yashsingh1/xdaforums huggingface dataset:
[Magisk] casouzaj:
Test3 doesn`t change anything in my Xperia XZ2 running LineageOS 20. It passes basic and device integrity tests, but fails strong one.
[Magisk] Fishawy:
Same here, P7P, passing strong integrity.
[Magisk] creeve4:
Pixel 4a

Safetynet-fix-v2.4.0-MOD_2.0-test3
[Magisk] tiga_x:
Pixel 7 Pro(JPN)

safetynet-fix-v2.4.0-MOD_2.0-test3
[Magisk] shoey63:
Pixel 6 Magisk Alpha 26103

Pixel 6 KernelSU

Finally a method to get Wallet working on KernelSU 👍
[Magisk] acwcanada:
Pixel 6 Pro with A14 Beta 4 and Magisk Canary-26104, updated to v2.4.0_mod_2.0_test3, I am getting this showing up in Magisk Modules, don't know if this is error or not as it seems still running fine.

P.S.: Sames as Mod_1.3, it passes basic and device integrity tests, but fails strong one.
[Magisk] JakeDHS07:
Triple passing on Pixel 7 Pro. Well done @Displax cheers mate 🍻
[Magisk] vindicatorr:
I'm already intrigued with Page2 of that PDF where it mentions intercepting comms going through Cronet, but doesn't say how they did it.

Did they put something like wireshark on the device?

Anything relating to a "setprop" (https://bugs.chromium.org/p/chromium/issues/detail?id=415238)?

Did they custom-build cronet to dump the info somewhere?

I'm thinking that getting that protobuf message could explain a lot.

It'd be nice to be able to play with "Hardware Attestation: KeyStore.getCertificateChain()" from something like "$ adb shell am ..." (https://github.com/OWASP/owasp-mastg/blob/master/Document/0x05d-Testing-Data-Storage.md)

All in all, nice stuff with that PDF, particularly with the annexes, but again I think that protobuf will tell a lot if I can get it.

I just find it odd that SN is passing things like "Basic integrity", but PI is failing "MEETS_BASIC_INTEGRITY".

EDIT0: I also meant to add that switching stock/hacked A/B would be an annoying workaround, but certainly no solution. I mainly use root to set the CPU governor and charging states (so my batteries don't "pillow" (already had 2 do that (2 different makes&models))).
[Magisk] amk316:
galaxy s23

magisk alpha

safetynet-fix-v2.4.0-MOD_2.0-test3

AND you fixed "wifi calling"

your the man
[Magisk] Lord Sithek:
Realme GT Neo 2, doesn't break all 3 checks now
[Magisk] zgfg:
With test3 I'm no more passing Strong Integrity and CTS is back to Basic

Went back to the first test version that passes Strong Integrity and shows CTS Hardware backed

Xiaomi.eu ROM, MIUI 14/A13
[Magisk] rushiranpise:
Test 1 All failed

Test 2 ( didn't got chance to test , zip was deleted)

Test 3 strong fails

Samsung A50

OneUI 4.1
[Magisk] chiteroman:
Xiaomi.eu 14.0.3 POCO X3 Pro.

Old module passing (xiaomi.eu roms already spoof vendor props)
[Magisk] chiteroman:
Working in OnePlus device, old module not
[Magisk] beeshyams:
Same on Pixel 6a, Android 13

With test version 2 goes into "Pixel is starting" loop; got out of it by safe mode, reboot

flashed stable version

Hope this helps @Displax
[Magisk] Spartacus500:
Version 2.0 test3 mod works like version 1.3 without Strong integrity 🤷 Samsung S7 edge Custom Pie 9.0 Rom NFE.
[Magisk] anthonnyb98:
It works for me on pixel 7 pro, july update.
[Magisk] jons99:
same here on zenfone 9 a13 july update
[Magisk] sawdoctor:
Latest test fails strong on pixel fold which is surprising as it passes on the pixel 7 series
[Magisk] Gordietm:
Latest test3 passes everything for me. Works perfectly. I'm on a 7 pro running A14 Beta4.
[Magisk] V0latyle:
No change on Pixel 5 with Mod 2.0 Test 3 on Magisk 25.2.

Everyone who is passing STRONG_INTEGRITY, what version of Magisk are you using, and are you using any other modules such as Shamiko?
[Magisk] anthonnyb98:
I am using kernelsu latest version and shamiko for kernelsu.
[Magisk] Lord Sithek:
Im passing Strong on Xiaomi Mi Note 10 with test 1 (havent tried test 3 yet). Magisk 26.1 stable, no Shamiko, Zygisk LSPosed installed, other modules not relevant

EDIT: Still passing STRONG with test 3
[Magisk] sawdoctor:
I'm running latest magisk canary (26104?) On pixel fold and still failed strong if that helps. Don't really want to change magisk version ATM as all my banking apps are working. You just know soon as you change things will break 🤣🤣
[Magisk] V0latyle:
Murphy's law. Never fix something that ain't broke, because you'll never be able to get it working again
[Magisk] chiteroman:
I'm using my custom module + Magisk Alpha 26103 (I tried KernelSU too) and latest Shamiko.
[Magisk] roirraW "edor" ehT:
Awesome news! Thanks for sharing that. Passing Strong (and the other two) on my Pixel 7 Pro with Android 13.0.0 (TQ3A.230705.001, Jul 2023), and Magisk Stable 26.1.

Spoiler content hidden.
[Magisk] Displax:
Magisk version doesn't matter. Some props values trick matter.
[Magisk] V0latyle:
Hmm. Nothing changed in props on mine, just Magisk 25.2 on the July update. Only other modules are the GPhotos Unlimited Storage mod, mindetatch, systemless hosts, and ReVanced for Youtube and Youtube Music
[Magisk] pndwal:
Xiaomi Redmi Note 8T (LSAR device), stock A11 MIUI, w/ or w/o Shamiko:

deviceIntegrity ✓

strongIntegrity x

No ill effects to report...

🙃 👍 PW
[Magisk] badabing2003:
Pixel 7 Pro

Magisk 25206,

All Green. (y)

Pixel XL

Magisk 26102

Fails Strong Integrity

Pixel 5

Magisk 26102

Fails Strong Integrity

One Plus 5

Lineage 20

Magisk 26104

Fails Strong Integrity
[Magisk] spida_singh:
Pixel 6

LineageOS 20 July Update

USNF 2.0 Test 3

Latest Magisk Alpha (https://xdaforums.com/t/discussion-magisk-alpha-public-released-fork-vvb2060.4424845/post-88706505)

Meets Device

Meets Basic

Failed Strong

Running Zygisk Xposed only with bootloaderspoofer module
[Magisk] badabing2003:
Which Props you want to check on my failing devices?
[Magisk] zgfg:
Didn't have time yet to read, just saw first two pages....

@pndwal - regarding your question, actually it is not necessary to have busybox binary itself in the path, it is enough for the use to have its applets mounted to /system/(x)bin (but they must link to theexevutable busybox binary aside)

Regarding to theApk.apk - it seams that Google is constantly updating (and not deleting the old versions - like they don't delete old TrichromeLibrary files)

I ran the following script:

theApkList=$(find "/data/user" -type f -name "the.apk" | grep app_dg_cache)
if [ ! -z "$theApkList" ]
then
for theApk in $theApkList
do
ls -l $theApk >> /sdcard/Download/theApkList.txt
echo "" >> /sdcard/Download/theApkList.txt
done
fi

And found12 theApk's on /data/data = /data/user/0 and 9 of them on /data/user/999.

All 21 installed since the end of June:

Spoiler content hidden.

Some installed to (GMS):

com.google.android.gms/app_dg_cache

(as in the pdf doc) but some also to (Playstore):

com.google.android.vending/app_dg_cache
[Magisk] pndwal:
Sorry, what question? 🙃

mmm... Don't know about leftovers, but a principal function is to update to latest droidguardVM per:

Anyway, unless you're going to reverse it, the 'Annex' (section 8) notes give the important detection function details... Clearly a few more have been added for Play Integrity since then however... PW
[Magisk] m0han:
Is this w.r.t. this post? Please share more info.
[Magisk] zgfg:
Didn't you ask today about theApk (droid guard) looking for BB in the path

Run the script to find how many theLeftovers you have
[Magisk] Displax:
Strong would work if device:

ro.product.first_api_level >= 33 or if it not present.
[Magisk] V0latyle:
Mine says 30.
[Magisk] badabing2003:
All the failed devices had <33

Pixel 7 Pro passed and it is 33

Any way to fake that? or it needs to be that to pass?
[Magisk] V0latyle:
I just changed it using MHPC (Root Explorer kept crashing for some reason)

Rebooted, gonna wait a few minutes then run PI check

Edit: Passed all 3

Edit2: but now my banking app won't launch

edit3: uninstalled/reinstalled app, it works fine now but still detects root so I can't use biometric sign in, same as before
[Magisk] zgfg:
With your safetynet-fix-xiaomi.eu.zip, Hardware backed CTS and Strong Integrity green on my Xiaomi.eu MIUI 14.10
[Magisk] sawdoctor:
Mine (pixel fold) is 33 and still fails strong integrity
[Magisk] badabing2003:
I think you can add these lines to service.sh file from test3 and not need MHPC (whatever that is)

But I fear that the side-effects might be too much.

if [[ "$(getprop ro.product.first_api_level)" -le 33 ]]; then
resetprop ro.product.first_api_level 33
fi

Update:

That worked on Pixel 5 (First API level 30), now to find out what broke

Update2:

It also worked on Pixel XL and One Plus 5 with Lineage 20
[Magisk] V0latyle:
MagiskHide Props Config. Originally tried editing build.prop with Root Explorer but it kept crashing.

Haven't noticed anything odd yet.
[Magisk] V0latyle:
How exactly is this working? Did we finally find a way to spoof STRONG_INTEGRITY?
[Magisk] rushiranpise:
this worked, it made pass strong integrity.

I added it to the test3 by editing the service.sh

zip is attached

Device: Samsung A50

Test 1 all failed

Test 2 N/A

Test 3 fails storng

Test 3 with api set to 33 pass all
[Magisk] badabing2003:
And Device API level is still reported low :) (which is good)

[ro.build.version.sdk]: [29]
[Magisk] rushiranpise:
Yes, same
[Magisk] Spartacus500:
Work Perfect Strong integrity Samsung Galaxy S7 edge Custom Pie 9.0 Rom NFE 👍😘
[Magisk] sawdoctor:
Any ideas at all for the pixel fold? It's 33 and so similar to the pixel 7 yet still fails strong. Really can't understand it especially if it's nothing to do with magisk version
[Magisk] badabing2003:
I wouldn't know, you'd have to ask the master.

I only suggested / tried changing the api level based on his remarks
[Magisk] rushiranpise:
same with test 1?
[Magisk] sawdoctor:
Tbh I only tried test 3, I'll try test 1 now. It's just baffling me what the pixel fold is doing different to the pixel 7
[Magisk] Lord Sithek:
Realme GT Neo 2, stock realme UI A13, with this change all 3 checks broken
[Magisk] badabing2003:
Make sure you didn't make a typo.

Try the attached.

This is test3 with those lines added, nothing else.
[Magisk] Lord Sithek:
Hmm yea, I must have made a mistake, now STRONG passes (y) Seems like it's universal solution :eek: Until Google finds this out :ROFLMAO:

EDIT: Same true with my Samsung Galaxy Tab S5e running crDroid ROM
[Magisk] sawdoctor:
Tried installing test 1 and pixel fold booted but would not get past the starting apps screen. Had to reboot to safe mode and then reinstall test 3. Definitely something different on the pixel fold

Edit its broken all my banking apps as well now
[Magisk] creeve4:
I flashed safetynet-fix-v2-4-0-mod_2-0-test3-api33-zip on my Pixel 4a, it booted fine, but after unlocking it restarted and keeps going to Android Recovery before I can enter safe mode. What is an alternate way to recover/remove the module?
[Magisk] badabing2003:
Open a command shell and issue this command

adb wait-for-device shell magisk --remove-modules

Reboot to system

As soon as a brief adb is available, the command will execute and disable modules.
[Magisk] creeve4:
Thank you. I tried this, but the system enters recovery before adb is available.

I will have to try flashing the stock boot.img from fastboot.
[Magisk] badabing2003:
Have you tried the safe mode key combination?

If you flash stock, you'll be unrooted, and as soon as you flash a patch boot, you'll bootloop again.

You need to disable the module(s), but for that you need patched boot/root.
[Magisk] rushiranpise:
thats strange, the service sh file runs after the boot has completed... so it shouldn't reboot u to recovery straight

maybe api_level 33 triggered it. but since it will any how reset to original value at reboot and set again...
[Magisk] rushiranpise:
how about rebooting in system by recovery mode??

or if adb is accessible in recovery, then try running those there ( i have no idea if is magisk is available there)
[Magisk] V0latyle:
I believe you can access shell via ADB in recovery but it's the recovery kernel's shell so a lot of stuff will be disabled or missing
[Magisk] Displax:
Set ro.product.first_api_level to 33 globally is not a good solution (that's what i try in my tests and what breaking system things on many devices).
[Magisk] creeve4:
I first tired the key combo to enter safe mode, didn't work.

It is not the normal recovery mode, the screen displays:

Android Recovery
Cannot load Android system. Your data may be corrupt.....

Try again
Factory data reset
[Magisk] creeve4:
Correct
[Magisk] rushiranpise:
will it lead to data corruption ?? like for creeve4
[Magisk] creeve4:
Even flashing stock boot.img does not allow me to boot past recovery...

Any other ideas?

Flashing the factory image without wipe, we'll see how that goes.

No good, still gets stuck at that recovery screen. crap.
[Magisk] rushiranpise:
if possible share pic of the screen
[Magisk] creeve4:
Sorry for the poor quality, using my laptop camera.

I've never seen this screen before.
[Magisk] creeve4:
When manually flashing the update zip

fastboot update image-sunfish-tq3a.230605.011.zip

It flashes without issue until it gets to the "Rebooting to fastboot" phase. at this point it reboots, but goes to the recovery screen above instead of userspace fastboot.

C:\sunfish-tq3a.230605.011-factory-e7734214\sunfish-tq3a.230605.011>fastboot update image-sunfish-tq3a.230605.011.zip
--------------------------------------------
Bootloader Version...: s5-0.5-9825683
Baseband Version.....: g7150-00112-230505-B-10075601
Serial Number........: 11031JEC203609
--------------------------------------------
extracting android-info.txt (0 MB) to RAM...
Checking 'product' OKAY [ 0.068s]
Checking 'version-bootloader' OKAY [ 0.067s]
Checking 'version-baseband' OKAY [ 0.068s]
Setting current slot to 'a' OKAY [ 0.149s]
extracting boot.img (64 MB) to disk... took 0.198s
archive does not contain 'boot.sig'
Sending 'boot_a' (65536 KB) OKAY [ 1.662s]
Writing 'boot_a' OKAY [ 0.305s]
extracting dtbo.img (8 MB) to disk... took 0.016s
archive does not contain 'dtbo.sig'
Sending 'dtbo_a' (8192 KB) OKAY [ 0.308s]
Writing 'dtbo_a' OKAY [ 0.104s]
archive does not contain 'dt.img'
archive does not contain 'pvmfw.img'
archive does not contain 'recovery.img'
extracting vbmeta.img (0 MB) to disk... took 0.000s
archive does not contain 'vbmeta.sig'
Sending 'vbmeta_a' (8 KB) OKAY [ 0.138s]
Writing 'vbmeta_a' OKAY [ 0.076s]
extracting vbmeta_system.img (0 MB) to disk... took 0.000s
archive does not contain 'vbmeta_system.sig'
Sending 'vbmeta_system_a' (4 KB) OKAY [ 0.138s]
Writing 'vbmeta_system_a' OKAY [ 0.077s]
archive does not contain 'vbmeta_vendor.img'
archive does not contain 'vendor_boot.img'
extracting super_empty.img (0 MB) to disk... took 0.000s
Rebooting into fastboot OKAY [ 0.068s]
< waiting for any device >
fastboot: error: Failed to boot into userspace fastboot; one or more components might be unbootable.

I attempted to manually reboot into fastboot, but then I get this error:

fastboot: error: Failed to boot into userspace fastboot; one or more components might be unbootable.
[Magisk] badabing2003:
What is the version of Android Platform Tools

Make sure not to use 34.x and use 33.0.3
[Magisk] V0latyle:
This is why I used MHPC, the prop isn't changed until the module loads AFAIK
[Magisk] zgfg:
If adb works for you, try to disable USNF:

adb shell su -c touch /data/adb/modules/safetynet-fix/disable

and reboot

You could also disable MHCP but I don't know module's folder name (what must come instead of "safety-net") - ir will be the same as I'd= .. in the MHCP module.prop (open the zip on the PC and read it)
[Magisk] creeve4:
Good catch! I was using an outdated fastboot. After updating the flashing process get farther, but still stops here:

Sending sparse 'super' 1/1 (4194303 KB) FAILED (Sparse file is too large or invalid)
fastboot: error: Command failed

adb shell is not available in this recovery environment.

edit: downgrading to v33 of platform tools fixed the above error.

Phone still gets stuck at the Android Recovery screen when attempting to boot into fastbootd.
[Magisk] rushiranpise:
ig format user data is the only option then
[Magisk] borisSweden:
This is getting way to common around here. There should be a big PSA on fastboot, this issue reminds me of the old "One Click Root" infestation that used to be around here.
[Magisk] Displax:
New build. Please test it and reply. Special attention to XiaomiEU users - please give feedback.
[Magisk] rushiranpise:
fails strong

samsung a50
[Magisk] badabing2003:
Just to be sure, you are flashing entire factory without -w and not just update image right?

full factory flashing flashes bootloader which might be the culprit.

If that still does not fix the issue, download full OTA for your device and sideload that, considering that you have no issues getting into recovery mode.
[Magisk] creeve4:
Correct, flashing full factory image (flash-all.bat with -w removed).

I already formatted user data.

Thank you everyone for the guidance and attempts to help!
[Magisk] Marvin732:
test 3 is failing STRONG on Xiaomi 11T Pro XiaomiEU 14.0.3.0

test4 is passing STRONG on Xiaomi 11T Pro XiaomiEU 14.0.3.0
[Magisk] jons99:
this one pass strong integrity on zenfone 9 a13 july omnirom
[Magisk] spida_singh:
Pixel 6

LineageOS 20 July Update

USNF 2.0 Test 4

Latest Magisk Alpha (https://xdaforums.com/t/...c-released-fork-vvb2060.4424845/post-88706505)

Meets Device Integrity

Meets Basic Integrity

Meets Strong Integrity

Running only 1 additional module, Zygisk Xposed with bootloaderspoofer module

Great Work!

Does anyone use GrapheneOS on a Pixel 6 who can check if this works on that OS?

If not I will try myself tomorrow. Would really like to get this running on that combo. You can run root with GrapheneOS, not sure if this will cause issues as their Google compatibility layer installs GMS as user apps, not system apps

Off topic either way. Thanks again
[Magisk] pndwal:
Nah... 😂 ... But thanks for efforts anyway 😜 ... PW
[Magisk] adi007:
Unfortunately on my old Mi mix 2s with Xiaomi eu stable v12.5.1 looks like it doesn't work :(

Magisk 26.1 + Zygisk/Deny list enabled
[Magisk] zgfg:
Strong/Hardware backed for me on Xiaomi.eu, MIUI 14, A13
[Magisk] pndwal:
... Oh. I see my link post was originally to another user (and @osm0sis) who commented/wondered about that... 😁 PW
[Magisk] chiteroman:
Xiaomi.EU roms already spoof props to pass Strong, but devs broke Strong attestation in latest rom, just patching first api level is the solution. Here is my module without Zygisk, if you are a Xiaomi.eu user you can use and test:

[OUTDATED] [DOESN'T WORK] Play Integrity Strong pass

.

xiaomi.eu

Only (should) works in Xiaomi.eu roms.
[Magisk] robuser007:
Working great on Oneplus 9 latest official build. Strong ok.
[Magisk] jaypur:
Samsung S20 plus | Rom stock | kernel ThunderStormS v3.3

Working great on S20 plus latest official build. Strong ok.
[Magisk] Lord Sithek:
Xiaomi Mi Note 10, A11, Xiaomi.eu - passing all 3 checks
[Magisk] Lord Sithek:
Same all good on realme GT Neo 2 and Samsung Galaxy Tab S5e
[Magisk] Displax:
Keystore broken? Check by: https://play.google.com/store/apps/details?id=io.github.vvb2060.keyattestation
[Magisk] Gordietm:
Test 4 passes strong integrity on 7 pro running A14 Beta 4.
[Magisk] sawdoctor:
Pixel fold Test 4 phone is stuck on starting apps same as Test 1. Flashing back to test 3 works fine just Test 1 and Test 4 won't get past starting apps
[Magisk] bjevers:
Pixel 7 Pro on July Android 13 update.

Test 3 worked fine.

Test 4 phone is stuck on "Pixel is Starting..." after rebooting. Had to disable module from adb and reinstall Test 3.
[Magisk] cosy6ay:
where to download the test package?
[Magisk] beeshyams:
@Displax Pixel 6a, Android 13,Magisk 25.2

Test version 2 and latest one result in the same "Pixel is starting" loop

Note to anybody else who is equally stupid as me - on reverting to a stable version that worked before, if your banking apps etc fail, it's because "enforce deny list" is not enabled

Yours truly flashed stock again to discover common sense
[Magisk] pndwal:
Well I'm voting for yours truly... And common sense:

😜 PW
[Magisk] pndwal:
From Kyiv, but which one?... Last one here:

Post in thread '[MODULE] [MOD] Universal SafetyNet Fix' https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88773941

😛 PW
[Magisk] casouzaj:
Yay, with Test4, my Xperia XZ2, running LineageOS 20.0, is finally passing the strong integrity test (all three tests are, for the first time, ever since I unlocked its bootloader, green). I`m keeping this version, no matter what! Thank you very much, @Displax !
[Magisk] zgfg:
Scroll back, read posts, find attachment(s).

Test4 was posted about 8 hours ago.

Many posts with test results quote back to the post with the attached Test4
[Magisk] Fishawy:
Happened to me with Test 1 or 2, can't remember.

Reboot the phone, and as soon as you see the G logo, press volume down and keep pressing until you see the lock screen.

You've now booted into Safe Mode, with Airplane mode activated and all Magisk modules disabled (not deleted).

Disable Airplane mode, do a normal reboot to exit Safe Mode, then afterwards re-enable your modules (except the USNF Mod Test4, just delete it and reflash Test3).

Have either the "SystemUI Bootloop Saver" or "Magisk Bootloop Protector" modules ready on your phone before you begin, just in case.
[Magisk] pndwal:
I'm confused... This means it should work on devices up to A12... Others indicated it works with prop set to 33!... (Did you mean 'would work if device:

ro.product.first_api_level < 33 or if it not present.?)... 🤔

Ah... I misread as 'ro.product.first_api_level >= 33 is not present'... 🤦... Sorry! 😬

... Also, original shipping level prop change for LV A13+ devices (set to 32 to bypass server end hardware backed verdict enforcement) is also set globally and this is apparently causing issues... Mentioned here:

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88753099

... Seems the other two mismatches originally required (to bypass hardware backed verdict enforcement), model and fingerprint props, are gms targeted...

Can we just target gms with shipping level changes to fix issue linked as well as to test strongIntegrity?... Thanks, PW
[Magisk] zgfg:
It's much easier as he mentioned he did, to disable only that single module by adb

adb shell su -c touch /data/adb/modules/safetynet-fix/disable

After that reboot normally since the above command disables only the safetynet-fix module (test or not, doesn't matter), all other modules load normally

No troubles with Android Safe mode (screwing up home screen, etc)
[Magisk] Stillhard:
@Displax

Surprisingly using file from here OR here
[Magisk] seanybiker:
Unihertz Tank 😆
[Magisk] sawdoctor:
Yep that's what happened to me but unfortunately I had to delete Google play store data to make them work again which caused enough problems on its own
[Magisk] Stillhard:
You can try to test with this one
[Magisk] seanybiker:
That's what I used 👍
[Magisk] Stillhard:
No, the file i sent is a modded one, taken from source of files i mentioned in my post here merged in Displax's test4
[Magisk] seanybiker:
Oh sorry . The name came as (1) when I went to download so I presumed it was the same. I'll check it now , thanks

Woah , fair play to you . You're a legend.