yashsingh1/xdaforums huggingface dataset:
[Magisk] chiteroman:
If the key doesn't exist or the value is null or empty, it will use the default of the current device to spoof: https://github.com/chiteroman/PlayI...56ea11b528a04/app/src/main/cpp/module.cpp#L11
[Magisk] ufhfuggh:
Any file fix itegrity support Riru
[Magisk] okij:
So do you think Google could easily patch this method? Otherwise you could as well release it, as it would bring you pride, honor and donations... 😎

Sh*t, that's one of the few fp that I mined. Now I'll already mark it as burned. :cry:
[Magisk] Vision:
For anyone who asks, The new Bootloader Spoofer mentioned by @chiteroman is not planned and is private, how we will learn more knowledge now. Democracy is died 👀 the only positive thing is that we learned that there is a way to get through it and get Strong

View attachment 6043890
[Magisk] Imnoa:
What has democracy has to do with someone not willing to share the code he developed?

If he shares the code there is a big chance Google wil fix whatever he uses to pass strong integrity ruining it for everyone.

I completely understand he's not willing to share his code he put his time and effort in just to have it ruined within days or weeks and then having dozens of people begging him for a fix or support
[Magisk] Vision:
Yeah in one part i agree, in other not show us the cure and after take it, and write this and, and I assumed he was making it for the public. Sorry my mistake

View attachment 6043895
[Magisk] Imnoa:
He developed a way to spoof a locked bootloader, he deserves bragging rights lol
[Magisk] HippoMan:
PIF is dead.

Long live PIF.
[Magisk] Vision:
Now talk it right, i agreed with that, if @chiteroman in first place had he say (I have figure a new way to pass Strong but its private), not have problem but write it more info and i think is for public and make me little confused, and because of this and plus i want to learn and test it lol

View attachment 6043900
[Magisk] Claus….:
But why keep the general fp approuch, if the custom print works without getting banned?

What is the strategy?
[Magisk] Vision:
Please if anyone have found any solution like this @chiteroman did it and spoof a locked bootloader (well done), I appreciate if can send me via PM to tell me (I promise not tell to anyone), really i need this with strong, i dont have money to buy another phone (can't relocked my bootloader i need unlock to practice) and i read more apps will use strong after 2024
[Magisk] Imnoa:
Burn valuable prints for people to lazy/incompetent to find their own print.

But on the other side, Xiaomi.eu is using the same print so It will get burned wheter chiteroman uses it or not, might as well help some people with it
[Magisk] DivintyQQ:
It's for people that can't find their own custom fingerprint. Obviously the less technical types or people that just don't have the time to do it want this approach to continue, but what is the point really, when you can't rely on your card working, because google decided to ban the fingerprint that everyone is using?

The only "long term" working solution is for everyone to find their own prints, unless another approach to circumventing Google's security measures is found. I guess it just takes time for people to accept this.
[Magisk] sawdoctor:
When Displax released strong fix Google blocked it in 2 days so pretty sure they'd do the same again.

Feel sorry for @chiteroman inbox, it must be blowing up with requests for it 😂

Yes but if you do "brag" /share that you've done it then except to be flooded with requests/begging letters to share it as well
[Magisk] immortalwon:
There is no strategy, the custom rom developers / the public version of chit's mod will keep going until the fingerprint train crashes. It almost seems like an inevitable simulation.
[Magisk] immortalwon:
you shouldn't feel bad, someone who openly brags about something very high quality should expect to be spammed by freeloaders. It probably gives him an ego boost, no offense of course.
[Magisk] sawdoctor:
Yes but all parties releasing ready made fixes have to agree to stop burning prints. There's not much point chiteroman stopping burning prints if custom ROM developers are still burning them. At least it's just 1 print now which is good but hopefully they'll agree a maximum/maximum schedule they'll burn
[Magisk] RazielSanchez:
The exact same thing happened to me, it's a problem with the Play Integrity Fix module, it happened to me only after updating it from Magisk, I also thought it had been due to Lucky Patcher or LSposed but I had been able to hide everything without any problem and pass Safety Net until I tried the module here and the verification did not pass... the only solution I could do was to install the Stock ROM from 0, Flash everything with Rescue and Smart Assistant... and install everything from 0 and hide everything, LSposed, Lucky Patcher etc... and stay only with the Universal Safety Net Fix Mod 2.4.0 Mod and ready Pass... Google Wallet working
[Magisk] legendebrune:
Hello @pndwal @chiteroman thanks for the great info and modules that you provide for noobs like me :)

Since you seem to know a lot about widevine, would you happen to know of a method to restore L1 level to Realme devices with unlocked bootloader(in my case Realme GT 2 pro with stock EUEX C.20 android 13 stock ROM)?

Could you point me at the right direction?

Perhaps it would also help others

Thanks in advance,I hope I'm not too far off topic 😊
[Magisk] marcussacana:
XPrivacyLua and LP are the most 2 apps that I want from my rooted phone, there's no way to solve that without uninstall?
[Magisk] Format20904:
@chiteroman, Great work, Just want to find out any chance of taking a look at lineageos ATV ?

stock rom passes Device and Basic but not ATV rom.
[Magisk] pndwal:
Bit OT here, so I've moved response to general Magisk discussion thread:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-88961311

🤠 PW
[Magisk] m0han:
@hermam, The second post after the post you quoted describes the scenario. Surprising that you didn't bother to scroll and read on.

https://xdaforums.com/t/module-play-integrity-fix.4607985/post-88780971
[Magisk] hermam:
I've already seen that. I have a rog phone 3 also the question was to know how you did it ok buddy thanks for the reply anyway
[Magisk] aquino.andres:
Hey gys! I've converted a Motorola X30 pro to the global version (edge 30 ultra) after running these modules on magisk those were my results, so far I have streaming apps problems and 1/3 of my banking apps are working, can you guide me out please?
[Magisk] westruk:
what problems?

what apps?
[Magisk] aquino.andres:
Netflix opens with this error message and won't even load, my banking apps will work if I take the modules off
[Magisk] andrey-seo:
hi what phone are you using and what modules are you using for magisk and lsposed?
[Magisk] chrbur:
Hi. Yes the App opens but WeConnect still detects root. Applist Detector finds nothing. And TB Checker only says that Strong Integrity an Virtual Integrity fails. I use Magisk Canary?
[Magisk] chiteroman:
Bruh, you can't install my module with safetynet-fix, and MagisHide Props Config is obsolete. You should remove safetynet-fix and MHPC modules if you are using my module.
[Magisk] RazielSanchez:
Moto G100 phone, the modules that it occupies were in Magisk:

Shamiko

Universal Safety Net Fix Mod 2.3.1

LSposed

after that in LSposed install the following modules:

Hide My Applist (the most important)

Im Not Developer

Lucky Patcher

very important: in LSposed check the option Protection of calls to the Xposed API in the configuration box, this is so that ruru and TBChecker and other apps do not detect it...

once installed go to Hide My Applist and configure as follows:

enable in settings Hide Module Icon Launcher

Data Insolation: check Vold app data

Create a Black List with all the LSposed modules you have and apply them to the corresponding apps:

Play Store, Google Services, Google Wallet, etc...

important once that is done probably ruru and TBChecker continue to detect HMA and Magisk, for that you must repackage Magisk and with everything configured uninstall HMA, reboot the device once rebooted, return Magisk to normal, install HMA, and in HMA add to Black list the Magisk and HMA app, so once restarted they will be hidden and will pass without problem

Im Use Google Translate, sorry for My bad english
[Magisk] andrey-seo:
thanks for the answer. did you try to do this before flashing?
[Magisk] RazielSanchez:
yes, I did not find the way to solve it without falsh of 0
[Magisk] zgfg:
Does it work ok for you with LP?

Can you pls give URL for

Im Not Developer
[Magisk] RazielSanchez:
Yes, in LP check in Xposed settings Hide Lucky Patcher...

I'm not a developer download it from LSposed but here is the link

GitHub - xfqwdsj/IAmNotADeveloper

Contribute to xfqwdsj/IAmNotADeveloper development by creating an account on GitHub.

github.com
[Magisk] zgfg:
Thx

My results for I am not a developer:

- It hides me Development mode enabled in Ruru

- It does not hide me Debugging mode enabled, neither in Ruru, nor in Momo

Btw, I tested previously and had the same results with DevOptsHide module
[Magisk] sawdoctor:
Notice i said his inbox not the developer 😂😂😂
[Magisk] HippoMan:
I think it's very likely that the spoof of a locked bootloader only works for apps, and not for the Googlefrinchian determination of locked/unlocked bootloader. That's how his exisitng bootloader spoofer works.

Of course, if he actually can spoof a locked bootloader from the Googlefrinchian point of view, then this indeed would be a major milestone ... but I'm not betting on it.

However, I'd be happy to lose such a bet.
[Magisk] intel_core_i7:
he told that he spoofed strong, but you will never know if it's true....
[Magisk] Sven Onderbeke:
Works like a charm, but it fails when I repack/resign an app (and use it with Frida), is their a way to still pass it while doing so?
[Magisk] chiteroman:
Bro I was joking 😂😂😂

Theres no known way to pass Strong, also I told in Telegram that SW attestation private key is useless¹.

Just a bit of trolling 😁

1. Maybe Google uses it to know if it is the real device and not spoofed. But I need one of these devices to test.
[Magisk] Imnoa:
Agreed, they should say something like:

We're gonna burn 10 more prints, after that you're on your own whether those prints last 10 days or 10 weeks.

That gives people time to extract or find their own prints. Two weeks ago I didn't know jack-sh*t about fingerprints and now I have about 30 working prints ready to go when needed.

The information is all here you just gotta put in some time and effort, if you don't...well then enjoy paying with your physical bank card.
[Magisk] chiteroman:
Use ZygiskFrida: https://github.com/lico-n/ZygiskFrida
[Magisk] Vision:
Yeah understand, and according @chiteroman sayed, he actually can spoof a locked bootloader, maybe the solution for pass Strong is more simple and if public it Google banned it after or it's so sophisticated even Google with big compny and trillions cant banned it if he public it
[Magisk] Vision:
Wait a minute, all this is just trolling ? Just got a heart attack

View attachment 6043917View attachment 6043918View attachment 6043919
[Magisk] zgfg:
So, if not present in the custom json file, you push BUILD_ID "NMF26F" from the built-in Asus prints:

#define DEF_BUILD_ID "NMF26F"

static std::string BUILD_ID;

parseJson():
if (json.contains("BUILD_ID")) {
if (json["BUILD_ID"].is_null() || json["BUILD_ID"].empty()) {
LOGD("BUILD_ID is null or empty");
} else {
BUILD_ID = json["BUILD_ID"].get<std::string>();
}

modify_callback():
if (prop == "ro.build.id") {
if (BUILD_ID.empty()) {
value = DEF_BUILD_ID;
} else {
value = BUILD_ID.c_str();
}
}

Wouldn't that affect previously mined JSON files without the two new fields - would they still pass Device Integrity when the module now modifies ro.build.id with the BUILD_ID from another device/FP?

Wouldn't be better to extract BUILD_ID from the FINGERPRINT given in the JSON file or just to ignore ro.build.id in that case in modify_callback()
[Magisk] HippoMan:
Well, just a few minutes ago, he wrote this ...
[Magisk] intel_core_i7:
Bummer. No real changes to PI spoofing soon then
[Magisk] Imnoa:
I'm 99% sure that works locally only, no way Google believes his bootloader is still locked.
[Magisk] Vision:
Yeah i read it and i write this after: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89217938
[Magisk] HippoMan:
Spoofing the existence of the spoof.
[Magisk] Claus….:
Don’t make any sense to do it than, it will just ruin it for everyone including the lazy ones and the ones that are not. Its not helping anyone.
[Magisk] osm0sis:
Yes, as I've said many times, the fallbacks are a bad design idea. You've basically handed Google an easy way to more fully ban this mod again too, by simply enabling ID field cross-checks, e.g. specifically for NMF26F/whatever is in use by the mod.

All the people trying to find working prints will have important things skewed in their testing (like DEVICE_INITIAL_SDK_INT/FIRST_API_LEVEL and SECURITY_PATCH) unless they're sure to override everything with custom values.
[Magisk] Slim2none4u:
Obsessive-compulsive disorder (OCD) is a long-lasting disorder in which a person experiences uncontrollable and recurring thoughts (obsessions), engages in repetitive behaviors (compulsions), or both. People with OCD have time-consuming symptoms that can cause significant distress or interfere with daily life.
[Magisk] osm0sis:
How to properly handle a newly discovered bug in a dependency, by the way: https://github.com/bytedance/android-inline-hook/issues/53

Hopefully there's a quick fix and I can just upstream my ShadowHook submodule, bing bang boom, QPR2 support. 🙂
[Magisk] badabing2003:
That is a bad strategy, I agree with @zgfg and @osm0sis

If I'm using custom print, and I leave out any keys / properties, because I want the system ones to be passed, not hardcoded spoofed ones.

This means that every time your public print hardcoded print gets banned, custom prints will fail as well, because of the fallback to it.

I know you might want to say that I can hardcode those keys in my custom print, yes I can, but that is neither flexible nor scalable.

Nothing from the built-in hardcoded print should be used when using custom print.

My two cents.
[Magisk] beeshyams:
TBH, I don't understand a word about the change or your statement above but what matters to me is I trust you and you will do the right thing
[Magisk] nero10:
same.
[Magisk] xSnowLeopardx:
Damn, I haven't updated in a long time. Went from v14 to this v14.4.

Still rocking that first FP, for 12 days now.
[Magisk] FIERA03:
I have repeatedly appealed to all users to find their own props to prevent further fingerprint "wear" (I've also created pif.json editing manual for Japanese speakers).

But I'm worn out of this. I'll refrain from speaking out because I found a prop that will work for more than 5 years(unless be hard-coded into PIFix or Big G makes drastic changes to the API).

I have been accused of being "selfish" before in Telegram and I'll accept that statement.

Finally, the Big Thank You to chiteroman and osm0sis 🙇🏻
[Magisk] xSnowLeopardx:
Getting called selfish in this context is all good.
[Magisk] osm0sis:
Selfish for the greater good! Not sure how that works, but sure! :p

I'm still on my very first custom fingerprints from a month ago. Proof is in the pudding. 😆
[Magisk] frasca61:
I am not convinced of the solution, I have my imprint that I fished with such effort from the famous site, how long will it last? How many people have downloaded the same imprint?
[Magisk] xSnowLeopardx:
Uh, I don't think anyone here can answer those questions...
[Magisk] bigknowz:
Still using PlayIntegrityFork-v3.zip?
[Magisk] bombadier:
New and improved v4
[Magisk] poulopoulosa:
Wooww great tool I didn't know such thing existed :D

I don't know if it is the right place to ask the question: I have a device which I do a getprop to pull all of the props.

I have placed that into a single file and then used the PixelFlasher to filter the info. However it seems that the props from that fingerprint didn't work (maybe banned)! Do I need to find all list of these files? Is my method wrong?
[Magisk] sawdoctor:
If you Google "android firmware dumps" you find a popular website with 1000s of firmware on them. You can just grab whichever buildprops you want to try from there. There's plenty of guides about best ones to try and most are in system or system/system folder
[Magisk] V0latyle:
spoof your wallet

you're spare parts, ain't you bud
[Magisk] kolouch.petr:
You don't need phone to pay with Pixel watch
[Magisk] HippoMan:
Hmm ... maybe this whole banana-ing of the build props exercise on the part of the Googlefrinchians is just a ploy to help them sell more pixel watches.
[Magisk] DougMG:
Works the same for Fossil and TicWatch as well.
[Magisk] HippoMan:
By the way, which of the Pixel, Fossil, and TicWatch watches is the easiest to manage with regard to tap-and-pay?

By "easiest to manage", I mean ...

(1) Can be used both at Google Pay and Apple Pay sites.

(2) Is the least expensive.

(3) Is easy to use simply to find out what time it is.

(4) Doesn't have a lot of other costly bells and whistles.
[Magisk] badabing2003:
Perhaps your device is not good for passing PI.

By the way you didn't need to do getprop and put that into a file, massage the format ...

In PF device menu, there is an option to get device PIF.
[Magisk] Jaitsu:
So why is it that Google can get into legal hot water over adblock detection via simple web script, but they get off scot-free for snooping around your device configuration while resisting any control by the user as to what information is sent by forcing OEMs to include a hardware security chip they have the keys for and we don't???
[Magisk] DougMG:
As far as easiest to access tap to pay I would say Fossil. You can assign one of the buttons to open wallet without having to go through menus to find it.
[Magisk] Klappp:
Becuase a normal user, not a power user, can easily understand the first practice google is doing but not the second. Only people with unlocked bootloaders and root are negatively affected by what googe is doing.
[Magisk] rodken:
+1

+1

The Pixel Watch also has a double-press side button feature that lets you instantly access your Google Wallet cards, even when the screen is off.
[Magisk] jabennett:
It's spoofs all the way down now. #Spoofception
[Magisk] awarexda:
I decided today to find a FP...

What a nightmare

First, I couldn't install PixelFlasher (python errors and missing dll)

Then I just made 2 of them but I couldn't find ro.build.id at all or vndk

I tried them anyway and of course they failed

I am not so happy with this
[Magisk] okij:
It's actually a goof move

if Google wants it spoof proof. 🙃
[Magisk] simplepinoi177:
How to search & find your own fingerprints [noob friendly]: A Comprehensive Guide w/ tips & Discussion for Complete Noobs (from one)

It seems Google has banned more than 95% of custom fingerprints, so this thread/guide has kind been laid to the wayside. But it's still a great resource to understanding the foundations of fingerprints and all that... This is for any/all utterly...

xdaforums.com

I made a thread for finding & creating custom fingerprints, a comprehensive guide for what worked for me, and discussion for help/assistance on the subject for utterly completely total noobs as I am.

I would’ve liked to keep it in this thread, as it’s the most applicable here, but this thread runs so active and 100 pages in 2 weeks type of pace that it would just get bogged down lost in the fray/pile.

If you are a noob reading through this thread finding yourself overwhelmed or self-conscious to ask questions/seek help, come to this thread! Or any of you experts can direct any non-experts to my thread. Of course, it is completely understandable to bring up noob inquiries here – as this is where all the experts frequent – but if you noobs want to go or experts want to direct to my thread to have a reference for a very comprehensive guide or a slower paced help thread, I would like you to go or experts direct them to my thread.
[Magisk] GabbyWC:
This message was posted today in the Evolution X (Official) Telegram channel.

"Each application that is using Play Integrity API is officially registered with Google. It has been observed that many users often use registered checker apps (Play Integrity API Checker, SPIC, etc) primarily to test if their spoofs are working or not. It's important to note that Google can discern these requests, identifying the specific package names responsible for them. These apps, by no intention of the developers, could potentially be used as honeypots for google. We believe that users should avoid using these checker applications and either use the check integrity function in Google Play developer options, or better yet, send no manual API requests at all and instead search for apps that would otherwise be marked as incompatible (e.g Netflix) if certification fails as a representation of whether you are passing or not."

Do you agree with it? I think that the disadvantage with the Netflix search is that it's more of a reactive method if the user does not keep up with fingerprint bans. By the time that Netflix is no longer compatible with one's device, the system has already noticed the device integrity failure and that requires more steps to correct. I'm currently using a custom fingerprint which has not needed to be replaced yet (and it's one of several that I have).
[Magisk] bleh815:
This is exactly how I verify my status for a while. I found it to be most accurate as certified state displayed in play store settings tends to be outdated when a status regression just occurred recently.
[Magisk] sawdoctor:
What OS are you installing Pixel flasher on?
[Magisk] D€INOS:
If that is part of Googles strategy then it's bad because good luck holding back user for not using these apps for checking their fingerprint. Not gonna happen sadly 😕
[Magisk] badabing2003:
You started very well and I had my finger on the thumbs up, then all went to boom when you suggested to use play store instead.

That's even worse, not only you're be giving away the print you are spoofing to, you be passing your play store login account.

By the way TB checker does not work if you don't sign to Google, so i personally avoid play store and TB checker for mining.

Luckily for us Google has no intention on killing us, all they want is to slow down the blatant abuse (common print), if they wanted to stop us, they easily could, without even resorting to strong integrity.
[Magisk] GabbyWC:
As you seem to have noticed, the Play Protect certification status does not change right away when a device fingerprint fails device integrity. The Play Integrity check in the Google Play app's developer options is what shows the immediate status.
[Magisk] osm0sis:
I mean, they're not wrong. 🤷‍♂️
[Magisk] purgy:
I feel like even manually running an integrity check through play store is a bit of a red flag, what normal person does that at all, never mind x times daily. And getting different results each time?
[Magisk] simplepinoi177:
Is manual API requests that much different than checking in Google Play's developer options? I would think that, while it's two ways to go about it, because it outputs the same result (to the device), it would still come up and possibly "flag" in Google's servers(?) regardless....

Also, I could never get the "server" part of SPIC to ever get working...is that not as minimal risk -- or at the very least less risky than API Checker or Play Store?
[Magisk] Vision:
Yeah, The "Netflix" method that's exactly what i do, the fewer traces the better