yashsingh1/xdaforums huggingface dataset:
[Magisk] chiteroman:
I agree that I release many versions in a row and it can get tiring, but the problem is that I only have one device (POCO X3 Pro) that for some reason that I don't know, no matter what ROM it has, no matter how I compile the module, it will always works perfectly, but then that same module is tested on other devices and oh, the other device has exploded.

I don't have the money to buy devices of different brands to test them and see why in some it works and in others it doesn't and I don't plan to do that either.

What's the ultimate solution? The project is open source and anyone can make their own version...

See? This is why there are so many versions XD

The simplest solution I found is that as you provide feedback I release prerelease versions so you can test that everything works correctly.
[Magisk] williamcll:
Works like a charm to deal with the recent google wallet updates. Though some of my banking apps still need Island to run on instead.
[Magisk] Stillhard:
For me it's still with the same detection problem, reverted to 9.4, 9.3, 9.2 make it normal again, strange right? :D
[Magisk] chrbur:
No problems with Pixel 7 and 7 Pro expect WiFi Call. Is there a problem regarding Play Integrity Fix x.y?
[Magisk] osm0sis:
Wi-Fi Calling on my Pixel 8 Pro is working well on 9.2. I've had it installed since before the device had Wi-Fi or mobile data active during setup though, so it has never had a Play Integrity check fail. 😉
[Magisk] chiteroman:
Uh, maybe the root detection issues are based on CMake build? Very strange because all builds you said are good and didn't have detection root issues are compiled using ndk-build :O

For someone who want to test I made a new prerelease build: https://github.com/chiteroman/PlayIntegrityFix/releases/tag/v9.7

Maybe we should do a list of apps that detect root using my module so I can research 👀👀
[Magisk] magaedy:
based on Dobby or Shadowhook ?
[Magisk] magaedy:
Instapay Egypt app

InstaPay Egypt - Apps on Google Play

With InstaPay, Transfer money instantly 24/7, and pay your bills.

play.google.com

It detects root from v9.5 and 9.6

My configuration for root:

Magisk delta v 26.1 stable with enforcing sulist on whitelist mode
[Magisk] shadyover:
Tested 9.7 and it failed root detection, revert back to 9.3

apps failed for me:

Instapay

BM Online

My Orange
[Magisk] immortalwon:
Your mistake is you are using magisk delta with shamiko, which are known to be incompatible with each other. Switch to magisk alpha.
[Magisk] magaedy:
No, magisk delta v 26.1 (stable) only is working with shamiko and all banking apps are working for me
[Magisk] Noweir:
i am using kernelsu when i use the model after 9.3

https://play.google.com/store/apps/details?id=com.egyptianbanks.instapay

root detect even 9.7 but if i remove the mod the app work and other apps not lol
[Magisk] Homeboy76:
Post in thread '[Discussion] Magisk - The Age of Zygisk.' https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-89116233
[Magisk] shadowillusion:
@chiteroman

If I just using Magisk + latest Zygisk enabled, NativeTest said "Normal" and the bank apps is not triggered.

But when your module is installed, bank Apps is triggering and NativeTest (attachment) said "Property Modified". Any idea how to bypass this? Currently on MIUI14 on Android 13.
[Magisk] simplepinoi177:
I'm betting your prolly running stock everything -- or youd've hit that wall already...

those having a good print (mined) and running all stock seems to be going safe in the long run -- case in point is mine (12/08)
[Magisk] dmenezes:
If by stock you meant the original ROM that came with my phone (in my case, Xiaomi's), nope -- I never run the manufacturer's ROM, always LineageOS (running Official LoS 20 right now).
[Magisk] sawdoctor:
It was a joke same as the competition for the oldest working print.
[Magisk] simplepinoi177:
if this is true (you are on LoS 20), and based off of what you say below

I find it very curious you not being apprised of how things are going in terms of LOS being blacklisted (last couple of pages) but you're still able to pass without changing the identifying name in the code....!

I haven't been able to keep up too well the whole blacklist of custom kernel/ROM, but I was under the impression that LOS wouldn't allow you to pass, even with a working fingerprint; unless you change (hex-edit) things -- maybe the "20" makes a difference? (someone more knowledgeable should be able to confirm)

It's the only reason why I assumed you were all stock, is all....
[Magisk] R3velation:
The LOS vanity string in the kernel version isn't universal across all of its builds. I know that the OP7Pro builds are all clear of the lineage vanity and have been using "pref" for as long as I've cared to check. From what I've read, it looks like its just certain device build maintainers that are using the lineage vanity string, not all of them.
[Magisk] simplepinoi177:
Thank you for the clarifying! I understand a little better having learnt from you a bit and can now comment (maybe even educate) better as well!
[Magisk] Umgak:
It's dependent on whoever is the kernel maintainer for the brand+soc, if they add a CONFIG_LOCALVERSION string it will be detected but many omit this and just cherrypick from upstream + build in LOS features while leaving version string unchanged.

OnePlus 9 Pro is the same, it just uses the Qualcomm Generic Kernel Image (qgki) name. I also found some devs removing CONFIG_LOCALVERSION from their builds in response to PI blacklisting the vanity string.
[Magisk] dmenezes:
Here's the screen resulting from tapping Settings/About Phone/Android Version on my phone, right now (suitably redacted to avoid giving too much info for the Google PIGs):

View attachment 6070351

So, it's LOS 20 alright... I can additionally state it's the official one from my phone, got it straight from download.lineageos.org, and haven't changed anything at the system level besides installing Magisk for rooting, and then adding Chiteroman's PIF module and then my own pif.json file with my self-mined fingerprint...

Oh sh*t... I must have missed that when I went through these pages... 🤦‍♂️

It's indeed passing BASIC+DEVICE, and I haven't changed(via hex-editing or not) anything:

View attachment 6070357

Mystery!!! 🤪
[Magisk] dmenezes:
Not sure whether or not that's the reason for my Xiaomi running LOS20 passing when it theoretically shouldn't, but I don't see anything I would call "vanity" on the output of `uname -a`, and I *do* see a "qgki" embedded in there (not posting the kernel string here to try and avoid making it any easier for the Google PIGs).

Not sure whether that's the case. I will try and ask him, them come back with the result.
[Magisk] Zytrel:
Did you install a recent build for your device? LineageOS started removing the "lineageos" string from their builds. You censored out the Kernel-String in your post, but it feels a tad too short to have the string still included. If that's the case, there you have your answer. ;)

Regards,

Zy.
[Magisk] dmenezes:
Last time I updated was about a month ago, right after the Android security string was bumped.
[Magisk] dmenezes:
Indeed! Thanks for your comment, and please see my next message.
[Magisk] dmenezes:
I searched the developer's Telegram channel and found he had already answered that:

View attachment 6070460

So that's an affirm! 👍👍👍

Thanks @Umgak and @Zytrel for the assist.
[Magisk] Umgak:
If it's a -qgki kernel, there's nothing that posting it will really do to help Google. It's a generic kernel used by many devices from various manufacturers, as well as several custom ROMs. If they blocked -qgki, they'd block millions of legitimate devices immediately.

Unless Google seriously wants to try and scrape new LineageOS boot.img files for the build number string of each kernel build separately and ban them every single week, your kernel string contains no usable info w.r.t. Play Integrity, honestly. Which is good, and what you'd want.
[Magisk] Spartacus500:
I just checked Play Integrity and something is wrong 🤔
[Magisk] :
Try the built-in integrity checker:

Playstore - settings - info. Tap playstore version until you're developer. Then go to general and check integrity in developer options.

And please change that font. You may develop eye cancer. ;-)
[Magisk] Spartacus500:
There is no such function in Android 9.0 Pie 🙂

I like 😍

Test app integrity now then...

- IntegrityAPI - error 😳

- Simple Play Integrity checker - error 😳

- Play Integrity API - error 😳

- Play integrity API Checker - pass 😉
[Magisk] Wolfcity:
That function is in every Playstore app. Read it again:

Playstore - settings - info. Tap playstore version until you're developer. Then go to general and check integrity in developer options

edit: sorry that the screenshots are in german, I'm on a walk.
[Magisk] :
There should be. What is your playstore version?

Obviously. 🥴
[Magisk] chiteroman:
I can't read it with that font... 😂
[Magisk] dmenezes:
Dear sir, the fact that you're a masochist doesn't oblige any of us to be masochists too... 🤪😆😁
[Magisk] osm0sis:
Might actually be part of the problem.

[SOLVED] Google Sans font module makes Google Play Services crash when using Play Integrity Fix and similar modules · Issue #245 · chiteroman/PlayIntegrityFix

I used both this and osm0sis' version of this module and in both cases I face the same issue: Google Play Services crash. When I try to add a card into Wallet or when I tap on the "Google" option i...

github.com
[Magisk] wfred:
Same print since November 21st. Started out as a pif,prop
[Magisk] zgfg:
Everything is possible, sky is the limit:

Playintegrity checker fake.apk

This file has been shared with you on pixeldrain

pixeldrain.com

Enjoy Strong Integrity for your lifetime😃
[Magisk] purgy:
Risky click of the day
[Magisk] mohamedabdalla798:
I tried to hide the root , but nothing seems to works, I can flash PIF 7 directly from twrp and copy the json file, will this works 🤡 ?
[Magisk] zgfg:
Magisk modules must be installed through Magisk app, Modules tab - not through TWRP

Generally, please find the FAQ podt in this thread and carefully read
[Magisk] V0latyle:
Pixeldrain is safe

That being said it's also used by a lot of pirates too so...
[Magisk] Vision:
What with the Shizuku? more apps ingrate it inside. i mean is good? i know is adb soluion (backup,restore etc.)

With Shizuku pass 3/3 ?

Ultimate solution if Google or other apps force Strong
[Magisk] V0latyle:
Google isn't going to force STRONG, it's up to the individual app developers to choose it.

For whatever reason Google doesn't even require STRONG on its own apps
[Magisk] rodken:
My guess is not all Google apps handle highly sensitive data like passwords or payments. Some might just display information or offer basic functionality where lower integrity levels suffice.

Mandating STRONG might unnecessarily restrict users who have older devices or choose not to enable certain security features.

At some point in time, implementing STRONG integrity might actually consume battery and resources.
[Magisk] Vision:
Yeah, true that, and i think my point have base, like you say not Google but app developers
[Magisk] Gungrave223:
I actually did find an area were Google does require STRONG secure in the Wallet App.... If you device security isn't STRONG then you won't be able to use the Wallet digital ID feature....(fyi, the logic here makes no sense.... you can use it for financially transaction but not for your state ID ?)
[Magisk] traversone:
invalid link...
[Magisk] Wolfcity:
Nope.
[Magisk] HippoMan:
You wrote, "... device security is STRONG ..." Is that a typo? Seems like you mean, "... device security is* not* STRONG ..."

Correct?
[Magisk] Gungrave223:
Nope... I can't add my GA drivers license to the Wallet app while my phone is rooted with just "Meets Devices Integrity", However, I do not get any errors when adding my id after unrooting my pixel 8 pro. (sure it could be something else that gets triggered when rooted so 🤷🏾‍♂️)
[Magisk] zgfg:
Could you share for which Digital ID

Probably the given mobile-ID requires Strong Integrity and Wallet just needs to follow up sub-requirements

Do you must have a corresponding ID app installed and that app (either requires Strong or maybe and more likely) detects modifications the other way, like various banking apps (so it appears that only stock ROM with the locked BLcan pass)?

---

Likewise, I had a case with my credit card. Just to enroll, I had to install certain app to my phone - and that app required additional hiding (but trivial, DenyList and HMA did)

Omce enrolled, that app was no more needed. So it was only embarrassing since I had to sign personally in the bank, and I was sitting by the desk and had to make it instantly (and not noticably, with the necessary reboots) to pass that app, that I could enroll the card, sign the papers and get out
[Magisk] YoShake:
I need to grab info about my motorola from build.prop inside stock rom img, as magisk's PIF module didn't create /data/adb/pif.json and file in module's dir contains info about xiaomi phone.

Unfortunately none of extraction tools for windows I had works with newer roms thus could somebody tell me what to use, to get the build.prop file from product_a.img/system_a.img (or any other rom's img file) ?

Would be great to pass integrity check after switching from safetynet 2.4.0 module in magisk.
[Magisk] HippoMan:
You originally wrote in your earlier message that you *CANNOT* add your digital ID when the device integrity *IS* strong.

Based on what else you said in that original message and also what you wrote here, you must have meant that you *CANNOT* add your digital ID when the device integrity *IS* *NOT* STRONG.

This is your exact, original quote from that earlier message: "If you device security is STRONG then you won't be able to use the Wallet digital ID feature"
[Magisk] zgfg:
1) Find and read the FAQvpost. With root, you can grab the props

2) However, no guarantee that with your original props (from the same phone) you could pass Device Integrity.

Indeed, if the prints for you ROM require Strong attesting on TEE (hardware) - then you will never get the Play Integrity attestation to downgrade to Device Integrity and to pass it with the help of PIF and root/zygisk

That's the reason why you need 'fake' prints, ie, from a different phone/ROM that doesn't require Strong attestation on TEE, so that PIF module can kick software attestation (instead of the hardware on TEE) and pass the less strict Device Integrity that is usually enough for the most apps

If you really want to use your original props - unroot, go back to fully stock, lock BL and you will not need any modules or workarounds, you will genuinely pass (most likely) the Strong Integrity with your built-in props
[Magisk] Gungrave223:
And that's why you proofread kids 😅,

Yes, you are correct, I cannot add my GA Id to the Wallet app if device STRONG integrity flag fails...
[Magisk] zgfg:
IMO, the logic here does make sence. This is your REAL ID you can go anywhere and prove your identity

You could even go yourself to the bank, identity you with that mobile ID and ask them to withdraw you a million dollars from your account

Hence IMO, it makes sense to require some strong security (being that maybe even the Strong Integrity) on the phone

If that's your ID:

Real ID Requirements

Real ID Documents you may be required to bring when visiting a Customer Service Center.

dds.georgia.gov
[Magisk] HippoMan:
Yes, if you want to use your mobile device as your official Real ID verifier, you'd probably find yourself having to deal with strong integrity.

This is just another confirmation of my decision to use a hardware wallet containing plastic cards.

And per my (rather pessimistic) world view concerning such matters, I think that more and more app developers will keep switching to strong ID verification, thereby rendering our modded Android devices more and more crippled as time goes on.

Even now, I've found that I can't use the full capabilities of TIcketmaster and Uber Rider if either of those apps detect an unlocked bootloader.

I can get around that problem by using BootloaderSpoofer for Ticketmaster, but that doesn't work for Uber Rider.

And I'm sure over time there will be more and more non-"Real ID"-related apps which will start requiring a locked bootloader.

I wonder how long it will take before McDonald's jumps onto the strong-integrity bandwagon. I mean, it's obvious that we need to know whether people who purchase french fries are who they claim to be. :)
[Magisk] casouzaj:
I just flashed the official LineageOS 21.0 build to my Sony Xperia 1 II (XQ-AT52 variant). I installed Magisk Kitsune Mask, with Zygisk, MagiskHide and SuList enabled, and Play Integrity v15.8, playcurl, and Shamiko v0.7.5 (newer versions complain about unsupported environment) modules . I pass both basic and device Integrity tests. I was able to add all my banking cards back to Google Wallet without any issues. Haven't tried to actually pay with my phone yet.
[Magisk] HippoMan:
Thank you for clarifying, and please don't think I was trying to attack or criticize you.

Yes, we all make mistakes ... sometimes even when we proofread!
[Magisk] Gungrave223:
The issue isn't with the banking cards.... Late last year Google expanded their state ID feature in the Google Wallet app....where depending on what state you living in you can add your driver's license to the Wallet app.
[Magisk] Umgak:
No. Shizuku is just a different superuser interface - most root solutions work by letting an app have access to a root shell, to run commands and parse their output. Shizuku gives more flexible and direct access to a lot of system APIs with elevated permissions, but it's mostly just a tool to make the creation of root apps easier - it won't magically pass Strong for you. You won't pass Strong, with current public methods.

Methods for extracting props from a system image vary based on the update package format. Some use the sparse image format (system.new.dat), many use payload.bin format, some distribute ext4 images.

More importantly, though, it sounds like you're trying to spoof your own device with PIF. That won't work - rooting doesn't actually change your build props, the problem is that your device supports Trusted Execution Environment, a hardware feature which will leak your bootloader state. PIF's job is to block the request to TEE, resulting in Play Integrity having to roll back to a legacy attestation method meant for devices which don't support TEE. Google used to accept that at face value regardless of print, but they've wised up and you now have to use a fingerprint belonging to a device which actually predates TEE in order to bypass it.

Or, for the TL;DR you need to dump an old device, not your current one.

Also, if you wanted to dump your current one, it's just /system/build.prop and /vendor/build.prop which you can easily get with any root enabled file explorer, or just use getprop command in termux/adb.
[Magisk] HippoMan:
Yes. And I'd like to add that Strong integrity doesn't simply mean a lack of detectable root. Rather, a necessary condition for Strong integrity is a locked bootloader. In other words, even without root, having an unlocked bootloader will result in a lack of Strong integrity.
[Magisk] 4sz0m:
I wanted to share a quick thanks to all key members who have been daily interacting in this forum for the past 3 months, and an especially big thank you to @osm0sis, @chiteroman and @badabing2003 for your effort.

Following your conversation has been educational and fun, and since early December when I quietly joined the PIF game (and started checking this forum as a daily habit), I only just recently had to switch to my 2nd print.

For stats: collected 10 prints on 8 Dec, 7/10 still OK. Thank you guys and keep it up!
[Magisk] niko26:
Thanks for the explanation.

Curious... Since wie have root and maybe xposed etc. -thus basically having film control of the device why can't we intercept those calls and/or patch them accordingly so that such tests always validate to true?
[Magisk] zgfg:
Strong integrity prerequisitions are validated on Trusted Execution Environment (hardware based) and TEE signs their blob by private PKI key

This has been discussed in detailes in this thread, with the analysis of the Google official and hackers unofficial documents

If you are not familiar with, please google for TEE, PKI, etc. And search in this thread. Once you really find a back-door in the architecture, please privately communicate to developers

Btw, if you really find a loophole in Titan's TEE, you can also claim for reward from Google

Overview of the Play Integrity API | Google Play | Android Developers

developer.android.com

Btw, PIF intercepts certain calls from the software based Device Integrity attestation but for TEE it goes out of the reach from the root hooks
[Magisk] niko26:
Searching in this thread is a nightmare. 500+ pages and dozens of hits!

Thanks for your explanation.

So Google has the public key to verify that the message has been signed by TEE and there is nothing we can do about it. :( Means it's just a question of time until we lose this race.
[Magisk] Vision:
I update my Xiaomi Poco X3 NFC to A12 MIUI 14 PIF works, the Stretch overscroll feature is bad for my eyes and make me dizzy, anyone know how disable only via magisk module or normal ? If no solution i go back to A11 MIUI 12.5
[Magisk] Matthew3955:
Hello! I tried create and use custom fingerprint with using pixel flasher. I couldn`t pass device integrity, only basic. I use "gett random fingerprint" function and install module from pixel flasher (I use play integrity fork). Fingerprint appeared in /data/adb/modules/playintegrityfix but it not working. And momo show redmi fingerprint but i dont using redmi fingerprint. Is it supposed to be? What I can do for this working?

P.S. Sorry my english
[Magisk] aorifan:
I'm still on v15.5, not sure if I should update it to the latest version though. Everything including bank apps work fine on my phone...
[Magisk] HippoMan:
IMO, if it ain't broke, don't fix it.
[Magisk] CZ.Kostra:
Test the FP from Xiaomi.eu. If DEVICE doesn't pass, then something is wrong with your settings.

Your device's FP display is fine.FP is counterfeit only for DG.
[Magisk] :
Get another fingerprint until you find a working one.

What is your kernel string, what does uname -r say? Take a look at

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] 4sz0m:
I'm on PIF v14.0 since December - it's the print that really matters.
[Magisk] xSnowLeopardx:
Very nice. I am at v14.4 since December. I think v14.X were goated versions.
[Magisk] CZ.Kostra:
PIForks by @osm0sis also work very well.
[Magisk] 4sz0m:
If a module upgrade would be required on my device to ensure continued functionality, I'd of course switch to the latest @osm0sis fork.
[Magisk] Matthew3955:
How I can find out a finger print is working?
[Magisk] osm0sis:
That's because I forked from the sweet spot after PROPS-v2.0 just before v14.0 and then have continued to make things more stable, more futureproof, and better documented. 🙂
[Magisk] CZ.Kostra:
You will pass MEETS_BASIC_INTEGRITY and MEETS_DEVICE_INTEGRITY.
[Magisk] badabing2003:
Like it was advised, test it first with xiaomi print, if it passes, then you're setup is good, and then you'd continue running TheFreeman until you find a passing one, if Xiaomi print fails, then your setup is not good and you need to first focus on fixing that.
[Magisk] xSnowLeopardx:
Appreciate your efforts. I think I won't go towards your fork since it's not really needed right now.

I am still waiting for the moment my FP breaks. Maybe I can check my other FPs - can't be that I have 20 working for months haha.
[Magisk] Matthew3955:
OK but momo not detectet new fingerprint its normal?
[Magisk] Matthew3955:
What`s xiaomi print