yashsingh1/xdaforums huggingface dataset:
[Magisk] zgfg:
Please carefully re-read my post if you think that my intention was to disprove anything you wrote, to the contrary

Btw, I was pointing from the beginning to the same side-effect, and I actually wanted to test and to see over time possibly the other side-effects (but don't have much time to test daily)
[Magisk] chiteroman:
Yes.
[Magisk] chiteroman:
@Displax

Done XD.
[Magisk] chiteroman:
These are the props which GMS check via native.
[Magisk] IgorEisberg:
True, I just don't have the patience to read short stories anymore, I guess.

In any case, I don't see how this can possibly be implemented to a ROM, because the attestation doesn't access the prop using SystemProperties, but rather using a native call. Can't see how we can intercept that.
[Magisk] G5-User7080:
Just using the test3 release cause I don't wanna break my stuff, but I'm still wondering, what so you even need STRONG for?

Also, how do you hide Storage isolation?

Everything else passes in "Application Detector" (the test app from hide my applist)… but for some reason storage isolation gets detected for "Libc file detection" and "syscall file detection"
[Magisk] chiteroman:
@zgfg @IgorEisberg and anyone using Xiaomi.eu ROM try this Zygisk module and check if something on your device breaks. If nothing crashes I will release a module which can bypass Strong for all devices.
[Magisk] vindicatorr:
That's interesting... Basically my props are all the same, other than API==31, usb.state==<null>, has_HDR_display==false, has_wide_color_display==<null> (no clue why the "flinger" ones (or frankly even the USB one) are even being checked), and I still fail all 3 checks.
[Magisk] anthonnyb98:
I tried on my other mobile which is a Xiaomi 12 pro with Rom xiaomi.eu and it works perfectly, I leave you screenshots.
[Magisk] pndwal:
So as indicated in @Displax's previously linked PR, that's on TODO list...

The latest builds (mod 2) already fix issues w/ wifi calling etc on A13+ (level 33+) LV devices, Wifi calling broken, by moving shipping level mismatch for hardware based verdict enforcement bypass:

# Avoid breaking encryption, set shipping level to 32 for devices >=33 to allow for software attestation
if [[ "$(getprop ro.product.first_api_level)" -ge 33 ]]; then
resetprop ro.product.first_api_level 32
fi
}&

from service.sh to Zygisk module...

Deletion of ro.product.first_api_level for 'strong' will likely become targeted also per mod 2-strong service.sh code/comment:

# SafetyNet/Play Integrity | STRONG | Delete global *first_api_level* to open access for *DEVICE_INITIAL_SDK_INT*
# TODO: Apply this only for *GMS.unstable*
if [[ "$(getprop ro.product.first_api_level)" -le 32 ]]; then
sleep 10
resetprop --delete ro.product.first_api_level
fi
}&

... Guess he may want to compare a few more results first... PW
[Magisk] Stillhard:
inline for all devices... :LOL:
[Magisk] gajo_luso:
Hey bro, I'm using magisk 26, and I try to do it work, but I couldn't... Help me please
[Magisk] Nergal di Cuthah:
You need to provide a ton of more information.

What device

What android

"try to do it work" tried what? The test builds? Mod 1.3?

"but i couldn't" be nore specfic what happened? What exactly doesn't work? and how are you checking if it works?
[Magisk] Lord Sithek:
Passes Strong on my Mi Note 10 with Xiaomi.eu (A11), no obvious issues
[Magisk] pndwal:
... Got it finally ...🤦 ... Edited:

...Re this:

Thanks for attention / fix in your builds! 👍 🎉 PW
[Magisk] gajo_luso:
Sorry.

My device is a Xiaomi Poco X3 NFC, Android 12. I don't know if the magisk 26.1 have MagiskHide. I saw other post (no in xda) that use the magisk 22
[Magisk] zgfg:
Excellent. Thank you very much for the Zygisk implementation. This is indeed what was needed👍👍👍

Strong Integrity (Hardware backed CTS Profile) passing while the prop

ro.product.first_api_level

stays intact for other apps

Please submit to Alt Magisk Module Repository 😁
[Magisk] zgfg:
See the Zygisk implementation (native code, not shell scripts) by @swer45

He spoofs only one prop, sufficient for Xiaomi.eu, but that's general way to go for the generic (all devices) SafetyNet fix (incl. Strong Integrity) - by Zygisk native implementation, he can filter processes and target only the com.google.android.gms.unstable (ie, spoof only for DroidGuard)
[Magisk] pndwal:
Yeah of course...

That's why I always wondered why with two prop mismatch hardware verdict bypassss in USNF targeting gms (droidguard/attestation process specifically) already (model and fingerprint), the last added (shipping level, for A13 LV devices) was set globally. 🤔...

Anyway, it's fixed by @Displax now!... Wifi calling will work on, Samsung S23, OnePlus 11 etc again. 😃 PW
[Magisk] JakeDHS07:
That's odd I have 7 Pro and have never had trouble with WiFi calling. No cell service at my home and calls were always fine. Guess I got lucky 😅
[Magisk] chiteroman:
After you installed Magisk turn on Zygisk and add GMS app to hide list, don't touch "enforce list", must be turned off.

Now you install latest Shamiko: https://github.com/LSPosed/LSPosed.github.io/releases/latest

And USNF: https://github.com/Displax/safetynet-fix/releases/latest

Reboot and done!
[Magisk] zgfg:
Btw, does it work also with KSU (you had KSU) - supposedly with Zygisk for KSU module?
[Magisk] chiteroman:
Now I'm using Magisk Alpha but it should work for KernelSU.
[Magisk] Stillhard:
@swer45 all devices?
[Magisk] pndwal:
My bad sorry. 😕 ... Edited out P7 line from post now...

No Pixels were among the A13 LV devices reported as affected in issue:

https://github.com/kdrag0n/safetynet-fix/issues/270

Samsung S23, Samsung S23 Ultra, Samsung S23 Plus, OnePlus 11 Pro were represented, and other issues included Mail app sync and Tesla app problems...

Also Wifi calling did work on some networks but failed on others for this user:

https://github.com/kdrag0n/safetynet-fix/issues/270#issuecomment-1635790332 and there were likely A13 LV issues that simply hadn't been noted or connected to shipping level mismatch... 🙃 PW
[Magisk] anthonnyb98:
It works perfectly with kernelsu.
[Magisk] zgfg:
Btw, on which Xiaomi device you tested_
[Magisk] anthonnyb98:
Xiaomi 12 Pro, Rom Xiaomi.eu, KernelSU + Zigisk
[Magisk] chiteroman:
https://xdaforums.com/t/module-play-integrity-fix.4607985/
[Magisk] zgfg:
Be aware, some of thosr spoofs are needed also for the 'banking' apps

Eg, all those that are by default spoofed in Xiaomi.eu... See also comments in the service.sh script and system.prop in @Displax module

Ok, what Shaniko spoofs is not necessary

Pls heck also Husky's Sensitive props, he had one or two more maybe
[Magisk] Stillhard:
This is not for all devices... ONLY to devices using Shaniko (referring to @zgfg post above)
[Magisk] chiteroman:
Updated :D
[Magisk] sawdoctor:
Tbh I'm still using your modded fix as it's the only one that actually booted properly+passed strong integrity on pixel fold. Did have to reset my API after though for some reason but hey it works
[Magisk] Stillhard:
Result in my device (A11 (SDK 30)), Strong failed :cry:
[Magisk] chiteroman:
Works with @Displax one?
[Magisk] Stillhard:
Yes

Tried adding back this line inside your services.sh

# SafetyNet/Play Integrity | STRONG | Hide *first_api_level* in system to open access for *DEVICE_INITIAL_SDK_INT*
if [[ "$(getprop ro.product.first_api_level)" -le 32 ]]; then
resetprop ro.product.first_api_level 33
fi

Strong failed still
[Magisk] chiteroman:
Send logs pls, I think I know which is the problem.
[Magisk] chiteroman:
Expected, GMS are not reading system prop. I think the problem is in the hook I did, I will try to fix it.
[Magisk] pndwal:
Doesn't for Xiaomi Mi Pad 4 w/ LOS 18.1 (A11) sadly... 3 red Xs...

... See you got tongues wagging in Alpha discussion... 😄

FWIW, re. author=Displax & chiteroman, core USNF is @kdrag0n's... 😜

Thanks for efforts @chiteroman... 👍 PW
[Magisk] pndwal:
BTW, this comment may be helpful:

👍 PW
[Magisk] chiteroman:
Updated again. I added all libs for all arch (like original safetynet-fix), added kdrag0n to author list, and changed some code in native libs, now should work for you @Stillhard
[Magisk] Stillhard:
Great! Green is the new color :cowboy:

Infinix-X695C:/ $ getprop ro.product.first_api_level
30
[Magisk] badabing2003:
I'm not sure if it is intentional or not, the module is named differently than safetynet-fix, hence if someone installs this thinking that it would upgrade / overwrite their existing Safteynetfix, they'd end up with both of them.

If it is intentional, then this post should serve as notice only.
[Magisk] pndwal:
All USNF / PIF Devs:

These commits from another USNF fork might be useful for completeness/compatibility:

-Patch denylist processes

PaperStrike committed on Apr 16

- Use Zygisk API v2

PaperStrike committed on Apr 16

👀 PW
[Magisk] pndwal:
Is better nomenclature, especially since it's a complete PI fix now and S/N is all but dead... Users just need to remove / disable USNF... 👀 PW
[Magisk] chiteroman:
I think this is useless, the only benefit I see it's throwing an exception on certificateChain method, but apps which check bootloader status requires a valid root of trust so...
[Magisk] 47here:
I'm on android 12, when I check API I get :

~ $ getprop ro.product.first_api_level

30

Is it normal? I thought android 12 supposed to be 31. Am I wrong?
[Magisk] badabing2003:
first api is different than your current os API, it's when the device was released, what was the api version.
[Magisk] pndwal:
All better (apart from testing)!...

----​

... Someone in P7Pro thread aptly said this is like seeing a (can you believe 'a' is correct 😜) 🦄...

All theories blown out of the water!... Except that this is basically based on an exploit... Countermeasures incoming! 😬😆 PW
[Magisk] chiteroman:
From Android API 33 sources:

android-sdk-sources-for-api-level-33/android/os/Build.java at master · AndroidSDKSources/android-sdk-sources-for-api-level-33

This is only a backup for Android SDK Sources for API Level 33 [Android 13]. - AndroidSDKSources/android-sdk-sources-for-api-level-33

github.com

/**
* The SDK version of the software that <em>initially</em> shipped on
* this hardware device. It <em>never</em> changes during the lifetime
* of the device, even when {@link #SDK_INT} increases due to an OTA
* update.
* <p>
* Possible values are defined in {@link Build.VERSION_CODES}.
*
* @see #SDK_INT
* @hide
*/
[Magisk] pndwal:
Ok, sure... But is Zygisk API up to date?... PW
[Magisk] chiteroman:
My module uses minimal Zygisk API (v2) to be compatible with all Magisk/KernelSU which support Zygisk.

zygisk-module-sample/module/jni/zygisk.hpp at v2 · topjohnwu/zygisk-module-sample

A sample project for building Zygisk modules. Contribute to topjohnwu/zygisk-module-sample development by creating an account on GitHub.

github.com
[Magisk] 47here:
i see, device released with android 11, android 11 is API 30 right?
[Magisk] chiteroman:
Yes: https://apilevels.com/
[Magisk] pndwal:
Yup... But now the 0s align since 12/31, 12L/32... PW
[Magisk] shoey63:
Haven't seen this in a while

ROG phone 3 with busted TEE which is also blacklisted by Google.

Thanks @swer45 🙏
[Magisk] Lord Sithek:
Maybe worth to launch a new thread on this occasion @swer45? :)

Btw, 3 of my devices (Mi Note 10, MIUI 13, A11; realme GT Neo 2, RealmeUI 4.0, A13; Samsung Galaxy Tab S5e, crDroid 9.7, A13) pass STRONG 💪 Gonna try on the old Redmi Note 4 soon :LOL:
[Magisk] ykjae:
Pixel 6 pro passing all 3. Is there anything we can do differently with strong passing?
[Magisk] chiteroman:
Done :D

https://xdaforums.com/t/module-play-integrity-fix.4607985/
[Magisk] chiteroman:
No, but it's funny that Google has these weird bugs. 😂
[Magisk] chiteroman:
https://xdaforums.com/t/module-play-integrity-fix.4607985/post-88782213
[Magisk] pndwal:
Good thinking!... I was just thinking about a PIF/HKA spoof combo... For this:

Rooting for you! 👍 PW
[Magisk] osm0sis:
Opening a new thread sort of assumes your changes wouldn't be merged into the existing module, no? It's been like 7 hours. 😶

kdrag0n's official upstream is (glacially) slow to move, so obviously no more waiting there, but Displax moves pretty quick still...
[Magisk] lieblingsbesuch:
Hey,

I am so sorry for asking these stupid questions, but could not find any answers in the current USNF / USNF Mod / USNF Mod Fix Threads.

I am on a Oneplus 8 Pro and want to reinstall Pixel Expirience (PE13). What I normally did is:

Install OOS12 w/latest Updates

Install PE13 as instructed on the website

Install Magisk (25.2), Root via patched Boot.img

Activate Zygote

Install Magisk Hide Props Config 6.1.2 and activate OP8Pro Fingerprint

Activate Zygote in Magisk

Install SafetyNet Fix 2.3.1

Do I understand it right that w/ this new mod from this thread, all I need to do is

Install Magisk

Install this mod into Magisk

....and it passes strong integrity? No Zygote Activation? No Magisk Hide Prop?

Is there any clue which settings

Would appreciate a brief instruction or a link to an instruction...
[Magisk] gajo_luso:
Hey Bro, o did it, but the Permission made my device reboot a lot of times. Sorry cause I'm noob... When I installed the SNF

Hey man, I did it as you said, but the Permission made my device reboot a lot of time, and I needed wipe data when I installed the SNF Strong, the other archive doesn't made it, but doesn't work too. Sorry bro, I'm too noob
[Magisk] (dataDyne):
Please help!

Only bypass the three things with (Play Integrity API Checker) this:

safetynet-fix-v2.4.0-MOD_2.0-STRONG

Modded by Displax

I have rooted Samsung Galaxy A22 5G, latest firmware today, Android 13.

Pokémon GO, is OK.

But an banking app don't work! I tried lot of things, with Shamiko, without...

CaixaBank Sign

https://play.google.com/store/apps/details?id=es.caixabank.caixabanksign

SOLVED, This is the solution, but I have other two problems:

https://www.htcmania.com/showpost.php?p=34445248&postcount=52
[Magisk] ipdev:
Still a Zygisk module so you still need to activate Zygisk in Magisk.

MHPC is no longer needed for most devices.

Might be an edge case where you need it to set a prop or configuration.

Normally not needed for most devices.​

Cheers. :cowboy:
[Magisk] Jonog:
If anyone has time to read my post on the xxx nolimits page, basically nothing I do works to get CTS passed. This mod changed evaluation type to basic which is a step in the right direction but can't get further. One plus nord 10.5.7 with xxx nolimits. Any suggestions?? Thanks
[Magisk] pndwal:
Had a quick look... Very interesting "ROM"... So it's not really a ROM per se, but a fairly complete ROM overlaid on stock OS... Based on John Wu's MultiRom POC no doubt...

Haven't read all setup guidance but seems it may be best to disable ROM module and see if you get passing PI deviceIntegrity (SafetyNet is deprecated) on stock only w/ current USNF (unofficial mod)...

There are any number of problems that the ROM overlay may be introducing if it works on stock OS base... Could be spoofing prop values that are detected or more... I see you have options in "ROM" to turn off security enhanced Linux (run permissive)... Nb. This could be hidden for old SafetyNet API detection but will trip basicIntegrity in current Play Integrity API, so you'll need to run as enforcing if not already...

Hope it helps. 🙂 PW
[Magisk] lieblingsbesuch:
Thank you so much, will try it as soon as possible!

The only think I can recomment to you is to stop using this years-old ROM (I was a fan of it, too, but it deprecated years ago!) and use Pixel Experience, which works flawlessly and provides a clean system.

OnePlus Nord (avicii) - PixelExperience

OnePlus Nord (avicii) - PixelExperience

get.pixelexperience.org
[Magisk] m0han:
If you meant PlayIntegrityFix v1.1 from this thread....

Just an FYI: I'm using Riru and this module is enabled, but suspended (greyed out). Don't know how, but Strong Integrity passed - for the first time - after flashing it. This on a device I don't use regularly now.
[Magisk] tkxabcdefg:
I flashed this module and only meets basic intergrity. Fails device integrity and strong integrity. What am I missing here? Does it work with custom kernels?

I have a rooted Pixel 7 Pro, disabled verity and verification and installed Kirisakura kernel.

Zygisk is on

Denylist is enforced and has Google Play Services and Play Protect Service

SELinux Switch Ver. 7.1.4 says I'm set to Enforcing

Massive thanks to whoever can give some advice. I'm new to rooting and this is so confusing.
[Magisk] pndwal:
Don't put any Google stuff (other than G Pay/Wallet) in denylist (with Zygisk based USNF)...

Please report result after removing, and with all modules other than USNF (modded version) disabled if still no dice... 🙂 PW
[Magisk] mrjuniork:
Is there a connection between netflix HD playback and a positive result of strong attestation? Or is this unrelated since it's connected to unlocked BL with L3?

Haven't had the need yet to flash this module since all the apps I'm using are properly functioning with regular Magisk Hide. But the SD netflix playback is pretty annoying on a QHD screen 😅
[Magisk] ashok:
Strong integrity passed with out zygisk in KernelSU
[Magisk] chiteroman:
I don't know how that it's possible 😂. Maybe the ROM already pass Strong without my module.
[Magisk] chiteroman:
Denylist shouldn't be enforced and you need Shamiko to hide root.
[Magisk] Jonog:
Thanks. So after reading a bit more seems I need Selinux enforcing but it won't stick. It passed with this set as enforcing but then it changed itself back to permissive. Hmmm

Edit - if I run "setenforce 1" it passes.

It won't hold on reboot of course.

Edit 2 - uninstall viper4android through the rom profile config file.

Passes now, even on restart.

1 banking app still wont work. I can live without viper4android anyway.

Crazy
[Magisk] intel_core_i7:
That depends on your device. Xiaomi devices don't lose their L1 certificate on stock MIUI when safetynet fails (bootloader unlocked), but I have no idea if netflix still support HD, since I never use that
[Magisk] lieblingsbesuch:
Hey,

first of all, thank you for the Modded USNF.

I decided to install the 2.0. version (I am coming from magisk 25.2, w/ props config and USNF 2.4 1.2 Mod), OP8Pro

I first disabled props config

then updated USNF

restart

-- still do not get strong integrity

after that I cleared data on google play app

restart

-- still no strong integrity

I then updated magisk to 26.1

restart

-- no strong integrity

I mean, don't get me wrong, the phone works like a charm including gpay and all the banking apps (like it did with 2.3.1. 1.2 MOD) but it would be nice to gain this strong integrity mode.

Is there anything I overlooked? Should I try the STRONG Mod?

Best,
[Magisk] tkxabcdefg:
OK after using Shamiko it's all pass now. Thank you!
[Magisk] tkxabcdefg:
I reconfigured my denylist and used Shamiko instead and now it works.
[Magisk] pndwal:
USNF hides root from gms... If you still have it in denylist you're double -hiding... It's not needed... However w/ Shamiko it won't break USNF because it hides root rather than deny Magisk modifications (and USNF/PIF injects code into gms zygote).

Shamiko is proper hiding, but denylist is actually enough 'hiding' for G Pay/Wallet (not other banks however) as long as gms isn't in the list as working USNF/PIF is needed... PW
[Magisk] chiteroman:
If you enforce deny list Zygisk won't be loaded in GMS processes but it can detect root, if you install only my module or USNF you won't pass nothing (you fail Basic).

That's why you need Shamiko.
[Magisk] jons99:
I pass strong integrity without shamiko but then again I'm using an asus device (zf9) with broken tee so who knows what's going on
[Magisk] chiteroman:
In my POCO X3 Pro if I uninstall Shamiko I don't pass any.
[Magisk] pndwal:
This is not true of USNF...

Haven't tried without Shamiko with your module, but by

I assumed the member meant @Displax USNF mod, and for that (or official) denylist (enforced) works sufficiently for passing deviceIntegrity verdict and for working G Pay/Wallet as I said... It was designed for this to work even before Shamiko was available, hot on the heels of 24.0 Magisk...

Of course the Zygisk module breaks with Denylist use and gms processes in denylist which is why they get removed on next boot if Denylist is active... (They were originally removed regardless before @ipdev's commit.) Also, if Shamiko had been available @kdrag0n could have mandated it's use (as you have) instead of embedding inbuilt root hiding for gms... He did do the latter so Shamiko is only double hiding for gms if it's processes are in denylist as I said...

Really, no Google stuff is needed (or should be) in denylist other than G Pay/Wallet whether enabling Denylist or hijacking it as a proper hidelist with Shamiko, DenylistUnmount etc. 🙂 PW
[Magisk] NotHazem:
What am I doing wrong here ?

- phone meets STRONG integrity but many banking apps still doesn't work !!

- Mi8 lite (platina) -Pixel Experience A13 rom

[my setup]

+ magisk alpha 26103

+ USNF Mod 2.0 (strong)

+shamiko 0.7.3

+hide magisk app

+zygisk enabled || NO enforce deny list

+ banking apps & google play services & store are activated in deny list

+ Developer mode OFF

[ apps that never work]

paymob - Android Apps on Google Play

Enjoy millions of the latest Android apps, games, music, movies, TV, books, magazines & more. Anytime, anywhere, across your devices.

play.google.com

cib - Android Apps on Google Play

Enjoy millions of the latest Android apps, games, music, movies, TV, books, magazines & more. Anytime, anywhere, across your devices.

play.google.com
[Magisk] sawdoctor:
Unfortunately once banking apps have detected root they tend to remember it. Every time it's happened to me I've had to clear data from the banking apps and from Google play services as well before they work again
[Magisk] m0han:
No. Never before have I had a Strong Integrity pass. And, the device has not had another rom in 4 months and much more.
[Magisk] NotHazem:
I did clear data . Still not working
[Magisk] Jonog:
Maybe off topic, how is this one app detecting root?
[Magisk] Nergal di Cuthah:
What app? And there are multiple way both known and unknown that app can detect this data (from accessibility settings, from oem debug, from non hidden magisk, from hidden magisk the list is much bigger than just that)
[Magisk] sawdoctor:
Do you have any other modules installed? Some xposed mods get detected as does anything named magisk or twrp. Sometimes a leftover file can be detected. With me the xposed mod app settings reborn was the one making my bank app fail
[Magisk] NotHazem:
no other modules, no xposed mods.

Is there any other method to hide root ? any app or module that can help me ?
[Magisk] Jonog:
Avant money (Ireland)
[Magisk] beeshyams:
Is enforce deny list enabled?
[Magisk] pndwal:
Please search my posts with "Widevine" as search term... I've put a lot on XDA about this, and you'll find some device specific stuff...

Basically you'll need to fix L1 certification (newer Netflix doesn't check integrity verdicts at all, although I believe Playstore listing is still dependant on these), and as mentioned, OEM implementations and fixes vary wildly per manufacturer and device... Eg on later MIUI ROMs incl. custom XiaomiEU there is a Settings fix allowing users to trigger new key generation when revoked due to failures incl. bad OS updates...

Also on Xiaomi there is no connection between L1 and PI attestations, but on others (OnePlus I believe) broken integrity verdicts are connected in OEM implementation (not in streaming apps themselves) to Widevine and L1 certification may be lost but I believe the keys are usually intact... Some devices may require a service department to restore keys however... (I think Xiaomi only introduced their convenient fix after a bad OTA caused L1 loss for stock devices, so modders are fortunate and benefit too... Of course the risk of Widevine keys being revoked is much greater for modders.)...

Hope it helps, 🙂 PW
[Magisk] NotHazem:
No. every other banking app breaks if I try to enable it