yashsingh1/xdaforums huggingface dataset:
[Magisk] zgfg:
If you mean locator used by Magisk app - it can be switched to use any other file manager installed to the system. And we've seen reported issues when using the preinstalled File managers, users were able to locate the downloaded zip installation for a module and select the file - but Magisk app was not signalized to be the zip file (instead, file manager wanted to open the zip archive to continue 'searching' inside)

Anyway, one of the first things I do is (systemlessly) debloating the preinstalled apps like Files. On the other side, 'power' users like my wife open the Gallery and scroll endless through the icons to 'find' a picture. Then she deletes and later asks me why she still sees her 'deleted' pictures (she actually deleted only the WA copy of the picture or so) and why her G-Drive is constantly full (due to automatic uploads of pictures and movies she didn't delete from her phone)

Btw, it's IMO opposite to the rooting mindset and ideology - I can hardly imagine an su[peruser] with (My) Documents, (My) Pictures and so - but I'm probably too old to understand the changes, maybe I should finally learn the vi editor and stick with😬
[Magisk] manjaroid:
I debloated it once, back when it was new and less useful than now. That was before I knew the difference between freeze and delete. Since then I've gained more respect for Files and leave it be.
[Magisk] PastEchos:
I stepped back a bit when sailfish broke, but when I saw PixelFlasher could get PIFs without the need for another device I decided to take a whack at it with the beta. I uninstalled the current version, restarted, updated the pif.json in v16.5.zip, and installed the new version. It now meets device integrity, passes basic, and CTS, but my RCS is still not working. I also thought maybe chiteroman's version didn't support a custom fp, so I tried osm0sis's version with a custom fp and still could not get RCS to work. Is the latest beta now broken?
[Magisk] majorfigjam:
Not broken for me.

You're probably breaking things by editing / updating in the zips. You only need to replace the json file with a file manager, if 16.6 doesn't work for you.

Osm0sis version works with beta json, but you need to delete all remnants of Chiteroman's pif.json files, and remember to rename the beta json as custom.pif.json and put it in /data/adb/modules/playintegrityfix
[Magisk] PastEchos:
Thanks. I fiddled around some more and uninstalled the Messages update, setup RCS, and it activated! I reinstalled the update and it seems to be working now. Never had to do that before, but it's working now on chiteroman's version with the beta json I replaced it with. Hopefully this helps someone else.
[Magisk] badabing2003:
Are you saying that you pass device with latest beta but RCS is broken?
[Magisk] PastEchos:
Yea, but I got it to work after turning off RCS, deleting the messages update, activating RCS, and reinstalling the update.

Also, thank you, your contributors and everyone else for their hard work, Pixel Flasher made the process very easy.
[Magisk] flyoffacliff:
So has anyone tested all the other a15 beta 3 and 3.1 prints besides the one used in PIF 16.6? Just to be prepared for whenever this one breaks.
[Magisk] Captain_Throwback:
Yes.

(Will not say more)
[Magisk] flyoffacliff:
Just came across this older post. It makes sense if you think about it. What if the Pixel 8 key box got leaked? Google can't fix it without a hardware change AFAIK, and they can't simply disable RCS for every pixel 8 device out there.

So if we use one of those key boxes that was revoked weeks ago, and we matched the fingerprint of the actual device that the key box belongs to, and spoof a locked bootloader state, then we not only regain RCS but also likely passed strong. And no need to mess with fingerprint changes again.

I've never actually messed with key boxes, just came up with the idea.
[Magisk] bluerar:
So I updated from android 10 to 12, At first I was getting BASIC-INTEGRITY Pass, After rooting it, I get all 3 to fail, now i'll try PIF 16.5 and 16.6 wish me luck!!

yippeeee!!!! 16.6 did work! Thanks for everyone's help
[Magisk] pndwal:
Actually they can, even for P6 keys. 🙃

RCS may depend on certain device fingerprints, but apparently doesn't even require DEVICE_INTEGRITY yet, let alone STRONG! 😜

... So this will become a non-issue for Google sooner than you think because, while you sum up the problem for Google and OEMs nicely, it's been fixed for some time already...

The issue still exists for Pixel 5 series launched with A11 and other devices launched with A12 or earlier...

A major milestone in A12 (Pixel 6) was 'Remote Key Provisioning' which means OEMs/ODMs no longer handle 'secrets' (eg attestation private keys/"hardware attestation root certificates") on their factory floors... Google will handle key provisioning and these keys can be both revoked and re-provisioned (repaired on-the-fly) remotely. RKP became mandatory for devices launched with A13.

Please see this post re. implications for leaked keyboxes/OEM (private) A8+ (hardware) keys:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89579911

and older post with links to the detail if interested:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89184994

... More here w/ ref to XDA article:

https://xdaforums.com/t/info-play-integrity-api-replacement-for-safetynet.4479337/post-87648183

👀 PW
[Magisk] taka2902:
Anywhere i can find a working keybox.xml? Sorry if im ignorant because i cant find any tutorials on google. I wanted to spoof bootloader, tysm!
[Magisk] Vision:
If you want only just spoof BL as locked, the default sw keybox.xml, do the job.
[Magisk] pershoot:
If this was a burning question on anyone's mind... I have successfully RCS'd with a new iPhone user.
[Magisk] Aarif goku:
You'll get 2 pass 👍

Edit my pages didn't load XD.

Congratulations on Device integrity.
[Magisk] pndwal:
👍... But I guess you mean with a Beta tester...

I see iOS 18 Beta 2 was released on June 24 for testers 'registered as developers' with limited carrier support for RCS (cross-platform support)... Beta 3 arrived on July 8 with more RCS carriers and better stability...

iOS 18 official updates for mainstream use are still predicted to roll out in mid-September, likely coinciding with the launch of the iPhone 16 line and Apple Watch 10... 🤠 PW
[Magisk] pershoot:
Not sure of the build, but it was a brand new iPhone.
[Magisk] pndwal:
Still, that would ship now with iOS 17 and no RCS support... Guess user is on the Beta program testing 18. 🙃 PW
[Magisk] pershoot:
uncertain of the model (thought I was told 14, but perhaps mistaken) so edited comment and omitted it.
[Magisk] pndwal:
I mean no iPhones are shipping with iOS 18/RCS yet. 😉 PW
[Magisk] taka2902:
Um can you tell me what is default sw keybox? I cant find anything on google using that keyword.
[Magisk] Vision:
If you download PIF v16.3, inside have a keybox.xml, just extract it.

EDIT: Also you can try and this:

GitHub - aviraxp/Zygisk-KeystoreInjection: Generate a valid certificate chain from scratch by injecting custom Keystore provider

Generate a valid certificate chain from scratch by injecting custom Keystore provider - aviraxp/Zygisk-KeystoreInjection

github.com
[Magisk] V0latyle:
Glad you were able to get it working,. It most likely will stop working eventually because every time we find a "working" build fingerprint to spoof, Google eventually breaks it. Just keep up to date on this thread.
[Magisk] taka2902:
Ohh it works, tysm!

But theres a warning though, is it normal?
[Magisk] Vision:
You mean a warning in AOSP ?

If yes, is normal.
[Magisk] taka2902:
For some reason, the app still detect bootloader unlocked. I use the bootloader spoofer xposed app and it works fine so im sure its local attestation, not server attestation.

Can app detect its aosp key?
[Magisk] Vision:
Oh I don't know about that, if it is only local.

The AOSP key is normal (I think) provide by Google.
[Magisk] mac796:
I thought the whole idea was to leave that beta out of the community pif. I was told to go find my own I went through over 200 before I found that beta and a couple more. Won't this make it banned real quick like? Or does it even matter anymore
[Magisk] 306bobby:
The theory (I believe) is that the beta prints will last longer due to developers needing integrity without strong

Why we made it public, no idea. Thankfully it's not the only private print I have
[Magisk] osm0sis:
The beta prints last roughly 6 weeks before they expire, from what we've seen so far.

😶‍🌫️
[Magisk] Vision:
I did not know that.

Thanks for info.

Very useful.
[Magisk] osm0sis:
The more you know! 🌈🌟😄

😶‍🌫️
[Magisk] Vision:
Yeah.

The only true power, is the knowledge 🤓
[Magisk] Joshsha:
I'm a noob to all of this, I have 16.5 of the magisk module, basic and device integrity are passing but not strong (of course), Google Wallet works, my device is Play Certified, but RCS just will not work at all. It shows as connected but I can't send or recieve RCS messages.
[Magisk] Zaxx32:
Can't recall...is unrooting enuff to get RCS back or to I also have to relock the bootloader? Hate to have it locked even without root cuz if something goes wrong it limits possible remedies. Tia...
[Magisk] majorfigjam:
16.5 has a Sailfish print, banned for RCS. Switch to 16.6, or find a 15beta print to use to replace your pif json.
[Magisk] Nergal di Cuthah:
New canary magisk, private print and @osm0sis latest. Pass device, don't know rcs cause i don't use it
[Magisk] pershoot:
Disable PIF, disable LSPosed (if you use it), ensure you pass BASIC integrity with your stock device's print and you should be ok with RCS. Wallet / contactless will not work in that configuration.
[Magisk] taka2902:
Hi everyone, do you know anyway to spoof locked bootloader? The app detects lsposed hook so i cant use xposed module, i tried the keystoreinjection with sw keybox and still failed.

The app use local attestation because it can detect without internet connection.
[Magisk] pndwal:
Locally validated keys can be spoofed which is why vv/Rikka Key Attestation demo app detection can be bypassed eg with Bootloader Spoofer Xposed module, so that could still work for you... If your app properly validates keys on a separate server your options would be more limited...

Was parasitic manager and hiding all Xposed modules (including HMA) + (already) hidden Magisk App from your app in HMA not enough to bypass LSPosed/Magisk detection? 🤔 PW
[Magisk] Vision:
About Zygisk-KeystoreInjection module, if is only for local attestation.

View attachment 6123175
[Magisk] osm0sis:
It's also currently directly limited to only work on the vvb key attestation demo app: https://github.com/aviraxp/Zygisk-KeystoreInjection/blob/main/app/src/main/cpp/main.cpp#L58-L59

😶‍🌫️
[Magisk] Vision:
Oh for that.

I hadn't noticed.

Thanks for the check.
[Magisk] Codename_Falcon:
Can you please also send me the telegram group? I am also looking for the latest fingerprint download.
[Magisk] Aarif goku:
Wait can that be implemented for TEE broken devices? Then reprogramming TEE won't be necessary as framework patch doesn't work for broken TEE.
[Magisk] bombadier:
You can get it here, it's in actions also just search for PlayIntegrityFix in telegram
[Magisk] Zaxx32:
Gotcha...losing wallet ttp is a deal breaker for me. I'll prolly hold out til A15 launches and then lock it up...chances of a workaround lookin' pretty slim for a casual rooter like me. :rolleyes:
[Magisk] cabagekiller:
I'm using pif 16.6 with apatch and RCS and Google wallet are both working fine.
[Magisk] osm0sis:
I think chit mentioned that during 16.3 as not possible through the Zygisk module, though could be built into FrameworkPatch (and has comments in the code to that effect).

😶‍🌫️
[Magisk] Vision:
Yeah you're right.

View attachment 6123260

View attachment 6123256View attachment 6123257
[Magisk] Aarif goku:
I tried framework patch as I don't know much samli or Java by following step by step through chatgpt but failed and also gave my framework.jar to someone who didn't have broken TEE but fixed was able to get himself strong integrity by the steps his modified framework boots up but didn't fix the issue it still remained broken. Also the framework patcher go 1.0.1 also didn't work and crashed Google apps etc last 2nd latest caused bootloop and latest doesn't work but no Google crash. Hope there could be an dumbed down version of framework patch method but I guess it rightfully is in comprehension of developers rather than layman.

Hope to one day see getting rid of 10003 error.
[Magisk] 306bobby:
Hey guys, so I just realized I messed up my private keys on my last ROM build.. it took me this long to realize because of this...

View attachment 6123345

View attachment 6123346

Any ideas 🤣
[Magisk] flyoffacliff:
Oh wow, thank you for the clear explanation on remote key provisioning. I read the linked posts.

I would think there would have to be SOME kind of trusted root loaded on the device with RKP so the device would know that the keys being pushed with RKP are indeed coming from Google. I have a pixel 5, but if I had a pixel 6, then what would stop me from swapping the key on a new device that hasn't had anything pushed by Google yet? If Google can do push a cert with nothing pre-existing on the device, then so can @flyoffacliff.

Well not really, I am sure smart people thought of that somehow. But not actually having the key box permanently burned into the hardware does introduce a new vulnerability into the picture which was not there before (pre RKP). How do they push out the new key anyway, through a Google Play Services update to the affected device?

Pre-post-edit, after reading https://android-developers.googleblog.com/2022/03/upgrading-android-attestation-remote.html: I see there's still a public key loaded onto the device in the factory that allows it to know what keys to retrieve, so there goes that option. I also found out that RKP devices don't just revoke then when they are compromised, they are rotated regularly, typically every two months. So it seems like newer devices supporting RKP don’t even have “keyboxes”, in the traditional sense.

So we DEFINEITLY know that using a keybox FROM a RKP device on any other device is a dead end. I'm still not clear on whether using a legacy keybox FROM a non-RKP device on a newer RKP device is possible. I don't see why not, but you mentioned “it will be a non-issue for Google sooner than you think”.

So given that I do have a Pixel 5 without RKP, I COULD take advantage of that trick (matching my fingerprint to the device with the non-RKP revoked key box that was loaded to my device via modding, and also spoofing a locked bootloader), right?
[Magisk] pndwal:
My understanding was that they're simply far less likely to be leaked now that OEMs don't handle/have access to them... May still be possible...

It is; STRONG is still achievable on P8 and others... I think this would be an easy vuln to patch/fix (properly) however.

I was speaking of the issue you raised; ie Google would state they'd simply revoke keys (as they have) but actually be very hard pressed and reticent to do so because of the implication for devices in the wild... That issue is fixed with RKP going forward.

Seems you can still do so w/ unmatched fingerprint too; Google simply doesn't do the 'obvious' checks... Yet... And apparently still working on P6+ (for now) too.

Make no mistake however; hardening is bound to occur. 🙃 PW
[Magisk] osm0sis:
Try a different print perhaps, like sailfish. 😏

😶‍🌫️
[Magisk] pndwal:
Looks like the issue may be in Magisk itself...

Not sure why Developing Zygisk Modules doc links module/jni/zygisk.hpp from April 2023 with ZYGISK_API_VERSION 4 as latest public API... We clearly got ZYGISK_API_VERSION 5 in api.hpp and Properly version zygisk APIs in December...

It seems Magisk itself isn't recognising v5 either (AppSpecializeArgs etc not configured correctly?), and I'm now wondering if Shamiko module is using the Zygisk v5 API... This would make sense to me as the same Devs implement many Zygisk fixes and enhancements... Further, devices on late firmware may be more affected as it seems Fixes for Android 14 QPR2 B2(+) needs API version recognition working for both Zygisk API v4 and v5 modules.

Shana has just made the PR Fix zygisk v5, and I'm guessing it could be to address this issue in Shamiko... Nothing said about it however... Anyone with the Shamiko issue wanting to test this early can try CI build from artifacts here: Fix zygisk v5 Magisk Build #4273. 🤔 PW
[Magisk] osm0sis:
This seems to directly suggest it's a Shamiko bug: https://github.com/osm0sis/PlayIntegrityFork/pull/11

Anybody affected can use latest PIFork CI. 👍

😶‍🌫️
[Magisk] pndwal:
Ah, forgot about that... So guess you confirmed it's fixed from your CI 233+... 👍 PW
[Magisk] taka2902:
Any way to spoof bootloader like the way the xposed app do? Chit's xposed spoofer work but the detected app got a new update and it now can detect any xposed app hook into it so i can no longer use that method.
[Magisk] CZ.Kostra:
For those interested v2.5.
[Magisk] yjcbn:
It's been updated, but not sure which targets should be added to the list to pass PI.
[Magisk] Vision:
Nice updated.

The next big thing.

So now have 2 folder, 1 inside in data/adb/modules and the second data/adb only put the list and the keybox.xml.

Why not put together? With this way prevent detect ?
[Magisk] Captain_Throwback:
They are together? With the targetlist change, the keybox path was also updated.

EDIT: Oh, I see it now.
[Magisk] Aarif goku:
Well doesn't seem to work on custom rom I'll have to test on stock. Atleast it spoofs bootloader status though to target app.
[Magisk] Vision:
What exactly you mean not work?

Because you say it spoofs bootloader status though to target app.
[Magisk] Aarif goku:
For play integrity.
[Magisk] Vision:
Yeah.

As understand until now, all this modules with generate a valid certificate chain, still all need a working FP, besides keybox.xml
[Magisk] Aarif goku:
I tried using it with Pif and without and even tried the props using old magiskhideprops so I'm out of Ideas. But atleast it's great for apps that detect hooking by lsposed and has local attestation. I'll try to see if I can get it working somehow. It's a big leap for whomever it is works currently.

Since I was looking for TEE virtualization few days ago and finding about these modules do restore my hope on the rooting community and the amazing developers who keep it alive with everything they do.
[Magisk] jakell888888888:
Framework Patcher GO

The module makes it impossible to hide my Google framework. Will it cause my virtual positioning module to be detected? Currently the virtual positioning module I am using is detected.

View attachment 6123760View attachment 6123761
[Magisk] Vision:
Understand.

You open this ?

Unknown error/ Unable to get certificate · Issue #5 · aviraxp/Zygisk-KeystoreInjection

I'm getting error in keyattestation and only getting Basic like usual. Original error is 10003 like everyone but after the module with keybox it's giving the following error. Key attestation result...

github.com
[Magisk] Aarif goku:
Yeah
[Magisk] Aarif goku:
If you able to take care of ingress login then you can use lsposed with MockMockLocation or Hidemocklocation module to spoof with joystick. Or you can even smalipatcherEx module.
[Magisk] jakell888888888:
Yes, I have strong certification and I can log in to ingress, but the software you mentioned will be tested. There is no fooling ingress now
[Magisk] Aarif goku:
I have played in on. My Vivo passing strong and I'm able to spoof if you are getting scanner disabled then you didn't put ingress in the mentioned lsposed module. + You need to disable Google location accuracy.
[Magisk] fulano123:
I am using an Unofficial LineageROM, build using test-keys.

Anything I could do to still pass integrity tests ?
[Magisk] Vision:
I don't tag anyone, because lot :ROFLMAO:

As understand until now, all this modules with generate a valid certificate chain, still all those need a working FP like with PIF, besides keybox.xml, to work full.

Even and the FrameworkPatch need a FP.

At first I thought with only a valid keybox.xml can pass all or at least pass 2/3.
[Magisk] Aarif goku:
In theory pif and keystore should work together if not then hideprops but it too didn't work maybe because it's forcing basic integrity and CTS mismatch.

Are you inferring beta fp won't work and need a separate private valid fp?.. I've been trying betas
[Magisk] Vision:
Yeah understand.

Me too and like @osm0sis say, beta FP is valid only for 6 weeks.

Unfortunately all this great modules, depends in a working FP, so when Google block and the last one, none of these work anymore, even and with a valid keybox.xml
[Magisk] generalculprit:
You should get Basic integrity. For Device, ask your ROM's maintainer to sign with private keys, compile the ROM yourself with private keys or use an official ROM.
[Magisk] Vision:
Now I get it.

You mean without need a working FP ?

Otherwise, you can add like @chiteroman and @osm0sis a .json file.
[Magisk] iceman0826:
Google is becoming Apple due to this Integrity certification shenanigans that they're implementing. I'm still hopeful that someone will be able to crack this in a legit and clean way otherwise, we might switch to iOS in the near future 😅
[Magisk] Stillhard:
Fresh!

Tricky Store​

A trick of keystore. Android 12 or above is required.

GitHub - 5ec1cff/TrickyStore

Contribute to 5ec1cff/TrickyStore development by creating an account on GitHub.

github.com
[Magisk] sawdoctor:
Obviously can't post the link but there's a telegram channel for it
[Magisk] casouzaj:
I'm running crDroid v10.6 (Android 14) in my Xperia 1 II. This module makes my system highly unstable. Many reboots. I'm back to aviraxp's Keystore Injection (latest CI).
[Magisk] xcl1pse:
Expected
[Magisk] flyoffacliff:
I believe there are still working methods after we lose this FP, but it definitely gets more complicated.
[Magisk] dilligaf56:
On A14 June '24, Magisk 27002 and PIF 16.3 and Wallet TTP is still working. Thinking of jumping to 16.6 or osm0sis' fork to see if I can get RCS working as well, but I'd hate to lose TTP (much more important to me than RCS, but since wifey is chained to the Apple walled garden, it would be nice to have it). Has anyone lost this functionality after upgrading? PIF, Systemless Hosts, and Wireguard CLI tools are the only modules I'm running.
[Magisk] Vision:
That's for sure.

Just need all the big brains working together to found it.
[Magisk] sawdoctor:
Chiteroman has released his own version by the looks of it
[Magisk] majorfigjam:
There should be no issues with switching.

All you need to do is swap out your default print for a working beta print, for as long as Google don't kill it off. Which could of course happen soon to the 16.3 default Sailfish print anyway.

If you switch to Osm0sis, remember to name and locate the print correctly.
[Magisk] Vision:
Nice.

As I see still need A12+

What happens about A10+ ?!
[Magisk] innit:
It says to put keybox.xml to data/adb/tricky_store but there's no such folder, only data/adb/modules/tricky_store. Do I need to create that folder? I'm on stock Pixel 7 Pro.
[Magisk] Stillhard:
It should create it for you automatically along with the default target.txt file, if not maybe it's not working correctly for your device

But yes, you can create it manually or try the latest action commits build
[Magisk] innit:
Thanks, will try this one.
[Magisk] Vision:
I think not create automatically, because inside in the customize.sh not have command for this.

I open a PR according to this.

Update customize.sh by VisionR1 · Pull Request #6 · 5ec1cff/TrickyStore

I decided to add this lines (thanks @aviraxp for the idea), according to this post on XDA, for better understood.

github.com