yashsingh1/xdaforums huggingface dataset:
[Xposed Framework Modules] Vision:
Yeah, you have mentioned about BootloaderSpoofer, I know about frameworkpatch, but still not working on my device and in lot of users, and on A11, I have some comments maybe help in TEE hacking thread, I have mention of you
[Xposed Framework Modules] kiradotee:
Yeah I'm trying to make BootloaderSpoofer work on my device so that WhatsApp works again. However, BootloaderSpoofer (and all LSPosed modules) seem to only work in the main profile and don't work in the Android work profile(Island).
[Xposed Framework Modules] raghavvashistha:
Is this still a module in development? Anyone using it with current kernel su on a14? Momo getting spoofed?
[Xposed Framework Modules] kevinco1:
Anyone get Uber Driver to work with this?
[Xposed Framework Modules] raghavvashistha:
For me, even normal uber doesn't work. It works in web view only mode and disables all modes of payments but cash. Which android version are you on?
[Xposed Framework Modules] Rayan_321:
Should i add pubg in bootloader unlock so that the pubg can't detect that bootloader is unlocked?
[Xposed Framework Modules] hzsolt:
My experience with Gpay and Wallet: I put OEM lock Off, reflashed original stock firmware for my Samsung A8, everything is worked. After this, I set ONLY OEM unlock in Settings-Developer Tools, all breaked. So no root, no changes, only one flag changed. Putting again OEM off (not restarted) and cleared the caches and datas from Google Play, Google Play Framwork, Gpay and Wallet, setting again and after worked again as charm. So first is to hide OEM UNLOCED STATUS before the rest of spoofing.
[Xposed Framework Modules] vygavedha:
Can this module fix my issues with Netflix not connecting?
[Xposed Framework Modules] intel_core_i7:
Well, some would be surprised, that this module can work with Lspatch!

That VNeID app I mentioned in several other threads works wonderfully after I patched it with this module, NoAccessibilityServices and IAmNotADeveloper. This app uses local hardware attestation.
[Xposed Framework Modules] mrgbuzz:
Hi, did you ever get the Vtech app working? I have the same issue now.
[Xposed Framework Modules] godecij942:
Nope, ended up simply installing an older version. Lucky that it's not one of those apps that forces you to install the latest version or else it won't run (like the digital licence app lol). Don't think the issue was related to an unlocked bootloader anyway. Scratch that, turned out it was simply zygisk getting detected. Turned it off > reboot and now both apps open without issue.
[Xposed Framework Modules] mrgbuzz:
Thanks. I'll try an older version without Zygisk.
[Xposed Framework Modules] rouenmod:
will this work for broken TEE? I have mi 5 (gemini)

will this work on custom and stock rom?
[Xposed Framework Modules] Vision:
A new module.

Very promising.

GitHub - 5ec1cff/TrickyStore

Contribute to 5ec1cff/TrickyStore development by creating an account on GitHub.

github.com
[Xposed Framework Modules] rouenmod:
sad, im in android 11. android 13 and 14 has aggressive memory killer on this device (gemini), so multitasking is almost impossible. for example, I cant use google maps with ytmusic. never tried android 12 tho, I'll give it a try if non of this worked on 11
[Xposed Framework Modules] Vision:
Yeah understand.

Me too I'm on A11.

Do a good search first and after you see what is better.

And this:

GitHub - aviraxp/Zygisk-KeystoreInjection: Generate a valid certificate chain from scratch by injecting custom Keystore provider

Generate a valid certificate chain from scratch by injecting custom Keystore provider - aviraxp/Zygisk-KeystoreInjection

github.com
[Xposed Framework Modules] rouenmod:
appreciate the help dude, apparently blspoofer works, and with playintegrityfix, now my "partially-banned" number can use whatsapp again, many many super big thanks @chiteroman, whatsapp is vital for my work :D
[Xposed Framework Modules] Vision:
That's is good 👍
[Xposed Framework Modules] rouenmod:
I tried this module on other rom.

install 3.8 module, checkmark keyattestation app (from playstore), delete its data, reboot. result was "unable to attest". delete its data, reboot. result is the same.

try uninstall blspoofer, install version 3.2, checkmark keyy attest app, delete its data, reboot. result was bootloader locked, but certificate chain is untrusted.

try uninstall blspoofer 3.2, reinstall 3.8, etc etc. result was perfect. I dunno what caused the first test fail.
[Xposed Framework Modules] chiteroman:
That only hides apps but not the su binary.
[Xposed Framework Modules] PhantomWhisper:
Thanks, that's good to know that, so no reason to use it if it doesn't hide su
[Xposed Framework Modules] chiteroman:
If there is an app that checks installed apps maybe will be useful.
[Xposed Framework Modules] Mu7am3D:
i tried cib but it didn't work i have lsposed-zygisk 26.1 magisk

and when i installed 'key attestation ' app it says the boadloader is locked ! but cib app doesn't open
[Xposed Framework Modules] chiteroman:
Hide root, do you have Shamiko module?
[Xposed Framework Modules] Mu7am3D:
Yes i have shamiko module, what do you mean by hiding root ?

i use configure deny list and checked the app and didn't force

and i have these modules installed

View attachment 5920635

View attachment 5920633
[Xposed Framework Modules] immortalwon:
This is now patched in latest key attestation app by Rikka, et. all. Version 1.4.1
[Xposed Framework Modules] PhantomWhisper:
Hi, which app is that can you point me to it pls?

update: found it
[Xposed Framework Modules] Ramco.:
Which font setup do you have? Can you please share? Looking nice.
[Xposed Framework Modules] NEO701:
Is this module still working for CIB app?

Does it have any workaround to work with OnePlus devices?

Does it have any new updates? The GitHub page seems down.
[Xposed Framework Modules] chiteroman:
1. Should work.

2. If your device has a broken TEE it will never work, so no :(

3. I temporarily removed it.
[Xposed Framework Modules] NEO701:
Thanks for the feedback. :)

I have Oneplus 8T, but I am not sure if it has a brocken TEE.

Is there a way to confirm?
[Xposed Framework Modules] westruk:
Releases · vvb2060/KeyAttestation

Contribute to vvb2060/KeyAttestation development by creating an account on GitHub.

github.com
[Xposed Framework Modules] chiteroman:
CHECK FIRST POST
[Xposed Framework Modules] chiteroman:
Confirmed, latest Magisk Alpha Alpha (26102) bypass InstaPay without spoofing bootloader, seems like InstaPay have a great Zygisk detection but can't detect native bridge :o @pndwal
[Xposed Framework Modules] chiteroman:
NEW VERSION RELEASED!
[Xposed Framework Modules] chiteroman:
Fixed
[Xposed Framework Modules] immortalwon:
Excellent work. Working as normal again.
[Xposed Framework Modules] innit:
BootloaderSpoofer + KeyAttestation 1.3.4 bootloader shown as locked

BootloaderSpoofer + KeyAttestation 1.4.1 bootloader shown as unlocked

What could be the reason for this?
[Xposed Framework Modules] NEO701:
This is what I got.

View attachment 5928659
[Xposed Framework Modules] immortalwon:
doesn't work on devices with Broken TEE like oneplus devices or rog3
[Xposed Framework Modules] chiteroman:
Whaaat, I don't know why that happen XD
[Xposed Framework Modules] chiteroman:
Rog3 has a broken TEE but in a good way xD
[Xposed Framework Modules] chiteroman:
InstaPay doesn't check bootloader status, I have latest Magisk Alpha (26102) + Shamiko and I can bypass it
[Xposed Framework Modules] Baraa Almodrek:
Thanks for your hard work ❤️

It works great.

Are you Egyptian?

And do you have patreon or Vodafone cash?
[Xposed Framework Modules] chiteroman:
No, I saw a post in Reddit with people complaining about this app.

No, just Paypal 😋
[Xposed Framework Modules] chiteroman:
Thanks 😎
[Xposed Framework Modules] Xperi.a:
Hey @swer45 - I've sent you a DM. Please check
[Xposed Framework Modules] Baraa Almodrek:
Ok np give me your paypal ❤️
[Xposed Framework Modules] the.art.m:
Hi. Has anyone researched Bet365 authenticator? It uses appdome and since new versions it started checking bootloader state. This app doesn't work, probably because it checks certificate issuer. Could someone help me with it?
[Xposed Framework Modules] westruk:
In previous appdome versions attestationspoofer works well?
[Xposed Framework Modules] the.art.m:
It is not needed cause Appdome started checking bootloader just in a new version
[Xposed Framework Modules] chiteroman:
Yeah, it checks your bootloader status and detect injection like Xposed. Sorry but I can't help you more, if you want to use that app you must lock your bootloader :(
[Xposed Framework Modules] the.art.m:
I could bypass xposed detection but not bootloader... It checks that certificate issuer is Google and detects it as Strong play integrity does. That's sad
[Xposed Framework Modules] chiteroman:
How could you know if you bypass Xposed detection? Also the app can't check Strong because isn't in Google Play...
[Xposed Framework Modules] the.art.m:
There are different messages for them. For instance, for frida, for magisk, for developer settings and for bootloader.
[Xposed Framework Modules] westruk:
you know how they check bootloader status?
[Xposed Framework Modules] the.art.m:
I hooked bootloader check in keystore bia xposed. I hooked it to throw exception and app crashed. Without throwing exception app closes on its behalf but with it it crashes without any messages
[Xposed Framework Modules] chiteroman:
Which method did you hook and which throw class did you use ?
[Xposed Framework Modules] chiteroman:
Updated :D
[Xposed Framework Modules] immortalwon:
Working good, but any changelog ?
[Xposed Framework Modules] Elsrougy:
@swer45​

Can you check if those apps works with your module? I want to know if they fail with me because they detect bootloader or Zygisk or something else but my phone is oneplus8 and I cannot use it

NAFATH: https://play.google.com/store/apps/details?id=sa.gov.nic.myid&hl=en&gl=US

SNB Bank: https://play.google.com/store/apps/details?id=com.snb.alahlimobile&hl=en&gl=US

Absher: https://play.google.com/store/apps/details?id=sa.gov.moi&hl=en_US
[Xposed Framework Modules] chiteroman:
View attachment 5933077

It just detects SU or Zygisk injection.

Other apps can't download cause region restriction.
[Xposed Framework Modules] Elsrougy:
Thank you, I believe other apps use the same detection method as they are all government related. If you can download them from APK mirror for example and test it would be of great help, if you do not feel safe to do so its okay.

I use Magisk Stable with USNF, Shamiko and HMA but does not seem to work with those 3 apps. I believe they are detecting Zygisk and I do not want to install Magisk Alpha as it is not that safe tbh. Any suggestions?
[Xposed Framework Modules] chiteroman:
What? Why?

Disable Magisk Zygisk and install: https://github.com/Dr-TSNG/ZygiskOnKernelSU (don't need KernelSU)
[Xposed Framework Modules] Elsrougy:
Not open source anymore and the developer's behavior is very questionable. You will find a lot on this on Alpha discussion and Magisk general discussion threads here on XDA. That made me skeptical and afraid to use it. Do not forget that specially Magisk will have nearly full control on your phone.

Will give it a shot. Thanks!

Edit: Does not work as when disabling Magisk Zygisk all other modules such as USNF, Shamiko, Lsposed (and thus HMA) doesn't detect Zygisk and are disabled giving the message "Module suspended because Zygisk is not enabled". Any other suggestions? 🙄
[Xposed Framework Modules] Xperi.a:
@swer45 Is there any method to use LSposed or Taichi on KernelSU without Enabling Zygisk?

I've noticed that Zygisk causes more problem then solution. 99% apps work for me if I dont enable Zygisk but when I enable Zygisk, They start to detect root and stuff.

I'm thinking to Try out Taichi with KSU or trying to find a way to use LSposed without Zygisk.

PS: I could not find RIru for KSU to use Riru version of LSposed
[Xposed Framework Modules] Donpablo0271:
Could you test with this app

Livin By Mandiri​

Livin' by Mandiri - Apps on Google Play

Livin' by Mandiri is here with more features, for your lively life!

play.google.com
[Xposed Framework Modules] DanGLES3:
The issue is, RIru wouldn't help depending on the app as some apps can detect both
[Xposed Framework Modules] Xperi.a:
We need a different solution then Zygisk. We need independent LSposed that works without Riru or Zygisk
[Xposed Framework Modules] chiteroman:
Modify super.img and flash it
[Xposed Framework Modules] Xperi.a:
Can you tell how? Also, After modifying super.img we can use LSposed without Zygisk or Riru?
[Xposed Framework Modules] chiteroman:
You need to unpack it and modify system.img and use apktool to decompile system framework, you can't use LSPosed using this, but you can do your own hooks.

Also you can modify Conscrypt library and modify the method to spoof a locked bootloader, but it won't work with new Key Attestation Demo version.

This: https://github.com/AndroidDumps/Firmware_extractor
[Xposed Framework Modules] Xperi.a:
I dont think I'm skilled enough to do all this.

Do you think you can modify current LSposed and make it work with KSU without Enabling Zygisk or Riru?
[Xposed Framework Modules] DanGLES3:
That's where the problem lies

Lsposed uses code injection methods (Riru and Zygisk) because directly modding the app_process file (like old Xposed) would result in it getting easily detected by anything as it will apply to every single process

And if you want Lsposed to come up with its own injection method, that's also another problem, these modern apps are now capable of detecting if anything was injected into the Zygote process

In short, it'd be more productive for someone to try and improve Zygisk's hiding capabilities or for someone to create an code injection framework directly into KernelSU
[Xposed Framework Modules] chiteroman:
View attachment 5933991

🤭🤭🤭🤭🤭
[Xposed Framework Modules] chiteroman:
View attachment 5934117View attachment 5934123

Finally Pine Injector works, now we can hook like LSPosed but without using it.

I will try to bypass that app protection.
[Xposed Framework Modules] DanGLES3:
Nice work, if that can bypass the zygisk/code injection detection these apps use that'd be great
[Xposed Framework Modules] chiteroman:
Thanks to Pine now we can hook Java methods + JNI methods + C code + patch instructions.

This is much better than original Zygisk implementation has.

But it needs an undetected Zygisk + Shamiko.
[Xposed Framework Modules] chiteroman:
View attachment 5934179

Root detection, no bootloader check.
[Xposed Framework Modules] immortal463:
Could you test this app https://play.google.com/store/apps/details?id=de.payback.client.android&hl=de or any other Payback regional version? I have no idea what it detects, the only app that I have that manages to detect something.
[Xposed Framework Modules] innit:
BootloaderSpoofer won't help. Payback still shows "Diese Anwendung kann nicht ausgeführt werden...." sometimes. I just force close and open it again and then it works. They changed something few versions ago for whatever reason as if it was some highly sensitive governmental app that needs strict protection heh
[Xposed Framework Modules] cina73:
Hi!

I'm far from understanding all of this and sorry for this question it if is dumb: Is there a way to restore TEE (Trusted Execution Environment, if I'm right) ?

I have a Samsung Note 10+ with official LineageOS 20. I changed my fingerprint to Google Pixel 6 Pro (google/raven/raven:13/TQ1A.230105.002/9325679:user/release-keys). The latter is needed for Netflix and brothers complaining in Playstore that they are not compatible with my device. I'm searching for a solution to not detect unlocked bootloader by Hungarian CIB. I have Magisk 26.1, MagiskHideProps, shamiko 0.7.3, Universal SNF mod 1.2 and GoogleSpoofForWear. All apps working as expected but CIB.
[Xposed Framework Modules] pndwal:
Yeah, you may be a little confused... You won't have broken TEE even if Momo detector etc report this... That only means broken OEM keymaster implementation for verified boot key attestation certificate verifications etc, which does involve keystore in TEE, a hardware protected OS (often Google's Trusty TEE or another chosen by OEM) and associated memory.

Despite broken attestations, HD video decoding normally still works (performed in hardware TEE also) as long as you still have L1 Widevine DRM security certification... In some devices Widevine does check S/N or PI attestations or possibly the droidguard attestation data used by the same and so certification drops to L3 which prevents decoding... Also, various issues incl bad ROM updates can cause L1 certificates to be revoked and L1 can't be restored without generating new certificate keys... I know that this is easily done on some devices incl. many Xiaomi devices (done through a simple settings menu), but may be difficult or impossible on some devices... Other TEE operations, eg biometric data handling generally also continue to work fine...

To see if you have L1, use DDM Info app...

To check PI deviceIntegrity verdict, use Play Integrity API Checker...

To fix deviceIntegrity, remove MHPC module (you don't need it with late USNF) or at least revert fingerprint/security patch date prop changes... Also, with Zygisk-USNF you should have nothing Google in denylist other than G Pay/Wallet... May need to clear data for Google Play Services, and to restore Device is certified in Play Protect / Play store, clear Google Play Store and Google Play Protect Service if exists (only on late devices or ROM updates)...

In case of issues, disable all modules other than @Displax's modded USNF and ensure you have no other mods, eg zips flashed from TWRP, and try again...

Once PI deviceIntegrity is passing, check for Widevine L1 certification... If all is good Netflix, Disney etc should show in Playstore...

If still L3, you may need to check Samsung forums re fix for L1 Widevine... Nb. Some devices (usually Chinese region, older or low spec) never had L1 certificates anyway, so you'll need to be sure L1 was certified for your device by Samsung also... There are other workarounds for HD available if stuck on L3, but I haven't used these...

Hope it helps, 🙃 PW
[Xposed Framework Modules] Elsrougy:
What is your setup when you opened this app?

I tried:

Alpha+Shamiko

Alpha+Denylist

Alpha+MagiskHide (No Zygsik) (This made one of the 3 apps I linked earlier work but not the others)

and off course before that I was on TJW Magisk and tried with hide, with shamiko, with Magisk hide, with riru and several other trials nothing seem to work

I really do not know what it is detecting on my device really
[Xposed Framework Modules] rushiranpise:
Works with key attestation demo latest ...

But not with momo & memory detector
[Xposed Framework Modules] Sm00thCriminal:
So like how does one actually use this app? I downloaded it and supposedly installed it but nothing has changed from what I can tell. It's not a module like the rest.

Edit: ok I'm dumb I figured it out. Though finding an up to date tutorial on how to get xposed framework working on magisk is kinda hard to find.

Edit Edit: Passing all checks and bootloader locked on Key Attenstation. Bank app still somehow detecting "custom ROM or unlocked bootloader" (not using custom rom btw)
[Xposed Framework Modules] chiteroman:
Which bank app do you use?
[Xposed Framework Modules] resi83:
Same result for me too, not with a banking app but VW we connect app always detects root...

https://play.google.com/store/apps/details?id=de.volkswagen.carnet.eu.eremote
[Xposed Framework Modules] DanGLES3:
Not detecting bootloader status, just hiding root here seemed to do the trick
[Xposed Framework Modules] pndwal:
Detecting Zygisk, but not native bridge loaded Zygisk... This post, and see post above:

https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-88468151

... 👍 PW
[Xposed Framework Modules] resi83:
I'm waiting patiently. 😇

In the meantime, I use the following solution:

- MagiskHide v1.10.3 Module (HuskyDG)

- toggling off Zygisk

🍻
[Xposed Framework Modules] Astral:
Does this app detect bootloader's status or just root/xposed? Does anyone have an idea?

Clash Royale - Apps on Google Play

Clash Royale is a real-time, head-to-head battle game set in the Clash Universe.

play.google.com
[Xposed Framework Modules] chiteroman:
I think it's only detect root. Hide it.
[Xposed Framework Modules] midozalouk:
What about making hook for apps

Can you please help me for making cib egypt work as i have oneplus 7 and the key attestation spoofing not working in oneplus 7
[Xposed Framework Modules] chiteroman:
OnePlus have broken TEE (when unlocked), this module will never work, you must lock your bootloader.
[Xposed Framework Modules] midozalouk:
Can i just hook how cib report broken TEE instead of the danger of locking the bootloader 😅
[Xposed Framework Modules] DanGLES3:
Just out of curiosity, would it be possible to add the following capability into the module, as in make so it injects into the system process itself but offer some sort of list of apps to apply the attestation spoofing into? This way it could avoid the spoofed app potentially detecting Xposed hooks and prevent breakage of Play Integrity by not spoofing the attestation to Google's processes

Just curious if such idea is possible, that's all
[Xposed Framework Modules] chiteroman:
Yeah, I never tried that way.
[Xposed Framework Modules] chiteroman:
You can pull your framework jar, implement Pine, hook certificate class and the extension value method and send it to device again. You must use recovery for this, due system is read only.

Also you must mount system with a custom script.

Maybe in a future I will provide instructions on how to do this.
[Xposed Framework Modules] DanGLES3:
Not exactly what I was hoping for but thanks for your answer nonetheless
[Xposed Framework Modules] chiteroman:
I tried it before but with Magisk magic and it worked! But I will need to study how to implement this in better way. I just throw an exception in engineGetCertificateChain, Momo don't detect it due it's not injection.

It's a first step 🙃
[Xposed Framework Modules] NEO701:
Is this something that can be implemented in the module, to bypass this on OnePlus devices?

Thanks for your efforts BTW. 🙂
[Xposed Framework Modules] Spartacus500:
Not working for me 😔
[Xposed Framework Modules] leonesta:
Any chance to run instapay without magisk alpha..?
[Xposed Framework Modules] leonesta:
Edit :tried latest Magisk Alpha and latest shamiko with no luck
[Xposed Framework Modules] MR.EXPLAINT:
can you show me which option need to edit....you have example script about this..?? or you have try that before? if yes what devices you have tested....
[Xposed Framework Modules] charlis88:
can you show me which option need to edit....you have example script about this..?? or you have try that before? if yes what devices you have tested....
[Xposed Framework Modules] Valla45:
Does anyone know if this works for Uber?

If they use the Play store check or a separate one?

If I am understanding it all correctly...

On a Pixel 7 and EvolutionX

Thanks guys!
[Xposed Framework Modules] chiteroman:
Uber driver requires Strong integrity, you must install stock rom and lock bootloader to use it.
[Xposed Framework Modules] Valla45:
Brah this **** is whack

All this time and my phone is so nice now :(

No need to answer, but there has ever been a way to spoof a locked bootloader for apps like this?

Cheers for the info!
[Xposed Framework Modules] chiteroman:
There are phones which TEE always sign as locked the bootloader status (like Asus Rog 3). But Google will blacklist them.
[Xposed Framework Modules] pndwal:
Keys already revoked for Asus ROG Phone 3... PW
[Xposed Framework Modules] chiteroman:
But not for Asus ROG Phone 6 😜

Why you think Asus disabled to open bootloader?
[Xposed Framework Modules] pndwal:
That did it 🤪 PW
[Xposed Framework Modules] pndwal:
Really?... No more Asus for modders?... Or only certain models? 🙄 PW