yashsingh1/xdaforums huggingface dataset:
[Magisk] addsfsds:
Hello mate, same here, no luck with op 12 rooted with magisk, but no problem on my old 8 pro with android 11.
[Magisk] Kris Chen:
OMG... This is the result from my Pixel4XL + LOS21 ~

Say thanks to chiteroman :)
[Magisk] 0ctobot:
Forgetting about RCS, do we even have any confirmation of anyone achieving STRONG on 16.0+ with a non-sailfish fingerprint, because I haven't seen any.
[Magisk] Annie the Eagle:
I have STRONG on my Pixel 8 Pro, using v16.0, and I'm not using a Sailfish print, been using the same custom pif.json for months now. I don't know what Sailfish even is to be honest... is that the name of the device an FP came from? How can I check?

I also have RCS working, but RCS has been working for months, even before this new STRONG version, I was getting RCS with just DEVICE as well.
[Magisk] RAZINARES:
Sailfish got banned?

Sent from Pixel 7a using ReLabs
[Magisk] majorfigjam:
Only for RCS
[Magisk] chiteroman:
They fixed the Strong pass, sailfish fingerprint works, just downgrade to v15.9.9
[Magisk] osm0sis:
That was fast!
[Magisk] intel_core_i7:
This time they ended the party pretty quickly eh?
[Magisk] joeyhuab:
Well people checked through Play Integrity checker app once again or TB checker. I'm sure that triggered the ban.
[Magisk] RAZINARES:
I think goolag devs are lurking in this thread
[Magisk] pndwal:
So looks like sailfish (ie. original pixel, code name) print (device prop/field set really) or other "private"/"un-banned" (for spoofing) prints may be needed for the STRONG with Magisk...

and KSU LKM or APatch may be needed to use your own device's print...

[Edit: Think I was a bit late to this party... STRONG FIXED by Google... Thanks to those who UnFixed it briefly!]

RCS is print dependant... Sailfish breaks it. Most "private" prints allow, own device print should allow if device is deemed RCS compliant (stock implementation/hardware is secure enough)...

It is [was] all very curious however... (You can try praying , but I've seen no official or anecdotal evidence of that working for this purpose either.) 😅 PW
[Magisk] Vision:
So complicated all this.

I will take the mountains, stay in a hut 🛖 😂🤣
[Magisk] Annie the Eagle:
Ah yeah, STRONG pass already fixed, I mean it was bound to happen as soon as Google heard about it. Using 15.9.9 still works with my custom print for DEVICE and I think RCS still works
[Magisk] pndwal:
Edited my post... The inevitable has happened! 😂 PW
[Magisk] sawdoctor:
About as quick as when displax gave us strong integrity but at least they didn't ban the print this time
[Magisk] samhhmobil:
@chiteroman

So....

It doesn't stay long...

Since about 30 minutes both devices does just only basic integrity (after passing strong for approx. 16 hours)

For now using PIF 16.2 game is over 😥

Falling back to 15.9.9 works for Basic AND Device Integrity, as before.

samhhmobil
[Magisk] pndwal:
Edited above... RCS should be good if it was before. 🙂

To be clear (for all), 16.x builds removed Zygisk parts (that break key attestation on device for fallback to basic/software attestation and do prop/field spoofs targeting DroidGuard to bypass server end HARDWARE_BACKED evaluationType enforcement) as both STRONG and DEVICE were briefly attainable with HKA and STRONG couldn't pass with basic/software attestation... Since this embarrassing (for Google) episode is now over, we once again need <\= v15 to achieve working basic/software attestation for DEVICE_INTEGRITY once again... 🤠 PW
[Magisk] Scholeggo:
I'm not taking about strong though..
[Magisk] Vision:
Yeah, Google fixed.
[Magisk] HippoMan:
... or it simply could be that one or more Googlefrinchians read this public thread.
[Magisk] V0latyle:
Use a different print. It'll only pass DEVICE though
[Magisk] osm0sis:
Not a working print.

Also, see FAQ #9:

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com
[Magisk] Frax3r:
Quick question, play integrity checker in play store dev settings supposed to see the fingerprint set by pif module right? for some reason its defaulting to my device fp no matter what I put inside pif.json file

actually read the faq, sorry. still I can't pass cts in safetynet and device verdict in play integrity with a working tee in a oss rom. tried both official magisk and kitsune magisk, with and without zygisk assistant
[Magisk] pndwal:
What I'm particularly interested in now is pursuing this observation:

Since device 'prints' (prop/field sets) apparently worked for the STRONG verdict/attestation only with KSU LKM or APatch while sailfish or other "private"/'un-banned-for-spoofing' prints continued to be be needed with Magisk (device prints wouldn't work), it seems that KSU LKM or APatch were somehow bypassing the spoof-use 'ban'. 😃🤔

I now wonder if (with the correct configuration) users of KSU LKM or APatch aren't subject to the 'bans' on prints for basic (software) attestations either and may actually be able to achieve DEVICE_INTEGRITY with any print sets from pre-Android 8 launch version devices or newer OnePlus devices (that Google never used to enforce HARDWARE_BACKED evaluationType), including those previously 'banned' for spoofing purposes....

It's a long shot, but please, would KSU LKM / APatch users try this and report?... It may help us to discover the critical difference between these setups and Magisk, and how the current print 'bans' were/are achieved and could be bypassed in Magisk...

Some may already be able to put their finger on how SU in kernel instead of in ramdisk could make Google 'banning' less effective.

👍 PW
[Magisk] passionicon:
Who knows how or even if cygwin can extract dumps from stock roms rather than the url?
[Magisk] pershoot:
I've done some testing against 16.0 and 16.2 using APatch. 16.0, no verdicts get passed (null) using my own device's FP (lynx). 16.2, only BASIC, using my own device's FP. Both versions pass Strong with the current pub. print.

<edit> This was yesterday before ban.
[Magisk] Vision:
Yeah, something strange happens between the root method.

Unfortunately, Google fixed.
[Magisk] pndwal:
But not any more...

Can you revert to v15.x and try APatch with other prints from devices launched with Android 7 or older? (See my post above)... 👍 PW
[Magisk] pershoot:
This was yesterday before ban.
[Magisk] pershoot:
🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

I will be reverting back to my previous config and will monitor this thread :)

I would stay on APatch, but LSposed has issue on it and do like the particular functionality I use from it.
[Magisk] bou1l3m:
strong passes again thanks google ♡
[Magisk] Aregtheeditor:
really?

EDIT: It is only basic bruh
[Magisk] Chacka_Upperi:
Hi what is the best method to pass basic right now?
[Magisk] JazonX:
Remove current PIF Module and Flash below;

Release v15.9.9 · chiteroman/PlayIntegrityFix

MEETS_DEVICE_INTEGRITY is green again ✅ Refine code logic

github.com
[Magisk] Chacka_Upperi:
Is the newer version broken?
[Magisk] Aregtheeditor:
ye
[Magisk] addsfsds:
Hello, so on oneplus 12 with magisk 27 it's not currently possible to achieve DEVICE?

On my old oneplus 8 pro with PIF 14.1 and playcurl I still pass device. Any advice please? Thank you
[Magisk] JazonX:
Yes, and explained here why;

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] LLStarks:
I'll probably try this later. Want to play around with bacon and taimen prints.

What I noticed yesterday, was that sailfish-styled prints were passing basic hardware attestation when they had no business passing.
[Magisk] trevtdogg:
I think one of the easiest ways to test this would be to use older versions of chit's pif that had different fingerprints (working at the time, but now all burnt) hard coded in.
[Magisk] pershoot:
Seems LSposed has some issue which I may not have noticed as it was installed before various upgrade(s). I could have stayed on APatch; ah well. I can always go back to it for further testing at a later date.

<edit> This works: https://github.com/mywalkb/LSPosed_mod

<edit2> Newer one: https://xdaforums.com/t/dev-apatch-...-to-kernelsu-and-magisk.4655727/post-89564072
[Magisk] lordmd:
Using a POCO X3 Pro with MIUI Global 14.0.1 (TJUEUXM) stock rom. Afaik the latest stock rom for the european market. (One later version that got rolled back and no more updates.)

I had this exact PlayIntegrityFix at an older version for a long time. Not updated since most of my apps worked. (Only one app was a bit annoying and I had to switch to Magisk Alpha though people reported that the normal Magisk would also work again - after some changes. And I have Shamiko installed which does not seem to be really needed - maybe it can affect some other stuff negatively.)

Updating to 15.9.9 a few days ago - everything stayed working. Base and Device ingetrity yes. Other two (strong, virtual) no. Switched to 16.0 now. Same. (No strong.) Not sure if some of my changes broke TEE and/or how to easily check it. Maybe there is a good all-in one app. Atm I have Momo and TB checker. (Root not dectected in TB checker. Some small LSPosed stuff detected and TWRP - but that only because of the directory for settings it creates.)

---

tl;dr: POCO X3 Pro at the latest not rolled back stock rom, bootloader unlocked and Magisk Alpha (also Smamiko and LSPosed latest). Base and Device ingetrity worked all the time (play licensed and play recognized also okay) even since an older version before 15.9.9 that I used for a long time without upgrading. No strong integrity with 16.0.

Not sure about TEE state but I made no other modifications.

(Seeing some people already posting other stuff and linking older explanations. Might read the whole thread/posts since 16.0 update later.)
[Magisk] Chacka_Upperi:
What are some magisk or xposed modules to avoid, that may break play integrity?
[Magisk] UberNorse:
I can try this later this evening when home if no one else has an answer for you.
[Magisk] chiteroman:
v16.0 works if your first_api_level < 33
[Magisk] Vision:
Something has changes yesterday.

Update · chiteroman/FrameworkPatch@f7ba6c5

Modify framework.jar to build on system level a valid certificate chain - Update · chiteroman/FrameworkPatch@f7ba6c5

github.com
[Magisk] dekefake:
Maybe next time you shouldn't put keybox values in GitHub they probably have a web scrapper running to identify the compromised keys published online.
[Magisk] tryigitx:
I have a project in mind, but it could be bad if Google tracks it, so I'm thinking of encryption

The code will randomly select a certificate chain from a certificate chain repository in encrypted form, either on the first boot of the phone or at certain time intervals.

At first it can be tested with at least 25 certificate chains and the number can be increased if it works for a long time etc. It can be implemented in the future, as currently Strong testing is not vital.
[Magisk] badabing2003:
Not limited to Apatch / KSU, I was strong with Magisk
[Magisk] Vision:
I think @pndwal means, with Magisk can't pass Strong with our device FP.
[Magisk] miku404:
Anyone else getting this error when trying to check their device integrity can someone explain? Did I mess up my FP.
[Magisk] frasca61:
I am still using PIF-DEV_V2 by Chiteroman with Sailfish, Magisk 27, Shamiko 0.7.5 and LSPOSED 1.9.2 for HMA Obviously I don't pass Strong but works Wallet, RCS and all the banking apps. I'm afraid to try new things, if it is not broken not to fix it.....
[Magisk] tryigitx:
The encryption is a bit complicated due to the nature of Magisk, but you should understand the basic logic.

If random certificate chains are used and Google can't see them directly (like bypassing ddos protection) they can't ban them respectively.

Probably the only downside of this project is that they will have to improve the Magisk (Root) detection method idk.
[Magisk] immortalwon:
Magisk can't use something that's encrypted unless it has on-the-fly decryption for the mentioned certificates, but I believe you mean keybox.
[Magisk] weilunt0219:
I'm a little confused. I have a OnePlus 9 Pro, and I think I'm using the same Key Attestation as everyone else who's posting screenshots. I get the "The device is not supported or the hardware attestation key is lost..." error, and I'm expecting that.

But I'm confused on where the TEE broke. As in, has OnePlus always just had a broken TEE? Or was it unlocking the bootloader that broke it? Seems to be conflicting info out there.
[Magisk] osm0sis:
Yep, always. Thank OnePlus. It just becomes a problem for endusers once unlocked.
[Magisk] BunnyPig1:
I get what you mean, but I don't understand how Google wouldn't be able to catch the keyboxes anyway?

In a utopia where this would work, everything on the internet (for users) would be encrypted, but once the information hits Google's servers they could see the information they need.

If they see abnormal information they could ban it straight away. Or am I missing something?

There must be a decryption key on their side, and in normal conditions this decryption key would be used once in a while from a single user. If this decryption key gets used hundreds, if not thousands of times per day or perhaps hour, they could use that to see what is being exploited, right?

Sorry if I'm way off course on this one but I'd like to understand how this could work.
[Magisk] marcopit-92:
Appdome

This is the software
[Magisk] alfian89:
what this?
[Magisk] pndwal:
You must be missing something...

If you want to try more, try whitelist HMA mode just for Bonvoy...

And find Momo and Riru detector apps and post screenshots... PW
[Magisk] pndwal:
NO... But you can test for kicks...

Also, MagiskDetector is deprecated and superseded by Momo... PW
[Magisk] pndwal:
Please confirm you have latest (10.23.1) Bonvoy version running on TJW Magisk... 👍 PW
[Magisk] marcopit-92:
Everytime I try something I just reboot and clear data and cache for the app to be sure, just to be clear with you that I am trying literally everything.

I also try disabling some app components some days ago but nothing.

Unfortunately nothing works. If you search on the web nobody was able to use MARRIOTT BONVOY with Magisk.

I tried whitelist right now and same. Nothing worked.
[Magisk] marcopit-92:
Confirmed
[Magisk] dimm0k:
I have Bonvoy working fine here
[Magisk] marcopit-92:
Can you share your denylist on magisk and your setup with root apps?
[Magisk] Klappp:
Declined again...
[Magisk] pndwal:
It works for me, digger16309, others and now more confirmation coming... Do you think we're all lying? 😬

🤔... I didn't ask you... I asked @digger16309 because he has Bonvoy working on TJW Magisk and I only have it on Alpha... 🙄 PW
[Magisk] dimm0k:
I have Magisk hidden as my dog's name with Zygisk enabled. also have all the components for Marriott denied on the Deny List

View attachment 6031512
[Magisk] marcopit-92:
Well do you think I am lying also? I posted screenshot of how is my activity and have no reason to.. 😑 I understand you have different setup..

Sorry for the answer on the version then that was confused.
[Magisk] marcopit-92:
So you don't have play store in deny list?
[Magisk] alfian89:
I haven't found a way to get magiskhide to work. because the developer recommends at least A11+, while I'm still using A9. now i am looking for some commands to enable magisk inside terminal emulator/shell
[Magisk] HippoMan:
The Googlefrinchians could have designed Android to require browsers to only be able to run in such sandboxed environments, and banks could have been urged to enable Android banking access solely via these sandboxed browsers. Then, rooted Android devices wouldn't have to be crippled in order to force us to "protect" ourselves.

Of course, nothing like this ever occurred, and therefore, we will have to continue to deal with the ongoing deterioration of Android.
[Magisk] immortalwon:
I am kinda flattered you went to such lengths to "change my mind" as they say on the popular crowder meme. You make excellent points, but not enough to change my mind about Google's absolute control. It almost seems to me that you have some interest in Google or defending them to an extent? But definitely appreciate your response.
[Magisk] LLStarks:
Created and applied my PIF from the latest Android 15 Beta 3 Pixel 8 Pro build.prop processed by PixelFlasher (not sure about smart paste). It was noticeable after DroidGuard clears when integrity and RCS were working or not during my experiments.

Pair that with Apatch, Zygisk Next, and 15.9.9 and it gives me DEVICE and working RCS. Seems to work with 16.0 as well.
[Magisk] swieder711:
Tried PIF 16.0 and failed meets basic integrity and CTS profile match. Went back to PIF 15.9.9 and pass both.

Where can I find PIF 16.2? Only see 16.0 on github.
[Magisk] osm0sis:
You should remove the print from your post. 😶
[Magisk] generalculprit:
It's dead, Jim. <\Bones>
[Magisk] BarackMitzvah:
I'd be curious to see how many modules you can enable in this setup without losing RCS
[Magisk] crypticc:
Hi

Silly question but I have Play protect "send unknown apps to Google" turned off. Also privacy settings for "Usage and Diagnostics". Should we all or is it not affecting PIF methods?

Wondering if the bug G could be uniquely able to just use Play Protect and diagnostics to be hoovering up payload of apk and device config information when Magisk and it's unnamed variants are installed?

Put it another way, if they're not already doing that, then why not?

Chris
[Magisk] generalculprit:
Damn. Just missed to copy it. Can we have that again? 😜
[Magisk] osm0sis:
He told you where to find it. 😛
[Magisk] pershoot:
I now have RCS working. APatch (would not work with Magisk) + PIF Fork v9 (osm0sis) + Zygisk Next; BASIC + DEVICE verdicts on lynx. Have not tested contactless (yet), but presume it should work since I pass a DEVICE verdict.

I'll start adding back modules, shortly.

<edit> Contactless (pay and non pay) + app handoff to wallet, is fine.
[Magisk] Vision:
So, because i'm little confused with v16 on KSU LKM or Apatch, we can add FP of new devices or from our device with hardware and pass what ?

and Google somehow have block the sailfish FP to use it with RCS only for Magisk ?
[Magisk] RAZINARES:
Private fp or sailfish?
[Magisk] joeyhuab:
Tried it on latest Evolution X via prebuilt PIF apk update. It says certified in Play store and I'm now able to send RCS once again. But checking Play integrity verdict via Play store shows a blank.
[Magisk] pershoot:
Sailfish is banned for RCS purposes; will not work. Not entirely private, but due to the sensitivity of this matter, I'll just leave it at that.
[Magisk] joeyhuab:
I removed the husky beta PIF and rebooted. Afterwards, I'm able to send RCS again while using Sailfish print. I don't know if it's due to cache but I guess this is a possible temporary workaround?
[Magisk] pershoot:
Likely cached. Sailfish wont work for RCS (I just re-tested back to back to back within a span of +24 hours).
[Magisk] LLStarks:
Given recent data points, should we just recommend apatch and have pif be generated from the device itself?
[Magisk] pershoot:
Modules added back: lsposed (mod / fork), zygisk assistant (have not added the apps i had when on magisk, yet, as I want to perform some testing to see if its truly needed on those items when on apatch) and pixelxpert (doesnt entirely support the release i'm on but the 2 features I use it for, functions).

RCS is functional; basic + device verdicts passing.
[Magisk] yeswap:
Are you using a private print or sailfish or no print at all?

Edit: Nevermind, I see you already answered this in your reply to RAIZINARES.
[Magisk] geokilla:
Flashed v15.9.9 but still getting only basic integrity. Not sure what I'm doing wrong... Using whatever print the developers of crDroid uses, so probably sailfish? Though some people say it works.
[Magisk] orlando23:
Thanks for hints, make it work ^-^
[Magisk] RAZINARES:
Okay i have tried the husky a15 beta3 fp, rcs works but i am not even passing basic integrity.

KSU(GKI) + PIFORK
[Magisk] pndwal:
With print from your device set (not sailfish or private unbanned print?) 😮🤔 PW
[Magisk] badabing2003:
I might have misunderstood your rather overloaded post, specially with sailfish thrown in there.

No not with my device print, actually didn't get a chance to test that, so can't make claims for or against.
[Magisk] LLStarks:
I didn't share that information for people to blindly use a print. The idea I was conveying was you can perhaps create your own print from your own phone.

I used husky beta because that is my version and my phone. I don't know how much version or build fingerprint matter though.

My phone is basically being honest about itself and Google doesn't seem to mind much.

Also, I wouldn't expect GKI to work as well as LKM.
[Magisk] ThePrinceofBirds:
Can you link me to PIF-Dev_V2? Not sure what that means exactly but I would like to try this setup on my Pixel 7 to get RCS back.

Edit: I ended up finding it and trying this setup. I lost device and RCS didn't work.
[Magisk] RAZINARES:
RCS doesn't work with my device fp.

Lynx A14 June patch
[Magisk] Aman Dewett:
Hi @chiteroman ,

Everything was fine until last evening when I tried to pass STORNG with v16.2. Once I installed, I passed the STRONG but scotialbank app stopped working, I tried by installing it again but still the same.

Then I revert back to v15.9.9 now only DEVICE was pass but still scotiabank app is not working anymore. Can anyone help me with the issue, I really need the app to work.

- added in magisk deny list: YES

- Magisk app hidden: YES

- Added in "Hide My Applist": YES

Here is the screen I am getting from the app:

System log file:

Link: https://1drv.ms/t/s!Ajvr0hJNicops9NCYpRPOPpgAs6f5A?e=VFyEUw
[Magisk] pershoot:
Try clearing cache for it, storage as a last resort. I noticed (some time ago) on one or two of my apps, if it detects or anything is off with init with regards to that, thats it; have had to destroy storage for it to reset it.
[Magisk] Vision:
Yeah, similar with McDonald's, when I try some test, and open say about can't pass, I delete the data but still say the same after enable PIF, even with reboot, and the solution is to pass, before download from Google Play Store, and after download again, all good.
[Magisk] Aman Dewett:
Thank you for the response but I have tried clearing cache, data and even reinstalling the app is not working.
[Magisk] LLStarks:
Apparently an even more minimal version of the husky print I was using can be used on other devices for DEVICE. More research needed to see if that works for RCS. I'll shrink mine down as well. This is using the print pif in Pixel flasher.
[Magisk] joeyhuab:
Message me the print so I can test. I'll also try my own device fp later.
[Magisk] passionicon:
I can test too, message me
[Magisk] Vision:
I have Kitsune Mask, with PIF Fork v9, I can test FP and RCS.

If anyone want to share, I'm here just PM (of course I keep it private).
[Magisk] rrusek:
I second that. Getting my pixel 8 back soon so would like to setup with apatch and do some testing 🙂
[Magisk] LLStarks:
I think you are blocking PM.
[Magisk] Vision:
I don't have, you can send to me 😂🤣
[Magisk] AlexS2412:
Lsposed is the culprit. if you use it, rcs will fail. **** google.
[Magisk] chiteroman:
Released v16.3!

Release v16.3 · chiteroman/PlayIntegrityFix

Google fixed the bug, no more Strong pass with SW keybox 😢 Improve C++ and Java code Downgrade first_api_level to 24, so all devices (should) be able to pass Device Included keybox.xml parsing! Yo...

github.com

Changelog:
[Magisk] Syoenth:
How can I create my own keybox?