yashsingh1/xdaforums huggingface dataset:
[Android Software Development] ipdev:
That is correct if you you have the Magisk DenyList Enforcing. 🙃

kdrag0n - safetynet-fix - [GitHub] - commit​

When Enforcing, Magisk is disabled and restores as much as possible while the processes on the denylist are called.

If you add any one part of "Google Mobile Services" (com.google.android.gms) to the denylist, Magisk will revert all changes possible when the process is called.

In other words, the Zygisk part of this module will not be active while GMS is called.​

I will let pndwal explain it more since he better at explaining things than I am. 😊

Over to you @pndwal. 😁

If you are not Enforcing the denylist, then this is an issue. :unsure:

Cheers. :cowboy:
[Android Software Development] roberto_1986:
Hmmm im confuse....

So how to enforce it? also i need to hide all from google play services???
[Android Software Development] ipdev:
Bit OT for this thread but. 🙃

Besides renaming the Magisk app and using the SafetyNet Fix module.

Personally I use the following modules and app.

GitHub Release Links:

LSPosed | Shamiko | Hide My Applist​

Normally I do not have to add GMS to the denylist, only the apps I need to hide Magisk from.

Unless it is a device that does not support hardware attestation.

Even then, only when I am enforcing the denylist and not using this module and/or Shamiko for hiding.​

Cheers. :cowboy:

PS.

See 73sydney's thread on how to configure/setup HMA.

Hide My Applist - A Brief Guide
[Android Software Development] pndwal:
I think you may have been confused already...

You don't want Hardware backed Evaluation type in S/N API!... USNF is for triggering a fallback to Basic Evaluation type, and also to allow S/N (depreciated) and new Play Integrity APIs to use the Basic attestations where Google otherwise only allows CTS Profile and deviceIntegrity verdicts to pass using Hardware backed evaluations because they deem such devices Hardware backed Evaluation type capable on the basis of device properties...

So you should now be checking Play Integrity deviceIntegrity verdict as most Banks have now migrated to this and must do so by June... Use Play Integrity API checker... Nb. You can't pass strongIntegrity on your modded device!...

Further, Zygisk based USNF does it's own hiding of root from the Droidguard gms (attestation) process as stated; simply DON'T put gms processes in denylist or USNF will remove it on next boot to prevent breaking USNF due to denylist blocking Zygisk injection / Magisk modifications in gms... Nb, proper hiding (eg old hidelist) doesn't behave like this, so the commit linked by @ipdev that allows gms attestation process to remain in denylist if using Shamiko (proper root hiding) doesn't seem to adversely affect USNF, however it is still unnecessary to add yourself and I wouldn't recommend it as it will simply mean you will be double-hiding as both USNF and Shamiko will be competing to hide root from gms...

🤠 PW
[Android Software Development] pndwal:
The OP still contains confusing information which reflects what is on @kdrag0n's GitHub (despite recent revision) regarding need for passing CTS Profile match incl. need to set a fingerprint independently for some devices, and even regarding @Didgeridoohan's MHPC module only working w/ Magisk 23 and earlier...

I put a comment that may clarify these things here:

https://github.com/kdrag0n/safetynet-fix/pull/235#issuecomment-1378288343

Please watch the GitHub description

https://github.com/kdrag0n/safetynet-fix#universal-safetynet-fix

for changes as I'm guessing you may need to update the OP here manually again... Might pay to wait for official confirmation on GitHub however... 👍 PW
[Android Software Development] rodken:
I took note of the module(s) and apps(s) that you are utilizing to pass SafetyNet.

-- I also noticed that MHPC is not on your list of go-to modules.
[Android Software Development] roberto_1986:
@ipdev @pndwal ok ty for your answers even im still confuse yet^^
[Android Software Development] rodken:
You might be surprised at what you discover once you plug in the term Google Play Services within Search This Thread.
[Android Software Development] shoey63:
No need for confusion. If you have USNF you leave Google Play services/wallet alone in deny list and all will be well.
[Android Software Development] pndwal:
🤔... 🙃... Sorry, meaning put them in?...

Users should leave Google Play Services out, put GPay/Wallet in!... PW
[Android Software Development] rodken:
OnePlus devices can leave both out.
[Android Software Development] shoey63:
As in leave BOTH out. Don't add them. Leave them alone 😉
[Android Software Development] neorean:
I'm using 2.4.0 on a OnePlus 5T running LOS 20 (A13) with MicroG, my banking app still detects root (it is in the DenyList in Magisk with Enforce DenyList on).

YASNAC returns CTS profile match Fail and Play Integrity API Checker gives an error:

"Error getting token from Google.

Binding to the service in the Play Store has failed."

Am I doing something wrong here?

EDIT: Tried taking everything out of the DenyList, all that accomplished was making it so the apps that were working are now detecting root and not working.

EDIT 2: I am not using MagiskHide Props Config as it was mentioned in the previously linked comments on GitHub that it isn't necessary to pass CTS profile match with latest USFN.
[Android Software Development] otonieru:
Turn off enforce and install Shamiko.
[Android Software Development] Displax:
Not all modules trigger this, as I saw. But there may be surprises, like even module with GPU drivers trigger this... o_O
[Android Software Development] osm0sis:
Thanks! Working so far with my usual modules! 🙌🤞
[Android Software Development] neorean:
Doing so results in no change in outcome, still failing CTS profile match and my banking app detects root.

Thank you for the suggestion though, appreciated.
[Android Software Development] mrjuniork:
Thx for the heads-up, appreciate it.

And I'd also appreciate it if you could keep me in the loop for any further adaptions and upcoming changes which could or should be reflected in the OP 👍
[Android Software Development] pndwal:
Will do, as I become aware...

Re. the issue mentioned, I intend to open a fresh issue ticket there if @kdrag0n hasn't responded in a few days... 👍 PW
[Android Software Development] Nekromantik:
sorry i looked through few pages and dont understand

so I got Pixel 7 Pro and installed new version of USNF and have to also use DenyList Unmount also for bank app but currently I cant use Google Pay. I cannot add any cards to my wallet. Previously I use the MOD version.

Do I still need to use MOD version?

I got no GMS service in denylist and hidden magisk app and called it something else

Not enforcing denylist as with denylist unmount you need to leave enforce off
[Android Software Development] pndwal:
Don't use mod[ed] version [of GPay/Wallet]... Don't use old SQLite fix etc. either... GPay/Wallet will appear in Play Store w/ PI deviceIntegrity passing...

I have GPay/Wallet in denylist w/ Shamiko, but Shamiko isn't actually needed for GPay/Wallet... I believe denylist is enough, so guessing DenyList Unmount should work also...

Once root is hidden and deviceIntegrity is passing, you may need to clear GPay/Wallet data and allow app to update again... You'll need to set up your cards again also...

Nb. Be sure to reboot before first running app to avoid issues like Activity list failure to populate persisting. (Data clearing without reboot breaks GPay/Wallet app updates)...

😀 PW
[Android Software Development] Nekromantik:
Will try that next but I had to go back to MOD version and it worked right away.

Over weekend I will remove MOD and then try latest again

thanks
[Android Software Development] wrongway213:
This is what I keep finding, the MOD-2.1 just works, immediately. I see no reason to move to the stable version until I can say the same for it.
[Android Software Development] 73sydney:
And i was just about to have a nice relaxing sleep, but now i cant

Because you mentioned it

IT....

Im triggered by even the mention of that thing, im sure i have a facial tick that goes off when i see it mentioned

Meanwhile....8 months and counting since ive had Pay/Wallet in the Deny List personally
[Android Software Development] pndwal:
Sorry, I completely misunderstood this... Thought you said you had a modded version of GPay/Wallet! 🤪...

... I would actually have suggested you move back to @Displax USNF modded fork until issues with official are fixed if I hadn't read this literally. 😜 ...So don't change anything for now!

I mentioned the issues here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87960043

... The reverted update commit was reverted again (so update is available) but it's still the same version; the patchset commit has not been applied and is slated for Next Release... There may be more fixes needed too...

🙃 PW
[Android Software Development] pndwal:
Yup, you got the rightway @wrongway213... I posted again above... PW
[Android Software Development] Nekromantik:
ah haha no problems :)

will keep MOD version until I see new version released.
[Android Software Development] m0han:
I found this. It removed the 'Debug Environment' detection I had in m0m0.😄

Edit

: Did more harm than good (no malice meant). GPay does not work. After disabling and rebooting, GPay works.

Note

: Screenshot added is not for showcasing Momo.
[Android Software Development] kaefers:
Hi!

> S22 Ultra 908B, latest A13, Magisk w/ Shamiko, USNF 2.4.0, LSPosed, Zygisk, DenyList disabled for Shamiko.

> In Magisk DenyList, ALL apps are ticked FULLY, incl YASNAC and (optionally) XPrivacyLUA.

> One module in LSPosed only: XPrivacyLUA, every box ticked except for Google Play Services.

> Successfully passing YASNAC SafetyNet test (Pass, Pass, BASIC).

Issue:

SafetyNet fails when selecting Google Play Services within LSPosed, e.g. for XPrivacyLUA.

Without selecting Google Play Services for XPrivacyLUA within LSPosed, XPrivacyLUA does not restrict Google Play Services (like spoofing Values or for permission restrictions). Fairly certain this was not an issue in the recent past, i.e. restricting Google Play Services within LSPosed and still passing SafetyNet.

I am not sure what I could try next. Not being able to restrict Google Play Services at will is a major drawback for me. Hoping I missed something ?!
[Android Software Development] 73sydney:
Please tell us when you say ALL apps, you dont literally mean ALL apps, because if you do, your 1st job is to untick ALL apps, and only select the core apps that need to be hidden (as best as possible) from root, like a sane person. These include any banking apps, and google pay/wallet (and even thats not entirely necessary for most people - mine is nearing 9 months unhidden and working every day ending in Y), and any detection apps, such as this, which is a good detection app (useful for seeing whats failing):

Releases · byxiaorun/Ruru

An android sample app of detecting suspicious apps like magisk manager - byxiaorun/Ruru

github.com

YASNAC is not enough any longer, you need to also pass Integrity Check, with this:

Play Integrity API Checker - Apps on Google Play

Get info about your Device Integrity through the Play Intergrity API

play.google.com

If you fail to pass this (after having first removed ALL apps but the critical apps as above), then put device in airplane mode, clear data for Google Play Services, and Google Play Store, reboot, and toggle airplane mode back off, wait 5 minutes and recheck integrity check
[Android Software Development] kaefers:
Thanks for your reply!

Magisk DenyList

I just unticked all apps within Magisk DenyList except for: Google Wallet, one banking app, YASNAC, Ruru, Play Integrity API Checker. | Didn't make any difference as such vs everything ticked.

XPrivacyLUA (or any other module) within LSPosed

The only thing that does seem to make a difference is whether or not I have Google Play Services ticked (within XPrivacyLUA) within LSPosed.

- Ticked => I can spoof Values & restrict for Google Play Services, but Google Wallet security warning

- Unticked => XPrivacyLUA doesn't work on Google Play Services, but Google Wallet works

Ruru

- Abnormal Environment | XPrivacyLUA and TWRP

- XPosed Modules | XPrivacyLUA (and 3C All-In-One Toolbox, optional)

- Magisk App | still finds the "hidden" Magisk

- Setting Props | Dev Mode and Debugging enabled

[ The above seems to be good enough for my banking app and Google wallet]

[ That's with Google Play Services unticked (within XPrivacyLUA) within LSPosed; with Google Play Services ticked there are a lot more issues ]

Play Integrity API Checker

OK for Device Integrity & Basic Integrity

Fail for Strong Integrity

[ That's with Google Play Services unticked (within XPrivacyLUA) within LSPosed; with Google Play Services ticked I get ALL Fails ]

---

I could now go ahead and untick everything (within XPrivacyLUA) within LSPosed but then I might as well uninstall XPrivacyLUA. I have had that app for nearly a decade since the original XPrivacy, to restrict random permission requests like Camera and Mic and spoof Values, just because I could. If this doesn't work anymore that'd be a shame.

N.B. I tried all of the above with and without 3C Toolbox installed. Fwiw - within LSPosed - I can untick Google Play Services with XPrivacyLUA and do tick it within 3C Toolbox, and it also breaks SafetyNet and the other checker.

Not being able to 'hook' Google Play Services at all anywhere within LSPosed without breaking SafetyNet is new to me ...

Thanks again :)

EDIT:

I guess this particular issue isn't all that new after all, I have probably just been living under a rock with my old device... I really wonder if there is any solution to this or if things like XPrivacyLUA have been defeated by SafetyNet et al after all... :/

Exactly what I am talking about..

https://www.reddit.com/r/androidroot/comments/lw26hd/_/gpt1msz
[Android Software Development] zgfg:
SafetyNet and Play Integrity Checker do not need (better should not be) ticked in DenyList

They only call Google Play Services (aka GMS) and for GMS the USNF module should take care

However, for detections by eg Ruru, you will need to use Hide My Apps (LSPosed module) - there is another thread with instructions:

Hide My Applist - A Brief Guide

Hide My Applist Guide Hide My Applist is a LSPosed module by Dr-TSNG (nullptr). Often referred to as HMA. In the simplest terms HMA aims to stop one app detecting a list of other installed apps. - It can often help stop your banking app(s) from...

xdaforums.com

You cannot pass Strong Integrity with the unlocked Bootloader (possible only on some devices with broken Keystone) but Wallet and other apps when they call Play Integrity, they are happy with Basic and Device Integrity.

There is also another thread with more tech details and discussions:

https://xdaforums.com/t/discussion-play-integrity-api.4479337/
[Android Software Development] kaefers:
Alright, thanks for this! I will follow those two points and see how far I can get. ✌

Android isn't what it used to be either...
[Android Software Development] 73sydney:
The good news:

You now have a "normal" base with unnecessary apps NOT selected (excepting XPrivacyLUA, which i have zero knowledge of) with the Integrity Check its normal to pass all but Strong with unlocked bootloader

Ruru reports:

- Kinda normal for it to still find magisk, this can be very device dependent, it finds it, su and busybox on my Pixel 6 Pro for example, and no dramas at all

- TWRP...you may wish to rename the TWRP folder to avoid that triggering some detection in apps

- You can try hiding LSposed and XPrivacyLUA via Hide My Applist - my guide here (sanest thread on XDA :) ):

Hide My Applist - A Brief Guide

Hide My Applist Guide Hide My Applist is a LSPosed module by Dr-TSNG (nullptr). Often referred to as HMA. In the simplest terms HMA aims to stop one app detecting a list of other installed apps. - It can often help stop your banking app(s) from...

xdaforums.com

- Settings/Props...all okay

There IS such as thing as getting too granular with app permissions, just saying....ive been doing Android since the beginning and been more than happy with the permissions progression over time, especially in the last 3 versions. Theres enough control over camera, mic and location permissions i feel in A12/13, that additonal controls seem like a lot more work and adding complexity thats possibly not needed (personal opinion)
[Android Software Development] zgfg:
Just edited my previous post, providing the links to the mentioned XDA thread

You may also consider switching from 'official' Magisk to Magisk Delta fork - it supports Zygisk but with the 'old' (but improved and enhanced) MagiskHide (instead of DenyList).

It's even possible to use Riru (but without Zygisk):

[Discussion] Kitsune Mask - Another unofficial mask of Magisk

This is not an officially supported topjohnwu project. If you are looking for official Magisk source, please go to this page Introduction WARNING! You are using an unofficial version of Magisk that is not officially supported by the Magisk...

xdaforums.com

For some banking apps, you can pass only with Delta
[Android Software Development] kaefers:
"There IS such as thing as getting too granular with app permissions, just saying"

hahahaha challenge accepted ! :D

Admittedly, XPrivacy(LUA) is not something really anyone needs but I had it ever since my S3. It's pretty interesting to see what kind of apps ask for whatever 'unnecessary' permissions at random times that they're not being used actively, and that includes my personal favorite Google Play Services.

I appreciate the info, and will definitely try my luck with Hide My Applist, that's realistically all there is left to try, other than to accept defeat and give Google Play Services its permissions... :]

Technically, I could use an old phone for banking stuff and such but that's a bit tedious as well..

" Safe New World " ✌

--

Had been tinkering with Magisk alpha before but never Delta, will look into it, thank you again :)
[Android Software Development] 73sydney:
If youre one of those of us who switch ROMs often or even magisk forks, then i have a few magisk modules might save you some manual labour, reticking superuser entries and magiskhide/deny list entries, the first 4 modules listed in Post #2 in my modules thread here:

https://xdaforums.com/t/73sydneys-magisk-module-museum-of-madness.4533381/
[Android Software Development] kaefers:
Thanks for that! Not even switching particularly often (anymore) but making sure everything is as I like it to be before making whatever new device my daily driver.

I feel like you should tinker with XPrivacyLUA [time permitted, it can take loads of time] ;)
[Android Software Development] 73sydney:
yeah i got tired of manually reticking things in magiskhide/deny lists after very ROM flash (at one point i was testing 3-5 ROM's a week) so i 1st made those backup and restore modules, wasnt until recently someone asked me to make the superuser backup/restore ones - id been putting them off because they required a bit more work due to how the packagename is stored (UID is matched to packagename, packagename is stored and come restore time you then have to reverse match the packagename to its new UID ), and im terrifically lazy, but as i was asked a few days before xmas this past year, i decided to knock it out over a couple of days and get it up on xmas....

i did wonder why backup and restore of these wasnt natively built into the magisk app, but then i had submitted a feature request for the magisk app to stay on the module install tab after manually installing modules from storage - so you could bang through one install after the other (again i was testing 3-5 ROM's so i had all my magisk modules stored locally), and even with @osm0sis giving it a tick or 3 to promote and support, it still took over 9 months? to happen :)

So im guessing one day it will natively be available, not that ive seen or put in a feature request for it (worth it @osm0sis ?).

Things can get spicy in the magisk github (on the best of days)....

As for XPrivacyLUSA, between my personal views on permissions raking and being 52 this year and feeling like my life cup is not exactly feeling like its overflowing as it once was, i doubt i will tinker with it. Im actually getting a bit into Python, and just enough to be dangerous...but finding it quite efficient at doing things i usually traditionally cobbled together various gnuwin32 binaries to do under windows or used WSL to do
[Android Software Development] zgfg:
I usually archive (zip, by MiXPlorer) /data/adb - that's enough to restore the same version of Magisk with all modules and DB, and LSPosed modules - of course, boot.img must be patched and Magisk app must be installed manually

For Delta, little bit more is needed:

/data/adb/magisk is linked to /data/unencrypted/MAGISKBIN hence that folder must be archived, too

When switching from Magisk TJW to Delta and vice-versa, additional tricks are needed since eg magisk.db have somewhat different formats
[Android Software Development] 73sydney:
Well thats exactly why i first created the magiskhide/deny list backup and restore, because back then as you remember people be fooling with the magisk.db schema, during the Fork Wars - i dont miss the days of like 4 different forks :)

I stopped doing the /data/adb backup a long time back now, it went pear shaped just the once, but it was one time too many :)

Meanwhile for a bit of levity (lets see how this goes), just saw some kiddie ask for an ETA in a GSI channel on TG, and couldnt help myself

View attachment 5812765

Reminds me i need to update the Superuser Restore module as i finally got around to putting better/more sane error checking into the script for when the script hits a package name it cant match to a UID because the app isnt installed on the new install.....i mean its been done for about a week, i just havent gotten around to testing it..should be done this weekend. ive just been busy sticking my hands into ceiling voids full of spiders to trace cables and having too much fun doing that to test things....of course by the time the borescope i ordered gets here, i will of course have finished doing all the hands into spider holes stuff, because im the master of timing :) Did i mention i live in Australia where everything wants to kill you, especially spiders....worst time of year too
[Android Software Development] zgfg:
Yeah. It's also possible to use CLI commands in Terminal to list DenyList/MagiskHide, then save the output

Edit the saved list and execute as a script to fill the MagiskHide/DenyList (for restoring or switching from one to another)

---

And I couldn't resist about this one:

103-Year-Old Comic Describes What Would Happen If 'Pocket Telephones' Are Invented

Over 103 years ago, English cartoonist and caricaturist W. K. Haselden did a strip on 'pocket telephones'. It was published in The Daily Mirror on March 5, 1919.

www.sunnyskyz.com
[Android Software Development] m0han:
And if he does, I guess @73sydney would open a thread for that, like his HMA Guide thread.
[Android Software Development] zgfg:
With the standard 73sydney disclaimer😁
[Android Software Development] m0han:
.... that runs into paragraphs, if not pages. 😄
[Android Software Development] 73sydney:
I have literally NO idea where i got this reputation for writing long posts or guides

And to get us back on topic, (i realise this must seem like opposite world for me to say), but it looks like USNF 2.4.0 apart from the few noted font/overlay edge cases is looking stable for most folks?
[Android Software Development] m0han:
I'm a Riru user and this.....
[Android Software Development] kaefers:
I am a fan and appreciative of elaborate and detailed guides !
[Android Software Development] Fishawy:
@kaefers @73sydney

Elaborate: check.

Detailed: check.

Appreciative: check check check.