yashsingh1/xdaforums huggingface dataset:
[Android Software Development] pndwal:
As you likely know, there are serious issues w/ official USNF 2.4.0 (w/ new fixes for PI deviceIntegrity)... I'd be using @Displax's first modded USNF fork w/ his own working PI fixes from here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87198517

for this reason... (Read his notes in spoiler)...

At first glance your issue seemed to relate to Xiaomi EU custom ROM integrating SNF per @kdrag0n's recommendation...

Personally I prefer clean ROMs that don't integrate prop spoofing based 'fixes' etc because they often conflict with Magisk modules trying to do the same thing... They may be fine without Magisk (eg you seem to be passing PI deviceIntegrity w/o Magisk w/ your ROMs implementation which likely forks the @Displax commits anyway) but cause unexpected surprises for Magisk users...Also, SNF applied to ROMs per @kdrag0n's notes for his Proton ROMs may play well with Magisk USNF module until the latter is updated; seems users may need to wait for their ROM Devs to update inbuilt SNF to match USNF when that occurs...

But now I see your SELinux is set to permissive!?!? Why? 🤔 ... Is that an official XiaomiEU custom ROM or unofficial build?... Have you disabled Linux security using a recovery flashable mod or other?... Done any other mods?...

... I'd uninstall XPrivacyLUA also, but note banks often detect this even after uninstalling as it doesn't clean up properly... Remove data/system/xlua folder to prevent this detection...

🤠 PW
[Android Software Development] thomas140:
Thanks for your reply. The miui Eu is based from the official miui Eu website.

Also, I'm using the Displax modded USNF

Yes, I found the issue.

The magisk 25.2 is the problem.

I used the magisk 24.1 and manage to resolve the integrity issue except the strong integrity.

As for the selinux to be permissive, it's because the viper4android doesn't work in enforcing under magisk 25.2.

Now that I have changed back to magisk 24.1, viper4android is now worked with enforcing now, so permissive is not needed anymore. 😁

As for XprivacyLua, manage to delete the folder and get applist detector cleared.

But the banking app still manage to find the root.

I tried to use ice box app to freeze magisk, hide my app and greenify but still the same issue.

Is there any solution to bypass?

Attached is the screenshot of detector after ice box freezes those apps.
[Android Software Development] Sasy969:
Hi guys, I need your help. I'm on latest Evox with no root, but suddenly wallet stopped working saiyng that my device didn't meet safety requirements, how can I solve?
[Android Software Development] pndwal:
Yes, I know that... I meant is it official custom XiaomiEU or some unofficial build as I asked... But seems you set permissive SELinux yourself... Doubt you'll pass deviceIntegrity easily with that set...

How is 25.2 a problem?

Permissive has not been needed for Viper4AndroidFX for a long while; you don't need old Magisk... And you still didn't describe what mod was used to switch SELinux... If you made system changes you may still have issues after reverting that...

How would I know?... You haven't even named the app!... 🙃 PW
[Android Software Development] pndwal:
My car won't start... How can I solve?... BTW, it's a green one... 😜 PW
[Android Software Development] pndwal:
Clue: Read back a bit before posting... PW
[Android Software Development] DartGerion:
Should i disable Revanced module and Substratum? Doesn't seem to be really necessary.
[Android Software Development] Sasy969:
Sorry to further bother you, but I have read the last 3/4 pages and i I have read only about other users with root, but i have the same problem without root.

I get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY, but still wallet says i don't meet safety requirements.

I also have tried with magisk and USNF 2.3.1 Modded but sometimes I get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY and sometimes I don't, like other users earlier
[Android Software Development] osm0sis:
Why are you in a root module thread if you don't have root. Of course it won't pass without root. 🤦‍♂️
[Android Software Development] thomas140:
1. It's official custom xiaomi EU.

2. Yes, understand that viper4android doesn't need to be permissive but I found that it can't run under enforcing anymore since I upgraded to Magisk 25.1 and then to 25.2.

But I saw you got mentioned that it's not easy to pass device integrity with selinux permissive. So I just tried magisk 25.2 again with selinux enforcing, this time, the Cts profile, Device and Basic integrity become Pass except the strong integrity.

And Viper4android status suddenly becomes normal with selinux enforcing.

Previously, I was using selinuxmodechanger app to change selinux, and now, I don't need it anymore.

Not sure which step fixes this viper4android issue that haunted me for 1year 😑

3. The banking app that still detect root is Ocbc Digital- Mobile Banking app(Singapore version). You can try to download the app via link below and test whether can hide from this banking app.

https://ocbc-digital.nl.aptoide.com/app

Attached are the screenshot of the integrity status and selinux changer app.
[Android Software Development] Sasy969:
I have the same problem also with root.

Btw i have always used my phone without root without any problems.

I attach some screenshots of my current setup. As i said before sometimes I get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY and sometimes don't
[Android Software Development] pndwal:
I already said "all modules disabled except USNF"... You can put stuff back after fixing issue (then you'll know if any break integrity verdicts), but test w/ essential mods only...

...And I asked you:

because it's not clear what "still doesnt pass the integrity" means... Do you mean deviceIntegrity or strongIntegrity here???... If not passing deviceIntegrity (and I suspect you are now), please show YASNAC results also (after disabling all modules except USNF) as I requested... PW
[Android Software Development] pndwal:
You still haven't given any details about your setup...

I'm guessing you're running a custom rom however, one that integrates SNF, and it's likely that you've taken an update recently and that the ROM dev may have already integrated USNF 2.4.0 changes for SNF with that update... If so inbuilt SNF solution may be conflicting with your downgraded USNF builds...

I'm not a fan of integrating SNF or other prop spoofs etc in ROMs as users must wait for ROM Devs for fixes and I've seen too many issues/conflicts with Magisk modules...

Ordinarily one of @Displax's modded USNF builds alone should have sorted you out for now...

Please say if I'm in the ballpark with you configuration, and give us some details!... PW
[Android Software Development] DartGerion:
M

Bro, calm down a notch. I'm asking about the necessity of disabling the modules just to clarify the situation, no need to get irritated. Should i just toggle the switch off or also reboot after toggling off?

The YASNAC screenshot is on the attachments. I'm not passing any Integrity, as the json log stats that integrity is UNEVALUATED.
[Android Software Development] pndwal:
What makes you think I'm irritated/not calm?...

But I'm not going to help if when I ask for details/confirmation, you totally ignore the question(s) and just ask more of your own...

...Two way street... PW
[Android Software Development] DartGerion:
You are absolutely right, it should be a two way street. With YASNAC screenshot, i totally overlooked it while reading, my apologies.

I'm not accusing you of anything, just the tone seems a bit irritated, but it's also understandable, seeing how many messages there recently are of people having a lot of problems with integrity and Gwallet.

I'm invested as much, as i could be, to solving this issue and to help others, who might face similar problems and i kindly ask for your help in this matter.
[Android Software Development] Sasy969:
Thanks for your replay. In my first post i have said that i am on the latest Evox, i have asked in the telegram group of the Rom and they said that the ROM doesn't have any kind of USNF integration that could cause some conflicts.

Also in the first post of the page i have attached some screenshots of my actual configuration:

Custom ROM : Evox

Magisk installed

USNF module: 2.3.1 modded by Displax.

No other module are installed.

Since this morning i fail all the integrity check as in the screenshot.

EDIT: Tried to install USNF 2.4.0 and i get the first two check
[Android Software Development] pndwal:
Ah yes... So EvolutionX ROM...

Well how can you pass integrity verdicts at all?... Unless device launched w/ A7 or earlier...

Anyway, seems your info is flawed... This indicates official EvolutionX official does integrate spoofing for S/N and PI:

https://t.me/EvolutionX/647435

This generally means they pull code from @Displax's USNF pull requests, his own forks and/or @kdrag0n's implemented code for custom Proton ROMs etc...

But we don't know what device AFAICS... Is it very old???

And have you tried simply adding com.google.android.gms.unstable (and may possibly need com.google.android.gms also) to denylist w/ Magisk installed and NO Magisk modules at all?... Please give that a go and say if verdicts are any more consistent/stable...

🤠 PW
[Android Software Development] Sasy969:
I'm so sorry about the wrong information I have given to you, but It was what i was said in the chat group.

My device is pretty recent (One Plus 9), I have just tried following you suggestions and I have eliminated USNF module.

com.google.android.gms.unstable and com.google.android.gms were already added to the denylist.

At least for now my device get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY.

I will try again during the day, for now I thank you for your help and apologize for my poor knowledge.
[Android Software Development] pndwal:
All good/all right then...

So no problem with main USNF fallback / prop spoofing since I believe you don't even need these on OnePlus 7TPro... You can check in Momo to confirm... It'll say TEE is broken if you don't need these fixes (actually it's not, but Devs mean keymaster implementation, part of which is processed in TEE, is broken)

Yup, need to reboot... Magisk = magic mask ie. a system overlay applied systemlessly (modules comprise part of that) loaded at boottime, so modules aren't disabled till reboot...

Your deviceIntegrity has been evaluated properly (returning blank value) but appIntegrity and accountDetails haven't been evaluated since failing deviceIntegrity invalidates these...

Anyway, it seems something is now breaking PI's more sensitive basicIntegrity verdict... Again, please report check w/ all modules disabled except USNF... This user also had passing S/N but failing PI basicIntegrity due to modules on OnePlus 7 device w/ stock ROM:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87891641

Also, please check your selinux status is enforcing regardless of results disabling modules... (Are you a viper4android user?)... PW
[Android Software Development] Sasy969:
I have tried again and now i fail all three integrity check as can been seen in the screenshot below.

Current setup

OP9

Magisk installed

Custom ROM Evox

No USNF module installed

com.google.android.gms.unstable and com.google.android.gms added to the denylist
[Android Software Development] memocatcher:
A few days ago I randomly got the message from Wallet that my device doesnt meet the security requirements to use Wallet. Before that, everything was fine with USF 2.4.0 installed. I checked the Play Integrity status and it now only shows a green check for basic integrity and device integrity, but not for strong integrity.

Is it supposed to be like that? Or does strong integrity normally works as well with USF installed?
[Android Software Development] rxmp:
Same situation. Does anyone know how to fix this? Every module is up to date.
[Android Software Development] pndwal:
All good for you now then re deviceIntegrity then... Expected results...

Is it Viper4AndroidFX?... I think you only have issues with Neon driver only when installing/changing to legacy mode... If you didn't reinstall V4A you shouldn't have the issue...

You just need to reset Neon driver when selecting legacy mode... When you reinstall in future or have driver = abnormal, just set legacy mode, disable the module, reboot, re-enable module and reboot again... driver should have reset and status should now be Normal...

I wasn't able to hide root/modified environment from this app with my setup... Sorry... PW
[Android Software Development] pndwal:
Folks, please read back a bit before posting here to save unnecessary repetition... 👍 PW
[Android Software Development] pndwal:
That's interesting... Did you add, or does ROM add?... And if you remove them, are the added again with reboot?

I ask because USNF removes these at boot if manually added as they'll cause conflicts w/ USNF if denylist is enforced... (There's no conflict if proper hiding using Shamiko etc is employed however.)

If they're added at boot by ROM, this may be the source of the conflict w/ USNF module... Simply allowing that to happen but using Shamiko (denylist NOT enforced) may possibly fix issue with USNF installed...

We're all learning here... Please report your mileage... PW
[Android Software Development] DartGerion:
Hey.

So with all modules (including USNF) the safetynet and PI Integrity shows "Not passed" (Duh).

The MOMO shows just that it found the SU folder and detected Magisk.

When everything excluding the @Displax modded USNF is turned off (and also Play Services data cleared) the results are on the screenshots below. Note: Deny list is enforced and only Google Wallet and some banking apps are added, nothing more.

YASNAC passes with flying colours. The device integrity in 2 apps fail to be checked and return UNEVALUATED results. Json is also attached.

What's baffling is that even now, the Google Wallet worked (I checked it now in the supermarket terminal).
[Android Software Development] thomas140:
Never mind then.

Anyway, thanks for your explanation, at least some issues have been resolved..😎
[Android Software Development] ipdev:
Adding gms processes to the denylist will do nothing unless you are enforcing the denylist or using another module that sources the denylist.

If your rom incudes integrity (SafteyNet) fix(s). Try enforcing the denylist in Magisk and see what happens.

Note:

Make sure to clear cache/data of PI checker before testing again.

Might also have to clear cache/data of PlayStore/PlayServices and let them update again.

SafetyNet (com.google.android.gms.unstable) is required.

Main GMS (com.google.android.gms) is only required if Magisk is not in /sbin.

It can/will cause problems if GMS is added when not required.

Cheers. :cowboy:
[Android Software Development] ipdev:
You can still use Displax's mod version on devices released with Android 13.

You just need to edit the service script after installing the module.

Add the fallback to the service script and then reboot.

if [[ "$(getprop ro.product.first_api_level)" -ge 33 ]]; then
resetprop ro.product.first_api_level 32
fi

USNF - [Github] - commit

Cheers. :cowboy:
[Android Software Development] fkofilee:
Yes sir. Same here - Uninstalled GW, wiped Google Store and Play Services. Disabled 2.4.0, pulled the modded version from @Displax and installed then rebooted. Downloaded GW - Added cards and all good. For now...
[Android Software Development] Displax:
No need to edit, this change already present in my MOD
[Android Software Development] BrimoFan123:
I wasn't able to add bank card to the Wallet.

Using Magisk Alpha which is hidden,

Google Play Services and Google Play Store added to DenyList,

Shamiko and Universal SafetyNet Fix 2.4.0 are installed,

Play Integrity API Checker says Device and Basic Integrity pass,

YASNAC says Basic integrity and CTS profile match both pass

I have clear data for Google Play Services, Google Play Store and for Wallet, phone rebooted but still getting: "Couldn't finish setup to pay in stores. This phone can't be used to pay in stores"

Then I have uninstalled USNF 2.4.0, reboot, installed safetynet-fix-v2.3.1-MOD_2.1.zip and finally bank card added to the Wallet.
[Android Software Development] pndwal:
Yes, I missed something in JSON... While Unevaluated results DO NOT apply to deviceIntegrity as I mentioned already (These are for appIntegrity - appRecognitionVerdict and accountDetails - appLicensingVerdict ... These are different signals from deviceIntegrity within the new Play integrity verdict), I'm no longer sure deviceIntegrity is actually supplying a proper response since while documentation says "device_recognition_verdict can have one of the following labels:

MEETS_DEVICE_INTEGRITY

No labels (a blank value)

MEETS_BASIC_INTEGRITY

MEETS_STRONG_INTEGRITY

MEETS_VIRTUAL_INTEGRITY"

the value"deviceRecognitionVerdict": generally appears before labels, and that is missing altogether...

https://developer.android.com/google/play/integrity/verdict#device-integrity-field

Of course a blank value is really No label as seen above, so

"deviceIntegrity": {},

may still be a properly evaluated response... I'm just not sure...

I'm still leaning towards the latter being the case, but I'm equally confused by working Wallet/contactless payments...

do JSON results change now modules are removed w/ a flush of Play Services data?

Nb. If deviceIntegrity correctly = blank/no label, this is what is indicated:

and it is clearly a more sensitive detection than old basicIntegrity for S/N... and this is why I mentioned:

Apart from permissive SELinux, you may break system partition/digest checks if you have ever run ANY system mods (even changing simple file permissions), eg twrp flashable mods etc, and even if you have fully reverted these, on current ROM... If you suspect this, flashing system again should fix...PW
[Android Software Development] pndwal:
Thanks for your experience/confirmation per recent discussion here!... My initial experience here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88049087

👀 PW
[Android Software Development] pndwal:
Ah, ... And that I suggested you add these slipped my mind when I responded:

so please disregard that unless ROM is also pre-rooted as of course ROM won't/can't usually do that... It doesn't need to hide root from gms attestation/droidguard as superuser permission doesn't exist... Could still be an issue in case of pre-rooted ROM however....

Seems something is breaking PI deviceIntegrity spasmodically for you however... Please see my post to member above for clues...

Yup, but member was passing like that:

but when trying again later on same day it failed... I assume no configuration was charged...

It does...

Member did...

I've never had this or most other checkers cache results... I may be wrong however...

Good points...

I only suggested doing this, which has worked at least initially, w/ Magisk installed but NO USNF module...

This alone is generally needed for ROMs integrating SNF w/ Magisk installed since SNF is achieving needed fallback and enforcement bypasses as well as altering sensitive prop values, but not generally hiding root from gms attestation/droidguard process etc... I assume a pre-rooted ROM would need to do that itself also however if integrating SNF...

🤠 PW
[Android Software Development] thomas140:
Hi again,

Just to update something here.

1. I manage to access the banking app with rooted poco f1 after so long.

I installed the Shamiko module and turned off the enforce denylist. Voila, all banking app issue resolved!!! 😁

2. I found that there is an app become forced closed if I root. When dirty flash back the same rom and become unroot, the app can be opened as per normal.

Do you face such kind of issue before?

Btw, the app is called TNG ewallet. It is a Malaysia app used by many Malaysian people here.
[Android Software Development] pndwal:
1) Interesting...

I wasn't able to hide root on RN8T w/ Shamiko for this, however

2) Have no issues opening TNG eWallet using LSPosed and HMA module... See here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87873291

🙃 PW
[Android Software Development] DartGerion:
Hey

Thank you for the reply. With all modules removed the JSON is same, only with "nonce" value changed.

I haven't installed the TWRP (No twrp for my phone), however i've used a Magisk module that tweaks some stock kernel issues. I've already deleted the module, but apparently the traces are what causing this issue.

I think i need to look into flashing the stock ROM, and trying again with Magisk and modded USNF.
[Android Software Development] thomas140:
Under LSPosed, I have HMA and Greenify.

In HMA, I added Greenify, HMA & hidden magisk app named WWE 🤣. But TNG app still forced closed. (Can refer to screenshot)

Wonder where did I do wrong though.

As for the root, that's what I did:

Under Magisk

- turn off enforce denylist

- Shamiko 0.6

- the modded usnf you recommended.

- zygisk lsposed 1.8.6

You may refer my screenshot to check where is the missing one. I can access to banking app even though the applist detector showed as attached.🤔
[Android Software Development] pndwal:
Detector should look like this:

View attachment 5823555

Greenify, HMA & hidden magisk app (named WWE) should be in a template used, in turn, for bank apps since you need to hide all these (especially Magisk) from banks! 🙃

You don't need them in App Manage list since there's no need to hide other apps from them... 😉 PW
[Android Software Development] thomas140:
Well, I manage to use banking software with the applist detector incomplete result as shown in my screenshot earlier.

I tried your suggestion. Put magisk, hma, greenify in the blacklist template to be invisible, put TNG app into app manage.

Apparently, the issue still persists.

Also, I have put the application detector in the app manage as well. The result is thay it can't find all these 3 app, meaning that the hma module is working🤔
[Android Software Development] pndwal:
If you suspect any system changes (as opposed to systemless) changes/mods have been applied, even dirty flashing ROM may fix the issue... PW
[Android Software Development] Bxperiaz3:
My pixel 7 pro is rooted since October. Always used this module without issue and then yesterday it blocked contact less Google pay, I used magisk to hide extra play services parts and cleared the play store cache. Was ok for a few taps and now I have the same issue again. Is there something else I can try?
[Android Software Development] Nergal di Cuthah:
Which version are you using, official or mod?
[Android Software Development] Bxperiaz3:
Of this module? Official. 2.4.0
[Android Software Development] Nergal di Cuthah:
Read above some, 2.4.0 is randomly dropping protection for some.
[Android Software Development] xabier-bo:
It's not my intention to double post, but maybe it's more relevant here what I wrote in other thread

Couple of weeks ago I found strange "card rejected" messages while paying with gwallet. But immediately, after the first failing attempt it was accepted.

Then I read the posts here sharing new problems, while everything had been working fine until now.

So I checked the gwallet app (I never look at it), and discovered it was complaining with the "old" message: this device doesn't meet...

I wiped apps caché (google play and gwallet), rebooted, got a first complaint of not meeting requirements, but closing and reopening the app made it disappear.

So, I decided a more "conclusive" approach. I went to the supermarket and payed with the gwallet without any problem.

So, this is my situation: I've had to downgrade nothing, I've kept USFN v2.4.0 by kdrag0n, and I'm paying with gwallet.

Hope it's helpful for your "diagnosis"