yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
So assuming zygisk = yes on home screen and it's TJW, I'm guessing something in Magisk config files may have gotten messed up; not unheard of especially if you've used unofficial builds or downgraded w/o complete Magisk uninstall...

May not be this at all, but if you want to test clean Magisk config, simply use a root explorer to delete all contents of /data/adb and reboot... Cong files will be rebuilt...

Nb. You'll need to set up all modules, SU permissions and Magisk settings again... PW
[Magisk] 10Maximus10:
Still doesn't work
[Magisk] pndwal:
Please show screenshot of Play Integrity API Checker raw JSON response... Click '< >' at top after Check, also YASNAC Check and JSON output...

Also, try booting with all Magisk modules disabled other than @Displax Mod fork USNF, have Zygisk enabled and Denylist Enforced...

Also, have you flashed a custom recovery or any mods from recovery or flashing utility? PW
[Magisk] 10Maximus10:
I will try it. I installed twrp and a patched kernel to avoid bootloop other than that I don't have any mods.
[Magisk] pndwal:
So no MagiskHide Props Config anymore? ... What patched kernel? Custom kernel?

Anyway, you got 'Unevaluated' responses in PI checker... This means:

So there's abnormal issues with your device causing it not to be trusted; you're not getting either Hardware or Basic Evaluation for PI API, just a failed response...

You may need to install full stock ROM and avoid your 'bootloop' patch to restore device trust for these verdict labels... PW
[Magisk] 10Maximus10:
its stock kernel with a patch that i need because without it my phone can boot only to twrp and I don't use magiskhide props config because i think its what caused issues with youtube before I restored the stock rom using the official lenovo tool for rescuing a broken phone
[Magisk] 10Maximus10:
I think i know whats causing this issue when i tried to restore system from a backup in twrp something broke and i was getting "can't mount "/mnt/vendor/persist" device or resource busy" now when i go to that path there isn't a vendor folder but all sensors work fine
[Magisk] pndwal:
Try dirty flashing a fastboot ROM again (recovery ROMs are generally not complete), fastboot Magisk-patched boot img and see if you can PI check will work... If it does I'd be inclined to leave it w/o TWRP or kernel patch... Why do you want TWRP anyway?

In any case at least you'll have confirmation bad configuration is rectified and can then try your luck again w/ TWRP and kernel patch if you wish... PW
[Magisk] 10Maximus10:
So I have to flash the stock boot.img?
[Magisk] V0latyle:
It seems pretty clear to me that he recommended flashing the Magisk patched boot image...
[Magisk] 10Maximus10:
Still says unevaluated.
[Magisk] pndwal:
Looks like some unusual mods are used (needed?) for this device... eg:

https://github.com/topjohnwu/Magisk/issues/4435

Are you sure your setup is now mod free apart from @Displax modded USNF?... If so I can only suggest trying a clean install, but it's probably a long shot... I'm not sure what Google detects for non-trusted device... It's likely there's some peculiarly w/ G7 ROM, but I don't know what... All the best... PW
[Magisk] 10Maximus10:
Japierdole I didn't do anything and it fixed itself. Now I can finally use Netflix and other apps. Thanks for helping.
[Magisk] V0latyle:
Gremlins.
[Magisk] V0latyle:
So, in terms of root detection...Aside from what we have already covered in Play Integrity, in what ways can an app "detect root"? I would assume that any app can see whether Magisk is installed by looking for a specific package name, but if Magisk is disguised, how else? Is it possible for an app without root permissions to detect the presence of the SU binary?
[Magisk] 10Maximus10:
Yes it is possible, Momo is an example. It's also possible to detect it by checking if Xposed is installed.
[Magisk] zgfg:
Ok, what of my four Momo detections would you attribute to my Zygisk-LSPosed?

Second and fourth definitely not.

I'm pretty sure that first and third are also not related to LSPosed

Actually, I have the same four detections when LSPosed is disabled, and I have the last three detections if I boot with the not-patched boot.img (hence, without Magisk)

Hence, none of the four would be related to Zygisk-LSPosed
[Magisk] 10Maximus10:
I didn't say Momo detects it. I said that an app that looks for root can detect it.
[Magisk] V0latyle:
USB debugging is considered suspicious? Wut.

Momo shows Su executable found and Magisk found.

Pixel 5, stock software, only systemless hosts and USNF modules.

So su can be detected then.
[Magisk] 10Maximus10:
Shamiko hides su executable and Magisk so it's not a problem.
[Magisk] zgfg:
Ok, but I argue that the fact that I have Zygisk-LSposed installed, does not attribute to any of my Momo detections

Neither for Ruru, TB-Checker nor SCheck - all those three fully pass in green not finding anything

NB:

TB-Checker extensively looks for XPosed artefacts but it fully passes in green

And actually HMA module for LSPosed helps to pass things for TB-Checker, SCheck and Ruru
[Magisk] 10Maximus10:
Also I'm not sure but setting SElinux to permissive at least from my experience might make cts profile match or device integrity fail.
[Magisk] zgfg:
Yes, if I recall the specs correctly, permissive mode is one of the checks for cts-profile attestation
[Magisk] 10Maximus10:
I thought that lsposed can be detected because when I recently reflashed the stock firmware for some reason no matter what I did PI api always detected device modifications and failed so I thought that lsposed can also be always detected by some specific app.
[Magisk] 10Maximus10:
If I knew about this before :( I almost hard bricked my phone 2 weeks ago because of the stupid permissive mode.

And I couldn't pass PI API no matter what after that.
[Magisk] zgfg:
My SN and PI pass (of course, cannot pass Strong Integrity - cannot trick TEE) with no problem with LSPosed installed
[Magisk] 10Maximus10:
Now it works turned out I had to just leave it for a few days and it fixed itself.

Gremlins
[Magisk] pndwal:
FWIW, some tech stuff on Momo detection methods was made public not long ago with the depreciation of MagiskDetector:

https://github.com/vvb2060/MagiskDetector/blob/master/README_ZH.md

A rough transition here:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-87262317

👀 PW
[Magisk] linus207:
Hi. I have a riddle that I can't solve. I have two devices: Pixel 6 Pro (raven) and Pixel 7 Pro (cheetah). Both with unlocked bootloader. On Pixel 6 Pro I installed the RiceDroid rom.

https://xdaforums.com/t/rom-13-raven-oriole-ricedroid-8-0-aosp-pixel.4499397/.

It is very functional, does not really require root to give satisfaction from daily use. It runs banking applications, gpay (wallet) and has the accepted status of MEETS_DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY.

Pixel 7 Pro, on the other hand, is quite a challenge. I installed Paranoid Android Topaz beta 1 on it

https://xdaforums.com/t/paranoid-android-topaz-beta-1-google-pixel-7-pro.4520783/

Due to limited usability, I rooted and installed Displax mod 2.0 USNF. I couldn't get MEETS_DEVICE_INTEGRITY despite combos with other Magisk modules (Shamiko, Husky, old USNF etc.) So I went back to absolute stock via the online android flash tool. Strangely, on absolute stock, without root, Pixel 7 Pro still shows only MEETS_BASIC_INTEGRITY and no wallet or Netflix or anything "requiring" internal payments accually works. This is a really incomprehensible situation for me considering how the predecessor (Pixel 6 Pro) behaves. I kindly ask for advice and tips.

Cheers
[Magisk] 10Maximus10:
Try displax modded usnf. Also does safety net ctsprofilematch pass?
[Magisk] pndwal:
Seems Ricedroid is based on lineage/crdroid... You'll see here that crdroid pulls SafetyNet Fix w/ Displax mod from here:

https://github.com/kdrag0n/safetynet-fix/pull/207

(Latest is this commit: c5ed4b1)

I don't see Paranoid Android on that page although that doesn't mean that they don't integrate a fix...

Personally I prefer to use clean ROMs (eg official LOS) that don't integrate spoofing and add these using Magisk as there are less issues with conflicting Magisk modules and when changes (eg Google server end) are made...

Nb. Displax mod 2.0 USNF is enough for this; USNF settings will often interfere with that fix and your other solutions may be confusing you/the issue...

It is possible there is also an underlying custom ROM issue (as mentioned above or other) that prevents success...

Device is not 'absolute stock' if bootloader is unlocked... AVB is reporting that so you don't have deviceIntegrity! - you need the @Displax modded USNF to spoof this by forcing the fallback (based on an exception error mod causes) to basic attestation as well as several prop mismatches needed to bypass hardware evaluation type enforcement... With old Basic attestation (as used in pre A8 devices) you can spoof deviceIntegrity as AVB signals are not backed by HKA.

I recommend that you check this thread, especially the first 8 posts:

https://xdaforums.com/t/unlock-bootloader-root-pixel-7-pro-cheetah-safetynet.4502805/

as there are really not issues getting deviceIntegrity on stock ROM. 😃

Welcome... 🙂 PW
[Magisk] linus207:
So I was able to get DEVICE_INTEGRITY on rooted stock. Displax mod turned out to be the perfect and simplest solution.

For more customization I used lsposed+ and the aosp mods module.

Wallet works great, added cards and looks like it will function as it should.

I must admit that there is a lot of confusion on the forums and "online guides", probably due to the high volatility of the situation over time. Sometimes the simplest solutions turn out to be the best.

Thank you for the explanation about spoofing in custom roms based on crdroid/linage, it really explains a lot and finally sorted my mind.
[Magisk] V0latyle:
@shoey63 and/or anyone else familiar with the Asus ROG situation, can you explain how the keystore is broken and how this allows Play Integrity to return STRONG verdict?
[Magisk] pndwal:
You may have missed the exchange here, but I recently analysed & made (educated) guesses w/ @shoey63's help. See here:

https://xdaforums.com/t/discussion-play-integrity-api.4479337/post-87684705

and here:

https://xdaforums.com/t/discussion-play-integrity-api.4479337/post-87684959

Basically It seems droidguard is erroneously sending basic attestation data flagged as hardware backed and this is the basic breakage in keymaster implementation...

Further, gms is not smart enough to challenge this (it would be very unusual after all) but the PI API has the smarts to recognise that some included data is not hardware backed and thus requires (the initial fingerprint) mismatched prop trigger for PI hardware enforcement bypass before accepting the attestation data...

👀 PW
[Magisk] V0latyle:
What's the deal with so many people jumping through hoops with Shamiko and lsposed to try to hide root? It would seem that the Play Integrity workaround should work for most people, the exception being apps that use specific root detection methods? In other words, hiding root shouldn't be necessary for most people; passing BASIC and DEVICE integrity should be the main concern, no?
[Magisk] zgfg:
Hiding root is necessary for many users because otherwise they cannot use various banking apps, e-citizen apps, mobile device management, etc

Those apps use various other methods to detect root - eg, although you pass Play Integrity (SN), those apps still seek themselves (not through Google's PII/SN) for su, initrc, LSPosed module and/or even for the presence of Magisk app, etc

If they detect, they complain that device is unsecure and user cannot open them to eg configure his banking logging account, etc

More or less, that's all because stakeholders for those apps know that PI/SN attestation is not full-proof, ie, that many users successfully spoof CTS attestation although their Bootloaders are unlocked, custom ROMs installed, boot partition patched with Magisk and so.

Hence they look for other detection methods that are harder (specially for newbies) to spoof

And the tricky part is that you cannot know what they detected and how (obviously, they don't tell you to help you to 'fix') hence the only way is to experiment by various methods

Some method that work for one device/ROM may not work for the other, and of course a method that works for one app ma not work for the other.

But still, most of that is common but unfortunately many users are lazy to follow discussions, read/learn in time and then they ask for help although they didn't even try basic things
[Magisk] V0latyle:
Makes sense

I guess what is bugging me is when someone recommends using Shamiko + lsposed as a fix for PI dependent apps not working. Google Wallet doesn't work? Here, install three modules and configure a bunch of confusing DenyList crap, instead of just installing one module and calling it a day

Occam's razor.
[Magisk] zgfg:
That's again the lack of knowledge and understanding

Eg, some user needs to hide root from his banking app. To pass he does not only need USNF but also eg Shamiko, LSPosed + Hide My Apps, etc

Then he tests Wallet and it works for him (bcs, among other things, he did install USNF)

Then another user asks only for Wallet and the first user tells him, you need all those (USNF, hide Magisk app, Shamiko, blue shirt, white socks, umbrella, sunglasses, who knows) bcs he had all that, he passed Wallet but he doesn't really know what of all that was really necessary just for Wallet

And then that 'guide' spreads around like conspiracy theories do (they are sometimes more catchy than the simple truth)
[Magisk] HippoMan:
And yet, these same banks gladly issue debit cards to their customers, and these cards are just as easy to steal as mobile devices, and they have many fewer "security" measures associated with them than most of these banks try to implement within mobile devices.

Lots of these cards are set up with credit-card-like clearing mechanisms and can be used without PINs for purchases. Therefore, it is easier to commit fraud via stolen debit cards than via stolen or hacked Android devices.

Furthermore, these banks allow their customers full web-based access to their finances via desktop computers which can be hacked with keystroke-capturing malware that can then be used to determine the victims' login ID's and passwords that are utilized to access these banks' web sites.

And all these desktop computers are rooted, and the banks do nothing to cripple any software on these desktop computers, nor do they even try to force their users to install anti-virus software before allowing web access to their banking sites.

And there are many more desktop computers and debit cards in use in the world than there are rooted Android devices, and much more fraud is committed via compromised home computers and via stolen debit cards than could possibly ever be committed via hacked or stolen rooted Android devices.

I believe that the monetary value of all the fraud that has been prevented by Android-device-crippling "security" software is lower than the amount of money spent by banks to develop and maintain the anti-rooting and anti-modding facilities that they utilize.

I'm not talking about Google themselves here; rather, I'm referring to the stupidity of the management of these banks.

But there's no law against being stupid, and therefore, we mice will be increasingly at the mercy of these cretinous cats.
[Magisk] pndwal:
Just realised I replied to the wrong member above... Corrected now...

Anyway, I was simply elaborating on why banks need more detection bypasses than Google's G Pay/Wallet (which goes to the issue of users confusing what bypasses are actually required)... Just stating how things are / developed / are developing...

Did I say anything wrong?... 🙃 PW
[Magisk] V0latyle:
No, he's just being a little obstinate and ignoring the fact that it's much less "risky" to attempt to exploit vulnerabilities on devices and obtain financial information that way...carrying a stolen card can get you caught, and installing a card skimmer is risky, too. I think it's pretty pointless to rail against the big bad banks when they try to take (necessary) steps to protect their customers, simply because it means that using their apps may not be possible a few white hats. As pndwal said, we are collateral damage.

Google certainly isn't trying to screw us, and if you really want to find issue with banks, I could tell you all about ESG divestments, asset management firms like BlackRock buying up entire subdivisions of single family homes, and companies like PayPal who refuse to let their customers use their services to purchase perfectly legal things such as firearms. Bank Australia will no longer issue loans for new gasoline or diesel cars in as little as 2 years, despite the lack of necessary infrastructure to support EVs.

And if you want to talk about the evils of Google...Look at their arbitrary ranking of search results, to the point of suppressing vital information, as well as their daughter company YouTube which exercises heavy handed censorship against anyone with views to the right of center, while permitting sexually suggestive and disturbing material for children.

But that's another story...
[Xiaomi Mi A3 Questions & Answers] tannerknight:
Hello,

I'm trying to root my Xiaomi Mi a3, however the OEM is greyed out and it has "Bootloader is already unlocked".

I tried factor resting it multiples times.

My issues is https://xdaforums.com/t/guide-root-magisk-how-to-root-mi-a3-with-magisk-without-twrp.3958509/, im following this guide. However, when i try to do "

fastboot flashing unlock" it reads "waiting for devices".

Any solution?
[Touch HD General] ericstoevenbelt:
I just bought the HTC Touch HD. I tried to reinstall MIOMap v3 (i had it running on my previous HTC phone). The install proces went fine, but the program does nog start. From the MIO logo screen it goes back to HTC Home, not showing an error message. Does anyone have the same problem and knows an solution?
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] retiredtab:
New build called lineage-19.1-20220912-UNOFFICIAL-gt5note10wifi.zip

NOTE: All builds that I upload have been personally tested on my device to boot and function as described in post #1. Having said that, there's still a chance it won't work on your device due to human error, your configuration, your apps, etc. If it won't boot, always start with a complete wipe of everything and format your data in TWRP. This is known has a clean install. Backup your data before a clean install.

19.1 has been my daily driver since March 2022.

Sept 12, 2022 release notes

1. Sept 5 security patches as per https://review.lineageos.org/q/topic:S_asb_2022-09

2. Switched to different timekeep repo that works with Android 12 and up.

3. Whatever LineageOS changed since Aug 5 patches. About 4,700 files had to be recompiled.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] retiredtab:
New build called lineage-19.1-20221007-UNOFFICIAL-gt5note10wifi.zip

NOTE: All builds that I upload have been personally tested on my device to boot and function as described in post #1. Having said that, there's still a chance it won't work on your device due to human error, your configuration, your apps, etc. If it won't boot, always start with a complete wipe of everything and format your data in TWRP. This is known has a clean install. Backup your data before a clean install.

19.1 has been my daily driver since March 2022.

Oct 7, 2022 release notes

1. Oct 5 security patches as per https://review.lineageos.org/q/topic:S_asb_2022-10

2. Whatever LineageOS changed since Sept 5 patches. About 4,500 files had to be recompiled.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] retiredtab:
New build called lineage-19.1-20221111-UNOFFICIAL-gt5note10wifi.zip

NOTE: All builds that I upload have been personally tested on my device to boot and function as described in post #1. Having said that, there's still a chance it won't work on your device due to human error, your configuration, your apps, etc. If it won't boot, always start with a complete wipe of everything and format your data in TWRP. This is known has a clean install. Backup your data before a clean install.

Nov 11, 2022 release notes

1. Nov 5 security patches as per https://review.lineageos.org/q/topic:S_asb_2022-11

2. Whatever LineageOS changed since Oct 5 patches. About 5,400 files had to be recompiled.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] mb1kid:
ok thank you
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] retiredtab:
New build called lineage-19.1-20221209-UNOFFICIAL-gt5note10wifi.zip

NOTE: All builds that I upload have been personally tested on my device to boot and function as described in post #1. Having said that, there's still a chance it won't work on your device due to human error, your configuration, your apps, etc. If it won't boot, always start with a complete wipe of everything and format your data in TWRP. This is known has a clean install. Backup your data before a clean install.

19.1 has been my daily driver since March 2022.

Dec 9, 2022 release notes

1. Dec 5 security patches as per https://review.lineageos.org/q/topic:S_asb_2022-12

2. Whatever LineageOS changed since Nov 5 patches. About 4,700 files had to be recompiled.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] retiredtab:
New build called lineage-19.1-20230108-UNOFFICIAL-gt5note10wifi.zip

NOTE: All builds that I upload have been personally tested on my device to boot and function as described in post #1. Having said that, there's still a chance it won't work on your device due to human error, your configuration, your apps, etc. If it won't boot, always start with a complete wipe of everything and format your data in TWRP. This is known has a clean install. Backup your data before a clean install.

19.1 has been my daily driver since March 2022.

Jan 8, 2023 release notes

1. Jan 5 security patches as per https://review.lineageos.org/q/topic:S_asb_2023-01

2. Whatever LineageOS changed since Dec 5 patches. About 4,400 files had to be recompiled.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] retiredtab:
New build called lineage-19.1-20230212-UNOFFICIAL-gt5note10wifi.zip

NOTE: All builds that I upload have been personally tested on my device to boot and function as described in post #1. Having said that, there's still a chance it won't work on your device due to human error, your configuration, your apps, etc. If it won't boot, always start with a complete wipe of everything and format your data in TWRP. This is known has a clean install. Backup your data before a clean install.

19.1 has been my daily driver since March 2022.

Feb 12, 2023 release notes

1. Feb 5 security patches as per https://review.lineageos.org/q/topic:S_asb_2023-02

2. Whatever LineageOS changed since Jan 5 patches. About 12,500 files had to be recompiled.
[Samsung Galaxy Tab A series ROMs, Kernels, Recover] retiredtab:
New build called lineage-19.1-20230319-UNOFFICIAL-gt5note10wifi.zip

NOTE: All builds that I upload have been personally tested on my device to boot and function as described in post #1. Having said that, there's still a chance it won't work on your device due to human error, your configuration, your apps, etc. If it won't boot, always start with a complete wipe of everything and format your data in TWRP. This is known has a clean install. Backup your data before a clean install.

19.1 has been my daily driver since March 2022.

March 19, 2023 release notes

1. Mar 5 security patches as per https://review.lineageos.org/q/topic:S_asb_2023-03

2. Whatever LineageOS changed since Feb 5 patches. About 23,500 files had to be recompiled.