yashsingh1/xdaforums huggingface dataset:
[Magisk] osm0sis:
ID makes sense since it appears to actually be a Play Integrity field like the others, but do you actually have any evidence that VNDK is needed for some print to pass somewhere?

EvoX has theirs automatically pull ID (and other things) directly from the fingerprint if not specified, which is kinda cool:

PPU: Make CTS/Play Integrity pass again (again and again and again) · Evolution-X/frameworks_base@63ab5a3

[someone5678] Adapt to this project Co-authored-by: Dyneteve <dyneteve@hentaios.com> Change-Id: If3a865849c7c99a9c7080114ba94a8f8878bb4f2 Signed-off-by: someone5678 <someone5678@users.nor...

github.com
[Magisk] Gilg@mesh:
still works with custom one. :)
[Magisk] hassanhassan:
might go back to iphone, this kind of cat and mouse isn't what I signed up for. At least I know what I'm getting with IOS
[Magisk] manjaroid:
Verifying paths and file names with a file manager is one of my steps before running checks.

Here's a twist: my working print in 14.0 omits the API level which is how an older version of PixelFlasher parsed the props so I went with it and have been passing. Then if I manually add the API number the print stops working so I go back to no API. With a newer PixelFlasher version the API number is parsed and added but the print doesn't work at all unless API is removed for module 14.0.

This kinda hints at a print that's not ideal and maybe not worth pursuing but have a look anyway. Since my comment 14.0 has been replaced with your fork and I'm on the hunt for different props.
[Magisk] Vision:
@chiteroman now I'm in v14 with custom fingerprint pass 2/3, update to DEV v1 or stay to v14 ?

View attachment 6040687
[Magisk] V0latyle:
If you're using a custom fingerprint, there's no reason to update. I'm still on v14 with custom print.
[Magisk] D€INOS:
Will be interesting if EvoXs implementation will work, don't think so but hopefully it will.
[Magisk] Vision:
True, if working, why should i upgrade it 🤣
[Magisk] wfred:
It's like a spoon, except with pointy parts instead of a scoop 😉

GitHub - osm0sis/PlayIntegrityFork: Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - osm0sis/PlayIntegrityFork

github.com
[Magisk] wfred:
Don't bother with yasnac. Google no longer uses Safety Net so the results aren't relevant. You need to use one of the integrity checkers or do a check with Play's built in checker under Settings/General/Developer
[Magisk] xSnowLeopardx:
Gonna sound weird, but it feels so nice to have this, that I would not even mind my current one breaking on me, since I can just switch it out with one out of my stock, lol. Have them saved on my phone as well, so it would be done rather quickly as well.
[Magisk] HippoMan:
A fairly recent estimate gives the total number of Android phones in use as around 724 million.

A very generous estimate of people reading this group is perhaps around 1,000 individuals, and the total population of @chiteroman's TG group is over 6,000. If each of these 7,000 or so people have modded Android devices, we modders own and use only around 0.1 percent of the total number of Android phones in existence.

Or even if we generously assume that each of the 7,000-ish readers of this forum and that TG channel has 2 Android phones, that's still only around 0.2 percent of the total.

Therefore, to the Googlefrinchians, we modders comprise no more than a microscopic speck in the vast universe of their customers, and so it's very unlikely that they are devoting many resources to actively trying to thwart our efforts or to paying much attention to us at all.

But this doesn't mean that we're not suffering as a result of the Googlefrinchians. They have their own priorities and agendas, and since we mean next to nothing to them, they're just ignoring us and walking all over us as they pursue their own goals.

So, even though I doubt that the Googlefrinchians are actively trying to do battle with us, the end result is that their actions and policies are still contributing to us getting screwed over, and there is little, if anything, that we can do to change our priority within the collection of Googlefrinchian policies.

So ... IMO, we're fortunate now that we modders have these fingerprint-based workarounds to the Googlefrinchian integrity checking, but Android is still going to continue to deteriorate for us.
[Magisk] stanley321:
I am just here to check if I win the FP lottery or not :ROFLMAO:

I agree with many members here, keep burning FP is not the way.
[Magisk] djcsurf:
I've been keeping up with this thread as much as I can the last few days and decided to search my own pif. Either I'm lucky or i have missed something out. I replaced the old pif, cleared cache from GPS and GSF and rebooted. In play store checker it says I'm ok and device is certified :)
[Magisk] xSnowLeopardx:
Leave GSF alone, it isn't needed. But, glad everything is fine for ya.
[Magisk] stanley321:
Turning the build.prop to JSON is easy but getting the build.prop from the ROM is harder.

For now my steps are:

Download a ROM,

Unzip,

Get the system image,

Turn Android image to EXT4 image,

Extract build.prop

Are there faster or easier way to do this?
[Magisk] awtompson:
How do you do #4? Just rename it?
[Magisk] sawdoctor:
Don't download the rom there's a dump of android firmwares if you Google it. You can then just download the buildprop from the files
[Magisk] fkofilee:
Thats depends on device manufacturer and software update method.

For example, Oneplus OP5t below used payload for ROM install, from OP6 they used a different method

Samsung use ODIN flashable files

The method to decrypt can be long and difficult but you can dig into the forum for methods on how to do it.
[Magisk] jabennett:
You know our motto around here: "If it ain't broke, fix it 'til it is." 🎭
[Magisk] xSnowLeopardx:
Sums up all my small - big mistakes in the past 14 years of rooting/modding... haha
[Magisk] stanley321:
Thank you, I realized I did something wrong when I saw others with dozens of FP in their pool.

However, I think by downloading obscure ROM not commonly available in online dump, it will be very unlikely for my FP to crash with others.

I use simg2img
[Magisk] Rabbia545:
Can I pass along my own phone details? Please someone lets me know. I'm samsung user
[Magisk] sawdoctor:
Also try some more modern fingerprints and change the api level. Some will work and less likely to be found by others

Edit also there's a few kitchens around which make extracting roms from a zip/tar/img a breeze
[Magisk] devilsshadow:
@V0latyle 1st print I ever tried still going strong here.

@osm0sis seeing you active in this thread after having followed some of your work since my first android phone (a dingy motorola photon 4g more than a decade ago) brings me much joy. Much respect for your contributions over the years.

I see you screaming sense into the void that is this thread and feel sorry for your wasted effort. Just know some of us appreciate your wisdom and experience in the space.

I'm not using your fork yet as my 14.0/custom FP is working fine, but as soon as it stops working, I'm jumpin' ship.

I see folks in here arguing for the easy "plug-and-play" way. The mental gymnastics required to ask for easy solutions for rooted devices is insane to say the least. I know the word "entitlement" gets tossed around a lot these days but damn... I feel sorry for the actual hackers, tinkerers and developers putting in the work, only to be swarmed by the ADHD instant gratification crowd.

Chin up you legends, you know who you are. If any of you stop giving us free android goodies this time tomorrow, you'll still have my undying respect forever.
[Magisk] litaninja:
14.2 gets me passing device integrity again after about 2 days of failing it. Thanks @chiteroman and everybody!
[Magisk] zgfg:
By "going strong" you mean passing STRONG Integrity?
[Magisk] EasyDeath:
Hello guys, i really don't know what i'm doing wrong.

Install last xiaomi eu rom

install magisk

boot system

hide magisk + enable Zygisk

install play integrity fix v14.2

all tests failed

Did the same on my oneplus 9pro and got MEETS_DEVICE_INTEGIRITY

Am i missing something?
[Magisk] Rabbia545:
Can I pass along my own phone details? Please someone lets me know. I'm samsung user and I'm noob. I want to know is it posible
[Magisk] zgfg:
Do you pass with them and without the module?

Supposedly not - then why would they work if module would spoof them/replace them by themselves

But you could try using them as they are and only upgrading FIRST_API_LEVEL

That's just an idea to tesr, it could maybe work but for some with older devices
[Magisk] Rabbia545:
Yes.i do with module
[Magisk] okotzak:
I downloaded ver14.2 and my Google wallet works perfectly without doing anything else.

I wonder why yours doesn't work.
[Magisk] zgfg:
Xiaomi eu ROMs new rebuilds have their own mechanism for spoofing

By messing with both the module and their apk for spoofing, you don't duplicate your chances to pass to 200% but to the contrary, to 0% since one will clash with the other

Please check on the Xiaomi.eu forum (it applies to MIUI 14 Stable ROMs and HyperOS monthly builds)
[Magisk] okij:
No, it's an even much smaller fraction based on the numbers you stated:

~7,000 / ~724,000,000 = ~0.00001 = just about 0.001 percent :)

Loking at this, Mr. Play Integrity seems to have an enormous important job at Google, caring for such a huge share of Android phones. 😄
[Magisk] sawdoctor:
@osm0sis got it spot on. Google don't mind us modders and actively encourage us to find things. But they do have to be seen as doing something so go after the low hanging fruit as he describes it. If we are less obvious and make less noise they'll leave us alone longer, unfortunately too many of us don't do that. The Googlefrinchians have certainly been more keen on banning fingerprints since Displax released a strong integrity fix
[Magisk] EasyDeath:
Yeah, i already tried that

Clean install + magisk + XiaomiEUModule_2023.12.05.apk = all tests failed

Then i tried again clean install, this time with PlayIntegrityFix_v14.2.zip and again, all tests failed

With safetynet-fix-v2.4.0-MOD_2.0.zip i was getting some basic pass, but not MEETS_DEVICE_INTEGIRITY

Is there anything else i can do?
[Magisk] zgfg:
Do clean install without magisk, just their apk for spoofing

If you use Magisk then you have to know how to setup DenyList, Shamiko and all these things - their apk does not hide your Magisk
[Magisk] jabennett:
"This is finally working, but could it work *better?*" 🤔

{bricks phone} 💀
[Magisk] Captain_Throwback:
So technically, we're white hat hackers for Google working for free?

I think the reason we keep running into issues here is that Play Integrity itself is meant to be a security feature, and this mod is directly intended to circumvent that security by bypassing hardware-backed verification. Despite the small size of the root community's footprint, I think the intent of this mod is certainly on Google's radar, and they seem to be intent on plugging this "security hole", essentially nullifying the usefulness of root for those that also want to use their phone to it's fullest potential.

In the end, sadly, we seem to be on a collision course with locked bootloaders.
[Magisk] dosbuddy:
we are burning fingerprints here and xiaomi.eu does the same
[Magisk] manjaroid:
A tweak @osm0sis recommended got v3 fork working with the same print now on its third day.
[Magisk] EasyDeath:
Yeah, i already know how to use DenyList, on my OnePlus i got all banking apps working no problems since day 1 i got it.

The problem is this new xiaomi phone... so difficult to get things working

So now i installed:

Shamiko-v0.7.4-188-release.zip

PlayIntegrityFix_v14.2.zip

And it seems to be working fine.. at least for now

Netflix works

MacDonald app works (this app behaves just like any banking app, just select country and press next, it will show error if it detects root)
[Magisk] zgfg:
You have to put GMS (even all processes) to DenyList

And Hide Magisk app, maybe even by HMA (out of scope here)

And you must uninstall Xiaomi.eu spoofing app - but I didn't switch yet, hence I don't know details

Or fully uninstall Magisk and use only their apk

Not both together

PS: What you see on your screenshot should be due to their spoofing
[Magisk] HippoMan:
Yes, the correction of my math error shows that we modders are even more insignificant to the Googlefrinchians than I thought.
[Magisk] Emmes:
yes, that is the fingerprint xiaomi.eu used for spoofing. i think you should delete the picture so that you don't give a hint for banning by google :-)
[Magisk] HippoMan:
... which means that they're not encouraging our efforts, but rather, they jumped in with a dramatic "fix" as soon as they noticed Displax's effort.
[Magisk] efazeti:
on latest xiaomi.eu:

rom + no root + XiaomiEUModule.apk

or

rom + root + disable/uninstall XiaomiEUModule.apk + PIF
[Magisk] HippoMan:
PS: and any encouragement they possibly might be offering for us to find things is so that they can then "fix" those things (which they see as security flaws). And the results of this "fixing" just end up making Android life more painful for us modders.
[Magisk] V0latyle:
That's what I've been saying. Play Integrity, like the rest of GMS, is a Google proprietary product. They already dominate the market with GMS. They want a bigger market share with PI too and are offering a simpler API as an alternative to app developers who are paying God knows how much for third party security engines. I don't think they're doing this to specifically cripple or disadvantage the modding community; Google in fact themselves market what may be the best development friendly devices on the market with the Pixel line. From a security standpoint though, any exploit and vulnerability should be patched, because how many app developers would switch to, or continue to use PI if they know it can be fairly easily bypassed?

As I've said in debate with @HippoMan, none of this really affects what we can do with our phones. It doesn't change whether we can unlock bootloaders, it doesn't change whether we can root, it doesn't even affect whether GMS can be used on rooted devices. Google has shown zero interest in preventing the modding community from using GMS.

So, reinforcing GMS security (at least as far as PI is concerned) doesn't hurt the modding community; it's a consequence of the fact that we use our devices in an insecure state, strictly speaking, and while it sucks for us, we have to remember that no matter how we try to explain it, unlocked bootloaders and rooted firmware are considered compromised and therefore outside the scope of what Google is trying to accomplish with PI.
[Magisk] Haxival:
View attachment 6040748Hello folks, been getting this message lately, even after updating the module. What does this mean? My apps seem to work as normal
[Magisk] sawdoctor:
They don't mind us rooting and modding otherwise they'd lock the bootloader. Yes they probably do care about play integrity spoofing which is a different thing. But i also think if we were more discreet with PI spoofing they'd pay less attention to us
[Magisk] HippoMan:
Exactly. And every workaround we find for them just ends up making our own Android lives more difficult, once they "fix" it.

At least TJW gets paid for working for the Googlefrinchians.
[Magisk] jurluk:
I know nothing about security or "cracking", but I know something about software development and architecture.

Even every hardware call must be initiated in software. Since we stick to the software layer, maybe there is some other type of bypass we can do.

I mean, if we can find code that calls some hardware api and fake it's return data, that could mean something. For example:

Before:

IsDeviceSafe() {
result = hardwareCheck();
return result.IsSafe;
}

After:

IsDeviceSafe() {
//result = hardwareCheck();
//return result.IsSafe;
return true;
}

I know It's overly simplified and I don't know is that even possible, but if I had enough knowledge, I would go in that direction.

Just my two cents :)
[Magisk] xSnowLeopardx:
Use TB Checker or even better: Play Store: settings -> about -> Play Store version -> click it a bunch of times -> then scroll up and click on General -> developer options -> Check integrity.
[Magisk] maxmax0:
Agreed. They need to demonstrate adequate effort, which at a minimum means to go after exploits being used en masse. They won't care too much about the solo guy using the fingerprint her found though.
[Magisk] Haxival:
I did the Play Store way and everything seems fine, meets both basic and device integrity. That app was very convenient thought, weird how it stopped working. Thank you anyway kind sir.
[Magisk] Fishawy:
"The Titanic is sinking!"

"Let's gather in the kitchen over a glass of Champagne and watch the water rise, all good."

With this rate, we will soon run out of whatever little stock of valid prints we have.

I used to be a plug-and-play guy, looking for the easiest way, but over the last week it's been proven several times that this is not sustainable. Folks, I urge you, please utilise @osm0sis's guide and fork with @badabing2003's PixelFlasher tool to get your own print.

A slightly safer Noah's ark is better than the great flood. Still floods, but at least you're not drowning (for now).

We need to stop taking generic PIFs for granted.

Did you update to v14.2 or switch to the fork?

With chiteroman's latest v14.2, no fingerprint.

With osm0sis's fork, you'll need to rename your fingerprint to custom.pif.json and place it under /data/adb/modules/playintegrityfix/.

Please read the help post by osm0sis pinned to the first OP post.

Mine still works. Didn't need to use any of my backup prints (yet).
[Magisk] xSnowLeopardx:
TB Checker is also a good one if you like the convenience. I think it had either no or very little errors. Play Store is guaranteed to have a working message, but it's, like you said, less convenient.

You're welcome!
[Magisk] ipilcher:
I've probably spent 40 hours searching for fingerprints, using both downloaded ROMs and dumps. I've read osm0sis's guide 5 or 6 times. And yet, I've come up with exactly zero working fingerprints in all that time.
[Magisk] Vision:
Yeah true, a update with more features, sometimes maybe is not better than a previous version 🤣
[Magisk] zgfg:
Overquota, app's server throttled by too many testing

But this thread is also throttled with a tons of Q&A about the same😁
[Magisk] frasca61:
reply to rodken, Can you explain this procedure better?

thank you
[Magisk] Fishawy:
I wouldn't download ROMs, there's a lot of online dumps where you can search for build.prop files. I would suggest focusing on that and trying different sources.

I'm sorry it's taking that long, but there's a manual part that cannot be escaped now. Tools and guides are on here to help reducing that.
[Magisk] zgfg:
Which procedure -sorry, mining cannot be explained in few words

But there are excellent posts and guides in this thread

Look mainly (XDA can show you those) posts that got most Likes by readers
[Magisk] xSnowLeopardx:
And you're using PixelFlasher as well? Not that that'd be the solution, but I see how it can speed up the process. 40 hours is a lot to not find at least one FP. I think there's something with your method of finding. Dumps are way more efficient than full ROMs.

Once you find at least one, you will be amazed how quickly you will find the second one, since it will mean your technique is OK. That is not, right now. Use this sentence to your advantage: "Write build.props dumps into google and follow your instincts" by @AlesiBoss
[Magisk] frasca61:
i'm sorry, Can you explain this procedure better?

thank you
[Magisk] zgfg:
Sink or swim

Too many high chairs and baby feeding here

Sorry but that's it or how it should be
[Magisk] ipilcher:
I don't have have Windows or Ubuntu system, so I can't use PixelFlasher. That said, writing or editing a JSON file and ensuring it's in the correct place isn't particularly difficult.

The things I've found that really slow down the process are:

Finding downloadable ROMs - so many dead links & dodgy sites

Figuring out how to extract a mountable filesystem from manufacturer X's random format

Trying to find the dump for a particular phone on the dump site I'm using; the random mix of codenames, marketing names, models, etc., makes it really difficult

So many older ROMs don't seem to have fingerprint properties

I also have a suspicion that I'm choosing the manufacturers & models poorly, but that's one of those things that we're supposed to figure out for ourselves.

Honestly, I'd be happy if people would just stop referring to those of us who haven't been able to find our own fingerprint as lazy.
[Magisk] xSnowLeopardx:
Ok, not lazy. Some are, some aren't. Let's see what I can do here.

So many older ROMs don't seem to have fingerprint properties

True. I usually skip those as well.

Trying to find the dump for a particular phone on the dump site I'm using; the random mix of codenames, marketing names, models, etc., makes it really difficult

Finding a dump for a particular phone? Why? When I have a site with multiple dumps, I just start with the first one I see. I don't think anything about it, just click and do my process (which is the faster way with PixelFlasher, but yeah).

I think you should focus more on dumps than ROMs. Yes, I have had ROMs as well. I have had a higher success rate with them, even, but for you, it's more efficient to find a good dump site.

I will iterate:

This helped me the minute I read it.
[Magisk] Nodens:
If others do it or not it is largely irrelevant. The entire point is that this is helping to exhaust a finite pool at increased rates. If others do it as well, then your contribution with the same method multiplies the problem so it by no means an argument that works in one's favor. This needs to stop. Yesterday. It is just the correct thing to do.

Instead of helping Google ban keys, for popularity, donations or whatever reason, resources should be spent in understand how the fps get banned for spoofing use only, why that mechanism is not absolute and why the same fps work on some devices and not others. This will allow patching the mechanism itself as the fps can not be outright banned for the obvious reasons.

A good starting point for analysis would be devices that currently pass with banned fps (eg the TG fp). We should at least start compiling device info from people reporting still using banned fps with success.
[Magisk] sawdoctor:
Do you mind me asking if you have a pc at all? Pixelflasher works on all Linux distros. I didn't find a build prop dump but did find an android firmware dump and getting build props from there was easy. Finding one that worked wasn't as easy as i expected but getting the buildprops was
[Magisk] wfred:
That message just means that too many people are using it.

Integrity check apps have a limited number of requests over a certain time period. Once they reach that limit they have to "recharge". There are so many people doing integrity checks that the popular apps are almost always at or near their limit.
[Magisk] Lubo99:
pixelflasher runs on OSX as well. but if you dont want to use it. connect via adb wifi and use vi editor to open pif.json file change to whatever you need and save. of course you need to "chmod" file privileges to edit file.