yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
I didn't follow your saga; lot of catching up to do 😆, but just for proper understanding, props can't force basic attestation and the evaluationType verdict doesn't refer to this either.

That the on-device fallback to BASIC-only attestation in PIF (this is the primary function of PIF and was needed in USNF/PIF since Google began opportunistically using hardware-backed attestation around January 12, 2021 for all Keymaster 3.0 compliant devices which was mandatory if launched with Android 8.0) was always working (the trigger for that is simply an exception thrown when Play Services attempts to use key attestation caused by the module injecting code into the Play Services process and registering a fake keystore provider that overrides the real one) is evidenced by your achieving PI DEVICE_INTEGRITY simply by setting props...

From September 2, 2021, Google started enforcing hardware-backed evaluation of attestation data in S/N API's backend based on device information. This essentially means that Google began blacklisting some (not all) devices for passing device integrity verdicts, including S/N ctsProfileMatch, when a 'blacklisted' device produces traditional basic-only attestations... HARDWARE_BACKED evaluationType DOESN'T mean that device is no longer sending traditional basic-only attestation measurements, if USNF/PIF is running it will be... NOR does it mean that additional measures are needed for the fallback to basic-only attestation; that USNF/PIF function will still be working fine!

What is does mean is that USNF needed to add a secondary key function, ie. the property (and field) based spoofs required to bypass enforcement of HARDWARE_BACKED evaluationType on Google Play servers... It's this per-device enforcement of the use hardware backed signals for evaluating attestation signals (for PI MEETS_DEVICE_INTEGRITY and S/N ctsProfileMatch) that Google keeps hardening and the spoofs for which we must keep adjusting, nothing to do with the attestation type the device is supplying via GMS/DroidGuard!

Other former USNF and current PIF functions are also essential of course, but they're not unique (eg root hiding and globally setting sensitive props to non-suspicious values).

👀 PW
[Magisk] markdewet:
If I may ask a really newbie question, reading this, are you perhaps saying that one should then install BOTH UNSF AND PIF modules for better results/increased chance of getting better integrity checks? Note, I am asking specifically for the case of Google Wallet not currently working.
[Magisk] osm0sis:
Absolutely not.
[Magisk] markdewet:
Oh OK, then I guess I am stuck with not using Google Wallet. Pity.
[Magisk] pndwal:
Absolutely not...

USNF was originally produced by @kdrag0n. His updates were infrequent however, so @Displax forked it and users were using his builds more often than official for some time, and since 2.4.0 all builds were from @Displax... Next, @chiteroman forked a @Displax build and renamed USNF to PIF. Then when Google began with the recent fingerprint-prop-for-spoofing-purposes 'bans', @chiteroman supplied quick fixes and @Displax hasn't produced any more USNF builds... Since then @chiteroman has pretty much rewritten all the code and due to differences of opinion about various (rapidfire) changes we also have @osm0sis's fork (and his unique custom JSON options for those configuring their own print/prop/field sets) to choose from...

So since the original USNF Devs have ceased development and PIF has taken up the challenge of keeping up with Google shenanigans, the PIF choices above are your only current options.

🤠 PW
[Magisk] osm0sis:
And why's that? Stuck on some unofficial unsigned ROM?
[Magisk] markdewet:
Yes, RisingOS. I'm currently using Magisk with Shamiko and PlayIntegrityFork-v8.
[Magisk] immortalwon:
The problem is there's no guide out there, beside the lineage guide, that properly shows how to sign a rom.
[Magisk] osm0sis:
And that you'd need to build it yourself to sign it. 🫤
[Magisk] markdewet:
Accordoing to the thread, it's based on LineageOS. He even thanks Ivan Meier (LineageOS developer for Samsung SM-G955F, amongst others).
[Magisk] trevtdogg:
I recently got a second hand fitbit watch with NFC for only $50aud, and google seems to have recently rolled out upgrades for fitbit device apps from fitbit pay to google wallet.

works great, and is pretty cheap. a good back up for those with rooted phones that want to keep using google wallet instead of using plastic bank cards.

so far, there's nothing else I personally need device integrity for. I don't use RCS, or any of the apps that require device integrity or strong integrity (although maybe there is still split opinions on if such apps even exist yet?).
[Magisk] osm0sis:
Yep, but if he didn't sign it he didn't sign it. You can ask him to, but if it's EOL then you'll either have to find a new ROM that is signed to switch to or figure out how to build and sign your own. That's just how it is now with the latest check. 😔
[Magisk] pndwal:
Thanks for the details, but yeah, I'd already gathered that... What I meant was is finsky used as some condition for 'throw new UnsupportedOperationException' rather than the code meaning it's actually spoofing to Play Store...

Anyway, are they watching this conversation?... The Finsky code you cited was just removed and hour ago! 👀 PW
[Magisk] HippoMan:
I would be very surprised if it turns out that none of the Googlefrinchians are regularly following this and other similar threads.
[Magisk] pndwal:
What?... I think the ROM is Evolution X... Seems their Devs removed the 'Play Store code' whatever it did... Not sure what that has to do with Google taking an interest in triggering fallback to basic only attestation in a custom ROM. 😜 PW
[Magisk] zgfg:
Just a note - I have moved Hide My Apps for TBChecker from BlackList to WhiteList mode: Then, to be able to Run Play Integrity Check from TBChecker, you must:

- enable Exclude System apps

or

- Use a WhiteList template with the two apps: Google Play Services and Google Play Store (both)

Otherwise, Run PI Check in TBChecker fails with:

Something went wrong

Requires Google Play Services v13.0 or above

Point: Both Play Services (com.google.android.gms) and PlayStore (com.android.vending) must be listed in the WhiteList template.

Assuming, PlayStore is also needed for the PLAY_RECOGNIZED in the Verdict

Point: This does not mean that Pkay Store must be in Magisk DenyList - Play Store does not check for root itself (I never have Play Store in DenyList)

This is just that TBChecker must be able to 'see" Play Store to check for Play Recognized
[Magisk] joeyhuab:
I've removed the spoof for Play store and play integrity still passes. Thanks!

PixelPropsUtils: Stop spoofing Gboard and Play store · Evolution-XYZ/frameworks_base@cae74c1

* Removing Gboard spoof fixes voice search. * Removing Play store spoof for Play integrity as it's not needed according to @osm0sis. Ref: https://xdaforums.com/t/module-play-integrity-fix-s...

github.com
[Magisk] joeyhuab:
Yes. We've been following this thread closely way back and just returned to help find out the solution regarding signed builds.
[Magisk] pndwal:
Store is certainly needed. Both S/N and PI check that it's there, and a while back only a dummy com.android.vending app was needed.Now however, a working implementation is needed for PI verdicts to be evaluated. I put some details re. why here (2nd half):

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89534534

And more here:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89535246

As mentioned in linked posts, the change is that the new environmentDetails field does an appsDetected check for appAccessRiskVerdict which calls for Play Store data to identify all apps installed by Google Play, so it seems the appIntegrity field (incl. PLAY_RECOGNIZED label) isn't the issue/culprit (as it uses server based app data)... If the environmentDetails field's appsDetected check can't access Play Store however, the device is deemed 'not trustworthy enough' for other field verdicts to be evaluated including device integrity... 👀 PW
[Magisk] beardedwonder:
When looking for prints, what should I be looking for in the fingerprint line? Or maybe I should say, what should I be avoiding?

e.g. test-keys, release-keys
[Magisk] zgfg:
Of course it must be release keys

But aming thousand with release keys, you will be good to find one useful for spoofing with PIF - for getting Device Integrity
[Magisk] markdewet:
OK, fair enough, so simple question is LineageOS signed or not? Why I ask is because I tried the same setup (Magisk with PlayInegrityFork-v8 and Shamiko) on LineageOS 21 and same, no Google Wallet. So I'm out of ideas, and no I cannot "build" my own, that is way beyond me.
[Magisk] osm0sis:
Official Lineage is signed.
[Magisk] markdewet:
OK, then why does Google Wallet STILL not work? Am I using the wrong Magisk Modules? A little guidance would really help here.
[Magisk] osm0sis:
You said you're not on official Lineage. So it's almost certainly the signing.

To confirm check the output of:

unzip -l /system/etc/security/otacerts.zip
[Magisk] Kopasz999:
hi.

where i can download the official lineage os ??
[Magisk] markdewet:
OK, apologies let me rephrase my question:

OK, then why does Google Wallet STILL not work even on LineageOS 21 with the modeules mentioned? Am I using the wrong Magisk Modules? A little guidance would really help here.
[Magisk] sawdoctor:
If it's official then it will be on the lineages website

Devices | LineageOS Wiki

wiki.lineageos.org

Not sure if there's any official builds not on the website though
[Magisk] sawdoctor:
Unfortunately if it's not official lineage and it's signed with test keys there's nothing anyone can do unless you download the source and build it yourself signing it with the appropriate keys
[Magisk] markdewet:
Ah OK, NOW I understand, so my ROM is BASED on LineageOS but developed/modified/built specifically for Samsung S8+ by another developer and as such is not signed correctly/at all by the developer. Kinda makes sense now, but even more of a pity.
[Magisk] osm0sis:
I've been trying to give you a little guidance but you still didn't even post the output of the command I requested which would confirm things...

Yes, it's not official unless it's official...
[Magisk] Nergal di Cuthah:
If the ROM's still updating and has a forum I'd petition the developer to sign with private key and release a new version of ROM that's signed.

Sadly this change in PI is likely to kill off alot of EOL ROMs
[Magisk] markdewet:
Apologies, I cannot connect my phone to a PC to run any commands on it, the port is faulty, otherwise I would have gone back to stock. I do apologise for that.
[Magisk] Nergal di Cuthah:
Adb via wireless? On my pixel it's an option don't know if on S8+

View attachment 6108713
[Magisk] Nergal di Cuthah:
I don't think you need a pc to run that command and can do it on device with a terminal emulator (i use FOSS called connectbot)
[Magisk] 9varo:
I just wanna say THANKS to the dev.

If you have Samsung, I'll post my phone so u know it works on today:

I have a Samsung A52 4G and installed LineageOS 21 from official website. Flashed Magisk + Zygisk and then the last version of Play Integrity Fix (fork is not working atm).

This passed device and basic integrity! Thanks again to the dev! 😀
[Magisk] zgfg:
I didn't go into the tech details but all that (some discussions last week) inspired me to go into that test - to see that PI requestor app must be able to call not only gms.unstable but also vending to be able to execute the PI attestation

---

Usuallly, we (brw, you + the other two per HMA Guide on GitHub 😁, one of them is unfortunately lost in time and the other is an XDA ex-pat) simply enable HMA in blaclist mode for TBChecker - to hide Magisk app and LSPosed apps. That way vending (Play Store) and gms (Play Services) are not hidden and TBChecker can also successfully execute the PI attestation

Alternatively, some people (also, you three in the guide) enable Whitelist mode but by excluding all system apps - then again, Play Store and Play Services are not hidden from TBChecker and TBChecker can still test PI

The guide is ok but the third case (not covered there) is actually of interest here:

Only with Whitelist mode but without excluding (all) System qpps, one must precisely pin-point which apps must be excluded to let TBChecker be able to call the PI Attestation - and the experiment was to prove that indeed, both Services AND Store have to be excluded (from whitelist hiding)

In fact I wanted to be sure about the following:

- that the requestor app (TBChecker) must call ITSELF the Play Store to obtain Play Recognized

- ie, that gms.unstsble does not provide a turn-key solution for the complete PI test, incl. also its internal call to Play Store to obtain the Play Recognized part.

In that case PI attestation would work even with Play Store being hidden from TB Checker, but as shown by experiment, that's not the case

And instead of TBChecker, it can be any 'banking' app that on one side looks for the presence of LSPosed modules (root apps) and on the other needs to test PI
[Magisk] sawdoctor:
Fork is working just as well as the original play integrity fix. The only difference is on the fork you add the fingerprint yourself. If you use the original and the print gets banned then you need to wait for the module to update. On the fork all you need to need is add a new print. Unfortunately there's very few working prints left
[Magisk] nek46:
Greetings from Greece and good month install the last version 15.9.9 it didn't pass , device HTC u ultra lineageOs android 12 thanks.
[Magisk] Nergal di Cuthah:
Make sure you've deleted any pif.json and disabled curl and/or next.

Is your lineageos an official build? If not you need to either 1) petition the ROM developer to securely sign the rom or 2) Compile the rom yourself with it securely signed.
[Magisk] intel_core_i7:
There are reports of Vietnam's government ID app VNeID (Similar to French Identite) requiring locked bootloader today, and bootloader spoofer does not work. Is it another case of app requiring STRONG? Can someone test it out?

App link: https://play.google.com/store/apps/details?id=com.vnid&hl=vi

Apkmirror since app is region locked:

Download VNeID APKs for Android - APKMirror

Download VNeID APKs for Android - APKMirror Free and safe Android APK downloads

www.apkmirror.com

It is strange, since the minimum requirement is Android 5.0 and up + one or 2 Pixel (or AOSP custom rom) user(s) has reported that it runs with unlocked bootloader, so yet to be verified. It happens mostly on Chinese region devices like Xiaomi, and it's reported that it works when bootloader is locked on those. Chinese Xiaomi devices passes STRONG when bootloader is locked just like their Global counterparts.

It now also requires Developer options to be off.

The app is "not mandatory" to use though. I also don't have the app currently installed and I don't have an unlocked device.

Further edit: Tested on my brother's POCO F3 running EvoX A13 (EOL ROM), nonrooted (PI Fail of course) and confirmed not working. He doesn't use the app for anything currently so he's not affected (yet). I won't update his phone since EvoX A14 requires a clean flash, it's his best interest to use the phone as is.

More more edit: Tested on stock Galaxy S5 plus on Android M, bootloader locked, passes DEVICE and app works. Definitely not checking Strong, but the custom check is very advanced and may require DEVICE to work. There are several reports of app successfully running under a rooted environment, though details on how to achieve is not disclosed.

Not mandatory put in quotation marks due to how Vietnamese govt. works. The police are given orders to basically have 100% of citizens to sign up for it so they will try in pretty much every way they can to have you install and make an account. Many were tricked by bad actors calling as the police (real police does call and text you too) to have a fake app installed with accessibility services on and got all of their money taken out of their account, hence the accessibility ban on nearly every banking/government apps. At least I could uninstall it after making an account since it's currently useless (our government IT is pretty much incompetent at everything outside root detection)
[Magisk] markdewet:
I was actually thinking, maybe I could run it through the terminal option in TWRP. Is that possible?
[Magisk] intel_core_i7:
Further testing by some communities claimed that the app has bootloader status checking for Android 8+. This is probably the only instance where the minimum android version required to run is lower than 8 but has a bootloader status check. I would appreciate if someone here takes time to test it, I don't have the optimal device to test this. Thanks for reading.
[Magisk] zgfg:
I doubt many could test - N/A outside your country
[Magisk] sawdoctor:
@intel_core_i7

Maybe give this a try

GitHub - Crazyphil/digitales-amt-liberator: Removes root and bootloader checks from Austrian e-gogernment apps

Removes root and bootloader checks from Austrian e-gogernment apps - Crazyphil/digitales-amt-liberator

github.com

It helped me with an app detecting root even though it's for another country
[Magisk] generalculprit:
You could simply use a terminal emulator as adviced, like Termux

Termux

The main termux site and help pages.

termux.dev
[Magisk] markdewet:
OK, thank you, however, unlike most users here, I am in no way experienced in using things like Termux and also, to be very honest, do not like installing unknown apps on my daily driver phone. So that is why I asked about the terminal option in TWRP. I DO know how to use that and it is already installed, so if I can run the command using that then fine, if I cannot then I am stuck, I guess.

Please try to understand that I am NOT trying to be difficult, I am just VERY cautious about things, at my age.
[Magisk] Vision:
I think this option, is only available from A12+

EDIT: From A11+

View attachment 6109056
[Magisk] markdewet:
I have not yet enabled developer options on the new ROM, as I read that enabling developer options could also cause apps not to work.
[Magisk] zgfg:
If you know how to use cmd and ADB from PC, then there is really no problem to use Terminal Emulator on the phone

However, although Termux is very good (but it sometimes requures experienced users to correctly setup paths, etc), I auggest you to use any simple Terminal Emulators from Playstore

Then type in the command you were asked couple of days ago and check do you have release key

As easy as on the screenshots

Btw, if you really insist on PC and ADB, then you must start with adb shell, hence use the longer command:

adb shell unzip -l /etc/security/otacerts.zip
[Magisk] Vision:
Yeah understand, that is true, some apps refuse to work, but you can disabled again after.
[Magisk] intel_core_i7:
Download VNeID APKs for Android - APKMirror

Download VNeID APKs for Android - APKMirror Free and safe Android APK downloads

www.apkmirror.com

Someone is kind enough to upload it to apkmirror.

Will update app link in original post
[Magisk] markdewet:
@zgfg, Ok, firstly, I am not insisting on using PC and ADB, I cannot, as explained, my USB port on my phone is faulty, I am referring to the actual Terminal option in the "Advanced" setting of TWRP.

Secondly, I have now used the above option in TWRP and received the following response:

Length: 1675 Date: 01-01-08 Time: 00:00 Name" testkey.x509.pem

So I am going to assume that this is the cause of my Google Wallet not working.
[Magisk] generalculprit:
Doesn't ADB require usb debugging? That would need developer options, which he doesn't want. Yet. 😉
[Magisk] osm0sis:
Terminal Emulator/TermOne Plus or Termux don't require adb though. Oh well, you can lead a horse to water..
[Magisk] zgfg:
Of course, ADB requires ADB debugging enabled. But he didn't want/know to use Terminal Emulator (?)

Btw, I always enable ADB debugging, if something goes wrong with Magisk it will be good to have

It's up to you/him/a user. Just different ways to do the same

Btw, I simply use MiXPlorer (with the root geanted - don't tell me there a problem with granting root from the installed Magisk), navigate to that zip file and open (screenshot)
[Magisk] avgogi:
Used to pass device integrity 3 days ago using pif v15.9.8 .

Then it failed, after updating pif v15.9.9 it didnt change(kept failing).

On Checking the form got to know about signed roms .Ran the command unzip -l /system/etc/security/otacerts.zip

Got the following output.

Im using crdroid 7.21 based on A11 since 1 year on poco x3 pro .The rom community is still active and theyve updated to android 14 and im a bit reluctant to update.

So now i have to update the rom in order to pass the device integrity right?

P.s. I also use shamiko (updated that too didnt help)
[Magisk] generalculprit:
You're right, I missread. Sorry.
[Magisk] zgfg:
Yes, testkey is not releasekey (Shamiko, etc, will not help for that)

Also for @markdewet
[Magisk] avgogi:
Thank you
[Magisk] Vision:
About adb, this aShell - a ADB shell on Google Play, work with Shizuku, and I think and with root.
[Magisk] osm0sis:
A bit of common confusion here is that the ROM can still be "release-keys" tagged, but be signed with the testkey, so instead of referring to what's now required for PI as "release keys" we should probably call them "private keys".

E.g. in both scenarios they'll show:

:/ $ getprop | grep build.tags
[ro.build.tags]: [release-keys]
[ro.product.build.tags]: [release-keys]
[ro.system.build.tags]: [release-keys]
[ro.system_dlkm.build.tags]: [release-keys]
[ro.system_ext.build.tags]: [release-keys]
[ro.vendor.build.tags]: [release-keys]
[ro.vendor_dlkm.build.tags]: [release-keys]
:/ $
[Magisk] beardedwonder:
I had to do the same, upgrade because of keys. Everything is working now, just make sure you backup everything!
[Magisk] avgogi:
Will backup though its a bit of a hassle changing rom with 1 year of pics and other data(especially with migrate backups not working when flashing from Android 11 to 14).

Any advise on how to easily backup all apps so that they can flashed again(does titanium backup work with A14)