yashsingh1/xdaforums huggingface dataset:
[Magisk] WhoIsJohnGalt1979:
I use the latest module released by displax with shamiko and have only wallet in the deny list along with other banking and office applications like company Portal. Adding playstore and gsm and other google services always proved counterproductive to me as doing so made my pixel 7 pro show up as a pixel xl under devices in google - security tab.

You however have to delete data from gsm and playstore with airplane mode on and reboot, there are multiple posts to guide you through the procedure.
[Magisk] Fishawy:
Interesting! Did you have any negative experience with removing Playstore and GMS from DenyList?

I have the same issue with the device name under security tab. If Google Wallet, banking apps, government apps, and SafetyNet are all okay, I might give this a shot.
[Magisk] Fishawy:
Thank you so much for the detailed explanation, and no, "childish instructions" is far far from that!

I have to apologise if my comments were not clear. I am passing SN, banking apps and Google Wallet are working fine, with the help of USNF Displax mod and Shamiko. I was only questioning the removal of Playstore and GMS from DenyList, since many old & new posts here portrait adding them to DenyList as a mandatory thing.

At the risk of screwing things up - or fixing something that isn't broken - I might actually give your guide a go when it's time for a clean installation or a reset. You know how painful it can be to get everything to work nowadays.

Thanks again, appreciate it!
[Magisk] WhoIsJohnGalt1979:
The only impact of adding any google component except for wallet for me has been the Pixel XL showing up under devices. I don't remember anything else broken from a functionality point of view.
[Magisk] zgfg:
PlayStore is an app that calls GMS for Play Integrity (SafetyNet in old times) - hence no point in putting PlayStore to DenyList

USNF, when installed, removes GMS from DenyList on every reboot (ie, you put it back, reboot and you will see that GMS is removed from DenyList)

Both facts have been zillion times commented in the original USNF thread, Play Integrity thread, general Magisk thread, Magisk the Zygisk thread and so
[Magisk] Bladius:
MEETS_STRONG_INTEGRITY still fail
[Magisk] osm0sis:
Always will. Read.
[Magisk] Bladius:
I don't know why, but integrity traversal stops working very quickly. You need to restart the device. This is a problem that was not fixed by the original version or even a similar module (Play Integrity Baypass)
[Magisk] pndwal:
Correct that these shouldn't be added (and gms in enabled denylist breaks Zygisk based USNF)...

Don't think this is so however (wouldn't alter props)...

I believe that would have been caused by MHPC module left enabled with Force BASIC key attestation (superseded by USNF) enabled. Default setting will set ro.product.model value to a pre-keymaster 3 (pre Android 8) device from the same OEM. 👀 PW
[Magisk] ipdev:
This should only happen if the DenyList is enforced.

USNF should never remove `GMS` or alter the DenyList when not enforcing.

No reason to remove `GMS` unless DenyList is enforcing.

Other modules might source the denylist, removing `GMS` might affect those modules.

USNF should only remove `GMS` if Magisk returns "enforcing" for DenyList.

If USNF is removing `GMS` or altering the denylist when not enforcing, we need to fix it.​

Cheers. :cowboy:
[Magisk] Fishawy:
That's correct on my device. With UNSF and Shamiko, GMS is never removed from DenyList.
[Magisk] ipdev:
Are you enforcing Denylist in Magisk?

If so, then `GMS` needs to be removed.

Then we need to fix that also. 😉​

Cheers. :cowboy:
[Magisk] Fishawy:
No, using Shamiko without enforcing DenyList. GMS sticks to the list after rebooting.
[Magisk] Nicknoxx:
Brilliant, thanks. Worked for me on Pixel 5 with Android 13.
[Magisk] NotesOfReality:
I installed this recently on an A13-based crDroid and the only issue I had was all the permissions of the "Google Play Services" app were denied after I cancelled its data except the network access, and I unfortunately didn't notice it.

I cleared GMS data lots of times to pass the PI checks and I never had to manually grant permissions back, so I suppose it's on A13, or should I assume it's on the Gapps installation .zip package I used?

Obviously(?) the almost total lack of permissions made any Play Integrity API check output an "unevaluated" result which meant it couldn't even pass the MEETS_DEVICE_INTEGRITY and the MEETS_BASIC_INTEGRITY checks.

If I may, I suggest adding a little notice to the guide in the OP to suggest checking the permissions of the "Google Play Services" app.

Anyways, the module does its job just fine, thanks a bunch! ♥️
[Magisk] pndwal:
Play Integrity API is connected with gms (Google Play Services) and so was Play Protect for a long time, but they are not the same.

Play Protect affects Play Store device certification status and may affect whether some apps appear in the Store but won't affect Play Integrity results... Conversely, PI does affect PP.

Further, whereas PP used to be part of gms (Play Services) and clearing PS data would reset it, in late devices/late Android PP has been seperated from PS and is now an app in it's own right, Google Play Protect Service. Users of late ROMs/devices need to clear Google Play Protect Service data in addition to Play Services to reset it.

👀 PW
[Magisk] NotesOfReality:
@pndwal my bad, I confused PI with PP at the start of the second sentence.

Thanks for your reply, the disambiguation and the infos you provided are valuable.

Coming to think of it, the Play Protect status of my device after I flashed the USNF MOD magisk module was always positive regardless of anything I did.
[Magisk] coolvipcandy:
Long and painful, but actually works. great job bro.

BUT trips safety net (basic integrity fails, All 3 Reds) but surprisingly the banking apps still working magically. I dont know how, neither interested coz

"never mess with code, if it works" :p

Though any new added app does detect the safety net/root, but all current apps somehow seems to work without any issue.

In contrast to YASNC and Integrity checker declaring safety net failure, play store says device certified (may be coz added to deny list)
[Magisk] coolvipcandy:
UPDATE : All peachy NOW, one of LSPOSED modules was culprit,

disabled all : safety net passed.

then enabled one by one.
[Magisk] Fishawy:
Just out of curiosity, which module was it?
[Magisk] coolvipcandy:
It was hushsms, one that I've been using since long time but I guess my new device os didn't get along with it. ( POCO F5, MIUI14, Android 13).
[Magisk] uschipower:
I am using Universal SafetyNet Fix 2.4 Mod 1.2

I noticed that Goggles Gmail-App doesnt start if Module is enabled. If I disable the module (and reboot) without any other changes, App starts correctly.

Any idea how to fix this?

Device: Lenovo TB X505F

Rom: A13 GSI LineageOS TD-based, Maintainer AndyYan

Generic System Image (GSI) list

Notes about tinkering with Android Project Treble. Contribute to phhusson/treble_experimentations development by creating an account on GitHub.

github.com

newest DeltaMagisk
[Magisk] osm0sis:
Works fine here with regular Magisk latest canary, on latest official Lineage and NikGApps, maybe ask in Magisk Delta or your GSI thread.
[Magisk] Displax:
MOD updated to v.1.3 !

Fix "stat /sys/fs/selinux" access time reading. Also removed archaic MIUI cross-region shenanigans. Thanks to PR by aviraxp!

Ignore props changing on Xiaomi.eu. This fixes randomly attestation failings. So strange ROM...
[Magisk] coolvipcandy:
v1.2 working fine on my 3 MIUI devices, poco f5, redmi note 10 pro max and redmi tab, No issues specific to this mod, though always had issue when starting fresh on any device, happened with all three, but thereon no random attestaion failures etc, once setup, its smooth.

Though Magisk isn't displaying update for same. Updating manually. Thanks for updated version and fixes.
[Magisk] zgfg:
Just for info - Xiaomi but not stock than Xiaomi.eu

Finally I upgraded my Lisa (clean install with Factory reset) to Xiaomi.eu MIUI 14.0.8 / A 13 (Sec update Apr 2023) and for now I didn't yet install Magisk (Bootloader is unlocked since Xiaomi.eu is custom ROM) and (as with previous Xiaomi.eu versions for A12 and A11), USNF is integrated to the ROM, passing Play Integrity (Basic and Device) and SN (Eval type Basic)

Btw, passing all detectors (TBChecker, Ruru) and even Big Minotaur is Normal (first time I see that)

Only Momo warns about Unlocked BL and Developer options and (sic) SCheck reports Root detection not passed (err 107|204|606)
[Magisk] pndwal:
Could you update to latest (V10) and try? 👍 PW
[Magisk] zgfg:
Native Test (or else)?

Mine was v7 - do you have link plz
[Magisk] pndwal:
Same I gave you in April:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-88408003

I see she only keeps the latest...

😉 PW
[Magisk] zgfg:
Minotaur v10 is also ok

Hence only two 'issues' with the official (custom ROM, not stock) not-rooted Xiaomi.Eu MIUI 14 / A 13 as on the screenshots

Of course, Play Integrity is ok with Device and Basic, not Strong and Key Attestation shows BootLoader unlocked (as is)
[Magisk] zgfg:
Just to mention that Google sees my Xiaomi as Pixel 2 (built-in USNF)

Now, with Magisk Canary v26102, Zygisk enabled, DenyList enforced with com google.android.gms.unstable checked-in, SafetyNet and Play Integrity are still ok (without any module installed - ie, no USNF or Sensitive Props)
[Magisk] WhoIsJohnGalt1979:
@zgfg FYI. All is working fine on the latest Displax update, banking applications, company portal, and other apps which detect root (i know there are some which fall through the crack). I do not have any google components in Deny list except for wallet and the apps that I actually want to hide. Deny list is not enforced. I wish there was a way to remove these two lines from Momo and API detector lol but I will live with it considering that everything works as it should for my setup.
[Magisk] pndwal:
API detectors seem good... Do you mean Applist Detector?...

Put Momo in denylist... Disable USB debugging or use app like https://github.com/accelforce/DevOptsHide

Put hidden Magisk stub app and xposed modules in a Hide my Applist xposed module template and enable hide with that template for Applist Detector... 👍 PW
[Magisk] pndwal:
Good stuff...

Just to confirm, tmpfs mount path is debug_ramdisk?... and only need to hide root from com.google.android.gms.unstable process (DroidGuardService) now, as in xbin tmpfs mount path (old) days?...

Edit: I see from screenshot you also have com.google.android.gms (GMS Core) selected in denylist... Please could you test without that to confirm the above? 👍 PW
[Magisk] zgfg:
Of course that for Magisk v26 mount path is debug_ramdisk - please look to the general Magisk thread, we've been discussed that code change regarding to v25 and earlier where it was /dev/<random-dir-name> and the corresponding (unfortunate) change that since v26 it is read-only

For additional experimenting - no time now. Must get the phone with upgraded OS and now Magisk v26 (definitely worse for hiding than Delta v25 I used previously) working for my daily personal and work needs

Now in the process of setting up, I still have issues with some detectors that I previously never had but at least the real apps I need do work (although I still did not configure all of them, hence we'll see).

Therefore, I'm not going to experiment with changes as long as I don't need (like unchecking gms process and leave only gms.unknown to see would it cause PI to fail)
[Magisk] pndwal:
Well not 'Of course for Magisk v26'...

debug_ramdisk replaces /dev/<random_string> as TMP dir only in devices where there's no (Magisk accessible) /sbin...

Also it wasn't in v26.0 or 26.1... it'll be in next stable/beta... Was only in latest canary, 26102...

... I am just hoping to learn if PI deviceIntegrity still requires hiding root from com.google.android.gms (GMS Core) in addition to com.google.android.gms.unstable process (attestation / DroidGuardService) where Magisk uses debug_ramdisk as path, or if having root hidden only from the latter will now be enough as it is where /sbin is/was path...

-------​

Perhaps another member with XiaomiEU or similar custom ROM with integrated SNF or a like (basic attestation fallback) solution (so don't need/use USNF) who also runs Magisk could check tmpfs mount path = debug_ramdisk by running

su
magisk --path

in a terminal emulator app and let me know if adding the Google Play Services (attestation / DroidGuardService) process com.google.android.gms.unstable to denylist is enough to pass PI deviceIntegrity, or if (GMS Core) process com.google.android.gms is actually still needed also.

Thanks, 👍 PW
[Magisk] WhoIsJohnGalt1979:
Thank you. That worked for App List detector and TB checker. Now am left with Momo. The USB debugging module didn't work. I have also added all the detecting apps in Deny list.

@zgfg I was referring to your post about adding a line "setprop init.svc.adbd stopped" to service.d of installed USNF module. I couldn't find any service.d in the safety net fix module in data/adb/modules. Any thoughts? Also in Momo what does "files found changed by magisk modules" correspond to?
[Magisk] zgfg:
Frankly, I don't remember my post you are referring - maybe you could link (but it might be something old and not relevant anymore)

Your Applist looks ok, but better try also with Ruru (it searches for more - like TB Checker) than just for root apps

Also, good detectors are SCheck (full name Service check - Device compli) and Oprek

Make all of them fully green/happy (and TB Checker). For Momo, you can get no sa-ti-sfaction

Eg, there are LSPosed modules DevOpts Hide and Bootloader Spoofer - you can hide Dev Options and unlocked BL to Momo but then Momo will suddenly find additional 'abnormalities"

All the mentioned detectors can be found on Playstore, for Ruru search through XDA threads to find a link to GitHub

But the only real thing is to make your production apps happy (happy wife - happy life).

For the rest, specially Momo, there is a colloquial term mastur...ion
[Magisk] WhoIsJohnGalt1979:
@zgfg Haha thank you. I think am okay now and can ignore Momo. I couldn't find Scheck.
[Magisk] zgfg:
S Check, but search for the full name I gave you

Security Check - Device compli - Apps on Google Play

Check your device readiness and compliance for Mobile Payments

play.google.com
[Magisk] WhoIsJohnGalt1979:
Same problem I faced with oprek but I was able to download it from outside of play store.
[Magisk] zgfg:
Yesterday installed to A13 (previously I had on A12 but upgraded the ROM with Factory reset). And having on another phone with A11
[Magisk] KProject:
Why this module not implemented update.json?

I miss 4 day since is updated.
[Magisk] Lughnasadh:
"I didn't change the update channel in the module on purpose so that everyone can upgrade to the new official version automatically without any problems."--Displax

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/#post-88151417
[Magisk] 2faraway2:
As mentioned earlier a few times:

Only safetynet-fix-v2.3.1-MOD_3.0 is working, every version >= 2.4 doesn't ..

Device: Galaxy Tab S5e (gts4lv) with latest los20 / microG
[Magisk] Lord Sithek:
Interesting. I own wifi variant, on stock OneUI all 2.4.x are working fine, and as far I remember the same was true on crDroid A13
[Magisk] Displax:
The problem is microG. I am aware of this issue.
[Magisk] ipdev:
Hi all. :)

The other week, I wanted to test something on A14 so, I installed Android 14 Beta 3 on my Pixel 7.

Long story short..

- Only needed the MOD_USNF module to pass PI and store certified. 😉

---

Tonight I installed Momo and Shamiko to see what Momo shows. 😉

Hope that gives hope and deters the idea that we can not pass PI on A14. 🙃

Cheers all. :cowboy:
[Magisk] Displax:
Thanks for info! Already looked at A14 a bit, some new sensitive changes may coming. But need to wait release version, now it is disabled.
[Magisk] Displax:
Added Riru version back. Remember that is need old MagiskHide support (and adding com.google.android.gms/com.google.android.gms.unstable to HideList) !

Maybe someone still need it :)
[Magisk] Displax:
Added microG version. Note there is some strange behavior that GMS can crash while run SN attest more than 2 times in one session. Just do not do this. This behavior should not affect applications in real life.
[Magisk] Fishawy:
Thanks.

What's the difference between Zygisk and microG? Or what's the use of the microG release? I have the normal 2.4.0 MOD 1.3 with microG separately installed.
[Magisk] pndwal:
Do you have a custom ROM without GApps?... Microg isn't generally needed with stock ROMs; there are many microG LineageOS builds for example however.

microG is 'de-Googled' Android (a misnomer really, but microG removes most of proprietary GMS while retaining a small GMS 'core', ie cut down Play Services), ie. an alternative Android addon package to proprietary Google Apps...

Of course Google's Device integrity APIs are part of GMS/GApps, so these won't work without GMS and apparently USNF spoofing needs adapting for 'micro' GMS core.

Nb. Zygisk is a hooking framework allowing Magisk to inject code into app zygote processes whereas microG is a minimal GMS implementation... Please don't confuse the two.

🤠 PW
[Magisk] Displax:
microG version is for those users (who use microG) when the original version does not work
[Magisk] david003:
I tested safetynet-fix-v2.4.0-MOD_1.3-microG on CalyxOS with MicroG and it passed safetynet. The old 2.4.0-MOD's didn't work, but interestingly, safetynet-fix-v2.3.1-MOD_3.0 did work.
[Magisk] 2faraway2:
Tested the 2.4.0-MOD-1.3-microG version successfully, device=POCO F3, rom=los20 for microG.

As soon as I'll get back my Galaxy Tab S5e I'll test this as well ..;)

Update: 2.4.0-MOD-1.3-microG version works as well with gts4lv (Galaxy Tab S5e) on los20 for microG.

Well done @Displax (y)
[Magisk] rafaz182:
Could anyone tell me if this bypass emulator ROMs from AVD? I don't have a free device at moment to root, so my only way to learn how to root is by using an emulator.
[Magisk] xtremesystems:
There are 3 versions of v1.3 mod.

Any descryption which version do what?

I've realme gt pro 2 rooted with newest magisk which should I choose?
[Magisk] osm0sis:
Check the changelog... And check like 6 posts before yours...
[Magisk] pndwal:
Not sure, but doubtful since there's a different device integrity verdict for emulators... Seems app must specifically be "released to approved emulators" and then depends on MEETS_VIRTUAL_INTEGRITY verdict.

Spoiler content hidden.

🤠 PW
[Magisk] RobinKara:
hope someone can help ;( sudenly all stopped working (Safetynet)

Describe the bug

if i start the pixel 7 pro - i pass both basic integrity and CTS. After some seconds if i test it again i fail both.

Screenshots of SafetyNet & Play Integrity API tests result

Device info

Device model: Pixel 7 Pro

Android version: 13

ROM name/version: 13.0.0 (TQ2A.230505.002, Mai 2023)
[Magisk] pndwal:
Why do you have MHPC module w/ @Displax modded USNF (or even 2.4.0+ @kdrag0n USNF, not recommended)?... Hopefully not adjusting fingerprint, security patch, model or shipping level props with this...

If so or you are simply trying to use it for passing device integrity API verdicts, uninstall or disable it... 😬 PW
[Magisk] 2faraway2:
MHPC isn't really needed ..

Beside of that - if you are using the microG 1.3 module- just don't run the check more than once in a session ..

@Display documented it here: https://github.com/Displax/safetynet-fix/releases

Hope that helps
[Magisk] RobinKara:
@pndwal thank you for your reply. To be honest i just tried to get it back to work. But i am lost at that point. it worked all fine and some days ago just stopped working (CTS and Basic integrity fail both). Google Wallet app is not working ...

Could you help to recover the situation (get CTS and Basic passed)

have now installed:

Magisk: a8c4a33e (26103)

Zygisk: Yes

Ramdisk: Yes

Update Channel: Canary

Systemless Host file

Zygisk: enabled

deny list:

- Carrier Services (Google)

- google

- Google play services

- Google wallet

- Google service framework

Modules:

- CloudflareDNS

- L Speed

- Magisk built-in BusyBox

- Shamiko

- Systemless Hosts

- Universal SafteNet Fix v2.3.1-Mod_3.0

- Youtube ReVanced

Phone: Pixel 7 Pro

Android 13

Build: TQ2A.230505.002

have no microG running
[Magisk] pndwal:
Remove all Google items other than G Pay/Wallet from denylist... Play services in particular will break USNF w/ denylist enabled. (Since first Zygisk-USNF builds it does its own root hiding for this reason, and will remove gms from list on reboot).

SafetyNet is deprecated so you need to confirm passing new Play Integrity API deviceIntegrity verdict... Don't worry about strongIntegrity... Use Play Integrity API Checker... Disable modules other than USNF if not passing and try again...

After passing, to see G Pay/Wallet in Play Store you may need to clear Google Play Services, Google Play Store and Google Play Protect Service data...

To fix G Pay/Wallet issues immediately you may need to uninstall updates, clear it's data and take updates again before adding back cards etc again... Be sure to reboot after wiping data and before first opening app to avoid issues like broken Activity list etc... Nb. Issues with Contactless security requirements usually resolve themselves after passing deviceIntegrity, but this may take several days...

Nb. Magisk inbuilt busybox is not installed as a module; you probably have BB for Android NDK in addition.

🤠 PW
[Magisk] Arcline:
Can confirm the microg version works!
[Magisk] rafaz182:
Thank you for this information, I checked my AVD and it's doesn't have any label on it. I'll use MEmu emulator, as this one have those labels on it (would be much better to use in avd, since it's easier to install magisk 26.1)
[Magisk] pandavova:
Thank you man, had some weird problems with my Xperia 5ii and LineageOS, now I know better.

Magisk + Google Stuff works finally again.

Edit: Spoken too soon, installed my current main modules, broke again. Something breaks just the Google Play Services, my Play Store works fine but for example if I open the Google Settings in the normal Settings app or open Wallet, it doesn't work.

Currently everything breaks if I enable anything more then USNF and Shamiko. If I disable everything except these both, it starts working...

Guess this will take more hours...

Edit2: Why is it always like this... Why is there so much misinformation mixed with true information...

Just putting Google Play Services in the Deny List fixes it. I hate the I put so many hours in this.

Xperia 5ii, lineage-20.0-20230630-nightly-pdx206, worked on Magisk 26.1 Release and on Magisk Alpha 26103 (46770db1).
[Magisk] WhoIsJohnGalt1979:
I am sorry to hear about your inconvenience. I wouldn't say what I had shared was intended to be "misinformation" for fellow users, cos honestly I don't even know what your "main modules" are and how they interact with USNF and Shamiko. What I had shared, for sure sure got you through wallet and possibly most banking and retail applications. One might want to use HMA for those difficult ones. There are very smart people that visit this forum, I am sure they would help you out if you share more details. Good luck.
[Magisk] pndwal:
Not sure why you think gms in denylist should or does help. 🤔

Since Zygisk based USNF, USNF itself incorporates the root hiding as gms in denylist w/ denylist active necessarily breaks the USNF main function (inject code to register fake keystore to trigger fallback to basic attestation)... That's why it removes gms from denylist on reboot if enforced...

If using Shamiko or similar module for proper hiding (ie. denylist disabled, but 'hijacked' for 'convenience' as a hidelist) there will be no such issue as Magisk modifications, incl. code injection, are not 'denied'/reverted by hidelist functions. There's still no benefit in having gms in a 'hijacked' denylist however if using Zygisk-USNF; it's just double hiding...

🤠 PW