yashsingh1/xdaforums huggingface dataset:
[Android Software Development] pndwal:
So you'll need to check and pass deviceIntegrity (using Play Integrity API Checker or other)... Don't worry about strongIntegrity... Permissive selinux will be breaking basicIntegrity...

Get a (responsible) ROM with selinux working (enforcing)... Remove the modules I mentioned... PW
[Android Software Development] googleDich:
So the solution is to find another rom? when i flash the original rom via odin and run the root file again. The error shows like that. What should I do to fix it?View attachment 5954157View attachment 5954159
[Android Software Development] googleDich:
Please. If possible give me some of your time. Please contact me via telegram at (+84) 389795367
[Android Software Development] bkakaroly:
I'm having a problem updating the USNf .. i don't know anymore what am i doing wrong, i tried clean installing it, cleaning cache and data on GPlayS, everytime i reboot and open AMM, i jumps back to 2.0.4, i'm on Ketan's Rom on Note 20 Ultra
[Android Software Development] shoey63:
@Displax

Any chance you could post a test build that might work with KernelSU that doesn't include the HARDWARE _BACKED implementation?

I have KernelSU up and running on my pixel 6 with Zygisk on KernelSU but the the 1.3 mod fails in all categories (3 red ❌ in play integrity checker), and the test 2.0 build results in endless "device is starting".
[Android Software Development] pndwal:
Not sure what more to say... Permissive selinux (read NO security enhancements turned on) is for testing purposes only... It's irresponsible to release any ROM publicly for daily use in permissive mode and AFAIK you can't hide that for Play Integrity deviceIntegrity verdict purposes...

Sorry, please post queries in appropriate XDA threads for help... 👍 PW
[Android Software Development] andyxo:
Hi guys, rooted my Pixel 4a two years ago and haven't had to do anything with it until now because it seems I now fail ctsProfile check (I haven't checked it in a long time so it could have been failing for months). I have Magisk 22.1 installed with Riru 26.1.2 with Busybox 1.33.1 and Universal Safety Net Fix v2.1 installed (which I am pretty sure I installed all this stuff two years ago)

Would a kind soul please take pity on this old guy here and tell me how to update to newest Safety Net Fix? I am reading something about Zygisk and newer versions of Magisk is now required for Safety Net Fix and crap now I am really lost. I guess my question is can I just go to the main page of Magisk and click "Update"? Then after that is hopefully updated I can install the newest version of Universal Safety Net Fix or is there some other convoluted process I will now have to do in order to get all this stuff working properly again just to update Safety Net Fix?

Thanks :)
[Android Software Development] lepras:
just install pixelOS guys, I am fed up with all this banking apps not able to start and fixing my root config.
[Android Software Development] XTrail02:
Or just use a browser to access your Bank's website to do transactions, works fine with root.
[Android Software Development] lepras:
or use vmos though its as insecure as anything gets lol
[Android Software Development] husharon:
hey

i had s21 ultra and safetynet worked great.

i have now 23 ultra and cant add cards to google wallet.
[Android Software Development] pndwal:
If you have Magisk App hidden I'd definitely unhide before updating All as stub obfuscation has been updated several times... Hide it again afterwards...

Otherwise update App then taking Direct Install to update should be ok... Be aware of options to disable modules (in Magisk FAQs) in case of bootloop, but should only be an issue if updating OS...

Be aware that some modules could be breaking device integrity attestations now... Also, SafetyNet is depreciation and most banks have already migrated to new Device Integrity API... Use Device Integrity API Checker to test passing deviceIntegrity verdict... You don't need strongIntegrity verdict for any known banks or G Pay/Wallet yet...

Remove Riru and use Zygisk based LSPosed if you need XPosed modules, eg. Hide My Applist for banks etc that detect root associated apps...

Remove all Google stuff from denylist other than G Pay/Wallet and consider using Shamiko to hijack that list (denylist not enforced) as hidelist for proper root hiding... Nb. Denylist isn't...

Remove MagiskHide Props Config if you have it... Ensure you aren't running mods or ROM that sets selinux to permissive...

Nb. @kdrag0ns official USNF hasn't been updated for a while, is largely broken for use with G Pay/Wallet and has intermittent failures; users have been using @Displax's modded builds with fixes for new Play Integrity API for some time... Here:

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88149053

... Or you could try his latest (Google bug-based) strongIntegrity passing experimental Play Integrity Fix (PIF) here:

https://xdaforums.com/t/module-play-integrity-fix.4607985/post-88785585

or the OPs builds in same thread! 😜

Also, read OP posts (first 9!) here:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/

and maybe follow general discussion here:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/

All best, PW
[Android Software Development] pndwal:
Please see post above re S/N depreciation, PI and fixes...

When you have PI deviceIntegrity, clear G Pay/Wallet data (or wait possibly several days for it to reset; it should eventually), reconfigure updates and cards etc and you should be good... 👍 PW
[Android Software Development] AnyNameYouWish:
Just realized I posted in the wrong thread my message below :

I'm a bit lost with all recent updates and new modules.

I have a rooted Pixel 5 with official firmware and july update.

Using Displax's safetynet-fix-v2.4.0.zip

Wallet app worked perfectly until last week, but I tried and failed to pay today.

I don't pass any integrity anymore

What should I do in order to pass at least device and basic integrity?

Also, I followed steps from pndwal previous messages but still no green mark on play integrity checker...

Thanks for support :)
[Android Software Development] Jh.soft.serv:
For those who cant pass:

Thanx to oshvitzon -:)
[Android Software Development] frenksisco:
Hi, I really need help to understand what I'm doing wrong.

I can't solve the SafetyNet CTS profile match Fail on my Moto G6 Plus with Android 9.

What I have done is:

Magisk-v26.1

hidden the Magisk App

enabled Systemless host

activated Zygisk

rebooted

Zygisk correctly activated

Installed SafetyNet Fix 2.4.0

rebooted

configured Denylist by checking every single service included in Google Play Service, Google Play Store, Google Service Framework and my bank app.

deleted every data from the above apps

rebooted

Results:

Basic integrity: Pass

CTS profile match: Fail

Please 🙏 ....
[Android Software Development] zgfg:
First, what do you mean by SN Fix 2 4.0 - if you refer to the 'official' (KDragon) version from this thread, it's a way too old

Try with the Displax mode - it was mentioned in this thread many times, and he opened a new thread so look there for his up-to-date version (link to that thread can be also found in the posts here)

And btw, hiding Magisk app is irrelevant for SN/Play Integrity. Similarly, Google Play Store and Google Framework Services
[Android Software Development] frenksisco:
First of all thank you very much for your help

Yes I mean this latest Kdragon SafetyNet Fix I see released on January 9 of this year

Not the latest available?
[Android Software Development] zgfg:
That's old. Things are changed quickly (and Kdragon is busy with the other stuff, hence Displax took over and updated the module - btw, many times since that old version you have). Please scroll through the thread backwards or directly search for Displax fork thread

Btw, aim to pass Play Integrity API, Device and Basic Integrity (you can't Strong Integrity with the unlocked BL - it worked only for a week or so, but Google fixed on their side)
[Android Software Development] frenksisco:
Okay thank you very much, I think this is what you are talking about. I will follow the instructions in the first post, thanks again!
[Android Software Development] Jh.soft.serv:
Not first post, just mine, 3-4 posts above https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88802789 (displax mod)

edit/ latest displax mod 2.4.0 mod 2.0 works as well
[Android Software Development] frenksisco:
I didn't follow your process because:

I got here by following guides that only talked about the Kdragon method, and I didn't know what the displax fork mod was

When zgfg made me aware of displax method I didn't understand why you indicated to use v2.3.1-MOD_3.0 instead of the latest

I don't have and don't use google wallet

In the end I followed a mix between a Kdragon guide and the directions on page 1

Magisk-v26.1

hidden Magisk App

Enabled "Systemless host"

Enabled Zygisk

Rebooted

Installed safetynet-fix-v2.4.0-MOD_2.0 by Displax

Rebooted

Configured "Denylist" by checking every sub-item in Google Play Service, Google Play Store, Google Service Framework and my banking app

Deleted any data from the above apps

Checked that SELinux mode was setted to Enforcing

Rebooted

Device integrity: Pass

Basic intergrity: Pass

CTS profile match: Pass

Very happy, thank you all!
[Android Software Development] mirfatif:
Correct. PMX is not an alternative to XPrivacyLua.
[Android Software Development] leogalski:
Hey all,

Can someone test if this still works, please? It still fails to me after having Alpha + HMA setup.

Thanks!
[Android Software Development] pndwal:
Still:

View attachment 5973985 👍

... Hidden all LSPosed modules from bank in HMA incl. HMA itself?

Using 'parasitic', not standard shortcut for LSPosed, or no shortcut (open from notifications or diaper)?

Have Shamiko and taken Hide the Magisk app in Magisk settings?...

Using @Displax fork USNF 1.3 (or 2.0 if working) build as official is broken? And checked passing deviceIntegrity verdict?

PW
[Android Software Development] leogalski:
Thanks for the answer!

So, all flags are checked:

HMA is hiding all root-enabled applications, including HMA itself (HMA is the only LSPosed module actually)

LSPosed is using only the notification shortcut

Shamiko enabled, 'hide Magisk app' active ( 82903582-alpha (26105))

USNF mod being used

Basic integrity and CTS profile match passing in YASNAC

...and I'm out of ideas... My device looks as clean as it can get lol

Thank you!
[Android Software Development] zgfg:
Since you are 'cleaning', did you clean everything for TBChecker (among others, it will test Play Integrity instead of deprecated SN by YASNAC)

You can additionally hide (hidden) Magisk app by HMA.

You can also hide that unlocked BL from selected apps by Bootloader Spoofer (not related to SN/Play Integrity), then you also need to hide BL Spoofer with HMA

Some apps detect USB Debugging and even Developer Options (there is also an LSPosed module to hide Dev Options but there are issues with)
[Android Software Development] pndwal:
Cleared app data after any failed attempt?

May need to hide suspicious apps other than root apps... Some banks detect detectors like Mom or diagnostic tools, but this app seems to only detect XPosed modules for me (they're in separate template to other apps and I could disable template for the latter)...You mad have different 'untrusted' apps however...

Nb. SafetyNet is deprecated and this can pass while new PI API deviceIntegrity fails... You need to check that minimum verdict... Don't worry about strongIntegrity...

Not confirmed: Hide the Magisk app (hidden stub app) used, bank app in denylist...

🤠 PW
[Android Software Development] leogalski:
Thank you again for the answer! Unfortunately it doesn't work still after I hid all apps which could be untrusted... The only thing I can even think of is that Momo finds the locked bootloader, and I couldn't hide it still.
[Android Software Development] pndwal:
Momo finds B/L unlocked for me too but Bankinter doesn't...

Are you using custom ROM?; Could be that or other traces detected... I'm on stock A11 MIUI... PW
[Android Software Development] leogalski:
Hi, yeah I'm using a custom ROM... The final solution was really to close my Bankinter account...

It's not a good bank anyway lol

Anyway, thank you!
[Android Software Development] vweone:
it doesn't work for me on galaxy m12...
[Android Software Development] zgfg:
This module is long ago deprecated/not updated to the Google's changes

Find and use a fork from Displax or Play Integrity Fix from Chiteronan
[Android Software Development] vweone:
I using stock ROM. What is "module forcing Permissive mode" and "XPrivacy Lua"?
[Android Software Development] vweone:
then which one should I use?
[Android Software Development] zgfg:
I realized where you posted and edited my previous response. Please re-read
[Android Software Development] zgfg:
Above answer was edited, I added:

Find and use a fork from Displax or Play Integrity Fix from Chiteronan

Search on XDA to find
[Android Software Development] vweone:
it still doesn't work for me :( idk what I can do, I using stock ROM
[Android Software Development] zgfg:
Ask in the thread(s) where you downloaded the up-to-date module(s). They have also instructions how to log

Developers and others will not read/help here
[Android Software Development] vweone:
lol, I dont think I even have root. I cant grant SU permission, because this grant window doesn't show up and etc. I think the plugins didn't even install because of that. Magisk says it's all installed, weird.
[Android Software Development] vweone:
OK, it was a bug. I think the problem with safety net that is Zygisk is disabled, because I dont have this toggler in Settings-Magisk section (?). Any way to enable it?
[Android Software Development] zgfg:
Then you didn't install Magisk but only Magisk app

Please don't ask here but find and study how to properly/fully install the Magisk
[Android Software Development] vweone:
No, Magisk root is installed, my bad.
[Android Software Development] cassato:
I'm not having much luck passing safetynet with my Pixel 7 Pro. There are so many mods and methods out there that I am getting lost in the weeds.

Pixel 7 Pro

Magisk (hidden) 26105 | Zygisk Yes | Ramdisk Yes

Powerhint_Cheetah v9_6 for Kirisakur-Kernel

Shamiko v0.7.3 (174)

Systemless Hosts 1.0

Universal SafetyNet Fix v2.4.0-MOD_2.0 by kdrag0n, modded by Displax - I'm thinking this version is wrong?

TB Checker Play Integrity fails: Device integrity, Strong integrity, Virtual integrity

TB Checker Root fails: SU Binary, 2nd SU binary, root via native check, Magisk specific checks

YASNAC CTS Profile match fail
[Android Software Development] cassato:
safetynet-fix-v2.3.1-MOD_3.0.zip got the CTS Profile to pass in YASNAC and Device integrity to pass in TB Checker.

Still failing:

TB Checker Play Integrity: Strong Integrity, Virtual integrity

TB Checker Root: SU Binary, 2nd SU Binary, Root via native check, Magisk specific checks
[Android Software Development] zgfg:
If you pass Basic and Device Integrity, that's it - with the unlocked Bootloader you will not pass Strong Integrity (and for Virtual Integrity nobody cares)

For the other findings you see in TB Checker - this module has absolutely nothing with them - you need to put TBChecker in DenyList, use HMA, Sensitive Props module and so
[Android Software Development] pndwal:
I think most P7 series users (and users of other devices launched with A13) are now using @Displax's USNF fork v2.4.0-MOD_1.3 build as MOD_2.0 fails w/ A13 launch version devices due to shipping level not properly set (and official 2.4.0 remains broken)...

The MOD_2.0 build was really an experiment with a recently discovered bad Pixel 2 implementation that allowed strongIntegrity to pass with basic-only attestation used on device. See:

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88840539

... Google have since fixed this (embarrassing) server-side vulnerability.

@Displax's v2.4.0-MOD_1.3 build works fine for deviceIntegrity which is all you can hope for, but breaks VoWiFi (+ possibly other functions) due to global shipping level setting... He did say he would produce a fix for that later:

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88847911

in which shipping level will target GMS... Not sure what to hold-up is...

While all these modules bypass hardware-backed attestation on the device, which is needed to pass deviceIntegrity, no fix will allow strongIntegrity (unless Google surprises us with another server end vulnerability) as hardware-backed server-side evaluationType enforcement cannot be bypassed for strongIntegrity verdict; it is always required... The prop mismatch-based bypasses for hardware-backed serverside evaluationType enforcement these solutions use will only ever work for deviceIntegrity verdict...

🤠 PW
[Android Software Development] DroidShift79:
Hi for some reason on my oneplus 9 pro with latest OOS13.1, my playstore tells me device is not certified, also YASNAC and Play integrity say Basic integrity passed.

I have already cleared google play services data and waited 2 days. playstore still says "not certified"
[Android Software Development] pndwal:
Have you cleared Google Play Store data?

Do you have Google Play Protect Service on your device (separated out from Play Services w/ late devices/OSs)? If so, clear data for this then for Google Play Store... PW
[Android Software Development] FredMontteiro:
Is there currently any way to fix TEE Broken? Device Xiaomi Mi A3
[Android Software Development] pndwal:
No... Unless Momo is giving false positive, really TEE is not broken anyway... I mentioned to you:

So OEM's messed up and AVB chain of trust fixes generally don't even come with OEM updates...

In such cases broken keystore etc will hopefully cause an exception that triggers on-device fallback to basic-only attestation and Google allows this verdict by not enforcing hardware backed evaluationType verdicts at server end, but generally devices affected will never pass strongIntegrity (unless a retrofit fix is applied by OEM.

In other cases, like Asus ROG Phone 3 that used to pass strongIntegrity erroneously with bootloader unlocked, Google simply revokes keys for strongIntegrity verdict (blacklists device) as soon as the flawed OEM implementations are discovered.. 😕

👀 PW
[Android Software Development] xSnowLeopardx:
Uggh. Will start crying soon ;-;

Couldn't pay today with Google Wallet (that was awkward) and had to resort to my good old physical card.

ANYWAY. Not passing any SN check and have 3 x's on Play Integrity API Checker.

Don't know what I am doing that is not working. Have tried and have installed and have configured A LOT.

Can someone help? OR at least tell me that it's not working for lots of people? My info:

- OnePlus 11 with Android 13.0 with unlocked bootloader and root.

- Magisk 26 with obfuscated Magisk name. Have Magisk Hide / Zygisk.

- Have tried with Enforce Denylist ON and with OFF (with OFF in combination with Shamiko 0.7.3-174).

- Have tried with various LSPosed modules.

- Have tried with RootCloak, with HideMyApplist

- Various SafetyNetFix versions (2.4.0, 2.4.0 mod 1.1, 2.4.0 mod 1.2, 2.4.0 mod 2.0, 2.3.1 mod 3.0)

- Have tried with PlayIntegrityFix

No, I won't touch my bootloader. No, I won't install a custom rom because OOS is insert curses. I just want to use my Wallet app and pass the SN checks. ANY help is greatly appreciated!
[Android Software Development] rodken:
Have you tried these methods from the following post(s) just to name a few:

-- #2737

-- #2538

-- #466
[Android Software Development] chiteroman:
- Remove all data from GSF and GMS.

- Completly uninstall Magisk and flash original boot.img (or init_boot.img) from bootloader.

- Remove dalvik cache and caches.

- "rm -rf *" in /data/adb directory (DON'T remove the directory)

- Try to remove any custom *.rc file.

- Check Play Integrity API, you should pass BASIC integrity.

- Patch original boot.img (or init_boot.img) in Magisk app and flash it in bootloader.

- Install PlayIntegrityFix or Displax safetynet-fix module.

- Should pass BASIC & DEVICE.
[Android Software Development] xSnowLeopardx:
Very weird, but this happened:

I restarted my phone and it went into bootloop but was saved by Magisk bootloop protector. Checked YASNAC and both passed... wtf. Google Wallet detects root so I'll need to still fix that but what the f is happening...
[Android Software Development] pndwal:
Did you try @Displax 2.4.0 mod 1.3 though?...

2.4.0 mod 2.0 was experimental and doesn't work with A13 launch version devices as shipping level isn't set (lower) properly... I think 2.4.0 mod 1.2 did it properly (set to 32), but I know most LV A13 device users (P7 series etc) are using 2.4.0 mod 1.3 while waiting for @Displax to update with targeted spoofing to fix VoWiFi etc... 1.3 has extra fixes too... Also @chiteroman's PIF module may now work properly for late devices too...

You should test with all modules other than USNF/PIF (and maybe Shamiko hiding) disabled, and don't forget to clear data for Google Play Services, Google Play Protect Service and G Pay/Wallet...

🤠 PW
[Android Software Development] pndwal:
Also, you need to check new Play Integrity API deviceIntegrity verdict since SafetyNet API is deprecated (ie. YASNAC isn't enough)... Use Play Integrity API Checker etc... Don't worry about strongIntegrity...

🤠 PW
[Android Software Development] xSnowLeopardx:
Can't find the 1.3 version. Can you link it? Appreciate the help immensely.
[Android Software Development] pndwal:
Second one here:

https://github.com/Displax/safetynet-fix/releases

👀 PW
[Android Software Development] xSnowLeopardx:
About that Google Play services. I see manage data there and inside there, I am kinda scared/reluctant to touch stuff there. Can't see a clear data button like the play store has or other apps have.
[Android Software Development] rodken:
+1
[Android Software Development] pndwal:
This is regularly done by modders here... No issues clearing that data APAIK... Flagged detections will probably reset without clearing if you wait long enough however... PW
[Android Software Development] xSnowLeopardx:
We're talking about the three options in Play store services?
[Android Software Development] zgfg:
Yes, use that. Answered and posted the same (actually three screenshots, and in English) here or on another thread, few days ago

It tells you that it will deleted eg passwords in Chrome, but that's the way to wipe Data for Play Services, if you want/need

It will not wipe your phone, your photos, etc. It will not uninstall your apps or who knows. Things will re-sync over some time
[Android Software Development] xSnowLeopardx:
Alright will do that then. Having root and both passed back on my 7 Pro with OOS11 was so easy. This, this has become so difficult lmao.
[Android Software Development] xSnowLeopardx:
So, I did clear the data of the Play Store services. Could not pass any checks. Then I don't know what happened but the hidden Magisk app could not start up anymore. Then I installed Magisk apk and looked. Saw that Magisk was not available (?). Can't access Magisk anymore and the modules are, I think, not working. Adaway doesn't work... This is such a sh*tty situation...

I think I'll do a Swift backup and root from scratch. Just can't believe that it's so hard to have root working with passing the safety checks and have GWallet working...
[Android Software Development] kudichode:
It shouldn't be so difficult. I factory reset data earlier today, soon as I flashed my patched boot.img the next thing was flash both this and a MOD1.1 version of this same universal fix. First check fails (shows it attempted hardware_attestation), clicked again and voila everything pass (shows evaluation type BASIC). Not sure what's going on with your setup but for sure not the norm
[Android Software Development] xSnowLeopardx:
And that's why I decided to say f all and go with a custom rom lol. CrDroid looks fun and gives me the customization level that I wanted.