yashsingh1/xdaforums huggingface dataset:
[Android Software Development] pndwal:
Android running version shouldn't matter...

We shouldn't need to independently set props (eg globally w/ MHPC) for any device (there may be exceptions, but an issue should be raise in USNF GitHub to address/fix these) since USNF builds introduced fingerprint prop spoofing targeting gms to cause the mismatch needed to bypass Play Integrity API's hardware-backed verdict enforcement...

Nb. While this isn't actually needed for many devices, it is still applied to every device (gms targeting means there should be no issues such as device/OEM specific functionality incl. camera features, OEM app stores and back-up utilities)... Also, since the fingerprint used predates March 16th 2018 no security-patch prop spoofing to match fingerprint prop is required (which MHPC did in the background for fingerprint props since that date)...

The old A6 fingerprint prop used is necessarily mismatched with expected props for all devices with keymaster 3 compliant hardware-backed attestation (which is required for HKA) so it works for Play Integrity API hardware-backed verdict bypassing as mentioned above, but of course it is also chosen to pass S/N ctsProfileMatch and PI deviceIntegrity... This is why even custom, beta, developer, China region and other non-CTS/VTS compliant ROMs no longer need fingerprint or security patch prop spoofing set independently of USNF...

You screenshots show USNF is working as expected... If you have cleared data for Google Play Services, Google Play Protect service, Google Play store and bank app since passing PI deviceIntegrity, you can safely conclude that bank is using its own detection techniques over and above PO deviceIntegrity...

Shamiko and Hide My AppList can hide apps and the common traces of root/modification banks detect... Some also detect TWRP folder or Developer options / OEM Unlock...

If these measures falls there are still other options...

Yes, that's what custom ROM Devs do to add SNF natively as I explained in my post above this...

We cannot generally/easily alter /system in late stock ROMs (since A10) due to new shared-blocks Google architecture, dynamic / logical r/o partitions, dm-verity etc...This is another reason Magisk mask (overlays for system etc) has become an even more valuable tool...

Technically possible (for custom ROMs lacking SNF), but probably highly impractical due to the myriad ROM configurations/specifications...

And we can just choose from a vast array of ROMs (a few confirmed to do this below*) already integrating SNF!

🤠 PW

* various unofficial LOS

crDroid

riceDroid

PixelExperience

VoidUI

ConquerOS

pixeldust

Evolution-X

VoltageOS

xdroid-oss

Spark-Rom

PixelExtended

BlissRoms

Proton

elytraOS

DerpFest-AOSP

PixelBlaster

CrystalOS

tequilaOS

PixysOS

SuperiorOS

PalyrimOS

Pix-OS

CherishOS

FlexLineage

LessAOSP

Colt-Enigma

cygnus
[Android Software Development] huskydg:
anyone can test?

[New Idea] Bypass Safetynet by without having to depend on MAGISK · Issue #269 · kdrag0n/safetynet-fix

Maybe you didn't know, most banking apps prefer to detect Riru or Zygisk. No matter we try to hide it, or use closed source module like Shamiko, Zygisk will be detected again time by time. Most use...

github.com
[Android Software Development] shoey63:
Yep. Works on Magisk Alpha (and Delta I assume)

Zygisk off, Magisk Hide on, GMS unstable in Deny List.

Have to spoof a valid fingerprint on

LineageOS.

Edit: Sony Xperia xz2 running LOS 20 (Non Hardware backed attestation device)

Edit 2: Doesn't work on Pixel 6.

MEETS_BASIC_INTEGRITY only, even if you change the fingerprint to an earlier android version.
[Android Software Development] _litz:
Anyone got a solution that makes the US Citibank app work on latest/greatest for P7P?

YSNAC says pass, Play Store says certified, app refuses to run, says phone rooted.

Usual setup : latest stable Magisk, zygisk/denylist properly setup, USNF 2.30 mod 3.0, USNF 2.40 mod 1.2, and all variants in between ... same result.
[Android Software Development] Nergal di Cuthah:
Um there is no 2.0 i believe do you mean mod 1.2?

That said what are you denying? Are you using Magisk hide or shamiko(may have bungled the name)?

YASNC is pretty useless what does play integrity say?
[Android Software Development] _litz:
Yes, edited it. thanks for catching that.
[Android Software Development] Nergal di Cuthah:
See my edit also what magisk version
[Android Software Development] _litz:
25.2, latest stable version.
[Android Software Development] _litz:
No Shamiko, just normal Magisk DenyList. MagiskHide has not existed since replaced with DenyList.
[Android Software Development] Nergal di Cuthah:
Thanks that's what i mesn :) is citibank in the list? Whatelse is on the list. Did you clear cb data after setting up deny and mod 1.2?
[Android Software Development] _litz:
yes, yes, yes ,and yes. cb is, yes, in the list. It doesn't matter what else is, either; have wiped all settings and tried JUST the core entries (ps, etc) + cb. No go.

In your mind, what exactly should be bare minimum of denylist entries be? Maybe I missed one.

Also, FWIW, the Play Integrity check within Play Store does report both Basic/Device are PASS, as expected.
[Android Software Development] Nergal di Cuthah:
Naw I'm mostly drawing information out that would be useful, for someone with knowledge, that was left off your original query.

Also are you hiding (or even freezing) magisk manager? And do you have adaway
[Android Software Development] _litz:
Yes (hiding not freezing), and yes, + systemless hosts enabled (for adaway)
[Android Software Development] pndwal:
For those using Canary builds

Please be aware that in 25207+ major refactoring (of selinux rule patching) has broken many modules etc... This is likely the cause of issues with hiding using recent builds as Shamiko is affected... Please see discussion in Magisk Discussion thread...

You could revert to 25206 or wait for fixes hopefully in 25211... 👀 PW
[Android Software Development] Nergal di Cuthah:
Seemgly this includes the inbuilt systemless hosts though only since today's canary, it worked with 25209. I'll see if i can stand the ads the few days til 25211, but i may roll all the way back to 25206 (bleh ;) )

Edit

Went back to 25209, not as scary as i thought it would be, had the installer for it in my downloads
[Android Software Development] pndwal:
Modules incl. Shamiko have had functionality affected since refactoring in 25207, but it got worse w/ neglected mkdir in Make Private... 25210 commit... Fixes are still currently being generated... 🙃 PW
[Android Software Development] huskydg:
Try https://github.com/huskydg/magiskhide, and zygisk must be turned off
[Android Software Development] creeve4:
Thank you for sharing. How does this compare with Shamiko?
[Android Software Development] zgfg:
That's for official Magisk (not Delta) and instead of DenyList - please open the link and read instructions

And you shall not run Shamiko with that - but you should not need Shamiko then

Btw, it's easy to test - install MagiskHide, disable Shamiko, teboit and test

If you want to go back - disable MagiskHide module, enable Shamiko, reboot and test

The module reads DenyList - hence put all your banking apps to DenyList
[Android Software Development] _litz:
Where do things stand with this project and banking apps (with zygisk off) vs google play store/pay (with zygisk on)?

Is this a setup where magick/root are hidden from all?
[Android Software Development] Nt8x:
Hello

Anyone test with Redmi Note 11 Pro 5G (pissarro) ? I cant pass Device certificated to use GPay. Please help

Phone: Redmi Note 11 Pro 5G (pissarro)

Stock Rom: China

Current Rom: Taiwan

Unlock bootloader
[Android Software Development] sas46:
I'm still getting error with wallet, passes safetynet but can't pay

Magisk 25200, Pixel 6 Pro with latest stable A13

MagiskHide and latest Universalsafetyfix module
[Android Software Development] simplepinoi177:
you might want to check out Post #3223, for Pixel 6 & Pixel 7 particularly, that mod works out real well...

And of course the obligatory clear cache & data of Google Play Protect, Google Framework, Google Play Services, Wallet, Gpay -- be aware this will remove cards if you have them entered in Wallet and you will merely have to re-add them -- all these apps' ticks in their respective sub-menu is ticked in Zygisk DenyList, and be sure to restart (personal experience; I did all that and couldn't add card, but after restart I could). Also, I passed safetynet and successfully added card, but had to call the banks on two cards to get it working without error at a store...
[Android Software Development] sas46:
Thanks for the reply

Deleting Wallet and Play services will cause a loss of all my cards and email account logged, am I right? 😔
[Android Software Development] simplepinoi177:
Unfortunately, yes it will require you to re-register your cards; but your email account will not be logged out. When I did it on my Pixel 7 Pro, it might ask you to log back in for "Backup" (maybe has to do with Google One or whatever the OS uses for the Sync/Backup), but that was the only thing. You don't have to delete wallet, just clearing data would be enough.

If you don't want to re-register your cards, then I suggest attempting to hide root with Shamiko (another member suggested using Magisk Delta as an alternative as well)...
[Android Software Development] sas46:
It works as you first described

Magisk Hide+SafetyNetFix Mod, no zygisk or shamiko, no enforce deny list

Denied wallet+play services+framework+protect, deleted all datas and reboot

Wallet works and no root detected, thanks!!
[Android Software Development] pippoparecchio:
Hi all, I would like to know if someone of you managed to pass the g-wallet test with a pixel 7 pro + linageos?
[Android Software Development] simplepinoi177:
I'm happy to hear! I'm very glad to have been helpful...although, for me, I still enforce deny list on all those things with all sub-selections ticked, just in case and to nip things in the bud for potential future issues...

I can't be sure with your response (as it works in no warnings or works in a shop), but be sure to test it out at a shop/store as, for whatever reason, my experience was that everything loaded up fine without any warning or issue (from Wallet or the bank), and yet when I went to pay, it didn't go through, was sent a fraud alert, and had to straighten it out with my bank to "authorize" the use of Wallet/NFC payments.

Point is; be sure to try it out at a shop/store before assuming it works 100%. (y)
[Android Software Development] aang741:
Safety net works but i have a bank app called lulo bank (colombia) which detects the root and shows that there is a vulnerability in the device.
[Android Software Development] Dark Obsessions:
deleted
[Android Software Development] Nergal di Cuthah:
What's in your deny list? are you running shamiko? What other mods are you using? Lsposed or no?

What's N26. Are you using the same bank app as @aang741
[Android Software Development] aang741:
Hi I am using only magisk delta + Universal safey net 2.4.0 mod 1.2 + Magisk hide, is the only banking app that can not pass the root as the others if they pass it even play store passes it normally.
[Android Software Development] sas46:
Works with no issue without enforcing 💪
[Android Software Development] herrlegno:
I have a weird behaviour, I can't make one specific app work but others that do safetynet verification work. Here is more information about my setup:

Device: Redmi Note 9 Pro (Global) -> joyeuse

OS: Lineage OS v19-20230310-NIGHTLY-miatoll

Magisk Delta with:

Zygisk

Bootloop Protection

MagiskHide

Enforce SuList

Magisk Modules:

MagiskHide Props Config (v6.1.2-v137)

SafetyNet sensitive props (v3)

Shamiko (v0.6-126)

Systemless hosts

Universal SafetyNet Fix (v2.4.0)

This allows me to pass some apps, but this one doesn't: "CaixaBank Sign". I'll attach the SafetyNet Checker results.
[Android Software Development] zgfg:
(Banking) apps test much more than Play Integrity - and what and how it varies (and they don't disclose)

Have you tried without Shamiko - generally, avoid Shamiko when running Magisk Delta

Maybe also without MHPC

And instead of this 'official' USNF, use the fork safetynet-fix-v2.4.0-MOD_1.2 (separate thread on XDA, it was noted here in the earlier posts, you can also find on GitHub)

GitHub - Displax/safetynet-fix: SafetyNet & Play Integrity API workarounds for Magisk

SafetyNet & Play Integrity API workarounds for Magisk - Displax/safetynet-fix

github.com
[Android Software Development] herrlegno:
I tried what you told me, but no luck so far :(
[Android Software Development] zgfg:
Came this far - I have no acc to continue

Xiaomi, A12 (MIUI, not LOS)

Magisk Delta with Zygisk and DenyList

And Hide My Applist (HMA) also in whitelist node
[Android Software Development] herrlegno:
That is more than I can get into. Can you provide me the link to the HMA module?
[Android Software Development] zgfg:
Guide:

GitHub - adrianmmiller/Hide-My-Applist-Guide: A brief guide to using Hide My Applist

A brief guide to using Hide My Applist. Contribute to adrianmmiller/Hide-My-Applist-Guide development by creating an account on GitHub.

github.com

But find also a thread on XDA and read last days posts about whitelist mode
[Android Software Development] Lpedraja2002:
Thank you so much! I have been trying for days to get the Citi bank app running and have tried numerous methods from deny list, creating guest profile, freezing Magisk, Hiding Magisk, Shamiko etc.

I just deleted the stupid TWRP folder from my internal storage, cleared app cache for Citi and the root message did not popup!

I was able to setup the app with Fingerprint as well which I was unable to do before!

I still need to confirm if I can pay off my credit card from the app, which I was unable to do before because of root.

But so far I'm on Version 9.59.1 which is the latest from March 9, 2023 and everything is working fine.
[Android Software Development] ThiagoXRS:
Tried on my moto G7 play Android 10 stockrom and it make the system to crash. This moto had a weird A/B partition that makes everything difficult. Anyone has any idea how to solve this problem?
[Android Software Development] metafaniel:
I tried to follow this guide but I failed to meet one of the prerequisites. I'm not able to install LSPosed because it's not available for Android 7.1 =(

Any ideas on what should I try next to bypass SafetyNet and be able to use my banking apps?

I've got Android 7.1, LineageOS 14.1, Magisk 25.2, Universal SafetyNet Fix 2.4.0 and MEETS_STRONG_INTEGRITY (fail).

Thanks in advance for any advise.
[Android Software Development] Nergal di Cuthah:
Will always fail on bootloader unlocked

Did you try displax's usnf 2.4.0 mod 1.2?
[Android Software Development] pndwal:
Modded USNF probably won't help*... Core fallback and API hardware-backed verdict enforcement bypass triggers aren't needed since device is pre-keymaster 3...

* Unless official USNF issues include breaking targeted fingerprint prop spoofing (which is doubtful) and it's needed (eg user's LOS build doesn't spoof fingerprint already)...

Assuming member/device has deviceIntegrity, USNF is working by simply hiding root from attestation/droidguard gms (com.google.android.gms.unstable), spoofing a passing fingerprint prop (fingerprint mismatch isn't needed) in gms needed for many custom ROMs and adding back MagiskHide sensitive prop resets...

👀 PW
[Android Software Development] zgfg:
To be precise, MEETS _STRONG_INTEGRITY is not part of deprecated SafetyNet API, but Play Integrity API

HMA and LSPosed have nothing to do with passing the old SafetyNet or the new Play Integrity API

Also, no banking or similar known app so far requires MEETS _STRONG_INTEGRITY.

We all here (with our Bootloaders unlocked) live with only MEETS _BASIC_INTEGRITY and MEETS _DEVICE_INTEGRITY passing.

See the screenshot

And the guide you mention https://github.com/adrianmmiller/Hide-My-Applist-Guide

does not claim;:

- that LSPosed and/or HMA would help you to pass Play Integrity API

- how to pass MEETS _STRONG_INTEGRITY

---

I have A11 and A12 phones hence sorry, cannot help you to find modules for A7

But generally, if you pass MEETS _BASIC_INTEGRITY and MEETS _DEVICE_INTEGRITY, you are good with Play Integrity API (and again, that's about Play Integrity API checking, not the deprecated SafetyNet API checking)

However, then comes the other part - 'banking' and similar apps do not test only Play Integrity API. They seek for other indications that you maybe have unlocked BL, that you don't run stock ROM, that you have Magisk, that you have root apps

HMA is only to help for one part of that - to hide root apps, like Magisk app and LSPosed modules apps - but since you don't have LSPosed, you don't have either the LSPosed modules apps to hide, only the Magisk app to hide

And again, sorry, I don't know the alternative for LSPosed for A7 - maybe the post right below may partially help you - try to follow:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88286385
[Android Software Development] pndwal:
If you have PI deviceIntegrity you have requisite S/N and PI passes as noted by others above...

Assume you have bank apps in denylist...

I'm not 100% sure Shamiko hiding module works with Android that early (suspect it will if you have Zygisk), but substituting that for denylist (keep bank apps in denylist but deselect enforcement) helps with many apps...

Some apps check for developer options like OEM unlocking, USB debugging etc...

If apps are abusing lax Google policy designed to prevent detection of other apps (too easy to bypass) Hide My Applist may help... GitHub doesn't mention Android version required... You may be able to use that will one of several legacy XPosed frameworks (incl. systemless), but be aware that many of these break device integrity attestations... There may also be other issues with this...

What is your device?... It may be best just to find custom ROM building later Android...

🤠 PW
[Android Software Development] ctcx:
Hello.

Already posted in the Magisk general support thread, but since I'm also using this module, I wanted to be a bit more sure.

BTW, downloaded and installed module from here: https://github.com/kdrag0n/safetynet-fix/releases/tag/v2.4.0

device is ocean (Moto) with LOS 20 ROM; using latest Magisk 25.2.

Infamous banking app finally ran and began registration stuff. But the app is unable to scan the needed qr code: the "screen" is just complete black instead of the camera looking for qr code. There are no covers at all in both back and front cameras; completely black square and no signal of movement at all.

Could this be related to USNF module?
[Android Software Development] simplepinoi177:
quick troubleshooting step -- have you tried disabling the module and running the qr code scan? or even attempting it unrooted?

if (at least) the qr code scan works without either/or, then it would obviously be the root cause (pardon the pun, couldn't help myself 🤪)...
[Android Software Development] anatoly1983:
Hi there. Can anybody help me?

After last google services update, google pay is stoped to work.

I have official magisk 25.2 installed with:

-USNF 2.4.0

-Shamiko 0.6.0

Tried magisk delta, but it didn't help me.

What can you advise me?
[Android Software Development] zgfg:
For the beginning see many previous posts - why people move to the fork safetynet-fix-v2.4.0-MOD_1.2.zip and try instead
[Android Software Development] anatoly1983:
I tried USNF mod, bui didn't help me. (
[Android Software Development] MatMew:
Using Pixel 6 here, rooted on Android 13 with Magisk via PixelFlasher and the latest safetynet fix Magisk module still leaves banking apps detecting root, and safety net checker app saying CTS profile match fail.
[Android Software Development] pndwal:
But you need @Displax USNF fork, not official as it's broken ATM... From here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88149057

And use Play Integrity API Checker to see you have deviceIntegrity (you won't get or need strongIntegrity)...

🤠 PW
[Android Software Development] pndwal:
Same as above... And if deviceIntegrity doesn't pass, try with all modules disabled except modded USNF...

Nb. SafetyNet API is deprecated now and most banks have moved on to Play Integrity API... Modders need to keep up too... 😁 PW
[Android Software Development] MatMew:
Thank you. Trying this now. I don't have any other modules installed, Not sure what Nb means, but I think it worked.

Thanks again boss.
[Android Software Development] anatoly1983:
I tried. It didn't help me.
[Android Software Development] pndwal:
Give some information then... What device? ROM? Android version? YASNAC results? Play Integrity API Checker results? What's in denylist?... PW
[Android Software Development] anatoly1983:
Device: Realme GT2 pro (RMX 3301)

Android 13 (Realme UI 4.0 version - c13)
[Android Software Development] zgfg:
NB = Nota bene (Latin), like Take a note

Our friend is not just a techie😁
[Android Software Development] anatoly1983:
My friend, maybe I found solution. I installed magisk hide props module and set all props to active, reset services and now google pay is working well. Now i will test it for some time.

Thank you for your help and answers.
[Android Software Development] pndwal:
You shouldn't need MHPC... May have needed G Play Services data wipe... shouldn't have any gms processes in denylist... Need Zygisk=yes in Magisk App... Don't change selinux to permissive...

Please say if you ran other mods (eg TWRP flashable .zips... PW
[Android Software Development] simplepinoi177:
From your screenshots, it doesn't look like all the selections in the sub-selection/drop-down are ticked...you need every single one of them to be ticked...

But you really need to pass everything other than "STRONG_INTEGRITY" if you want any hope of getting Wallet or other (especially Google based) apps to work while rooted...

Also, you should really recheck if Displax's USNF-MOD 1.2 is properly installed and working as, usually, the mod in itself is usually enough...

Also you can do (or re-do, as it were) what I stated below; it seemed to work for sas46...
[Android Software Development] anatoly1983:
Thank you my friend, I solved my problem with magisk hide props module. If i tick all of drop-down in google services, wallet stops to work, even with USNF-mod. So I can do well only with mhp module.
[Android Software Development] pndwal:
USNF hides attestation/droidguard (com.google.android.gms.unstable) gms (Play Services) process itself since Denylist breaks USNF's key functions, especially the injection of code in gms to register a fake keystore and cause the fallback to basic attestation... That's why if you add this to denylist it will kill USNF (deviceIntegrity will be failing) if Denylist is enforced until next boot when USNF will actually remove it from denylist for you!...

With Zygisk based USNF, simply don't add any gms (Google Play Services) processes to Denylist... PW
[Android Software Development] Ingenium13:
I'm starting to fail CTS as of a couple days ago. It will intermittently pass, but if I open Google Wallet then I get a notice about not meeting the requirements, and it will fail for a while. Play Integrity Checker will also cause it to fail consistently, but YASNAC sometimes passes, sometimes fails.
[Android Software Development] pndwal:
https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88335083
[Android Software Development] Daifex:
Hello herrlegno

Have you found any working solution for Caixabank Sign ?

I have Xiaomi Mi android 13 with opened bootloader, when rooted Cbk sign don't works, not mater any magisk tweak I've tried. I unrooted (not locking bootloader) and Cbk sign works.
[Android Software Development] herrlegno:
No, the only solution i found was to change rom. I'm with pixel experience now. Without magisk but with bootloader unlocked.