yashsingh1/xdaforums huggingface dataset:
[Magisk] L0nk:
In my case - I still pass basic Integrity. Device Integrity is a fail on my old Mi 9T Pro (using xiaomi.eu rom) - which I still haven't replaced as it's still holding up super well. But well.. ro.product.first_api_level on this device doesn't even seem to be set. I guess I'll wait a bit - so far, apps still seem to run fine interestingly enough - including my banking apps.
[Magisk] zgfg:
Oops. I see it also now on my old Mi 9T (not Pro), Xiaomi.eu MIUI12.5/A11

So far I didn't need USNF (except when playing with Strong Integrity, before Google fixed on their side), passing Basic and Device with Shamiko only worked fine

Now I tried also with safetynet-fix-v2.4.0-MOD_2.0 and safetynet-fix-v2.4.0-MOD_1.3-Zygisk but they cannot help. And YASNAC shows now (first time seeing that except when Strong Integrity worked) Hardware backed CTS evaluation

logcat | grep SNFix attached

Spoiler content hidden.
[Magisk] Lord Sithek:
On my device's Telegram group I've also read that on Xiaomi.eu DEVICE_INTEGRITY is broken no matter what USNF version is used. But on my EEA variant it passes with 1.3
[Magisk] zgfg:
On Xiaomi.eu, MIUI 14/A13 it still works, and without USNF
[Magisk] Lord Sithek:
Oh, I misread you then. That's interesting
[Magisk] sawdoctor:
Try with safety net 2.4.0 1.3 that seems to be passing device integrity for most people. I've attached it or just get it from his GitHub page
[Magisk] zgfg:
See

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-8883628
[Magisk] kholdstayr:
I just wanted to say thanks ♥️♥️♥️♥️♥️ this works great. I upgraded to Android 13 and the original safetynet module stopped working with cts. I installed this and now it passes cts.
[Magisk] pndwal:
The following may contain errors but should give some insight into recent 'Google tinkering' as well as Integrity verdict production methods and their evolution... For anyone interested...

Spoiler content hidden.

End of lesson (for modders and for our benefactor). 🤠 PW
[Magisk] L0nk:
Thank you. That's the one I am using - also made sure Zygisk is enabled, it's the Zygisk version. Guess it's broken - but Shamiko and Co. do their job - and games still function, banking apps still work. So for now it seems there are no issues yet - I wonder if Google Pay stopped working. Yesterday morning it still worked fine - but well. I'm gonna see.
[Magisk] ipdev:
Hi all. 🙂

Using safetynet-fix-v2.4.0-MOD_2.0.zip..

My older devices (released before API/SDK 33) pass both basic and device integrity.

Spoiler content hidden.

My 7 and 7a only meets basic integrity.

(SafetyNet CTS if I remember correctly?)

As a quick check, I reset ro.product.first_api_level down to 32.

Both meet basic and device with the prop reset. 😉

Spoiler content hidden.

Spoiler content hidden.

Hope it helps more than confuse. 🙃

Cheers. :cowboy:
[Magisk] ykjae:
I'm using mod 2.0 with my pixel 6 pro and not spoofing any values. I pass everything but strong.
[Magisk] Nergal di Cuthah:
Same.
[Magisk] zgfg:
Originally, mine is 28.

I tried by deleting the prop and by upgrading to 30 and 31 (currently on A11 on that older phone) but no success with passing Device Integrity (tested together with mod 2.0 and without)
[Magisk] osm0sis:
Hmm, so should people in general revert to 1.3, or await a 2.1 or something to account for the new changes causing failures on newer devices?
[Magisk] beeshyams:
That's what I did Pixel 6a
[Magisk] pndwal:
The MOD_2.0 Displax USNF, like the various PIF buids, was NOT based on prop settings who's effects were ever going to last...

It sets various props to spoof walleye/Pixel 2 as that fingerprint prop specifically triggered both an override of shipping level based hardware backed verdict enforcement (server end, intended apparently only for early early batch Pixel 2 devices to distinguish these from later batches with incremented API/SDK level; likely this worked for LV API/SDK versions ≥33, 26, possibly 27 and possibly ≤25) and, more remarkably, overrode all hardware backed attestations that normally break strongIntegrity and falsely showed hardware-backed evaluationType while only basic evaluationType attestations were used in reality (again, server end, intended (or unintended?) apparently only for early early batch Pixel 2 devices).

See code:

val patchedProduct = "walleye"
val patchedDevice = "walleye"
val patchedModel = "Pixel 2"
val patchedFingerprint = "google/walleye/walleye:8.1.0/OPM1.171019.011/4448085:user/release-keys"

Initialize DEVICE_INITIAL_SDK_INT

See changelog:

I put more supposition about why we could exploit this in my WOT above:

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88837329

Google's back end fix for the strongIntegrity "bug" shouldn't affect most v2.4.0-MOD_2.0 users as deviceIntegrity would still pass with basic evaluationType on-device fallback, and the prop-based model and fingerprint mismatches needed on some devices to bypass server end hardware-backed verdicts would still work with walleye print (apparently now no longer slated for hardware-backed verdict enforcement at all meaning a mismatch won't be needed for Pixel 2 so it should also work with this print)...

The back end fix for walleye fingerprint props override of shipping level prop based hardware backed verdict enforcement will affect devices requiring the original shipping level prop based hardware backed verdict enforcement bypass (setting shipping level to 32) added for Android 13+ launch version devices, ie Pixel 7, Samsung S23, Redmi 12 series etc, as this was removed in order for the walleye fingerprint prop's override to work instead...

So for devices launched with A13+, users will need to use v2.4.0-MOD_1.3 Displax USNF or await an update...

@Displax, could you please produce a new build reverting the latest prop changes (from marlin/Pixel XL to walleye/Pixel 2), as well as restoring 'set shipping level to 32 for devices >=33 to trigger software-only (basic) attestation' but this time in GMS only instead of global namespace? This should allow A13 LV device users also to enjoy a build with fixed KernelSU support as well as fixes for WiFi calling/other issues... Some will no doubt appreciate later Riru-based and microG supported builds also if it's possible... 😋 PW
[Magisk] pndwal:
Changing shipping level only works for A13+ launch version devices since Google only enforces hardware-backed verdicts by means of ro.product.first_api_level where it's 33+...

Custom XiaomiEU issues in recent ROMs may well be related to recent use of walleye print but it seems the way their implementation rejects USNF settings is the real issue... As @Displax said, "So strange ROM..." 🙃 PW
[Magisk] dorimanx:
Displax BRO! Thank you for your work with mod 2_0 worked perfectly on my OP8T Android 13.

Now i can use wallet again, i wish you only the best! :)

XDA community never let me down.
[Magisk] mattgyver:
OnePlus 8 Pro running the latest LineageOS 20 nightly (20230806). Integtrity checker shows that it's not meeting strong integrity. YASNAC is showing I'm passing CTS profile now, but my apps that are in my magisk denylist are still seeing the phone as rooted so they aren't working.

I removed magiskhideprops and kdrag0n's safetynetfix, and installed your mod. Initially, I was getting a CTS Profile Mismatch. that's passing now, in YASNAC, but it's still throwing the rooted notification in the apps, and showing that strong integrity fails.
[Magisk] Jon8RFC:
Shamiko magisk module works well for me with many rooted apps.

Releases · LSPosed/LSPosed.github.io

Contribute to LSPosed/LSPosed.github.io development by creating an account on GitHub.

github.com

And this adb hider works for some as well. I use both simultaneously.

GitHub - Xposed-Modules-Repo/xyz.xfqlittlefan.notdeveloper: 我不是开发者 / IAmNotADeveloper

我不是开发者 / IAmNotADeveloper. Contribute to Xposed-Modules-Repo/xyz.xfqlittlefan.notdeveloper development by creating an account on GitHub.

github.com
[Magisk] pndwal:
Thanks for linking 'iamnotadeveloper' module... Hiding debug bridge and developer options will be useful for some... 👍 PW
[Magisk] Displax:
Yes. Temporary use 1.3 until the update comes out
[Magisk] bymisi:
Great . solved cts pass on my Veux device . Thank you !
[Magisk] chiteroman:
Fixed, also should work in Xiaomi.eu ROMs. Only Basic and Device. I'm still researching to pass Strong.

EDIT: check https://xdaforums.com/t/module-play-integrity-fix.4607985/
[Magisk] anthonnyb98:
P7Pro Device integrity still not working
[Magisk] chiteroman:
I know why. I will fix it
[Magisk] pndwal:
May we see source? 👍 PW
[Magisk] casouzaj:
Sony Xperia XZ2: running LineageOS 20.0 and Magisk Delta (still 25210). Device and Basic integrity tests pass, strong fails.
[Magisk] chiteroman:
I just modified .dex file, the zygisk libraries are the same. You can check the .dex source code using Jadx 🙃

Doesn't work and never will work due first api level is 33 (Android 13).

Expected behavior 😁
[Magisk] pndwal:
But isn't that why Mod 1.3 etc set 33+ to 32?... Mod 2 removed that only because walleye associated shipping level check (unintentionally) overrode the hardware-backed verdict enforcement for 33+ LV devices...

Mod 1.3 did make shipping level targeted, but spoofing 32 needs to be restored... But targeted to fix WiFi etc... What am I missing?... PW
[Magisk] zgfg:
Thanks 👍
[Magisk] chiteroman:
If you set ro.product.first_api_level in all namespaces system will break.

Check my module: https://xdaforums.com/t/module-play-integrity-fix.4607985/
[Magisk] anthonnyb98:
Excellent, now it works on P7Pro
[Magisk] pndwal:
Didn't suggest that... I said targeting GMS since it's clear previous shipping level spoofing broke wifi etc in some devices...

Nb. It was set globally in @Displax USNF fork long before we had 2.4.0, and only recently did anyone discover issues...

Yeah, saw your code for that... My response was to:

Anyway, seems you've fixed the build by ensuring prop targeting GMS is set to 32, unless lower, now...

Thanks! 👍 PW
[Magisk] UnknownPlanet:
It doesn't work on Samsung Galaxy Note 4 SM-N910H with Custom ROM of REFINED_NOTE8_7.1_T2.zip + latest RisingNote4 and Custom Kernel of Helios_Kernel-V3.1-N910C.H-20200809.img and latest Magisk debug channel version 26105 with Zygisk enabled.

The phone was released on October 2014, definitely doesn't have any hardware attestation feature.

Shamiko only supports Oreo and up.
[Magisk] chiteroman:
Android 7 and lower just need to spoof device model and fingerprint. Use MagiskProps.
[Magisk] pndwal:
USNF module has support for 7.0+ (but you may be using PIF.) I believe it's supposed to work but you won't need the principal fallback to basic-only attestation function or secondary hardware-backed verdict enforcements...

It should provide for hiding root from GMS (Google Play Services), resetting sensitive (suspicious) props and the recently added certified fingerprint spoofing (which accommodates custom ROMs although it's an unintended benefit) which you need as long as you have Zygisk = Yes in Magisk app main page...

If it's not working, you can use MHPC module to configure a certified fingerprint prop if the ROM didn't integrate this to pass SafetyNet originally, and the module will also reset sensitive props by default (no need to configure this)... You'll also need to hide root from GMS Droidguard (attestation) process, ie. Google Play Services com.google.android.gms.unstable process by adding it in denylist... You can enforce denylist, but using Shamiko (hijacks denylist as a hidelist) is better...

👀 PW
[Magisk] ipdev:
Not sure if it will help. 🙃

I wrote a module with the changes I was making for older devices when I was testing the changes in Magisk.

Removal of MagiskHide and the introduction of Zygisk.

I updated it about a year ago so, it should still work? :unsure:

mHide SafetyNet - [github] - Link

Along with the MHPC module, I was able to pass SN at the time on older devices.

Cheers. :cowboy:
[Magisk] Hybrid Divide:
Any idea if this will help on the OnePlus Nord N30 5G / CE 3?

I've been able to root, but can't pass SafetyNet / Play Integrity.

Any help would be greatly appreciated!
[Magisk] innit:
So far mod 6.0 passes basic & device integrity on Pixel 7 Pro with August firmware. Thanks 🙏

Edit: Worked for almost a whole day (flashed yesterday around 16) but stopped working now 😅
[Magisk] Hybrid Divide:
Damn. Hope this can sorted out soon. For both our sakes!
[Magisk] zgfg:
Probably will be but then a question for how long

Google just tweaks a thing on their side and it will be back at the square one
[Magisk] m0han:
Just an FYI for people running Magisk Delta and Riru (Zygisk not enabled): https://xdaforums.com/t/discussion-...third-party-magisk-fork.4460555/post-88864243. Many thanks, @Displax.
[Magisk] sunny928:
Hello bro I have Samsung galaxy s21 ultra and I flash all safety net not pass strong integrity please tell me what I do because my uber show error unable to authenticate device.please tell me
[Magisk] beeshyams:
I am sorry, I wish I could but I can't help you

I do not have enough knowledge

Maybe some body can help. Thank you
[Magisk] pndwal:
Yeah, Uber added detections for Uber Driver app on Aug 4... No-one has found fix with unlocked bootloader yet AFAIK... App opens and can sign in fine, apparently even sign up with Uber, but detection occurs when you press GO button to proceed with a job and you see "unable to authenticate device" error.

I can't test further but suggested trying the app with Alpha Magisk (has native bridge loaded Zygisk) and Shamiko hiding here:

https://xdaforums.com/t/need-help-uber-driver-app-not-go-online.4614295/post-88851595

No-one responded...

If that doesn't work there may be some other detection used that can be bypassed but I suspect they may be using Google's published model for "Verifying hardware-backed key pairs with Key Attestation" to poll VerifiedBootState along with Keymaster/KeyMint version:

https://developer.android.com/training/articles/security-key-attestation

If apps are now doing this instead of relying on Play Integrity API, I'm sceptical any solution will be found short of re-locking bootloader. 😬

🤠 PW
[Magisk] spida_singh:
Thanks! Latest riru, canary lsposed for riru and riru safety net fix has allowed me to pass safety net without zygisk. Running magisk alpha canary.
[Magisk] supermansaga:
Is it me or is it Shamiko 0.7.3 or Displax 1.3 that the airliner EVA Mobile app v4.9.1 no longer works on pixel 7 pro? Thx. Passing both basic and device check with Displax 1.3.
[Magisk] chiteroman:
Working. Maybe bootloader check?
[Magisk] Spartacus500:
For me not working 🤷 Zygisk on.
[Magisk] sawdoctor:
Have you installed any other mods recently especially xposed ones? I've had a few xposed mods cause apps to fail root check. Unfortunately once an app has detected root you usually have to wipe play services data and the individual app data or it will usually still detect root
[Magisk] Spartacus500:
From the Lsposed modules, I only have one HMA, I cleaned the apps, nothing helps.
[Magisk] pndwal:
Fine for me with Alpha Magisk (with NBZ POC) and Shamiko... Guess it's detecting official Zygisk...

Didn't need HMA or to hide Dev options, USB debugging or OEM unlock... 👍 PW
[Magisk] chiteroman:
A lot of apps (including games) are detecting official Zygisk, hope topjohnwu release v27 with native bridge.
[Magisk] supermansaga:
Brave warrior. I only do Canary
[Magisk] supermansaga:
But why is it checking my bootloader but not yours?

I don't want to re-add my payment cards by deleting play services data. EVA alone is not worth it yet.
[Magisk] pndwal:
It isn't, except for likely trying to via PI deviceIntegrity; I didn't disable spoofed for that to check... It'll be detecting your Zygisk... PW
[Magisk] pndwal:
He'll release NB-Zygisk, even if after 27.0, but I imagine they'll just push back 27.0 as needed... They're all collaborating with this...

Nb. branch still "has conflicts that must be resolved"... 5 months in... 🙃
[Magisk] bombadier:
Does anyone in this thread know the mechanism that Google is using to stop the Google one App vpn from working on rooted/unlocked bootloader devices?
[Magisk] Lughnasadh:
I don't know what mechanisms that one is using. Maybe this will help, or not... (probably not what you are looking for 🙃).

New: Play Integrity API now has two options for requesting verdicts. Standard API requests, new and in beta, are low latency and can be used on demand. Classic API requests take longer and should be made less frequently. You can decide whether your app makes standard requests, classic requests, or both.

Make a standard API request (beta) | Google Play | Android Developers

developer.android.com
[Magisk] chiteroman:
Who knows? 😋
[Magisk] bombadier:
Thanks for the link but that is gibberish to me, the google one app has a free VPN for pixel users which does not seem to work on rooted/unlocked phones,there is a thread here about it but nobody seems to know exactly why its not working, was hoping to gain some insight from the knowledgeable types that frequent this thread, cheers.
[Magisk] Lughnasadh:
Yeah, I really have no idea why that doesn't work. I've never been able to get it working on my Pixel 7 Pro, but Google's VPN isn't that great in my opinion (lack of features, e.g. Kill Switch, slow speeds, etc.), so I don't even care that it doesn't work properly. Other free VPNs (e.g. ProtonVPN, Windscribe) work fine for me while rooted.
[Magisk] supermansaga:
I am obviously not a tech person, but I think the superiority is its pureness for streaming media purposes, circumventing those georestrictions easier
[Magisk] essor-13:
Worked on redmin note 11 spesn stock rom MIUI 14.0.1.0 / Magisk 26.1, thanks a lot !
[Magisk] :
Hi, I have an interrogation, on Pixel 7 the original safety net fix by kdrag0n disables hardware_backed attestation, but can't pass of course play integrity attestation. So could it be possible to combine the modules to pass device integrity and basic integrity + disable use of hardware attestation on Pixel 7 to pass strong integrity ? Thank you
[Magisk] acwcanada:
As far as I know, you are never going to pass strong integrity if phone bootloader is unlocked. A few weeks people find a way to do it but it actually is just a Google bug and Google fixed it pretty soon.
[Magisk] pndwal:
My response to duplicate post here:

https://xdaforums.com/t/module-play-integrity-fix.4607985/post-88907995 🤠 PW
[Magisk] elmor0:
kdrag0n doesn't but Displax flags up as having a trojan (Android/Generic.S.281A7A!tr) on VirusTotal scan...........

Any suggestions/ alternative?
[Magisk] Nergal di Cuthah:
Yes, dont take one out of many antivirus word for it. They're called false positives

VirusTotal

VirusTotal

www.virustotal.com

Always good to post your vt results when talking about them
[Magisk] zgfg:
What about potential false-positive virus detection?

On the other side, do you mind the other users (nobody complained about). Also, did you check the source code to make a verdict

And yes, there is the alternative, a module under a different name and from another developer, and you can find it mentioned and a link to its thread in the posts in this thread
[Magisk] Nergal di Cuthah:
Infact what it is telling you is that on android this file can access root functions, i gather from it being "generic android"
[Magisk] TotallyAnxious:
https://www.reddit.com/r/antivirus/comments/oabu6z/_/h3j56di
[Magisk] gknayak9:
How to wipe GMS data (not cache)

Please help 🙏
[Magisk] zgfg:
Details depend on your ROM

For me (MIUI):

-Settings, Apps, Manage Apps

-enable Show System Services in the menu

-scroll to (search to go faster) Google Play Services

-Clear Data, Manage Space, Clear All Data

Screenshots attached

But again, how these menus may look on LOS or Pixel or your other phone/ROM, I have no idea
[Magisk] Fishawy:
Completely unrelated, but that %1 battery gave me a mini anxiety attack :D
[Magisk] zgfg:
30 seconds till turn-off started to count-down while I was editing the screenshots...

I posted and switched to the other phone. One more screenshot here (and here the battery is on 99%)
[Magisk] elmor0:
I tried with Displax SFNF - CTS profile now passes [basic-integrity already passed with kadrag0n before].........

.......... but the App I'm trying to run (Metrash2) still detects root (HSBC & Ehteraz apps however work fine/ are hidden from Magisk)

Any suggestions/ work around please?

(trying this with latest Magisk, enabled Zygisk + Magisk hide + enforced DenyList; on Android 11, OnePlus 7T Pro)
[Magisk] gknayak9:
Great help. Paytm worked. Thanks a ton @zgfg

But Phonepe, BHIM upi and sate bank India Yono app mis behaving. I have already added them in Deny list.

Shall I Enforce Dely list or not
[Magisk] pndwal:
MagiskHide?... Which Magisk then?... Or do you mean Hide the Magisk app (ie. app renamed/obfuscated)?

I have this:

with unofficial Alpha Magisk+Shamiko (Builds WIP native bridge loaded Zygisk from LSPosed Metagisk zygisk test branch... 👀 PW
[Magisk] manjaroid:
stub-release.apk from official Magisk builds will trigger AV software also because the file has a trojan-like function as an apk downloader and starter. There's probably something similar happening with Displax's module.
[Magisk] osm0sis:
The new SNFix.dex probably.
[Magisk] elmor0:
Links to these please - will try it out.............
[Magisk] grzes222:
He tests different solutions, different phones

xiaomi redmi , samsung a02s a31 a52s

I use Magisk+LSposed+xprivacyLUA PRO

and on a52s i can never reach SafetyNet

and the other phones, sometimes it works, sometimes it doesn't, but I'm just learning and I don't understand everything.

Gentlemen, explain one thing to me

Is there an ideal phone model, some Android version so that you can run the whole setup once so as not to worry about SafetyNet, Gpay and banking apps?

Is it an eternal battle with windmills until an application or module in Magisk is updated?

Does google want to detect Root devices all the time?
[Magisk] zgfg:
You will not pass SafetyNet/PlayIntegrity with XPrivacyLua, hence Wallet will not work

Not only that you must uninstall, but you must manually delete certain remaining XLua files

Take a look into the older posts in the thread
[Magisk] wyt18:
Xlua is the culprit, you need to delete it and get rid of all traces of it including in root and sdcard
[Magisk] pndwal:
If you respond to my questions I might respond to this... PW
[Magisk] dmenezes:
Just stopped by to say this module is working GREAT and passed SafetyNet with Magisk 26.2 on my Lisa running LineageOS 20 official, just followed the instructions and it worked first time, didn't even had to run `props` in the terminal!

Thanks @Displax and congrats on a job well done!

If anyone is interested, I posted a more detailed description of what I did right here: https://xdaforums.com/t/rom-android...ite-5g-ne-mi-11-le-lisa.4468087/post-88936407
[Magisk] grzes222:
Gentlemen, can you give me a hint

why sometimes safetynet disappears after reboot?
[Magisk] andreidi:
I have updated my firmware on my Samsung A54 and now I have the 2023-08-01 security patch. I am using safetyfix 2.4.0 mod 2.0 + shamiko 0.7.3.174 and I don't get CTS profile match pass anymore, with the old firmware it worked fine, security patch was 2023-07-01. Any ideas?
[Magisk] pndwal:
Experimental 2.4.0 mod 2.0 is broken for devices launched with Android 13...

Use 2.4.0 mod 1.3 till an update to use targeted shipping level spoofing is published (to fix VoWiFi etc) or try @chiteroman's PIF module... PW
[Magisk] andreidi:
Play Integrity Fix from chiteroman did the trick! Many many thanks, my friend!​
[Magisk] :
This did the trick for me too, thanks. (Redmi Note 10S, android 12,, RiceOS)
[Magisk] Thebear j koss:
Sorry, I'm a little confused here. I was using 2.40 mod 1.2 and I was passing basic and device integrity on my pixel 6 pro stock rooted with magisk and GPay worked until the August update. Now all I can get is basic integrity working no matter what I do. Does GPay work for anyone on stock rooted pixel 6 and what are the exact steps I need to do to get device integrity back? In Magisk enforce-deny it seems like google services framework never sticks. Any help would be appreciated, or if safetynet is broken from last update a clear answer would also help. Thanks.