yashsingh1/xdaforums huggingface dataset:
[Android Software Development] neilth:
I have a Pixel 2XL running LOS 18.1 which had been rooted and running Magisk 23.1 with no issues until several months ago when it stopped passing Safetynet tests and lost its device certification. After reading in this forum, I upgraded to Magisk 24.1, added MagiskHide Props Config 6.1.2, Shamiko 0.4.1, and Universal SafetyNet Fix 2.2.1. Systemless Hosts 1.0 was left installed from my previous Magisk installation. The system is successfully rooted, but fails Safetynet with Google Play Services issues.

I have Zygisk enabled and Enforce DenyList disabled and Shamiko says that it’s working as blacklist mode.

I’m not sure exactly what system apps need to be added to the DenyList to restore device certification and pass Safetynet, but if I add Google Play Services, which I assume is a required app to add, rebooting the phone removes the just added Google Play Services app from the DenyList.

I have the SafetyNet Test app installed on the phone, which fails saying that it can’t access Google Play Services.

Does anyone have any guidance on how I can resolve these issues to get this phone working properly again?
[Android Software Development] kallekula33:
Hi. I didn't even mange to install Zygisk version of USF 2.2.1 since my phone said that RIRU is missing or something. I'm running Magisk on the stable update channel and I guess you need the Canary version to get this working? I'm not sure what to do. I assume I need to use the RIRU version but I assume other modules are needed for that. Is there a complete noob guide for this?
[Android Software Development] Canny1913:
The latest Magisk version (24) is not compatible with Riru since there is Zygisk now.

I was talking about this version:

https://github.com/kdrag0n/safetynet-fix/releases/download/v2.2.1/safetynet-fix-v2.2.1.zip

Just enable Zygisk and install this module and it should work.
[Android Software Development] Canny1913:
Just add the Google system apps to DenyList and clear data from Play Store and Play Services and it should certify.

Try adding apps to DenyList while Enforce DenyList is enabled. after you add them disable Enforce DenyList and it should work.

SafetyNet testing apps have a limit of testing (10000 tests) try different SafetyNet testing apps or wait a few days before testing again.
[Android Software Development] kallekula33:
But that is what I actually did. So I'm majorly confused now 🤔.
[Android Software Development] k3npachi:
Last version works perfect on mi9t pro, thanks
[Android Software Development] Canny1913:
It shouldn't say anything about Riru.

You can try the Canary version of Magisk if you want.
[Android Software Development] pndwal:
You can't use riru-USNF post 23001.as this solution requires MagiskHide to work and it's gone. (Riru itself is still compatible with new Magisk as long as Zygisk is disabled; it's a choice.)

v2.2.1 should work fine on any Magisk version post 23001 as long as Zygisk is enabled... 👍 PW
[Android Software Development] kallekula33:
My bad, I was actually trying to install wrong version so no wonder it failed 😔. Used the correct one and Safetynet passes just fine. However I still have 2 issues, Google pay and Teams ( towards company) doesn't work. No deal breakers per say, but it would be good to have them working. Not sure how to tackle this.
[Android Software Development] Canny1913:
Google Pay requires some other workarounds and i have no idea for Teams.
[Android Software Development] kallekula33:
Ok. Do you know what additional workarounds are needed for Google pay? For Teams, that would be nice to have but again not a complete deal breaker. Kinda weird that is was working just fine with Magisk v23 and previous method of hiding things from the app. But now after the upgrade, no dice unfortunately 😕.
[Android Software Development] neilth:
Thanks for the quick reply, I cleared data as you instructed, but nothing changed after that. Google Play Services will not stay in the DenyList and Google Services Framework stays in the DenyList, but will not stay checked in the list. What other Google system apps are required to be added to the DenyList?
[Android Software Development] Canny1913:
I have no idea what's causing that, try checking Magisk log after you add Play services to see what's causing the issue. Other than Play services Play store is required to be added too.
[Android Software Development] Canny1913:
Found this but i'm not sure that it works on 24 and i don't use Google Pay so i can't really test it.

https://xdaforums.com/t/working-mag...s-17-1-22-on-pie.3929950/page-9#post-79643248
[Android Software Development] neilth:
I did as you suggested and the log shows the ten components that apparently make up Google Play Services all load successfully. But, once the phone is rebooted, these components all load again one by one and then are immediately removed one by one. It looks like some type of software issue. Maybe I should post this on the Magisk General Support/Discussion forum.
[Android Software Development] _mysiak_:
Google services are removed from Denylist by USFN module automatically, don't stress over it, Safetynet will pass anyway (as long as other requirements are met).

https://github.com/kdrag0n/safetynet-fix/blob/master/magisk/post-fs-data.sh

# Remove Play Services from DenyList, otherwise the Zygisk module won't load
magisk --denylist rm com.google.android.gms

Edit: you mention installing "MagiskHide Props Config 6.1.2", but did you actually change fingerprint of your device?
[Android Software Development] Canny1913:
Oh wow i didn't know that.
[Android Software Development] k3npachi:
I take back what I said, it worked once and since I rebooted it doesn't work anymore

The safety net is failed "can't acces service Google play"

I think it's the new magisk that's messing up

Any solution ?
[Android Software Development] zgfg:
If you have API error or Google Play Services error (those errors might be caused by overquota number of tests), try with another SN checker
[Android Software Development] k3npachi:
I have error with 2 app

View attachment 5527613

View attachment 5527615
[Android Software Development] zgfg:
The second screenshot tells you that Google Play Services are required (SafetyNet API is provided by)

You either have a too old version (?) or some de-googled ROM with maybe MicroG or something - do not even think of testing SN without the proper Google Play Services

E.g, see post #92 in this thread:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-86336179
[Android Software Development] rfgamaral:
Hey everyone. I'm a bit confused by this SafetyNet Fix and Shamiko, are they trying to solve the same problem in different ways, or are they trying to solve different problems?

My interpretation is that Shamiko is a module to replace the old MagiskHide (i.e. to hide Magisk/root from banking apps and others), and to also replace the basic DenyList baked into Magisk 24. And SafetyNet Fix is to bypass SafetyNet Attestation. Is this correct?

With that said, I'm still confused about 2 things:

I'm using the DenyList to hide root from some apps, and so far it's been enough for the apps I personally use. Does this mean that there is no point in using Shamiko, right?

My phone doesn't pass the SafetyNet Attestation check, but Google Pay still launches and works without issues. I was under the impression that it shouldn't work. Why is it working for me?
[Android Software Development] k3npachi:
I use rom from xiaomi EU, and safety net works before I update magisk to last version
[Android Software Development] zgfg:
I have Xiaomi.eu Stable, A11, MIUI 12.5

I pass SN with Magisk 24, Zygisk+DenyList+Shamiko and with no need for USNF
[Android Software Development] k3npachi:
Shamiko?
[Android Software Development] zgfg:
Yes, why not. But it should also work without Shamiko as well (Shamiko hides Zygisk while SN does not look for Zygisk)
[Android Software Development] k3npachi:
It's good I have updated manually service Google play and the test it's done
[Android Software Development] ernsteiswuerfel:
Well... I managed to install Masik v24.1 but seems I am not able to install safetynet-fix-v2.2.1.zip or any module within Magisk.

I klick on Modules -> Install from storage -> select safetynet-fix-v2.2.1.zip from SD-Card Downloads -> and after choosing safetynet-fix-v2.2.1.zip I get thrown back to Modules screen and nothing happens... The logs show no error message but simply no message.

Device is a Samsung s5neolte running LineageOS 17.1. Any help would be appreciated!
[Android Software Development] zulu88:
@ernsteiswuerfel Have you tried to move the modules to the internal memory of the telephony and install?
[Android Software Development] ernsteiswuerfel:
@zulu88 Thanks for your advice! But it didn't work out..

My SDCard is indeed formatted as internal storage and encrypted. LineageOS own "Datei" won't let me access root. So I installed Dateimanager+, used it to move the fix and other modules to /media/data (internal storage) and used Dateimanager+ out of Magisk-Modules to open the file. But result is still the same, it does not install nor even tries to install.
[Android Software Development] pndwal:
Most custom ROMs that spoof Compatibility Test Suite certified (ie. build with certified fingerprint matching security patch date) are also integrating USNF these days ( https://github.com/kdrag0n/safetynet-fix#rom-integration ) as do @kdrag0n's Proton ROMs, so it's likely you do need / actually have USNF. 😜 PW
[Android Software Development] pndwal:
Re. 2, Google Play will generally launch / work fine, but Play Protect (See in Play Store settings) will show Device is not Certified, and apps like Google Pay, Netflix and some bank apps will likely not appear in Play Store, update nor work.

Other questions are covered here:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-86363389

🤠 PW
[Android Software Development] zgfg:
Yes, that's what I suggested to try without USNF

Settings, Apps,Wipe Cache and Data for Google Play and after some time it should become Device certified if you are passing SafetyNet
[Android Software Development] Slim2none4u:
Upgrade your phone! An s5? Time for an upgrade!
[Android Software Development] ernsteiswuerfel:
And how exactly would a hardware upgrade solve a software problem?

Neither Magisk nor any installed App is complaining about the kernel or phone being too old...
[Android Software Development] Canny1913:
Xiaomi.eu already integrated it (or did some other workarounds)
[Android Software Development] m0.ke:
When I try to open the pushTAN app of my bank, I get a security notice: blah blah ROOT something something.

My phone is the OnePlus Nord and I'm using the lastest magisk version with zygisk and the SafetyNet Fix enabled. If I check the SafetyNet Attestation with various apps, I pass both "Basic integrity" and "CTS profile match", but for some reason my banking app still doesn't work.

Any help is appreciated.
[Android Software Development] Canny1913:
Try hiding Magisk. If that doesn't work you'll need to freeze the app before you use the app.
[Android Software Development] Lord Sithek:
The solution for this usually is to repackage Magisk app first and then hide this repackaged app using Hide My Applist Xposed module
[Android Software Development] amit_coolcampus:
Rename TWRP folder in internal storage where twrp stores backup folders. Rename to anything like twrpOld. Some apps are looking fot twrp folder.

You could also try HMA (hide my apps) module with lsposed. That is really powerful.
[Android Software Development] m0.ke:
Hi guys,

thanks alot for your quick replies. I tried to hide Magisk and I put the banking app on the DenyList, both through Magisk settings. It actually opens the app for a second now, but unfortunately I still get redirected after that.

I do not currently have TWRP installed, because if I remember correctly it breaks OTA updates. So right now I'm trying to figure out how to get Xposed installed. Maybe I'll just install TWRP and uninstall it again.

If there's any easier way to get Xposed on my phone pls let me know. :)
[Android Software Development] zgfg:
You install XPosed (use Zygisk-LSPosed - please don't ask where to download from, there were many, many posts about, please take time and go through) like any other Magisk module (from Magisk app, not through TWRP)
[Android Software Development] CalYorBro:
Not working on my Oneplus 7T with lineageOS + MicroG. ( v18.1 )

Any suggestions on what I can do?

Also I am on the latest version ( v2.2.1 ) with MagiskHide.
[Android Software Development] thomas2403:
You wrote earlier, that it is a pushTAN app. Some time ago I have tried to get the German DKB pushTAN working, which is the same as the S-pushTAN app. The only way I found was freezing Magisk before executing the app.
[Android Software Development] Canny1913:
If you are using Magisk 23, you'l need to use version v2.1.3 and Riru, v2.2.1 only works with Magisk 24.
[Android Software Development] m0.ke:
Yes, the S-pushTAN app ist exactly the one I'm using. What exactly do you mean by freezing? I tried to force stop Magisk but that didn't work.
[Android Software Development] thomas2403:
That is not enough, please read here:

https://xdaforums.com/t/magisk-hide-guide-s-pushtan-app-maybe-more.4294761/

No idea, if this still works. I'm not using pushTAN apps anymore.
[Android Software Development] CalYorBro:
I am using magisk 24.1

Is there anything I need to do with the denylist maybe. I can't seem to find a good explanation on how that works
[Android Software Development] Canny1913:
I suggested this in a old post before.
[Android Software Development] CalYorBro:
Ok I'll try it. Btw I have been reading a lot that I need to put google play on the deny list, do I need to put MicroG on there too? And if yes then what services?
[Android Software Development] CalYorBro:
Does not seem to work either

View attachment 5532751View attachment 5532753

Also my banking apps work but they still warn me so that's just weird
[Android Software Development] zgfg:
Oops, SafetyNet is integrated to the officail GApps, actually to GMS = Google Play Servicesi, it communicates by using PKI authentication with Google servers and you will never make it working with MicroG or any fake replacement (neither of them could know the Google Play Services private key to spoof the Google backend)

IMHO, for those who don't like Google, makes no sense to bother with their SN (?!)
[Android Software Development] Canny1913:
Universal SafetyNet Fix is doing it's job partially, it should set Evulation type to Basic (which it does) but it doesn't set Basic integrity to Yes.

Can you post logs?
[Android Software Development] Canny1913:
Put all google apps there and clear the play services and play store data after you put them. MicroG is optional but put it there just to be safe.
[Android Software Development] CalYorBro:
Well I got my banking apps to work and pokemon go even though every time I check safetynet it fails. They all use google play services, that is why I have MicroG and only one of them worked before I fixed safetynet. Don't know exactly what did it but I guess a combo of everything.
[Android Software Development] CalYorBro:
Well it works now, I ended up putting MicroG on the list just to be sure.

Thanks again for all the help.
[Android Software Development] CalYorBro:
Magisk logs?
[Android Software Development] doveman:
Using Universal SafetyNet Fix v.2.2.1 and Root Checker fails when I "Check Safety Net".
[Android Software Development] zgfg:
You are testing SN with Root Checker or with SafetyNet checker like YASNAC?

If you want somebody to be ble to help you, then provide some info for the beginning:

-What is your phone, ROM

-What is your Magisk version
[Android Software Development] doveman:
I used Root Checker first. I tried SafetyNet Checker but that didn't return any results. There's load of SN apps on the Play Store but I'm wary of installing stuff like YASNAC with no reviews. Maybe there's a trusted SN checker available on F-Droid?

My phone is Poco X3 NFC running Android 11 / MIUI Global 12.5.4 and Magisk is v24.1 (both components).
[Android Software Development] wrongway213:
I dunno if you looked up the wrong app or what, but YASNAC has 412 reviews and a perfect 5* score. It's the most widely used/trusted here on XDA. Just use YASNAC
[Android Software Development] doveman:
I'm looking at it on my phone. It says it has 10K+ downloads, it's by Xingchen & Rikka and it says under Ratings and reviews "No reviews yet".

EDIT: Anyway, I installed it and it says I pass Basic integrity and CTS profile match.
[Android Software Development] Captain_Throwback:
Something must be wrong with your Play Store, then.

View attachment 5542487
[Android Software Development] doveman:
Clearly something's wrong with the Play Store. As I say, I've installed and run that app now anyway, and it says I pass SafetyNet, so that isn't the reason why I can't update Netflix and Revolut.
[Android Software Development] Slim2none4u:
Clear the cache of Google play store and Google play services. Make sure they are in the deny list in magisk.

Restart phone.

This always works for me.
[Android Software Development] doveman:
Thanks for the tip. I hadn't added Google Play Services to the deny list in Magisk, as it's hidden unless you tick "Show system apps". However I've tried adding it now and clearing the caches and rebooting a few times and I still have the same problem.

Every time I reboot it unticks Google Play Services in the Deny List. When I tick "Show system apps" it shows it unticked way down the list (i.e. not grouped with the ticked items at the top of the list), but even if I re-tick it straight after rebooting and before opening the Play Store, it still won't let me update Netflix or Revolut.
[Android Software Development] Lughnasadh:
If you are using USNF version 2.2+, you don't need to tick Google Play Services. It "hides/denies" it in the background but keeps it unticked because the mod won't work properly if it is ticked.
[Android Software Development] doveman:
OK, it's not that then, but regardless of whether I tick it or not I have the same problem with being unable to update Netflix and Revolut. I can still open them and they still show in the update list because they're installed but they're not visible in the Store if I search for them.
[Android Software Development] Lughnasadh:
I don't use Netflix or Revolut so I'm not sure how much help I can be. However:

Are you certified in Play Store? If not, clear cache and data from it and reboot.
[Android Software Development] Canny1913:
If you're passing SafetyNet, clear Play Store and Play Services data, launch Play store and wait 30 secs (so it tries to certify) and check device certification in settings, if it's certified Netflix and Revolut should appear in search.
[Android Software Development] doveman:
I first changed the device fingerprint from POCO X3 NFC Global to POCO X3 NFC Europe and I added all the other Google stuff I could find to the DenyList (other than Play Services), so Google, Google Contacts Sync, Google News, Google One, Google One Time Initi, Google Partner Setup, Google Podcasts and Google TV. I'd already added Google Pay and Google Play Services for AR in the first place.

I then cleared Play Store and Play Services cache and data (again) and rebooted. This seems to revert Play Store to an older version, as under Settings it shows v29.3.14.21 and an option to Update Play Store. It does says it's certified.

I didn't update Play Store and checked my installed list and it didn't show Netflix or Revolut at all now, but when I searched for them in the Store it showed that they were installed and I was able to update them. They still don't show in the list of installed apps though. Clicking the Update Play Store option doesn't actually do anything, so I guess it will update when it feels like it!

So I can't say exactly what fixed it, but I'd cleared the Play Store and Play Services cache and data and rebooted several times before and it didn't help, so I think it was either changing the device fingerprint or adding one of those things to the DenyList. I'll try removing them again and rebooting and see if the Play Store says that Netflix and Revolut aren't compatible with my device again.

EDIT: Nope. Removing those extra things from the DenyList hasn't changed it. Play Store has updated itself now and is v29.4.13.-21 and Netflix and Revolut both show in the Installed apps list. Obviously I don't have the option to update them now but I imagine it would still say they're not compatible if there was a problem. So I guess changing the fingerprint did the trick.
[Android Software Development] pndwal:
I may have missed all your progress since this, but FWIW:

You likely need to spoof certified fingerprint using MagiskHide Props Config as it's a custom ROM.

Also, read this re. recent SafetyNet fix for MicroG as you may need updates:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-86481921

?? - You say you're on Magisk 24.1... there is no MagiskHide any more! PW
[Android Software Development] CalYorBro:
Yes you missed my progress since I did get a half fix. Safetycheck still failed but some banking apps and other root detectors worked again.

I had no idea that there was a fix in microg. I read the posts you linked to and I don't 100℅ understand what I need to do. The first thing I checked was my microg version and its on 0.2.24.214816, which is higher than the one mentioned in the github post.

I have Safetynet attestation on but it still fails. Maybe it's the fact that I am using the integrated version or that my magisk settings are configured wrong.

If you have some tips on how I might fix this that would be great.
[Android Software Development] CalYorBro:
Also just FYI since you didn't read the way I fixed it.

Im on an oneplus 7T

On Lineage OS 18.1with MicroG

Magisk v.24.1 with zygisk enabled

Using modules universal safetynet fix, shamiko and magisk hide props to pass safetynet

MicroG v. 0.2.24.214816

Half of my banking apps work as intended while the other is half broken. (I can log in but then it kicks me for being rooted when I try to do something else in the app)
[Android Software Development] pndwal:
Passing S/N ...

🤔 Not passing S/N? ... Still confused if passing... Please say evaluation type, basic integrity & CTS profile results...

As long as GMSCore is late version... I assume it will be same as MicroG version, but I'm not a user... I just noted the recent fix for MG S/N after 2+ years broken... If version is ok, better ask ROM / MicroG users...

Sorry, what's this?

... PW
[Android Software Development] CalYorBro:
I am not passing CTS nor am I passing Basic integrity. But somehow it allows some of my banking apps that did not work before my "fix" to work. (See attachment 1)

The safetynet attestation in MicroG which your Github link said to turn on is on. It even fails the simple test in the MicroG settings even though it is turned on. (See attachments 2/3)

See why I am confused with the situation? All my checks say I fail but my banking apps don't.
[Android Software Development] pndwal:
Ok... Seems everything is confusing... So you don't have S/N pass despite having MagiskHide Props Config...

Is ROM this official one?:

https://xdaforums.com/t/rom-official-hotdogb-11-lineageos-18-1.4270931/

If so:

I can't see any comments there re. Passing S/N in last month... Nb. it has only become possible one month ago, and users may not even be aware yet as this option was broken (impossible) for MicroG for 2+ years... May want to post there for help getting it passing now on this ROM...

You will need passing fingerprint configured in MHPC module as this ROM is official, and Devs won't integrate passing fingerprint, USNF, etc. due to LOS policy... What fingerprint(s) did you try / configure?...

Also, be aware that some Magisk modules break SafetyNet. EDXposed is a common example... Until S/N passes, try with all modules other than USNF and MHPC disabled... PW