yashsingh1/xdaforums huggingface dataset:
[Magisk] ScottIsMyName:
Just to be clear, we're spoofing fingerprints for droidguard....I get that.

Is there any way to know which service called or causes droidguard to do it's check? Not sure if that is passed in the command or droidguard receives it as an argument or something else.

What I'm getting at is we already know how to only spoof the fingerprint for droidguard, but can we take that one step further and spoof different fingerprints for droidguard based on what caused droidguard to be triggered in the first place? For example, Messenger triggered a droidguard check, spoof using this fingerprint. Wallet triggered droiguard, spoof this fingerprint, etc....
[Magisk] AlexS2412:
are we not allowed to know how private prints are made? :(
[Magisk] Captain_Throwback:
This is not, nor has it ever been, a secret.
[Magisk] chiteroman:
Instead of porting to a LSPosed module, which I don't recommend it, I can try to port to zloader (that module uses it to load LSPosed without Zygisk or Riru):

GitHub - Mufanc/z-loader: Inject into processes specialized from Zygote

Inject into processes specialized from Zygote. Contribute to Mufanc/z-loader development by creating an account on GitHub.

github.com

However, it doesn't work on older kernels (it requires new BPF commits) and on modern kernels, such as the one on my POCO X6 Pro (duchamp) with kernel v6.1.57, it also doesn't work.

Therefore, it's better to use Zygisk: it's compatible with 99% of devices, it's undetectable to DroidGuard, and it works.

Zloader is a new, promising injector (better than Zygisk and Riru because it's at the kernel level), but it's still new and has bugs. Maybe in the future, I'll create a version for it. 👍
[Magisk] AlexS2412:
where is the information? assume i know nothing. i really looked for it, but people keep saying "you cant just make one." it makes no sense...
[Magisk] sawdoctor:
How to search & find your own fingerprints [noob friendly]: A Comprehensive Guide w/ tips & Discussion for Complete Noobs (from one)

It seems Google has banned more than 95% of custom fingerprints, so this thread/guide has kind been laid to the wayside. But it's still a great resource to understanding the foundations of fingerprints and all that... This is for any/all utterly...

xdaforums.com

Everything is in this thread
[Magisk] woodpe:
There's a simple way: search many, many build.props, build par example with pixelflasher the fingerprint and test, test, test...

Perhaps you'll get one working fingerprint out of 1000 tests!
[Magisk] AlexS2412:
this isnt helpful. i could not find it before. i am losing my mind here because this is starting to turn into stackoverflow. obody really wants to help anyone.
[Magisk] zgfg:
Of course, tou can. Long ago it was discussed here,v in this thread. The posts are still here, you need to roll hundreds of pages back. However, some sources with dumps are no more available, some are still available but you will find no more working prints there

Here or there it can be still found somthing but be ready to test few K to find 1

Everything that was exposed and made to easy to find became banned

A post with scriprlrs, etc, from the other thread (but the link was also given here, so again,, no censorship), from my testing in the April:

https://xdaforums.com/t/tools-zips-...tiple-devices-platforms.2239421/post-89482876
[Magisk] AlexS2412:
none of this explains anything on how to create a print. i just dont understand!!!
[Magisk] HippoMan:
People have been offering massive amounts of help in this thread, over and over ... and over ... and over ... and [ ... etc. ... ]

Many of those who have helped SO much and SO many times here have just gotten worn out from the huge amount of repeated answers they have given here to the same questions.

No one pays these people for their generosity in giving these mass quantities of help repeatedly in response to the same questions.

This thread's OP (the original post in this thread) contains (1) the answers to many of these repeated questions and (2) pointers to posts which provide answers and (3) the very valuable suggestion of using this site's search function to help narrow down the list of posts in which answers pertinent to the questions being asked could be found.

PS: after availing yourself of these resources to obtain your desired answers, perhaps you could then make the commitment to come here every day over a 6-to-12-month period and repeatedly answer the same questions over and over about what you learned.
[Magisk] CSX321:
Maybe the confusion is because it's not that you create a "custom print", you're looking for a one from an old device that hasn't been banned. That's what's meant by "private print". It's one from an old device that someone has found works, but that they haven't publicly revealed. It's not something they created from scratch.
[Magisk] zgfg:
You cannot "create'. Nobody here 'created' them

Last time in the April I did automatic testing (the scripts are there, in the post I gave a link) for ten days, 16 and more hours a day (phone running the script over night, when I was at work, over the weekend while spending time with family and friends, while driving a car, almost constantly, even in my pocket)

So that is how you 'create' some

The script was crunching 2-3 FPs every minute and I was happy if I found few good every day. Then on May 25, many of them got banned
[Magisk] AlexS2412:
this is still very vague. you were running a script that collects fingerprints or something?
[Magisk] osm0sis:
Everyone is pointing you in the correct directions and it appears you haven't done any reading yet.

Start with the OP. Read it. Follow the link to the FAQ. Read it. Follow the link there to my README. Read it. Then follow the links to the Resources within and you'll have everything you need to understand what's being said here and eventually find a private print IF you put in the work. Put in the work. That starts with reading.
[Magisk] ezdiy:
What you're looking for is CONFIG_UPROBE_EVENTS=y. Plain eBPF/seccomp as such is available since Oreo (this is how chrome sandboxing works for example), but is less versatile (works only on syscall boundary, and doesn't allow to run specific bpf program per trap -> you bounce to tracer/signal handler that needs to exist in the first place).

Beware that uprobes are detectable/removable in a same way as ordinary debugger breakpoints and library hooks are. Their utility lies in being a "shotgun" auto-hook with system-wide filter (which is useful for zygote spawnees) by removing the need for a tracer process.

If all you want to do is spoof props and be stealthy about it, simplest way to go about it is mutating data used by system_properties.cpp once you detect you run in a target process, and then *removing* whatever hook you have in place - the data alone will spoof the prop.
[Magisk] trevtdogg:
that thread is probably the most helpful thing you could read and understand to start looking for a private print.
[Magisk] cabagekiller:
What don't you understand? Do you even know what a fingerprint is?
[Magisk] HippoMan:
If he needs to learn what a "fingerprint" is in this case, the information in the OP, FAQ, etc. that @osm0sis referred to above ( in this message: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89559905 ) explains what it is.

@osm0sis also made it clear that the way to gain this and related understanding is to "Put in the work" and read the items that he mentioned.

It takes maybe 5-10 minutes at most to read all of the information that @osm0sis referenced.
[Magisk] osm0sis:
A bit more light reading! :cool:
[Magisk] Nergal di Cuthah:
For your sailfish device maybe try @osm0sis scripts only unless android ten is too late for it, just a thought
[Magisk] HippoMan:
Agreed, and just a little while ago, @osm0sis released an updated version of his PI Next Fork utility:

https://xdaforums.com/t/tools-zips-...tiple-devices-platforms.2239421/post-89560095

PS: Oh, I just now realized he notified us here just above, in his "light reading" link. But I guess there's no harm in leaving this message of mine here, as well.

PPS: Corrected "PI Next" to "PI Fork", above. I accidentally typed "Next", even though I knew that it's "Fork".
[Magisk] osm0sis:
PI Next is not and was never me, however. In fact I had major beef with that ****show since it erased all credit... 🤨

From my Odds thread:

View attachment 6113234
[Magisk] HippoMan:
Oops, I meant PIFork, not "Next".

I'll correct my error in my message, above.
[Magisk] joeyhuab:
You won't understand if you DON'T WANT TO understand. Simple. Everyone's helping each other out and even pointing you where to look. People FIND "private" fingerprints via scripts. Not THAT hard to understand. Once they find one, obviously its kept private for a reason (so Google doesn't BAN them).
[Magisk] zgfg:
I doubt that you did read the post I put the link, watched the video there, etc, bcs if you did, you would not ask how you're asking

Hence sorry, why do you bother, I'm not going to waste the time

Also, If you are really interested, search for my old posts in this thread.

Open the script (that is attached to that post in the other thread that I gave a link yesterday) and read the first 15-20 lines with the comments there, it also describes a lot

Anyway, you would first need to download the dumps to the phone before running the main script. One source that I used is no more online. I gave there a link to another site with the dumps, you will need to download them locally to use. Do your own work how to download them or search for other sources to download the dumps from

Don't take me wrong but knowing about that matter and reading your posts here - make your life easier and use the public Sailfish. Or if you don't like to be dependant on the prints from Xiaomi.eu (troubles with RCS, etc) make your life even more easier by flashing back the stock and re-locking Bootloader - RCS, Wallet, all banking apps, etc will work

If you stay with the modded phone, the future is uncertain. You may spend days to catch-up (or weeks to fish for the private prints) and tomorrow, next week or next month G may change things and what/how it works today will no more work

You're grown-up, no need for spoon feeding. Enjoy and good luck
[Magisk] mike.s:
... who is lazy, won't spend time reading/researching, and wants everything handed to them on a platter.
[Magisk] dmitrydahmer:
thanks

for the second day I've been using latest magisk module by chiteroman with no fingerprint

surprisingly it started passing device int.

I was able to pay in groceries with no issues
[Magisk] Utini:
For anyone who prefers to run @osm0sis autopif.sh via the PC/Laptop:

Open cmd

adb devices

adb shell "su -c sh /data/adb/modules/playintegrityfix/autopif.sh"

@osm0sis your github path to the script under this links is missing /modules/:

GitHub - osm0sis/PlayIntegrityFork: Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - osm0sis/PlayIntegrityFork

github.com

Thanks for the update, worked fine!
[Magisk] pndwal:
No, but that mode is only good for devices lacking DroidGuard-level hardware key backed attestation, either because they don't have Keymaster Hal 3+* (Nb. HKA actually arrived with Android 7 w/ Keymaster HAL 2, but the spec wasn't comprehensive enough for DroidGuard attestation) or the Keymaster 3+ implementation is broken and an exception already causes fallback to basic only attestation. Note that Keymaster is not updated with Android upgrades so device must be launched with Keymaster 3+ for HKA in DroidGuard, and that came with Android 8+... So read Scripts-only PIF is only good for devices launched with pre-8.0 Android or more modern OnePlus etc w/ broken Keymaster implementations.

So no, it doesn't need Zygisk. That's needed for both on-device (DroidGuard) fallback to basic attestation (fake keystore registration data injected into zygote to cause error/exception triggering fallback) and newer serverside HARDWARE_BACKED verdict evaluationType enforcement bypass (props/field spoofs use Zygisk to target GMS DroidGuard process only with non-HKA compliant device identifiers)... These are really the key functions of USNF and now PIF, but aren't needed where a device is already using, and expected by backend to use, basic-only attestation...

Scripts-only mode basically works for PI DEVICE_INTEGRITY as we still need to hide root from GMS (DroidGuard process in particular, but core GMS process should also have root hidden in some cases depending on the Magisk path in use) and set 'sensitive' props to non-suspicious values. These functions have been needed since we lost MagiskHide which basically did the same thing... There are also some other adjustments on a per device basis to prevent breaking of functions like biometric scanners etc too.

👀 PW
[Magisk] Iridule:
This could be one way google sees something suspicious. I recently had to re-root... anyone else have this issue? Seems the FP changes how my phone appears on google one and backup. Among other areas....View attachment 6113331
[Magisk] majorfigjam:
This came up the other day (again). Sailfish comes from a Google pixel.

You need to "unpif", log into your google account then delete all android sessions, then log out and back in again so Google identifies your device type correctly.

Once done, you can reinstall pif.
[Magisk] Hugh9190:
Just to confirm one last time! Is there currently anyone who can use a private fingerprint along with pif/pifork on a rooted device to normally use RCS? Even if it only passes the basic check and cannot be used for payments. If there really is, and no one is willing to give me more additional help, I will be content to look for a "private" one. Thank you, everyone.
[Magisk] Shaifu2K:
I have a question, and this is directed to any devs here. I read in the past days that only 70 fingerprints are only working out of the thousands of fingerprints out there. Is it true? If it's true, how can I find one that's working without doing too much trial-and-error, or does it really require that hard work before I can find one?

So far, I've tried 10 fingerprints, and none is working. All of them pass BASIC, but not DEVICE. I feel like this is becoming impossible to achieve.
[Magisk] aliantonio:
Quick update on the modules that are working for me with RCS on stock Pixel 7 and APatch:

RCS works:

-Systemloss hosts

-Zygisk Next

-Zygisk Assistant

RCS breaks:

-LSposed

-BusyBox

-Zygisk Detach

At this point, with the few modules that are still working for me without breaking RCS, I'm not sure if root is worth the trouble. Feels like I'm losing more than I'm gaining. Going to stick with root for now though in hopes something changes.
[Magisk] sawdoctor:
Yes there's about 70 left and yes it's that hard to find one. Most of us have downloaded hundreds of firmwares and had no luck. There's a script to make testing easier but it's needle in a haystack
[Magisk] Shaifu2K:
Fml 😞 I think I'm gonna try until I give up. Any link or reference to the script you mentioned? Thanks.
[Magisk] ThePrinceofBirds:
I feel pretty much the same. It's so frustrating and even dangerous to randomly lose RCS. I'm at the point, especially with RCS integration with all the iPhone users I work with, that I may not root on my next phone (might even unroot my current one). The cat and mouse game is just too exhausting and time consuming. I mostly use root for AdAway, removing the pointless white gesture line at the bottom of the pixel, and installing revanced with root so that Chromecast actually works. If I can effectively use the VPN and blocking solutions I can maybe live with the white bar and the Chromecast issues if it means I'm not randomly losing RCS or fighting Google wallet and the play store.
[Magisk] generalculprit:
One. Page. Back.
[Magisk] kholdstayr:
I just tried APatch/ZygiskNext/Zygisk Assistant but RCS is not working.

I understand though that Assistant might need special setup. I disabled "enforce denylist" in Zygisk Next. But I also read in the Assistant GitHub that you need to "unmount the target app". I don't know what that means. I don't see an unmount option in APatch. Thanks in advance.
[Magisk] Captain_Throwback:
On the Superuser tab in the APatch app, when you tap an app, the second line lets you "Exclude" the app from seeing the modified system, and it hides root when used along with a hiding method like Shamiko, Zygisk Assistant, or Denylist.
[Magisk] osm0sis:
So, again, sounds like APatch isn't hiding things very well...

Edit: Ah, guess it needs some extra setup, see the post above this one. 👍
[Magisk] kholdstayr:
Ok hopefully I'm not bugging you with these questions. Should I exclude play services and Google messages?
[Magisk] Captain_Throwback:
You'll have to try it and find out. I don't have any of the issues mentioned here so I don't know what specific hiding/setup may be needed.
[Magisk] s1dest3pnate:
RCS has been working for me for 48+ hrs by simply having Apatch and no modules or custom/private fingerprint
[Magisk] zgfg:
Unfortunately they are rarely rare. When you test thousands, you will be lucky to find some.

Just by testing 10, chances to find are practically zero

And yes, there are almost 80 known to work, but they have been found among (tens or so) thousands of dumps
[Magisk] Hugh9190:
But I must to use the Lsposed either. :ROFLMAO:
[Magisk] pershoot:
You won't pass DEVICE and thus contactless will fail. This particular case has been reported in the past (with a print that isn't banned for RCS purposes (your actual device since its not being spoofed)). Unfortunately, until the current public print gets banned in full and another is found (i.e. cat and mouse), one will have to live with one or the other, as of now, if they are not using a private print.
[Magisk] s1dest3pnate:
Yep, no problem for me. Just want RCS, couldn't care less about contactless

There is a Carrier Services and Messages update pending for me... I'm scared to install it haha
[Magisk] passionicon:
Based on this explanation of yours, i actually don't mind having rcs working and losing contactless. Now i have a work app that won't work unless i pass basic and device integrity, is there a known workaround for this one single app to work without passing the 2 integrity?

Hma didn't work
[Magisk] immortalwon:
Is it the custom print that's detected or zygisk itself?
[Magisk] passionicon:
What does carrier services do
[Magisk] zgfg:
Not, if you tested with passing PI vs not and in the first case it worked and in the second not. It means that the app calls PI attestation

You can also watch the PIF kogcat while opening that app to see does it trigger the attestation

But you said that Wallet is important to you. Then, with Zygisk, PIF and Sailfish you have both, missing only RCS
[Magisk] aliantonio:
Tried excluding messages and play services like @Captain_Throwback explained and re-installing LSposed and RCS still breaks. So yes, agreed, apatch is not hiding root that well.
[Magisk] passionicon:
How do i watch the pif logcat? From kernelsu log?
[Magisk] Captain_Throwback:
Aren't all the root solutions having the issue with broken RCS? Not sure what that has to do with APatch root hiding...
[Magisk] aliantonio:
Some modules are breaking RCS, not necessarily root. RCS works for me with root via apatch and a few modules installed, but breaks when installing some others.
[Magisk] Captain_Throwback:
So then that sounds like a module issue, not an APatch issue, right?
[Magisk] D€INOS:
Running the excellent from zgfg , awsome script btw 🏆, on my test phone.

About 5000+ prints to go.

A question to narrow it down a bit;

Lots of prints with higher api level than recommended, i.e. higher than API 23-26, should I change the api_level on the prints or let them as is?
[Magisk] zgfg:
I'm pretty sure that taking logcat for PIF was explained in the FAQ post

Anyway, from the Terminal Emulator:

su -c killall com.google.android.gms.unstable
su -c logcat -c

# Run your app, maybe clear its Cache (and Data?) before to meke sure it would not use its old PI results

su -c logcat -d | grep PIF

You could also use PC and ADB, then prepend all commands with

adb shell

If needed, google about the commands su, logcat, grep, killall, adb, shell[/Code]
[Magisk] osm0sis:
Magisk doesn't reveal my busybox to DroidGuard/RCS to trigger a failure, but APatch reportedly does; that's definitely not my module's problem. :p
[Magisk] zgfg:
The script has

function f_set_api_25

it will call automatically, and at the end you will have statistics how many PIFs were downgraded to API 25

setApi25=

Turn on the migration:

MIGRATE_JSON="yes"

But you must have the migrate.sh from Fork v9 (in the module's folder) or rename my_migrate.sh from that post there to migrate.sh and put together with pif-test-json-files.sh

If it was not the latest version there, attached here
[Magisk] Captain_Throwback:
I'm not even sure why your busybox module would be needed, since, like Magisk, busybox comes included with APatch.
[Magisk] osm0sis:
Mind opening a thread or keeping all the pif-test-json-files.sh stuff in one post? I'm linking to the Odds thread post you made from my README now under Resources. So if you could make that one have the latest script and gather your super useful instructions tidbits there we're already good to go. 🤞 :)
[Magisk] osm0sis:
As always, included but not accessible from PATH. Anyway, that's beside the previous point here.
[Magisk] D€INOS:
Yup, I have renamed my_migrate.sh to migrate.sh and is together in the same directory as pif-test-json-files.sh along with the other sh.

Had the lastest pif-test-json-files.sh, did some un-comments, watched the mp4 etc.

It's running along fine, haha, unbelievable! :) 🏆
[Magisk] Captain_Throwback:
The issue seems to be that /system/bin/busybox can be called without root. I noticed that my RCS with Gemini has disappeared from my Messages app after installing the Busybox module.

Is it expected that only root processes should be able to access busybox, or is it working as intended?
[Magisk] osm0sis:
Yeah, that's the desired effect of installing any shell utility module, but DenyList or Shamiko, etc. should block DroidGuard or whatever other apps from seeing it. That's where APatch is seeming flaky from the recent reports here.
[Magisk] zgfg:
And one more comment (I was answering while commuting)

Don't test thousand(s) at once. You could exhaust the daily quota for SPIC, PIC or TB Checker (they will start failing with an API error) and then all the PF Json files will be "inconclusive" (they won't be deleted but you will have to test them again)

In that case redefine

TEST_PI=

to another app and run the script again

If you use with

DELETE_FAILED="yes"

then those that failed will be deleted, hence when you run again it will test those that were bot tested, those inconclusive and those that passed

That way you can survive calls that temporarily grab the foreground.

Actually, I had a feeling when I can shortly switch to eg WA, XDA, browser, open something, then switch back to the attestation screen (between the script kicks Test button and before it returns 15 seconds later to grab the screen and 'read' results), without ending with many inconclusive

Test in chunks and shortly search the pif-test-results.txt at the end for INCONCLUSIVE, DEVICE_INTEGRITY, watch the statistics at the end

That way I was able to use the phone in time sharing mode with the script running

At the top of pif-test-results.txt you have

PID=<PId>

You can always prematurely kill the script with

Su -c kill-9 <PId>

from another Terminal Emulator.

However, that way script will not clean-up and you will remain with the last tested (most likely not good) custom.pif.json in the Fork module's folder, and there will be no statistics at the end in the results txt file

I used another small pif-fix.sh script

to clean-up everything - you must have custom.json.bak as a backup copy of your good custom.pif.json in the module's folder, this script will copy/paste the backup over, it will killall GMS and will shortly test are you good again with Device Integrity