yashsingh1/xdaforums huggingface dataset:
[Android Software Development] sliding_billy:
Took a quick ride to the store. Both phones paid at terminal with no issues with original Boston Dan manual attestation method of numbers set to 0 and existing cards. Coincidental thing was I needed to re-add a card the day before this all started.
[Android Software Development] ryanjayke:
Hey, I was having this same problem on Pixel 5. If you go check the file in your downloads folder and try to force with "Open with...", it says you don't have a program that opens this file type. The naming convention of the file is screwing things up.

Rename the file by removing the periods in the version (e.g., "safetynet-fix-v111.zip").

Also, module works on Pixel 5! Passing CTS. Thank you, kdrag0n!
[Android Software Development] j1gga84:
For me it works also but the certification status in play store is still uncertified allthough both SafetyNet Checks are ok.

I installed the module in the OP and "Avoiding hardware evalType 1.1" from Displax.

Any ideas?

regards
[Android Software Development] T0unet:
Works well on Pixel 4a. Store certified

Gpay activated after delete data (in Google play services too).
[Android Software Development] Uzephi:
Clear play store and play services cache and data and reboot. That could be an old "not certified" flag from a previous check. It won't clear unless you manually clear it, usually.
[Android Software Development] j1gga84:
That worked for me, many thanks :)

I even don't need Hide Props Config and Avoiding hardware evalType modules anymore, only universal safetynet fix module from this thread and all is ok.

regards
[Android Software Development] zfk110:
Couldn't install it on my Sm-T510
[Android Software Development] j1gga84:
@Uzephi

What does not seem to work anymore is using biometric authentication (fingerprint) in Google play store for payments.

Any idea?

I could check logcat if that has something to do with the module maybe.. (log attached)

Regards
[Android Software Development] Uzephi:
If you have a heavily skinned OEM like Samsung's OneUI, that is a known issue and per OP, it isn't fully supported. Scrubbing through this thread, it seems changing your device fingerprint to another using the MagiskHide Props module might help. Ymmv though.
[Android Software Development] Born<ICs:
Does this differ from zip I found on another thread?

safetynet-fix-v1.0.2-Android10.zip
[Android Software Development] Uzephi:
1.0.2 is outdated. Follow the github link and you'll see the latest release is 1.1.1.
[Android Software Development] pndwal:
OT, but a heads-up:

After hearing some now had G Pay w/ root working without SQLite fix, I tried this a while ago w/ fresh install of Redmi Note 8T, and it works fine (as long as it is selected in Magisk Manager Hide list, then data cleared), contactless payments and all...

Seems something has changed w/ G Pay, but not sure whether SQLite fix is still needed for some devices.

Currently, USNF is the only Magisk module I have installed. PW
[Android Software Development] Z00nkor:
I would love to give this module a try but my device doesn't seems to supported (S5 Plus) :(

- Copying zip to temp directory
- Installing safetynet-fix-v1.1.1.zip
Archive: /data/user/0/kqkjgjdhx.bn/cache/flash/install.zip
inflating: module.prop
*************************
Universal SafetyNet Fix
by kdrag0n
*************************
*******************
Archive: /data/user/0/kqkjgjdhx.bn/cache/flash/install.zip
inflating: customize.sh
Powered by Magisk
*******************
- Extracting module files
Archive: /data/user/0/kqkjgjdhx.bn/cache/flash/install.zip
creating: system_sdk28/
creating: system_sdk28/bin/
inflating: system_sdk28/bin/keystore
inflating: README.md
inflating: module.prop
inflating: LICENSE
creating: system_sdk26/
creating: system_sdk26/bin/
inflating: system_sdk26/bin/keystore
creating: system_sdk27/
creating: system_sdk27/bin/
inflating: system_sdk27/bin/keystore
inflating: LICENSE.android
inflating: customize.sh
creating: system_sdk29/
creating: system_sdk29/bin/
inflating: system_sdk29/bin/keystore
creating: system_sdk30/
creating: system_sdk30/lib64/
inflating: system_sdk30/lib64/libkeystore-attestation-application-id.so
creating: system_sdk30/bin/
inflating: system_sdk30/bin/keystore
inflating: system.prop
Unsupported CPU architecture: armeabi-v7a
! Installation failed

I'm using the latest los4microg build and Safety Net completely fails...

Any ideas?

View attachment 5191113
[Android Software Development] pndwal:
I don't know much about los w/ microG or what Google proprietary add-ons are actually included, but recall there being a GMS add-on for microG which you may need for SafetyNet to function.

It SafetyNet API is part of Google Play Services, so you will need at least minimal GMS for it to function. PW

Edit: As noted below, you likely don't have issues stemming from Hardware Key Attestation in any case.

FWIW however, I did find information about getting SafetyNet working/passing w/ microG some time ago. It may help:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-83647735 PW
[Android Software Development] Uzephi:
Looks like armv7 isn't supported. That old of a phone is hardware backed? Seems more like a rom issue for SN failing or gapps
[Android Software Development] pndwal:
So can/do you get this:

View attachment 5676741

like Rog phone? PW
[Android Software Development] osm0sis:
My understanding was it was always broken on OnePlus, regardless of unlock state, along with proper hardware key attestation, according to https://play.google.com/store/apps/details?id=io.github.vvb2060.keyattestation and Momo.

Yeah, no STRONG here, but everything working fine.
[Android Software Development] Eddy1911:
I cleared data on play services and it worked ty @Displax, i was hesitant because some ppl said clearing the storage doesn't work.

Thanks guys
[Android Software Development] Displax:
Yep.
[Android Software Development] little-endian:
Many thanks for that!

I did and the stubborn Google Pay works again.

Sigh, yet another piece of resistance against the endless retardedness of developers who seriously seem to misbelieve that their android patchwork **** of a system would be anything remotely such as safe just because unrooted. This independent from the matter why someone would not want to have administrative access to one's own device. :rolleyes:

I wonder though how one maybe could prevent that crappy software from updating itself. Although I disabled auto-app updating, some play services **** always is doing so nonetheless. I already hate it whenever I witness it. This update for the update for the update is also such an annoying and moronic development in usage and society, that it is unbelievable.
[Android Software Development] ipdev:
Not sure about newer OnePlus numbered devices.

8, 9, 10, ..

My 5T, 6T and (new-to-me) 7T do not support hardware backed security.

Stock with locked bootloader, they pass SafetyNet showing basic attestation.

Unlocking the bootloader, adjusting the sensitive [secure] props and adding some GMS parts into Magisk's enforcing denylist, they passe SafetyNet.

--

It seems they fixed TEE in their Nord series. :unsure:

OnePlus Nord N200

Stock locked bootloader, passes SafetyNet showing hardware attestation.

Unlocking the bootloader, adjusting the sensitive [secure] props and adding some Google GMS parts into the Magisk's enforcing denylist, fails SafetyNet because of hardware attestation.

No surprise there. 🙃​

I had to use the USNF module to force basic to pass SafetyNet.

Cheers :cowboy:

PS.

Playing with the build fingerprint, I can pass Play Integrity on all of my OnePlus devices.

Note: It does not need to be a different SDK level but..

I still have not figured out the rhyme or reason for adjusting the build fingerprint.

Every time I seem to find a pattern that works, the pattern is destroyed by a different device.😜
[Android Software Development] pndwal:
Technical:

Workings of USNF with PI fix (mod by @Displax )

- for anyone interested.​

... So it's safe to conclude that using an A6 print means those running A7* and up are sure to be using an SDK level (Android version or original print) that will be a mismatch with the print now seen by the attestation (SafetyNet/Play Integrity) process (com.google.android.gms.unstable).

*Nb. "theoretically google can use hardware attestation on pixels with Android <8.0" so 7 is now covered.

It seems that the same attestation as well as trigger for fallback to a basic form of attestation (not using hardware keystore etc) is used by both S/N and PI currently, ie:

https://github.com/kdrag0n/safetyne...ails.md#how-does-universal-safetynet-fix-work

Clearly the Play Integrity API is also enforcing HKA on devices that are known by Google to support it in Android 11+ devices (only?) in a similar way to SafetyNet API enforcement

however the means to bypass enforcement (fall back to accepting basic attestation) differs.

SafetyNet hardware-based check is bypassed the by appending a space character to the device model name to create a mismatch with model prop to trigger fallback. (This too has "minimal impact on UX when only applied to Play Services")

New Play Integrity hardware-based check requires no additional bypassing means on many devices currently, but devices running Android 11+ now commonly require use of a fingerprint prop with mismatched SDK(/API) level, possibly at least Android 10 (level 29) or earlier, and possibly other fingerprint details are material also, in addition to the model prop mismatch.

Obviously the print used must still be a real / recognised certified value to allow CTS Profile match (needed for both S/N and PI APIs) = True, but for HKA enforcement bypassing purposes specifically, it seems that it may only be the SDK (/API) level that's important...

👀 PW
[Android Software Development] Thisisauser6443:
This module, for a good while, worked quite brilliantly on my Pixel 4a 5G, passing both "BASIC" and "DEVICE" integrity. Unfortunately it hasn't worked ever since the start of this week, for... some reason. (With the stock Pixel ROM, btw)

So far, I've tried:

- This (again, brilliant) module

- Spoofing an old A6 (Nexus 5) fingerprint using MHPC

- Using Magisk Delta's iteration of MagiskHide, Riru and it's PI fix module

- Using Shamiko instead of DenyList

The question is, am I missing anything here, and just making myself look stupid?
[Android Software Development] pndwal:
Guessing you mean official, not @Displax modded one w/ PI fix?

Official module is often enough for new device integrity API, especially w/ Android 10 and below...

Not familiar with a delta PI fix module. Most are using @Displax mod posted here; this does targeted spoofing of an A6 print using Zygisk.

Note: Zygisk is not compatible with Riru... Not sure if that 'PI fix' needs Zygisk or Riru...

Shamiko requires Zygisk; Is Zygisk working with Riru in Delta?... If it is, commits preventing this have been bypassed and there will be issues. (The two did work together in early Alpha with limitations...)

Please give more details re. ROM (incl. Android version), mods used etc especially that 'delta PI fix' , Zygisk status, screenshot Shamiko denylist info etc if above info doesn't help. PW
[Android Software Development] matfcb:
Does not work on Xiaomi Mi 9 Pro 5G, Android 11, software version Xiaomi.eu ROM 13.0.1. I have tried Your mod, all methods online, in YASNAC both checks are failed. Device is not certified in Google Play Store. Everything worked on Magisk 23.0, since I updated it to 25 everything fails. DenyList Google Play Store and Play Services (unstable and gms only and first vending option from GPS), hiding doesn't work. HideMyApps, Shamiko, USNF (Your mod later I tried), Zygisk LSPosed are my mods. I have hidden Play Store and PS Services in all those LSPosed, HMA modules. Repacking Magisk by other name doesn't work. Nothing seems to work on Mi 9 Pro 5G on newest Magisk. 23.0 everything works, device is certified in Play Store. On my mum rooted Poco X3 Pro (I rooted it two hours ago) with USNF everything is OK. Device is certified and YASNAC both tests passed.
[Android Software Development] pndwal:
I believe Xiaomi.eu ROMs integrate fingerprint/security-patch level spoofing as well as USNF out of the box... Not sure how integrated USNF copes when Magisk module version is installed.

You may need help from devs / XiaomiEU forums etc to know if there is a conflict... PW
[Android Software Development] Thisisauser6443:
No, it is the modded one. Also, had a last-ditch attempt with the original one

Should have mentioned that I was using A12.1 🙃

Neither did I, until today (This isn't bundled with Delta, btw. I just use it for MagiskHide). Found it on Fox's MMM, too (Alt Repository)

Uh, I meant just using Shamiko, itself. Unfortunately, I'm not even smart enough to bypass the commits that you mentioned, though I did know about the early alpha stages.

It's 12.1 on the July patch (but as you're reading this, I might be on the August patch), with the modded USNF module and Shamiko "working as blacklist mode"

Zygisk is enabled (Denylist, obviously isn't) with the following config:

View attachment 5678311

Now, I should note that GMS does get unchecked after a reboot, but I know that this is expected. It was more of a reckless attempt
[Android Software Development] cantenna:
...So....

i have no idea why I am unable to use google Pay.

I have verified my NFC is working.

I pass YASNAC

I pass Integrity Checker meets & basic, fail at strong (to be expected)

I have no issue at all with setting up Google Wallet/Bank adding a credit or debit card, no errors at all.

All my apps that usually complain about root being detected do not (leading me to believe I'm setup correctly)

....so it all seems like it should work, but....

At all Point of Sale terminals around Australia, the moment I tap my phone to the terminal, my NFC turns off and the terminal reports "Bad Card Type"

Anyone see this before?
[Android Software Development] matfcb:
Without USNF phone doesn't pass Safety Net check either.
[Android Software Development] V0latyle:
So what exactly is HARDWARE_BACKED evaluation type? Like, what sort of hardware based security features are available, aside from Key Attestation, and how does having an unlocked bootloader prevent its use? Is this linked to dm-verity and vbmeta verification?
[Android Software Development] zgfg:
HARDWARE_BACKED eval type means checking CTS Profile by use of TEE = Trusted Execution Environment and getting those results signed by TEE
[Android Software Development] V0latyle:
So if the bootloader is unlocked, trust is disabled, thereby preventing TEE?
[Android Software Development] shoey63:
That's correctomundo buddy😋

Unless the device has a broken TEE, there is no way to get HARDWARE BACKED attestation on an unlocked bootloader.
[Android Software Development] V0latyle:
So maybe it would be possible to intentionally break TEE, although I imagine "breaking" it in such a way that it continues to return valid results would be a lot harder than finding a workaround, like Displax did with forcing legacy attestation.
[Android Software Development] shoey63:
To intentionally "break" TEE would mean fooling around with the bootloader (AFAIK).

And that normally ends in tears . . .
[Android Software Development] V0latyle:
I imagine it could probably be done in the kernel, to a degree - but again, the effort probably be wouldn't worth it when we've found an simpler and acceptable workaround.
[Android Software Development] zgfg:
For breaking TEE on the new Titan, Google offers up to 350K $
[Android Software Development] whitewallman:
Hello @Displax . I don't know why, but I have 2 different copies of your modded unsf module:

safetynet-fix-v2.3.1-MOD.zip

safetynet-fix-v2.3.2-final.zip

Which is your newest, or official module?

Thanks.
[Android Software Development] zgfg:
The latest is safetynet-fix-v2.3.1-MOD.zip

If you go through his posts, you will see that the first came the other one, then two or so days later version number was downgraded to safetynet-fix-v2.3.1-MOD.zip

Also, the latest is shown on his GitHub:

GitHub - Displax/safetynet-fix at integrity

Google SafetyNet attestation workarounds for Magisk - GitHub - Displax/safetynet-fix at integrity

github.com
[Android Software Development] whitewallman:
Thank you for the clarification! I missed that update. Think I can install the v2.3.1-MOD over the v2.3.2final? Everything is working as is and I'm kind of a "If it ain't broke, don't fix it" kind of guy..
[Android Software Development] zgfg:
You can install over the other one. If everything was ok, it shall stay so

If not, you can always downgrade from 2.3.1-mod to 2.3.2-final
[Android Software Development] ipdev:
That is a low bounty. 🙃

From the Vulnerability Reward Program: 2021 Year in Review

Our industry leading prize of $1,500,000 for a compromise of our Titan-M Security chip used in our Pixel device remains unclaimed - for more information on this reward and Android exploit chain rewards, please visit our public rules page.​

Cheers. :cowboy:
[Android Software Development] cantenna:
Can someone share with me the nikgaaps package their installing? Full, basic or other whom has GPay/Google Wallet working?
[Android Software Development] 73sydney:
1) Just quietly, thats off topic for the thread - you should be asking the dev or other users in the thread of the ROM you have installed

2) You could have asked the poster who mentioned it (and contacting him directly via PM) by expending a bit of effort by searching the thread

3) He would then have told you that Pay/Wallet is not included in the custom ROM that he happens to use NikGapps with as a preference (sideloaded), and that NikGapps has never included Pay/Wallet (i used it for years):

Downloads - NikGapps

NikGapps Website

nikgapps.com
[Android Software Development] cantenna:
It's not off topic mate, I've exhausted all efforts to get this to work and from the lack of error in being able to add a credit card successfully without error to Google wallet, this should work for me.

So in a last ditch effort, I was wondering if their perhaps exists a dependency in one gaaps package vs another that would be a requirement for pay/wallet to work....

...and I don't know what is up with search this thread function these days on XDA... I get result from all threads...
[Android Software Development] cantenna:
Hahaha, I did something crazy, in a last ditch effort to get Google wallet to work....

In addition to installing the mod and all the other tweaks, I've modified the scripts of universal binary installer and GPay fix to allow me to overwrite the sqlite3 binary that comes bundled in my rom....

The sqlite3 binary is nearly 6 times the size of the one included in my rom... So I'm optimistic!

Wish me luck!

P.s. if there is a module for a kitchen sink, I want to know!
[Android Software Development] 73sydney:
Differrent GApps builds wont stop Pay/Wallet working, none of them ship with it included and the bundled Google Play Services etc are the same in all as they are never messed with perhaps the exception of perhaps changing some power management options

Pay/Wallet only relies on Google Play Services, and as above, almost no one messes with that

As for searching a thread, i do it plenty of times a day, but it does confuse some, heres a recently reposted guide:

Check out the new XDA app! Let us know what you think [App rolling out now]

The new app is just an upgrade to the current XDA app, so you should be able to just go into Play and hit "Update" https://play.google.com/store/apps/details?id=com.xda.labs.play The app is rolling out now, and will take hours to get to...

xdaforums.com
[Android Software Development] 73sydney:
If you read my signature, using my GPay module REALLY is the last thing you should use....in some edge cases it will sometimes be the only thing that works, but i havent used it in years, and dont recommend it as a 1st or even 2nd option.

Not sure why you would want to "modify" anything.....
[Android Software Development] cantenna:
Because I've tried literally everything else and nothing working for me...

I upgrade from Android 10 LineageOS where pay was working beautifully for me.

Now on an unofficial LineageOS build with NikGaaps, I'm unable to get pay to work again.

I have a One Plus 7 Pro.

My ROMs /system/bin/sqlite3 is 158K

The universal binary sqlite3 is 693K in size, it's bigger and bigger is better no!?

What I'm curious to know, why does it block install if sqlite3 is detected in TitaniumBackup of all things?
[Android Software Development] 73sydney:
I'll answer the last line first (because its the easiest :) ):

The Universal SQLite3 Binaries module looks for the existence of a pre-existing sqlite in some well known paths:

/data/data/com.termux/files/usr/bin/ (termux)

/data/data/com.keramidas.TitaniumBackup/files/ (Ti Backup)

/system/xbin/ (standard path)

/system/bin/ (standard path)

because it was designed to provide an sqlite3 binary only in the case a user didnt already have one. theres little point using the larger one as it itself is several years old and the call to it is a such a basic sqlite3 function that "upgrading" to it makes little sense

If you have tried @Displax's mod of Universal SafetyNet Fix and still cant pass SafetyNet/Integrity checker and have a working Wallet, then you may want to check with the maintainer of your device's Lineage ROM build as something may be causing this behaviour. Thats where id be headed. Especially if i was able to test another ROM on it and it worked. Ive even seen, on past devices (as recently as my previous device, the Pixel 2XL), some ROM's who were based on the same base pass and others not....even with the common base of LineageOS or AOSP....

Plus youve just pointed out its an unofficial build of LineageOS...and you had no problems on the previous official.

Sometimes weird stuff happens, like you can have 12 magisk modules that do some major things, and then you install a magisk font module and suddenly apps are detecting root...then you go install another ROM form the same base and insatll the same modules and nothing gets flagged.....welcome to custom ROM's

Youve done all you can do by the sounds of it, best to start looking where its most likely the issue is...

And please, try not to use the GPay module :)
[Android Software Development] LedgendaryEpics:
Just got this message... I guess the mod stopped working, is there anything else I can do? I still have the same setup I posted about earlier.
[Android Software Development] zgfg:
On that same link I see the rewards valid since April 2022, 250K $ for TEE

Screenshots from the Reward program below
[Android Software Development] cantenna:
So whole a bit off topic, but kinda still on topic as I'm desperately trying to get this to work and refuse to give up...

I just discovered the app 'rootbeer sample'

View attachment 5679855

...is this an issue?
[Android Software Development] ipdev:
If you break TEE on the Titan M chip, you would get all three.

250K for TEE, 250K for Secure Element, and 1M for Pixel Titan M.

Hence Google's boast. 🙃

"Our industry leading prize of $1,500,000 for a compromise of our Titan-M Security chip used in our Pixel device remains unclaimed".

Cheers. :cowboy:
[Android Software Development] ipdev:
Are you enforcing Magisk's Denylist or not enforcing and using a module like Shamiko to hide root?

Add RootBeer to Magisk's Denylist.

That should hide most (or all) from RootBeer.

If you are enforcing Magisk's denylist, there might be a few other processes that you will also need to add to the Denylist.

Cheers. :cowboy:
[Android Software Development] cantenna:
I've tried to both the module and enforce, same results.
[Android Software Development] ipdev:
Since this does not seem to be related to the USNF module, lets move into the Magisk General Support / Discussion thread. 🙃

Post #52,874

Cheers. :cowboy: