yashsingh1/xdaforums huggingface dataset:
[Android Software Development] pndwal:
I can't find 2.4.0 even on his GitHub... He lists v2.3.1-MOD_2.1 as latest!... Or check here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87198517

Have you got G Pay and Wallet appearing together?... Did you update G Pay to Wallet from Play Store or other?...

Take Play Protect service out as discussed...

Try above changes, then we may need to figure out fix for ctsProfileMatch and deviceIntegrity... PW
[Android Software Development] iwearthebelt:
Not sure if this will help or not but for the last couple of weeks Play Protect has been harassing me about uninstalling an app that I downloaded to play video on my car's infotainment center using android auto. Ever since I updated to the February release yesterday I haven't been able to use tap and pay and also I was failing device integrity. I uninstalled the app I was using (not by choice) and now I'm passing device integrity and can use tap and pay. I haven't rebooted since getting back device integrity and although I'm going to have to I'm pretty sure it should be fine. Just thought I'd provide this information hoping it will help you figure out your issue as well.
[Android Software Development] iwearthebelt:
BTW, you'll never pass strong integrity with a rooted device, no one can.
[Android Software Development] pndwal:
Some modules will break basicIntegrity and/or deviceIntegrity/old ctsProfileMatch... I don't recall apps doing that, but things change... Please say what app. 👍 PW
[Android Software Development] pndwal:
Asus ROG Phone 3 can pass strongIntegrity verdict rooted and unlocked, so some members can!... 😁

There are always exceptions. 😝

😃 PW
[Android Software Development] linus207:
So has anything changed in recent days? My pixel 6 pro after the February 2023 update said that it no longer meets MEETS_DEVICE_INTEGRITY and I can't restore it either with version 2.3.1 or 2.4.0.
[Android Software Development] crypticc:
Hi,

Similar to the chat above I used to pass safetynet and now do not. Google play and YASNTC both reports CTS profile match failure. Wallet etc don't work.

I'm this build of full stock Android... TQ1A.221205.011

I originally had this config:

Magisk latest app and root (25206)

Running in Zygote,

USNF 2.3.1_MOD 2.1

Shamiko 0.6 (126)

Enforce Deny list disabled (as per Shamiko instruction)

Deny list including :

Google Play Protect,

Google Play Services (I've tried both with and without this)

Google wallet

Banking and media apps

I tried updating to 2.4.0 before reading above suggestions that 2.3.1 might be better but clearing Data for above apps and then rebooting still didn't pass checks.

I've now gone back to 2.3.1_MOD 2.1, clear, reboot, clear, reboot etc. and still not working.

I've tried uninstalling updates to play protect and play store.

Finally I've since found app called com.android.systemui.globalactions.wallet but adding that doesn't do anything.

Any help appreciated,

Thanks,

Chris
[Android Software Development] shoey63:
Not anymore!

View attachment 5830841View attachment 5830843

View attachment 5830881

Had to go back to original fingerprint to get Yasnac to pass HARDWARE_BACKED attestation by disabling MHPC.

So . . .

- Fingerprint is original

- Bootloader appears locked even though it is unlocked (ROG 3 peculiarity)

- Shamiko is taking care of other sensitive props.

- GMS/GMS unstable is disabled in (hidden) deny list.

Can we conclude Google is picking up on attempts to hide other sensitive props?
[Android Software Development] seanho12345:
I'm currently on Pixel 7. My CTS profile match and DEVICE_INTEGRITY isn't working anymore. Tried a few time clearing GAPPS with v2.3.1-MOD2.1 installed. Here are my magisk setup.

For some context, I was fiddling around with the magisk mod yesterday after seeing the new integrity api. After installing the mod, DEVICE_INTEGRITY worked but inconsistent. (At this time, I have both the modded USNF and MHPC installed) Seeing that the changes will be offically released in the original USNF. I installed back v2.4.0 USNF. After that the SN and PI api check no longer works, except it worked one time and failing immediately afterwards.

Is there any possibilities that the MHPC somehow have left some old settings on my device? I also update my OS to the latest Feb patch but still no luck.
[Android Software Development] pndwal:
Haha! 😝 ... But your device / efforts keeps giving valuable clues!...

And I'm betting you'll restore strongIntegrity rooted because Root of trust still returns Device locked: true w/ Verified boot state: Verified...

This should be fine... You never needed the PI hardware-based verdict enforcement bypass that is mismatched fingerprint prop anyway. 😜... Were you changing it for some particular reason?

👍

Maybe... May need more now (and must figure out which)... Or MHPC may have handled sensitive props differently... Nb. MHPC does this by default, without configuring anything... So I'd try restoring MHPC w/o fingerprint changes...

If you only configured fingerprint, you could activate again and revert to stock print... Or if you made many MHPC changes, fully remove the module and reboot before installing and rebooting again w/o configuring anything... 'MagiskHide props' should be active by default to adjust sensitive props as needed...

You could also try disabling Shamiko (enforce denylist, but don't just deactivate Shamiko Zygisk parts this way, disable Shamiko module properly also before rebooting) after trying with MHPC in case Shamiko's sensitive prop adjustment method is the issue or part of it...

Also, sometimes clearing Play Services data is needed to fix some attestations... Do that too...

Please say/remind me of

- ROM (stock?),

- Android version,

- anything in denylist aside from 2 gms processes and banks + G Pay/Wallet?,

- all modules...

May think of other considerations later, but that's all I have for now... 🥴 PW
[Android Software Development] dingolino:
Hi,

are there some tips for the Amazon app to get it to work?

Best regards

dingolino
[Android Software Development] zgfg:
Maybe you are using AdAway and you have to disable in AdAway settings its Web server
[Android Software Development] dingolino:
Yes I am using adaway.

Could you tell/guide me a little more details how to make the settings in AdAway?

Best regards

dingolino
[Android Software Development] nowster:
If you're getting the sad dog screens in the Amazon app, you may need to disable any Adaway rules for amazon (both amazon.com and amazon.your.country and aws.a2z.com).

To do this, I had to clear AdAway's config, run it in VPN mode, DNS monitor what the Amazon app requested, enable that manually, export the config, clear the config, run in root mode, import the saved config.

One or more of the AdAway rule sets is blocking something in the ad. It'll probably be fixed in a few days when someone notices.

Maybe add something like this (change .co.uk to your country) to the allowed list:

aan.amazon.com

aan.amazon.co.uk
[Android Software Development] zgfg:
Did you pls try to spend a minute to look into the AdAway, it's really not a rocket science:

Preferences / Root base ad- blocker

uncheck (to disable) Enable web server

And for further questions about AdAway pls consult its corresponding AdAway thread on XDA
[Android Software Development] dr4go:
I'd like to create an Android 11 version of your patch - any hints? How did you create the diff? What toolchain did you use to create the non-patched build? I assume you created the diff by comparing the non-patched with the patched build and then applying it to Samsung's keystore file?
[Android Software Development] dingolino:
Ok, thank you both for the tips!

I disabled AdAway and Amazon app is working, now I can figure out the rest what I have to do to get it work.

I just did not had AdAway in my view that this is the root cause for my problem. The safety net fix was the last thing I was adding, therefore I thought this is causing the problem.

Thank you again and I will not spam this thread any longer with this topic

Best regards

dingolino
[Android Software Development] voetbalremco:
Works on Pocophone F1 with Xiaomi.eu 12.0.2.

Had to use the props config module to adjust it to 12.0.3.

Flashing from recovery caused a bootloop at first, flashing from Magisk manager was succesfull.

Basisintegrity and CtsProfile passed.
[Android Software Development] Deny.Kr:
Thank you, buddy. But don't you know why this file is for Magisk greyed out? It's not able to install it.. :(

Thank you.
[Android Software Development] grenskul:
Working on ulefone armor 7. With HTC U12+ props.
[Android Software Development] daddylonglegs:
Inside of edXposed, enable "pass safetynet option". The option should be third from the bottom or so.

BAM! Now with the Universal SafetyNet fix module, you can pass SafetyNet even with having edXposed/GravityBox enabled!
[Android Software Development] spiderjuka:
nampud - can you explain in detail how did you do it?

I have Galaxy S10 Android 9 - where I can find keystore at my phone? How I can patch it?

Thank you.
[Android Software Development] Marko_SK:
Can confirm v1.1.1 working on Sony Xperia XZ1 Compact, Android 9 with Magisk 20.4. SafetyNet ctsProfile started working right away, Google Pay worked after deleting cache and data for Google Pay, Google Play and Google Play Services. Fingerprint works okay in all apps.

Thanks for the great work, I'll surely donate something for a beer or coffee ;-)

EDIT: Donation sent ;-)
[Android Software Development] j1gga84:
Just whitelist *amazon* in Ad Away and the app is working again without any issues.

Regards
[Android Software Development] fr3d0x:
thanks, it woriks for mi 9t
[Android Software Development] nomisunrider:
Not working for dosh nor blind on pixel 3xl
[Android Software Development] Philnicolls89:
Confirmed working on s10+ many thanks😁

Its something to do with the file name, just rename it to whatever you like, such as 'samsungfix.zip' and then magisk manager should let you flash it.
[Android Software Development] AddYX11:
v 1.1.1 worked on my Poco F1 Evolution X 4.7 (Android 10)+ NGK
[Android Software Development] doclucas:
The original keystore file is /bin/keystore

Hopefully @nampud can share with us how to do the binary patching and replace it inside the magisk module ourselves.

It's also being discussed here: https://github.com/kdrag0n/safetynet-fix/issues/6
[Android Software Development] Slim2none4u:
Working on mine just fine. Check your set up.
[Android Software Development] iwearthebelt:
The app is called Screen2Auto
[Android Software Development] iwearthebelt:
Did not know that you can pass strong integrity with a unlocked bootloader. Last I heard, once you unlock the bootloader, strong integrity cannot be passed.
[Android Software Development] pndwal:
Generally that's correct.

... Unless the AVB root/chain of trust is messed up by the OEM!... Nb. ROG phone 3 always returns

- Verified boot state: Verified and

- Device locked: true ...

And this is not just broken keymaster implementation like on so many OnePlus devices ... Seems keymaster is fine so hardware-backed Device locked = true checks out!.. 🤪 PW
[Android Software Development] pndwal:
Folks, looks to me like Google is upping the anti for late-ish devices/OS's by somehow preventing ctsProfileMatch from passing with mismatched fingerprints now...Of course PI deviceIntegrity depends on this and thus fails also...

On the other hand, Google still seem to be flipping switches / experimenting, and there are a number of reports that even users of stock phones are having similar failures (Play Protect: Device not certified, G Pay/Wallet suddenly not meeting Security requirements etc) popping up recently on Reddit etc...

Seems for those modders affected, ctsProfileMatch still passes when matching fingerprint prop is used, but w/o the mismatch PI deviceIntegrity doesn't pass any longer...

The strategy for Google now seems to be to come up with ways to enforce hardware-backed verdicts on a per device basis that can't easily be bypassed...

I'm hoping someone will discover a new way to bypass PI API hardware-backed verdict enforcement for devices Google identifies as hardware-ready using fingerprint prop...

May need the best minds on this, and it may get difficult while the Google plays games we aren't expecting... but it wouldn't be the first time!...

Who wants to play🐈&🐁?

😁PW
[Android Software Development] Nekromantik:
I not tried paying using my phone yet but on Pixel 7 Pro Stock Feb ROM using Magisk 25.02 with Disaplex USNF MOD 2 and unmount denylist I can add cards to Wallet without error I normally get to say device is not supported.

However I fail CTS check.
[Android Software Development] zetsumeikuro:
Same, I fail CTF check and MEETS_DEVICE_INTEGRITY and MEETS_STRONG_INTEGRITY and can still add cards and just paid with Google Wallet. Google doing Google things.
[Android Software Development] LeoPeink:
Pixel 7 here:

Pixel 7 user here, root with Magisk. No hideprops (device not spoofed), only Universal SafetyNet 2.4.0 and DenyList on Play Store, and i cant get the certified on play protect. Wallet is giving me the "unable to pay contactless on this device". :(
[Android Software Development] Nekromantik:
I use Denylist Unmount module and dont enforce denylist and also hide the magisk app.
[Android Software Development] LeoPeink:
Could you please provide details? I pass basic integrity check, but not CTS. I can pass CTS as for this tutorial, but in minutes the denylist for Play Services unchecks itself and i'm back to failing CTS check.
[Android Software Development] rubnduardo:
I had been using contactless gpay with no issue till yesterday, did not even used denylist. I updated the module, still didn't work. I added gpay to denylist and voilà, it worked. CTS is not passed but it doesn't mean anything to me, not yet. Remember restarting after doing any changes.
[Android Software Development] Sasy969:
Same, I only get MEETS_BASIC_INTEGRITY, but I cannot add cards or pay with Wallet, because my device doesn't meet the safety requirements
[Android Software Development] LeoPeink:
Google Wallet (and Play Store) are not fooled by the Universal Safety Fix for me. It does not matter if i pass or not integrity tests, they just know :(
[Android Software Development] rubnduardo:
Must be device specific. I'm on p3xl.
[Android Software Development] Nekromantik:
I do not pass CTS check either but I can add cards to Wallet without issue. Its not related for me.
[Android Software Development] seanho12345:
Same for me on pixel 7 right now. With USNF 2.3.1-mod2.1 installed.
[Android Software Development] Sasy969:
Yep, it appears to be a common problem due to something Google made
[Android Software Development] ddrum2000:
Ok so I

Ok so here's what I did:

Changed to 2.3.1 mod 2.1

Reboot

Uninstalled/uninstall updates and clear storage for: gpay, wallet, play services, play protect, and play store

Remove all of the above from the denylist

Reboot

reinstall/update: gpay, wallet, play services

Run gpay and wallet to get them to "integrate" . Wallet app did not disappear like it had previously

Have not added any of these back to denylist

Fails cts, passes basic, fails device and Strong

Am I now at the point that I'm having the same issue as everyone else?
[Android Software Development] 5riram:
I'm using safetynet fix 2.4.0 by anirudhgupta109 on my Pixel 7 on rooted Android 13. I've been on version 2.3.1 for months starting November and Google Wallet worked fine until today. I don't know what changed but I tried a lot of the suggestions on this thread (like using 2.3.1 mod 2.1, configuring the denyList etc) but nothing worked.

Is there a current fix to get google wallet/gpay working?

View attachment 5831159
[Android Software Development] iwearthebelt:
No new fix as of yet. I'm having the same issue as you. It started after updating to the February release on my Pixel 6 Pro. There were also a few Google app updates that may have contributed to it as well. I know there are some developers working on it already but who knows how long it will be before they figure something out. Guess I'll be using my debit card instead of tap and pay for a while.
[Android Software Development] Bad Bimr:
Where can we get the latest @Displax modded build?

Last one I am seeing is here v2.3.1mod 2.1. Is that the correct file? I currently have 2.4 will this install over 2.4?

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87198517

Thanks
[Android Software Development] pndwal:
Yup, apparently... This seems to be the situation now:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88114877

So sorry for your loss... 🙁 PW
[Android Software Development] pndwal:
Here are all:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87198517

Yes

Welcome... PW
[Android Software Development] ddrum2000:
That's what I thought. I'll stay tuned
[Android Software Development] swent:
Due to a mistake on my side I had to reset my pixel 7 pro and start from scratch, magisk + modded universal safetynet fix installed, ofc denylist configured and and wallet/play services data reset -> no success as mentioned above (CTS profile mismatch).

I gave the safetynet 2.4 module a go and had the same result like half an hour ago. Strangely enough, about 5 minutes ago I just executed safetynet check again and it passed cts profile match!

Was about to set up google wallet for the phone again when it would show "Google Pay is updating right now so you won't be able to access the app".

I thought that would easily be fixed by a reboot, now I'm stuck on loading screen, no clue whats going on.

Will deactivate magisk and check if I can get logs.
[Android Software Development] qetuol:
My GWallet keeps alternating between "working" and "not working" state, same for passing CTS. Doesn't even matter whether denylist is enforced or not. I also think Safetynet version has no influence here. It is just how it works now.
[Android Software Development] Bad Bimr:
OK, used v2.3.1mod 2.1 which I must assume is the latest. should I have . Still fails CTS. Should I have MagiskHide Props Config Enabled or Disabled? (Currently Disabled).

EDIT: I assume I should NOT take the upgrade in SafteyNet Fix.

Thanks Again.

BB
[Android Software Development] AndDiSa:
For me it's exactly the same thing: without doing anything sometimes when opening the wallet application you get informed "Your device doesn't fulfill the security requirements" then, a few moments later everything is fine. Even if you check within the application you see "All security requirements met" ... 🤔
[Android Software Development] digger16309:
I follow this thread consistently but have rarely posted in it. Now that things are a bit sideways I'll ask this -

I understand that kdragon initially developed USNF. But, what is the difference between the Displax USNF (2.3.1-Mod_2.1) module, which I'm running and also failing CTS with, and the updated but also not working kDragon USNF 2.4 module?
[Android Software Development] Bad Bimr:
Same for me. It was still working even after the ""Your device doesn't fulfill the security requirements"" error. Yesterday was the first time it did not work. My problem is I have a child leaving for a week with school that will need to use the wallet app and don't want it to not work. I guess I must remove root from the phone to be guaranteed it will work.
[Android Software Development] pndwal:
Enabled for what / with what configured?... If you have an idea, let us know! 🙃

Won't make any difference to issue most late-ish device/OS users are experiencing now; USNF 2.4.0 and earlier @Displax modded builds all set a mismatched fingerprint prop, and it seems we need to use prints matching ROM for ctsProfileMatch now... But mismatch was needed for deviceIntegrity, so that will still fail...

It's possible someone may discover mismatched props that allow both ctsProfileMatch and deviceIntegrity to pass, eg earlier ROM, same device rather than the very old prop USNF sets, but no-one has reported experiments yet... (My device is older / not affected.)

Anyone wanting to try can use oficial 2.3.1 USNF (doesn't alter fingerprint prop) and make global print adjustments w/ MHPC... Please do and report...

This is what I know at this juncture:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88114877

👀 PW
[Android Software Development] pndwal:
Search my posts and you'll find pointers...

You'll likely need to uninstall all updates for Play Services and Pay/Wallet, clear data incl. Play Store, reboot (important), install Pay/Wallet again and see if it updates... Should work again as G Pay, but may not update to Wallet again for days... No easy way to invoke the update it seems... 🙂 PW
[Android Software Development] inzaghi89:
I've done that three times, still same effect. Today morning I've paid with gpay few times, after that I've an information about root, and until now it's not working.
[Android Software Development] pndwal:
@Displax made earlier builds w/ fingerprint prop mismatch for new Play Integrity hardware-backed verdict enforcement bypass... @kdrag0n not only targeted gms attestation/droidguard process with the same mismatched prop, but found a way to do it only part-time, only when the process is called... This should better avoid issues, but in practice resulted in USNF failures (it's not clear exactly what function fails) immediately after boot and at other times, so initial implementation needs fixes... Rolling back to @kdrag0n builds fixed that issue at least...

The latest failures are also fingerprint prop related, but not the same issue and both Dev's builds are failing to preserve deviceIntegrity for newer devices/OS's...

Experimentation will now be needed to find a fix as mentioned in my post above...

👀 PW
[Android Software Development] pndwal:
You are responding to a reply to a different user with a different issue... Please don't confuse issues...

Depending on your device, you likely have the newly reported ctsProfileMatch and deviceIntegrity issues w/ recent USNF builds... Please read back here a bit... PW
[Android Software Development] SoyDPR:
Google is definitely touching things, we will have to wait for a next solution
[Android Software Development] Zirila:
Today I was just setting up my new phone with a new custom rom and with USNF exactly as with other phones before. 8 hours ago I got a valid working safetynet pass. since a few hours all of a sudden safetynet pass fails.

I completely reflashed my completely installed rom just due to this error... just to read here that google probably fiddles around with safetynet.. 🤬 what an unlucky coincidence.. will there ever be an end to this cat and mouse game.. the whole situation just sucks.
[Android Software Development] jnss98b:
Don't even bother lol I've been on v2.3.1 mod 2.1 for months now and never took kdragon's v2.4 update bc it was still working fine ig and I didn't wanna check any chances and even then google wallet still stopped working for me just a few hours ago even though it worked just fine yesterday. Google definitely played with something. I'm using a pixel 7 pro btw. Ig we'll have to wait and see for now
[Android Software Development] Bad Bimr:
I actually had BOTH USNF and MagiskHide Props Config enabled since day one. Always worked 100% until recently. Yesterday was the first day a payment failed. Did not try today but from others' reports Google is messing with things. I wanted to set-up wallet for my child who is going on a school trip, guess I will have to give them some cash and a CC.

Thanks for all your help. Hoping for a quick fix.

BB

I agree Google is playing games. Mine failed for the 1st time yesterday.

BB
[Android Software Development] tjsynkral:
I give up. I ignored all Magisk, Wallet, and OTA update notifications for months and stayed on the old version and it worked for a while but that still wasn't enough to stop them from disabling my tap to pay today.

You win Google, I am unrooting and locking my device. Damn you. I'd threaten to go to the competition but things are even worse over there.