yashsingh1/xdaforums huggingface dataset:
[Android Software Development] pndwal:
The failures with 2.4.0 may be random, often occuring with a reboot...

Google monitors device security for G Pay/Wallet full time, so whether PI deviceIntegrity fails momentarily or user removes lockscreen pattern/password and immediately restores it, Pay/Wallet will likely lock out contactless payment use even while Pay/Wallet is not in use and either require resetting (clearing data for Pay/Wallet and/or Play Services) or will be restored after some time...

We need a fix for detections in official solution, but @Displax modded USNF builds are not failing this way and are working fine for most users ATM. PW
[Android Software Development] bangrod:
Does the modded version work with Magisk v23 do you know?
[Android Software Development] Nergal di Cuthah:
Works fine as far as i can tell
[Android Software Development] bangrod:
Does it need to be installed with the kdrag0n original mod or should I remove that one first?
[Android Software Development] Nergal di Cuthah:
If you are downgrading i suppose best practice is to remove the newer, don't know if it is necessary though. If you're on older than 2.4.0 then you should be able to install over (but don't follow the update button after as it will upgrade you to 2.4.0)
[Android Software Development] bangrod:
Ok thanks I'll try it again. I'm using older version as I'm on magisk v23 and need the Riru version of safety net fix
[Android Software Development] Nergal di Cuthah:
I'm sorry i think I misread your magisk version. I think I'm on 25
[Android Software Development] christantoan:
Sorry for bumping but can anyone help me with this, please?

Thank you!
[Android Software Development] pndwal:
No... It's a Zygisk module so needs 24.0+.

You can use Riru modules, eg @huskydg's USNF fork, or official Riru-USNF + Magiskhide + for PI deviceIntegrity use MHPC to manually add a mismatched fingerprint prop and manually alter shipping level prop value (for A13 LV devices) if google enforces hardware based verdicts for Play Integrity API on you device. (Hardware based verdict enforcement for SafetyNet API is bypassed by mismatched model prop in Riru-USNF)... PW
[Android Software Development] pndwal:
Please see post above... PW
[Android Software Development] huskydg:
Yes, but you have to uninstall UNSF and give up official magisk. Also even you switch to another unofficial magisk, installing USNF will make it detects again. That's your choice ¯\_(ツ)_/¯

Also check this:

[Suggestion] Bypass Safetynet without using resetprop · Issue #253 · kdrag0n/safetynet-fix

We have few apps that detect dirty props change done by Magisk resetprop. This will make it is impossible to use these apps and make Safetynet passed on stock ROM. We need to change necessary props...

github.com
[Android Software Development] christantoan:
Ouch

Thank you for the advice though. Glad to know how the apps detect root.
[Android Software Development] Sasy969:
Hi again guys

thanks to the help of @pndwal I was able to have wallet working, simply adding com.google.android.gms.unstable and com.google.android.gms to magisk denylist with no USNF magisk module at all.

Until now everything was working preatty fine and i was using wallet for paymenti without any problem, but now I have just opened wallet and again the same poup up saying my device doesn't meet safety requirements.

Attual Setup

Magisk installed

One Plus 9 eith EvolutionX ROM (ROM seems to have some tricks to pass safetny net on its own)

No magisk module installed

i am able to get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY
[Android Software Development] AnyNameYouWish:
On Google Pixel 5, I installed january update last weekend. Since today only, I can't pass integrity check anymore.

I followed V0latyle and Homeboy76 guides, tried with Kdrag0n(2.4) and Displax's (3 available versions) modules. Each time I flashed in Magisk then wiped Play Store, Play services and Wallet cache and data.

Deny list is configured but not enforced since I use Shamiko. I tried both ways tho, but unsuccessful in both.

No changes in my modules since I updated so I don't think one of them caused it, but here's the lists:

My modules in magisk are

- AOSP Mods Full 2.6.0

- Builtin Busybos 1.0.4

- Debloater 17.3.3

- Magisk Bootloop protector 1.5

- mindetach 2.3

- Shamiko 06

- Universal SafetyNet Fix 2.4.0 (Kdrag0n)

- Youtube Revanced 18.03.36

- Zygist Lsposed 1.8.5 mod

In Lsposed, modules are :

- AOSP mods

- Let me downgrade

- UniversalAuth

- UpdateLocker

- XprivacyLUA

Any idea what I'm missing and what could be a fix?
[Android Software Development] wyt18:
Try uninstalling xprivacylua and delete all the folders it created in system and sdcard. That was what tripped integrity checker for me before
[Android Software Development] AnyNameYouWish:
Holy Moly you made me happy!

I didn't find any folder to delete, but first try with Displax latest mod + clear data from Play Store, Play service and Wallet did the job.

I reinstalled XprivacyLUA, so far so good 🤞 Still have to go out and test the wallet.

Thanks Captain! May I ask how did you find out?
[Android Software Development] wyt18:
I tried everything and at some point deleted all my magisk and xposed modules to test individually

Be careful about using xprivacy, it may trip integrity again at some point. I removed it completely and now all works fine
[Android Software Development] Sasy969:
Update: I have tried again to simply delete the data of GW, GPS and PS and wallet started working again
[Android Software Development] Schroeder09:
how can you tell this? I am now out of nowhere not passing integrity check, and I have no idea why, and I'm not sure ow to troubleshoot to determine the cause.
[Android Software Development] wyt18:
try uninstalling all your xposed / magisk modules and see if that works
[Android Software Development] Schroeder09:
will disabling them do the same trick?

edit: disabled XPL and rebooted. now im passing safety net. wth!? I guess I will have to see what google apps I restricted the last couple days and undo that? is that the proper course of action?

EDIT#2: Cant seem to get safety net to pass if XPL is active at all. Is there cache or data in certain folders I need to delete or rename? I'm on A13 on a p7p with the latest security update. I have magisk 25.2 and lsposed 1.8.6. I'm using universal safety net fix 2.4.0.

EDIT #3: so it seems restricting gboard with XPL causes safetynet to trip. I will post a 4th edit, but I believe there is a specific restriction on gboard that is causing this.
[Android Software Development] pndwal:
A number of modules will break basicIntegrity even for S/N API, more for PI API... Some configurations in modules like XPrivacyLUA will also break ctsProfileMatch etc... Disabling all modules other than USNF is the correct approach for diagnosing issues...

Nb. Banks often detect XPrivacyLUA even after uninstalling as it doesn't clean up properly... Remove data/system/xlua folder to prevent this detection...

🤠 PW
[Android Software Development] Schroeder09:
Can the file be named to something else and XPL still function properly? Does another portion of the app need to be changed to then route things to the renamed folder?
[Android Software Development] pndwal:
So you mean folder/directory?... I don't know... Hardly used XPrivacy... Doubtful however... PW
[Android Software Development] christantoan:
Just a note that as of version 3.19.0 they seem to disable the protection. Probably due to many false positives according to the reviews.

I attached the last version I have (3.17.0) that still have the protection enabled just in case it can be used for further investigation.
[Android Software Development] pndwal:
Moving this here:

Nice interception of that ball! 😉

Yup, the method I previously posted in G Pay Magisk Discussion thread didn't work for me either this time...

Not sure it will clear w/o intervention... Try what I wrote in this thread... May need to clear updates, caches and uninstall G Pay again before rebooting and reinstalling as mentioned in last paragraph re. my recent saga:

Be sure to do the reboot or you may need to go through hoops to get other issues fixed even if G Pay updates to wallet and works again, eg Activity list never populates issue...

Hope it works for you and please report your results...

🤠 PW
[Android Software Development] wfred:
Thanks, why ask your own question when you can just snag something else's 😉

Anyway, cleared gpay & play cache this morning and about an hour later, after 2 days, it was working. Added the cards back and everything seems to be fine.

Thanks again
[Android Software Development] f.c_dj:
I noticed GMS is gone from deny list after reboot. Could this be the reason why it works for some time and then it stops again?

Maybe GMS "disappears" at boot to be removed from magisk deny list
[Android Software Development] zgfg:
Answered really many times - the USNF removes GMS from DenyList deliberately and from the beginning of the module's development.

It has nothing to do with the issues you have now with Wallet

You can open USNF scripts and find the code where it removes GMS.

You can find how and why also on the GitHub and in the posts in this thread
[Android Software Development] pndwal:
Folks, a number of members have reported intermittent failures for G Pay/Wallet security checks even with @Displax modded USNF builds, and I can confirm that after a good run this has also occurred on my device:

https://xdaforums.com/t/discussion-google-pay-magisk-discussion-thread.3906703/post-88100463

It seems that @Displax modded USNF builds may be more consistently maintaining deviceIntegrity, but that there may have been some Google change that trips detections sporadically... 🤔

Clues:

I only have a few clues, but I believe we can eliminate Prop-based device ID bypasses because my device (Xiaomi RN8T) doesn't require any of the 3 prop-based device ID bypasses for Google's hardware-based verdict enforcement for devices they identify that way...

So I wonder if Fake keystore-based attestation type fallback can kick in late or otherwise fail. This is doubtful because I haven't seen any Zygisk failures and believe the code for fake keystore registration in gms is injected at boot-time so hardware attestation data delivery should remain broken as fallback trigger... I may be missing something here however...

This leaves the module's setting of new sensitive prop values and consistent hiding of root from gms attestation/droidguard process (Nb. my device has /sbin as magisk tmpfs mount path) in doubt.

I suspect the issue may lie with the modules root hiding implementation for gms, but this is only an educated guess at best and the fact that those on custom ROMs w/ SNF but w/o USNF are reporting the same issue (not sure if any w/o Magisk have reported yet) might indicate that it's not this...

This one may be a doozy to diagnose... Hold on to your hats... And plastic cards... 🙃 PW
[Android Software Development] pogo-airsupport:
For what it's worth, I found disabling Shamiko and turning on enforce denylist seems to have fixed it for me over the past few days.
[Android Software Development] pndwal:
Doubtful it'll fix sparodic fails; USNF doesn't rely on either for hiding normally...

I've just done this:

1) Fixed G Pay/Wallet installation

2) Put gms attestation/droidguard and main gms processes (main process not actually needed for my device w/ Magisk path = /sbin but shouldn't hurt) in denylist (NOT enforced) with Shamiko working in blacklist mode...

Nb. This won't work with DenyList functioning, but persists/works w/ Shamiko thanks to @ipdev's Only remove gms if Denylist is enforced commit. 😜 😋

... in case the issue is with USNF root hiding... This way Shamiko will be the second watchman...

I'm not confident this will fix failures (may not be a hiding issue as discussed) but so far so good with this configuration. 🤪 PW
[Android Software Development] pogo-airsupport:
What is gms attestation/droidguard listed under?
[Android Software Development] pndwal:
It's the gms (Google Play Services) com.google.android.gms.unstable process that John referred to as the "SafetyNet" process...

It is now evident that this is more correctly termed an "Attestation / Droidguard" service.

Technical​

Since S/N is now deprecated it's evident that the process is not API dependant... Also, reversers have recently revealed that it actually performs the handshaking between gms and DroidGuard, which is the actual attestation engine responsible for collecting many of the measurements (not all, but is responsible for the hardware keystore backed signals and more) that gms sends to Google's back end servers.

From Romain Thomas's whitepaper (Note this was written while SafetyNet was the only Device Integrity API available so still refers to many attestation functions as 'SafetyNet' functions):

View attachment 5829603

View attachment 5829605

https://www.romainthomas.fr/publication/22-sstic-blackhat-droidguard-safetynet/

👀 PW
[Android Software Development] ddrum2000:
Maybe I am doing something wrong but I followed this process but I am unable to add cards to gpay/wallet. Any thoughts? I'm on a pixel 6a Feb 2023 update.
[Android Software Development] Lagartixo:
Started problem today and made all procedures including v2.3.1-MOD_2.1 and no solution. CTS profile match fail. (Mi9 with EvoX 13)
[Android Software Development] bigknowz:
Swuches
[Android Software Development] ddrum2000:
Same here but I'm running 2.4.0

View attachment 5830415
[Android Software Development] bigknowz:
You have older version GPS.
[Android Software Development] ddrum2000:
Thanks updated play services and now I'm on 23.03.13. CTS now fails so I guess same as you?
[Android Software Development] JakeDHS07:
Yup looks like there's gonna need to be an update 🙄. It's a damn good thing I don't need or use NFC hardly ever and just do this for fun otherwise I'd be very annoyed.
[Android Software Development] pndwal:
I've needed to wipe data for Play Store , Wallet/Pay and Play Services at least but twice even that wasn't enough; removing all updates for Play Store , Wallet/Pay and Play Services also, rebooting (very important) and starting fresh fixed it... 😬 PW
[Android Software Development] pndwal:
Of course you also need Play Integrity deviceIntegrity pass since Safetyis deprecated...

This:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88103103

🙃 😬 PW
[Android Software Development] jknaggs:
CTS profile match fail here also on P7pro Feb security update. Running latest USNF 2.4.

Device still certified in play store and all banking apps working.
[Android Software Development] pndwal:
Bank app are usually fine since they don't monitor environment for security compliance / device integrity full time...

Google does that for Pay/Wallet, so even if PI API's deviceIntegrity fails at boot-time only or momentarily later while Pay/Wallet is not in use, security requirements will fail for contactless payments on next use. Nb. This applies to removing and replacing screen lock pattern/password also...

👀 PW
[Android Software Development] ddrum2000:
I did all of that. Do you mind being a little more specific about the order? Also if CTS failing, this doesn't really matter at this point does it?
[Android Software Development] pndwal:
Can you be specific about why you are

... Do you have

View attachment 5830511

screen that doesn't ever complete, or other?

👍 PW
[Android Software Development] AusVGM:
Thank you! This worked for me.
[Android Software Development] ddrum2000:
No. I'm getting this Google pay error messageView attachment 5830525

And this fail from the security checker

View attachment 5830527
[Android Software Development] benjaminrm:
Hi, I was having problems passing CTS Profile Match today.

Device: Pixel 7 Feb Update

Tried v2.4.0 and v2.3.1-MOD_2.1 without success.

This last module have worked for me, hope for your devices too!

Releases · Jukmisael/safetynet-fix-jukmisael

Google SafetyNet attestation workarounds for Magisk - Jukmisael/safetynet-fix-jukmisael

github.com
[Android Software Development] ddrum2000:
This did not work for me. Which apps do you have "enabled" on the denylist. I currently have: Google Play Store, Wallet, GPay, Play Protect Service, and some other non-relevent apps.
[Android Software Development] benjaminrm:
Just banking apps + wallet
[Android Software Development] pndwal:
Ah... The issue most here have is old (deprecated) S/N ctsProfileMatch and new PI deviceIntegrity failing only sporadically; they generally have these passing...

Yes, you need to fix PI deviceIntegrity first, then clear data etc for G Pay/Wallet, G Play services etc to reset failed security checks... It may just reset itself after some days (even a week), but only if you have PI deviceIntegrity... 😜 PW
[Android Software Development] pndwal:
Interesting fork of a very experimental fork of @Displax's fork of official USNF!... 😃 😜 PW
[Android Software Development] osm0sis:
Brutal commit log... If it is real it looks fake/spam as hell. I wouldn't trust giving that thing zygote access on my device...

Commits · Jukmisael/safetynet-fix-jukmisael

Google SafetyNet attestation workarounds for Magisk - Commits · Jukmisael/safetynet-fix-jukmisael

github.com
[Android Software Development] pndwal:
Did you have this passing previously?... Is ROM stock?...

You don't need Play Store in denylist... Keep Play Protect Service... Other than that, only bank and detection apps + GPay/Wallet are normally added...

Try passing PI deviceIntegrity with all modules disabled other than one of @Displax's USNF Mod builds, denylist enforced and Zygisk = Yes appearing on Magisk App home screen... PW
[Android Software Development] pndwal:
Better ping the member:

😶

... Did you see any especially suspect commits?... Just tooo many since Dec... Seems to be trying to do all kinds of root hiding (Shamiko's job) too...

But security is the big issue for sure... PW
[Android Software Development] osm0sis:
Nah just judging by the repetitious and nonsensical commit names. It's chaos. I mean look at this page of them: https://github.com/Jukmisael/safety...&branch=myfix&qualified_name=refs/heads/myfix
[Android Software Development] Bad Bimr:
Been reading for about an hour and could not find a definitive answer.

Have Both Pixel 6A and 7

magisk stable 25.2 (25200)(33)

with modules:

Advanced Charging Controller (ACC) v2022.7.3.30

MagiskHide PropsConfig v6.1.2-v137

SystemlessHosts 1.0

Universal SafteyNet Fix v2.4.0

Lately I have been getting an error (Pixel 7) about root upon opening my wallet but it would still work. Today however it did not work. Running YASNAC - SafetyNet Checker it passes for the first few times but after a while CTS fails. Then later it may pass again. With the Pixel 6A it passes when you reboot but fails a few seconds after.

What is going on? Is there a fix?

Thanks in advance.

BB
[Android Software Development] pndwal:
There's plenty on it here if you read back...

Basically 2.4.0 failed to maintain deviceIntegrity from the getgo:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88052749

Now we have intermittent failures w/ @Displax modded USNF builds also:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88103103

And note what I posted just above:

👀 PW
[Android Software Development] ddrum2000:
Ok so what am I missing here. I cleared the storage for gpay, wallet, and play services, then rebooted. Here's what I got...

View attachment 5830633

My enabled modules

View attachment 5830637

Then the denylist...

View attachment 5830635

Then I try to add a card in wallet

View attachment 5830639

What am I missing? Thanks for the help.
[Android Software Development] Fishawy:
Not sure about the USNF module you're using, as I'm using Displax's fork.

I can't see Google Play Services in your DenyList. I would say this needs to be added, then clear storage for all, reboot and test.
[Android Software Development] pndwal:
Very suspicious USNF fork... Doesn't even credit @kdrag0n!? 😶 ... Dev doing their own thing at best...

And you seem to have missed my response to you 🙁 :

Yes?... No?...

Yes?... No?...

... Where did that go? Edit: Actually I mis-remembered this... Don't add this here, but you may need to clear Play Protect Service's data later to restore Play Protect Device is Certified in Play Store...

Where is Play Integrity check result?... G Pay/Wallet isn't called SafetyNet API anymore since it's depreciated...

So why the dubious USNF???

Have you checked these?... PW
[Android Software Development] pndwal:
DON'T do this ever with denylist enforced... With Shamiko USNF can function with that, but shouldn't be needed as USNF hides root from gms attestation/droidguard service/process itself...
[Android Software Development] Fishawy:
Always using Shamiko & "Enforce DenyList" disabled.

Is Shamiko alone enough without adding GMS to DenyList? I didn't know that.
[Android Software Development] ddrum2000:
Ok so:

I saw a post here referring to that module. I was using the original kdrag0n for years prior to changing it today. Which do you recommend moving forward?

prior to a few days ago and applying the most recent Pixel 6a OTA it worked great

I'm using the stock Pixel ROM except for rooting to run AdAway. No other additions or changes

I'm getting differing feedback about the denylist but I will include gpay, wallet, play protect but remove play services from the denylist. Is that correct?

How should I check the PI?

Denylist is enforced and zygisk is yes. Magisk app is in the app drawer. I don't have it on the home screen so I'm not quite sure what you are referring to here.

Thanks for the patience and the help.
[Android Software Development] Nergal di Cuthah:
Are you using any extra sources in adaway? Just for s**** and giggles try with the default hosts (no blocking) in adaway. Maybe one of the hosts sources is blocking something needed? Shot in the dark but maybe. I seem to have stable integerity with a similar setup (rooted for adaway no extra doodads, p6p) but dont google wallet/pay so I've kept quiet to this point
[Android Software Development] ddrum2000:
update: I figured out how to do a PI check. It passes basic but fails device and strong. What are the next steps?
[Android Software Development] ddrum2000:
Also i tired disabling Adaway, it doesn't change anything
[Android Software Development] pndwal:
Any @Displax modded build (since 2.4.0 needs fixing) as I said... Check what else was said about the other fork above... @Displax contributes to official USNF and provided the basic pull request for Play Integrity deviceIntegrity fix in official USNF... That should tell you something...

You may have been passing PI deviceIntegrity before that... I do with standard USNF, but with A11+ updates especially, many devices need extra prop changes to bypass PI API's hardware based verdict enforcement...

👍

Actually I edited my response above on this; please check again... Generally include Pay/Wallet and bank apps only...

Play Integrity API Checker... Pass deviceIntegrity, don't try to pass strongIntegrity...

👍

🤔... I said check/report:

... and you've now confirmed Zygisk = Yes appears on Magisk App home screen. 😜

Welcome... PW
[Android Software Development] pndwal:
Go through what I suggested... Install a Display USNF build... He has a post with 3 here... Clear Google Play Services and Google Play Protect Service data then reboot... Report PI check results... PW
[Android Software Development] ddrum2000:
I used his 2.4.0 selfbuild unless you are saying I should go back to 2.3.1? This is listed as by kdrag0n in the modules

denylist = gpay, wallet, play protect

I'm now failing safetynet CTS profile match

PI - pass basic, fails device and strong

I can't add a card in wallet