yashsingh1/xdaforums huggingface dataset:
[Magisk] tangcla:
Where do I get the mod 3.0 version from?

And should I be using 2.3.1 mod 3 from Displax or 2.4.0 from kdrag0n? It stopped working for me recently.
[Magisk] Fishawy:
[MODULE] [MOD] Universal SafetyNet Fix

Universal SafetyNet Fix [MOD] Magisk module Hello. This is my modification [FORK] of the original Universal SafetyNet Fix module from @kdrag0n. Created for the (temporary?) restoration of working capacity in the conditions of constant change...

xdaforums.com
[Magisk] tangcla:
Thanks.

After using 2.4.0-MOD_1.2 it appears to be working again.
[Magisk] qetuol:
Just a quick update for you guys. The "Enforce Denylist" option must be turned OFF, otherwise gpay won't work. I tried and tested this. Don't worry if you don't pass device integrity, as long as you have a checkmark for "your phone meets security requirements" you are good to go (see image).
[Magisk] rodken:
I beg to differ.

-- Most if not all OnePlus devices can have Enforce Denylist enabled and still have GPay functional.
[Magisk] Virnik0:
This is so weird. I have Galaxy S22 and Galaxy S20+, both with latest stock firmware + Magisk 25.2, I have all google apps in DenyList. Also, the ROM is heavily modified: I disable almost all Samsung Apps (except for system-critical). SafetyNetFix of latest Git-downloaded version installed, TWRP also of latest available (corsicanu's build). Everything works, but Google Wallet sometimes throws a pop-up warning about root. I usually kill the app, wipe it's cache, start it again and I can again pay without problem. Also, no matter what, contact-less payment have all checks green, despite prior toast warning. Reboot also fixes the issue (making payments possible again, in cases where cache wipe or app-kill won't work).
[Magisk] Fishawy:
If you're using the original Universal SafetyNet Fix by kdrag0n, you might wanna switch to the Displax fork linked a couple of posts above and test.

Hope this helps.
[Magisk] Virnik0:
Yes, just did so. I'm using 2.4 MOD from this thread. Will see how it works
[Magisk] DineshValor:
Requirements:-

- Magisk v25.2

- LSPosed v1.8.6

- PrivacySpace v1.3.7 (LSPosed module app)

- Enable Zygisk (Enforce DenyList - Disabled) under Magisk (+ download some Magisk module as shown in screenshot¹)

Follow below steps to fix "This functionality is not available due to security concerns with your device" in Paytm (Tap to Tay):-

1. Download frest original Paytm app or clear data & force stop.

2. Open PrivacySpace app/module under LSPosed.

3. Hidden Apps > select Paytm (+ all other modules such as Lucky Patcher, etc as show in screenshot²).

4. Blacklist > select Paytm.

Note: If u want to recieve Paytm app update in Play Store then select Play Store in "Connected with Others" to unhide Paytm app for Play Store.

5. All Set, Try your Luck Now, and do not forget to let me know if it's work for you too.
[Magisk] varunpilankar:
I was still using hide my Applist xposed module.. How is PrivacySpace different from it?
[Magisk] DineshValor:
Never used or try HMA myself, if HMA worked for you then u can go for with it, otherwise u can try PrivacySpace.
[Magisk] varunpilankar:
I'm guessing it's the same..right?

So far able to get the Paytm app to work but when ever I trying to register the card for tap to pay, it fails.

It was not the case in the past.. Happening from recent app update onwards.
[Magisk] DineshValor:
I'm the victim with same issue few weeks ago and try to found solution on google but didn't found rather than your post in Magisk thread,

and later one day try to solve the issue by own and actually worked for me, & successfully rid out of Paytm "Tap to Pay" issue "This functionality... on your device!" warning message.
[Magisk] varunpilankar:
Let me try it again using HMA in this week.. Will get back to you.
[Magisk] varunpilankar:
@DineshValor doesn't work with HMA, my card is still showing pending to be added.

Any good brief guide to replace HMA with PrivacySpace?
[Magisk] DineshValor:
Additionally, u can use Google Pay, I'm personally using GPay just for NFC payment and it's feel better than Paytm "Tap to Pay" + support more bank debit/credit card.
[Magisk] varunpilankar:
I don't prefer G Pay for anything.. Will like to stick with Paytm and try to work on fixing tap to pay
[Magisk] DineshValor:
So try to use PrivacySpace and share the details of ss if any error comes, also one day I will try with HMA whenever got free time 😅
[Magisk] pndwal:
I see you said you pass SafetyNet... But of course that's deprecated; most banks have migrated to new Play Integrity API now... Are you passing PI deviceIntegrity?...If not official Universal SafetyNet Fix will likely not help as it currently has issues... You'll need @Displax's up-to-date fork with fixes...

Also, did you install Shamiko for proper root hiding as suggested more than once above?

🤠 PW
[Magisk] m0han:
Does anyone happen to know why GPay 'Check bank balance' is not working? When I tap on the account on the 'Select account' screen, a line flashes above and disappears. Nothing else happens. Hope this is not OT here.
[Magisk] DineshValor:
I'm using same version GPay and didn't face such issue, probably it's your device app bug or something in your device. There no traces related magisk. Kindly confirm your side.
[Magisk] m0han:
Yes. Cleared cache & data and set everything up afresh. All fine now.
[Magisk] varunpilankar:
@DineshValor does Privacy Space support android 10 with Lsposed? Also can share the link to download the module? I'm finding a old one which mentioned support for Android 9
[Magisk] DineshValor:
It's supported upto android 13 and currently I'm using LSposed with android 12.

Here is the link:

GitHub - LSPosed/LSPosed: LSPosed Framework

LSPosed Framework. Contribute to LSPosed/LSPosed development by creating an account on GitHub.

github.com

Release 1.3.7 · Xposed-Modules-Repo/cn.geektang.privacyspace

1、修复在Android9上不生效的问题； 2、适配Pixel、一加手机的设置页面； 3、修复了一些已知bug。

github.com
[Magisk] varunpilankar:
following this guide, landed me into bootloop. Is there a brief guide - blog or video?
[Magisk] DineshValor:
Sorry about that issue, but right now I'm busy in some other stuff, i will make sure to create a brief video as a demo, plz grant me some time.
[Magisk] varunpilankar:
Sure, take your time.. Can you cover Paytm Tap to pay setup in your guide.. That would be very helpful.
[Magisk] Master_T:
Hi everyone

I've had to factory reset my phone (Xiaomi Mi 9T) recently, and since then I am unable to verify my payment cards for contactless payment on Google Wallet, on any rom that I tried (even the ones that pass SafetyNet by default).

The weird thing is that I don't get any error messages or security warning, but the verification process simply goes in an infinite loop:

1) I add a card

2) The Wallet app says it needs to verify the card with the bank, it asks me how I want to verify

3) I chose "use the bank's app"

4) The bank's app opens, I verify the card, it says everything is good and the card can now be used for contactless payments

5) I go back to Wallet and... it asks me how do I want to verify the card again! (in other words: I'm back at step 2)

Has anyone here experienced something like this? I've been tinkering for hours now, switching roms, installing magisk and various combinations of modules, but to no avail. Any suggestions?
[Magisk] pndwal:
Can't say I've had exactly that behaviour... My bank app doesn't get opened to verify...

However SafetyNet API is of course now deprecated, so are your ROMs up to date and passing new Play Integrity API's deviceIntegrity verdict?

Nb. If using Magisk, late official Universal SafetyNet Fix module is broken... You need @Displax's fork... PW
[Magisk] Master_T:
Thanks for the info, is there an app I can use to check the status of Play Integrity?
[Magisk] zgfg:
Of course. It has been described in this thread

Search for Play Integrity on the Play Store and you will find the PI API Checker

Or, Google Play Store app itself (Developer options) can be used
[Magisk] m0han:
Or TB Checker, which has a few more things to, well, check. :D
[Magisk] Master_T:
Thanks a lot for your help.

Indeed, the strong Integrity check is failing, only the basic and device ones are passing. I'll try to install magisk and the modded module and see if it helps. Should I use original magisk? I've seen the Delta version recommend elsewhere 🤔
[Magisk] zgfg:
Strong Integrity is not relevant and you will never be able to pass with the Bootloader unlocked

Again, before posting/,asking, please read and be familiar with the common facts
[Magisk] Master_T:
Sorry, I've been reading about this stuff all day but a lot of the information out there is at times contradictory and I have yet to find a single case similar to mine (i.e: where no error occurs but the Wallet app simply refuses to advance to the next step of the verification wizard).

This is what I find strange, all apps (integrity checkers, my bank's app, etc.) report everything is ok but for some reason I just cannot complete the verification process 🤔
[Magisk] raphytaffy:
Can P7P users with GPay working please chime in with the following:

OTA version:

Magisk version:

Universal SafetyNet Fix version:

+any other relevant info

Thank you in advance!
[Magisk] pndwal:
Ask here?:

https://xdaforums.com/t/april-10-20...r-root-pixel-7-pro-cheetah-safetynet.4502805/ 🙂 PW
[Magisk] nicky-xda:
gpay / wallet working here on xiaomi mi9 / crDroid 9 with: magisk 26.1, safetynet 2.4.mod.1.1, shamiko 0.7.x
[Magisk] wtosta:
With the deny list enforcement disabled in Magisk manager, e.g. Revolut does not work. Therefore, when you are adding payment cards to Google Wallet, the "Enforce Denylist" option in Magisk manager must be disabled, and after adding your cards to the wallet, you can re-enable it for the Revolut application to work. A very simple trick ;-)
[Magisk] pndwal:
Denylist is not proper root hiding; it's a little of MagiskHide code repurposed for the purpose of reverting/preventing Magisk modifications in listed processes... This is no longer a function for the general modder, but for the Android developer, security researcher etc...

Anyway, there's no issue using denylist (or enforced) for hiding root from GPay/Wallet... I don't know why any think this...

It isn't enough to hide root from apps that do more than superficial checks for root, eg looking for Zygisk injection or memory leaks etc... For this we need proper root-hiding modules like Shamiko... These might use the denylist (hijack it) for convenience, but it is NO LONGER used as denylist... It no longer prevents Magisk modifications (Zygisk injection into an app's zygote for instance) so doesn't interfere with hiding modules ... Denylist is now actually a hide list (as long as DenyList is disabled, ie. not enforced) per old MagiskHide but much improved in the case of Shamiko...

So for those wanting proper root hiding, Denylist must necessarily be disabled and a suitable hiding module utilised... This mode works well for GPay/Wallet and much better to bypass detections in other bank apps etc.

Nb. Shamiko has already been updated to hide new Native Bridge Zygisk loading implementation currently being tested for Magisk 27.0 by making /proc/maps string memory anonymous... This coming change is not being detected by banks at present as far as I've tested, but it appears that Shamiko is already configured in anticipation of this event...

🤠 PW
[Magisk] wtosta:
Unfortunately Revolut Bank app says that it won't work on rooted phones when Enforce Denylist option is disabled. I must confess that I'm still using Magisk 25.2 with application name changed. Because some dumb apps find rooted phone based on an installed app called "Magisk". Also, is Magisk 26.1 fundamentally better than version 25.2?
[Magisk] pndwal:
🤔 How does it say that?

That's not dumb... It's par for the course...

Have you ever installed / tested Shamiko hiding?

Nb. Currently I'm running an unofficial test fork which showcases new NB Zygisk loading, but Revolut is no different to other apps... It runs fine with proper root hiding and with DenyList disabled... I'll add it to my post here:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-88468151

Each iteration has fixes / enhancements but can also have regressions (especially if considering Canary builds)... Please see release note to know what they are...

FWIW, Native Bridge Zygisk implementation will be a big one...

😜 PW
[Magisk] wtosta:
It says... Revolut is not supported on rooted devices.
[Magisk] wtosta:
Shamiko I have barely tested with no success, so I have abandoned further tests. I have now installed safetynet-fix with Displax modifications (safetynet-fix-v2.4.0-MOD_1.2.zip).

I was forced to reinstall the system on my S10e Exynos and Google Wallet did not want to register my payment cards for contactless payments. I had to start figuring out why this is happening since on the same Ambassadii ROM 5.6 system everything was fine before. I didn't know what to do and accidentally came across a hint from qetuol - Senior Member to try to disable "Enforce Denylist". Google Wallet cards I have registered successfully, but only Revolut wouldn't start, saying that I have a rooted phone, which is of course true :) After re-enabling "Enforce Denylist" in Magisk, Google Wallet cards remained, GWallet didn't complain that my phone was rooted unsecured and Revolut went alive at last. I do not know how to explain it. Let me remind you that I have Magisk version 25.2.
[Magisk] pndwal:
Of course they won't support this use...

Doesn't say:

however!...

Maybe you don't understand why we hide root?! 🙃 PW
[Magisk] wtosta:
Of course, I'm not as knowledgeable about Magisk as you are. However, as far as I know, hiding the root is for the purpose of preventing secured (e.g. banking) applications from "seeing" that the device is rooted, because with root permissions, userspace can access the phone's system partition and do various things that could potentially put user data at risk in e.g. banking applications. However, I don't know what the "Enforce Denylist" option in Magisk is exactly for since there are deny lists to hide the root for applications that you specify.
[Magisk] pndwal:
Magisk version won't matter to GPay/Wallet... It does detect root also (specifically contactless setup component), but being Google it does minimal checks... DenyList is enough to hide root for GPay/Wallat as I said...

Shamiko is proper root hiding however (read designed to hide root; denylist just isn't...) Installing that, rebooting, then disabling denylist will not effect GPay/Wallet at all, but it will hide root from many more banks that denylist will...

Of course, disabling denylist without having a root hiding app installed and active first will break GPay/Wallet... 😬 PW
[Magisk] rogerinnyc:
Just adding my experience to this thread, FWIW. On a OnePlus 9 Pro, rooted, Android 13 stock, and using the official Magisk 26.1. All I have installed is Shamiko 0.7 -- no Universal Safety Net Fix, no MagiskHide Props Config. In Magisk settings, Zygisk is enabled (as is required by Shamiko), but not Enforce Deny List. My Configure DenyList includes Google Wallet and Google Play Store, but not Google Play Services. With that configuration, Google Wallet has been working consistently. I can't speak to the various banking apps -- but I use Chase with this configuration (but the setup to get it working is not straight-forward, involving using an older apk version initially, and functionality for secure messages doesn't always work).

I did have a problem with opening Wallet after a reboot and getting a pop up warning that your device does not meet security requirements, but I could simply dismiss that and Wallet would still work (and "tap to pay setup" would show "Your phone meets security requirements" still). I think that may have been Magisk taking some time to load. I've gone into Battery settings for Magisk and enabled it both to run in the background and to autolaunch and that issue hasn't (yet) re-occurred.

Interestingly, with this configuration, using YASNAC (Yet Another SafetyNet Attestation Checker), my device would fail both Basic Integrity and CTS Profile Match, even with Google Wallet working. Once I added Universal Safety Net Fix 2.4, YASNAC would pass my device. So far, no ill effects from having both Shamiko and USNF installed and running. But Shamiko alone was sufficient for Google Wallet purposes.

YMMV.

P.S. I should add that once you have the Magisk/Module set up you want, you should clear cache (and, I believe but am not certain it's needed, data) for Google Play Store and Google Play Services and and Google Wallet and reboot.
[Magisk] wtosta:
Thanks to pndwal's suggestions, I confirm what rogerinnyc wrote above. On my S10e I'm using Ambassadii ROM 5.6 and Magisk 26.1 the Zygisk option is enabled. I set denials for GPay/Wallet, Google Play Services, banking applications and the Allegro application (a popular shopping platform in Poland, something like eBay). Also, I have the safetynet-fix-v2.4.0-MOD_1.2 module installed in Magisk. Without the Shamiko module installed in Magisk and without Enforce Deny List enabled, a strange thing happens. Namely, the GPay/Wallet application worked, but the banking applications detected the root. When Enforce Deny List was enabled, banking applications did not detect the root, but GPay/Wallet stopped working and showed that the device does not comply with security rules. Only the installation of the Shamiko module with the DISABLED Enforce Deny List in Magisk solved the problem. Both GPay/Wallet works and other banking apps don't see root. I did not tested removal of safetynet-fix-v2.4.0-MOD_1.2 module and leaving Shamiko module alone anymore. But my current combination of modules works for me. Thank you, Dear Friends, once more for your hints.
[Magisk] pndwal:
I believe GPay/Wallet would usually fail after some time unless you still pass Play Integrity deviceIntegrity verdict because ROM integrates SNF or it's own spoofs for this...

It's not surprising bank apps fail without denylist (they actively search for root) / Shamiko (proper hiding for traces of Zygisk etc)...

Having Play Services, specifically the droid guard/attestation process com.google.android.gms.unstable in active denylist breaks Zygisk based USNF builds (note, it will remove these from denylist on next boot for this reason) because DenyList reverts/prevents Magisk modifications in listed processes unlike old MagishHide. (It's really now a development tool, not a hiding tool.) In this case USNF injects code in gms to register a fake keystore to cause the fallback to basic attestation that's it's key function, so we can't hide root front gms using Denylist... Shamiko on the other hand is a proper hiding module and simply uses denylist (for convenience) as a hidelist, so it doesn't break USNF in this case...

Zy-USNF builds hide root from gsm processes itself, so they shouldn't be added in denylist anyway... This should be done to pass device integrity verdicts if you use pre-Android 8, devices with broken keymaster implementations or revoked keys, or when ROM integrates it's own SNF/spoofing, and USNF is not used/needed but never with Zy-USNF.

GPay/Wallet needs passing PI deviceIntegrity and you need to check this is passing with a Play Integrity checker app... You'll see this fail as soon as denylist is enforced...

Bank apps on the other hand often employ their own checks for traces of root and some don't check deviceIntegrity. Some only check deviceIntegrity and some do both...

Hope it helps your understanding of this.

🤠 PW
[Magisk] wtosta:
It happens exactly as you said. So denylist enforcement in Magisk should be disabled. Shamiko module properly hides the root for all the rest bankig/shopping apps :)
[Magisk] nicky-xda:
I have an issue with only 1 german bank app: Hanseatic Bank Secure.

It starts normally without issues on my phone xiaomi mi9 / magisk 26.1 / shamiko 0.7.161 / safet_netfix2.4.mod1.2

On my second mi9, which is the same device with exactly the same installation, it will not start and shows: rooted device.

I've tried to dis-/enable "enforce denylist", hide magisk, different older versions of the app, nothing helps.

What could be the reason for this strange thing?
[Magisk] wtosta:
I would start by clearing the memory of Google Play Services and your Hanseatic Bank Secure. Then I would try to register it again in your phone. Of course, Magisk settings and modules should be set up as was written in posts above. Of course in Magisk your banking app must be checked in the Zygisk denial list with all components ticked. Also it is good idea to hide a Magisk app by renaming it (there is an option in Magisk settings). You may also try to install a Play Integrity API Checker from Play store. It is a good prognostic for that you have set up things correctly. Your device should meet device integrity and basic integrity. Strong integrity of course will fail as your device has unlocked bootloader and it is a rooted phone.
[Magisk] pndwal:
Interesting that you can still use contactless despite contactless setup detecting compromised environment... The detection is expected however...

Seems your OnePlus 9 Pro may be one of many OnePlus devices with broken keymaster implementation... Does Momo app say "Broken TEE"? (If it does, TEE OS is not really broken but key based attestation is.) Also, does YASNAC say BASIC for evaluationType?

If this is correct you won't need USNF to trigger fallback to basic attestation; device is already falling back to this due to broken hardware key-backed attestation.

You still need to add Google Play Services to denylist, specifically the droid guard/attestation process com.google.android.gms.unstable and the main process, com.google.android.gms, in order to hide root from gms. Seems this is what you're missing...

You also need a solution to set sensitive props to non-suspicious values. I believe Shamiko includes this function. (If not, MagiskHide Props Config module goes this with nothing configured; MagiskHide sensitive props are adjusted just enable by default.) With Shamiko active (denylist disabled / not enforced) you should now have passing deviceIntegrity. Nb, SafetyNet API is now depreciated; Check deviceIntegrity with Play Integrity API Checker.

The only benefit you were gaining with USNF was that it does hide root from gms, but if you want to keep it instead of adding the GMs processes in denylist manually there should be no issue... It also duplicates the sensitive props adjustments...

Chase have started detecting Zygisk injection... This should start working with new native bridge Zygisk loading (akin to hidable Riru framework/memory hiding) + Shamiko (already supports hiding native bridge based hooking memory) which is currently a WIP (2+ months already) but should be seen in Magisk 27.0... I've put alot about native bridge Zygisk refactoring in Magisk Discussion thread recently...

Chase works in Alpha fork POC for me.

🤠 PW
[Magisk] nicky-xda:
thanks a lot, wtosta!

Play Integrity API Checker & YASNAC both show PASS, resetted Play Services, and the bank app several times already: unfortunately nothing seems to help.
[Magisk] wtosta:
Very strange case indeed. I know it's a last resort, but maybe all you have left is a clean system reinstall. Good luck with this.