yashsingh1/xdaforums huggingface dataset:
[Magisk] neonblind:
Hi all,

a Sony X compact with stock Android 7 Rom rooted with Magisk v23 gives me headaches. I pass safetynet without any modul. PlayStore is certified, I see all the banking apps, netflix etc.

One app wont start, even with Magisk hide enabled. I think this app does the new play integrity check, which failed BASIC_INTEGRITY and DEVICE_INTEGRITY.

As i understand the official USNF modul restored support for A7 but bypassing play integrity does not work and the USNF mod dont have the Android 7 fallback, right? So what are the options for Android 7?
[Magisk] pndwal:
It's surprising that you don't pass PI basicIntegrity and deviceIntegrity with this setup if S/N ctsProfileMatch passes...

Please say if you have any modules enabled, or have TWRP or any other flashable mods applied, or have you even installed and uninstalled any since last clean fastboot ROM flash...

Please also check selinux status with an app like Inware, and see if Oprek Root Detector sees any 'dangerous' props... PW
[Magisk] kingwicked:
Hi.

I am using a Note 20 Ultra N986B with custom rom by Dr Ketan and i am on A12 Sep security patch. I had issues with A13 poor battery life so i downgraded back to Android 12.

I have safetynet passed and Google playstore shows verified . I am using 2.4.0 Mod 1.2 By Diplax. Previously it was 2.3.0 mod and after that i flashed safetynet 2.4.0 official.

I have same results on all 3 modules. safetynet passed shows basic in yasnac , playstore cerified in settings of playstore. Magisk app hidden denylist has playstore and play services ticked.

Every banking app i use works fine when ticked in denylist. BUT play integrity app shows all 3 red ❌️.

Can someone tell me how to pass play integrity?
[Magisk] pndwal:
Take google stuff out of denylist (except G Pay/Wallet)... Delete Play Services data...

Try with all modules except USNF disabled (& reboot)...

If still failing you may need a later ROM especially if that build still requires disabling verity / verification or has selinux set to permissive (check selinux status with an app like Inware)...

Please say if you have TWRP or any other flashable mods applied, or have you even installed and uninstalled any since last clean fastboot ROM flash... PW
[Magisk] kingwicked:
Thanks for your reply 🙂

I have twrp installed on My note 20 Ultra. I have exact same issue

on my Samsung A52 which doesnot have TWRP. And root was achieved by patching AP file with magisk 25.2. Exact same scenario on it as well. Playstore certified. Safety net passed all 3 crosses failed in Play integrity app.

Although all my banking apps work fine after i ticked them in denylist.
[Magisk] neonblind:
Uhh, thats tough. For testing purpose i disabled every modul and failed PI anyway.

I flashed the rom years ago and had systemless xposed installed which broke S/N as expected. But its removed long time ago. Maybe there are still traces which trigger PI.

Another thing could be the rooting process itself. If I remeber correctly it was relatively complex:

- using dirty-cow exploit to save the drm keys under Android 6

- unlock BL and putting the boot.img through a script called rootkernel disabling dm-verity and Sony RIC

- boot TWRP and flash repacked boot.img and the drm keys back and using another script (drm-fix) to pick up the saved drm keys during boot

So, inactive dm-verity and / or Sony RIC could also be a dealbreaker.

I will check inware and Oprek Root Detector.

Do you know anyone with a rooted Sony device from that era (z5, x, xz1) who pass PI? :)
[Magisk] V0latyle:
Wanted to add more thoughts to this...

Play Integrity may be developed mainly by Google under the Google Play platform, but Play Integrity is still just an open source API. It does not attempt to enforce any particular security requirements on a device, it simply provides a means for apps to determine what the security state is.

In other words, Play Integrity itself does not require any particular response; that is up to the individual app developer. So, the only thing Google could require is STRONG integrity for some of their own apps - such as GPay or Wallet - if they so choose, just like any other developer could.

But.

To my knowledge, no developer has required SN HARDWARE_BACKED or PI STRONG_INTEGRITY for any of their apps. Can they? Yes. Will they? Who knows. The ability to do so has been there since Android 8.0, but no one has ever required it, and I have doubts as to whether they will start or when. One educated guess from @pndwal is that this is mainly due to fragmentation - so many Android devices running so many versions - and they just want to wait until penetration metrics show that the majority of the market is running 8.0 and above. But, again, this is just conjecture.
[Magisk] pndwal:
A technicality only; I don't know if PI API is really open source, even if an Open API... It's part of Google Mobile Services, ie proprietary (closed source) GApps, not Android Open Source Project...

Here's some interesting disambiguation:

https://www.osaango.com/blog/what-is-an-open-api-or-what-makes-an-api-widely-adopted

Of course Google's GMS license is not open although Google doesn't apparently charge for this; it's the Mobile Application Distribution Agreement (MADA), ie. permission for a company to use its GMS suite of applications and services on it's devices, and manufacturers holding a MADA can have devices certified by 3PLs (Third Party Labs) which are authorised by Google to charge various fees to provide the GMS certification required after performing independent testing using CTS, CTS-V, GTS, CAT, VTS, STS and other tests etc...

On the other hand, AOSP licences are open, generally being the open Apache Version 2.0 (Apache 2.0) licence, but some parts use open GPLv2 or other open variations...

👀 PW
[Magisk] V0latyle:
Good point, it would be more accurate to say that Play Integrity is open access
[Magisk] pndwal:
Systemless (eg EDXposed) should uninstall clean... Newer (systemless) LSPosed hasn't broken integrity attestations for some time now...

Is that a mod to fix Widevine certification? Other?... Sounds like it may be responsible...

Sounds suspicious... What's Sony RIC?

Maybe you should ask in Sony furums? 😜...

If there are more othodox ways to unlock/flash Magisk for your device now, you'll likely find that dirty flashing ROM and re-rooting fixes this, but no guarantees... Will have to rethink 'drm'/other(?) mods too...

All best, PW
[Magisk] neonblind:
Classic systemless xposed, we are talking about Android 7.

Yes it is, if you unlook BL without it, you will lose drm keys and can't watch netflix in HD on a 4.5 zoll display anymore :) and some sony camera features wont work.

I think its sonys implementation to protect /system , mound rw and so on.

Ok, i will reflash everything putting boot.img through rootkernel script again and wont touch dm-verity/sony ric this time cause i think it not necessary.

Than try this: https://xdaforums.com/t/poc-work-in-progress-trim-area-proof-of-concept.3552893/

It's another method to embedding drm-keys.

We will see.
[Magisk] pndwal:
Any reason you haven't updated to 8.0?... Or custom ROMs, eg LineageOS 19, A12?... PW
[Magisk] deusfaux:
Is it possible Sony's Remote Play app https://play.google.com/store/apps/details?id=com.playstation.remoteplay&hl=en_CA&gl=US

uses STRONG integrity check? because even passing BASIC and DEVICE, having the app in the DenyList, etc the app will produce an error when rooted.

OR did I just answer my own question because the app will run with an unlocked bootloader if not rooted... It must be detecting something else by some other means?

It's pretty much the only app that doesn't work for me
[Magisk] V0latyle:
Sounds like the app is using specific root detection methods. To my knowledge there are zero apps that require STRONG integrity; the few that cause the most problems for people have specific root detection methods, to the point where some even look for Xposed
[Magisk] deusfaux:
Is there a good forum for app specific discussion and workarounds like the aforementioned one? Like, presumably ppl could determine which thing it was looking for and then hide that (I'm not using Xposed)
[Magisk] V0latyle:
I would try the USNF module threads.
[Magisk] pndwal:
Does it fail before this?:

... Stock RN8T MIUI A10, Canary 25210, Magisk App hidden in stub, Shamiko hiding, @Displax USNF... PW
[Magisk] deusfaux:
Indeed. Immediate upon launch, a in-app error of 88001003.

Going back to a pre-5.0 app version there is no issue and I can sign in as you see.

Im stock Feb Android update, bl unlocked, magisk 25.209, app is on denylist, depralx safety net 2.4 mod, pass integrity checks etc
[Magisk] pndwal:
I downloaded the one you linked, 6.0.0...

As I said, I have Magisk App hidden in stub and Shamiko hiding... Do you?

If so and not passing, please say device and ROM... PW
[Magisk] crok.bic:
What does "etc" means in your context? In pndwal's setup there's Shamiko as well and that's what solves the issue for PS Remote Play for me, too.
[Magisk] deusfaux:
Ah I've read 'Shamiko' several times but haven't been introduced yet, seemingly never having an incentive to use it so I'll look into that and what it does
[Magisk] pndwal:
It's proper hideing, AKA new MagiskHide...

Denylist is really not proper hiding, but does revert/prevent Magisk/root modifications running in processes...

Denylist is really for / useful to Devs, pen-testers, security researchers etc... It's based on original hidecode, but completely repurposed and not targeted to Magisk for daily use, especially as it prevents Zygisk or Riru injection into processes in the list which is why solutions like USNF must now integrate proper hiding of root from gms as we also need code injection for more than one of its functions to work...

So unlike old MagiskHide, DenyList is limited for hiding Magisk root from gms and also it won't spoof expected signals so sensitive props aren't reset... Further, it doesn't add newer root trace hiding as banks etc discover and perfect techniques, eg traces of Zygisk, isolated processes, app zygotes, changes in init.rc etc...

These functions are all handled by Shamiko for modders' daily use and successor to @canyie's MomoHider...

🤠 PW
[Magisk] V0latyle:
Does GMS/GPS actually detect root, though?

I was gonna say that a unlocked but unrooted device should pass GMS checks but due to the hardware backed attestation it'll fail all 3 verdicts...

Does USNF do the actual "blocking" and "hiding" then?
[Magisk] manjaroid:
Like @deusfaux I haven't had incentive to use Shamiko. Until now.
[Magisk] deusfaux:
What are some typical

What are some common apps or uses for Shamiko? Is it unusual I haven't encountered anything that would need it, previously?
[Magisk] V0latyle:
Shamiko helps hide Magisk, Zygisk traces, and root. It's developed by the LSposed team.

Unfortunately there doesn't seem to be an XDA thread on the topic.
[Magisk] pndwal:
It certainly does... And at the base-level basicIntegrity!

That's why toggling MagiskHide used to add the attestation/droidguard (previously known as the SafetyNet) process (com.google.android.gms.unstable) in hidelist... If you manually removed it S/N would fail (even with MagiskHide still on)... And John originally recommended @Chainfire's suhide for SuperSU when Magisk users 'borrowed' that, and later included suhide for Magisk compatible phh root (superuser) developed by @phhusson before introducing MagiskHide for native MagiskSU when Magisk users moved to new integrated root...

Later, DriodGuard began checking for Magisk specifically, checking for properties like init.svc.magisk_service, persist.magisk.hide and more... (Of course John took this as a compliment... It also checks for Pegasus and the like.) Here's an original 3rd party SafetyNet Fix that addressed these detections, later implemented by John:

https://xdaforums.com/t/safetynet-f...017-07-17-on-magisk-v13.3637801/post-73055995

Johns comment:

https://xdaforums.com/t/magisk-the-magic-mask-for-android.3473445/post-73079059

Now, of course, we use USNF, although Denylist hiding is enough for pre keymaster 3 compliant devices along with a sensitive prop resetting solution...

Yes, since denylist breaks USNF...

Of course we're only discussing hiding needed to conceal root from gms here... Don't confuse this with hiding root from apps in general; USNF has no facility for this; that's the domain of proper root-hiding modules like Shamiko.

🤠 PW
[Magisk] V0latyle:
I see. So what exactly does DenyList do now, then?

I have noticed some of the apps I use that would normally detect root seem to work fine if I enable DenyList on them. So maybe there is some semblance of root hiding still?
[Magisk] zgfg:
Specially if you use Shamiko. Then Shamiko reads your DenyList and does its kind of hiding
[Magisk] V0latyle:
Ah. I don't, personally...have never needed to, and I'm a bit wary of the fact that there doesn't seem to be any official source aside from the LSposed git repo, which as far as I've found doesn't have specific instructions on how to use it...
[Magisk] deusfaux:
Yes but hide from what? Like what are some common apps Shamiko is keeping things hidden from? The niche Playstation Remote Play App is the first I've encountered that denylist + integrity pass didn't work on. Others?
[Magisk] pndwal:
I don't think I can add much to what I said above... Pretty much covered:

... To be clear, reverting/preventing Magisk/root modifications running in processes (denylist's function) is effectively basic root hiding...

👀 PW
[Magisk] pndwal:
Yup, it is closed source... Reasons given here:

https://github.com/canyie/Riru-MomoHider#deprecation-notice

Usage can be found by extracting readme.md from module.zip, as with many (most?) Magisk modules. 🙂 PW
[Magisk] pndwal:
It will hide root more effectively than denylist for many bank apps and more...

Nb. It won't attempt to further hide apps incl. Magisk App, so obfuscation using Magisk App stub hiding and 3rd party solutions like Hide My Applist (LSPosed module) as well as manual changes like disabling settings in Developer Options, or deleting detected folders, eg. TWRP, may be needed in addition...

Also, Shamiko root hiding will always be a WIP... It's not (probably far from) perfect...

🤠 PW
[Magisk] zgfg:
Btw, Readme zipped in the module is usually the same README.md that's displayed on the GitHub
[Magisk] LaiKash:
Device and Strong integrity is failing for me in all my Rog3 devices (with Shamiko but without the Universal Safetynet Fix). Do you or @shoey63 have the same behaviour?

EDIT:

Untouched device:

- Locked bootloader

- No Magisk installed

- Tested with different firmware versions (Android 11 and Android 12)

- Not pass CTS profile match (it should, it is an unmodified device)

With Magisk:

- Same behaviour with just Shamiko installed

- With Universal SN Fix Magisk module I manage to pass basic and CTS profile, not Hardware one so it might be that they blocked the Rog3 devices somehow
[Magisk] pndwal:
I don't have that device... Google has now (sadly) clearly revoked keys for strongIntegrity on Rog 3 since chain of trust is broken...

@shoey63 disclosed this change here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88127511

Next, @Displax put his finger on the real cause... I commented here:

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88127829

... There's no reason you shouldn't be passing deviceIntegrity (with @Displax modded USNF or other means to hide root from GMS etc) however... 😬 PW
[Magisk] LaiKash:
Well... I was really using this device to research HW attestation and those things. Nothing else to do here in this case afaik
[Magisk] DarkusRattus:
Just wondering, since the keys for the ROG Phone 3 have been revoked, does that mean it will always fail Strong Integrity even if it has stock firmware on a locked bootloader?
[Magisk] immortalwon:
Yes, because its TEE was defective from production and Google (the pseudo tech gods) has revoked the entire device key system stored in their database and marked it as a risk.
[Magisk] aboda7m:
Can someone check if these apps work with rooted devices

NAFATH | نفاذ خدمات - Apps on Google Play

NAFATH SERVICES IS AVAILABLE NOW !

play.google.com

SNB Mobile - Apps on Google Play

SNB Mobile, The Premiere Mobile Banking Application in KSA

play.google.com

They crash on open for me and i think its root related can someone try opening them?
[Magisk] Spartacus500:
NAFATH app work for me open ok, but SNB open crash 🤕
[Magisk] aboda7m:
Great thanks, could you also try https://play.google.com/store/apps/details?id=sa.gov.nic.myid

I kind of think its related to strong integrity but not sure
[Magisk] Spartacus500:
It opens for a while then crashes 🤷
[Magisk] aboda7m:
Do you think its detecting root then crashing? Or is it something else? Because its working on everyone else's phone but not on mine
[Magisk] V0latyle:
Nafath didn't work for me. Rooted with Magisk 25200, using latest Displax USNF mod, no other modules.

I didn't try location spoofing, and I don't use Shamiko
[Magisk] aboda7m:
I use Shamiko and its still crashing, whats location spoofing?
[Magisk] V0latyle:
Some apps are region locked by using device location information. Android has the ability to use a mock location app (in Developer Options) to set your location to whatever you want. However these apps crash before they even ask for location permission so that probably isn't it...

Make sure that a VPN or an ad blocker isn't causing the issue
[Magisk] aboda7m:
I disabled adaway and still crashes , there is also another application that says it detects root but doesnt crash immediately like this one

Absher | أبشر - Apps on Google Play

Absher is the official individuals eServices Mobile Application in Saudi Arabia.

play.google.com

It opens fine but when i click login button it detects root
[Magisk] intel_core_i7:
So, I had a very stupid argument with someone on the internet... I have a few questions to ask for myself (we "kinda" ended it, agree to disagree) after that and it may sound so stupid, pardon me. Here they are:

Is it "possible" for a future developer (anyone) to develop a method to pass PI's STRONG_INTEGRITY with an unlocked bootloader like how kdragon and displax's method of passing the other 2 categories, or even any way at all (even modifying the bootloader or something like that, I'm don't know much about it), like the ROG phone 3 case I read in some replies above. The opponent of me said it's "possible" to pass STRONG_INTEGRITY on an unlocked bootloader because of that phone, and in his view and technically speaking, he kinda won the argument. My original argument is it's impossible (like you guys originally said).

And a short summary of how Play Integrity's STRONG_INTEGRITY category work (and possibly how those "keys" work and stored on the device, and is it possible for anyone to tamper with it and do what I said in the first question) for a newbie like me (you can skip this)

Thanks for reading and replying to me, if you even do it at all
[Magisk] zgfg:
Generally, it should not be possible. It's far more than just about Play Integrity

If you pal thinks it's possible, he can try and (if still available) ask for a big money reward from Google, if he breaks on the new Pixel/Titan
[Magisk] pndwal:
Google have already revoked keys for strongIntegrity on ROG Phone 3, and are always able to do this in the case of broken keymaster implementations or other chain-of-trust compromises...

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88127829

Here's what John Wu originally said when SafetyNet began using Hardware backed evaluationType:

https://twitter.com/i/web/status/1237656703929180160

and FAQ answers:

https://twitter.com/i/web/status/1237830555523149824

Not much has changed other than 'cosmetic' differences between S/N API and the new PI API... Use of private key signed attestations performed by droidguard process in TEE OS (eg Google's TrustyTEE or OEMs alternative choice), cryptography etc means hacking this is virtually impossible...

While we can't simply bypass strongIntegrity attestation using root, John touched on the possibility of circumventing the attestation by using vulns (vulnerabilities) to hack system to hide root with locked bootloader... Nb. he also cites a Reddit writeup re. 'Why hardware-backed attestation is impossible to bypass?' with more technical details:

https://twitter.com/i/web/status/1355642038121885699

The vuln path is fraught / probably of limited value as it is limited to specific devices and vulns are usually patched in short order too.

More re. Hacking hardware TEE (wiki article):

https://twitter.com/i/web/status/1237662699233792000

Interesting convo between John and reverser Romain Thomas:

https://twitter.com/i/web/status/1458776847622148098

Previous post re. Thomas' work reversing droidguard (download his whitepaper pdf from his website):

https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88105937

👀 PW
[Magisk] intel_core_i7:
Wow. Thanks for the detailed reply! This will be a good read for myself, and for few others (maybe)
[Magisk] LinhBT:
Well, tell ur pal that believe it or not, it's just a matter of if Google want to do it and when they does, cuz in my POV, I'm sure that they have it fully under control in any circumstances.
[Magisk] chiteroman:
So, by the moment are there any device that pass STRONG with unlocked bootloader? Or any exploit or bypass avalaible?
[Magisk] V0latyle:
Go back and read the first post.
[Magisk] immortalwon:
Guys we may be in trouble, Google is quickly patching safetynet fixes as well as the lsposed play integrity fix module. We may need a new method soon. I get occasional fails.
[Magisk] pndwal:
On what basis do you believe this? PW
[Magisk] immortalwon:
The displax safetynet fix and the lsposed play integrity fix seem to work for a little bit of time. Eventually the modules will start to randomly fail. It doesn't make sense unless Google has finally started fixing both of their methods.
[Magisk] zgfg:
How could make sure that you don't have random issues with eg Zygisk or the USNF module itself (ie, that something else is not affecting your results or that you have changed your config like Magisk, etc)

Btw, if Google did change, I bet your new results would be consistent, not random

Also, not seeing that anybody else claimed something similar and conclusive. For me, PI API Checking (A12, but also probably different phone than yours) consistently pass
[Magisk] immortalwon:
Can you give me a run-down of your setup? I am pretty sure I ain't doing anything wrong. Running UNSF Displax, Cleared my caches on playstore and services, magisk 2.61 with zygisk. Running oneplus pro 9
[Magisk] immortalwon:
I just realized my problem could have been the magiskhide props config, the old 6.1.2 version. I was only using it because of a post I read how some devices have lower fps for specific games.
[Magisk] zgfg:
As I wrote, I expected to have different phone, ROM, etc

I have Xiaomi, with Xiaomi.eu where I don't need and don't use USNF

Second, I use Magisk Delta

But what I want to say, for me there are no differences today, vs yesterday, last week, etc - always passing Play Protect PI API Checker (in that app, in TB Checker and directly in Google Play app Developer settings).

Hence I don't see any change, at least on my side

But I well remember how it looked in two or three occasions earlier. There were suddenly a number of users who were affected by Google changes, and not random in time. If they were affected, they were affected the while day, no matter how many times they re-tested

Edit: Seeing now your new post - hence your problem was not related to Google's changes. Good that you found the root cause