yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
Well it probably doesn't really matter with targeted spoofing, but I doubt Google would do this because they want to allow exemptions for devices with broken Keymaster implementations like so many OnePlus, their own Pixel 2 it seems, and countless others, to pass at least deviceIntegrity with locked bootloader.

These will simply default to basic-only attestation on device, but the moment Google uses shipping level lower than 32 to enforce hardware-backed verdicts at the server end, devices they've purposely exempted (by exclusion from model and fingerprint prop lists for enforcement) will pass only basicIntegrity if stock/locked...

That's a move that will anger many bank customers... OnePlus, for instance, have apparently only fixed their keymaster setups in very recent devices.

I think they decided on across the board enforcement from A13+ (33+) for good reason...

👀 PW
[Magisk] Catfriend1:
I'm currently using Displax 2.0 mod (recent release) + shamiko + deny list. What do i need to change to use this module? I'm on Xiaomi mi8, Android 13, PixelExperience ROM.

Edit: just replaced the displax mod with the play integrity fix v7 ... I'm passing the first two checks , not passing strong_integrity. Is this expected result?
[Magisk] Homeboy76:
Yes
[Magisk] Bladius:
V7 work perfectly for me
[Magisk] zgfg:
Go to Modules tab in Magisk app and check if particular module shows active Update button

If so, click on, update and reboot

That's for any module, not just this one
[Magisk] mmbaknnba:
Sorry if I missed the details, but which Magisk version you used? I would like to suggest to use Magisk Alpha if you don't care about it's being closed source.
[Magisk] Gersp52366:
Hello, on my Oneplus 9 the module is unstable, play integrity fix, I have Google pay periodically falling off

But I have a goal, I really don’t know how to implement it

In general, to the point, is it possible to somehow force the Google services framework to go offline to avoid re-certification?
[Magisk] osm0sis:
I have always reported to you how it works on my Pixel 8 Pro... You should leave it separate for now, in case you change your mind again, to maintain more stable development here. 😛

I'm going to PR some improvements to custom pif.json support, and tidy up the scripts tonight. 🙌
[Magisk] ralf_waldo:
@chiteroman I think there is forced CTS profile (lg nexus 5) being installed in my non LG nexus phone after flashing the latest module fro magisk. This is causing the google call screening feature to not work anymore. Is there any fix for this issue. please help as we dont want to miss the call screening feature.
[Magisk] Juleast:
Wdym lol. It's not that it's not passing, the app has reached its API call limit for play integrity API.

Try TB checker on play store. It has ads but it works well in my case. I pair my phone up with Adgaurd so I don't see ads. TB checker also has other tools like xposed checker, etc.
[Magisk] Nergal di Cuthah:
Actually there's a play integrity test in playstore's settings, it isn't limited like checker you use is. The error you see means too many people are checking with that app globally.

Turn on developer mode in playstore (not android settings, playstore) and run its checker.
[Magisk] badabing2003:
Million dollar question, is there any value in attempting to mine prints in hopes of landing on one that supports strong integrity?

Or has that ship permanently sailed?

What was the trick used and soon after blocked by Google to fool the strong integrity check? (I didn't pay much attention at the time and at this point it would be easier to get to the moon than find a post in this thread ;) )

I vaguely recall something along the lines that Google had whitelisted some devices (Pixel 2 XL??) to cover up of them messing up their own bad hardware attestation?

Is there any chance other such whitelisted devices might be discovered?

Would it be device specific or firmware version + device specific?
[Magisk] HippoMan:
All integrity checkers that are PlayStore apps will eventually reach API call limits. However it's been described here in this thread how to get non-expiring integrity checking via PlayStore Developer options. You can get details via a search of this thread.
[Magisk] dnfm:
As of today gpay is failing again for me. I'm running 13.8 and pass all checks except strong integrity.

Don't know if that means they've caught on again and we need another fix or if my phone is specifically stupid, but I thought I'd mention it in case it's the former.
[Magisk] Vision:
View attachment 6037848View attachment 6037849

View attachment 6037850

View attachment 6037851
[Magisk] badabing2003:
I gather people have found such prints, so the hunt is not futile.

Thanks
[Magisk] Vision:
Yeah true
[Magisk] niko26:
Same here. v13.7 works on my P7Pro A14.

Correction, v13.8 that is!
[Magisk] wfred:
To get to the built-in integrity checker

Play Settings-->About-->Play Store Version

tap on the version number until it says you're a developer then

Play Settings-->General-->Developer Options-->Check Integrity
[Magisk] Vision:
@chiteroman someone looking for you

View attachment 6037920
[Magisk] arda99:
Per my understanding its impossible at least with current public released PIF, as PIF tricks the phone to do BASIC test, no hardware verdict so no strong integrity.

I'm also wondering how the broken TEE thing plays out. People talk about broken TEE on OnePlus phones but I can't find one usable A9+ fingerprints from OnePlus 7/8/9 models, these always fails on device_integrity.

That said, I've seen screenshot with Strong passed so it's still a mystery to me.
[Magisk] Vision:
Post in thread '🔧 [MODULE] Play Integrity Fix (SafetyNet fix)' https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89187372
[Magisk] wangdaning:
Playstore still passes me on basic, but I have no clue if cards would work. This is using USNF on P8P, been too lazy to switch.
[Magisk] fifi49:
Hi what Magisk have u installed? and what modules that you meet strong intigriy. Did with that all Baninkg apps working?
[Magisk] Dj Telo:
Hi everyone. Just updated to PIF 13.8 after wallet payments stopped working for me today. However I've not been able to make payments work again. I've been scrolling for a while and I cannot figure out if there's a solution to this yet. Clared data in wallet and cache in play store. No hope so far.

Any indications will be appreciated. Thanks in advance and have a good day!
[Magisk] zgfg:
Long and old story about the Rog 3 revoked certificate
[Magisk] BillGoss:
You need to clear storage for Google Play Services and reboot your phone.
[Magisk] pndwal:
Nah, it's pretty much futile now I'm afraid... 😬

The point is that we cannot spoof STRONG_INTEGRITY which requires HARDWARE_BACKED evaluationType, but some devices do supply false signed attestations from AVB/hardware keystore per OEM implementation...

Google's (arguably deceitful) totally FAKE STRONG_INTEGRITY to cover up bad Keymaster implementation or chain of trust data in keys for early batch Pixel 2 (Walleye) has been fixed and, as I've said, if they did this for other Google devices, they will have been sufficiently embarrassed to have taken pains to revert any other such server end verdict fudging...

... also this:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89168792

annd original WOT here:

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88837329

This doesn't mean that some devices can't pass STRONG_INTEGRITY w/o AVB Verified boot state... The Samsung device and posts referenced above by @Vision is one such example, but what's being missed here is that such a verdict requires that the device itself is transmitting bad chain of trust/keypair data and is still signing keys as valid... As @chiteroman also said:

So yes, you can pass STRONG_INTEGRITY on such a device as first became apparent her with Asus ROG Phone 3... And users may be wise to keep those device models secret if they wish to have STRONG_INTEGRITY long term (Google will revoke keys when implementations giving erroneous AVB Verified boot state AVB are discovered), but you cannot use this for STRONG_INTEGRITY in devices with healthy Keymaster and keypair data...

Nb. This is more than just the common OEM incompetence of OnePlus notoriety where Keymaster implementation is bad but AVB/keypair data is correct... These just naturally fall back to BASIC-only attestation due to errors (exceptions thrown) and can therefore pass DEVICE_INTEGRITY (provided Google is careful not to enforce HARDWARE-BACKED evaluationType verdicts for these device, which concession is exactly what we exploit with USNF/PIF) , but will simply never pass STRONG_INTEGRITY...

Nb.2. Bad OEM Keymaster etc in newer devices can now be repaired on the fly using Remote Key Provisioning for Upgrading Android Attestation... Also, OEMs/ODMs are no longer provisioning attestation private keys directly to devices in the factory, so no longer need manage 'secrets' for attestation in shop... Google servers now issue keys/certificates... See:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89184994

This means there may be no need for Google to revoke keys in these instances going forward...

👀 PW
[Magisk] badabing2003:
Thank you for excellent (as you always do) explanation and details.

I'm not going to waste time then hunting for the unicorn :)
[Magisk] osm0sis:
@chiteroman, by the way if you want your old commit history back (in a separate branch; merging it without things getting ugly is a bit more complicated)...

git remote add old https://github.com/doom-man/PlayIntegrityFix
git fetch old
git checkout -b old old/main
git push -u origin
git remote rm old
[Magisk] pndwal:
But I only did it for your offer of cash:

And as I essentially answered five more:

I guess I can claim $6m, but I'll settle for a Cool Million... Can I DM you bank details?

... How about a pot-o-gold?... 😜 Steve Austin...
[Magisk] badabing2003:
Certainly DM me your bank details, along a processing fee of mere $1999, and the 1 million will be wired :)
[Magisk] westruk:
@chiteroman

bro, please don't use "safetynet" in naming of u modules

It confuses the users
[Magisk] pndwal:
🤔 It's a Universal SafetyNet Fix fork. but already renamed Play Integrity Fix!... So what are you referring to?... PW
[Magisk] westruk:
I'm about this https://github.com/chiteroman/safetynet-fix
[Magisk] osm0sis:
That's an archived (i.e. not active) fork of a different project (i.e. not this module)... Please read more carefully before making accusations/demands.
[Magisk] westruk:
Are you sure it's inactive?

View attachment 6037965
[Magisk] xcl1pse:
It's minimal version of PIF. Maybe the reason of archived is to prevent any fork or the source can be seen by others? BTW is up to date with new fp tho...
[Magisk] osm0sis:
Hard to say... he murdered the commit history on it again so it's just a file dump. He also deleted the license, which isn't allowed. Bad development. 😠

Edit: Eee... global first api prop... ****ing yikes! Must have forgotten/missed it. https://github.com/chiteroman/safetynet-fix/blob/main/module/service.sh#L47

Edit 2: Anyway, hopefully he leaves USNF alone again, it is indeed confusing that he's spending time on it.

pif.json is clearly the way forward in general. :)

Update .gitignore: hide included pif.json from git tree by osm0sis · Pull Request #100 · chiteroman/PlayIntegrityFix

Let's not directly publish the pif.json we're using for easy viewing.

github.com

Module scripts fixes/improvements (custom) by osm0sis · Pull Request #102 · chiteroman/PlayIntegrityFix

add back check_resetprop but rename functions to make their use more clear (thanks HuskyDG) combine system.prop (runs at post-fs-data) entries into service.sh so that they're only set if needed (no...

github.com

But the real thing I want to get to, which is cleanly preserving custom pif.prop through a module update, I plan to work on tomorrow once these basic things get merged. 👍

I've also kinda mentally been writing a how-to for finding/creating a custom pif.json, which I'll plan to get into a post later this week.
[Magisk] xcl1pse:
He made this maybe because displax is inactive to merge new fixes and then google banned the fp. Also updating one module twice a week and testing new stuff is a pain then He released this. But yeah, no commit history...
[Magisk] pndwal:
Oh... But that's a fork of Displax USNF 2.4.0 mod 2.0, updated but now archived... Mod 2.0 was only working properly with Google fake STRONG_INTEGRITY for Pixel 2 spoofing until Google fixed that 'bug' (being generous here), after which it failed for A13+ LV devices but still spoofed DEVICE_INTEGRITY for devices launched with A12 or less for a while, eventually failing for all devices...

@chiteroman resurrected it and fixed shipping level spoofing along with other issues recently per:

and

because @Displax is AWOL as far as USNF is concerned... Evidently @chiteroman updated it again yesterday to keep it working, but killed commit history as is his habit...

If he'd changed the name of the module to PIF etc, it'd be more confusing...

Also, many people have private forks in their repos for testing etc... They may be publicly available, but they're often none of our business... In this case @chiteroman did post about it's availability...

FWIW, safetynet-fix_v3.0.0 is really a fork of a fork... Ie. @kdrag0n's safetynet-fix-v2.4.0 --> @Displax's safetynet-fix-v2.4.0-MOD_2.0 fork --> safetynet-fix_v3.0.0 forked fork... (really safetynet-fix-v2.4.0-MOD_2.0_v3.0.0?)

... Maybe I'll fork it again for kicks... 😜 PW

Edit: I see others recall this now too...

Edit 2: ...Now it's completely redone and won't be for everyone:
[Magisk] twister26:
Wallet app works, root is not detected. I cannot add a new card to it though, as I don't get the verification SMS message. Does anyone have a similar issue?
[Magisk] michasssxdd:
View attachment 6038002Hello. What kind of error is this? And how to fix it? 2 days ago Google pay worked normally
[Magisk] zgfg:
It's been answered several times.

How/why and which alternative ways to test

Please take time to scroll back
[Magisk] voetbalremco:
You"ll need to give SMS permission to Google Play Service
[Magisk] chiteroman:
Because it's not the same source code, I did it from scratch.

This is just for my devices (vayu, daisy) because it doesn't need PIF. That's why I archive it, it's not for everyone. In another devices may work.
[Magisk] _phk_:
I'm on kernelsu with latest zygisk-next v4-0.8.1 and playintegrity fix v13.8

Still MEETS_DEVICE_INTEGRITY fails. Any idea?

Already deleted data of google wallet and google play services.
[Magisk] Dehumanizer77:
I still had 13.0 installed, now I have found it's failing so I've installed 13.8 and after reboot it meets device integrity again
[Magisk] badabing2003:
Shouldn't your proposed changes of adding it to .gitignore be sufficient?

Or is it a case of Magisk wiping the module directory on each update and it somehow needs to be preserved programmatically?
[Magisk] FIERA03:
The latest release of ZigiskNext may not work in rare cases, so please use this one.

https://github.com/5ec1cff/ZygiskNext/suites/18510582343/artifacts/1074169138
[Magisk] chiteroman:
Updated unstable build !!!

Release CUSTOM SPOOF · chiteroman/PlayIntegrityFix

DO NOT USE THIS BUILD IF YOU AREN'T A DEVELOPER, ALWAYS USE LATEST STABLE. THIS BUILD IS JUST FOR TESTING PURPOSES. Removed custom resetprop. Fix JSON parsing. Less libs size. Few code improvements.

github.com

Changelog:

Fix JSON parsing.

Less libs size.

Few code improvements.
[Magisk] _phk_:
Sorry but link is not working. Which ZygiskNext version should I use?

EDIT: OK from my pc I was able to download it.

EDIT2: Working now again

@FIERA03 thank you very much
[Magisk] pndwal:
Oh...

Marvelous devices... 😛 PW
[Magisk] chiteroman:
Updated source code for stable releases.

GitHub - chiteroman/PlayIntegrityFix: Fix Play Integrity (and SafetyNet) verdicts.

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com
[Magisk] Fishawy:
Interestingly, after all the issues we had with the latest stable releases, this one works just fine on P7P. SafetyNet, wallet, banks, everything.

Good to have a backup option that also works (for now).
[Magisk] Vision:
Finally, thanks for a complete answer and details. I had little confused because of this

View attachment 6038073
[Magisk] Dj Telo:
Thank you so much. This worked.

This is cumbersome though because it removes all pairings with my Pixel Watch 2 and I basically have to reset the watch to pair again (the transfer function does not work for me for some reason).

Therefore, is there any way to prevent these automatic updates from screwing Wallet? I don't mind being in an outdated version of whatever as long as it works. Coming from Android 12, I spent 2 years without updating my phone and all worked well.
[Magisk] Virnik0:
happened to me too. Do time-shift trick or wait a day.
[Magisk] ManovSteele:
After my device failed to verify yesterday I updated to 13.8 and it works like a charm so far!

Amazing work chiteroman, really appreciate what you do.
[Magisk] franco985:
Hi @chiteroman I remember that after cleaning data and chace of gms there was a fix via adb to restore id app registration. Instructions were on the first page of thread, could you gently repost them?
[Magisk] HRSE:
How about Singpass?
[Magisk] xcl1pse:
Just need something to hide the manager like HMA
[Magisk] HRSE:
how about KernelSU?

many of us are looking for working solution for Singpass, please share the details here {Mod edit: Link removed. Oswald Boelcke, Senior Moderator}
[Magisk] rodken:
Keeping said device models secret can be a prudent strategy because Google may revoke keys for devices where erroneous AVB Verified boot states are detected.

However, it's important to note, as you already know, that relying solely on secrecy may not be a foolproof solution in the long run. As security researchers and device manufacturers continue to uncover vulnerabilities, maintaining STRONG_INTEGRITY may require more than just secrecy.

I suppose that to effectively maintain STRONG_INTEGRITY, it would take a more comprehensive approach:

-- Device integrity checks

-- Secure key management

-- Vulnerability patching

-- User education

-- Transparency

Maybe, by adopting a multi-layered approach to device integrity, users and device manufacturers can work together to safeguard devices and maintain STRONG_INTEGRITY.

I would agree that Remote Key Provisioning (RKP) is a new method for upgrading Android Attestation that can be used to repair bad OEM Keymaster on newer devices which allows said device to continue to generate secure attestations even if the OEM Keymaster is corrupted.

As far as I know, Google is currently rolling out or has already rolled out RKP to newer devices and to be availale to all compatible devices completed by the end of 2023.

Pixel 7 and Pixel 7 Pro and beyond

Samsung Galaxy S23 and Galaxy S23 Ultra and beyond

OnePlus 11 Pro and beyond
[Magisk] xcl1pse:
Same since KernelSU will never implement randomization package name like magisk (depends on weishu tho). Just need properly configured or uninstall the manager, the module will still working...

Edit: Currently try Citibank and HSBC, seems work for me too
[Magisk] Dehumanizer77:
How exactly is the time-shift supposed to work? I have followed one method that was mentioned here but it didn't help last time I was trying.
[Magisk] HRSE:
I've just tried HMA again but still couldn't pass Singpass (T0).

Would you mind coming over to HWZ to continue the discussion? This thread is already too busy and we're kind of off-topic here.
[Magisk] xcl1pse:
Ok

Edit: but I can't reply because it says You have insufficient privileges to reply here
[Magisk] cosy6ay:
had install 13.8 beta and roll back to 13.7 now unable to pass device integrity.
[Magisk] shoey63:
Nice build 👍

Passes Basic and Device Integrity with default PIF.JSON AND custom PIF.JSON on all my devices

- ROG 3 ✅

- PIXEL 6 ✅

- PIXEL Tablet ✅

😎
[Magisk] HRSE:
I just realize KSU Overlay Unmount by HuskyDG is no longer available.

Does anyone know what happened? Is it because the module is no longer relevant?
[Magisk] Oswald Boelcke:
Hello and good afternoon, @HRSE

I've removed the link from your quoted post. Please review the XDA Forum Rules, an excerpt is below:

Thanks for your cooperation.

Regards

Oswald Boelcke

Senior Moderator
[Magisk] immortalwon:
Can anyone confirm hit and miss play integrity passing for version 13.8? As of this moment, mixed results one a11
[Magisk] osm0sis:
Ah, then you should delete it from GitHub, and *not* hit the fork button on GitHub from Displax's to recreate it and reupload it, because currently GitHub thinks it's a fork though it has no related history.

Bingo.

Also 🤣

Module scripts fixes/improvements · osm0sis/PlayIntegrityFork@1a9eb9d

- add back check_resetprop but rename functions to make their use more clear (thanks HuskyDG) - combine system.prop (runs at post-fs-data) entries into service.sh so that they're only set if ne...

github.com
[Magisk] Virnik0:
Usually you enable plane mode, kill Wallet, wipe its cache, kill Google and wipe its cache, kill play store and wipe its cache, and then set the date manually a day or two back. Reboot, and start wallet (airplane still on). It will complain again. then enable time sync again and reboot. after second reboot, disable airplane and give the phone few minutes. Wallet then have mixed behaviour: It will say that you don't meet security standards, but at the same time, it will fail just first payment, another will go ok and the 'finish payment setup' will go away with next hour or so.
[Magisk] zgfg:
@chiteroman

please double-check for this V2.1, in the logcat I see only 7 spoofs:

11-29 14:28:17.677 11144 11144 D PIF/Java: [PRODUCT]: lisa -> taimen
11-29 14:28:17.677 11144 11144 D PIF/Java: [DEVICE]: lisa -> taimen
11-29 14:28:17.677 11144 11144 D PIFJava: [MANUFACTURER]: Xiaomi -> Google
11-29 14:28:17.678 11144 11144 D PIF/Java: [BRAND]: Xiaomi -> google
11-29 14:28:17.678 11144 11144 D PIF/Java: [MODEL]: 2109119DG -> Pixel 2 XL
11-29 14:28:17.678 11144 11144 D PIF/Java: [FINGERPRINT]: Xiaomi/lisa/lisa:13/RKQ1.211001.001/V14.0.12.0.TKOCNXM:user/release-keys -> google/taimen/taimen:8.1.0/OPM4.171019.021.R1/4833808:user/release-keys
11-29 14:28:17.678 11144 11144 D PIF/Java: [SECURITY_PATCH]: 2023-08-01 -> 2018-07-05

So it seems that FIRST_API_LEVEL from JSON is ignored - why?

{
"PRODUCT": "taimen",
"DEVICE": "taimen",
"MANUFACTURER": "Google",
"BRAND": "google",
"MODEL": "Pixel 2 XL",
"FINGERPRINT": "google/taimen/taimen:8.1.0/OPM4.171019.021.R1/4833808:user/release-keys",
"SECURITY_PATCH": "2018-07-05",
"FIRST_API_LEVEL": "25"
}

Full log is attached
[Magisk] Dehumanizer77:
Wait, you have to set the date back? I thought you have to set it forward to the future.
[Magisk] osm0sis:
Hey @zgfg, maybe edit the currently used fingerprint and date out of your post (as I have)?!

Also, it still works fine, you're looking at the wrong part of the log:

:/ $ su
:/ # logcat | grep PIF
11-29 10:13:16.368 9236 9329 D PIF/Java: DroidGuard detected!
11-29 10:13:16.374 9236 9329 D PIF/Native: [ro.build.version.security_patch] -> [redacted]
11-29 10:13:16.380 9236 9329 D PIF/Native: [ro.product.first_api_level] -> 25
11-29 10:13:16.528 9236 9329 D PIF/Java: DroidGuard detected!
11-29 10:13:16.834 9236 9329 D PIF/Native: [ro.vendor.api_level] -> 25