yashsingh1/xdaforums huggingface dataset:
[Magisk] pandavova:
In this example my main modules don't really matter I guess, as I said, any additional module "broke" it (without putting GMS in to the Denylist.

FYI, here are the modules I tried, which are my main modules, USNF and Shamiko excluded:

AOSP Mods

AuroraServices

BCR

Busybox

Google Sans Prime

LSposed (Also already using HMA for other stuff)

The "misinformation" part was not really targeted to you, it was more in general about this, sorry, was pretty annoyed about the lost time to this.

Because if I would for example remove it right now and reboot, GMS would "break".

Denylist was never enforced, so it was used for Shamiko, if I understand correctly.

So the double hiding does something in my case? In any case, putting GMS in the Denylist (not enforced, with Shamiko) did the trick for me.
[Magisk] pndwal:
So there's something awry with your setup/system...

Please describe what 'breaks'... Does Play Integrity API Checker fail to give passing deviceIntegrity? (What about YASNAC result?)

Not the extra hiding, but thinking about this:

I suspect that one module is causing your issues...

At a guess I think Google Sans Prime as font modules are known to break stuff. (Others among your modules may also be suspect, I don't know.)

Re. Google Sans Prime, seems this is your issue:

https://github.com/nongthaihoang/custom_font_installer/issues/1

Comments on this in https://xdaforums.com/t/module-oh-my-font-google-sans-prime-custom-font-installer.4215515/ thread:

...

I also suspect Shamiko is fixing issue (for items in denylist?) since:

Shamiko v0.7...

• 2. Fix font loading

even though Shamiko hiding itself is not needed for gms as I said... Having G Pay/Wallet in denylist also w/ Shamiko 0.7+ is probably preventing the font module from breaking that too...

... So seems the above may be why...

🤠 🔎 PW
[Magisk] Displax:
It seems that Google is starting to roll out the next phase of hardware attestation. So don't be surprised when SN/PI tests starts failing for you...
[Magisk] cldborges:
Following all the instructions in the main post, YASNAC it says everything is fine and Play Integrity show device and basic ok, but some banking apps still detect that my phone is rooted. Is there anything that can be done? Thanks.

Phone: Poco X3 NFC (SURYA)

Android 11

Bootloader unlocked and Magisk
[Magisk] shoey63:
Banking apps often use their own methods of detection, independent of Play Integrity.

For example, checking for unlocked bootloader, TWRP folder, Developer Options enabled, USB Debugging enabled, Xposed hooks etc. etc. . . .
[Magisk] rodken:
Not to beat a dead horse, banking apps often use their other methods of root detection.

-- Checking for the presence of root-related files or directories. Files that were created or directories that are not normally present on an Android device. Banking apps can check for these files or directories to see if the device has been rooted.

-- Checking for the presence of root-related permissions. Giving users the ability to grant themselves certain permissions that are not normally granted to regular users. Banking apps can check for these permissions to see if the device has been rooted.

-- Checking for the presence of root-related modifications to the system. Of course, changing the kernel or installing custom ROMs. Banking apps can check for these modifications to see if the device has been rooted.
[Magisk] digger16309:
Also use Play Integrity Checker. YASNAC is insufficient. Also hide Magisk.
[Magisk] Yusef Kifah:
After many weeks, my safetynet was not passing anymore affecting my banking apps and such. Was recommended this mod by a good fellow community for our device.

Works like a charm on Oneplus Nord 5G (2020) running latest official LineageOS 20 Vanilla. So using - Zygisk version.

Removed deprecated Propsconfig module and installed this mod over kdrag0n's original version as suggested here.

Voila.

Great job Dev 👍🏼
[Magisk] rmccurdy:
Thank you all so much I love XDA from my G1 days long live DANGERMOD !

I have a open source github project that makes testing Objection and Frida with with Android easy in windows. I need help getting saftynet checks to work with Objection to start. Should I try blank 30 Google image then try adding microG to it or something ?

I guess for now all I want is =>30 with google play and saftynet on real AVD not NOX Bluestacks etc .. see my project.

GitHub - freeload101/Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy: Java Android Magisk Burp Objection Root Emulator Easy (JAMBOREE)

Java Android Magisk Burp Objection Root Emulator Easy (JAMBOREE) - freeload101/Java-Android-Magisk-Burp-Objection-Root-Emulator-Easy

github.com

* using this image / googls AVD system-images;android-30;google_apis_playstore;x86

* running RootAVD.bat" system-images\android-30\google_apis_playstore\x86\ramdisk.img FAKEBOOTIMG

* no microG

* I have tried with props config of Plxel 2 MagiskHide Props Config (MHPC)

* tried with props https://xdaforums.com/t/passing-safetynet-on-android-emulator.4469211/post-88345137

*Tried:

safetynet-fix-v2.3.1-MOD_3.0.zip

safetynet-fix-v2.4.0-MOD_1.3-Zygisk.zip

safetynet-fix-v2.4.0.zip

* I don't let any update run so that may have something to do with it ? historalcy you never do updates if you need to hack something but older play store may not be commpatable with saftynet fix modules ?

Please feel free to reach out to me directly I am avaiable 24/7 for help with this! - RMcCurdy.com
[Magisk] Smedslund:
I can use wallet now, thanks to this.
[Magisk] amk316:
this is strange!!!

when i use this model (Zygisk or riru) my s23 wifi calling (vowifi) stop working

if i disable it and reboot the problem is solved !!!

what to do?
[Magisk] pndwal:
Does it happen with NO modules other than USNF enabled and NOTHING in denylist? Is denylist enabled?... PW
[Magisk] pndwal:
I don't know much about emulators, but USNF is for causing an exception/error to trigger fallback to fully 'basic' attestations to signals on a real device as well as for bypassing hardware backed attestation server end enforcement... Banks must accept another attestation label for emulators apparently... I put info here:

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88702211

Hope it helps... 🤠 PW
[Magisk] rmccurdy:
Herm well I just think it's sick devs can write horrid app and 'hide' them behind saftynet,root checks, obfucataion and pinning... I want to show people how awaful the backend and API's are for mobile apps and i was hoping I could to it with JAMBOREE :( maybe something like RMS-Runtime-Mobile-Security ?
[Magisk] amk316:
i am using magisk alpha and no other model is disabled only USNF and denylist is not enforced and i removed everything in denylist still i have the problem
[Magisk] pndwal:
By 'sick' Devs, you mean banks / games Devs?... Well if they want to allow their code to run only in a secure runtime environment they check for modifications... They always have AFAIK... And that's just the game of cat and mouse for us modders!...

... Play hard while you can... Cats are playing harder, and they're gonna win in the end! 😜 🤷 PW
[Magisk] pndwal:
module?

Not sure you read what I said:

... You could try with Shamiko module in addition to USNF module only and keep denylist disabled, but have NO Google stuff other than G Pay/Wallet in denylist even while used as hidelist for Shamiko for this test...

I suspect a module that messes with props (other than Shamiko or USNF) may be causing your issues... PW
[Magisk] amk316:
USNF v2.4.0-MOD_1.3 alone = no wifi calling

USNF v2.4.0-MOD_1.3 + Shamiko = no wifi calling (denylist disabled and no google stuff)

NO USNF v2.4.0-MOD_1.3 + othere modules = wifi calling

USNF v2.4.0 (kdrag0n) alone = no wifi calling

it seams a known issue

https://github.com/kdrag0n/safetynet-fix/issues/270
[Magisk] pndwal:
Well done... Thanks for heads up!... I hadn't checked issues/PRs there for a while...

Seems the shipping level globally set prop is likely the issue, and when @Displax or @kdrag0n builds it to target gms only some functions may work properly again...

I had actually wondered why shipping level mismatch HKA (server end) enforcement bypass (for A13 launched devices) wasn't targeted like earlier model and fingerprint mismatches... Commented here then forgot about it. 🤪 :

... So looks like not targeting gms W/ shipping level may well have been an overnight... Hope @Displax can sort the issue soon... 😛 PW
[Magisk] Displax:
LOL :ROFLMAO: 👀

Just played a bit with the mod today...
[Magisk] JakeDHS07:
Yooooo drop thatttttt 🔥
[Magisk] Lord Sithek:
You can be a rich man or a god in our community 😂
[Magisk] JakeDHS07:
Accidentally fixing strong integrity 😂
[Magisk] sawdoctor:
Problem is the sooner he drops it the shorter time it will last. Soon as he drops it google and app developers will start working to bypass it again.
[Magisk] immortalwon:
Lol, would recommend keeping the method closed source wink wink
[Magisk] Displax:
So, here is build for testing, try it yourself :)

Any users of KernelSU here? - Try it too (you need the latest versions of KSU & zygisk for KSU).
[Magisk] Lord Sithek:
Wow

Xiaomi Mi Note 10, Magisk Delta (25.2)

EDIT: But on my realme GT Neo 2 with official Magisk it broke everything 😂
[Magisk] zgfg:
Have you tried with USNF v2.4 but without MHCP

Please also check in the Wallet thread
[Magisk] linux.alucard:
Using v2.4.0-MOD_1.2 now and Google Wallet working fine! :)

- Realme GT NEO2

- RUI3
[Magisk] LegendaryCheerio:
It was working yesterday, but just overnight it seems to have stopped working. Real pain
[Magisk] coolvipcandy:
Doesn't work with LSPOSED (tested version LSPosed-v1.8.6-6712), safetynet and CTS pass if LSPOSED disabled in magisk but both fail if enabled.

Unfortunately need LSPOSED for LuckyPatcher and HushSMS
[Magisk] Displax:
Be more specific please. I have everything working as before.

Working fine with LSPosed on my side.
[Magisk] zgfg:
You have to hide LSPosed modules by use of LSPosed module Hide My Applist (HMA) - there is a separate thread with a guide for - actually in its post #1 you'll see the link to GitHub where the author now maintains the guide
[Magisk] coolvipcandy:
I'll try disabling all LSPOSED modules, if works then will add one by one and will post update.
[Magisk] coolvipcandy:
I have HMA already installed, let me do this and update, thanks for speedy reply BTW
[Magisk] coolvipcandy:
Nope, doesnt budge
[Magisk] coolvipcandy:
@Displax disabling all modules (but LSPOSED itself enabled), Works. So its one of the modules that's tripping safetynet
[Magisk] zgfg:
Instead of the old SN test Play Integrity API, what does exactly pass/fail (Strong Integrity is not relevant) and inspect what does the JSON show:

Play Integrity API Checker - Apps on Google Play

Get info about your Device Integrity through the Play Intergrity API

play.google.com

Check also if PlayProtect complains (about LP)
[Magisk] coolvipcandy:
JSON :"The SafetyNet Attestation API is deprecated. It is recommended to use the Play Integrity API: https://g.co/play/safetynet-timeline."

LP isn't the issue, enabled and working, though that was my first suspect too.

the two so far are : xPrivacyLua and HushSMS
[Magisk] zgfg:
Wrote you to test PI API, not the deprecated SN and gave you the link in the quoted post for PI API Checker

Problems with the old and deprecated Lua have been commented here or there, better uninstall.

Unfortunately, even when uninstalled it leaves something that can be detected, files must be manually deleted, it's described on the Lua GitHub FAQ page
[Magisk] coolvipcandy:
STRONG INTEGRITY Failed, other two passed
[Magisk] zgfg:
Then that part is ok (Strong Integrity requires locked Bootloader and stock ROM, nothing flashed)

See the prev post about Lua
[Magisk] coolvipcandy:
But now banking Apps are detecting root, though GPay is working.

banking Apps working with denylist enabled (shamiko though installed, but not working now, so has to enable denylist), But when denylist enable, CTS fails
[Magisk] coolvipcandy:
UPDATE :

@zgfg thanks for help, removed lua files manually, a db and one another from /data/system/xula and HMA is doing its job now.

@Displax Thanks for module, Everything peachy now. (And especially for pointing that LSPOSED works in first place.)

HushSMS working as well, Issue was xPrivacyLua,
[Magisk] Tamsta_T:
For first time ("clean") install, does one have to install old version first and the new one on top of it, or is it enough to install new version only? Thanks!
[Magisk] coolvipcandy:
i installed over latest public version, 2.4.0, and worked fine. (As OP hasn't mentioned about fresh install)

I guess its better to flash original 2.4.0 and then flash this fork. (won't take more than 5 mins, but worth the effort)
[Magisk] zgfg:
Module is self sufficient. No need to bother with old versions

Generally the case with Magisk modules - if you need the latest, install directly the latest.

Update if you already had an older version
[Magisk] zgfg:
Indeed Strong

On two phones, MIUI 14 and MIUI 12.5
[Magisk] casouzaj:
Lucky you who started passing even the strong integrity test with the MOD_2.0_test release. In my Xperia XZ2 phone, running LineageOS 20.0, it broke all integrity tests. Had to revert back to the 2.4.0_MOD-1.3 version.
[Magisk] Stillhard:
Yes, it broke in my test too, maybe because in mine the TEE already broken
[Magisk] Displax:
DEL
[Magisk] Gordietm:
This one didn't work for either.
[Magisk] Fishawy:
Test 1 got my Pixel 7 Pro stuck on "phone is starting", and test 2 broke all 3 integrity checks.

Back to 2.4.0 MOD 1.3 for now, and patiently waiting for the next update.

Thank you!
[Magisk] Spartacus500:
Not working for me S7 edge Custom Pie 9.0 Rom NFE, 3x fail & stop working Google 😔
[Magisk] zgfg:
Once "Something went wrong" but after that it always worked
[Magisk] casouzaj:
Test2 breaks things for good. My XZ2 keeps showing `Phone is starting...` like forever.

EDIT: Thankfully, I had USB debugging turned on, because with lineageOS recovery, data is not mounted. Through adb, I deleted the module, rebooted, and installed 1.3 via Magisk again. Uff! Was not ready to hard reset this time.
[Magisk] Lord Sithek:
This one still breaks PI altogether on my realme GT Neo 2 and broke Strong on Mi Note 10 as well
[Magisk] shoey63:
Exactly the same for me on Pixel 6.

My notorious Rog phone 3 which used to pass Hardware backed integrity without USNF and is now blacklisted by Google, got thrown into rescue party mode and attempted to do a factory reset 😱

Thankfully it just rebooted into TWRP and I was able to delete the module.
[Magisk] ipdev:
Pixel 7 - Android 14 Beta 3

Pixel 3a XL - LineageOS 19.1

safetynet-fix-v2.4.0-MOD_2.0-test.zip

safetynet-fix-v2.4.0-MOD_2.0-test2.zip

Both test modules give the same result on both phones.

Error: -17: Integrity API error (-17): There is a transient error on the calling device.

Both phones pass basic with an older version of the module.

Cheers. :cowboy:
[Magisk] pndwal:
For me, first test module fails all verdicts and second boots but launcher doesn't complete loading w/ no icons accessible... Used safemode to disable, boot and restore standard module...

Xiaomi Redmi Note 8T, stock Android 11 MIUI...

Interesting test! PW
[Magisk] zgfg:
On my old Xiaomi Mi 9T with MIUI 12.5, A11 it worked fine with Test1 but with Test2 is like bricked - phone boots, I enter the pin but weather widgets never load and if I try to open any app it tells me: Wait until your device is fully rebooted - but it never happens

Since Magisk Canary 26103 broke my TWRP (I wrote about in the other thread like two weeks ago), I can not disable USNF from TWRP. So until further, when I find the time to try to fix it or Factory reset the phone (I'm pretty sure that disabling modules by ADB never worked on that phone when I previously tested, I may try Safe Boot, reflashing TWRP does not help) I will not use that phone and could not retest with eg Test3
[Magisk] wlnfr:
Lenovo Vibe P1a42, Android 9, HavocOS 2.9 from phone's xda thread.

PicoGapps, Magisk 26.1, zygisk with everything that has word 'google' in it being in enforced denylist. Fails device integrity check. Only USNF module from here is installed. I also did restore my apps with Titanium backup, but I can reset from scratch(and by that I mean flash to stock with qfil and start from there) if needed as I'm still in the process of migrating to this ROM. How do I proceed in tracking down whatever is causing it to fail device_integrity? Thanks for any help in advance

My ROM doesn't support SELinux enforcing which is most likely the problem, so ignore this post
[Magisk] Displax:
Thank all for testing (especially for unsuccessful). Just to be clear, did you has any system issues with Test1 build except possible broken tests? Test2 deleted now.
[Magisk] Lord Sithek:
Not for me, Xiaomi Mi Note 10 with Octavi custom ROM passes Strong , realme GT Neo 2 with stock realme UI all 3 checks fail, but no other issues observed
[Magisk] wilsonhlacerda:
Poco X3 NFC, LOS20 (A13), Magisk Alpha, Shamiko, LSPosed

v1.3 works as expected

v2.0 test 2 haven't tried it

v2.0 test 1: app YASNAC force close, app TB Checker returns API error -17, no other side effects on device

Thanks and waiting for new releases! 😁
[Magisk] Stillhard:
No system issues 'cept the broken tests and sometimes repeated flash in the screen like some background process failed
[Magisk] zgfg:
adb wait-for-device shell magisk --remove-modules

did not remove the modules (btw, good that it didn't, I have too many of them installed and configured + LSPosed and its modules)

Also, booting to Android Safe mode did not trigger Magisk to disable the modules (although, as expected, Android Safe mode screwed up Home screen icons and some other things)

However, the most simple thing (unfortunately, did not come to my mind earlier) disabled the USNF Test2:

adb shell su -c touch /data/adb/modules/safetynet-fix/disable

ie, fixed the endless "Wait for boot to finish...", hence I was able to open apps again, eg Magisk app, and I have now installed back the working USNF Test1

---

Two conclusions:

- I have again avoided to fix the TWRP issue (since Canary 26103, TWRP does no more ask for pin, hence it's useless without decrypting FBE).

I previously tried practically everything except Factory reset

- In fact I don't really need TWRP. Phone (my old phone for testing Magisk and so) is end-of-line and I have well working its last Xiaomi.eu ROM hence I don't need TWRP for flashing the ROMs. There are other ways (Fastboot, disk-dumping from Terminal or via adb,, Magisk module for flashing zips and images, Swift Backup for backing up the apps, etc); the only 'problem' is that I cannot flash the original Recovery since TWRP was the 'official' Recovery that came with Xiaomi.eu ROM
[Magisk] Marvin732:
Works here too 😁
[Magisk] fbirraque:
Does any feedback from latest module version on Redmi K40 (CN) / Poco F3 (Global) - [alioth]?

Thanks in advance,
[Magisk] vindicatorr:
AOSP-13 GSI

Magisk 26.1

Zygisk​

MagiskHide Props Config 6.1.2-v137​

set to use vendor fingerprint for my GSI (option 'v')​

USNF 2.4.0-MOD_1.3​

YASNAC passes

Play Integrity API Checker completely fails (at some point it was passing the first two as expected)

//"UNEVALUATED"​

More details: https://github.com/1nikolas/play-integrity-checker-app/issues/12#issuecomment-1633589630​

Play Store->Settings->About->Play Protect certification: Device is not certified

//$ getprop | grep ro.product.build.fingerprint​

//shows my device vendor product info (not GSI fingerprint)​

I've been trying various combinations of things (like with only USNF module), clearing cache/data, rebooting. But nothing has given my passes back.

EDIT0: Also "$ getenforce" result: "Enforcing".
[Magisk] pndwal:
Disable or uninstall MHPC! 😬... PW
[Magisk] LinhBT:
Just another day in the paradise!
[Magisk] vindicatorr:
"I've been trying various combinations of things (like with only USNF module)". The result was still the same.
[Magisk] chiteroman:
It's something about prebuilt vendor or security patch because in Xiaomi.eu for MIUI 12, 13 and 14 (14.0.1) from POCO X3 Pro it works. In 14.0.3 doesn't work.
[Magisk] chiteroman:
Also rip Strong bypass, now Google will notice this and will be the same history as Rog3 from @shoey63
[Magisk] chiteroman:
WTF now it works in 14.0.3 Xiaomi.eu XD
[Magisk] zgfg:
It works for me (reported couple of days ago) on Xiaomi.eu 14.0.10 (but another phone, Lisa, not Vayu)
[Magisk] chiteroman:
Which method did you use to spoof locked bootloader?
[Magisk] chiteroman:
@Displax LineageOS 19.1
[Magisk] chiteroman:
I managed to fix it but still no passing Strong.
[Magisk] rushiranpise:
OneUI 4.1

test2.0 zip
[Magisk] pndwal:
Sorry...

However I still don't think you have an issue with fingerprint prop (you have a certified one although very old for ctsProfileMatch and it's also mismatched to bypass server end hardware backed evaluation enforcement) as 'unevaluated' indicates something different, and your log seems to point to permission issues...

Can you run Play Integrity API Checker again, then click <> symbol at top to show full raw JSON response and send screenshot?... PW
[Magisk] vindicatorr:
I mean the screenshot is going to be the same as that github issue I linked, other than the only other meaningful(?) thing like "requestPackageName" (not that I even think that would be meaninful to finding the issue), so I don't know how you think you're going to be able to glean something more valuable from it:

Let's try a different approach... what can the end-user do in the shell that would be able to find the values that are used to check the "integrity"? I already mentioned "getenforce" and "getprop" earlier (which btw the fingerprint is currently the "*gsi_arm64:13*" value since I'm not using the MHPC vendor fingerprint option anymore).

EDIT0: And I guess while I'm here and thinking about the future for hardware attestation becoming enforced, can we use A/B to just have our (stock/hacked)-use boots and switch them on-the-fly?

EDIT1: pndwal, it looks like you've had this issue (UNEVALUATED) as well (elsewhere): https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88500109
[Magisk] zgfg:
On some phones/ROMs, the inactive slot is not bootable, even when you put the proper Boot img to that slot and so
[Magisk] Displax:
New test build. Please test it hardly on many devices (especially on Pixel 7+).

If you lucky enough - you should pass "STRONG_INTEGRITY", if no - you should simply pass default "DEVICE_INTEGRITY".

I hope there will be no system problems with this build. But who knows...
[Magisk] Marvin732:
tried it on my Xiaomi 11T Pro, doesnt pass STRONG_INTEGRITY anymore,

going back to this version and i get pass STRONG_INTEGRITY
[Magisk] vindicatorr:
No changes for me either, but then it had stopped working for me anyway, as mentioned previously.

Is there any logging going on, either through the install (other than what the magisk module install shows), or boot, or checks, that people can inform you about rather than "it {,doesn't} work{s,}"?
[Magisk] belair56:
All good Pixel 7 pro

safetynet-fix-v2.4.0-MOD_2.0-test3
[Magisk] pndwal:
... Just to confirm there's no deviceRecognitionVerdict, so you're not even getting no-label response...

As I said I don't believe this is your issue... (There's no deviceRecognitionVerdict response.) And you'll most likely need a mismatched fingerprint for bypass anyway...

However there's virtually nothing published by Google on DroidGuard VM... You'd need to reverse current the.app (droidguard)... There's a great paper on droidguard before PI... (Substitute 'term SafetyNet' for 'attestation' since it was assumed droidguard responses were only S/N responses, and note categories including Magisk and root, hooking frameworks (dynamic instrumentation), emulators, bootloader status, conditional checks (on files matching specific keywords)in section 8, Annexes)... Some info/link here:

https://xdaforums.com/t/tools-zips-...tiple-devices-platforms.2239421/post-88605981

Well yes and no... You'd really need dual bootloaders. 🙃 ... That's where AVB chain of trust starts...

Yup, similar... 🤠 PW