yashsingh1/xdaforums huggingface dataset:
[Android Software Development] crypticc:
As above mine currently working.

full stock Android... TQ1A.221205.011

I originally had this config:

Magisk latest app and root (25206)

Running in Zygote,

USNF Displax 2.3.1_MOD 3 (previously 2.1)

Shamiko 0.6 (126)

Enforce Deny list disabled (as per Shamiko instruction)

Deny list including :

Google Play Protect,

Google Play Services (I've tried both with and without this)

Google wallet

In addition I've added following into deny list as mentioned by others on this thread

Global actions Wallet API

Android setup that includes the lifeboat API mentioned by others

Device policy (also mentioned lifeboat so did this too)

Betterbug (mentioned by others here)

Hardware info, because why not?

Security hub

Settings service ( includes lifeboat as mentioned)

Banking and media apps

I've probably put more than u need in the deny list but something in that second list is, once mod3 installed, what finally also allowed me to add a card. Might be coincidental though as been clearing rebooting adding clearing etc all day
[Android Software Development] olik2000:
Thank you, this solved all my problems with the apps in my work profile!
[Android Software Development] crypticc:
Thank you

The Gpay app seems to be the version left behind just for India UPI payments. Not available in my country but presumably I had some remnants from my trip to Goa a few weeks ago because last week when I first started getting device security errors it was bringing up gpay gui until I installed wallet from the PlayStore. This was all cleared yesterday so not related to permission issues today (now resolved)

Now I just have whatever is the skeletal wallet and then re-install Wallet app from PlayStore is what I finally added the card to after MOD3 and freezing more stuff.

Thanks again
[Android Software Development] V0latyle:
If you check DenyList again, I bet you'll see it's unchecked :)

Play Protect shouldn't be necessary, but better safe than sorry.

I personally have Wallet and Play Store blocked, but since the only thing you and I have in common is Wallet and we're both able to use it, I think that's all that is necessary:

USNF 2.3.1 MOD 3.0

DenyList:

Wallet

GPay
[Android Software Development] iwearthebelt:
Hey, I checked out the wallet app and it's working fine. Everything is working as it was prior to the February release. I'm not having any issues whatsoever. When checking integrity, the only one that fails is Strong security. but that fails due to the bootloader being unlocked, not much you can do about that.
[Android Software Development] canibuz:
I replicated this exact setup and it is now working for me.

The one thing I had to do in addition is clear the storage for Google Wallet. I was able to add a card with no warnings after that.
[Android Software Development] Jon8RFC:
@huskydg does some stuff for riru users:

Releases · HuskyDG/safetynet-fix

Google SafetyNet attestation workarounds for Magisk - HuskyDG/safetynet-fix

github.com

I thought they also maintained an updated magisk riru version for some reason. I must've confused it with their magisk delta project:

GitHub - HuskyDG/magisk-files

Contribute to HuskyDG/magisk-files development by creating an account on GitHub.

github.com
[Android Software Development] Yeedatoy:
I have both as well.
[Android Software Development] Yeedatoy:
You don't check gms in the deny list. That can cause issues
[Android Software Development] V0latyle:
USNF automatically unchecks this if I'm not mistaken
[Android Software Development] Yeedatoy:
Yup, that's correct. My wallet says its insecure as well, I just ignore it and it still works
[Android Software Development] bombadier:
Curious what issues does it cause? Reason for asking is my banking app (Halifax) will detect root if i dont have gms in the denylist
[Android Software Development] m0han:
Maybe a Magisk Delta user. Ignore.
[Android Software Development] m0han:
@huskydg might. Just wait it out.
[Android Software Development] crypticc:
Delete
[Android Software Development] crypticc:
I thought it didn't apply Google Play Services behind the scenes, but left as is so could be used by Shamiko
[Android Software Development] crypticc:
Yes. I was doing three obvious steps. Clearing data of the trinity of Play Services, Play Store, Wallet, and for good measure I also did Pay protect and then rebooted.

My play store and wallet both still says compliant couple of hours later. I'm not brave enough to try a reboot to see if they stick
[Android Software Development] cognitivedissonance:
To anyone scratching their head not knowing why they're getting Play Integrity API Checker showing you failing all 3 checks (Device Integrity, Basic Integrity, and Strong Integrity) the above may work for you, but if it does not, I have an additional couple suggestions.

1. Check that you don't have a modded Play Store installed. If you know you don't, then skip this step. Spoiler content hidden.

2. Check the version of your Google Play Store app. It may be quite outdated (especially if you're in the situation mentioned above.) The easiest way to update it is to grab a Play Store apk from APK Mirror (or other reputable source) and install it. To do the install, you'll need to use Split Apk Installer (SAI) which is an app you can find on the Play Store (the developer is polychromaticfox.)

tl;dr - The way I got my setup to pass Device Integrity and Basic Integrity was to follow crypticc's instructions, then V0latyle's instructions, and finally steps 1 and 2 that I've listed, above.

Edit: For the record, Wallet still acts like I'll be able to Tap To Pay (by shimmering the NFC icon above my cards that I've entered) however i haven't tested it yet to be sure. Also, when I go to the Wallet Tap To Pay Setup menu, it still shows "Phone does not meet security requirements" but also has a check mark indicating that (1) NFC is on, (2) Google Pay is set as my default, (3l I've added a card, and (4) I've set a screen lock.

I'll provide an update if I test out Tap To Pay.
[Android Software Development] Iverol:
If it still says it doesn't meet the requirements then it just won't work. checking YASNAC on my phone and it still fails CTS. Wallet still reports my phone as unsafe.
[Android Software Development] V0latyle:
What have you tried thus far? Are you using the Magisk module and the DenyList settings described above? Did you clear data for Wallet after doing this? And why are you still using YASNAC when you should be using Play Integrity API Checker?
[Android Software Development] Anonshe:
@Displax, thanks for the fix. Works great even on A14 DP1.
[Android Software Development] D€INOS:
Would "meet strong integrity" pass before all these Google changes in Play Integrity API Checker?
[Android Software Development] crypticc:
I have wallet and play store both saying device certified.

Integrity checker has all the checks "green" (EDiT: when I say"ALL" I meant "DEVICE", "BASIC" but NOT "STRONG" which as noted by someone else will never work for unlocked bootloader.)

I paid for something with contactless this evening. Device is still certified.

So at risk of repeating what's already been said the dance I did once all the permissions set and modules loaded and shamiko deny list set was

Force close and clear data of those 3 components I mentioned before

At some point with wallet installed and complaining from previous attempts I'd cleared data for wallet and the other apps and rebooted.

I then uninstalled wallet and again cleared data for the key apps and rebooted.

Finally I installed wallet again. And that was when it started to work.

Since then I rechecked and see that magisk remembered that wallet is on deny list even with uninstall in-between the steps, so I didn't need to reapply the setting.

The last things I remembered...if helpful

I'd already hidden magisk by renaming it months ago before all of this malarky.

I also use Ice box or whatever it's called to freeze the hidden magisk once all the deny props set and before clearing data and rebooting and reinstalling wallet and patting your head and rubbing your belly.

The renamed magisk is only ever not frozen when I actually have it open, but I did need to remember freezing the APK each time after exiting the app because auto freeze wasn't working for me... That was a step I was forgetting during the period that I wasn't passing integrity but maybe coincidental.
[Android Software Development] pndwal:
This seems to be the principal initial fix for latest Google checks:

Checking the changes (green entries),

fingerprint prop google/angler:6.0 is changed to google/marlin/marlin:7.1.2 (Pixel XL) and setBuildField PRODUCT and DEVICE values are set in addition to MODEL:

setBuildField("PRODUCT", "marlin");
setBuildField("DEVICE", "marlin");
setBuildField("MODEL", "Pixel XL");

My A-Only device isn't affected either, but it didn't need model mismatch based hardware-backed attestation enforcement (for S/N, and later also for PI) or the fingerprint mismatch based one (for PI)...

My guess is that if manufacturers are still making new-ish A-Only devices, these would most likely be targeted for hardware-backed attestation enforcement in PI (like many A/B devices) and now need fingerprint properly matched to product, device and model in props also...

🤠 PW
[Android Software Development] pndwal:
PSA for custom ROM users:

If your ROM integrates it's own prop changes/spoofing you should not be surprised if @Displax's latest USNF fails to work for you... You'll likely need to wait for the ROMs maintaining Dev to incorporate the changes natively...

Many custom ROMs are built clean and are thus more suitable for USNF and other magisk solutions, but of course these won't pass Play Integrity deviceIntegrity w/o magisk and USNF etc, so it's a choice for users... For example, official LineageOS will never spoof props/other expected signals, although many unofficial builds do.

👀 PW
[Android Software Development] Bad Bimr:
I want to send out a BIG shout out and Thank You to @pndwal and @Displax. Thanks to your hard work my phone is working properly again.

One question about all this denylist stuff. Since day one I have always used deny list and now many here say they use Shamiko. I have no idea what it is and searching I have come up with some people saying to stay away because it is not open source. Any help on what it is, how it works, what is the official page/download for it would be greatly appreciated.

Again Thanks in advance!

BB

​
[Android Software Development] V0latyle:
Unless bootloader is locked on bone stock firmware, STRONG integrity will fail. It's not important though because no apps require STRONG as far as I know.
[Android Software Development] osm0sis:
I think you misunderstood me, I meant it's an A/B test, nothing about device slots. 😆

https://en.m.wikipedia.org/wiki/A/B_testing

Anyway, I'm on my OnePlus 9 Pro running Lineage 19.1 here, so I guess I'm finally on the good side of one of these tests/rollouts for once! 🤷‍♂️
[Android Software Development] MatMew:
Hello, I flashed 3.0 on my Pixel 6 and we're back with contactless payments.

Thanks y'allz.
[Android Software Development] lieblingsbesuch:
Thank you so much for this instruction, had a problem with wallet out of the blue (I am on pe13 with a oneplus 8 pro). With shamiko and your deny list config, it worked again.
[Android Software Development] zgfg:
Your phone passed CTS Profile with hardware-backed evaluation type (required for Strong Integrity) only before you unlocked Bootloader on your phone

It means that CTS profile was evaluated and passed by TEE=Trusted Execution Environment

You cannot trick or mock TEE and basically what eg USNF module does is that it first downgrades CTS Profile evaluation to Basic (software) and then helps to pass that CTS Profile with the mocked Basic evaluation type. But that suffices for Device Integrity, not Strong Integrity

However, as of now, no apps require Strong Integrity

Btw, Strong Integrity applies only to phones that were launched with Android 8 or higher and it can be passed with unlocked Bootloader only on some ROG phones due to the broken implementation by vendor
[Android Software Development] katzis:
Hi I try where I can to wipe GMS data ?
[Android Software Development] katzis:
Sorry what about GMS data where can I find ?
[Android Software Development] zgfg:
Clear Data for Google Play Services (system app)
[Android Software Development] katzis:
Anyone knows?
[Android Software Development] zgfg:
Do you mind to read the answer in the previous post?
[Android Software Development] katzis:
There is only cache and manage data What exactly I must do ?
[Android Software Development] gj4560:
Manage data then click clear all data
[Android Software Development] katzis:
And reboot?
[Android Software Development] katzis:
It's doesn't work for Google wallet
[Android Software Development] huskydg:
You forgot to mention: + Magisk Alpha + MagiskLite
[Android Software Development] pndwal:
Where? 🙃 PW
[Android Software Development] huskydg:
Well, you don't know it? The author of its is one of the project you mentioned
[Android Software Development] pndwal:
Of course I know these!... I've put heaps about vv's Lite/Alpha/MTK and other forks in Magisk general discussion thread. 🙃 ... FWIW, I've discussed Metagisk, Bravo and even Delta too!... Guess I should have mentioned them all...😜 ... BTW, congrats on

run module uninstall.sh on Magisk uninstallation merge!

But you said I forgot... I said 'Where (did I forget)?'... Because that post was about DenyList, root hiding, Shamiko and closed source!... 🤔

Apart from isolated process leaks and other hiding methods (for which I did credit both vv and @canyie) developed in vv's Lite especially, I don't see how those relate to the member's queries...

But I know you like to stir the pot... PW
[Android Software Development] katzis:
I can't pass integrity only the basic any idea ?
[Android Software Development] pndwal:
For ideas we need clues... Clue: Device details/ROM/mods are a good start... PW
[Android Software Development] katzis:
Redmi note 11 Pro 5G with custom ROM evolution x
[Android Software Development] pndwal:
Evolution X will be the issue... I just posted re. this today:

🙃 PW
[Android Software Development] katzis:
So no solution with the latest USNF?
[Android Software Development] stubbs95:
If the rom maintainer doesn't release a new build no apparently
[Android Software Development] pndwal:
Not for ROM's that do 'dirty' tricks w/ props/spoofing as I said...

But depending on the ROM maintainer, there may be an update building a proper fix for integrated PI deviceIntegrity solution already!... Hope, check, fidget a bit, check again...

Personally, I prefer 'clean' custom ROMs + Magisk + root solutions over ROMs designed to pass PI deviceIntegrity w/o root unless not rooting... because a ROM designed to pass PI deviceIntegrity w/o root + Magiskroot + USNF = TROUBLE, especially when USNF and integrated fixes don't match and conflict...

🤠 PW
[Android Software Development] katzis:
Thanks you
[Android Software Development] Lagartixo:
Cepheus with Evox 13 and new merge pass with USNF 2.3.1.3.0. Thanks @Displax and @Chema_F

View attachment 5832627View attachment 5832629
[Android Software Development] huskydg:
To be honest, Android 11+ won't have this happened
[Android Software Development] seanho12345:
Does anyone encountered push notifications started to fail after clearing storage and caches of GAPPs?

My instant message app constantly failed to deliver notifications on time. It only started to pop up notifications when I open the app.
[Android Software Development] pndwal:
Sure... Well done with your research / results BTW ...

However I knew this was limited, eg Shamiko changelog says:

So if you were not referring to the considerable effort with isolated process etc hiding improvements in Alpha and especially in Lite, I'm still at a loss re. why you think I should have mentioned those forks in a consideration of the differences between Shamiko and denylist... 🤷‍♂️

I will say, in case anyone doesn't realise, that most of the important changes in official Magisk are developed and tested in personal forks like Alpha, Lite, MTK, Metagisk, Bravo, Delta (I meant to say Delta above... Corrected now) and more!... Pull requests often link directly to commits in such forks...To the extent that Devs with personal Magisk forks submit PRs with their fixes, these forks can be considered 'Magisk test forks'... And Magisk wouldn't be nearly the same without them!...

Long live Open Source!... And many thanks to Magisk & hide module Devs! 👍 PW
[Android Software Development] immortalwon:
@shoey63, so I take it you still working on getting hardware-backed attestation working again on your Rog 3 asus? I was considering buying this used phone, but if they fixed it, no point.

You using the tencent or international version? Just curious
[Android Software Development] rubnduardo:
How do i know if my custom rom integrates this? Im on pixeldust A13 and latest displax mod is not working. Help :(
[Android Software Development] V0latyle:
Use Play Integrity Checker. If fixes are implemented correctly you should be passing BASIC and DEVICE integrity.

That being said...it does appear that the latest Play Services update performs additional checks between advertised fingerprint and actual environment, so from what I understand it's less likely to be able to pass on custom ROMs
[Android Software Development] Schroeder09:
I haven't updated to feb yet because of all the varying reports on safetynet failing. Even without updating I all of a sudden started failing CTS profile. I couldn't figure it out or get it to pass after clearing cache and deleting data for messages (I put some hooks in it with XPL that I thought caused the issue) or play store. I had to uninstall UNSF 2.4.0 and install 2.3.1-mod 3, and not YASNAC and integrity check give good results. Why do the lower-level versions work? This is somewhat confusing because they're older versions, but they function better. It seems to be a downgrade to have to use them if going by regular file naming nomenclature.
[Android Software Development] rubnduardo:
I know pixeldust used to pass device integrity but don't know if it still does.

I'm on A13, latest magisk, MOD3, shamiko installed, play integrity bypass lsp module on, erased data from services, wallet and store, and denilisted wallet.

Only passes basic integrity.
[Android Software Development] Drahy:
Hi,

does not work for my Samsung Galaxy A600FN and Android 10 says installation faled unsupported CPU, can it be fixed?
[Android Software Development] Deny.Kr:
Thank you very much, it working! :)

EDIT: But unfortunately Google Pay app not working due to root :(
[Android Software Development] greenys':
Bootloop on Realme Q and Realme 5 Pro sadly.
[Android Software Development] Philnicolls89:
You will need to clear data from Google pay and Google play services then it should work again
[Android Software Development] nazirite.ninjah:
Thank you for this. I have Chinese Xiaomi Mi8 running miui miglobe Rom with unlocked bootloader. Google pay stopped working a week or so ago after working fine for years. I have never routed before but I really wanted Google pay so tried this and it works fine. Have been to the store and tested it. I had to clear Google Play services to get NFC to work. Thanks again, have donated.
[Android Software Development] nomisunrider:
Obviously I did, or would not have posted here. Google pay works fine for me.

Magisk 21.4 with Kirisakura_R 3.0.4 kernel.
[Android Software Development] fobtob387:
This works phenomenally for me in combination with MagiskHide Props, thanks heaps for your hard work!
[Android Software Development] Deny.Kr:
You are my savior, now all is fully working :)

Thank you!
[Android Software Development] Mdyche82:
i have 9860 rooted with magisk, i havent lost any of my credit card or banking apps, funny enough the only app i have problem with is my live tv app from spectrum, says unsupported device after root
[Android Software Development] Lughnasadh:
Try turning off USB debugging when using that app. May also have to clear data in the app and then hide it in Magisk hide before opening it up again.
[Android Software Development] tnmurdock:
Android 11 Pixel 4XL smooth as butta... enjoy the cup o' joe!
[Android Software Development] samashok:
Universal SafetyNet Fix v1.1.1 Magisk module is working on my Poco F1 stock ROM MIUI v12.0.3. SafetyNet Passed.

Thank you!
[Android Software Development] alexic82:
Hi

Hoping for some help.

Installed this fix. Works so far as Google pay works etc. No worries.

However, if I try to enter any of the security settings and requests a pin number, settings crash. Can't setup facial recognition, can't setup a new fingerprint. Anything that asks for a pin it crashes settings. If the screen is locked I can't use a pin to unlock it. But the previously setup fingerprint works to unlock.

Soon as I uninstall this fix from magisk it all works again....

Any ideas?
[Android Software Development] :
Try using Magisk version 7.5.1

Also boot up with out some of the new modules. In my case it was Webview..

It would help others, if you list what version you're on and modules installed.
[Android Software Development] alexic82:
Thanks for the reply. Apologies for the lack of info.

I'm on manager 8.0.7 and only other module other than this fix is call recorder.

So i should uninstall 8.0.7 manager and try 7.5.1? Assume there's an apk on github?
[Android Software Development] alexic82:
Tried 7.5.1. Nothing else installed. Same issue. It's weird. Everytime a pin is entered it crashes.

On lock screen, enter pin incorrectly and it says incorrect pin. Enter pin correctly and it goes to enter the phone but then crashes and comes back to home screen.

Works in safe mode.
[Android Software Development] Snow_ball:
sure you don't have systemless hosts enabled? If so, that's your culprit.
[Android Software Development] Essentrix:
Hi mate. Problem solved using safetynet-fix-v1.1.1-samsungmod.zip.

Appreciate the assistance.

Cheers
[Android Software Development] alexic82:
How would I check if it's on and turn it off? Seem to recall accidentally clicking it but it doesn't appear to be an on off option...?
[Android Software Development] :
if its working in safe mode, uninstall magisk, then reebot into TWRP, and flash the zip, you may as well delete the modules folder while you're at it.

data/adb/magisk/ delete the folder.
[Android Software Development] V0latyle:
They're not the same. The original Universal SafetyNet Fix is developed by kdrag0n; 2.3.1 MOD is a fork that's developed by @Displax.
[Android Software Development] Lagartixo:
To me UFSM 3.2.1.3.0. only works after the ROM updated with the necessary modifications. Check the changelog of your latest ROM

View attachment 5832821
[Android Software Development] pndwal:
You haven't given device, but this maintainer for Pixel 3 / Pixeldust A13 confirmed fixes for SafetyNet are added:

https://xdaforums.com/t/rom-pixel-3...blueline-5-october-2022.4024905/post-87145983

Custom ROMs are not the issue... The issue is that ROM already has a SNF solution, and these often don't play nicely with USNF, especially when Devs lag behind USNF with needed updates...

This is a choice for both users and Devs... Official LineageOS will never spoof expected signals as a matter of policy for example... So users of official LOS should have no more issues using @Displax's USNF solution than stock ROM users...

FWIW, attestation should pass without root with devices implementing a SNF solution, and if rooted users should simply hide root from gms (attestation/droidguard) and attestation should pass... No need for two SNF solutions... This relies on Dev's skill/knowledge/interest in passing integrity attestations however, as well as supplying timely updates when required... PW
[Android Software Development] rubnduardo:
So i uninstall USNF, Shamiko, and playintegrity lsp and only add to denylist Wallet and GMS, nothing else or am i getting it worng?
[Android Software Development] shoey63:
My bragging in these forums may have caught Google's attention.

Hardware backed attestation is no longer achievable it seems.

I'm using the Displax USNF Mod 3 method like everyone else now.