yashsingh1/xdaforums huggingface dataset:
[Magisk] V0latyle:
One would think with a discovery that significant, it shouldn't have been published....

Let's chill with the language, OK? This thread is already on the staff radar, please don't foster any conflict
[Magisk] Wolfcity:
Please do us all a favor and delete that link.

Thank you.
[Magisk] D€INOS:
Jesus Christ...
[Magisk] Lord Sithek:
Hello and thank you very much for your attention!

I don't mind at all to move my post to the Tasker forum 😊 You may name it as "Tasker profile for testing fingerprints", or add to the title any information that you feel needed 🙂

Still, I feel that leaving here a link to the new thread would be beneficial because I hope that folks from here can contribute
[Magisk] Wolfcity:
He can do it too.....🙏 But hey, it's a free world.
[Magisk] Oswald Boelcke:
Sir, here's the link to you new thread:

PIF Testing helper - Tasker profile for testing fingerprints

Hello Tasker users If you have root access/unlocked bootloader and you want to use Google Wallet or other apps/services involved with Play Integrity, you are most probably well aware of the Play Integrity Fix module (and perhaps of it's fork as...

xdaforums.com

Feel free to leave the link in this thread anywhere you deem it's suitable.

And again a great thanks to my esteemed team mate @V0latyle who initiated this reasonable action.

Regards

Oswald Boelcke
[Magisk] V0latyle:
Again, we don't see any reason to remove links to publicly available files. More to the point there's nothing specific about those dumps that indicates which prints we are using...and we've already discussed at length in this thread the criteria needed to find working prints

As for who can do what, I'm actually not assigned to this section so I can't do anything here, if you see something that you think violates the Forum Rules, please use the Report button.
[Magisk] Wolfcity:
I think this all is a process in motion.

Some things may be ok today but not tomorrow.

However, I posted that it's a "free world". Maybe my humor isn't the best but what I wanted to say was: It's ok by me.

Anyway, thanks for your explanation.
[Magisk] HippoMan:
Tasker is just another utility like PixelFlasher and the script by @osm0sis which can be used to help to obtain usable fingerprints and test them. I don't think we need to isolate questions about using this Tasker utility this from this current thread, any more than we need to isolate questions about PixelFlasher or @osm0sis' utility.

But since there now indeed is a Tasker-related thread concerning this, I posted a comment there concerning this.
[Magisk] wfred:
Frankly, I doubt there will be many willing to invest the time digging through each device with the low average success rate per page.

My concern was G simply deciding to scan widely used depositories and preemptively block everything they contain.
[Magisk] wfred:
I've shared that link with three others who requested help finding builds. Via DM after checking their history to see if they were legit.

It isn't a matter of keeping it secret, it has to do with avoiding publicity and whoever Google may have monitoring this thread
[Magisk] sawdoctor:
Tbh i think they'll just update play integrity to detect mismatched prints
[Magisk] D€INOS:
I don't really believe that at all.

And regarding Google, do you really believe that the gitlab repo I linked wasn't already found through a Google search by one or more Google employees??? It's literally the first result in a reasonable search string.
[Magisk] Nergal di Cuthah:
When they do, XDA will find another way, i have faith.
[Magisk] acwcanada:
I want to give some of my situations here and believe you might find them interesting:-

I have 3 json files which I generated from my 3 old phones, one is a big name and two are Chinese phones which you might haven't heard them before. The 3 json files works with @chiteroman's PIF v14.0, then I switched to @osm0sis's Fork v3, two of them still working fine but one always failed in device integrity. I sent it to @osm0sis for testing. It got passed with his OnePlus 9 and Pixel 8P. As I am testing them with my Pixel 6P, his 8P is on stable version and mine is on QPR2. So we are wondering if Google has something new in the QPR2 thus to cause the difference. Perhaps @osmosis can explain more details in his findings.

Also, my 3 fingerprints which working with @chiteroman's v14.0 are all failed in his Dev1, wondering if this is related with the new "VNDK" as I am not able to locate it in their related build.props.

One more interesting findings is that with my Pixel 6p is not able to pass with @chiteroman's v14.2 but it was worked with his V14.1 before the print got "banned". I am wondering this is also related to the OS? So if you are failed with the v14.2, are you also on A14 QPR2?
[Magisk] ipilcher:
I've spent the last day or so automating the process of creating fingerprint JSON files and testing them as much as possible. Now I'm getting throttled by the Play Integrity API (using the Play Store to check).

Anyone know what the threshhold is that triggers the throttling?
[Magisk] Lord Sithek:
I installed this app but it's difficult for me to say anything about it because I don't know how it works underhood, it doesn't seem to show any info when I tap on it (except a usual Tasker monitor notification, if I grant it access). The command shown on the image looks legit though, as far as my knowledge goes

I'm not sure if it's useful to kill com.google.android.gms... All mentions from advanced users that I remember were saying about killing unstable process. Can somebody clarify?
[Magisk] rseiler:
The way you can tell that it's doing anything is by having a non-working json in place. Test it (fail). Put a working json in place. Run the app. Test it. (Hopefully) pass.

Yeah, about also killing the other process, he said it was more of a "for good measure" type thing, since at least once he found that it mattered.
[Magisk] Strephon Alkhalikoi:
Ehh, at this point I'm gonna exit this rat race. I use my watch far more than my P6P for contactless payments since it's right there on my wrist. Plus it has the unintended side effect of grabbing people's attention. The looks I get when I use my watch to pay range from bewilderment to astonishment.
[Magisk] Claus….:
It feels like pokeman days, you are a rich man :)
[Magisk] Imnoa:
10k in 24hrs
[Magisk] xSnowLeopardx:
Oh, the memories...
[Magisk] V0latyle:
@Oswald Boelcke I think a good compromise to this would be to keep the thread in the Magisk section, given the prominence of this issue. Just my two pesos.
[Magisk] maxmax0:
It's all good man. Sometimes emotions fly high, sometimes people disagree, but we are all on the same team. Anyways, I totally get what you mean!
[Magisk] V0latyle:
This. We really should stop with all the defeatist rhetoric. Google will 'improve' Play Integrity eventually to the point where this current workaround doesn't work anymore. But someone will figure out how to break it, whether if it's improving what we currently have, or finding some other breakthrough. Never underestimate a forum full of people who are hell bent on having our cake and eating it too :LOL::ROFLMAO:
[Magisk] maxmax0:
Yeah I also think the ticket is already there, waiting in the backlog..
[Magisk] Nergal di Cuthah:
Also, why would they wait to do this, we're too little-fish to be being toyed with.

Maybe a malware was trying to use mismatched finger prints and we got caught up in the tsunami.

I do doubt there's a "mr play integrity" (though someone should get dall-e to create one for us). That we're experiencing a simple script or minor AI culling the fp crops.
[Magisk] chiteroman:
Should I add support for reading pif.prop again? I see a lot of users who want this instead JSON.

In the DEV version I can leave it together with JSON in case you want to use it :D

if pif.json ! exist -> read pif.prop
[Magisk] ipilcher:
Huzzah!

After spending several hours over the last 2 days to automate the process of downloading properties files, creating fingerprint JSON files, and pushing them to the correct locations on the phone, I finally managed to find some working fingerprints.

It took an hour or so for me to check 75 fingerprints, due to the need to manually check them on the phone (and one instance where the Play Store was throttled). Of those, 6 ended up working.

My conclusion is that automation (and using dumps, not ROM files) is key. Forget trying to guess what devices might have a working fingerprint, fiddling with API levels, etc. The brute force approach is far more effective.

Special thanks to @ArzZenic for pointing me in the right direction.

Now y'all keep your dirty mitts off my fingerprints. ;)

PS - Please stop calling people who haven't got this figured out yet lazy. This process is frustrating enough without that.

PPS - The truly irritating thing is that I'm not doing anything with my phone that should even be checking Play Integrity. Logging in to the American Airlines app and using my Now for Reddit subscription (through Google Play) should

not

be requiring a security level that was designed for PCI-compliant payment apps! (It's debatable whether PI solving real problems even for those apps, but you get the idea.)
[Magisk] sawdoctor:
Think most of us are using pixelflasher to process build props and create json. So as long as @badabing2003 updates pixelflasher i don't think it matters which way.

I'm still rocking PIF14 with custom fingerprint, if it ain't broke don't fix it
[Magisk] badabing2003:
Do one way and stick to it, don't flip flop.

By now anyone who wants to do custom prints would be familiar with pif.json, and it's not like the two are massively different, if there's someone who can not translate prop format to json manually or through available tools, I question if they should be hunting for prints.
[Magisk] Lord Sithek:
Ok, to then it works, when granted su access
[Magisk] Claus….:
Amen! :)
[Magisk] purgy:
I do wonder how obvious it is on the other end, when it comes to the same device hitting the servers with 10k different fps in a 24hr period...
[Magisk] rseiler:
Some notable changes relevant to us:

Release Release v6.3.2.0 · badabing2005/PixelFlasher

Added Dump Screen XML (uiautomator). With SPIC and Play Integrity Api Checker apps, when they hit quota limits, detect and report. Added Playintegrity testing using Play Store (Developer options ne...

github.com
[Magisk] Iridule:
Took a few hours though,

I have 21 working prints is that good enough for now ❓
[Magisk] Nergal di Cuthah:
Since most custom pif are still on their first print I'd say 21 is more than enough.
[Magisk] rom-g:
IMHO, beyond 10 won't make a big difference
[Magisk] xcl1pse:
bruh mining fps 😂
[Magisk] xSnowLeopardx:
Actually do not like this one.

Gives me two things:

- Finds the first API level and puts the number in

- Finds and puts in the "BUILD_ID"

After trying LOTS of prints, all either have nothing or only basic integrity.

I started to play (pun not inteded) around:

1) Removed "BUILD_ID"

= nothing.

2) Removed "BUILD_ID" + removed the number for API level (so basically "")

= success!

Soooo.... yeah. I don't really like how it doesn't work with the extra fields it finds and enters (or I am f-ing something up big time).

Anyone? (:

@badabing2003
[Magisk] Iridule:
I was wondering if I should cycle through them every few weeks (if they last that long) or just stick to one until it doesn't work... 🤔
[Magisk] Yotoprules:
Could be wrong, but AFAIK it shouldn't get flagged unless a lot of people are using the same print.
[Magisk] Nergal di Cuthah:
While not proven that does seem to be the way the wind is blowing
[Magisk] Iridule:
Btw if a few people need a print and they just can't figure any of this out I can give a few away in pm if that's cool with the mods?
[Magisk] arda99:
check

https://myaccount.google.com/device-activity

for some fun.
[Magisk] chiteroman:
View attachment 6041813

New BootloaderSpoofer zygisk module looks promising 😎

May we pass Strong with this?

(No hooking framework was used, the signature is real and it is NOT spoofed)
[Magisk] iruiz2:
Nice! But probably no love for OnePlus owners like me with TEE broken implementation, right?
[Magisk] chiteroman:
I'm working on it, at the moment only devices with a functional TEE could use it.
[Magisk] arda99:
so this faked a real self-signed locked BL? how could this pass strong PI?
[Magisk] intel_core_i7:
If it's true then the question is already answered, STRONG is never possible with self-signed key
[Magisk] xcl1pse:
I bet the session login was spoofed into another phone when using this module :p
[Magisk] majorfigjam:
Intriguing.

Logging in from Windows suggests that the device I use for 2FA for my Google account has the same manufacturer as the actual device, but shows a device model of similar vintage to the one in my custom json file (which is from a different manufacturer).

That may give some clues as to how Google is currently parsing the fingerprints.

And yes, I've been using the same json for a week now, with no issues with the Wallet. The only apparent side effect is that my phone number can't be verified for RSA chat.
[Magisk] Iridule:
@badabing2003 the new update for PF that adds buildID to the .json breaks integrity on my props once I remove that line it passes again. EDIT...The error is there is no (,) after the API line when processing the props. Adding the , passes even with build ID line. :)
[Magisk] sga999:
I just posted this about 10 minutes ago in the pixel flasher thread. I guess it's good to put it everywhere so everyone sees it.
[Magisk] Iridule:
I don't see anything out of place, it says moto edge which is my phone for every 2fa option...not sure what i should be seeing?
[Magisk] sawdoctor:
I'm seeing a device that isn't mine and definitely isn't the device my fingerprint is from
[Magisk] Iridule:
also using play store integrity checker worked for me once, then it randomly picked some chinese banking app from the play store and looped and never checked again. I cant get it to work again.
[Magisk] Iridule:
don't think that has anything to do with this module or fingerprints, not sure but I would figure out how to remove it. I see only my device and I have tested 45 prints.
[Magisk] majorfigjam:
Likewise. It's as if, for example, someone with an S21 would be reporting they are logged in to an S7, when their json is from an Asus.

And logging in from My Account on the device shows as this device logged in as S7 not S21.
[Magisk] Nergal di Cuthah:
Looks normal to me
[Magisk] badabing2003:
PF, processes the build.prop and extracts the relevant values based on priority preset.

Nothing else nothing more.

No one suggested that the extracted values are guaranteed to pass device integrity,

Some fields sometimes even come out blank, depending on the fed file.

It's up to the use the experiment with combinations of the fields, sometimes you have to actually charge the First API level. Furthermore it's a function of what device is using the donor print.

I have prints that work on one device but not on another from another manufacturer unless I change certain values.

It's just a tool to ease your hunt, not a magic solution.

The missing comma could be an issue, I'll have that fixed tomorrow, but it's so easy to add a comma when editing and pasting, so is changing first API.

Silly mistake, I'll have it fixed tomorrow.
[Magisk] badabing2003:
In pf working space there is a file named coords.json.

If you delete that, it will try to find the coordinates again.

Because there are no known cli methods to invoke these tests, the best that can be done is using uiautomator which is based on elements found on screen and tapping, scrolling, parsing the view ...

Which is not always very consistent and prone to change.

Clicking on the user to get to the settings is the most challenging as there is no consistent pattern to key on.

This is the case with play store, the other 3 are more of less more reliable as there is a single screen to get to instead on several which is the case with play store.

Don't touch the phone when doing the test through pf, make sure the screen does not rotate, portrait always works better.

If you charge screen display size, fonts, delete the coords.json to make sure it does take new measurements.

Usually when it fails it auto deletes so that on next run it learns again, but perhaps you hit a corner case that didn't delete it.
[Magisk] beeshyams:
Wow! Incredibly complex working behind the scenes and user gets such an easy interface 🙏👍

Edit: Typo in your post rains =trains
[Magisk] badabing2003:
Thanks, fixed. Damn auto correct

By the way it's fails not trains in that context.
[Magisk] fbirraque:
Maybe some .EU users come back.

Current xiaomi.eu custom fix doesn't seem reliably when using root + lsposed => report

@chiteroman latest version module also works better for many bank and gov apps.
[Magisk] simplepinoi177:
Sorry if the following has been discussed already, but I can't go through all 120+ pages just to see if it did (side note; amazingly it's been exactly 124 pages in the 2 weeks around Thanksgiving @chiteroman declared that we're to all simply just have to find our own fingerprints...so please don't come at me about it). Nor the very recent developments (ro.build.id & vndk.version). And due to XDA's search limitations, I very well can't search "why does it work in one and not the other".

After grinding for 2 and a half days straight on it, I finally found a working fingerprint! But @chiteroman @osm0sis , I found that while it worked using osm0sis' fork, when I used chiteroman's DEV v1, it would only pass BASIC. I was implementing it using @badabing2003 's PixelFlasher. I'm thinking it might be the "added ro.build.id" & "...vndk.version", and I did find the build.prop did have a ro.build.id and inputted that in, but nothing on "vndk". Could that be it? But now I'm wondering, if it's so important, why can it pass with osm0sis' fork but not the DEV v1.

Sorry how I am truly ignorant of these things and if I'm just talking nonsense that has nothing to do with each other or that's simply not how it works or that's very much missing the point (of vndk or DEV v1)....

I plan on making a thread/guide/discussion that dumbs things down more that should really display how ignorant I am of these things...
[Magisk] Dark_Diver:
I have been successfully using DEV v1 version with custom pif.json for 4 days for now.

My pif.json contains BUILD_ID but doesn't have VNDK.

Earlie I was using previous version of module with the same props, but without BUILD_ID and VNDK.
[Magisk] zeyad_155:
Where is that?
[Magisk] hayvan96:
Probably a Zygisk adaptation of this https://github.com/chiteroman/BootloaderSpoofer
[Magisk] simplepinoi177:
just wanted to update on this...

Went ahead and did the same stuff to my wife's Pixel 7 Pro and found an interesting tidbit...

I used @badabing2003 PixelFlasher's newest version (released the last 12 hours at the time of this post) -- which also included including the build ID and the vndk.version I assume. I allowed it to remain in the custom pif.json file, and couldn't pass DEVICE. I figured I had to reboot or I had copied the wrong fingerprint prop values, but after rebooting and double-checking, it still remained. I figure I would clear data on all the requisite Play services, but I didn't need to do it on my phone. So before that, I figured to change the only thing different between my phone and hers and removed the BUILD ID line, and lo and behold, it passes both!

Just thought you guys or others would like to know (in case it makes a difference both in your programming or others' ability to pass). Again, I'm using osm0sis' fork. Also, again, apologies if this has been covered before (not gonna read however many pages it's been since bringing up build ID...).

CC: @chiteroman @osm0sis
[Magisk] evildog1:
When TEE is broken it means hardware attestation key was lost right? Because the Key attestation app failed to attest keys. Sorry, I'm new to this stuff
[Magisk] titomax82:
For people with lots of working fingerprints in thei pool ... What about selling them? I'm so desperate that I would buy them for a fair price. A commercial transaction of a pool of fingerprints would ensure 2 important things:

1) I would choose randomly the fingerprint from the bought pool, while another buyer would choose another > less same fingerprint around;

2) I wouldn't never share, and in the same way other buyers, what has been paied > again less same fingerprints around.

Win-win solution. What do you think about?
[Magisk] xcl1pse:
Why just why 💀
[Magisk] okij:
So it's not released yet? @chiteroman
[Magisk] osm0sis:
My fork doesn't support BUILD_ID since I have yet to see any prints where it's necessary. It shouldn't make it fail though, just skip that line, so I'll look into that. 👍
[Magisk] uschipower:
When I look for modules for magisk/lsposed to bypass google's safetynet, I found different modules:

- HuskyDG's Safetynet sensitive props v3 from 03/2023 click

- chiteroman's Fix Play Integrity (and SafetyNet) v14.2 from 12/2023 click

- kdrag0n's safetynet fix v2.4.0 from 01/2023 click

- Displax's Universal safetynet fix v2.4.0 Mod 2.0 from 07/2023 click

- Didgeridoohan's MagiskHide Props Config v 6.1.2 from 11/2021 click

I am a litte bit confused.

What are the differences, and when do I need which one I mentioned above.

Thanks.
[Magisk] beeshyams:
Edit: Kdragon, Didgeridoohan

& Displax mods are R.I.P and so is safety net, replaced by Play Integrity Fix, which is what this thread is mostly about

Choose from the others based on their Github explanation
[Magisk] Fishawy:
I can't see your PlayIntegrityFix module installed. Does Bootloader Spoofer replace it?

And what's the difference between both? Or do they need to work side by side?

Lastly, where do fingerprints stand with this? Is custom fingerprint still needed? Are you passing 2 or 3 integrity?
[Magisk] spida_singh:
Great stuff, do you need shamiko with kernelsu?