yashsingh1/xdaforums huggingface dataset:
[Android Software Development] matfcb:
This new mod doesn't make my deviced certified in Play Store, Safety Net not passed. Mi 9 Pro 5G. I only need to pass SN for McDonald's app, but I lose hope it will ever work again on my device.
[Android Software Development] V0latyle:
Just tested Outlook on my device. It's a pain to set up with Exchange accounts but I think that's a problem with the app development, not so much root. I'm now logged in and can send/receive organizational emails.

I believe Google has revoked CTS certification for most if not all Chinese OEMs due to continued violation of Android compliance and modified APIs. You will likely need to spoof a valid CTS profile.
[Android Software Development] matfcb:
I fear that if I will choose wrong CTS profile it will brick my device.
[Android Software Development] V0latyle:
It shouldn't, but if you experience a boot loop, you can disable Magisk modules via ADB during boot.
[Android Software Development] D€INOS:
Same deal with safetynet-fix-v2.4.0-MOD_1.1 for me. I couldn't pay (small amount) with just waking the phone, I had to unlock the phone.

Don't know if it's a rom issue though ( Evolution X, A13)

Anyone able to do a payment with just waking the display?
[Android Software Development] tiiiit74:
Same for me.

I wrote this in the thread about my rooted Pixel 6 TQ1A.230105.002 : "Hi everyone, I'm on vacation, I don't have a computer and I have a problem with Safety Net. I can no longer pay in NFC on my Pixel 6 Root when it worked a few days ago in SafetyNet-fix 2.4.0. I haven't done anything in the meantime... Tried 2.3.1 mod, doesn't work either. Can you tell me if I can unroot from Magisk without going through a computer? Thank you very much, it's urgent. See you soon I hope"."

But I realize that the problem affects many people.

To be continued !
[Android Software Development] pndwal:
This:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88105937

Latest Canary.

Yup, as soon as the stable version was updated past the first A12 capable version...

🤠 PW
[Android Software Development] pndwal:
So Google revoked CTS/VTS for certified devices?... 😲

I don't think that happened for any Xiaomi devices... Please can you say which brands?... Recently?... PW

... But all @Displax modded USNF builds do that for all devices anyway, as does official 2.4.0+... No need to spoof as already spoofed!... PW
[Android Software Development] V0latyle:
You're probably right...Google did suspend Huawei's license, but I could have sworn I had seen something about CTS profiles being revoked for a lot of Chinese devices. Maybe not.
[Android Software Development] pndwal:
No need anyway... See post above... Don't do that!... PW
[Android Software Development] Displax:
Not sure if I need separate thread for my MOD. It is not my own project, only just temp fixes and public decision direction (in my opinion) until original version got update. I just don`t want to associate this like "my own feat".
[Android Software Development] V0latyle:
Well, considering @kdrag0n is no longer active on XDA and does not maintain this thread, would you be interested in doing so? Following the commits of the original it does seem like he's implemented some of your changes. We're just trying to keep things organized on the administrative side - if you aren't working together with him to update the original, it would probably be easier for XDA users if you had your own thread for your fork, but if changes from your fork are being committed to the original, maybe he'd be OK with you taking over the thread if you feel up to it?
[Android Software Development] pndwal:
Huawei was a special case involving government/political considerations, sanctions etc, but AFAIK no devices had certificates revoked; in fact Huawei were allowed/able to guarantee that current users/devices would still be supported and continue to source Google updates... Google was ordered to suspend licencing for future devices however...

Also, may be confusing the tightening of CTS requirements a long while back with resellers supplying uncertified devices unlocked worldwide w/ their own ROMs incl gms/GApps... Google doesn't mind individuals applying GApps to personal devices, even clarifying this for Steve Kondik and more recently even allowed users to whitelist uncertified devices so GApps could be installed on custom ROMs legitimately w/o spoofing ctsProfileMatch... They took action because of unscrupulous resellers...

And notably, all this affects non-certified devices only, usually intended/configured for China region where government restricts use of GApps anyway and China alternatives are used, NOT certified models from Chinese manufacturers destined for overseas markets... Those must pass the usual scrutiny and CTS/VTS...

🙂 PW
[Android Software Development] V0latyle:
I must have confused something in my somewhat addled and exhausted mental state. There's Shawn Wilden's tweet regarding revoking attestation keys but that's a completely different topic
[Android Software Development] pndwal:
He is doing this in several pull requests, latest (and open) here:

Update deps, new hiding method, fix tests randomly failing

#261 opened 2 days ago by Displax

... Seems @kdrag0n is very busy w/ Proton, other projects, and is pressed at times to give attention to USNF... It may not be a high priority either, but @Displax is doing a great public service but building and publishing his fixes as an interim measure because of the lag w/ updates in official...

This could work AFAICS...

eeek.... (here's hoping! 😁)... But personally I'm very happy @Displax is making time to do what he is... PW
[Android Software Development] pndwal:
Revoking keys?... Shawn Willden?... PW
[Android Software Development] V0latyle:
https://twitter.com/i/web/status/1237836365238337536
[Android Software Development] Lughnasadh:
I'm not sure if kdragon is still updating ProtonAOSP. I think his last release was in August, but I could be totally wrong. Seems he's been very busy with his OrbStack project, which just went to early access.
[Android Software Development] Displax:
Well, maybe it's worth it. I will create a separate thread if it will be easier for the community
[Android Software Development] pndwal:
... Yup, something completely different...

This will generally relate to invalidating / breaking hardware-backed verdicts, and will be accompanied by removing model / fingerprint / other? prop based enforcement for the same on affected devices...

The revocation means strongIntegrity can never pass but attestation type will fall back to basic, and the associated changes means enforcement of hardware-backed verdicts per API is also removed which allows basic attestations to pass...

Of course, to be clear, this is nothing to do with revoking device certification although I'm guessing OEM's may receive warnings for failing to comply with protocol for their keymaster implementations etc, and may get assistance to ensure future devices comply...

🤠 PW
[Android Software Development] inzaghi89:
Discontinuing the SafetyNet Attestation API | App quality | Android Developers

developer.android.com

Not sure that someone has noticed that.

So just for the dumb - is there something we should worry about? Does that attestation do something more than blocking our payments apps?
[Android Software Development] Nergal di Cuthah:
Safetynet was deprecated for PI which this addon works for as well. Basically stop testing with YASNAC and use something like Ingrity checker

GitHub - 1nikolas/play-integrity-checker-app: Get info about your Device Integrity through the Play Intergrity API

Get info about your Device Integrity through the Play Intergrity API - 1nikolas/play-integrity-checker-app

github.com
[Android Software Development] crypt0kiddie:
Is this why the Safetynet patches seem broken?

I have a Pixel 7 Pro and access to two others, ALL of them are on the newest OEM Feb update, newest Magisk and I've tried both 2.3.1-MOD (the fork) and the newest 2.4.0 on all 3, none work with Tap to Pay.

I also can't pass a Safetynet check (CTS profile mismatch) unless I reset Magisk and reinstall the module. Then I will pass until I open the Play Store, then it breaks again.
[Android Software Development] matfcb:
I have newest Magisk in Canary version, Xiaomi Mi 9 Pro 5G newest stable version on Android 11, USNF 2.4.0 (I tried this mod) and I have device uncertified in Google Play Store and device is not passing Safety Net test in YASNAC. I tried to change fingerprints to Mi 9 T Pro and Poco X3 Pro but it didn't work. In Magisk I have systemless hosts on, Zygisk on, Shamiko on, LSPosed on, USNF on, in deny list Google Play Store, GP Services on, Google Services Framework on but it did not work. Mum's Poco X3 Pro is rooted and certified in Play Store and it passes Safety Net. Any suggestions?
[Android Software Development] inzaghi89:
For me both 2.3.1_3, and 2.4.0_1.1 works. With 2.4 i need to wait ~5 secs until integrity checks will pass after unlock device, but it works all the time. You've added gwallet and gservices to hidden list in magisk?! I've also renamed magisk
[Android Software Development] Nergal di Cuthah:
What apps for lsposed i would think one of those, at a guess, might be triggering.

What do you have in your shamiko deny list (i think that's right that it takes over for enforce deny list)
[Android Software Development] zgfg:
Months ago it was commented here.

And all this talk since then about Play Integrity API

The new USNF versions, troubles with Wallet...

Just randomly scrolled back 60 (sixty) pages to the pg 108, and seeing the posts from September last year already discussing the new PI API (successor to SafetyNet)
[Android Software Development] crypt0kiddie:
Everything has been added, yes and I renamed Magisk to "Bob".

Been here on XDA and a Google phones since the Nexus 6, I'd like to think I did not miss anything, just seems broken.

I should add sometimes it works, sometimes it doesn't. Like I might get tap to pay to work at one store, then an hour later it fails at another. Try it again an hour later and now it works. Today, no such luck though.

Trying safetynet-fix-v2.4.0-MOD_1.1.zip now..
[Android Software Development] zgfg:
Outlook, Teams, Wallet - all working fine for me on Xiaomi

But I'm not going to reveal much details, we know who is monitoring here

Mama ŠČ😄
[Android Software Development] crypt0kiddie:
Looks like safetynet-fix-v2.4.0-MOD_1.1.zip might have been the trick with Wallet..

Passing in YASNAC now and um I'm passing the top two in Play Integrity API Checker.
[Android Software Development] Displax:
Well, anyway new version is out :)

MOD updated to v.1.2

Fix crash and endless tests loop/failing on Android < 9.0 (bug from original version 2.4.0).

Do not unpatch (revert) changes. To prevent possible tests failing after a while on some ROMs (cross conflicts).

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88132825
[Android Software Development] Nergal di Cuthah:
Everything working well, as it was on last mod. Thanks for update. i don't use wallet/pay/phonepay at all so i can't/haven't spoken up, but maybe it's good to tell @Displax that it works as intended for some.
[Android Software Development] Pavilo-Olson:
Z Fold 3, latest stock OS (January security patch), magisk stable with USNF 2.3.1 and shamiko.

Device previously worked fine on November security patch, updated to January a few days back and wallet started throwing the "device does not meet requirements" error but still worked for contacless payments earlier today, but then randomly started failing after no changes a few hours ago.

I've now updated USNF to 2.4.0 mod 1.2, device and basic integrity are passing but wallet still showing unsupported. Will see what happens if I leave it overnight, don't really want to clear play services data unless I absolutely have to as that means factory resetting my Galaxy watch 4 :rolleyes:
[Android Software Development] crypticc:
Thought wearables was a separate area of play services data?
[Android Software Development] Nergal di Cuthah:
That sucks that they're that tied together. What happens with a new phone reset watch too.

Did you delete data for wallet?
[Android Software Development] Pavilo-Olson:
The categories are:

"Manage search data"

"Manage wearable data"

"Clear all data"

You need to use the "All data" option to give play services a kick up the arse, and that deletes wearables. 10/10 Google moment.

Yeah, at least with Samsung wearables you are tied specifically to a play services dataset and any change (factory reset phone, new phone, clear play services data) requires a factory reset for the watch.

I did delete data for wallet, no change as of yet. From what I understand it can sometimes take a while, considering device and basic integrity are passing and wallet being on blacklist I see no reason for it to throw the error. If it still does it tomorrow I'll bite the bullet with the play services data.
[Android Software Development] Displax:
So, created separate thread for my mod. Welcome)

[MODULE] [MOD] Universal SafetyNet Fix

Universal SafetyNet Fix [MOD] Magisk module Hello. This is my modification [FORK] of the original Universal SafetyNet Fix module from @kdrag0n. Created for the (temporary?) restoration of working capacity in the conditions of constant change...

xdaforums.com
[Android Software Development] Pavilo-Olson:
Update: Clearing GMS data has made it work again. Waiting did not.
[Android Software Development] Legoman6:
I think it's here: https://github.com/HuskyDG/safetynet-fix/releases
[Android Software Development] Nightf0x_007:
Not passing the tests, i switched to zygisk & installed latest safetynetfix 2.4.0 mod 1.1 by displax & the good thing in magisk delta that is magiskhide works with both riru & zygisk, now passing the tests & bank apps working as it is
[Android Software Development] immortalwon:
I just want to see if anyone else is having issues:

I am still passing safetynet / play integrity with original 2.4.0 kdrag0n mod but my google messages

app is acting weird. I can't even sync to desktop pc and sometimes my messages don't go through to my friend who uses google messages. Anyone else?
[Android Software Development] V0latyle:
I'm able to pair with desktop but I find that the PC often gets messages before my phone does. Not sure why and I don't think it has anything to do with SN/PI.
[Android Software Development] wfred:
Which usnf were you using before?

Dropping down to 2.3.1 mod 2.1 worked on my 7T
[Android Software Development] wfred:
When you clear data & uninstall updates for wallet it returns to being Gpay.

The app stays Gpay until it eventually updates to Wallet (took 2 days for me) so it might be a case of when they are posting
[Android Software Development] pndwal:
Nb. Latest @Displax fork/mod 2.4.0 build has several fixes, but this:

should fix issues/conflicts with custom ROMs that integrate attestation fixes...

👍 🙂 PW
[Android Software Development] Valiante:
Very strange I had no issues until I updated the module to the latest version. Now Google wallet is constantly failing. I should've stuck with the module that was working, amateur move lol.
[Android Software Development] tuannghia1985:
Rog phone 6 work well with that module, No need MagiskHide props Config anymore. Cheers.!!!!

So far Netflix app work again. For other apps please install another module call Sui - Magisk module. That will allow you to hide/deny/allow su permission for each app (same but better than Magisk deny list). Then G-wallet will work again. Safety Net will also pass without a doubt.
[Android Software Development] crypticc:
What version USNF and Magisk and wallet do you have?

Just a heads up that wallet and I saw another bunch of Banking apps just got updated today, so warning to everyone on that. backup the apk before updating just in case you need to go back. I didn't on one of my apps and that's now not working.
[Android Software Development] doveman:
I'm having a problem with my Poco X3 NFC. I had this problem with MIUI12 and I've just updated to MIUI13 and still have it.

I've rooted the device using Magisk to patch the boot.img and flashed that and done "fastboot flash vbmeta --disable-verity --disable-verification vbmeta.img" and the device is rooted, because AFWall+ works, but Magisk shows "Installed N/A" so I can't install any modules.

I've tried installing the SafetyNet and Zygisk modules from TWRP 3.7 but apps still detect that the device is rooted, so it seems the modules don't work unless Magisk recognises that the device is rooted.

Has anyone encountered this problem before?
[Android Software Development] zgfg:
Make sure do you really need to mess with vbmeta on Xiaomi - usually it is not needed (I have two Xiaomi phones but not your surya)

Anyway, the issue you have described is well known and common (and numerous times discussed in the Magisk threads) for users who previously did Hide Magisk app and did not Restore Magisk app - then that old Magisk app (renamed and repackaged) remains connected to Magisk while the newly installed Magisk app cannot 'connect' to Magisk

Try to think did you do Hide Magisk app previously and what name you provided then - from Settings /Apps / Manage apps search for that name and uninstall that app and reboot
[Android Software Development] Nergal di Cuthah:
Often points to two magisk installed one hidden as another app and one as magisk

Oops already answered by @zgfg
[Android Software Development] doveman:
Thanks, that was the problem. I uninstalled the hidden one and then reinstalled Magisk from TWRP and it's all working again now.
[Android Software Development] Momoske:
Since QPR2 Beta 3, some of my apps checking for safetynet/integrity have been crashing when hidden with Zygisk. Using the Displax USFN mod, nothing changed for me unfortunately, I'm still passing as Basic but not strong integrity.

Is that because of being on QPR? If so, does anyone know why all my apps opened just fine on QPR2 Beta 1 (I am 100% sure of it) but not anymore? Even RootBeer Fresh crashes if hidden. Makes no sense to me 😕
[Android Software Development] JakeDHS07:
You will never pass strong integrity with an unlocked bootloader. It's not possible. But it's also not necessary. Only device and basic.
[Android Software Development] zgfg:
You should not think about Strong Integrity - it cannot be passed with Bootloader unlocked and afaik no app requires Strong Integrity yet (there are reasons for).

Hence make sure you pass BASIC and DEVICE Integrity

There is a new thread by displax with his latest v2.4.0, try that:

[MODULE] [MOD] Universal SafetyNet Fix

Universal SafetyNet Fix [MOD] Magisk module Hello. This is my modification [FORK] of the original Universal SafetyNet Fix module from @kdrag0n. Created for the (temporary?) restoration of working capacity in the conditions of constant change...

xdaforums.com

Btw, most banking apps do not just check Integrity but they also use other methods to detect roots (and they may "crash"). To hide root from them you will have to investigate (things are discussed a lot in this thread, in the Magisk thread, Magisk-Zygksk and Magisk Delta threads, etc) and to make other protections - but try with that USNF first, to make sure that PI API Checker passes Basic and Device Integrity (btw, it does never "crash", it shows what it passes or not and you can further inspect the JSON answer)
[Android Software Development] Momoske:
That makes sense, then the mod is working as expected for me I guess - no idea why RootBeer Fresh is crashing on start though. MatLog isn't giving me any logs when the app crashes and nothing useful appears in the Magisk logs, is there any way to debug this? Would love to know if that's tied to the USNF module or not
[Android Software Development] zgfg:
Use better apps than RootBeer (they test more deeply and show what they find)

Oprek Root Detector - Check De - Apps on Google Play

Apps to check devices health, root, or xposed framework.

play.google.com

TB Checker - Play Integrity - Apps on Google Play

All in one tools check android devices

play.google.com

Releases · byxiaorun/Ruru

An android sample app of detecting suspicious apps like magisk manager - byxiaorun/Ruru

github.com

GitHub - Dr-TSNG/ApplistDetector: A library to detect suspicious apps like Magisk

A library to detect suspicious apps like Magisk. Contribute to Dr-TSNG/ApplistDetector development by creating an account on GitHub.

github.com

You should make them all pass - that will be a good excersize and a good start for the real apps
[Android Software Development] pndwal:
First, great to see you around still guv!...

I cut my teeth w/ XDA/modding largely in your famous Everything Huawei Y550 - Root/CWM/TWRP thread... And not many threads beat that for longevity, value and support!... I had 14 of those devices once they hit the bargain bins in Australia!...

FWIW, there's an open GitHub issue for this that will hopefully get some attention from Devs soon... But, as mentioned, this has existed for a long time and a fix has also been a long time coming...

I commented on two scenarios where this occurs and linked some tips in that issue here:

https://github.com/topjohnwu/Magisk/issues/6309#issuecomment-1269725891

and here:

https://github.com/topjohnwu/Magisk/issues/6309#issuecomment-1272312236

Nice to see you, to see you Nice! 🙂 PW
[Android Software Development] Momoske:
I can get behind your thought of using other apps to test, but this was just an example - Google Wallet also crashes (though the wallet QS tile still works somehow), regardless if it's in the DenyList or not, and reinstalling doesn't fix it. So confused honestly, I doubt anyone knows haha.

Thanks for your suggestions though, TB Checker works great! Seems to say my Zygisk works fine.
[Android Software Development] zgfg:
Just tried and both RootBeer Sample and Fresh fully pass (they are easy)

Wallet also works for me but I added only some reward cards - anyway, there is a separate thread for Wallet, check the recent posts there

(For the matter of fact I have Wallet on my everyday driver with Magisk Delta and I 'bloated by beer' my retired driver with the official Magisk Canary

Other then that, I have the same checkers on both phones and they fully pass on both sides)
[Android Software Development] alexic82:
So not via Odin? Flash the magisk zip from recovery?
[Android Software Development] zgfg:
Folder with Magisk modules is /data/adb/modules

Each module has its own subfolder - adding an empty file named "disable" (without quotes) in its subfolder disables that module.

Empty file named "remove" (without quotes) commands to uninstall that module on the next (re)boot
[Android Software Development] alexic82:
This is a fresh install of a patched file via Odin. No other modules except safety net fix.

Removed magisk. All works. Install magisk without safety net fix.still works. Install safety net Fix and stops working.

I noticed a second google play services related to dual messenger. Couldn't get into it to clear cache as it needed a pin and that crashes settings
[Android Software Development] alexic82:
Interestingly I've narrowed it down to installing dual messenger...soon as I do that it breaks
[Android Software Development] Sven74Muc:
Unsupportet CPU architecture: armeabi-v7a

! Installation failed
[Android Software Development] milsabords:
Same hère, SM-T510, NEXUS rom Android 10.
[Android Software Development] emaborsa:
It's a known problem/behavior, IMHO don't know if they are going to fix it...

However, I have the same problem, waiting for something new.
[Android Software Development] alexic82:
R u talking about the dual messenger issue or something else?
[Android Software Development] emaborsa:
...don't know what the dual messenger issue is :D
[Android Software Development] NexxusDE:
Worked
[Android Software Development] Sven74Muc:
Is there any other solution you found to fix the SafetyNet issue?
[Android Software Development] emaborsa:
As far as I've understood, no.