point out to [MENTION=7590872]fhloston[/MENTION] that a dirty flash wasn't supported in this thread.
[OnePlus 3 & 3T Cross Device Development] phoberus:
Same with my banking app:

Magisk gets an update -> app doesn't detect root

app forces an update -> detects root

Do you know how we can help top improve magisk hide? Which informations and files are important for such problems?
[OnePlus 3 & 3T Cross Device Development] fhloston:
Don't worry, I am not going back. I have a nandroid of /data which lacks /data/media aswell as a complete tarball of /data though.

Same now aswell, 20109 and 262 for manager. Same issue, eniq detects root right after start. :crying:

I tried installing eniq on a LineageOS 16.0-20191115-NIGHTLY-oneplus3 device without root, without Magisk. There I also get the device is rooted message - but the device is not showing as certified in playstore. So I do not know if this is of any use.
[OnePlus 3 & 3T Cross Device Development] :
...hard to tell who's Sysiphus in this game... Yeah, that's the way it is.

https://xdaforums.com/apps/magisk/dev-magisk-canary-channel-bleeding-edge-t3839337

https://github.com/topjohnwu/Magisk/issues

If you use plain los without root, you can relock the bootloader and flash the 2019-08-01 sec patch datre in order to pass safetynet.

Obvisously, the device is rooted message is not technecally accurate.

BTW: did you try plain nlos with magisk - only with sec patch date set to 2019-08-01? (Passes safetynet api unrooted)
[OnePlus 3 & 3T Cross Device Development] fhloston:
I guess you mean plain nlos without magisk?

Strange enough, I had a colleague try the eniq app on his ZTE Axon7 with uptodate Magisk 20.1 and an older Lineage from May. Just works.

Gpay works on my NLOS setup aswell, just did a payment today.

This app must do some other weird check that for some reason fails on NLOS with Magisk.

Can somenone else test this, please? I am beginning to think something with my install is b0rked.

https://play.google.com/store/apps/details?id=de.dom.android.master
[OnePlus 3 & 3T Cross Device Development] :
No. I've meant plain los without magisk but with locked bootloader, because...

...if this "some other wired check" is for locked bootloader or if verity flag is green, plain los (nlos kernel throws away the verity flag, which has worked perfectly, sofar) without magisk and locked bootloader is the easiest way to check. Please check before proceeding to the next paragraph.

As a last resort (since May los builds seem to work with unlocked bootloader and magisk installed) you can try the magisk module https://xdaforums.com/apps/magisk/module-magiskhide-props-config-t3789228, https://github.com/Magisk-Modules-Repo/MagiskHidePropsConf/blob/master/README.md and use the OOS 5 fingerprint (@BillGoss: which one was the working one? 5.0.8 or open beta?).
[OnePlus 3 & 3T Cross Device Development] BillGoss:
I don't know for sure which version it is, though it's definitely an Android 8 one. See the attachment in https://xdaforums.com/showthread.php?p=81068429
[OnePlus 3 & 3T Cross Device Development] :
UPDATE (WireGuard: 20191219; maintainance)

Build 20191225

(last nlos build of the decade)

Releasenotes:

This build relies on OxygenOS firmware. OxygenOS 9.0.6 firmware is required. At this point you have two options:

You don't care about loosing data on an unlocked bootloader and clean flash including format userdata according to the first time installation instructions in OP (recommended):

Oneplus 3T: OxygenOS 9.0.6 firmware

Oneplus 3: OxygenOS 9.0.6 firmware

You want to keep your current setup and like to dirty flash on top of beta builds:

I've created a firmware package from OxygenOS 9.0.6. To avoid issues due to an unlocked bootloader and/or encrypted userdata partition, I've kept the bootloader and and keymaster partition to OxygenOS 5.0.8. This allows to run the pie-blobs builds with native Oneplus OxygenOS 9.0.6 firmware, but you don't need to reformat the userdata partition (for details see: https://xdaforums.com/oneplus-3t/how-to/guide-cope-9-0-3-5-0-8-firmware-barrier-t3941164 ).

Oneplus 3T: OxygenOS 9.0.6 firmware with 5.0.8 bootloader and keymaster

Oneplus 3: OxygenOS 9.0.6 firmware with 5.0.8 bootloader and keymaster

If you need to pass safetynet api flash sec-patch-2019-08-01_v02.zip from https://xdaforums.com/oneplus-3/one...-nlos-16-0-t3879405/post78433987#post78433987 .

Before you ask: though I've updated the blobs used in the rom to OOS 9.0.6, I've decided to stick with OOS 9.0.5 build fimgerprint, because 9.0.5 is the only version with identical fingerprint strings for op3 and op3t.

For a complete list of additional cherry picks see: current.pick.sh.

Changelog (Last repo sync: 25 Dez 2019, 11:04:02 CET / 25 Dez 2019, 10:04:02 UTC):

current.pick.sh: "f2fs-tools: fsck/fsck.c: fix typo." — Nvertigo

op3/t: use phone-xhdpi-6144-dalvik-heap.mk. — Nvertigo

WG: squash WireGuard-0.0.20191219. — Nvertigo

NLOS-Bootlogo

nlos_bootlogo-v0.1.zip

back_in_black_bootlogo-v1.0.zip(pre ob16 OxygenOS Bootlogo)

[SIZE="+2"]DOWNLOAD[/SIZE]​

Merry Xmas!
[OnePlus 3 & 3T Cross Device Development] BillGoss:
Hmm, so you start counting at 0?

I would count 1...10 so, for me, the decade ends next December. :D
[OnePlus 3 & 3T Cross Device Development] :
I agree with you. Sadly, we are the only ones (or at least part of the minority) accepting that there hasn't been a year 0 in the calendaric year count. We all know that a child has lived for a decade when celebrating the 10th birthday, but most people have always and will always state that the turn of the millenium has been from '99 to '00... and the turn of the decade is from '19 to '20.

Anyway: Merry Christmas (though this is not the accurate date of birth of Christ... ;) )!
[OnePlus 3 & 3T Cross Device Development] ahb83:
What would be my date for my phone with this

ro.build.fingerprint=OnePlus/OnePlus3/OnePlus3:8.0.0/OPR1.170623.032/02281230:user/release-keys
[OnePlus 3 & 3T Cross Device Development] :
Cut down your quoting. Thanx for keeping the thread readable.

Read this thread. [MENTION=2911853]BillGoss[/MENTION] exxplained detailed the oreo fp trick (no fake sec patch date needed), and I've exlpained why I don't like the oreo fp.
[OnePlus 3 & 3T Cross Device Development] ahb83:
His method didn't work on my op3 with Q

Does patching the date work with my setup?
[OnePlus 3 & 3T Cross Device Development] :
Help keeping the thread readable and cut down your quoting in the original posting, please. Only quote, what's necessary.

The date patching works for p fps. If your rom comes with an o fp, you are on your own.
[OnePlus 3 & 3T Cross Device Development] :
UPDATE (Security Patchlevel: 2020-01-05; WireGuard: 20200105; Fix:deepsleep with AOD)

Build 20200108

Releasenotes:

This build relies on OxygenOS firmware. OxygenOS 9.0.6 firmware is required. At this point you have two options:

You don't care about loosing data on an unlocked bootloader and clean flash including format userdata according to the first time installation instructions in OP (recommended):

Oneplus 3T: OxygenOS 9.0.6 firmware

Oneplus 3: OxygenOS 9.0.6 firmware

You want to keep your current setup and like to dirty flash on top of beta builds:

I've created a firmware package from OxygenOS 9.0.6. To avoid issues due to an unlocked bootloader and/or encrypted userdata partition, I've kept the bootloader and and keymaster partition to OxygenOS 5.0.8. This allows to run the pie-blobs builds with native Oneplus OxygenOS 9.0.6 firmware, but you don't need to reformat the userdata partition (for details see: https://xdaforums.com/oneplus-3t/how-to/guide-cope-9-0-3-5-0-8-firmware-barrier-t3941164 ).

Oneplus 3T: OxygenOS 9.0.6 firmware with 5.0.8 bootloader and keymaster

Oneplus 3: OxygenOS 9.0.6 firmware with 5.0.8 bootloader and keymaster

If you need to pass safetynet api flash sec-patch-2019-08-01_v02.zip from https://xdaforums.com/oneplus-3/one...-nlos-16-0-t3879405/post78433987#post78433987 .

Before you ask: though I've updated the blobs used in the rom to OOS 9.0.6, I've decided to stick with OOS 9.0.5 build fimgerprint, because 9.0.5 is the only version with identical fingerprint strings for op3 and op3t.

For a complete list of additional cherry picks see: current.pick.sh.

Changelog (Last repo sync: 8 Jan 2020, 11:22:48 CET / 8 Jan 2020, 10:22:48 UTC):

Patch up: P_asb_2020-01. — Nvertigo

op3/t: Enable mSBC wideband bluetooth codec — Lorenz Brun

op3: doze: Disable seamless transition — dianlujitao

op3: AOD: Decouple suspend from screen state — Adrian Roos

WG: squash WireGuard-linux-compat-0.0.20200105. — Nvertigo

NLOS-Bootlogo

nlos_bootlogo-v0.1.zip

back_in_black_bootlogo-v1.0.zip(pre ob16 OxygenOS Bootlogo)

[SIZE="+2"]DOWNLOAD[/SIZE]​

Happy flashing!
[OnePlus 3 & 3T Cross Device Development] phoberus:
Hello, suddenly I have the problem that some apps cannot be opened anymore (force close). I can't say exactly when the problem occurs, as I'm abroad on business at the moment. I have attached a Logcat, dmesg and kmsg. From about [ 01-09 22:21:33 ] I started to start the problematic apps one after the other. I also deleted and reinstalled them, deleted the app data, cleared the cache and reflashed the rom. But all of this did not help. Unfortunately, I'm on the road a lot at the moment and a clean flash is only possible in a week. If someone has an idea what it could be, please answer it here.

This is my setup:

Oneplus 3T

logs are taken with nlos-16.0-20191225, running now the newest build with same issue (also tested with nlos-16.0-20191119)

stock kernel

Magisk v20.3 (tested also with 20.1 and 20.2)

OxygenOS 9.0.6 firmware with 5.0.8 bootloader and keymaster

sec-patch-2019-08-01_v02.zip flashed

no xposed and things like that
[OnePlus 3 & 3T Cross Device Development] Ihe87:
Hi [MENTION=3456089]nvertigo[/MENTION],

is it possible to make this Rom/Kernel compatible with the App SnoopSnitch (mobile network testing and attack detection features) from F-Droid?

The SnoopSnitch FAQ says:

"SnoopSnitch and the mobile network security tests should work if the maintainer of your devices ROM enabled the Qualcomm DIAG driver in the Android kernel."

Source: FAQ - SnoopSnitch - SRLabs Open Source Projects – https://opensource.srlabs.de/projec...-on-custom-ROMs-like-CyanogenMod-or-LineageOS

Greets
[OnePlus 3 & 3T Cross Device Development] knpk13:
This has been answered previously.

https://xdaforums.com/oneplus-3/one...velopment/rom-nlos-16-0-t3879405/post80435773
[OnePlus 3 & 3T Cross Device Development] phoberus:
Ops, sorry. I used "adb logcat -v long", next time I post a logcat without the -v flag:good:

Many thanks, that was it. I could have come up with it myself, but did not think of this source of error. I'm using since a long time the magisk module to install the Bromite WebView. It worked in the past, maybe a module update broke it. Gonna stick with the rom webview for now.

Thanks for your time and reading my logs:highfive:
[OnePlus 3 & 3T Cross Device Development] :
What I really dislike about bromite webview: why not just ship as com.bromite.android.webview, install as user app and select in dev-opts - there is no need at all to overwrite com.android.webview... This means, they are asking for trouble and the end user gets the trouble... BTW: the issue they are referencing in the chromium bug tracker is only true for closed source google roms, since all source build roms use com.android.webview as build in webview name. This means they trigger exactly the described bug on source build roms (including plain aosp), which should be avoided on google closed source roms...

If you can install the playstore version as user app, why does bromite need to replace system files? If you install chrome-webbrowser, it comes with it's own webview. There's no reason at all to replace system files - it's just bad practise!

Don't use packages with a hostory of bad programming and or installation practise!

I'm still waiting for an answer: what's wrong with tne shipped webview and the playstore google version, that it's necessary to replace system files?
[OnePlus 3 & 3T Cross Device Development] Ihe87:
I think the reason is the adblocking feature of Bromite webview get used for all Apps.

See:

//github.com/om/ SystemWebView · bromite/bromite Wiki · GitHub – https://github.com/bromite/bromite/wiki/Installing-SystemWebView
[OnePlus 3 & 3T Cross Device Development] :
In dev-opts you set the systemwide default for webview... So that's again only some kimd of pseudo reason. Again: build with different name, install as user app and select in dev-opts - that's good practise

As a rom dev, I can only ensure the shipped version is working. If it's replaced, I can't do anything about it, but spending my time on looking at logs and pointing out, that the apps arn't crashing with the shipped one. Sounds like a waste of (my) time.

With a proper implemented third party webview, everybody can fallback to the working(!) rom-shipped webview, if issues with the third party webview occure.
[OnePlus 3 & 3T Cross Device Development] phoberus:
I used it because of the privacy and security. It supports the same features as the bromite (chromium based) browser, but I think they removed the adblocker at one time.

The installation needs to remove the stock webview apk. I don't unterstand why: https://github.com/bromite/bromite/wiki/Installing-SystemWebView

That's why it was easier to use a magisk module. But I will download the one from google and activate it in dev ops. Google already has my data anyway :p
[OnePlus 3 & 3T Cross Device Development] :
For adblocking I ise the private DNS setting of our rom: Settings->Nework & internet->expand Advanced->Private DNS

I use dns.adguard.com. According to i.e. https://xdaforums.com/galaxy-s9-plus/how-to/how-to-blocking-ads-additional-software-t3883458 you can also use dns-family.adguard.com to block adult sites.

On my router I use 176.103.130.130 and 176.103.130.131:

adler ~ # dig dns.adguard.com

; <<>> DiG 9.14.8 <<>> dns.adguard.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26346
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;dns.adguard.com. IN A

;; ANSWER SECTION:
dns.adguard.com. 275 IN A 176.103.130.130
dns.adguard.com. 275 IN A 176.103.130.131

;; Query time: 0 msec
;; SERVER: 192.168.7.1#53(192.168.7.1)
;; WHEN: Sun Jan 12 15:43:03 CET 2020
;; MSG SIZE rcvd: 76

If you want adult site blocking use 176.103.130.132 and 176.103.130.134:

adler ~ # dig dns-family.adguard.com

; <<>> DiG 9.14.8 <<>> dns-family.adguard.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 12029
;; flags: qr rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 7a1e65b64e11dc42 (echoed)
;; QUESTION SECTION:
;dns-family.adguard.com. IN A

;; ANSWER SECTION:
dns-family.adguard.com. 996 IN A 176.103.130.132
dns-family.adguard.com. 996 IN A 176.103.130.134

;; Query time: 47 msec
;; SERVER: 192.168.7.1#53(192.168.7.1)
;; WHEN: Sun Jan 12 15:45:18 CET 2020
;; MSG SIZE rcvd: 95

This works pretty well.

I've played around with bromite system webview. I don't think the wiki documentation is up to date:

The documentation states you can still select other installed webviews as system webview after installing bromite system webview - sadly this doesn't work: as soon as bromite wv (webview) is installed, no other installed wvs are shown in dev-opts anymore. (I've also tried building nlos with bromite wv, with the same result.)

bromite webview can't be updated (or downgraded for that matter) by f-droid (unknown installation error), though the documentation suggests exactly that.

The documentation claims bromite wv has the same features as bromite web-browser, I wonder how to configure that features for bromite wv.

Though I was interested in building nlos with bromite wv as default system wv after reading the documentation, every single item in the list above is a no-go.
[OnePlus 3 & 3T Cross Device Development] Ihe87:
I've bromite webview installed since many month ago without any Problem.

Also updates from f-Droid are working fine.

I use the ZIP file from Nanolx download page.

It replace the stock webview and adds the Bromite repo to f-droid.

So flash and forget.

https://downloads.nanolx.org/NanoDroid/Stable/
[OnePlus 3 & 3T Cross Device Development] :
Is it still possible to select other installed wvs as system wv?

How do you configure the additional privacy and security features?

Which are these additional features? (Obviously it's not add blocking... ;) ) Is Nanodroid Setup Wizard needed additionally to utilize the additional features?
[OnePlus 3 & 3T Cross Device Development] phoberus:
Interesting didn't know this setting. If I need adblocking, I use the adguard app because I can activate it only for the apps I really need it.

Also very nice that you looked into bromite, but I think to replace stock it would harm more people than use. Only my personal view :)
[OnePlus 3 & 3T Cross Device Development] :
It's a general solition with no nells and wistles. I like the minimalistic approach: no addotional apps needed. But I understand, what you mean; some sites tell me to switch off the adblocker - which is not possible in my home network... ;)

For sure not. My personal nlos policy is "I don't add amything that breaks something else". Since building with bromize wv breaks selectebility of other wvs and upfating, bromite wv has no chance to be used in nlos builds.
[OnePlus 3 & 3T Cross Device Development] Ihe87:
I don't have another wv installed, so i can't test it.

There is nothing to configure - just replaced the stock wv.

The additional features should be privacy relevated, i'm not sure about adblocking - i think i read some time ago about that.

As far as i know the Setup Wizard is for installing extra apps - mostly replacements for stock into foss.