yashsingh1/xdaforums huggingface dataset:
[Magisk] Imnoa:
You need to pass Play Integrity, not Safetynet

Play Integrity API Checker - Apps on Google Play

Get info about your Device Integrity through the Play Intergrity API

play.google.com
[Magisk] wcente00:
Can someone show me how to do this on S21 Ultra i tried so may things it doesnt work ...

Whatever i try its with adb shell getprop the same ... :( Even Play Integrity Checks fails
[Magisk] mike.s:
Nope.
[Magisk] sawdoctor:
So many posts on telegram "FFS" "not again" "when will it be fixed" If they used the time spent complaining finding a working fingerprint then they'd have one by now
[Magisk] Vision:
Hi @chiteroman i have the same question as a other user write (if you can answer, i appreciate)

View attachment 6046053
[Magisk] Imnoa:
Why put in effort if you can just complain till it's fixed?
[Magisk] Imnoa:
Find or extract some build.props and use Pixelflasher to convert / place and test them
[Magisk] BrimoFan123:
Should we ask @chiteroman to not release new 14.6 PIF version with hardcoded fingerprint?

It is already detailed instruction written and published how to search and test own fingerprints.

Babysitting for those who don't want find few hours in their life and follow the guide should be terminated. Otherwise we all who did that task would ends with burned own fingerprint which is just not fair as we did the job of searching and testing them.

Just my 2 cents. Or 5.
[Magisk] wcente00:
i got a some FP from other phones which i rooted without getting online but they dont work :( I think my S21 cant do it like that .. Is somebody else using this with an S21 Ultra Exynos?
[Magisk] Joly0:
Ahh, ok. Got you. I pass basic but not device. Anything i can do?
[Magisk] sawdoctor:
Perhaps if @chiteroman would consider leaving it a few days before updating instead of spoon feeding it may give some users the nudge they need to find thier own prints?
[Magisk] Tamsta_T:
@chiteroman will (probably) not release new version if xiaomi.eu will not do it first; if they will, @chiteroman will just copy fingerprint they are using.
[Magisk] sawdoctor:
The phone you are on won't matter unless you are on android 14 beta firmware. Google android firmware dumps and you'll find a website with thousands of firmware to try. Try starting with phones on Oreo
[Magisk] Vision:
Maybe you not passing device certification because you're custom fingerprint is not right

Excellent guide by @osm0sis : https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89189572
[Magisk] zgfg:
Impression, Hollywood 2 - post above
[Magisk] zgfg:
HMA 3.2 or which?

Where is that "shell" setting?
[Magisk] pndwal:
Ah yes... that one... I'd tested again with deviceIntegrity failing as was checking something else... will edit post... PW
[Magisk] zgfg:
Sometimes even you don't recall

And I was surprised that you didn't quote a dozen of old posts about

---

11/31

There is tiny line between a nominator and denominator - only a fraction will understand
[Magisk] pndwal:
Couldn't be bothered...

And told you my photographic memory still needs developing... PW
[Magisk] chiteroman:
More than 3000 downloads, thanks to everyone guys 🥰

I'm still searching a new "exploit" and turn green STRONG veredict ✔ (to report it to Google 😈)
[Magisk] zgfg:
@pndwal, @chiteroman

One thing is interesting

My device is GP Certified and it passes Device and Basic PI

FaceApp reports "device certification cannot be verified by Google Services"

However, logcat does not catch any SNFix call while I'm opening FaceApp and clicking to apply Hollywood 2 filter (but it does when I test Play Integrity by PI API Checker or TB Checker)

logcat | grep SNFix

So, how FaceApp tests Play Integrity (Strong) if it indeed does?

Or, it bypasses PI Fix module and hence it gets Device Integrity failing?

Edit:

And needless to say, I do have PI Fix module installed
[Magisk] chiteroman:
Maybe local attestation, check with BootloaderSpoofer :o
[Magisk] zgfg:
It didn't help. Strange, it claims for "Google services certification"
[Magisk] pndwal:
Haven't checked for a while, but even after Google Play/Wallet was migrated to PI (deviceIntegrity enforced), Play Protect certification still only relied on old S/N ctsProfileMatch with basic only evaluationType... I assume this does now use PI deviceIntegrity, but enforcing strongIntegrity for this would mean old (A7 an earlier) devices, even if running latest Android, as well as many modern OnePlus etc (broken OEM keymaster implementation etc) devices would all remain 'uncertified' even if stock/locked... Of course the deviceIntegrity (or basic S/N) verdict used for this is acknowledged by Google to be a weaker, relatively untrustworthy (not 'strong') device integrity attestation.

So seems they might check Play Protect status directly, but require a 'strongly' attested verification to device certification so cannot rely on the Play Protect indication itself, which is either embedded in Google Play Services or in a seperated Play Protect Service app... Since 'Device is certified ' is essentially the same as CTS/VTS passed as indicated by deviceIntegrity, it follows that the proper (strong) verification they poll is strongIntegrity, also obtained via Google Play Services... The notice appears because the reliable verification (strongIntegrity verdict label) isn't available...

mmm... Interesting exercise...

I had to make several attempts before I could get the call to show... Initially it wouldn't, as for you...

In this:

View attachment 6004241

The first results are from YASNAC and Play Integrity API Checker, then Google Play wallet, surprisingly from Netflix (I had assumed it doesn't bother since the Netflix notice that they rely exclusively on Widevine certification now; maybe they just didn't remove the check, or just want info about user configurations...), a local government app, etc...

The last calls are from FaceApp after I finally cleared it's Data and ran again... It occurred only on initial opening, so evidently the filters use a cached result... Most check for deviceIntegrity, but the Hollywood 2 filter apparently looks for cached strongIntegrity whether or not this is intentional or a bug. (I'm still not sure)...

I imagine the app will poll the Play Integrity API at unknown intervals after it's first run to refresh cached results...

😜 PW
[Magisk] Johnn78:
My device is Poco F3 with official fw & bootloader locked. If I go to recovery in TWRP then in backup option, doesn't exist any persist partition. Anyway, I wonder such exist way to hide root from many apps, if it exists way to hide bootloader from the Google so that to pass Strong Integrity.
[Magisk] zgfg:
Yeah. I cleared the FaceApp Cache but that's not enough. Only upon clearing Data, it checks Play Integrity again

And it will check again after 1 day (minus 2 milliseconds), per the app's log from:

/data/user/0/io.faceapp/files/logs

Spoiler content hidden.

The app posts the obtained PI result to the FaceApp server.

Later, when I reopened the app, in checked from their own server and Trust Level was Medium (maybe indeed Basic and Device but not Strong?):

Spoiler content hidden.
[Magisk] pndwal:
Again, I'm confused... do you have TWRP installed, or are you temp. booting it only?... If it's actually installed (flashed), how is bootloader locked?... Does Poco allow locking with custom keys (like Pixel)?...

Apart from your repeating that B/L is locked, it sounds like it's unlocked!... or why "hide bootloader from the Google so that to pass Strong Integrity"?... Nb, if it's really unlocked, there's no way to get PI strongIntegrity verdict without re-locking...

Also, you probably have no /persist issue either... That's just one reason for failing integrity verdicts when B/L is locked with stock images restored... And you kept saying it's locked. ?!?! PW
[Magisk] chiteroman:
Or hack the TEE 😝
[Magisk] aquino.andres:
Thanks for putting time and efforts into it man!
[Magisk] supermansaga:
somehow it didnt. https://github.com/MustardChef/WSABuilds could you please take a look?
[Magisk] zgfg:
Cont. on the previous answer

Just tested - yes, Netflix also calls PI (or SN), found SNFix in logcat while opening Netflix
[Magisk] chiteroman:
I need more info, which modules do you have installed? Also provide logs with this command:

adb shell "logcat | grep 'SNFix'"
[Magisk] Johnn78:
I have Twrp. By mistake I wrote that it is locked. I wanted to write that it is unlocked. In here: https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/page-28

writes that via USNF 2.0 Test 4 or strongbypass.zip (service.sh) passed the strong integrity and logical they may have unlocked bootloader like me. I tried both ways but none of them worked for me and I wonder if it exists like similar which would work for Poco F3 and such it is prooved that the unlocked bootloader doesn't mean that the failing in strong integrity is certain 100%.
[Magisk] zgfg:
We live in Internet time. You're referring to the posts from July 20 - that was loooong ago

Read in that same thread there what happened just a week later. What Google did. Did people/we continue to pass Strong Integrity with unlocked BL and modded phones?

Read also the OP post #1 in this thread. And on GitHub. Even, open Modules tab in Magisk app - see the screenshot. It's put everywhere to not expect to pass Strong Integrity
[Magisk] chiteroman:
Update v14.6

Release v14.6 · chiteroman/PlayIntegrityFix

Updated fingerprint.

github.com
[Magisk] sawdoctor:
Could you at the very least link to one of the guides for finding a working fingerprint in your release notes? We need to start nudging more people to do it for everyones sake
[Magisk] HippoMan:
"Googlefrinchian" is a play on words based on a reference from the humorous science fiction series called "Hitchhiker's Guide to the Galaxy" from a few decades ago. I and some of the long-term posters to this and related XDA threads have enjoyed making other "Hitchhiker's Guide" references from time to time in our posted messages.

In that sci-fi series, a million or so years ago, people called the "Golgafrinchians" were tricked by their world's leaders into leaving their home planet, "Golgafrinchia", because these leaders wanted to get rid of a bunch of useless middlemen such as used-car salesmen, management consultants, and telephone sanitizers, who contributed nothing beneficial to society and just got in the way.

These middlemen ended up on earth and proceeded to supplant the original natives here, and they are the ancestors of us modern-day humans.

Upon originally arriving here, they continued to follow their useless and less-than-beneficial natures, for example by planning projects such as defoliating the earth's forests in order to attempt to increase the monetary value of the leaves that they had been using as currency since they first got here.

I call Google "Googlefrinchians" as a play on the word "Golgafrinchians" in order to mock Google. Also, since many of the Golgafrinchians were described as useless "telephone sanitizers", I want to apply that very apt characterization to Google, who, after all, are putting us Android rooters and modders through so much grief via their attempts to sanitize our Android smartphones.

I highly recommend checking out the very enjoyable "Hitchhiker's Guide to the Galaxy" series.

Life. Don't talk to me about "life".

42
[Magisk] ldeveraux:
This 100%. I was going to try my hand at a custom fp, went to the front page assuming the guide would be there, gave up.
[Magisk] frank93:
ah, damnit, - sounds plausible. thanks for the explanation. :)
[Magisk] zgfg:
Or vice versa - since his PIF is much older and they later joined the band-wagon with their injector app that similarly spoofs the prints once the previous are burned/banned by G

Or maybe he is now really waiting for Xiaomi.eu - in that case he will put on fire the same FP that was already fired by Xiaomi.eu. If so now, this is clever strategy from him
[Magisk] osm0sis:
Would be curious to know the usage stats for Xiaomi.eu ROMs. By the PIF per-release data, looking only at ones that are released and banned in the same week (i.e. no weekends since Google seems to take those off), it looks like the ban threshold is ~16000-18000.

GitHub Release Stats

Get the latest release stats like download counts, release dates, author on any GitHub project

tooomm.github.io
[Magisk] Jonog:
This must be the most active thread right now.
[Magisk] chrcol:
Is it actually still possible to get play store certified then?

Magisk dev notes indicate its an impossibility, but this thread suggests otherwise.
[Magisk] zgfg:
Seems they are burning the same (Acers) as PIF. It's just the questions who puts on fire first or is it coordinated
[Magisk] zgfg:
Why not, having all the time (ofc, using PI Fork to pass Play Integrity)
[Magisk] osm0sis:
Right but do they have 2000 active users or 7000 active users? That would make the bar something like ~18000-25000.

Very tempted to (temporarily) put a pif.json in my fork zip for science just to see if it lasts purely by virtue of having fewer users currently.
[Magisk] Imnoa:
There is a new update so there will be two or three days of silence now until this FP is banned too
[Magisk] skyler544:
Info:

Phone: S10e SM-G970F

ROM: LineageOS 20

Magisk: 26.1

PIF: chiteroman/PlayIntegrityFix Release v14.5\

PC: GNU/Linux

[Pre-post edit] While I was typing this, the v14.6 update came out and now I'm passing basic and device again. However, I'm sick of this cat-and-mouse game with the fingerprints and I still want to be able to correctly try out fingerprints on my own.

I'm having trouble with the process for making a custom fingerprint work. I've investigated and have followed the guide. Here is how I've been doing it:

Find a ROM or a dump of one (stock images)

Extract the build.prop (helpful info here) if working from a downloaded ROM instead of a dump

Using the python script from here, create a pif.json with the info from the build.prop

Run $ adb push pif.json /sdcard/

In termux, run $ su then # cp /sdcard/pif.json /data/adb/pif.json (there must be a way to just adb push the pif.json straight from my computer to this path, right? but how? even with sudo, I get adb: error: failed to copy 'pif.json' to '/data/adb/pif.json': remote couldn't create file: Permission denied)

Reboot

On boot, a message appears saying that Google Play Services keeps stopping. The Play Integrity Check in the Playstore developer settings results in a message like "Error -17" and "transient error in client device"

What am I doing wrong?

Do I need to add something to the Magisk DenyList?

For the day or two between an update to the PlayIntegrityFix module and when Google bans the fingerprint, I can use Google Wallet, and during that time I don't have Google Play Services and friends in the Magisk DenyList, so my guess is that it's not related to that?

Do I need to clear cache/data of various apps (Google Play Services and co)?

That's never necessary when updating the Magisk module, so I haven't been doing that either.

Something that I haven't considered?

EDIT 1: fix formatting

UPDATE:

The "transient error" / crashing GMS seems to have been indicating an invalid pif.json / custom.pif.json in my case. If this happens to you, try using this script instead of the one I mentioned above. With this approach I was able to use osm0sis/PlayIntegrityFork with a custom fingerprint and am passing device/basic integrity.
[Magisk] osm0sis:
Transient error usually means something weird in your pif.json, e.g. nulls. GMS usually also crashes after this.

I'd probably suggest you use my shell script instead of the Python one, just so I can be confident in what's being created, and I'd probably suggest using my fork so that we're sure there aren't any fallback values, or nulls (fixed in v4), making it to GMS.

If you'd like to PM me I'd be willing to help you test and fix your json.
[Magisk] chiteroman:
Transient error also happens when props doesn't match with props in another partition (vendor, product, system_ext...). DroidGuard also send this info to Google servers, but this props are collected in another GMS process. This may explain why in real phones, "banned" fps still pass Device verdict.

I'm working on a solution.
[Magisk] Yahoo1:
My first custom FP banned today. I was using it since December 6th. It was Acer. 😎
[Magisk] osm0sis:
Is that why the ROMs all also started spoofing to Finsky (Play Store) recently?

Seems like an overall bad idea to make the Play Store think you're on a different device.
[Magisk] osm0sis:
That's what PIF was using, so bad luck I guess. 😵
[Magisk] XAedgeS:
Well, can anyone show me a way on how to integrate this module (or just the way to fix Play Integrity at technical level) into a custom ROM. I know how to build ROM decently (well, enough to have a fully function Pixel 6 oriole running for a few months with update), so any kind of direction would be really helpful.

Also, consider I have my own fingerprint already too, thank you. :D
[Magisk] osm0sis:
Just check out the way EvoX used to do it: https://github.com/Evolution-X/frameworks_base/commit/bc67db6b49fb4791f3141733ff22b11904610cf7
[Magisk] XAedgeS:
Lovely, thank you so much. Porting these shouldn't much of a chore to my ROM.
[Magisk] sawdoctor:
Please don't use mine 😂😂😂😂
[Magisk] rodken:
Only if it's done right, enforcement of PI STRONG_INTEGRITY could be a game-changer for the banking industry.

What remains to be seen is how it all unfolds. Whether we have an elegant upgrade or a comical blunder, it'll be interesting to watch.
[Magisk] sawdoctor:
There is a working xposed apk that spoofs a print, maybe you could modify that
[Magisk] osm0sis:
Yeah it functions exactly the same as PIF now, including pif.json support, but it uses Xposed to hook instead of Dobby/ShadowHook.
[Magisk] Unn113:
14.6 :c
[Magisk] thatsupnow:
No I'm on December A14 stable
[Magisk] skyler544:
Now that I've succeeded in getting a custom fingerprint working, I want to document exactly what I did in order to potentially help the next person. (Thank you @osm0sis!!)

I'm not going to talk about how to install adb or Magisk or anything like that, this is only about the steps that I had to do in order to correctly install a working fingerprint. I can't say if this will work on any other phone than the one I have in my pocket right now, but from my understanding this process should be the same for other phones as well. I am NOT an expert, I just like tinkering. I also can't help you with doing this on Windows or MacOS, though I can't imagine that the process would be very different there.

The parts in monospace represent shell commands / output; I'm using bash here but other shells should work very similarly. The parts in yellow refer to filenames that you need to be very careful to spell correctly.

Now, on to the guide:

1. Carefully read osm0sis guide first!

2. Installing osm0sis/PlayIntegrityFork

* Grab the latest release

* Push it to your phone:

[clock@void] adb push ~/downloads/PlayIntegrityFork-v4.zip /sdcard/

3. Install it with Magisk (in Magisk app, go to "Modules", then "Install from storage" and navigate with the file chooser app to the root of your SD card to pick the file. It will install, then you have to reboot.)

4. Setup a tool for extracting a fingerprint:

* Grab osm0sis shell script from here and place it on your phone. This is what I did:

[clock@void] mkdir ~/s10e

[clock@void] mv ~/downloads/gen_pif_custom.sh ~/s10e/

[clock@void] adb shell mkdir /sdcard/fingerprint

[clock@void] adb push ~/s10e/gen_pif_custom.sh /sdcard/fingerprint

5. Find a ROM or a dump of one (helpful info here if working from a downloaded ROM instead of a dump). This step is likely the most difficult part, and you should refer to osm0sis guide for information about the kinds of ROMs that will be the most likely to work.

* Extract/copy the system/build.prop and name it build.prop

* Extract/copy the vendor/build.prop and name it vendor-build.prop

* Push these files to the phone; they need to be in the same folder as the shell script. This is what I did:

[clock@void] cd ~/s10e/rom-version-here

[clock@void rom-version-here] ls

build.prop vendor-build.prop

[clock@void rom-version-here] adb push build.prop vendor-build.prop /sdcard/fingerprint

6. Now it's time to create the custom.pif.json with gen_pif_custom.sh. This is what I did:

[clock@void] adb shell

beyond0lte:/ $ su

su

beyond0lte:/ # cd /sdcard/fingerprint

cd sdcard/fingerprint

beyond0lte:/sdcard/fingerprint # sh gen_pif_custom.sh

... if all goes well some information about what the script is doing followed by your new custom.pif.json will be output here

beyond0lte:/sdcard/fingerprint # mv custom.pif.json /data/adb/modules/playintegrityfix

beyond0lte:/sdcard/fingerprint # killall com.google.android.gms.unstable

At this point, you will need to check if your new fingerprint works. If you've gotten this far, I assume you know how to do that... ;)

If it doesn't work, you'll have to go back and find a new ROM and start from there. Good luck!
[Magisk] XAedgeS:
Well, I finished one build with the general direction of EvoX commit, update my Pixel, which works perfectly fine now, Play Integrity fixed.

I can have an increment build every 30 mins so not much time loss on my end since I automated the whole process anyway.

Thanks again osm0sis for the tip.
[Magisk] immortalwon:
Great guide, shared to the P.I group as well.
[Magisk] Vision:
My FP dead today R.I.P., so close to month ( 22/11/23 - 20/12/23)
[Magisk] xSnowLeopardx:
RIP
[Magisk] frasca61:
Can you tell us the name and surname of the dead?
[Magisk] Vision:
OnePlus7pro
[Magisk] xSnowLeopardx:
Just tested OP7P from my stock and that one works...
[Magisk] Vision:
You mean pull out the build.prop from OP7P and write it in the pif.json file in your phone you had now and you pass 2/3 ? 🤔
[Magisk] xSnowLeopardx:
One of my 19 stock props is the OP7P. I copied the FP inside the saved pif.json, pasted it PF, tested it and got 2/3.
[Magisk] Vision:
Intesting, now i wonder, why stopped work in my device
[Magisk] frasca61:
I tested this imprint OP7P when I was looking for mine but never worked !!!
[Magisk] mates21:
@chiteroman Please stop sharing more versions with a working print. People are about to lose their prints.
[Magisk] frasca61:
How is it possible that the same imprint work on one phone and not on another? I tested this imprint 8 days ago and on my phone it didn't work ... pixelflasher + chiteroman dev 2
[Magisk] Vision:
Strange :unsure: maybe @chiteroman know it

View attachment 6046142
[Magisk] CZ.Kostra:
There are devices with the same name but different FPs.
[Magisk] osm0sis:
Yeah, to reiterate, fingerprints are of the ROM build, not the device or physical unit.
[Magisk] immortalwon:
It's not just him, custom rom developers are also doing the same thing. Many forked versions of P.I.F doing the same.
[Magisk] Iridule:
I've shared the same print in pm with 13 people nearly 4 weeks ago. It's still good. I think fps are banned by high number of users.
[Magisk] miss:
View attachment 6046148personalized fingerprint basic integrity ok harward ok, but it won't let me put cards in the wallet
[Magisk] Iridule:
Add wallet to magisk deny list...clear wallet data and cache, clear Google Play services. Restart phone. Sign into Google Play make sure device is certified...try wallet again. May give error showing updates to Google Play services but close wallet app and try again...should work.
[Magisk] frasca61:
Then I invite you to publish Pif.json who stopped working, so much now he died but we can control him
[Magisk] miimaa:
If anyone has a few extra working fingerprints and can give me one, I'll be grateful.

I've tried over 120 fingerprints with no goal.
[Magisk] miimaa:
I

I love this forum. Thank you very much to the donors!