yashsingh1/xdaforums huggingface dataset:
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
In a nutshell, build LOS 17.1 for oneplus 3 takes time :

- [MENTION=4801280]remedya[/MENTION] : 8h42 (lineage-17.1-20200612-UNOFFICIAL-oneplus3.zip)

- [MENTION=9708417]Eric_Lev[/MENTION] : 2h44 (lineage-17.1-20200612-UNOFFICIAL-oneplus3.zip)

- LOS build server : 2h21 ( lineage-17.1-20200608-nightly-oneplus3-signed.zip) ... https://buildkite.com/lineageos/android/builds/24407

- [MENTION=4244522]pitrus-[/MENTION] : ??? (lineage-17.1-20200612-UNOFFICIAL-oneplus3.zip) ... https://lineageos.wickenberg.nu/oneplus3/
[OnePlus 3 & 3T Cross Device Development] :
No crashes here, everything working fine.

Am on the Wickenberg builds at the moment btw as they are built daily and LOS switched to weekly for now.
[OnePlus 3 & 3T Cross Device Development] BillGoss:
GPS doesn't use the phone network. You can take out the SIM card and it's still works.

But, since you asked, I'm with Telstra Australia.
[OnePlus 3 & 3T Cross Device Development] Siddk007:
Flashed latest LOS 17.1 nightly 0608. I'm impressed with the stability and features. Good job [MENTION=5091734]dianlujitao[/MENTION]
[OnePlus 3 & 3T Cross Device Development] pitrus-:
Last build finished in 2h and 48 minutes, but then I build LineageOS 16 in parallel on the same server so it depends on the status of those builds. But in general it takes anywhere from 3 to 8 times longer to build the LOS17 builds depending on device.
[OnePlus 3 & 3T Cross Device Development] Dirk:
Okay, getting up to date here. On the latest LOS build with 9.0.6 Firmware. Previously i was using the [MENTION=4405529]nvertigo67[/MENTION] patch .zip to edit my build.prop so that the Security Patch Date matched the Build Fingerprint. That was on Pie.

Currently i am CTS Profile - Fail. Certainly i need a new patch .zip to do the job. Does such a thing exist yet? I am planning on re-locking my Bootloader. Will the patch still be needed? (I'm guessing yes)

Am i also right to assume that the ROM Fingerprint is taken from OOS 9.0.6 and that the Security Patch Date needs to be edited to 2019.10.01?

Thanks.
[OnePlus 3 & 3T Cross Device Development] Dirk:
Thanks but i have no idea what to actually do with it. Instructions said to remove the .txt part...but then what? Is there a flashable version that can be installed via TWRP?

Thanks for your patience.
[OnePlus 3 & 3T Cross Device Development] :
When you remove the .txt you have a .sh file. In terminal of twrp you can do a chmod 755 *.sh in the directory where you keep the file and then execute it.

So, for example the file is named setup.sh and stored in /sdcard/Download.

In twrp you go to terminal

In terminal you go to sdcard/Download:

cd /sdcard/Download

Then you do the chmod:

chmod 755 *.sh

Then you run the script:

./setup.sh

Job done ;)

Reboot and enjoy.
[OnePlus 3 & 3T Cross Device Development] :
If i remembered correctly, nvertigo sec patch zip is compatible with android 10
[OnePlus 3 & 3T Cross Device Development] Dirk:
That worked, thanks! I've checked the build.prop and the entries were created. Just need to lock BL now and clear Play Store Data.

Thanks for your help.

Just tried it but TWRP (SAR build) refused it. See screenshot:
[OnePlus 3 & 3T Cross Device Development] :
Let's summon [MENTION=4405529]nvertigo67[/MENTION] then :p I don't use 10 yet

I don't know what los 17 use, but for los 16 you shouldn't use that version to pass safetynet though.
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Hello Dirk

With or without Magisk (LOS 17.1), Safetynet passes on my side (note my BL is locked and data is unencrypted).

I've done several tests... started from dirty or clean flashes.

My fw is 9.0.6 (not modded).

In your case, it might be easier to make a clean flash (from scratch).

You can use Migrate app to backup your app.

Remove your screen lock

Boot to TWRP

Flash SAR TWRP

Boot to TWRP

Flash FW 9.0.6 (not modded)

Boot to TWRP

Format data and then wipe all partitions

Boot to TWRP

Copy zip files from PC to internal storage

Flash latest LOS 17.1 + pico or nano open gapps

Reboot to System

Optional 1 :

Reboot to bootloader

Lock your BL

Optional 2:

Flash Magisk

Optional 3:

Encrypted

Optional 4:

Flash LOS recovery ... only if data unencrypted
[OnePlus 3 & 3T Cross Device Development] :
First of all: the sec level patch shouldn't be needed since 17.1 uses the oreo fp trick:

https://github.com/LineageOS/androi...mmit/ad1e83986e048fc0f9c5e8cfbc307b756a14ce70

As [MENTION=5091734]dianlujitao[/MENTION] has explained in this thread it doesn't matter that in build.prop an other fp is used:

https://github.com/LineageOS/androi...us3/blob/lineage-17.1/lineage_oneplus3.mk#L36

For the zips from https://xdaforums.com/showpost.php?p=78433987&postcount=3:

They handle non-sar roms (/system) and sar roms (/system/system); the sar twrp seems(*) to use /system_root/system. I'll rework my scripts when the official twrp chanhes to /system_root/systemmif the sec level patch is still needed (what is not the case for this rom, because of the oreo fp trick).

BTW: the fp for 2019-10-01 is not used in this rom at all - see above.

(*) on flashing errors a recovery log is mandatory to have it fixed.
[OnePlus 3 & 3T Cross Device Development] Dirk:
I don't use Magisk and am Unencrypted.

Are you saying that you haven't edited your build.prop to change the Security Patch Date? Yet you still have a CTS Profile Pass? (With Bootloader locked of course).
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Never edited and CTS Profile Pass with LOS 17.1 ... Unlike LOS 16 under the same conditions.

As "evidence" :

- before dirty flash (LOS 16), CTS Profile fails ... (LOS addon su)

- after dirty flash (LOS 17), CTS Profile Pass. ... (with or without Magisk)
[OnePlus 3 & 3T Cross Device Development] Dirk:
Interesting. I guess locked BL trumps all others.

Do i still need to say 'No' when prompted by Fastboot? (Meaning 'Yes')

Do i need to do anything with the 'Allow OEM...' setting in Devops?

Thanks for your time..
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Not sure but... No means Yes ...

Yes ... Enable OEM unlocking

No sweat ... ;)

As reminder :

- https://xdaforums.com/showpost.php?p=82704221&postcount=1326

- https://xdaforums.com/showpost.php?p=82350637&postcount=969
[OnePlus 3 & 3T Cross Device Development] Dirk:
This isn't going well. I locked the BL. Tried 'No' but the BL remained unlocked. So i ran the command again and selected 'yes' this time. Now the BL is locked, but i get 'Phone is Starting, immediately after the phone boots to homescreen, and then it loops back to the Boot Animation ad infinitum.
[OnePlus 3 & 3T Cross Device Development] :
It's like it has always been since sfaetynet api has been introduced: an unlocked bl breaks passing safetynet. To have safetynet passing with an unlocked bl you need either Magisk to throw away the tripped verity bit, or you need a kernel patched to throw away the tripped verity bit. Nothing changed.

On los16 you need to adjust the sec patch date according to the fp - on los17 this isn't needed anymore, because of the oreo fp trick.

Apart from passing safetynet api some root detection kits (used by some apks) search for so called "dangerous properties". I still havn't seen a complete list, but "ro.debugable=1" (which allows root on adb even without root addon or Magisk) is one of them.
[OnePlus 3 & 3T Cross Device Development] rohan164:
[MENTION=9708417]Eric_Lev[/MENTION]

hello

i am on LOS 17.1 8th June build latest, with LOS recovery, BL locked & data is encrypted.

can i use & install magisk?
[OnePlus 3 & 3T Cross Device Development] :
Magisk since 20.3 resigns the boot partition after altering it with the aosp berity key.

Though this is written in the hardended los16 thread everything about locked bl is also true for los17:

https://xdaforums.com/showpost.php?p=82812301&postcount=85
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Strange because in my case, I can lock and unlock my BL with LOS 17 ... https://xdaforums.com/showpost.php?p=82350637&postcount=969

But it's true that I locked it several months ago.

Could you boot to TWRP ?

---------- Post added at 19:42 ---------- Previous post was at 19:34 ----------

Read this post : https://xdaforums.com/showpost.php?p=82704221&postcount=1326
[OnePlus 3 & 3T Cross Device Development] Dirk:
I could.

Currently i'm working the steps that [MENTION=10511117]Johan2020[/MENTION] posted here:

https://xdaforums.com/showpost.php?p=82204597&postcount=710

This has allowed me to Boot successfully with the BL locked. Safetynet passes accross the board. Play Store shows 'Certified' Google Pay allowed me to set it up without complaint. (Don't know if this means it will work at the Terminal though). Sadly my Banking app say's i am Rooted and refuses to work. Any ideas on this last point?

The only thing i can think of is to use the script posted in the link above and see if that helps. Worth a try i suppose. Will report back.
[OnePlus 3 & 3T Cross Device Development] :
See one of my previous posts: ro.debuggable=1 is considered dangerous because it allows to use root previlegs via adb even without magisk. It's in default.prop, which is no problem to edit on sar-roms (on non-sar roms it's in the ramfs).
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
An alternative ... LOS recovery ... but no root.
[OnePlus 3 & 3T Cross Device Development] Dirk:
I tried the Script mentioned before which sets ro.debuggable=0. The Banking App still doesn't work. I can't understand how it can find anything to complain about now.

I never Root anyway. Everything is working perfectly well, with TWRP/Unencrypted/BL Locked.

EXCEPT for the Banking App that still says i'm Rooted when Safetynet is passing and Play Store is 'Certified'. ADB is disabled in Devops. I'm out of ideas.

Edit: My OP5 is on crDroid Pie. Because of the recent Key Attestation change i fail CTS Profile on that device now. Play Store shows 'Uncertified' and Google Pay is out of the question. BUT, the Banking App in question actually works just fine regardless. Explain that!
[OnePlus 3 & 3T Cross Device Development] :
I have had a lot of issues to get all my banking apps working, though the script should do it for you.

Did you try to remove the app and install it again after changes were made?

ro.debuggable=0 is the most important one, as ro.build.tags=release-keys, adb another one or even default USB settings (default to charge only).

Your setup is encrypted, LB, password set and script executed so modified build.prop?
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
In Dev Options, enable Local terminal.

In Terminal app, input su + enter:

$ su

If root, response = # ... otherwise response = $

LOS recovery or TWRP with Magisk, response = # ... so root.

LOS recovery or TWRP without Magisk, response = $ ... so no root.
[OnePlus 3 & 3T Cross Device Development] :
Out of curiosity, i just did installing los 17, gapps and magisk and it's indeed doesn't passed safetynet check with unlocked bl....

The more reason to stick with my beloved pie
[OnePlus 3 & 3T Cross Device Development] Dirk:
The changes were made by the script. I checked the build.prop after executing it. I was re-installing the Banking App before every attempt to set it up. I'm unencrypted with Fingerprint+Pin Lockscreen security.

$ su not found.
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Enter su and validate ...
[OnePlus 3 & 3T Cross Device Development] Dirk:
I don't know what you mean by validate. Screenshot shows the response after i enter 'SU'.....
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Install Termux from play store (https://play.google.com/store/apps/details?id=com.termux&hl=fr)

Via Termux, enter su and give me the response via a screenshot ... Please

Edit : sorry ... response = $ ... so you are not rooted.

Your setup is ... BL locked, unencrypted, TWRP without magisk ... ?
[OnePlus 3 & 3T Cross Device Development] Dirk:
Correct. That's my exact configuration.

Termux is one of the Terminal apps i tried. Same response.
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
So you are not rooted.

Your banking application checks the validity of Android security patches ... :(
[OnePlus 3 & 3T Cross Device Development] Dirk:
I've tried it with the ROM default and using the script which sets the Security Patch Date to 2019.10.01. If the ROM is using the OOS 9.0.6 Build Fingerprint, that date should give a valid match. (nvertigo67 mentioned that the ROM might be using an Oreo fingerprint though. In that case i don't know.)

I'm at a loss.

Edit: Thanks for all your help though. Despite this one hurdle i think the ROM is great. Works really well! If the day comes when i have to switch to my OP5 i won't have the benefit of being able to lock my BL. So on that phone i will have a working Banking App, but no Google Pay. The opposite of my current situation! Win some, lose some. :)
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Yes, indeed... Sorry I can't help you any more!
[OnePlus 3 & 3T Cross Device Development] christantoan:
Something to try. If your banking app uses storage permission, try to rename TWRP folder if you have it on your root storage folder. It works here on some banking apps.
[OnePlus 3 & 3T Cross Device Development] rohan164:
Can we install magisk using LOS recovery? using adb root?

I am on locked BL, encrypted data, and non rooted.

Is it possible to use magisk on locked bootloader?

I want use magisk. In this condition

I don't want to unencrpt data and unlock the bootloader & loose smooth OTA updates.

[MENTION=9708417]Eric_Lev[/MENTION]
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Post #1492, I suggested you read the post #1326 .... https://xdaforums.com/showpost.php?p=82704221&postcount=1326

First, your setup (with an on boot password?) is ideal in terms of security.

Second, yes you can flash (boot to LOS recovery > Apply update > Apply from ADB) and use Magisk with a setup such as BL locked, encrypted data and LOS recovery.

BUT

OTA updater disables/removes Magisk on reboot (Post #1326)

BECAUSE

Says a LOS team developer, Magisk cannot survive an OTA update on A-Only FDE encrypted devices.

Trouble is, the method that Magisk uses to preserve itself across OTA updates requires access to the data partition.

But the data partition in a full-disk-encrypted device is completely inaccessible from inside Lineage Recovery. So Magisk fails to preserve itself.

This lack of access to the encrypted data partition inside Lineage Recovery is intentional and there is no plan to change it.

You can't enjoy both OTA updater and Magisk with a setup such as BL locked, encrypted data and LOS recovery ... it's one or the other!

In a nutshell, you can't have your cake and eat it too (in french, "avoir le beurre et l'argent du beurre").

So no way out with such a setup ... or unencrypt your data partition (boot to LOS recovery > factory reset > Format data/factory reset ... a clean flash !)

That is why my data partition is unencrypted ... With this setup (BL locked, unencrypted data and LOS recovery), you enjoy OTA updater/Safetynet, can install/uninstall Magisk (boot to LOS recovery > Apply update > Apply from ADB or Choose from internal storage), switch from LOS recovery to TWRP (and vice versa) ... and I take advantage of my banking app ... ;)
[OnePlus 3 & 3T Cross Device Development] :
Please see the links I looked up for you here: https://xdaforums.com/showpost.php?p=82823985&postcount=1483

This rom definetly uses the oreo fp. If anything at all relates to a pie fp it's build.prop which uses the fp from 9.0.5 (2019-08-01).

If you don't trust the sources, check the fp your setup is currently using by "getprop ro.build.fingerprint".

If gpay is working on the op3 your setup passes safetynet api tests. So your banking app is using some additional checks for root. You can try comparing the props from your op5 setup to the props of your op5 setup. Don't use a script, but really compare them one by one. That's a nasty task, I know.

Though [MENTION=5091734]dianlujitao[/MENTION] has pointed out that the pie fp in build.prop doesn't matter, I'd try to use the fp returned by "getprop ro.build.fingerprint" also in build.prop, if the props check shows no results.
[OnePlus 3 & 3T Cross Device Development] Dirk:
That actually worked. I can barely believe it! I've not heard of any app doing that specific check before. The mind boggles.

Thank you! :good:
[OnePlus 3 & 3T Cross Device Development] christantoan:
You're welcome and thanks for confirming that it works.

Another way to do it is to use Storage Isolation app which forces the app to a kind of scoped storage environment. Not sure if you need the Magisk module for the Enhanced mode though but if you already have root it's better to go all the way, I think.
[OnePlus 3 & 3T Cross Device Development] Eric_Lev:
Now I understand why my banking app only works with LOS recovery and not with TWRP ... Thanks Dirk and [MENTION=6991637]christantoan[/MENTION] !
[OnePlus 3 & 3T Cross Device Development] Dirk:
christantoan has imparted some really solid information there. Well done that man! I hadn't even considered that it explains your experience with the two Recoveries. Now you have the TWRP option too should you prefer it. :good:
[OnePlus 3 & 3T Cross Device Development] The_Passporter:
Same issue here

I am having the same issue here. The problem is it will not ring through the bluetooth on the "ring" setting.. Did some OS updates and nothing, but as I was testing using my bluetooth I slid the slider up to the "vibrate" position and it would ring through the bluetooth but not notifications... Opposite to that in the "ring" position I hear notifications but not the phone calls. Lol. Reminds me of BB10.

I tried swapping the buttons in the software but same result. At least it does work tho but still need to get both notifications and phonecalls working on the same profile.

I am a super nube and may not understand everything so please be patient with me. Any ideas are very much appreciated cause I love my Oneplus 3T
[OnePlus 3 & 3T Cross Device Development] knpk13:
A few months ago some popular apps made the news for abusing storage permissions (or some exploit) to check for folders names like TWRP, Magisk, TitaniumBackup and other popular root stuff. I think Magisk dropped the folder name a while ago to counter that and now just downloads modules to the download folder. I remember a guy on the TWRP thread asking for the ability to rename the TWRP backup folder for this reason as well.

I can't remember what app it was but I don't think it was a banking app. Guess they're doing that too now. It's concerning that some apps can do those checks even when storage permissions are denied (not sure how that works and if they fixed it) but hopefully scoped storage in Android 11 solves that. Another similar thing about permissions that boggles me is how WhatsApp manages to automatically retrieve my SMS verification code even when SMS and call permissions are denied. No other chat app has been able to do that.
[OnePlus 3 & 3T Cross Device Development] :
A third way is using an usb mass storage device for storing backups (besides the obvious advantages on a sdcard-slot-less devoce). Thanx for the heads up! Great finding!
[OnePlus 3 & 3T Cross Device Development] christantoan:
For this AFAIK Android now has a system for apps to automatically retrieve verification code based on the format of the SMS. I think this actually increases privacy because now apps doesn't need to access all SMS just to get verification code automatically.

Source (maybe): https://developers.google.com/identity/sms-retriever/overview

Just a note though that TWRP also stores its settings in that folder so you still need to to remove that folder somehow even if you store backups externally.
[OnePlus 3 & 3T Cross Device Development] Johannes1098:
For example some sky apps like "go" or "ticket" here in Germany also refuses to work.

It's a little bit ago (last year or longer), but I think they also scanned the app package names (probably they're still doing this...)

So even after hiding magisk app (with random package name) it didn't work. I had to uninstall some root apps, I think it was AdAway and Titanium Backup..

The "funny" thing is, that even most banking apps and e.g Google Pay doesn't have this "big" root check (just safetynet check)

If you can, just don't use the app with such security mechanism, that's the easiest way (I know that this isn't possible with all apps), but for me I just quit Sky and didn't have a problem with an app detecting root since then (apart from the normal safetynet issues, like using an old sec patch etc to make it working=

Scanning the storage is even a step more, I didn't hear about this and I think it's very uncool..

My rooted LOS 17.1 device with June sec patch is most likely better secured than the 0815 android device running lollipop, marshmellow etc with 3 years old security patches - and as we know there are not only a few devices with such old software (https://androiddistribution.io/) - but that's another story to tel...
[OnePlus 3 & 3T Cross Device Development] knpk13:
Yes I know about this but I have not enabled this feature as I don't want 2FA codes to be autofilled (I remember it asks you explicitly if you want to enable it and I said no). And this has been happening before the autofill verification code feature was ever introduced, it's really weird. It bothers me that it's possible but I can't do much other than restrict permissions and minimize my usage of the app as it's usually the primary chat app for the average person in my region.
[OnePlus 3 & 3T Cross Device Development] christantoan:
Make sure the toggle is off in Settings > Google > Verification code auto-fill. Other than that, I don't know. Maybe the method the app uses and the toggle in Settings are for different things? As in the one I mentioned before is part of AOSP and the toggle is from GMS.

It's not the first time Google developed multiple solutions to fulfill one purpose...
[OnePlus 3 & 3T Cross Device Development] rohan164:
hello [MENTION=10511117]Johan2020[/MENTION]

i want to use bank apps & was trying to edit build prop as you suggested.

i am getting below error when i try to edit build pro via adb in LOS recovery & i mounted system & enabled adb still the errors is coming

i used command adb pull /system/build.prop

adb: error: failed to stat remote object '/system/build.prop': No such file or directory
[OnePlus 3 & 3T Cross Device Development] :
Watch the paths: it's a sar rom.
[OnePlus 3 & 3T Cross Device Development] mrplowdan:
Am I the only one without any safetynet issues?

LOS 17.1, super gapps with custom gapps-config, magisk, magisk hide, encrypted data partition, unlocked bl.

Passes safetynet integrity and cts profile.

Banking apps work, play store says certified, ingress/pogo work fine (they use to trip up even though safetynet checking apps said passed).
[OnePlus 3 & 3T Cross Device Development] knpk13:
Nope, why would people without issues post about it? I don't have any issues with safetynet and I have the same setup as you except for nano gapps.
[OnePlus 3 & 3T Cross Device Development] rohan164:
where i can find the path?

---------- Post added at 10:31 AM ---------- Previous post was at 10:30 AM ----------

where i can find path?
[OnePlus 3 & 3T Cross Device Development] BillGoss:
You could try /system_root/system/build.prop
[OnePlus 3 & 3T Cross Device Development] :
That magisk hide might be the culprit, i don't bother to check if it's enable or not when testing lately

I'm too busy to bother now :p

It used to be enable by default
[OnePlus 3 & 3T Cross Device Development] knpk13:
It is not enabled by default anymore.