yashsingh1/xdaforums huggingface dataset:
[Magisk] ipdev:
You originally had it backwards but, looks like you figured it out. 😁

Denylist had to be enabled (enforced) before you could edit/modify it.

Not sure when Shamiko actually became to be in existence. 🤔

or when I started using Shamiko. 🙃​

The oldest release on GitHub is v0.3.0 and that is dated a few days after John committed the change for Magisk's denylist.

The Shamiko release notes make note of working around it. 🙃

3. Request Magisk 23017+, which allows us to strip Java daemon and change denylist regardless of enforcement status​

It is an error. 🙂

To complicate the answer.

The "status" in magisk's database when enforcing the denylist is 1.🙃​

$? is the return (exit) value of the last command.

bonito:/ $ su
bonito:/ #
bonito:/ # magisk --denylist status
Denylist is enforced
bonito:/ # echo $?
0
bonito:/ # magisk --denylist status
Denylist is not enforced
1|bonito:/ # echo $?
1
bonito:/ #

Notice the command line changes after checking when not enforcing.

It includes the exit value 1|bonito:/ # because the command did not return 0 (successful).

This is the reason why the if/then statement works.

if magisk --denylist status; then

Enforcing will return as true because the command exits with 0 (success).

Not enforcing will return as false because the command exits with 1 (error).

Otherwise this would have had to been more complicated. 🙃​

When enforcing the denylist, I use what was MagiskHide for gms.

This only works for devices that do not suport hardware Attesatation.

#define SNET_PROC "com.google.android.gms.unstable"
#define GMS_PKG "com.google.android.gms"

Remove all non-Magisk hiding code · topjohnwu/Magisk@003fea5

Magisk no longer interferes with any signals/info that were not created or caused by Magisk itself.

github.com

// Add SafetyNet by default
add_hide_set(GMS_PKG, SNET_PROC);

// We also need to hide the default GMS process if MAGISKTMP != /sbin
// The snet process communicates with the main process and get additional info
if (MAGISKTMP != "/sbin")
add_hide_set(GMS_PKG, GMS_PKG);

Remove all non-Magisk hiding code · topjohnwu/Magisk@003fea5

Magisk no longer interferes with any signals/info that were not created or caused by Magisk itself.

github.com

I set this as a function in my scripts if I need it.

set_default_list() {
magisk --denylist add com.google.android.gms com.google.android.gms.unstable
if [[ $(magisk --path) != /sbin ]]; then
magisk --denylist add com.google.android.gms com.google.android.gms
fi
}

usnf/customize.sh at testing · ipdev99/usnf

Universal fix for Google SafetyNet on Android devices with hardware attestation and unlocked bootloaders. - usnf/customize.sh at testing · ipdev99/usnf

github.com

👍

Somethings still exist.

Seems boot-time changes like prop values and such are global and not reverted when a process on the denylist is called.

Devices that do not support Hadrware Attestation, you can pass SN/PI with prop changes during boot while including gms in the enforcing denylist.

Cheers. :cowboy:
[Magisk] ipdev:
:love:

---

I am more..

Cheers. :cowboy:
[Magisk] Minecraftitsover90:
nvm i got past that stage

unfortunately i got the Couldn't finish card setup for pay contactless

to resolve this, you'll need to contact your bank
[Magisk] pndwal:
Nah... Didn't... I did simplify the overly complex sentence, but said the same thing. 😉 Knew this well as had to disable enforcement to configure denylist (now really hidelist) for Shamiko for a while...

I posted about Shamiko POC from a post by @nu11ptr in Alpha TG discussion (now hidden as "街角LycoReco的處刑之吻", and recently purged) on Dec 2, 2021:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86032113

... Posted re. first public release on Dec 4 here:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86042643

Originally needed to build Magisk with Shana's XHook clear commit or use Shana / Canyie Metagisk build... TJW merged this commit on Dec 14 2021 here:

https://github.com/topjohnwu/Magisk/pull/5010

making official Magisk compatible w/ Shamiko in Canary 23016 on Dec 15 2021... Essentially only Zygisk hiding then... (Of course there was likely discussion about this, and Shana was most likely already in John's Magisk Slack group; she certainly is now)... We can only speculate...

The Allow modifying denylist without enforcement commit was built in Canary 23017 on Jan 20 this year... vvb2060 made the PR: https://github.com/topjohnwu/Magisk/pull/5235/commits/e44a875345e1265a8455df85093208e746280147

...

Can't help you here... 😁

... There was no GitHub release page till it was added to LSPosed public repos by Shana on 20 Jan this year, same date as Canary 23017 release... ; Earlier releases were all passed on from TG... GitHub page made things much easier in the face of XDA policing no TG as file source policy (we couldn't post proper links till then)...

So yes, Shamiko (a Canyie initiative) became mature for most users from 23017 but was compatible from 23016 (some tried it w/ 23015 before this too, but didn't succeed of course), so a number of members here were using it some 6 weeks before Allow modifying denylist without enforcement...

Thanks for clarifying / covering this.. I think I've got it now! 😝 ... It's complex enough all right...

... Good stuff!...

You mean these still exist?... But the point is they're not 'unloaded' for a process/when a process is called either!

...But Zygisk modules that run code in a process's zygote (and other modifications?) must never load (as @kdrag0n states) for processes in the list...

Just saying I don't think this meant

or

... Rather, it seems @kdrag0n's statement that the module will 'never load' is correct for processes in (enforced) denylist'...

I think the statement that Magisk "reverts all changes it had done" applies immediately after a process is added to denylist (since it takes effect immediately, without reboot) rather than to unloading 'every time a process in the list is called'... 😶

Yup...

... You don't need a good memory anyway... just a keen nose...

... Regards, PW
[Magisk] DineshValor:
Same issue with me? Did any solution found yet?
[Magisk] pndwal:
Of course... Read back here a bit...

SafetyNet is depreciated and Google Pay/Wallet has migrated to new Play Integrity API ... You'll need to be passing deviceIntegrity verdict...

Also, Play Protect certification remains dependant on old S/N API at least for devices w/o new separated Google Play Protect Service, so that doesn't indicate that PI deviceIntegrity is passing for these devices... Latest USNF module has just added fixes for devices that need bypasses for the extra prop based hardware attestation enforcement the Play Integrity API adds however...

🙂 PW
[Magisk] BesoC:
Hi. Do you mean this one - safetynet-fix 2.4.0 from kdrag0n? It doesn't work for my RideDroid A13, even with MagiskHideProps :(
[Magisk] AndrzejDwo:
unfortunately 2.4.0 by kdragon doesn't work for me, I have to use 2.3.1 Displax mod, maybe it's the same case for you.
[Magisk] BesoC:
I did tried to use it - Displax v2.3.1-MOD_2.1. With it, the message box 'device does not meet security requirements...' does not appear anymore. However, in menu -> Tap to pay setup, there is still a message "Phone does not meet security requirements'
[Magisk] AndrzejDwo:
you would have to describe your full setup if you want people to be able to help you. which magisk you use, if deny list is enforced and gpay added into the list, if your device meets basic integrity etc etc etc
[Magisk] BesoC:
By all means.

Phone is OnePlus 6T, RiceDroid 10.1, build date: January 17th, Android 13.

Magisk 25.2, hidden and renamed with following modules:

Zygisk with enforced DenyList of all google apps and services installed on the phone:

SE policy set to permissive

Anything else I've missed?
[Magisk] AndrzejDwo:
you missed play integrity check result. the other thing is that you have too many apps on deny list imo, this might result with the opposite result than expected, also you don't need magisk hide props when you use usnf mod by displax, and the last but not least - would be good to switch to ENFORCING SE LINUX if possible, i never tried to setup Gwallet on permissive tbh.

cheers
[Magisk] pndwal:
Yup... Try standard setup; remove ALL things Google from denylist other than G Pay/Wallet and try official 2.4.0 again... remove MHPC also...

AFAIK, PI deviceIntegrity cannot pass w/ selinix set to permissive.. Just don't do that!!! (At least say why you want/have that.)

Or is permissive selinux set by ROM?... Nb. permissive allows Devs to troubleshoot/fix major issues with a ROM and bypasses many of them... ROMs released w/ permissive set should be considered insecure, experimental and unsuitable for daily use...

Check have PI deviceIntegrity in Play Integrity API Checker; if so it's job done... Or move back to @Displax mod/fork...

Nb. Even when nothing is wrong with a setup any longer, clearing Google Play Services data is sometimes (often?) needed to restore deviceIntegrity etc... Some users have even needed to disable USNF module (official or forked), reboot, enable and boot again to fix...

Clearing Play Store data and/or Play Protect Services data if it exists (A12+?) may also be needed to restore Play Protect 'Device is certified' in Play Store Settings, About... This will affect whether Google Pay and other apps calling S/N or PI APIs appear in the Store

Once PI deviceIntegrity is restored / passing, Google Pay/Wallet security requirements may pass again after some days (could take a week!) if simply left... Clearing Google Play Services and Google Pay/Wallet data will fix this immediately but you will need to set up cards again... Nb. Be sure to reboot immediately after clearing Google Pay/Wallet data (before opening app for first time) to avoid issues persisting (eg. app works but Activity list fails to populate)...

🤠 PW
[Magisk] BesoC:
OK.

Removed MHPC from magisk modules

Removed everything from denylist except Google Wallet

Set SELinux to enforcing - I set it to permissive earlier because of Viper4AndroidFX

Reboot

Still PI checker shows red cross for MEETS_STRONG_INTEGRITY
[Magisk] AndrzejDwo:
that's normal and gwallet should work
[Magisk] pndwal:
Perfect!...

I didn't say you need strongIntegrity... When Google/banks start enforcing that it'll be a sad day for modders... Also, customers using any device w/ A7 or less + many modern OnePlus etc w/ broken keymaster will be collateral damage... deviceIntegrity is what you need ATM as stated... PW
[Magisk] BesoC:
Ah, I thought everything should be green :) Will clear PlayServices and Wallet data then...
[Magisk] pndwal:
... PI strongIntegrity is like having S/N ctsProfileMatch=true + evaluationType=HARDWARE_BACKED, but even stricter... Banks/Google haven't gone there yet w/ S/N API nor PI API... PW
[Magisk] zgfg:
If using V4A FX 2.7.2.1, it doesn't set SE Linux to Permissive and you should not need to force Permissive manually

And no need for Strong Integrity was already answered by others (and for the mater of fact, the same was commented numerous times in this thread already)
[Magisk] BesoC:
Thanks a ton guys, Google trusts me again :)

One more question - if I update safetynet-fix to 2.4, will phone still pass the check?
[Magisk] BesoC:
No, it does not set by itself. I had problems enabling its driver, one thread on XDA was strongly suggesting to set SELinux to permissive. I did and it worked, so... 🤷‍♂️. However, now when I reverted it back to enforcing, Viper still works 😊

I did not search for STRONG_INTEGRITY, my bad
[Magisk] BesoC:
SafetyNet-Fix 2.4.0 works for me :)(y)
[Magisk] zgfg:
Good that V4A V2.7 works for you with Enforcing mode (as it should)

Btw, there are two newer versions:

1) Repackaged V4A - finding and patching audio drivers when they are scattered to other system folders (needed for some devices):

GitHub - programminghoch10/ViPER4AndroidRepackaged: A refined ViPER4Android installer.

A refined ViPER4Android installer. Contribute to programminghoch10/ViPER4AndroidRepackaged development by creating an account on GitHub.

github.com

2) (1) + Reverse engineered V4A alpha v0.2.0 support for 64-bit audio drivers (needed on some new devices that could not fall-back to 32-bit audio drivers):

GitHub - AndroidAudioMods/ViPERFX_RE: Reverse Engineering of ViPER4Android FX

Reverse Engineering of ViPER4Android FX. Contribute to AndroidAudioMods/ViPERFX_RE development by creating an account on GitHub.

github.com

Both also don't require SE Linux Permissive. Might need AML v4.2 (recently updated):

https://raw.githubusercontent.com/Zackptg5/Audio-Modification-Library/master/install.zip

PS:

And don't forget to enable Legacy mode (and of course, Master limiter)
[Magisk] BesoC:
Thanks for sharing :)(y)
[Magisk] pndwal:
No... Days when that was needed are gone...

I used to use the install-and-disable-AML trick for fixing driver problem, but I realised we simply need a way to 'reset' driver once in Legacy mode...

Simply disabling module and rebooting, then enabling and rebooting again works and Neon driver installs properly without installing AML etc... If you do get Driver Status: Abnormal again in future, eg. If you need to reinstall, just use this trick to fix it...

Also, I use this build now which seems to fix old issues too:

https://github.com/programminghoch10/ViPER4AndroidRepackaged

👍 PW
[Magisk] BesoC:
Yes, legacy mode switch trick worked for me 👍. Many thanks for your help 🙏
[Magisk] DerGriechisch:
this summer google introduced a new api and thats why youa re having touble

install this https://play.google.com/store/apps/details?id=gr.nikolasspyr.integritycheck&hl=en&gl=US and check

you need to get MEETS_DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY green

you can do this with magisk hide and various magisk modules

i managed to do it by selecting EVERYTHING in magisk denylist (every single app including system apps)

once these two are green you need to delete

1.google play services app data

2.play store app data

3.wallet app data

if everything works you can now go to wallet tap to pay setup and you will see that "Your phone meets security requirements"

enter your card number etc and you are ready !

let me know if it works ;)
[Magisk] m0han:
I don't know about you @pndwal, but I believe @zgfg was using v2.7.2.1 which is just 1.62 MB in size, whereas the new one is 85.1 MB in size. Just wanna ask you guys whether there is any significant improvement in sound over the old version. I believe the two of you are not on A13 (yet).
[Magisk] zgfg:
Repackaged is not an 'official' V4A

It was still v2.7.2.1 but enhanced to search for the other/duplicated folders with copy of (32-bit) audio drivers that also need to be patched for the newer phones (actually, I had my post-fs-data.sh modifications and the developer incorporated them into the V4A Java code)

Depending on the phone/ROM, that might be enough for installation of V4A on A13, or not.

However, as I mentioned in my previous post, some new phones (even with A12) require the use of 64-bit drivers and for that you would need the Re-engineered v4A (currently Beta v0.2.0, IRS and some other filters are not yet supported - but generally Beta was confirmed to work even by A13 users)

---

If you unzip (or install) the Repackaged V4A, you could see that developer also included an archive of 80 MB IRS filters - that's why his zip file is that big

Anyway, there is another thread dedicated to V4A, hence please use that one for further V4A discussion:

https://xdaforums.com/t/app-all-root-solutions-6-0-viper4android-fx-2-7.3774651/
[Magisk] pndwal:
... Yup, audio engine is the same, so doubt much has changed for audiophiles... Ease of installation seems to be improved w/ this package installer; Neon driver setup just works IIRC... 🙂 PW
[Magisk] raulci:
So, after some months without any issue, now Google Wallet/Pay is complaining that my Xiaomi Mi9 is rooted...

I have safetynet fix 2.4.0 installed.

Anyone is having issues too?

Thanks!

Edit: just read here https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/page-142 and it's happening the same to some other colleagues. Reverting to 2.3.1 mod.

Thanks! Great community!
[Magisk] Fry-kun:
+1, wallet stopped working in the last couple of days

Had safetynet 2.2.0 (updating to 2.4.0 now) & shamiko 0.6
[Magisk] pndwal:
Yup...

Clearly new 2.4.0 is failing intermittently for many, and Google Pay/Wallet users particularly are getting failures w/ 'Device doesn't meet Security requirements' message as Google monitors device security even when Pay/Wallet is not invoked... I recommend using @Displax's USNF modded fork at least until official USNF is updated...

I gave what clues I have in post in USNF thread:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88049087

Many more comments there follow... PW
[Magisk] Fry-kun:
Broken link 😓
[Magisk] Fry-kun:
Installed Displax' usnf 2.3.1-MOD_2.1 (from GitHub) and seeing the same issue.

Edit: cleared Wallet cache and it's not complaining now... So maybe it did work.

Will test payments later
[Magisk] pndwal:
👍... Fixed. 🙂

What symptoms?... PW
[Magisk] qetuol:
My Gwallet also stopped to work a few days ago despite [see attached picture].

I did not modify anything in system,it just stopped to work with "Your device doesn't meet security requirements". Any idea? Is it now gone for good?
[Magisk] bizkit_120:
Same issue here , everything works fine 3 days ago,didn't update anything nor security patch update. Yesterday when I try to make a payment it tell me on the payment screen phone doesn't meet security standard. Back home Tried safety net 2.4.0 worked about an hour when i retry integrity api checker first one failed,mean time try add card to wallets failed too..😑

Downgrade to 2.3.1 straight way integrity checker failed.

Have to say goodbye to wallets for some time.. Will see you again..😢

OnePlus 9 oos13

.
[Magisk] rodken:
Not to 'toot my own horn' - I might be one of the lucky few that doesn't have any issues with GPay while running 2.4.0 on the OnePlus 8 OOS 11 while passing Basic and Device Integrity.
[Magisk] pndwal:
OnePlus 8?... Doesn't Momo show 'Tee broken'?... (It's actually not, but Devs mean keymaster implementation is broken)...

If so (IIRC), you don't even need main USNF functions!; neither fake keystore registration to trip fallback to Basic attestation nor prop changes to bypass hardware attestation based verdict enforcement as your broken keymaster already trips fallback to basic and Google don't enforce hardware attestation based verdict enforcement using your devices expected prop values as they know which OnePlus devices (and others) are broken...

It seems that the recent failure relates to USNF's key fake keystore registration function/timing...

You most likely only need root hiding for gms attestation (droidguard) process (com.google.android.gms.unstable) and resetting of some sensitive props to pass S/N or PI deviceIntegrity... USNF also performs these functions since we no longer have MagiskHide doing this...

👀 PW
[Magisk] bizkit_120:
Update: 😃 Finally it works... don't know how long it can lasting...🤞
[Magisk] casouzaj:
For me, too. Couple of days ago, Wallet complained that my device didn`t match security standards. Then, downgraded to USNF-MOD-2.1, rebooted, and Wallet is back to work! Xperia XZ2 running LineageOS 20.0. Magisk Delta Canary. Zygisk, Magiskhide and SuList are enabled.
[Magisk] bizkit_120:
You will also need to make sure wipe out Google service cache just in case if any funky residue may back to you some time later..
[Magisk] pndwal:
Did you move to @Displax forked/modded USNF?... Should last with that... Until official 2.4.0 gets fixed... PW
[Magisk] shoey63:
@pndwal

Which is the best @Displax fork?

There's a couple of 2.31's and a 2.40

Edit. Obviously not required for my Rog 3, but I am going to try This method on my pixel 6 to achieve locked bootloader and rooted with Magisk to try and pass "Strong Integrity"
[Magisk] pndwal:
Ah, all 3 published ones are 3.31 based... Read spoiler notes here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87198517

You can use any... Last 2 needed for P7 and any device launched with A13... Final build has Hide "Enable OEM Unlock" setting... Jury's out on that; I think @kdrag0n didn't want to include it...

Doubt you'll achieve that; Hardware will still attest to custom keys/signing used / custom root of trust set, ie. Yellow state... That's still technically a Verified Boot issue category... You'll need verified Green state to pass strongIntegrity... 😬 PW
[Magisk] bizkit_120:
I tried 2.4, 2.3. none of them work, eventually found out this 2.3.1 mod which works perfectly fine . I was keep run integrity api checker today morning.. so far so good .. first 2 pass, Strong I haven't seen it ever show me green check mark since I rooted my phone...not sure anyone ever seen Strong pass..
[Magisk] j0110:
Getting stuck on this screen right after Google Wallet being installed...

Any ideas ?
[Magisk] centaurium:
Just downgrade play services to version 22.50.55 and add play services to the update locker lsposed module and no more wallet issue.
[Magisk] j0110:
I'm using MicroG. Should I downgrade Play Store to 22.50.55 ?
[Magisk] cmstlist:
Just wanted to report on Pixel 6a this seems to have worked?

I removed 2.4.0, added the above mod, then before any reboots I did a force-close + cache clear on Play Store, Wallet and Play Services. Did not wipe data of any. Then reboot. On first open of Wallet app it still complained. But then after quitting and reopening the app, no further complaints.

EDIT: Yes it worked. The error appeared when I tried to make a payment at a cafe this morning. After doing the above I went grocery shopping and was able to pay again.
[Magisk] xabier-bo:
Couple of weeks ago I found strange "card rejected" messages while paying with gwallet. But immediately, after the first failing attempt it was accepted.

Then I read the posts here sharing new problems, while everything had been working fine until now.

So I checked the gwallet app (I never look at it), and discovered it was complaining with the "old" message: this device doesn't meet...

I wiped apps caché (google play and gwallet), rebooted, got a first complaint of not meeting requirements, but closing and reopening the app made it disappear.

So, I decided a more "conclusive" approach. I went to the supermarket and payed with the gwallet without any problem.

So, this is my situation: I've had to downgrade nothing, I've kept USFN v2.4.0 by kdrag0n, and I'm paying with gwallet.

Hope it's helpful for your "diagnosis"
[Magisk] pndwal:
The failures with 2.4.0 may be random, often occuring with a reboot...

Google monitors device security for G Pay/Wallet full time, so whether PI deviceIntegrity fails momentarily or user removes lockscreen pattern/password and immediately restores it, Pay/Wallet will likely lock out contactless payment use even while Pay/Wallet is not in use and either require resetting (clearing data for Pay/Wallet and/or Play Services) or will be restored after some time...

We need a fix for detections in official solution, but @Displax modded USNF builds are not failing this way and are working fine for most users ATM. PW
[Magisk] xabier-bo:
So the situation is clear enough.

Thanks, PW!

PS. ATM but also payment terminals 😜
[Magisk] Garbonzo17:
Ok, these 2 posts cleared up ALOT of my confusion about how this works! (I think)

I had my OP9 w/oos13 working fine up until a couple of days ago, and was going bonkers trying to walk back whatever had happened... I think what I did was enabled enforcing the list so I could add kroger so I could use their shopping app, but left gps on the list??? I have removed that, gone to the USNF/displax v2.1 and not only have google wallet and kroger in the deny list. I gather there may be still overlooking something simple or doing something out of sequence... still passing basic integrity and CTS match, same as before, have cleared storage+cache for wallet, gps (and kroger for good measure) and now still having no luck with getting wallet/pay to work. I am trying some other things but if anyone can be precise with anything I am not grokking it would be much appreciated! TIA!