yashsingh1/xdaforums huggingface dataset:
[Android Software Development] joegreat:
Hi,

My OnePlus 7T got recently the Android 12 update (OxygenOS 12.1 version HD1903_11_F.20) and I took the change to update Universal SafetyNet Fix to version 2.4.0 (from version 2.3.1).

The SafetyNet Fix-update was a BIG MISTAKE!

Now the fingerprint unlock does not work anymore. :-(

I tried all the suggestions (clearing data and hiding of Google apps/services, reboot, installed old version of SafetyNet Fix, ...) but nothing helped so far.

Only disabling SafetyNet Fix brings back the fingerprint function...

...but then it breaks the Microsoft Authenticator and Outlook!

Any further ideas? Maybe a complete list Google Apps/Services (incl. system one) would help...
[Android Software Development] iwearthebelt:
Just go back to an older version. I'm still using Universal Safetynet fix version 2.3.1mod_3.0. This version has been working for me, never updated to the recent one. BTW, you're lucky to have fingerprint working at all. Almost all the time when the bootloader is unlocked, that instantly blocks the fingerprint reader from working.
[Android Software Development] pndwal:
A few posts back...

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88335083
[Android Software Development] joegreat:
Hi,

Thank you for the suggestion, with safetynet-fix-v2.4.0-MOD_1.2.zip the fingerprint scan works now again on my OnePlus 7T (in conjunction with Shamiko-v0.6-126-release.zip)!
[Android Software Development] aboda7m:
I cant open these 2 apps and i dont know why can you check for me?

NAFATH | نفاذ خدمات - Apps on Google Play

NAFATH SERVICES IS AVAILABLE NOW !

play.google.com

SNB Mobile - Apps on Google Play

SNB Mobile, The Premiere Mobile Banking Application in KSA

play.google.com

I pass both device and basic integrity so i think its beacise of strong integrity
[Android Software Development] tigreek:
Works well v2.4.0/Xperia 5 II/LineageOs 20/Magisk v25.2 - thanks, coffee bought :)
[Android Software Development] mebel:
2.4.0 stopped working on Magisk 26 - Zygisk detection problem.
[Android Software Development] pndwal:
... That's nothing to do with USNF... It's main function is to bypass use of hardware-backed attestation to collect measurements used for device integrity verdicts.

Zygisk detection etc is the provence of root hiding modules like Shamiko...

USNF is fully working if you can pass Play Integrity deviceIntegrity verdict. 🤪 PW
[Android Software Development] mebel:
"Module is suspended because Zygisk is not enabled" - But Zygisk IS enabled. It's not working because is suspended.
[Android Software Development] zgfg:
Do you have any Ruru modules

Actually, what other modules do you have installed?

Also, do you use safetynet-fix-v2.4.0-MOD_1.2.zip

Also, Magisk app, main screen, top - please provide screenshot to see what Magisk version is installed, does it say Zygisk Yes, etc
[Android Software Development] pndwal:
Ah, ok... You said 'Zygisk detection' problem... I'm guessing you mean Zygisk activation problem... This is not indicated by toggle in settings... If it has actually activated you'll see Zygisk: Yes in App main page...

As above, Zygisk can be affected by modules; try rebooting with all disabled to eliminate modules... If no dice, please say device ROM etc, and other mods (custom ROM mods etc) you may have... 👍 PW
[Android Software Development] mebel:
I have

At a glance enhancer

Dolby audio moto G pro

HOS display callibration

Pixel launcher extended for android 13

Yes I use use safetynet-fix-v2.4.0-MOD_1.2.zip

Magisk 26.0

App 26.0

Now I see that that problem is probably with Magisk 26 because it shows that Zygisk is not (working/turned?) But it's turned on In options and I made restart too.
[Android Software Development] mebel:
Thank you for help, and sorry.

The problem occured with Dolby audio moto G pro on Magisk 26. The module blocked Zygisk.
[Android Software Development] ghosty999:
Thanks to the team for making this! However I'm having issues on the OnePlus 8T KB2003

Magisk 26.1

Zygisk Yes

Qualcomm 865

Android Version 13

Shamiko 0.7

SafetyNet-Fix v2.4.0-MOD_1.2

When the SafetyNet-Fix module is ENABLED the Phone PASSES Integrity and CTS but the Fingerprint Reader FAILS

When the SafetyNet-Fix module is DISABLED the Phone FAILS Integrity and CTS but the Fingerprint Reader WORKS

Any ideas?
[Android Software Development] pndwal:
Official build is broken ATM anyway... Try this (everyone else is) 😜:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88149057

Edit (Thanks @shoey63):

... Try this earlier, pre-runtime-only (ie. part time) spoofing, @Displax modded build:

https://github.com/Displax/safetynet-fix/releases/tag/v2.3.1-MOD_3.0

👍 PW
[Android Software Development] shoey63:
He already is isn't he?
[Android Software Development] ghosty999:
I am on SafetyNet-Fix v2.4.0-MOD_1.2 and I think he's suggesting v2.3.1-MOD_3.0

Trying this now, will report back
[Android Software Development] ghosty999:
This worked :) thanks for your help!
[Android Software Development] raphytaffy:
Can P7P users with GPay working please chime in with the following:

OTA version:

Magisk version:

Universal SafetyNet Fix version:

+any other relevant info

Thank you in advance!
[Android Software Development] fkofilee:
Anybody a Starling Bank User? With the latest update on P7P to the App and Base OS - I can no longer hide my root. Doesnt matter what I do and it is still being detected.

Its rather peculiar.. .I cant seem to get my head around what they have done to get it avoid it (Guessing they finally got round to updating the APIs etc they use for Validation / Hardware Att?)
[Android Software Development] David B.:
Sometimes, apps will detect root using means other than just SafetyNet/Play Integrity API. Some things that might be useful for getting the app to work are:

Use the Shamiko Magisk module and configure the Magisk denylist to not load Magisk for the Starling Bank app.

Use the Hide My Applist Xposed module to block the Starling Bank app from "seeing" the apps installed on your device.
[Android Software Development] fkofilee:
I tried this and it didnt work - I suspect this is by nature and Starling is able to work around it.

Unless someone with Starling can test this method with the latest update.
[Android Software Development] David B.:
Yeah if these two methods do not work, then unfortunately, you might be right. I do not use Starling Bank, so I am unable to provide further assistance.
[Android Software Development] simplepinoi177:
Are you passing YASNAC, Play Integrity API Checker, and/or TB Checker (everything outside STRONG_INTEGRITY)?
[Android Software Development] fkofilee:
Yeah I am - Sorted it with some help on another thread.

Turns out Starling is using an API call. Import this into Adaway as a blacklisted file as per below; Make sure you select the file accordingly. (Pressing File will open Google's File Explorer etc)

View attachment 5890347

Host it on device or Cloud Storage - itll work

Oh did I mention to reboot? You should really reboot after applying 😂😂
[Android Software Development] Prof. Yaffle:
I use Starling on my 6T with LOS20 and it's started detecting Root for me as well with 26.1. I have Shamiko and Universal SafetyNet Fix Mod. YASNAC is showing Basic Integrity Pass, CTS Profile Match Pass and Evaluation Type Basic. Play Integrity Checker is showing ticks on Meets_Device_Integrity and Meets_Basic_Integrity and Fail on Meets_Strong_Integrity

EDIT

Fixed with fkofilee's information above. Thanks!

EDIT 2

Apparently not. I'm still getting the 14 day warning when quitting the app.
[Android Software Development] Lagartixo:
Same here with Santander
[Android Software Development] fkofilee:
Weirdly Im not... So it could be working - but something local to your device?
[Android Software Development] Prof. Yaffle:
Sorry, I should have updated the thread. It seems to be working now. I had to clear storage on the Starling app and then re-log in and go through the authorisation video again. It seems to be all working at the moment.
[Android Software Development] fkofilee:
Shame its not automated but Starling are one of the best banks around
[Android Software Development] Lagartixo:
I solved my problem with Santander. See this post
[Android Software Development] ms70019925:
I tried this but doesn't worked with netflix, you can see here in the video. Netflix still display the same "Sorry, we could not reach the Netflix service. Please check Network Settings to connect to an available network and use Netflix (15001). (-93)".
[Android Software Development] inzaghi89:
For me workaround for Netflix was installing it from pc (play.google.com) and let it install on my pixel phone.
[Android Software Development] pndwal:
You can use his up to date v2.4.0-MOD_1.2 build now, but it won't make a difference to Netflix... You see have issue with network... Adblock settings / host file, firewalls, other?...

Netflix no longer checks S/N or PI API verdicts... It does require Widevine DRM L1 certification for HD content decoding, but you should still be able to connect for SD content even w/ L3...

👀 PW
[Android Software Development] davwheat:
I've started to have issues with Safetynet on the P7 Pro recently. May be related to A14 beta.

I get a response signature validation error when using 2.4.0_MOD1.2 or 2.3.1_MOD3.0.

Any ideas?
[Android Software Development] chiteroman:
Share screenshot. Maybe USNF isn't compatible with A14.
[Android Software Development] davwheat:
I think it was mainly an issue with the app I was using to check it. YASNAC says it's fine.

The app I had issues with is likely detecting root another way.
[Android Software Development] Nergal di Cuthah:
Is deprecated, checks Safety Net which is no longer used. You need to use play integrity checker like https://github.com/1nikolas/play-integrity-checker-app
[Android Software Development] David B.:
While it is true that SafetyNet is deprecated, it's still worth checking that it is properly working since there may be some apps out there that still use it. At the very least, it is worth ensuring that it works until June 2023, and at most, until June 2024.

Discontinuing the SafetyNet Attestation API | App quality | Android Developers

developer.android.com
[Android Software Development] davwheat:
Integrity API only reports basic integrity, which is the expected behaviour, I believe.
[Android Software Development] David B.:
Yes, this is expected.
[Android Software Development] chiteroman:
Nop, you should pass basic and device
[Android Software Development] David B.:
Oh, yes, I forgot about that device. Sorry.
[Android Software Development] davwheat:
Well yeah, I mean basic integrity and below.
[Android Software Development] Nergal di Cuthah:
You passing is the two top test hardware (the third) is tripped if you've unlocked bootloader (i believe, correct me if I'm wrong)
[Android Software Development] zgfg:
What do you mean by "below"?

In the PI API Checker, Device Integrity is first (on top), Basic in the middle and Strong is below (bottom) - and you are not expected to pass Strong Integrity
[Android Software Development] Nergal di Cuthah:
You mean locked right?
[Android Software Development] zgfg:
Yes - thx, I corrected
[Android Software Development] davwheat:
Well device integrity is the most basic check, then basic integrity, then strong integrity.
[Android Software Development] zgfg:
Ok, you mean that way
[Android Software Development] chiteroman:
If you have a broken TEE you can pass strong
[Android Software Development] pndwal:
It's expected you'll pass none with root and no hiding/spoofing... With up to date USNF you should pass deviceIntegrity... Most banks have now migrated to this.

... On the other hand S/N pass can be assumed if you have PI deviceIntegrity since PI has only added signals checked, eg permissive selinux and extra props for per device hardware-backed verdict enforcement.

Nb. The original model prop mismatch to bypass per device hardware-backed verdict enforcement for some devices in S/N is still required by those same devices using PI...

👀 PW
[Android Software Development] pndwal:
Does Momo report 'broken tee'?...

With ROG Phone 3 TEE was reportedly intact; we concluded that droidguard or other was mishandling AVB signals...

Also, out of interest, what do you see in Key Attestation app, especially under 'Root of trust's?

'broken TEE' even as reported by Momo is really a misnomer anyway... It's really just the keymaster implementation specific to device integrity attestations that is broken in this case... TEE OS (usually Google's TrustyTEE unless OEMs prefer other) still works fine, eg for biometric measurements or decoding Widevine DRM content... PW
[Android Software Development] chiteroman:
Using Magisk Alpha with MagiskHide and Zygisk disabled:

View attachment 5896007

Asus rog phone 3 has a broken bootloader not TEE, that's why @shoey63 can pass strong, because the bootloader is completly broken and show as locked even if is unlocked, so TEE didn't get disabled. Mine is different because my bootloader works fine, but I managed to completly broke TEE that's why in official ROM I can't pass CTS/Strong and in Xiaomi.eu (spoofs a lot of sensible props) I can. But Momo or Key Attestation Demo shows a unlocked bootloader due to hardware check.

So:

Asus rog phone 3 -> Broken bootloader (OEM's problem)

My Xiaomi -> Broken TEE (bug caused by me)
[Android Software Development] chiteroman:
And Key Attestation Demo:

View attachment 5896019
[Android Software Development] chiteroman:
One question @Displax your module safetynet-fix bypass Google Play protect certificate? Fixes CTS profile? I will recompile it changing this:

View attachment 5896045

to my own phone so I will force HARDWARE_BACKED evaluation and see if I can bypass Strong. Because xiaomi.eu fixes sensible props (and I can bypass Strong) I want to check it in official ROM.
[Android Software Development] pndwal:
Are you using an old Alpha build? I think MagiskHide has long been removed from Alpha. 🤔 (... Perhaps you mean not hiding/obfuscating the Magisk App??)

You mean it doesn't pass with bootloader locked?... Because it's expected not to pass unlocked, unless you mean it doesn't with Magisk and @Displax modded USNF...

Sensitive props?

It's interesting, but Momo isn't saying 'TEE is broken' as it does with OnePlus etc devices with broken keymaster implementations...

Also Key Attestation app clearly shows TEE is working as Verified boot state is properly showing Bootloader is unlocked, Device locked:false and Verified boot state: Unverified (Orange state) for unlocked bootloader w/ an OS installed... (FWIW failing AVB shows 'Failed' / Red state.).. So clearly the issue is only with the attestation measurements collected by droidguardVM (the device integration attestation engine for gms) or it's handling of them or transmission to gms via the com.google.android.gms.unstable service...

Please run DRM Info app; if you have L1 security and you can stream HD in Netflix etc, TEE has to be working too... Also, a fingerprint scanner that's working is another indication that TEE OS and memory is intact since ARM processors keep biometric fingerprint data/algorithms securely on the physical chip usd by TEE TrustZone. (Some phones like the Google Pixel us a dedicated off soc security chip, eg. Titan M2, for these functions.)

... Actually I agree that on @shoey63's device BL signals are being mishandled/misrepresented... I doubt BL is "completely broken", but chain of trust certainly is...

BTW, if ROM passes deviceIntegrity w/o Magisk, all you should need to do on installing Magisk is hide root from gms by adding the droidguard/attestation gms (Google Play Services) process com.google.android.gms.unstable and the main gms process com.google.android.gms to denylist... (Don't use any USNF).

It would be interesting to confirm you still have strongIntegrity passing in this case... I'd be surprised if you didn't... 🙂 PW
[Android Software Development] pndwal:
As I said above, you don't need this module!

With current XiaomiEU ROM; just add the gms processes mentioned to denylist...

The main function of USNF is to 'force' BASIC attestation (exception produced by fake keystore registration causes fallback) and the mismatched fingerprint and other props are to bypass hardware-backed verdict enforcement at Google server end for a number of devices otherwise identified by these props...

The fake keystore alone will break strongIntegrity necessarily, but you're trying to reverse just the secondary function props... If you reverse both the fake registration and the props, you're basically left only with sensitive prop manipulation...

So just don't use it at all! You don't need it! (Might want to read @kdragon's description of what it does.)...

Just do as i described with XiaomiEU.

With stock ROM, add these same processes and additionally run MagiskHide Props Config module (don't configure anything... Sensitive props are set to 'happy' values by default if it's active) and you should pass all the verdicts without USNF... Also, I believe Shamiko also adjusts to sensitive props so if you run that you shouldn't need MHPC to pass...

👀 PW
[Android Software Development] chiteroman:
Magisk Alpha has MagiskHide and it works well. I use it when I don't want Zygisk turned on.

Asus rog phone 3 reports a locked bootloader always, so TEE never "turn off", that's why he can pass PI in official rom.

Yes. They use "private" methods (maybe just a copy-paste of USNF).

My TEE isn't broken at all, it just accepts anything as valid even with unlocked bootloader. Looks like I break the "channel" between bootloader and TEE.

I have Widevine L1, xiaomi.eu already patch that in supported devices:

View attachment 5896235

With official rom I can't pass Strong because I fail Device due unlocked bootloader, that's why I need a patched USNF for me.

I tried that and not, in official rom using Shamiko + MHPC I can't pass Device, so Strong will always fail.

But in xiaomi.eu rom works, maybe only work with this rom? xD
[Android Software Development] chiteroman:
Also remember that xiaomi.eu devs don't know how I get 2 evaluation types: https://xiaomi.eu/community/threads/meets_strong_integrity-pass-bug.68941/

View attachment 5896239
[Android Software Development] chiteroman:
Also I didn't know if it works with AOSP rom, never tried it.
[Android Software Development] shoey63:
I can get perfect momo

View attachment 5896245

Perfect TEE Attestation

View attachment 5896255

But no more hardware backed attestation since Google blacklisted Rog 3

View attachment 5896261

But I'm hopeful that could change. Just need some ingenious dev to crack it🤞

Edit: Thought I'd try re-locking the bootloader and do some more tests. Forgot I still had twrp in the recovery partition and spent all afternoon unbricking the device. 😂
[Android Software Development] btonetbone:
I had something similar when I had too many apps (literally almost all of them) selected in Magisk Hide. I've since become much more judicious with Magisk Hide, and all my instability issues went away. Not sure if that might be the same issue as you, but the problem sounds similar!
[Android Software Development] icanrule:
You helped me figure it out. I forgot about all the stuff I did before finding this patch to fix the problem. I used magiskhide to hide Google and Google services framework. I read to try to hide as many Google things as I could. It turns out hiding things can break the phone.

Thanks for the help everyone.
[Android Software Development] Dante63:
By any chance, do you know how to revert this?

Can I restore the fingerprints and throw away the safetynet?
[Android Software Development] Lord Sithek:
Anybody experience late notifications when the module is installed?
[Android Software Development] tlxxxsracer:
So it seems guides are confusing.. I deleted MagiskHide Props module to remove the previous working workaround..

I flashed this module and can't pass.

Guides say just flash this and that's it and yet OP says you must pass basic CTS. Then when I read about selecting pixel 3a as fingerprint edit, people say this isn't needed anymore.

After flashing this module, my pixel just sits at "pixel is starting" now.

Using pixel 5 btw
[Android Software Development] sliding_billy:
Took the new Canary build of Magisk (as of a few hours ago). My wife's Pixel 3 running stock rooted Android 11 continues to pass with this module. Now, my Pixel 3XL running DU (Android 10) will not pass anymore.
[Android Software Development] Yarsan090690:
Hi. I have lg v30 plus h930ds. Lineage os android 11. I lost my fingerprint settings after I did everything according to the instructions from the header. Safetynet now passes, but I can't add a fingerprint. How to fix it?
[Android Software Development] assumingyogi:
I am using poco F1 (corvus 10) magisk shows attestation failed but I can use Google pay
[Android Software Development] SupertardMC:
I'm running Pixel Experience BETA on my Google Pixel 2 (so Android 11.) I have manually de-googled it and have also enabled signature spoofing. microG is installed systemlessly through Magisk and has all check marks checked (for location I use deja vu and nominatim.) I can't pass safety net. I have MagiskHide enabled, and have installed MagiskHide Props Config (I already configured), Systemless Hosts, and Universal SafetyNet Fix (the latest of each.) Is there anything else I can try to pass safety net? Thanks (I'm also going to start my own thread elsewhere and will post the solution there if I get one here)
[Android Software Development] Lolitary:
I'm newbie for rooting device no matter how many i follow instruction on the internet i can't pass cts for my Note 9.

But after installed this module finally PASS!
[Android Software Development] Dante63:
I'm struggling with that as well, late or no notifications at all...
[Android Software Development] Lord Sithek:
Huh. So I'm not crazy 😝 It seems that the module can have some impact on the notifications... Meanwhile I cleared data and reinstalled all my social apps, so far it seems that that it helped... You can try
[Android Software Development] AngusYoung14:
Hello I have your very same problem on a POCO phone, already tried 3 different ROMS and followed the same steps, MicroG with all marks checked, also tried Magisk modules one at a time but no success.
[Android Software Development] Dante63:
I have to probably reinstall many apps to re-register their notification services... but still, I'd rather have the safetynet fail because I want the biometrics to work again, I'd appreciate if someone knows how because disabling module doesn't fix it...

EDIT: To fix notifications, you don't need to clear data or to uninstall and install the app, you only need to reinstall it... what I do is use titanium backup, make a backup on all apps then batch restore apps only, this will register all apps in notification service if app not found...
[Android Software Development] BrimoFan123:
I had Universal SafetyNet Fix installed and enabled on my phone rooted with Magisk 20.4

It worked perfectly fine: both safety checks passed.

I wanted to test if Universal SafetyNet Fix is the root cause of the issue that KeePasDroid lost fingerprint authentication so I have disabled Universal SafetyNet Fix in Magisk Manager and rebooted the phone.

Now I can't logon at all: fingerprint doesn't work, PIN doesn't work - phone just not unlocking.

I flashed stock ramdisk and using adb root -> adb shell I have deleted "disable" file from /data/adb/modules/safetynet-fix ->>> still can't logon.

I flashed patched ramdisk with Magisk 20.4 ->>> still can't logon to phone - fingerprint nor PIS doesn't work.

Please let me know I can somehow recover my phone.
[Android Software Development] Lord Sithek:
I don't know why you suffer the issue, but take a look here to recover your phone:

https://xdaforums.com/t/remove-bypass-lockscreen-with-recovery.3530008/

Hope it helps.