yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
Seems Play Protect only checks periodically.

Not enough to force Play Store refresh.

Forced Play Store refresh but any cached Play Protect measurements are too old... Play Store is waiting for a periodical Play Protect attestation check.

You should get an instant result by clearing Play Services data where Play Protect is still included, or by additionally clearing Google Play Protect Service app in late systems. (I still don't have this w/ A11 stock MIUI.)

Reboot most likely refreshes Play Protect cached measurements (triggers new attestation check), or USNF may may cause this with a Play Services refresh.

Forced Play Store refresh and cached Play Protect measurements are fresh enough to be accepted.

---------​

Play Store does take some time to catch up with gms attestation without intervention like G Pay/Wallet does (up to a week?), but clearing data seems to make it poll Play Protect service immediately... The Play Protect service was embedded in Google Play Services till recently but in late systems it's seperated out to new Google Play Protect Service app.

For me results have generally been instant, but I've also generally cleared Play Services data at the same time to refresh it's cached measurements (incl. Play Protect service); Play Store apparently waits for Play Protect to periodically refresh attestation results if its cached results are too old. Nb. if on a late system with seperate Google Play Protect Service app you'll also need to clear its data to get refreshed results.

For a long while after June 2022 (PI rollout) Play Protect service was still polling S/N ctsProfileMatch only... That's why many wondered why bank apps failed despite Play Protect returning 'Device is Certified' or wouldn't show in Store. (S/N ctsProfileMatch was passing with older USNF but many devices needed the later added fingerprint prop based mismatch in addition to bypass new fingerprint prop based hardware-backed verdict enforcement and pass PI deviceIntegrity... Devices launched with A13+ also need shipping level prop mismatch.) I'd say Google may have simply been waiting for some critical mass of bank apps to move Play Protect device certification result to PI deviceIntegrity. I'm not sure, but Play Integrity may have migrated also by now. Nb. Playstore correctly excludes apps based on several different criteria so displayed Play Protect device certification result is only one of several device compliance measurements that are actually known by Play Store.

🤠 PW
[Magisk] chiteroman:
Device is certified = passing MEETS_DEVICE_INTEGRITY (and MEETS_BASIC_INTEGRITY).

To reset it, clear GSF and GMS data.
[Magisk] IlyasPro:
do you guys know how to pass cts profile match please in couple months my device was and still unable to use banking apps because google play certification is not certified
[Magisk] pndwal:
Do you have Universal SafetyNet Fix module, modded fork/build by @Displax ? PW
[Magisk] V0latyle:
What modules are you using?

Edit: Ninja'd by @pndwal
[Magisk] IlyasPro:
yeah actually
[Magisk] pndwal:
@IlyasPro

Disable all other than USNF and reboot to see if pass deviceIntegrity...

Please say device / ROM, and if you have any other mods, eg flashed from TWRP... 👍 PW
[Magisk] IlyasPro:
I don't know how to thanks you you are a life saver so there is a module cause this entire issue, It looks like strong integrity is still failing but it doesnt matter finally I got to login to my account again thanks you so much
[Magisk] pndwal:
Please say which mod... May help others... I suspect it may be have been MHPC configuration(?)

Nb. There's no need to alter fingerprint prop globally w/ MHPC if using current USNF builds as that's now an integrated function...

FYI, you won't ever pass strongIntegrity unless your device has defective implementation of components relaying chain of trust data from hardware keys...

Happily for us, no banks are known to use PI strongIntegrity (equivalent to old S/N API returning ctsProfileMatch pass w/ evaluationType: HARDWARE_BACKED, BASIC) yet...

👍 PW
[Magisk] IlyasPro:
Thanks you it was Lsposed module after I disable it it pass the cts profile
[Magisk] IlyasPro:
I wonder if there is a similar module like Lsposed because there are some apps in my device that require the Lsposed on
[Magisk] pndwal:
Late LSPosed generally hides itself from Play Integrity API... Try disabling all XPosed modules and keep LSPosed Magisk module enabled...

And please say if succeed / which module causes issues... 👍 PW
[Magisk] IlyasPro:
ok I will try it now
[Magisk] IlyasPro:
I found it. its Xprivacylua module from Lsposed I disable it and it fix everything
[Magisk] pndwal:
Yup, that's often a culprit and also detected by banks easily due to folder it creates in /data/system...

What's more, if you install Ruru detector from here:

https://github.com/byxiaorun/Ruru

you will probably see that Xprivacylua is still detectable after uninstalling! That's because uninstall routine doesn't clean up properly...

If detected you'll need to remove data/system/xlua folder manually and check again...

👀 PW
[Magisk] chiteroman:
Expected.
[Magisk] V0latyle:
Is there a guide somewhere on how to use the "additional" modules such as LSposed + Shamiko?

My main bank's app somehow still detects root and disables fingerprint login. My secondary bank's app won't work at all - after blocking in DenyList, it still complains about USB Debugging being enabled.
[Magisk] chiteroman:
Which Magisk are you using?
[Magisk] zgfg:
There is HMA thread about HMA. Shamiko doesn't require special settings (just Zygisk and DenyList). You can try also App Data Isolation (Magisk module) and DevOpts Hide (for LSPosed) to hide Dev. Options
[Magisk] V0latyle:
I tried 25.2 with just Displax USNF module, then 26.1 with Lsposed+Shamiko and DenyList unenforced
[Magisk] V0latyle:
HMA?
[Magisk] zgfg:
Hide My Applist
[Magisk] V0latyle:
Didn't work for this particular app.

I wish there was a way to see exactly what methods an app was using to detect root or other modifications
[Magisk] chiteroman:
Try latest Magisk Alpha, maybe apps are detecting original Magisk zygisk.
[Magisk] V0latyle:
I'm not sure I want to switch to a different branch. Everything else works so I'm not exactly inclined to break everything just because one thing doesn't. Lol.
[Magisk] chiteroman:
Download the apk from their Telegram, completely uninstall Magisk, and then boot to TWRP and flash the apk to install Alpha. Zero problems in my device.
[Magisk] V0latyle:
I'm on a Pixel, no recovery partition.

I also don't like joining random TG channels
[Magisk] chiteroman:
So you can download it, give root permissions to Alpha and direct install it.

Random Telegram channel? The dev is one of the contributors of official Magisk, LSPosed and Shamiko. I don't think it's a random telegram channel 🙃

Give it a try 😁: [search in Google lol]
[Magisk] V0latyle:
Do I have to replace Magisk core with the Alpha core? Or just use the app?
[Magisk] pndwal:
Does that matter?

You don't need to join group, but 26101 is not latest Alpha... I don't think much has changed though, and it probably does have the native bridge Zygisk loading changes...

26102 Alpha is in private discussion group... I can send file in conversation if you want... PW
[Magisk] pndwal:
Yes... Or banks will still detect injection (Zygisk)... Nb some, like Starling, detect even native bridge loaded Zygisk ATM... PW
[Magisk] Lord Sithek:
Is there any way to join this private group?
[Magisk] pndwal:
Yup... Invite link obfuscated in Magisk alpha release channel, pinned message no. 1... Or you can just listen to Rick Astley sing "Never Gonna Give You Up"... 😜

Chinese only, and be warned you'll get chewed up and spat out if you break any rules. 😂 PW
[Magisk] V0latyle:
I'm pretty Telegram illiterate, I can't even seem to download the file.

I think I'm just gonna say screw it, I can still use my main banking app and the other one is only really for ATM access so I don't care about it.
[Magisk] Lord Sithek:
Naah, just wanna observe in silence 😂 Thanx for the hint, it's really... obfuscated 😝 And Nekogram is our friend ;)
[Magisk] chiteroman:
Join group chat on Telegram

t.me

For someone who want to join :)
[Magisk] pndwal:
Can you say app then?... Or did I miss it... PW
[Magisk] V0latyle:
You mean the app name?

Main bank is Navy Federal but you can't test biometric sign in unless you have an account.

Other app is Mid America Bank, it complains about root unless DenyList is enabled on it, then it complains about USB Debugging.
[Magisk] chiteroman:
To download the file you must have Telegram installed in your phone and had an account :(

But I can share it :D
[Magisk] chiteroman:
badf-alpha?
[Magisk] chiteroman:
Google servers are crazy 🤪
[Magisk] HippoMan:
So, given the policies in force in that TG group, there are obstacles to downloading the Alpha software and discussing it there.

And sadly, given XDA's own policies, there are even additional obstacles to sharing the software.

However effective the Alpha software might possibly be, it hardly seems worth the trouble of trying to obtain it and use it.
[Magisk] pndwal:
Guess many will think that, others not...

I'm running it just to test 3/4 baked native bridge loaded Zygisk (some 3 months in the making already)

Refactor zygisk to use native bridge to inject

#6659 opened on Mar 2 by yujincheng08

• Approved 2 of 3 tasks

and I have no issues that need discussing... I have got helpful responses from @canyie (a main Alpha discussion administrator) in the past however... Policies are quite normal... It is a Chinese community... Need translation solution like Nekogram or a translation bot... No different to XDAs English only policy really...

Actually I built and tried yujincheng08's (Shana on TG) Metagisk nbzygisk test branch Magisk yesterday to see if it's progressed since last Alpha. Not many will want to build themselves (and there's not much difference anyway) so Alpha builds are good option for testing.

I can say many more bank app apps run with this already than with official TJW Magisk (native bridge loading was adopted by Riru to make that hooking framework's memory hidable too and is a thus well tested concept)... Most will want simply to wait for fully baked NB loaded Zygisk expected in Magisk 27.0+ (or perhaps an earlier Canary).

If any are desperate to use their bank apps, this has a good chance of success... I have no such need but can't see any issues if people want to try... Or not... Or wait...

Installation issues (bypassing signature checks etc) are not unique and many here are used to/can give advice on testing bleeding edge Magisk... 😶 PW
[Magisk] chiteroman:
Where we can get it?
[Magisk] pndwal:
LSPosed (LS = LoveSy = Shana = yujincheng08) Magisk = Metagisk... Select branch. 👍 PW
[Magisk] chiteroman:
GitHub - LSPosed/Metagisk: The Meta Magic Mask for Android

The Meta Magic Mask for Android. Contribute to LSPosed/Metagisk development by creating an account on GitHub.

github.com

I found it, isn't very difficult 😂
[Magisk] pndwal:
For context, this:

So it seems that despite the rule update and the fact that many here use Telegram to communicate or to peruse forums, we still cannot link even main Magisk test forks from principal Magisk Devs like @vvb2060's Alpha (with no GitHub published releases) or other apps etc published (for root hiding etc) there...
[Magisk] chiteroman:
Magisk Alpha has MagiskHide lol

If you don't need Zygisk (your ROM spoof BASIC attestation so you don't need safetynet-fix) why use it? For example, someone who only wants root. MagiskHide is a great feature.
[Magisk] karandpr:
Well you can also ...

Step 1: Get permission from the devs to post on XDA.

Step 2: Post on XDA on their behalf as a maintainer or representative or diplomatic envoy or whatever. Give ample credits to the original author.

Step 3: For 1 project, you can link to their Telegram channel/group or whatever as per the current rules.

If there is a download in Telegram downloads, you can ask the author permission for mirroring on XDA or in a separate telegram post.

If you want, you can create a rollup thread with multiple Magisk dev channels, that's fine too. But make sure to write that in OP.

Peeps on internet who don't want to trawl on telegram will get it here.
[Magisk] pndwal:
Of course, I was referring to it's official extinction:

"Yes, MagiskHide will have to see its end of life..." https://topjohnwu.github.io/Magisk/releases/24000.html 🙂 PW
[Magisk] simplepinoi177:
MOD ANNOUNCEMENT​

All posts discussed here regarding Telegram links, the rules & policy of XDA concerning them, has been moved to THIS THREAD

XDA & Telegram

I'm creating this thread, but if any Senior Mods or Admins feel it would best be discussed in [All XDA Members] Feedback/Recommendations for XDA thread (I was unsure as that thread is more for suggestions & feedback, I don't know if criticism...

xdaforums.com

At the very least, this is not the thread to discuss it as this thread is about "[INFO] Play Integrity API - replacement for SafetyNet" and even if OP is okay with off-topic discussion, discussing it in a dedicated thread in "About xda.developers.com" section or even the "Feedback/Recommendations for XDA" thread would be a more appropriate and conducive location for such a discussion than here. Please direct/continue further discussions to the above URL.
[Magisk] tehdomic:
Well, this might explain why Google Wallet payments don't work too often for me despite properly reinstalling and reapplying all known useful methods and patches etc. I'll switch back to my physical card 💳 for now. Thanks for clearing this up.
[Magisk] pndwal:
Should be no problem with passing PI deviceIntegrity and G Pay/Wallet in denylist... May need to clear G Pay/Wallet data and reboot (important to reboot before opening again)...

Nb.this is all you'll need; disable old SQLite fix if you have it... 👍 PW
[Magisk] intel_core_i7:
Another stupid question, will SN/PI hardware attestation ever be enforced on banking apps by Google? I can't see any reason of this becoming reality. And with more and more banks adapting this new zygisk detection method, I can't see why must they use SN at all...
[Magisk] V0latyle:
As I've pointed out before, Google doesn't enforce anything except requirements for their own apps. Each app developer chooses their own requirements. Play Integrity is merely an interface that developers can use to determine how secure the device is.

As far as I am aware, there are no apps currently available that use STRONG_INTEGRITY. The option to require hardware backed attestation has been available since Android 7.0, even on the old SafetyNet API, but none have used it, not even Google.

Yeah, it does seem that way - instead of relying on Play Integrity, they're using other methods. As @pndwal pointed out, there is a documented method for Hardware Key Attestation to determine whether the device's bootloader is unlocked. Unlocked bootloader = broken chain of trust. There's also a hodgepodge of other methods out there - detecting the presence of SU binary, detecting whether USB Debugging is enabled, looking for package names like Magisk, looking for lSposed, etc.

AFAIK we do not currently have a way to determine which apps use what methods. The only way I can think of that this would be possible would be to run each app in some sort of "sandbox" environment while intercepting the various requests from the app...but this would be rather exhausting.

The whole point of SafetyNet and now Play Integrity is to provide a "one stop shop" for apps to determine device state, instead of having to implement anything else. Why they choose to use their own methods instead of what Google has literally handed them on a platter, no one but them knows.
[Magisk] intel_core_i7:
Yeah speaking about methods, have you seen any apps outside of momo (magisk alpha thing) detecting custom ROMs and saying phone is rooted?

In Vietnam most banks are switching to this new method that it detects if zygisk is installed, and there haven't been an effective way to hide zygisk, other than turning it off. Truly a cat and mouse game.
[Magisk] V0latyle:
I don't use custom ROMs, but I do know of at least one app that detects root and doesn't allow biometric authentication, even though I'm passing BASIC and DEVICE integrity.

Another seemed to detect root no matter what I did, even with Shamiko and HMA. I didn't try hiding Magisk itself though and I eventually just gave up. At a certain point when they make it a pain in the ass to use an app, I just say "screw it" and use the website.
[Magisk] intel_core_i7:
Rooting is getting more and more difficult these days... and its benefits for me don't really outweigh its disadvantages

I have only come to android rooting/modding scheme for a year, seems like I missed the golden days...

One last reply before it goes too off-topic, have a great day.
[Magisk] V0latyle:
I think there may be some confusion about Google's part in all this. Yes, they maintained SafetyNet and now maintain Play Integrity...but once again the only requirements they enforce is for their own apps.

Google cannot enforce STRONG_INTEGRITY for third party apps. The Play Integrity API doesn't tell apps what they should use; it only tells apps what responses are available. I keep saying this - it is up to each app developer to decide what responses they require, Google has nothing to do with what requirements they decide on.

The only thing Google could do in this regard is make hardware backed attestation mandatory for all devices, but as has been discussed previously, this means anyone with a phone running Android prior to 8.0 would be unable to use any apps that use Play Integrity.

So once again, and hopefully for the last time:

Google DOES NOT enforce Play Integrity responses and CANNOT require any app (except their own) to use Strong integrity. The option is there if banks choose to use it...but it's always been there, albeit in a different form with SafetyNet, and none ever have.

So, if your app doesn't work, it has nothing to do with Google and everything to do with that app's developer.
[Magisk] pndwal:
Yup, I'd overlooked that the member was asking if Google will force banks to use strongIntegrity, thanks... Adjusted response above. 👍 PW
[Magisk] HippoMan:
Agreed. Google simply provides the tools that app developers themselves could utilize -- if they so choose -- to make Android life miserable for rooted users.
[Magisk] intel_core_i7:
That will never become reality, at least with what I know. Some non-google certified android version >8 devices (with or without Play Services, from Chinese manufacturers, mostly and other smaller brands worldwide) may never even come with any sort S/N or PI software attestation, let alone hardware. If google makes every banking software to adapt this then using banking software or any other play store apps (which can be also downloaded with other sources) without Play Services installed on your devices will be impossible. Oh I also forgot about Huawei's harmonyOS devices, no organization would spend that type of budget to make another version of their android app to adapt non-gapps devices. If google actually decide to make every app to enforce STRONG_INTEGRITY, then I think there will certain be lawsuits going after them. The point of android being open source will just be, pointless.

An example is my phone. I just bought a Xiaomi Qin F21 Pro, you probably know that piece of brick running Android 11, and it doesn't support TEE, at all (checked with Rikka's app). I come from Vietnam, and if you know geography, we're a neighboring country of China. As a result, Chinese domestic market phones sells very well here, since cheaper pricing, and there are many private importers who mass import them, and normally install modded ROM (like xiaomi.eu for xiaomi phones) or ROMs for those phone in international markets. This would leave the phones' bootloader to stay unlocked, of course, and if hardware attestation (via SN or any other method) was enforced, you would expect major backlash from customers.

Yeah as I stated above, probably possible in western countries, but in many developing countries, not so much where the market is full of imported phones and smaller, unknown manufacturers. Also, there are already apps enforcing some kind of bootloader locking check, but some of those could be modded/bypassed. This Egyptian bank, for example:

CIB Egypt Mobile Banking - Ứng dụng trên Google Play

Ứng dụng CIB Mobile Banking được thiết kế để đáp ứng mọi nhu cầu ngân hàng của bạn.

play.google.com

I'm not looking forward to a future where hardware attestation is enforced (with all applications), by any means, because it will just end android modding once and for all. I would rather having apps with stupid tamper protections like custom ROM/ debugging to actually decent method like zygisk/lsposed/magisk/blahblahblah detection, rather than this...
[Magisk] V0latyle:
If you mean in the sense that Google implemented hardware backed attestation, and documented a method for verifying hardware keys...Sure. The former is definitely a Google thing with PI, the latter is more of an Android thing overall.

But I think it's clear at this point from this conversation that many developers are choosing to forego these in favor of third party security solutions that use other things - package name detection, Zygisk detection, etc.

At the end of the day it doesn't seem fair to me to accuse Google of trying to make things harder on us rooted peoples. It's a matter of the fact, yes, but not so much intentional as coincidential I think.

And even when it comes to the app developers themselves, I don't think they care so much about sticking it to rooted users - I think they're just engineering things from a security perspective that sees any modification as a potential exploit and vulnerability - such as security policy that prohibits USB Debugging from being active. That's just silly IMO.

Not quite. Go back to the OP and read about the 3 elements of PI. Any device profile that has passed CTS should pass MEETS_DEVICE_INTEGRITY. Any device that reports basic system integrtiy should pass MEETS_BASIC_INTEGRITY. Yes, the CTS profile can be revoked...but we have already demonstrated that we can spoof a different profile through device props. So...they revoke a Huawei CTS profile? Doesn't matter, just spoof a Pixel. AFAIK they haven't done this, they've only revoked some hardware keys, so the affected devices should still pass BASIC and DEVICE with the PI fix.

Google can't make anyone adapt anything, and haven't shown any interest in doing so. Sure, they have certain requirements for being listed in the Play Store, but they don't block GMS access for sideloaded apps

But again...They've had the ability to do so ever since Android 8.0 rolled out in 2017. There's no impending doom, because for the past 6 years not a single one has required hardware backed attestation (beyond verifying hardware key pairs outside of SN/PI) and all have instead relied on third party security solutions.

So I think it's premature to assume anything is going to change. Yeah, those third party solutions are going to get more complex and harder to beat, but not everyone uses them, and I really doubt that there would be any sort of domino/lemmings effect where all banks suddenly decide to use some sort of unbeatable security scheme.
[Magisk] HippoMan:
... which I said "Agreed" about, in my previous post.
[Magisk] wilsonhlacerda:
After tons of tests with all flavors of Magisks, LSPosed, modules, network connections monitoring/block (on Poco X3) and even with an old stock Android 6 device (works fine on it), I do suspect that this Brazilian bank is also doing its own bootloader unlocked test (local, not server) + zygisk/riru/zygote injection detection + LSPosed hooked detection:

https://play.google.com/store/apps/details?id=br.com.daycoval.dayconnect

It crashes (faster or slower depending on tools being used) and does not show any screen. No way to use it nowadays.

If you all have any tips, please let me know. Thanks.