yashsingh1/xdaforums huggingface dataset:
[Magisk] Lord Sithek:
I'm sure it was discussed here but truly, it's so difficult to find in this flood of messages 😕 So if you don't mind, kindly remind me, please what are the requirements for custom props to get them working with pif.json?
[Magisk] purgy:
I'm on v0.118.0, possibly from GitHub?

It seems though I'm missing a lot (most?) of the useful content.

11-28 10:00:59.088 14972 18874 D PIF/Java: DroidGuard de tected ! 11-28 10:00:59.329 14972 18874 D PIF/Native: [ro.build.v ersion . security_patch] -> 2018-07-05 11-28 10:00:59.332 14972 18874 D PIF/Native : [ro.vendor. api_level] -> 25 11-28 10:00:59.383 14972 18874 D PIF/Java: DroidGuard de tected! 11-28 10:00:59.385 14972 18874 D PIF/Native : [ro.product .first_api_level] -> 25

It seems vs pif.prop in 13.3 there's a fair bit missing
[Magisk] whatsisnametake2:
what's your root and module setup?
[Magisk] sawdoctor:
I'm on pixel fold QPR2 beta 1.1 rooted with magisk canary. I have shamiko instead of deny list and PIF.
[Magisk] Nergal di Cuthah:
Done and successful

Yup that was my issue, i thought it pulled from existing log not live log, as soon as i pi checked in playstore, with grep running, i got results. Error was between device and chair...ie me)
[Magisk] UberNorse:
Yes, specifically download Termux from F-droid. Playstore version isn't what you want.
[Magisk] whatsisnametake2:
thanks for the info. which version of pif?
[Magisk] TraderJack:
Yeah, I could use the service.sh, but could just as easily use the MHP. The problem as we both recognize is that it reflects against all apps, which I would prefer not to do.

I have an Lsposed module that targets a specific OS to a specific app for a specific purpose. Perhaps I could fork that and try my hand at fixing it up to be a more generic target. This brings me to another question that @chiteroman or perhaps @osm0sis (or @pndwal) can answer in terms of supplying PIF as a Magisk module instead of as an Lsposed module.

I suppose that Magisk has higher support in terms of everyone has it whereas not everyone is using Lsposed. It is clear that Lsposed can target and change props to a specific app - as I mentioned I have another module that does this. So I am just curious if it is possible to implement PIF's functions as an Lsposed module and if so, is there a reason Magisk is preferable apart from the reason I already mentioned? (and/or might there be any advantages to incorporating it via Lsposed/Zygisk instead)?
[Magisk] 130ryokohama:
I've just gone from PIF v4 to v13 after getting the device does not meet requirements.

previously on PIF v4 I was able to pay via google wallet despite it saying it doesn't meet requirements but it corrected itself later.

For PIF v13, it says I meet basic and device integrity but google wallet still says I am not meeting device requirements, do I still need to wait for it to correct itself or do I need to do something specifically?

I'm on a galaxy s21 on Android 12
[Magisk] Juleast:
You have to clear either data or cache of wallet app.

Also, when you experience play integrity changes, you have to make sure you clear data of play services and play store.
[Magisk] BillGoss:
Use logcat -d | grep PIF

And you need to run the command just after your phone has booted or else the PIF log lines will have been discarded.
[Magisk] bobby8921:
No, still not working.

After the agreement of the conditions it loads then it fails to add the credit card.

I already reached my bank and they told me it's about a security issue on my phone
[Magisk] HippoMan:
For me, logcat | grep PIF also works fine.
[Magisk] 130ryokohama:
seems like im able to pay! but google wallet still showing not meeting security requirements
[Magisk] BillGoss:
I'm guessing, Terminal emulator or ADB shell, but not Termux.
[Magisk] HippoMan:
PS: I just realized that I can also just run the following from my desktop machine as soon as the device starts to boot ...

adb logcat | grep PIF

It sits and waits until the device is sufficiently booted, and then I start seeing the logcat output.
[Magisk] osm0sis:
-d literally just means exit after the current buffer, whereas not specifying -d will wait and continue to dump logcat ongoing. `logcat --help` :p
[Magisk] Nergal di Cuthah:
So i won't have to ctrl c it
[Magisk] HippoMan:
Correct.
[Magisk] biTToe:
Have you tried adding the card to wallet from your computer instead? Perhaps then you could access it on your phone
[Magisk] pndwal:
It does. But you'll notice that the device information is present even when the integrity tests fail (eg no network):

View attachment 6037610

So Play Store or Play Protect (actually in Google Play Services traditionally, in separate Google Play Protect Service in newer devices) is just sourcing device information from local (global) properties...

This is because apps can request PI verdicts but can't see/don't controll what Play Services (GMS) sends in device attestation data. For that matter, the returned verdict doesn't contain device identifiers either.

👀 PW
[Magisk] PokemonTotalWar:
Pixel 7 Pro, QPR2, 13.8 and the 2.0 beta don't work for me. They fail CTS on both KSU and Kitsune Magisk.

13.7 still works just fine, though.
[Magisk] kek-mex:
You should continue using it, as long as it works. Did you pass basic and device integrity with the 13.8 version?
[Magisk] 130ryokohama:
I've got the cards added on wallet from a while back but just it says I don't meet requirements although I can actually pay in store
[Magisk] magaedy:
V 13.8 Works on Poco F2 pro , MIUI 14 Stock rooted Android 12
[Magisk] dmenezes:
Started getting this from the gr.nikolasspyr.integritycheck app:

View attachment 6037630

What's a good alternative?
[Magisk] 306bobby:
There isn't one. You aren't passing. Just happened to me as well
[Magisk] zgfg:
Sorry, cannot spend now half an hour to read back and copy you the links to the posts describing the details

Or to summarize and write sane things once again - tomorrow somebody similar would come, won't be interested to read that post and will ask for the detailed answer again for him, for maybe just slightly different question

I'm pretty sure that YOU will find it👍

Beta version of this module from GitHub, script from Osmosis, build prop and related files from the 'donor' phone

And/or, installing few last module versions, testing do they still pass and if they do, looking into the GitHub and extracting spoofs they use (v13.7)
[Magisk] zgfg:
The other apps mention in this thread, SPIC, TB Checker and Developer options in Playstore
[Magisk] dmenezes:
The error message on the screen I attached specifically says it's the checking app making too many calls, so I don't think it's my device not passing.
[Magisk] zgfg:
There are three good alternatives SPIC, TB Checker and Dev Options in PlayStore

Search in PlayStore for the first two

All mentioned several times in this thread
[Magisk] 306bobby:
I thought so too. Updated to the latest release released 19 hours ago, reset google play services, and it worked fine again passing both basic and device integrity. One alternative I tried when it broke failed the device integrity, so I assume this is google's way of blacklisting
[Magisk] 306bobby:
Yes, won't fix the base issue
[Magisk] Lord Sithek:
Honestly it would be easier for you to copy/paste the previous post than to write all that answer. But OK, I understand your point

EDIT: To be precise - I was not asking about how to EXTRACT spoofs, this is something I can manage. Just about what REQUIREMENTS are needed for a fingerprint to be a proper spoof
[Magisk] 306bobby:
Try this one. see if it passes. Doubt it will. maybe I'm wrong
[Magisk] 306bobby:
replied to wrong person, see my quote
[Magisk] zgfg:
There is no single post with all details. And things change. And Search in this thread breaks with stupid Neo broke Matrix. And this thread accumulates 6-7 new pages every day...
[Magisk] zgfg:
What was the base issue. Assuming you've updated the module to the latest

If about banking apps, checking with PI API Checked (and getting overquota popup) won't help much (passing PI is just one of prerequisites)
[Magisk] dmenezes:
SPIC only works in Local/Local mode unless I bring up a server, right? And in Local/Local mode it only shows Device s Integrity, at least that I can see... :-/

TB Checker doesn't look like it has source code available, and on Play Store it's flagged as having ads and in-app purchases. Or am I missing something?

Developer options in Google Play, can't find it. Does it require a developer account?
[Magisk] 306bobby:
Base issue is google blocked the profile used 13.7 and below. Google most likely is blocking api requests for that profile, hence a 529 response the app perceives as too many requests. Since why from what I've seen, other apps will show failed device integrity and updating to 13.8 fixes the issue
[Magisk] zgfg:
You really download from PlayStore only the apps that you can find their source on GitHub?

On my rooted phone I use AdAway and I didn't even know that TB Checker pops up ads or so

How about googling for eg:

PlayStore enable Developer Options
[Magisk] pndwal:
An LSPosed module (from Nekogram Dev) has existed for some time but I had little success with it in the past:

Play Integrity bypass

io.github.tehcneko.disablehardwareattestation

• Make your device pass Play Integrity check. Shamiko is required.

Updated at 9/2/23

https://github.com/Xposed-Modules-Repo/io.github.tehcneko.disablehardwareattestation

I tried it as 'SafetyNet bypass'... Not since updated for PI... 👀 PW
[Magisk] zgfg:
v13.7 worked just fine for me recently

When G blacklists a particular spoof that was used in old versions of this module, just update the module to get new spoof - our dev master is always quick to provide the fix and update👍

And overquota popup in PI APIi Checker means exactly as saying, too many users testing with that app at this time (hour, day, last days, don't know how the quotas are applied)

You may have perfectly original, not modded phone with locked BL and official, stock and certified ROM and if you go to test now you will also get overquota popup from the PI API Checker

Overquota does not mean you're failing PI, simply take another checker to make sure are you still passing or failing

Also, if Network is disabled, PI API cannot be checked - different popup, again it's not that PI is failing.

Enable Network and test
[Magisk] dmenezes:
No, but I do try and prefer the ones that have source code available somewhere (not necessarily on GitHub).

> On my rooted phone I use AdAway and I didn't even know that TB Checker pops up ads or so

My phone is also rooted but I don't use AdAway or similar all-around ad blockers out of principle (people/apps/sites putting up ads often needs the ad money to keep offering their services).

> How about googling for eg:

> PlayStore enable Developer Optionsn

I presumed, as it's pretty specialized knowledge, that it would be best asking here first. Sorry to have bothered you.
[Magisk] zgfg:
But googling really helps. And will give you the answer

The other option is to dig in this thread. Or to look for another specific thread about GPay on XDA, where the instructions for enabling and testing PI from PlayStore, Dev Options are described in the OP post #1
[Magisk] pndwal:
This may help: a bit of clarity on basics of how USNF and forks (inc. PIF) work:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89167147

... I recently edited it to keep it current... Includes needed mismatches with Google's prop-based HARDWARE_BACKED evaluationType enforcement lists etc.

Also, see @chiteroman's post for PIF JSON and build prop mapping:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89183109

🤠 PW
[Magisk] dmenezes:
[INFO] Play Integrity API - replacement for SafetyNet

THIS IS NOT A SUPPORT THREAD. For questions and support regarding how to fix your Play Integrity verdicts, see the Play Integrity Fix thread. ⚠️BEFORE YOU ASK A QUESTION, READ THIS POST AND THE FAQ!⚠️ ****Update 12/11/23**** Google has been...

xdaforums.com

It didn't, at least not at first: amid the usual trash that Google has been serving nowadays, the best came up was how to enable developer options (which I already had enabled), not how to use it to check Play Integrity. But please see below

All 168 pages of it? Seriously? 😁 And I had already read through a substantial part of it and didn't find anything like that.

You might have heard that the forum search function is broken and returning some stupid messages about Neo and a broken Matrix...

Thanks, that was useful as it allowed me to reformulate my Google search query and I ended up finding it; here's the direct URL for anyone else reading this and more interested in the proverbial fish than on learning how to catch them: https://xdaforums.com/t/info-play-integrity-api-replacement-for-safetynet.4479337/post-87275863 (search for the part beginning with "How do I know if my device is passing Play Integrity checks?").
[Magisk] Lord Sithek:
Thanks, that's helpful (y)
[Magisk] arda99:
Unless you mean the fake props mismatch all real values...current PIF sends exactly all predefined props. and pretends to be the special non-hardware-required device to pass PI, it's quite different from old USNF mismatch.

Edit: if you mean "mismatch" the full enforcement list, how about "avoid"? "mismatch" sounds like taking a (bad) fingerprint, changing few bytes to "mismatch".

Thanks.
[Magisk] zgfg:
Yes I've 'heard' about, actually I posted that issue about Neo Broken Matrix for Search in this thread to Feedback/Recommendations on XDA theead😁
[Magisk] zgfg:
Ref @osm0sis

Now a distraction from the repetitive questions😁and rather a practical example here

I got getprop log from Huawei Mate 9, phone 2018, Fist API 24

Official ROM, BL never unlocked, passing Device and Basic and not Strong - I expected to be ok for the custom Json

Cannot bother the guy to send me build.props (he could take with MiXplore, no root needed), but log shows all required props, all are present (first choices for Osm0sis script and alternative props with the same values), UTC build is newer so I included Security patch (I tested also without)

Everything looks straightforward, I used my mind as a pre-provedsor for the script😁 (since not having the build prop files) and created the JSON

Tested with v2.0 Beta and old v13.8 Beta, the other custom JSon files work for me, logcat also shows that all 8 values are read from the JSon, replaced and injected but it fails Device Integrity
[Magisk] Lada333:
Works for me, friend. Pixel 6a, A13 stock, PIF v13.8
[Magisk] m0han:
I just have this 'placeholder/notification' or whatever it is called.
[Magisk] highdiver_2000:
No joy. My Citibank app has 6 lines / services (?). Seperately tried HideMyApp too.

So far 2 of the most 'difficult' apps are Citibank and HSBC. HSBC don't even give a root warning. The app just crashes.

Looks like I will have to run the Citibank app on the corporate phone.
[Magisk] Lione2:
13.7 Pass integrity on pixel 7 A14, 13.8 doesn't pass device integrity
[Magisk] Unn113:
Nothing Phone (2) Pong, magisk 26.4, 13.7 module, meets device integrity so I'm staying with it till it works
[Magisk] xSnowLeopardx:
Unfortunately, v13 broke on me today, RIP.

Cleared the necessary things, tried v13.7 and everything is fine again. Will update asap if something changes again.
[Magisk] shoey63:
PlayIntegrityFix_PROPS-v2.0.zip

Pixel 6

Fails device out of the box, HOWEVER basic and device both pass with a custom fingerprint 😉
[Magisk] Vision:
Still v13.3 stable all works, what problems supposedly have this version?
[Magisk] zgfg:
Yeah. Small prints. Didn't bother about
[Magisk] pulpf:
Hello when the contactless payment does not work anymore we can update directly the module play integrity in magisk where you have to uninstall all the modules download it and reinstall it?
[Magisk] xSnowLeopardx:
Probably the same as with v13 before. It works for some until it doesn't. V13 worked for me until today.

I just skipped the other version and went to V13.7.
[Magisk] Yahoo1:
V13.3 stopped working today, v13.7 works fine on my Pixel 7 A14.
[Magisk] Vision:
I use this version because have pif.prop and can change the fingerprint and pass again if google blocked the current
[Magisk] V0latyle:
You can update through Magisk. No need to remove your other modules.
[Magisk] FIERA03:
I'm (as usual) using v13.4-osmod rewritten to a certain ASUS prop, and for the time being it seems that the DEVICE will not be broken

※Unless Big G foolishly moves to a full Hardware Attenstation
[Magisk] miho171:
Android 12 miui 13 Xiaomi 12t Pro stock rom magisk 26.4 - Play integrity fix 13.7 pass basic and device, still able to pay with g wallet. version 13.8 doesn't meet the requirements.
[Magisk] chiteroman:
The branch may no longer be necessary because some users have reported to me that the unstable version works, even on modern devices like a Pixel 8 Pro, so the next time Google gives us a surprise it may release it as a stable version ( v13.9).

But first I'll give it a few tweaks. 😝
[Magisk] V0latyle:
STRONG _INTEGRITY means that there's hardware backed "proof" of basic and device verdicts - the bootloader is locked, the chain of trust to the root certificate is complete and TEE is able to authenticate everything as genuine and unmodified. It cannot be broken or spoofed, provided everything is working as it should - we've only been able to spoof STRONG using "broken" implementations such as Pixel 2

@Ginosius You need to stop checking SafetyNet and start checking Play Integrity. SafetyNet is no longer supported by Google.
[Magisk] Ginosius:
Yes, but I was getting a successful response with Displax' Universal Safetynet Fix v2.4.0-MOD_2.0 before lol :P

But as long as Google Pay and Microsoft apps such as Teams keep on working, I'm happy :)
[Magisk] V0latyle:
AFAIK Microsoft apps do not care about device state unless your administration has Exchange security policies on mobile devices. Glad you got it working though.
[Magisk] Ginosius:
Yes I have the exchange security policies applied for my company.

I'll ignore the safetynet api error for now.

It usually takes a while before apps start reporting problems with device security.a

It's usually Google Wallet/Pay and Microsoft Outlook/Teams which are the first that will block.

I'll give it some time :)
[Magisk] V0latyle:
If you're getting BASIC and DEVICE pass you should be fine.
[Magisk] Ginosius:
Yep, both the safetynet and play integrity check are working again and everything passes except for strong integrity obviously.

Perhaps Google was having problems this afternoon.

So all is good here, working just as fine as Displax' Safetynet Fix Mod :)

Regarding strong integrity, is that something all phones will pass out of the box?

Or only certain Samsung phones, featuring Knox security for example?
[Magisk] zgfg:
All new phones, not-modded (BL locked, stock firmware) should pass Strong Integrity
[Magisk] V0latyle:
All phones with a locked bootloader on original firmware should pass. I don't think Samsung Knox has anything to do with it; as far as I know, even with Knox tripped, the device will pass strong integrity as long as it's on original OEM firmware and the bootloader is locked.

Knox AFAIK is only used for warranty purposes (warranty denied if tripped) and for Samsung specific security functions, although I don't know if it actually prevents anything from working if everything else is original (locked bootloader, factory firmware)
[Magisk] Ginosius:
Thank you V0latyle and zgfg for the heads up.

For now basic integrity covers everything.

Let's hope it will stay that way until a new exploit or workaround has been found.
[Magisk] _MartyMan_:
Nothing passes for me on my OnePlus 9 running v6.1 module with Paranoid Android. Can't take logs sorry. I'll try again with a clean build.
[Magisk] ipdev:
---

Maybe because it is mismatch of shipping level to both "marlin" (24) and "walleye" (26)?

¯\_(ツ)_/¯

Cheers. :cowboy:
[Magisk] pndwal:
Knox has nothing to do with strongIntegrity, but strongbox / KeyMint implementations like Samsung's Turnkey and Google's Titan security-dedicated chips are stronger than original Keymaster implementations... But Keymaster 3+ is the requirement for strongIntegrity...

All modern devices except some with broken OEM keymaster implementations like many OnePlus models till recently, or with other faulty attestation to AVB chain of trust requiring revocation of keys for strongIntegrity like Asus ROG Phone 3...

Google CTS/VTS checks and policing of OEM implementations has doubtlessly become stronger since LV Android 13 (as evidenced by the tough prop based enforcement of hardware-backed verdicts for ALL devices shipping with API/SDK 33+), so revocations should be extremely rare now... 🤠 PW
[Magisk] pndwal:
Nah... marlin and walleye devices never needed a mismatch to pass deviceIntegrity or strongIntegrity, but it seems early batch walleye (P2) actually needed a faked strongIntegrity result to pass that... The shipping level was still set correctly of course, no mismatch; just used to identify early batch P2's...

My theory is that Google tried to mask broken keymaster or other in early batch Pixel 2 walleye devices (seemingly produced with 3 different shipping API/SDK levels) by using shipping level prop to let those with early API level pass strongIntegrity (actually fudge the pass since evaluationType on device was still basic due to the same exception/fallback USNF relies on where keystore is broken) as an exception to enforcement of proper hardware backed verdicts other P2's were subject to on the basis of fingerprint prop... I assume Google though this would make the whole P2 iteration appear to behave the same and that it would go unnoticed, or, since hardware-backed attestation and evaluationType was added to S/N API much later, simply forgot about this intended faking of strongIntegrity...

The introduced fix now seems to be not to use prop based enforcement on any P2's and fix the shipping level override (fake strongIntegrity), so seems the earliest P2s, like so many OnePlus devices, will simply not pass strongIntegrity while later P2 batches will... Nb. that the exception based fallback will still allow locked devices w/ broken Keymaster implementation to pass deviceIntegrity... This is logical, should have been left like that (as with OnePlus etc) in the first place, and fixes the unlevel playing field! 😉

Nb. also, prop based hardware-backed verdict enforcement is not really needed and simply invalidates deviceIntegrity or strongIntegrity verdicts in devices where a means is found to cause a fallback to basic attestation on device... Of course these enforcements can be bypassed easily by spoofing props where B/L is unlocked or custom signed... On many devices like my LV A9 Xiaomi RN8T, there is neither model, fingerprint or shipping level prop based enforcement enabled; evaluationType always says Basic (because this represents server end 'enforcement'), but a fallback to basic-only attestation (USNF currently used an exception based on fake keystore registration but used to simply set a flag which was deemed a bit too obvious) on device is still needed in order to pass deviceIntegrity unlocked.

Seems Google were found out for what appears to be a bit of a deceitful spoof of strongIntegrity for their 'own' 2nd generation Pixel... Of course a broken walleye keymaster was likely HTC's fault (don't think taimen, P2XL by LG had such issues), but OEMs like OnePlus would have no opportunity to fix such bad implementations via a server end spoof... Guess the Google/HTC faux pas may have contributed to using Foxconn for P3 series production.

Anyway, with things back to normal, shipping level prop based hardware-backed verdict enforcement only affects LV 33+ (P7 etc) devices... Earlier LV devices should be left as is, and for 33+ devices there's no good reason to set it lower than 32 AFAICS...

👀 PW
[Magisk] zgfg:
Ok, D+B
[Magisk] _MartyMan_:
Thanks, but still nothing passes. I think it might be something in my configuration.

EDIT: Did a clean flash now it's working, thank you!