yashsingh1/xdaforums huggingface dataset:
[Magisk] mkcs:
There are some issues when I run TB checker to verify the status on Mi Pad 5 Pro 5G. It shows Google Play Services API Error -1: SUCCESS_CACHE

C:\adb>adb shell "logcat | grep 'SNFix'"

11-08 04:13:45.803 7781 7847 I SNFix/Java: Spoof new device props

11-08 04:13:45.808 7781 7847 I SNFix/Java: Spoof new device props

11-08 04:13:45.841 7781 7847 I SNFix/Java: DroidGuard detected

11-08 04:13:45.917 7781 7847 D SNFix/JNI: [ro.zygote] -> zygote64_32

11-08 04:13:46.060 7781 7847 D SNFix/JNI: [ro.secure] -> 1

11-08 04:13:46.060 7781 7847 D SNFix/JNI: [ro.debuggable] -> 0

11-08 04:13:46.060 7781 7847 D SNFix/JNI: [sys.usb.state] -> none

11-08 04:13:46.060 7781 7847 D SNFix/JNI: [ro.build.version.security_patch] -> 2023-09-01

11-08 04:13:46.072 7781 7847 D SNFix/JNI: [ro.product.first_api_level] -> 25

11-08 04:13:46.072 7781 7847 D SNFix/JNI: [ro.boot.verifiedbootstate] -> green

11-08 04:13:46.072 7781 7847 D SNFix/JNI: [ro.boot.vbmeta.digest] -> d7083d89e951524598a17c3ab3dcd8343b06d90b5876335b02d6c473590b1b7b

11-08 04:13:46.100 7781 7847 D SNFix/JNI: [ro.boot.flash.locked] -> 1

11-08 04:13:46.100 7781 7847 D SNFix/JNI: [ro.boot.vbmeta.device_state] -> locked

11-08 04:13:46.102 7781 7847 I SNFix/Java: Spoof new device props

11-08 04:13:46.105 7781 7847 I SNFix/Java: DroidGuard detected
[Magisk] zandatsu06:
Is ZygiskNext is the new Zygisk on KSU module? or they are different?
[Magisk] spida_singh:
Yes just renamed to ZygiskNext
[Magisk] alfian89:
hello dev. how to build a command to implement a fake deny list, the command is like this "magisk --denylist enable". because when I entered that command, some banking applications accepted it and Magisk was not detected. if it is activated, shamiko rejects it. but shamiko is also useful for several other applications so that magisk is not detected. I want shamiko not to be affected by that order
[Magisk] zgfg:
It's a well known fact (see in the Magisk General, Magisk New Zygisk age and other similar threads) that if using Shamiko, DenyList must be disabled

However, you must populate DenyList with the apps you want to hide the root from - then, by disabling DenyList, Magisk/Zygisk itself will not process the list but Shamiko module will do to hide Zygisk from the apps in the list

Hence, you need to fill DenyList. You can do that from the Magisk app but you have also CLI commands (since you mentioned one for enabling the list):

magisk --denylist add <PKG> [PROC]

or

magisk --denylist rm <PKG> [PROC]

or

magisk --denylist ls

Or you can directly edit the /data/adb/magisk.db, DenyList tab by SQL Lite or more easily from MiXPlorer - see the screenshots
[Magisk] aygul12345:
I have installed this module 9.7.2 and there was a popup with something with the module: ''Shamiko" '' if you use banking etc.etc. etc'' Can't get that notification or memo, so I'm searching for that kind of memo before updating it. Could you retrieve the memo what it was?

EDIT: I will make a donation to your nice work. Keep updating this module.
[Magisk] Kristean.tk:
I read that it would never work on samsung, but, somehow it worked, i dont know why or how but is passing 3/5 greens. I noticed that it completley fails after kali nethunter startup, and if i stop kali chroot it keeps failing until reboot, i dont know if someone know how to fix it or how to stop kali from chrooting on boot.

EDIT: I fixed the nethunter problem by setting it to SELinux Enforcing

Spoiler content hidden.
[Magisk] osm0sis:
Anybody else suddenly have Device Integrity start failing recently? CTS Profile still passes, and I swear all was working yesterday with the same setup. Currently on 9.9, latest Magisk canary on my Pixel 8 Pro. 🤔
[Magisk] Unn113:
Yes, but I'm on 9.8 tho
[Magisk] IAMAB:
Same here. Device intergrity is failing. Tried 9.9 as well as latest alpha build
[Magisk] shadowstep:
Same here. I tested using both Play Integrity Fix as well as @chiteroman's new SafetyNet Fix Mod. Maybe it's a temporary issue with the Big G's servers...
[Magisk] rogers11:
Yes, just tried (Pixel 4a, LOS 20, also 9.9)
[Magisk] osm0sis:
And if not that, then maybe they added "original recipe" Zygisk detection? It does coincide with topjohnwu finally merging Native Bridge Zygisk upstream... 😅
[Magisk] Morhoo:
Yes, same experience, CTS passes, MEETS_DEVICE_INTEGRITY fails, and now i'm getting even timeouts on YASNAC checks...
[Magisk] pndwal:
Same on my Xiaomi RN8T w/ @Displax USNF 2.4.0 mod 1.3...

Anyone still passing DEVICEINTEGRITY unlocked? Anyone have a locked device to check? 😜 PW
[Magisk] AzeriVandam:
Hello 🥺 please someone bypass this

Like 20 minutes ago i could not purchase a single coffee from university :( I use galaxy A3 2016 android11
[Magisk] shoey63:
Yup.

3 devices. Looks like Google has finally pulled the trigger on Integrity bypasses.
[Magisk] MightySashiman:
same issue here. Wallet contactless payment working this morning, and now getting the message about my device not being secure enough for contactless payment.
[Magisk] ashish1989:
Thank you brother, will reply shortly with results. I think zygisk needs to be disabled, right?
[Magisk] Vision:
I think no because if you see have a zygisk folder inside to do the job, but give it a try with enable

@osm0sis say if you have original Magisk

Add Play Services DroidGuard process to Magisk DenyList for better results in scripts-only mode

magisk --denylist add com.google.android.gms com.google.android.gms.unstable
[Magisk] zgfg:
If Zygisk is not supported on your old Android, you will see: Magisk app, top, Zygisk shows yes or now

Additionally, if you have Shamiko: Magisk app, Modules, Shamiko and look at its status - it will show error if Zygisk not working
[Magisk] ashish1989:
I think shamiko too doesn't work under android 8
[Magisk] pndwal:
I think it's a simple mistake. (@osm0sis, PING!)

Instead of "since it doesn't support Zygisk and generally doesn't need a PIF module to pass at all", he meant to say "since Zygisk PIF parts (that's to say the core spoofs) are not needed (being to trigger fallback to BASIC-only attestation and to bypass blacklisting of BASIC-only evaluationType by servers) at all"...

Yup.*

Still has DroidGuard, it just doesn't perform hardware key backed attestations (and Google won't enforce the use of hardware backed evaluationType at server end based on print/prop/field identifiers either).

When spoofing device identifiers (ie providing mismatched props etc), targeting Driodguard/attestation GMS process is important to avoid issues with OEM or model specific device functions that poll the same properties etc. eg Galaxy store, OEM backup facilities, high end camera functions, voWiFi etc. The global spoofs are not device ID spoofs however; they're about hiding root, and while targeted spoofing may allow meeting DEVICE_INTEGRITY, PIF, like old MagiskHide (pre Magisk 24) also hides basic traces of modified environment and root, eg by spoofing Verified (green) boot state etc from apps themselves, so global spoofing is really good for these. For 'sensitive props' read 'suspicious traces of root/modification'.

*FWIW, Zygisk now should work with any Android version supporting Magisk AFAIK... Even the (previously pinned, 'wontfix') Samsung issue for older kernels that break Zygisk has been fixed with move to native bridge loaded Zygisk...

👀 PW
[Magisk] Vision:
This Magisk app, top, Zygisk shows yes or no, is for is the Zygisk enabled or not, is not if devices supported zygisk or not, like ramdisk, at least on Kitsune Mask
[Magisk] pndwal:
Yeah... @osm0sis was probably momentarily thinking of that limitation. 🙃 PW
[Magisk] zgfg:
Shamiko requires Zygisk. So, that was my answer above, without Zygisk, Shamiko shows status error

Only its global service.sh and post-fs-data.sh scripts work, but not the Zygisk part - however, it's Zygisk part is for hiding Zygisk, that you don't have
[Magisk] zgfg:
If you enable Zygisk but Zygisk doesn't work, I think Magisk app will still show Zygisk status no - but I don't such a phone, hence cannot guarantee
[Magisk] Vision:
Yeah, had devices with 7.1.1 and i had do lot test for that i say, still has DroidGuard like you say but because older not have hardware, not need to complicated things like custom FP, and that is good
[Magisk] Vision:
Oh yeah this part, yeah you have right and show and in the modules, this module suspended because zygisk is not enabled
[Magisk] pndwal:
If Zygisk isn't loaded (eg. fails or before reboot) after toggled on in settings, 'Zygisk No' will appear on main page. But most (all?) scenarios/kernel versions where there's an issue loading Zygisk are now fixed AFAIK... Old Android shouldn't be a factor any more. 🙂 PW
[Magisk] Vision:
Yeah like i say to you before, extract it and copy&paste

if you want try and this:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] ashish1989:
Will try this too
[Magisk] zgfg:
PS: Regarding the general spoofs provided by sh scripts in Shamiko: whatever they do, corresponding PI Fork scripts will also do (and more) hence if Zygisk not working, no need for Shamiko

sh scripts work generally, they don't filter/target the sppofs only to DroidGuard by use of the Zygisk hook).

That was the way how the old MHPC worked, helping to pass SN in its time, but spoofing the device props may affect some system apps that need to know what device you are really on - hence targetting spoofed prints to DroidGuard only is generally preferred
[Magisk] pndwal:
I think none of the sh script spoofs are targeted however, even Shamiko's. 🙃 PW
[Magisk] Vision:
I think in my old device with 7.1.1 say not work, and i extract manually the files to /data/adb/modules/ and after work im not 100% sure and i don't remember which version, you can try it

View attachment 6084473View attachment 6084474
[Magisk] Vision:
Read the instructions and try the Test1.zip and Test2.zip
[Magisk] zgfg:
sh scripts CANNOT target, they spoof for every app in advance, at the time when Magisk and modules are initialized

Use Terminal and su -c getprop and what is spoofed by sh scriots, getprop will respond as spoofed

Only by use of the Zygisk hook, PIF knows which app requests the print, and it dynamically spoofs the given print only if the requesting app was DroidGuard
[Magisk] ashish1989:
I am confused now, which to do first and what is more benefecial to make my bank apps works. Also, I am not able to download the files from osmosis bro which have uploaded recently. I am sorry if I am upsetting you guys with my novice skills.
[Magisk] Vision:
This Test1 and Test2 zip, is from my old devices with 7.1.1, and the other is for shamiko maybe work with this

and here @osm0sis file
[Magisk] pndwal:
Please try latest official USNF module from @kdrag0n on your device and say if it works... There are several ways to get DEVICE_INTEGRITY on old devices, but that may be simplest. 👍 PW
[Magisk] Vision:
Exactly, have support for Android 7, this i write here:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] zgfg:
so (shared libs/objects) in the zygisk folder (for any module) provide the zygisk patt of that module. And will be found only for the Zygisk modules

If Zygisk not working, those so libs are 'desd', of no use, they can be deleted with no difference

Unlike the shell sh scripts, so libs are precompiled from the native source code (C/C++)
[Magisk] Vision:
Yeah, beside the limations of install when go to flash it in Android 7 or 7.1.1, when do it all manually like the way i write the strange is as remember say the shamiko work in black or white list something like that, but i don't know, if it really worked or if it just said it worked, without actually working

EDIT: Anyone with Android 7 or 7.1.1 can try it all this and tell us
[Magisk] pndwal:
Exactly... So I don't know why you said :

The .sh spoofs in PI Fork aren't done with Zygisk or targeted, but neither are Shamiko's. 🤷 ... But maybe you were pointing out the similarity, not a difference(?) PW
[Magisk] CZ.Kostra:
The thing is that @osm0sis patched module in the latest version CI #202 for Android<8 and @ashish1989 said he couldn't install it. In fact, he didn't even download it. So you spend half a day trying to help him with a problem that never arose.

That's why it's important for people to be specific.
[Magisk] Vision:
I get your point, and thanks you note this.

now i see it 😂🤣
[Magisk] ashish1989:
No brother I tried to download it, but I can't

I also flashed osmosis latest v8, but it didn't even install due to below android 8 restrictions
[Magisk] Vision:
Now with small step, latest v8 is not for Android 7

and here the file download and install and tell us the results
[Magisk] pndwal:
What do you mean you 'tried'? Did you download CI build from actions?... Do you have a GitHub account? PW
[Magisk] CZ.Kostra:
Don't take it the wrong way, I'm just saying that problems should be described in detail. The CI #202 version was sent to you by @Vision as an attachment in post #13603.
[Magisk] ashish1989:
I tried downloading, but I don't know it would need gitgub account. Now I realize, why I can't download. Sorry for this incoveniece
[Magisk] ashish1989:
Should I install it directly through magisk, right?
[Magisk] Vision:
Its ok, i upload the file there, download it and install it and tell us the results
[Magisk] Vision:
Yeah
[Magisk] FritzM:
I am running the latest v8 of PIF on my Pixel 5 running A14 and everything is working great. I noticed that if I run the Google One app and look under the "Backup" section, it shows the spoofed device name. If I click on "Backup" for details, then it shows Pixel 5 as the device being backed up. Is this the expected behavior?
[Magisk] Vision:
You can ignore, you can change it, this happens, because need open this app before install the module, and @osm0sis write about this but i don't remember where

EDIT: i found it here https://xdaforums.com/t/pif-faq.4653307/

View attachment 6084538

Device recognized as Google Pixel 2 XL · Issue #159 · chiteroman/PlayIntegrityFix

As an exchange to Play Integrity Fix, my device is now recognized by Google as Pixel 2 XL. Is this a bug? Is there a way to get back to my old device name. Not a big deal for me but my Google accou...

github.com
[Magisk] forserg:
Tried too hard with not much knowledge, verdict - baseband unknown along with IMEIs :(
[Magisk] Vision:
Thanks you @mrjuniork

From now on i answer to users who ask me only with PIF or relation with PIF problems, here in the page
[Magisk] problemathic:
i have this error. help please
[Magisk] Vision:
More info?

What device ? PIF ? root method ? setup?
[Magisk] problemathic:
sadly. im using custom rom with prebuit pif then decided to flash the latest playfixfork. i have magisk, zygisk enabled but not enforce enabled.
[Magisk] Vision:
Which custom ROM ?
[Magisk] problemathic:
this one. what should i do?
[Magisk] Vision:
If have already inside the prebuilt pif, why you install the PIF fork?
[Magisk] problemathic:
we have this app in our country "Gcash" that is strict in enabling developer option thats why i need lsposed module that hide devopt and safetynetfix.
[Magisk] Vision:
Yeah understand that, the prebuit pif not working in your ROM ?
[Magisk] osm0sis:
Bingo, that error doesn't even exist anymore if he was using the correct zip. My CI #202 is now the simplest, most complete scripts module for passing on older Android. 👍

Huh, I still thought the lower limit for Zygisk itself working was Android 8 since that's what this module and USNF always had. You're telling me it all works correctly on 7 and below now? 😲

If that's the case what should the trigger be for automatically installing scripts-only mode? I'm thinking still the same, but adjusting the message, since LV 8.0 would definitely require normal mode due to keymaster 3. 🤔
[Magisk] problemathic:
its working and pass but sadly the app wont work if its not in enforce denylist which lsposed module wont work if its on denylist. i try to pass safetynet by this module
[Magisk] Vision:
Thanks you.

Yeah i had my device 7.1.1 with zygisk and some modifications if you read all the above 3-4 pages.

Now if some in latest zygisk change and cause problem in older devices, i don't know
[Magisk] Vision:
I think this is cause by the other module and not by PIF, because if you pass 2/3 is all good, if some app detect, the PIF is not the problem

You can try the Kitsune Mask with zygisk and magiskhide
[Magisk] problemathic:
another problem. i tried to remove the playfork module and this settings keep craahing when i click "play integrity fix"
[Magisk] Vision:
Try to disabled all your modules in Magisk reboot and try again
[Magisk] pndwal:
Yup, Zygisk should work with any Android supported by Magisk, especially since this issue was resolved:

[Wontfix] Zygisk cannot activate on some old Samsung devices ... #5395... Shamiko is limited A8+ however.

Manually remove a file?... Suggest not limiting it to <\= A7 since it would be useful for modern devices with broken keymaster that naturally fall back to BASIC-only (OnePlus etc) too. 👍 PW
[Magisk] problemathic:
its working again but i fail in safetynet test. what happen?
[Magisk] Vision:
maybe the spoof options cause the fail? and disabled all modules ? include the PIF fork
[Magisk] osm0sis:
I already have a manual trigger (currently deleting zygisk subdirectory in the module and then reflashing, but I'll change that to check for a scripts-only-mode file in the module directory for the next build), I'm just talking about when to automatically install scripts-only, and < 8 still seems reasonable from everything you've mentioned about keymaster 3 starting in 8.
[Magisk] Vision:
Exactly, a perfect solution for all :cool:
[Magisk] pndwal:
You don't put Xposed modules in denylist... They need root... You can (and should) hide all root/mod related apps from them using HMA LSPosed module. 👀 PW
[Magisk] problemathic:
yes disabling all the module and restarting the system fix it, cleared "play services", "playstore" data and cache fix the safetynet.
[Magisk] pndwal:
If you have both auto and manual means, yes, no Android below A8 is hardware backed attestation capable as Keymaster 3+ is required and 3 only arrived with 8.0, and from 8.0 Keymaster 3+ was mandatory as I confirmed recently, so the API/SDK level could be used reliably for auto disabling Zygisk parts. 👍 PW
[Magisk] V0latyle:
IIRC 7.0 introduced the capability but it wasn't required until 8.0/API 26
[Magisk] Vision:
This meant when say put it the LSPosed module in denylist, i don't had get it

Thank you note this. I appreciate
[Magisk] Vision:
Now works all normal ?
[Magisk] problemathic:
yes all back to normal, BTW is kitsune safe to use?
[Magisk] Vision:
Unfortunately this is the risk of the users who actually install, like others etc. Alpha, and the original Magisk when we meet for first time

But the source code is open if you want to check it for any virus

PS. I have Kitsune Mask latest stable, until now i think all is good
[Magisk] zgfg:
Are those the spoofed prints built-in to your ROM - if so, how do you jnow they are still valid for spoofing
[Magisk] Vision:
I get your point, i think the problem solved, read the 2 posts above yours
[Magisk] pndwal:
Well 7.0 introduced key attestation, but when I say 'hardware backed attestation capable' in this context I mean for S/N + PI API device integrity purposes... (This is PIF after all.) Hardware backed attestation for these Google APIs actually requires more than key attestation for reliable assurances; Google also mandated the use of ID attestation (to allow the device to provide proof of its hardware identifiers, such as serial number or IMEI) which only came with A8.0...

So Keymaster introduced key Attestation in Android 7.0 (Keymaster 2) and ID attestation in Android 8.0 (Keymaster 3) but both are requisite for hardware backed attestation used by S/N or PI device integrity APIs. 👀 PW
[Magisk] Nergal di Cuthah:
Ok wth, I'm still on the post leap day x print, and it's still not banned. Did they switch directions or...
[Magisk] sawdoctor:
Not the last day of the month yet. If it's still working on April fools day we might be ok
[Magisk] Nergal di Cuthah:
Maybe the x print is same as tjw's rooted devices and so we're safe :ROFLMAO:
[Magisk] pndwal:
You also need to understand that DenyList is not designed for hiding root/modifications; it simply reverts and denies Magisk modifications incl. those of modules loaded but doesn't even alter suspicious ('sensitive') props (as old MagiskHide did)... Further, and for the same reason, if bank app is in DenyList and it's enforced, Magisk and LSPosed modules break for that app, ie. your "lsposed module that hide(s) devopt and safetynetfix" cannot work as modifications are denied for that bank app... Other hiding modules, eg HMA, likely break or are of limited use when using DenyList too.

Solution is simple; use a proper hiding module that, like old MagiskHide, allows modifications, including hook based, to work in apps while hiding root/modified environment changes also works properly... Shamiko is the new MagiskHide and works in hidelist mode although hijacking the list from DenyList. Nb. The same Devs responsible for many major Magisk changes also maintain Shamiko. 🤠 PW
[Magisk] osm0sis:
For the new message, how about

"! Installing global scripts only for Android < 8.0; Zygisk device spoofing disabled"

?

I figure if you've manually triggered it then you know what you're doing so I don't need to have a different message for that case.
[Magisk] pndwal:
Loading Installation message? I think that's not bad but I'd add the key function being skipped, ie.

"! Installing global scripts only for Android < 8.0; Zygisk fallback trigger and device spoofing disabled" (The key function for hardware backed attestation capable devices is really the exception based fallback).

Your "- do scripts-only mode automatically on Android < 8.0 since it doesn't support Zygisk and generally doesn't need a PIF module to pass at all" description was only flawed by "since it doesn't support Zygisk"... That should probably read "do scripts-only mode automatically on Android < 8.0 since Zygisk PIF parts (ie. the core fallback to BASIC-only and targeted device spoofs for HARDWARE enforcement bypassing) are not needed at all"... (Had to go back 3 pages to find what I originally said! 😮)

Hope it's helpful. 🙂 PW
[Magisk] osm0sis:
Could be moreso. 😛

Not exactly a brief suggestion!

Read my edit above, and remember this is of course what the installer shows when scripts-only-mode is getting enabled, by either method.
[Magisk] pndwal:
Please say how. PW

Edit: OK, briefer... Hang on...
[Magisk] osm0sis:
Check all the edits please.

I'm thinking

"! Installing global scripts only for Android < 8.0; Zygisk device spoofing disabled"

Vs.

"! Installing global scripts only for Android < 8.0; Zygisk device spoofing unnecessary"

Though the former keeps it more applicable to a manual trigger.
[Magisk] pndwal:
Yeah, loading message no?... I only added 3 words, "fallback trigger and"... 😳

The other was for GitHub comment I originally mentioned... PW
[Magisk] osm0sis:
Not loading, because it only happens the once during an install.

The original message I had was

"! Installing global scripts only for Android < 8.0; no Zygisk device spoofing possible"