yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
USNF has issues as you'll see here... So

... Don't put gms (Play Services) in denylist for ANY USNF builds. (Only needed for custom ROMs integrating @kdrag0n's SNF or their own solutions for S/N / PI)...

Please be specific what you mean by

... Are you getting the "Google Pay is Currently Updating..." Screen that never goes away? Other?... PW
[Magisk] Garbonzo17:
No, but I got everything working again. And my fix isn't gonna jive with what I am seeing here (I don't believe).

I currently have also made the cardinal sin of changing MORE than one thing at the time... so I am NOT 100% why it works now...

1st (and probably NOT relevant) I have GPS (only com.google.android.gms nothing else) and Google Wallet on denylist. Set Enorce DenyList=off though, so I am even more confused that I was... (but this is how my OnePlus 6t is set, so I did same)

2nd I switched from Displax v2.1 mod back to 2.0 (I think I was originally using that from when I did the whole Tmo conversion of this phone back in December...

3rd I went through the process of uninstalling wallet (actually disabled again in addition to uninstalling updates), dumping updates for play store/services and storage/cache, rebooted, and cards added fine without the red circles telling me contactless no good cuz I suck!

So, it is probably #2 or #3 (I feel like probably the steps in #3), and I really have to (and hate) to move on with my day, this has eaten enough, but I feel like I understand marginally more than I did.. and it was your posts both in this thread and others that you linked to that got me to the goal (even if it may be temp, considering I don't know what blew it up a few days ago, but from what I am reading I am certainly not the only one having these issues... and guys like you doing the lords work in making stuff work for those of us that like to tinker...

THANKS (to everyone, really) for this community.

-G
[Magisk] pndwal:
Play Services is generally referred to as gms, not GPS...

But gms in denylist with USNF?... Why? ... USNF will hide that itself as denylist prevents zygisk modifications in gms... If denylist is not enforced and proper hiding modules source denylist for convenience there is usually no conflict, but both Shamiko (or other) and USNF will be competing to hide root from attestation/droidguard (com.google.android.gms.unstable) and/or main (com.google.android.gms) process...

Zy-USNF works w/o denylist enforced as it does its own process hiding (unlike Riru-USNF which used MagiskHide's hidelist) since denylist breaks modifications in 'denied' processes... It's denying Magisk modifications...

Long explanation: Denylist can hide root from gms, but then the primary fix, which uses Zygisk to inject code into gms to register the fake keystore that produces the exception which causes our fallback to basic attestation will be broken!!! (... because denylist prevents zygisk modifications in processes as mentioned above.)

No... Stay on any of @Displax's modded builds for now... PW
[Magisk] wfred:
Yeah, I am.

Cleared play & wallet cache & data, downgraded from 2.4 to 2.3.1 v2.1

Now it's stuck on Google Pay updating.

How long does it usually take for that to clear?
[Magisk] pndwal:
Nice interception of that ball! 😉

Answered here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88092445

Hope it helps...

🤠 PW
[Magisk] Fun_GKC:
Suddenly can't use Google Pay today. Anyone has the same issue?
[Magisk] Fun_GKC:
Suddenly can't use Google Pay today. Anyone has the same issue

nvm. Just read the last page.
[Magisk] Rokcy98:
I have your same problem, did you solve this?
[Magisk] bombadier:
I have just had a strange experience, wallet was working fine on Thursday, went to pay for a takeaway tonight and wallet payment was rejected with the message your phone doesn't meet security requirements, checked play integrity API checker and my device was failing meets_device_integrity, my banking app is still working, read some of these comments and downgraded from USNF 2.4.0 official to USNF 2.3.1_2.1 MOD by Displax and rebooted my phone, after rebooting I passed meets_device_integrity, still had the error in wallet so wiped cache and reloaded the app, error message is gone, will see if wallet works tomorrow at the shops but not sure what the issue was other as 2.4.0 just randomly stopped working

Update not tried to use wallet yet but am still getting the error when opening the app, have deleted my bank card and added it again which was successful, just need to test making a payment

Update Google wallet seems to be working just made a payment
[Magisk] Garbonzo17:
If you re-added the cards and it seems normal when you attempt a (dry) purchase, you should be good to go. (I was in your situation earlier in the week, and have been using everything fine for the last 3 days or so)

I am still unclear as to what caused working installs (using USNF2.4.0 official) to just stop working...

But as long as people better with these things than are working on this situation (and USNF2.3x/displax holds) I feel pretty good about things!

Thanks again to @pndwal and others for taking the time to explain things slowly enough for non-coders to follow.

-g
[Magisk] cmstlist:
Follow up: this weekend I've been often getting the message about my device not meeting security requirements, when opening Wallet app. It's especially prone to happen when I launch it from the Wallet quick settings tile. But after getting the message, the contactless symbol is not crossed out, and payments still work 🤷‍♂️

Clearly there's something going on that could use another fix.
[Magisk] pndwal:
Are you using a custom ROM? If so, which? PW
[Magisk] cmstlist:
No, stock Pixel 6a on latest Android 13, latest Magisk. Universal SafetyNet Fix V2.3.1-MOD_2.1 by kdragon, modded by Displax
[Magisk] pndwal:
mmm... Then it may have just been a glitch... I've seen this inexplicably before also...

You could try earlier @Displax mod builds that don't build Hide "Enable OEM Unlock" setting... @kdrag0n was concerned that this might cause per-device breakages and @Displax has agreed that it shouldn't be merged in official USNF, although it caused no problems for me (Xiaomi RN8T)...

Summary: You need neither:

nor:

but you do need:

... 😶 PW
[Magisk] cmstlist:
Sure I'll try the older mod. On first reboot no complaint from Wallet, Safetynet still passes. Will see if it stays consistent.
[Magisk] cmstlist:
Update: No I'm having the same experience as before. Open Wallet and get the warning, but then it seems to work anyway.
[Magisk] pndwal:
mmm... Just checked mine and strangely enough I can now confirm you are not alone:

... I've just cleared Google Play services data and tried opening Wallet but it's icon was removed from app drawer in lauuncher... Opened Play Store and wallet is still there:

But after opening from here:

... This isn't completing... Again...

Will get back to this later... 😬🤔🙃 PW
[Magisk] cmstlist:
Interesting, that's MORE non functional than mine

For me it's just sporadic and no failed payments so far. Except for last weekend when I was still on USNF 2.4.0. It seems like there are different conflicting sources of checks going on and having some kind of race condition. Sometimes the successful check wins, sometimes the unsuccessful wins. On my device the unsuccessful check lives just long enough to give me an error, then the successful check appears to take over 🤔
[Magisk] bombadier:
After my spot of bother yesterday since going back to Displax's version of USNF (That fixed the failed meets_device_integrity), I was still getting the error message after wiping wallet's cache, since deleting payment method and adding my card I have had no further error messages in wallet and can make payments
[Magisk] cmstlist:
Good to know, but it seems all the anecdotes here are along the lines of "Aha! I did X and that fixed it... [insert 1-7 days] nope that didn't fix it"

So I think there will have to be some new fix/patch developed to deal with a new behaviour.

I'm taking this phone on vacation in 2 weeks for a 5-week vacation to mostly Australia. If Pay fails, no sweat, I can still use the physical cards in my wallet. But two things I might hesitate with:

- Using Pay for contactless entry to the Sydney transit system. If it succeeds on the way in and fails on the way out, I'm stuck and might have to pay a fine. (It treats the phone as a different device than the physical card.) Plus if I use the same card regularly it applies fare-capping daily and weekly, and that won't work right if I start via Pay and have to switch midway to the physical card.

- Using the mobile Myki feature in Melbourne via Wallet instead of a physical card. If I load money onto mobile Myki and then Wallet fails on me, the money becomes inaccessible. Plus if I wipe GP Services it destroys the transit card and the money is not retrievable.
[Magisk] pershoot:
Please note, Wallet started complaining (as is the case with others) when on 2.4.0 (kdrag0n). Rolled back to 2.3.1_mod_2.1 (Displax), cleared cache for Wallet (for precaution) and then updated Google Play system. After ~+24 hours, it has dropped off and no more apparent error messages (as of yet).
[Magisk] rafikowy:
Tried everything from this thread - GPay still not working - even on latest Canary. :/ We are on the same boat guys.
[Magisk] pedritopl:
Good to know. For me it's working again since two days on Canary, but now I know what to expect so I'll better be carrying the regular card with me ;)
[Magisk] Nosferatu.:
Sounds like everyone's results are truly hit & miss. I was able to add them but cannot make purchases. I'll just use my actual card so it's not a deal breaker. There will need a fix on Magisk's side of things for this to work IMO. Install order this, play services that, etc. etc. etc. Seems like it just buys temporary time until server side updates/changes are forced by Google and you're back to defunct Google Pay.
[Magisk] Web_E:
Hello everyone,

I have created two tasker task which help me in bypassing root detection on my OP3.

This is for Gpay (India) / Tez

One task is to remove phone permission from play services, stop and kill GPay then relaunch it. (The trick to remove phone permission, is to execute pm revoke twice)

Other task is to grant phone permission for play services.

Prerequisite:

You device must pass safetynet , can check on magisk. If not try to change fingerprint of the device using "Magiskhide prop config" module

Root permission to tasker.

How to use:

- Download files from below link and import them to your tasker. You are welcome to verify the contents of the task.

- Create task shortcuts to your home screen

- Execute "Launch Gpay" and verify that phone permission is removed for Gplay services. Verify Gpay works

- Execute "Grant" task when done to avoid play services error.

Caution:

- When using apps which uses Gpay through intent launcher (like paying in swiggy) , before you select Gpay for payment, minimize the app, launch GPay using the shortcut then switch back to the app and continue payment.

- Might increase chances of "better luck next time",:p not very sure of this. I do get occasional normal cashback and guaranteed ones.

Tasker files

https://drive.google.com/open?id=1HQSInvBW1GaUdica0laFoSfRjEHDs-Hl

TIP

For me phonepe requires same settings, in that case clone the "Launch Gpay" and change app details for phone pe.

Hope this helps.
[Magisk] Djtrip83:
Last Friday, that is 4 days after fixing, everything broke again. Surprisingly, everything worked fine even when play services upgraded to the latest version and all was fine until the end of day thursday when root was again detected and no tap and pay worked. I am so curious to find out what is making MagiskHide not working...
[Magisk] DanRyb:
Are you using "Tez"? India's version of Google Pay? I had to go in and modify your Launch GPay task because it was bombing out on actually launching the app. When I Googled what was being launched, Tez came up.

So I modified your task but it's still not working. I tried to add a card in and getting a message stating Google Play Services needs Phone permission in order to work. Doesn't seem to let me advance past the message.
[Magisk] Web_E:
Yes it was for Gpay india /Tez . Updated the description.

Ok, so the international version has put a check for phone permission of google services. Then probably have to wait for magisk update.

I guess the check will also find its way to Gpay India :(
[Magisk] DanRyb:
Thanks, it was worth a shot at least! Hope a Magisk fix is rolled out soon. :)
[Magisk] PuffDaddy_d:
I'm glad that worked for you but I've had no such luck. Nothing I've tried has worked in the past 2 weeks. I'm losing hope.
[Magisk] andrewwdai:
I can confirm that downgrading GMS to 14.7 version works.
[Magisk] Bogega:
Magisk 18.2, downgraded GPS and GP, data access restricted, magisk hide etc - everything works for a day or two max.

Then GPS somehow updates itself to 15.0.90 (usually happens overnight) and GP stops working again.
[Magisk] prot-:
How do we downgrade?
[Magisk] b3rsus:
This way=)
[Magisk] StirringDesert:
Didn't work for me :( Everything is working fine with ver. 14 but it still autoupdates to faulty ver. 16
[Magisk] caluz78:
Sorry for you.. Mine not be updated from 14/03. :(
[Magisk] Nekromantik:
16.0.86 GPS stopped working yesterday for me.

Was working fine on magisk 18.1 but now can't pay again in shops.
[Magisk] joeyddr:
Broke again here also...
[Magisk] beatschubser:
32 pages and you guy still don't understand that the problem is on Googles end. Right now it's pure luck if Google Pay is working and has nothing to do with all the "fixes" that have been posted. Causation != Correlation!
[Magisk] joeyddr:
If that is the case how come it works for a few days after clearing google play services data?
[Magisk] nrpetonr:
It only works as long as play services do not get updated. Simple as that...
[Magisk] pershoot:
Wallet is def. spamming with it, but tap to pay setup shows good (unlike previous where tap to pay setup showed issue). tap to pay seems to work.
[Magisk] bigknowz:
Thanks for the info, Tap to Pay stopped working this morning, root detection. Went back to mod_2.1 and Tap to Pay working again.
[Magisk] simplydat:
Thanks for this. Rolled back to 2.3.1 by Displax.
[Magisk] bigknowz:
Stopped working again this morning. Anyone else noticing?
[Magisk] casouzaj:
Have just paid through Google Wallet, with USNF-MOD-2.31-v2.1. No changes for me on this subject.. Sony Xperia XZ2 running LineageOS 20.0. Latest Magisk Delta Canary. Zygisk and MagiskHide are enabled. SuList is not enforced.
[Magisk] casouzaj:
Well, you have to pass both the basic and the device integrity tests, (except the strong one, of course) in order to be able to use Google Wallet. Search your device's threads for specific help on that matter.
[Magisk] bigknowz:
Guessing you are not on latest version of GPS. That seems to break CTS.
[Magisk] pndwal:
+ Others...

This:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88103103

🙃 😬 PW
[Magisk] casouzaj:
My Play Store app was updated today. These are its 'About' info, along with gms'. Are these the latest, which have been giving people headaches today? I ask it because I keep passing the device integrity test, and my Google Wallet is still good to go. Might it be that Sony is extremely dev friendly?
[Magisk] m0han:
Not just Sony, I guess. GPay works, as of now.
[Magisk] pershoot:
tap to pay setup flipped back to security requirements error (on displax 2.3.1-mod_2.1).

have not tested at terminal.
[Magisk] pndwal:
Expected... Upgrade to @Displax's v2.3.1-MOD_3.0...

NB. Users of ROMs integrating prop changes/spoofing may need to wait for a fix from maintaining Dev. 👀 PW
[Magisk] pershoot:
Yea, I updated a lil while ago. Will wait ~+24 hours for this to potentially drop off and observe.
[Magisk] pndwal:
Did you check deviceIntegrity? PW
[Magisk] pershoot:
I didn't before, but did just now as you mentioned it. passed.
[Magisk] pndwal:
Should come right without intervention as long as you have PI deviceIntegrity... Can take a week... Clearing data definitely clears detection flags but can be arduous establishing setup / Wallet updates again... Clearing cache only is safe but may not reset detection flags... PW
[Magisk] BesoC:
Magisk hidden, Zygisk enabled, safetynet-fix 2.3.1-MOD_3.0 installed

Force stop, clear cache and storage for Google Play Services, Play Store and Wallet, reboot.

Repeat 4 times

Still Play Integrity API Checker shows red cross for MEETS_DEVICE_INTEGRITY

EDIT:

Uninstall USNF, reboot, check with Integrity API Checker - got 3 red crosses, predictable.

Reinstall USNF, reboot - MEETS_DEVICE_INTEGRITY is red :(
[Magisk] pndwal:
Don't bother fixing Pay/Wallet till you have deviceIntegrity...

It's pretty much useless posting issues like this w/o at least giving device details/ROM/mods... But I remembered you. 😉

OnePlus? RiceDroid?...

... I just posted re. this today:

🙃 PW
[Magisk] BesoC:
You have superb memory mate :) It's OnePlus 6T and RiceDroid. Maybe I should try MagiskHideProps?
[Magisk] asripath:
FWIW

Currently device just meets/passes basic integrity.

Have gpay in island work profile...

no issues so far in payments.

Maybe user's should explore that option too while waiting for custom roms to roll-out fix.
[Magisk] _Raziel666:
Just tried that but I get the message:

The only choice is "OK" and when pressed, it shows the same message.
[Magisk] asripath:
Are the usual suspects like gpay,play Store,play setvices etc in deny list ?
[Magisk] _Raziel666:
Not rooted!
[Magisk] V0latyle:
If your bootloader is unlocked, the only way you're going to be able to pass Play Integrity and use payment apps is with Magisk. I tried explaining this to you in the Magisk discussion thread. Without root, Magisk cannot load modules, nor can the fact the bootloader is unlocked be hidden.

If you're not going to use root, you should stay on the OEM firmware and keep your bootloader locked.

You can't have it both ways.
[Magisk] _Raziel666:
@asripath mentioned using Island's work profile and Island can work without root too, that's why I tried it.
[Magisk] V0latyle:
It still doesn't isolate apps from the device environment; since apps depend on the Play Integrity API, failing BASIC and/or DEVICE integrity will prevent payment apps from working.
[Magisk] _Raziel666:
For some weird reason (and long before all this crap with GPay), I found out that my banking app was refusing to work in my non-rooted phone, but when using Island the same app was working flawlessly in the work profile. Go figure...
[Magisk] V0latyle:
How long ago was this? Play Integrity is fairly new and was only introduced last year.

Your bootloader is unlocked, correct? Without fixes being baked into the Android build you're running, there are only two ways to be able to pass sufficiently to run payment apps:

Locked bootloader with unmodified firmware

Unlocked bootloader, Magisk root + Zygisk + modules to force basic attestation

There is no in between.
[Magisk] _Raziel666:
I'm running a custom ROM (i.e. my bootloader is unlocked) in my surya. The problem with the banking (not payment!) app exists since an update they did a couple of years back.

Waiting for an update in the custom ROM I have that supposedly resolves the issue. If not, I will go down the road of root, etc.
[Magisk] xabier-bo:
Well...

Today I've been able to pay with GPay. It's a new risky sport: try to buy anything

Magisk 25.2; USNF 2.3.1 MOD 3; Enforce Deny List; and just clear GPay cache

It seems that for a couple of days we are allowed to pay...

Under his eyes! 😅
[Magisk] Dasher81:
Poco f3 custom pixalos rom

Pay and revolut stopped working, now working again thankfully

Magisk 25.2

USNF 2.3.1 MOD 3

Enforce Deny List (block google services, pay, play and banking apps)

clear GPay cache
[Magisk] m0han:
Magisk Delta (latest, almost always) + Riru +...... works for me (as of now) on Poco X3 (Karna) running AICP A12.1 (10-Feb release).

:giggle:

:D
[Magisk] cmstlist:
Just wanted to be sure, on my device:

- Pay/Wallet are in DenyList

- Play Store is in DenyList

- Play Services is NOT in DenyList (because we need SafetyNet fix to be able to do its thing)

Is that what's recommended for best results or did I get any of it wrong?
[Magisk] pershoot:
Dropped off earlier, tap to pay works, all pass in tap to pay setup, no errors as of yet.
[Magisk] pndwal:
No it's not!

But it can be hidden!

Why?

But you can! 😜

I've explained it to you in Universal SafetyNet Fix discussion thread...

But for clarity and for others, root and USNF are only needed for fixing device integrity attestations when a ROM doesn't implement native fixes, or, as in this member's case and many many more recently, where the ROM's integrated integrity attestation solution requires updating by maintainers because of changed Google server end checks etc...

Your statement may apply to stock public, developer, and beta ROMs as well as clean custom ROM builds like official LineageOS, but it's definitely false as users of custom unofficial LineageOS and even many official builds of the likes of Evolution X, CrDroid, Proton, RiceDroid, Bliss, Paranoid, Resurrection Remix, etc, etc, etc do enjoy passing SafetyNet and PI deviceintegrity with neither root nor USNF module etc!

Many (most?) of these ROM maintainers pull commits directly from @kdrag0ns current Proton builds (per his recommendation; and he supplies two technically different variations of SNF for Devs to choose from) which generally pass integrity attestations natively (ie. w/ NO root!), and augment these with @Displax's up-to-date fixes... Others likely build with their own variations on SNF...

I personally prefer a 'clean' ROM (no integrated prop/signal manipulation or spoofing) + Magisk + USNF variants to pass device integrity verdicts, but many want a custom ROM without root... It's a personal choice to adopt either approach... And a custom ROM Dev's choice...

😬... 😉 PW

... Gotta love that signature!

- First time I've seen it... Usually access XDA from phone... 😁
[Magisk] V0latyle:
My assumption was:

I understand that custom builds may implement native fixes and do not require root...or additional fixes in that case.

9 yrs in the Marines. You can take the man out of the Corps but you can't take the Corps out of the man
[Magisk] pndwal:
The key thing that breaks device integrity and attestations to the same (incl. old S/N API) is unlocked bootloader... Root is a secondary sign that a device is tampered.

If a ROM doesn't attempt to hide AVBs broken chain of trust in userspace attestations, Magisk modules can do this... Nothing can properly hide this in hardware-backed attestations.

Sandboxing apps can prevent these from accessing userspace signals that attest to tampering and can work especially if the app fails to test why it cannot access device integrity attestations... However many apps are not satisfied when S/N or PI attestations cannot be accessed and will also look for signs of sandboxing as well as spoofed environment signals...

The level of sophistication for insecure execution environment detection in bank apps varies wildly; those employing professional 'security' engines like Promon are tougher nuts to crack...

🤠 PW
[Magisk] pndwal:
Assumptions or not, those were sweeping generalisations that failed to consider countless modders using custom ROMs that spoof environment checks... 😁

Interestingly, even @kdrag0n recommends the non-root ROM integrated spoofing approach from his Proton project as the 'ideal' solution for custom ROMs:

https://github.com/kdrag0n/safetynet-fix#rom-integration

This way @kdrag0n has made it easy for ROMs to pass device integrity attestations natively and without root or USNF... We shouldn't forget that XDA is principally a mobile software development community supporting custom ROM modders as well as root users...

... Guess I'm taking a risk contradicting you then! 😜... (We seem to miss a lot on XDA if not using a larger-screen device...)

Should I be glad I'm down under and you're way up there standing on your head? 😝

Best regards, PW