yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
I have Xiaomi RN8T w/ global stock MIUI A11... TJW CI Magisk build w/ NB-Zygisk, PIF, Shamiko, LSPosed, HMA...

I also have Mi Pad 4 tablet, but currently don't try to pass DEVICE_INTEGRITY on that... 😉 PW
[Magisk] osm0sis:
Exact same results on the latest beta..😲🫤

Edit: "FIRST_API_LEVEL": "null" works of course, but that's the same "workaround" as setting it to "poop" and not a real fix because I know that's getting sent to Google, which it shouldn't...

The goal should be to have when set to true null or when the fields are missing to not try to replace (at least) security patch or first api at all.

CC @huskydg
[Magisk] arda99:
If there is no first_api_level, sdk version# is used.

common/device-side/util-axt/src/com/android/compatibility/common/util/PropertyUtil.java - platform/cts - Git at Google

This seems not strictly checked, just set it to matching current (fake) android sdk version or lower. For a device released with A9 and updated to A10, using the A10 fingerprint and set first_api_level to 28 or 29 all work just fine.
[Magisk] HippoMan:
Looks like it first checks api_level and then first_api_level, and if both are set, it uses the minimum of the two. So I think that only if they're both missing would it be necessary to choose SDK version.
[Magisk] fbirraque:
The latest Play Integrity v13.8-Beta is the best I already tested.

Just EVERYTHING working flawlessly... Play Store Certified, SafetyNet, Play Integrity, Bank apps, Google Pay (Wallet) e some "other" apps that NEVER WORKED WHEN ROOTED BEFORE.

My suggestion is don`t change anything!

Thank you very, very much... Cheers

- Redmi Note 8T (willow) - Lab Device, EvolutionX (Android 13), Magisk Delta (26401) R6561D823, HMA, LSPosed 1.9.2 (7042) and your awesome Play Integrity 13.8-Beta

EDITED (tested also):

- Poco F3 (alioth) - MIUI.eu Stable (REBUILD v2) 14.0.8.0 (Android 13), Magisk (26401) aa6c7c15, HMA, LSPosed 1.9.2 (7042) and Play Integrity 13.8-Beta. Almost all apps works but I confirm that Magisk Delta reach BETTER results now.
[Magisk] arda99:
but why set it to null? if you don't need it just don't include these 2 lines.

per the code(line 30 and 170)

https://github.com/chiteroman/PlayI...6bea20bff6144a0fffb/app/src/main/cpp/main.cpp

When you set "SECURITY_PATCH":null in json I believe it's translated to "NULL" and finally nullptr. I don't know zygisk modules so maybe this by design or a bug.

And if the "SECURITY_PATCH"/"FIRST_API_LEVEL" line is missing in json, empty "" is set and used, which looks like a bug to me...

But how about just set them in json? the only thing can be omitted is "SECURITY_PATCH", in that case it's on an old fingerprint anyway, set it to "" doesn't matter much. And always set FIRST_API_LEVEL regardless.
[Magisk] HippoMan:
It seems like in some cases, ro.product.name exists, and in other cases, ro.product.product_name exists.

If both exist, then which should be used (assuming they are not equal)? I don't know whether both cases could ever exist with different values, but just in case ... ???

And what if neither exists?
[Magisk] HippoMan:
13.8-beta doesn't crash for me and successfully gives me BASIC and DEVICE integrity.

Nothing 2 OS 2.0.3 (A13) with Magisk Alpha 26401 and LSPosed-Zygisk 1.9.2.
[Magisk] osm0sis:
I tried null because chiteroman told me to. 🤷‍♂️

Yeah, the thing that looks like a bug is the bug I've been describing for weeks. 😝
[Magisk] pndwal:
👍

see note below...

3. Any device where Google hasn't used prints to enforce HARDWARE_BACKED evaluationType verdicts... This can be Keymaster 3 compliant devices (they do seem to have added more and more to their list as they've tested slowly to avoid breaking DEVICE_INTEGRITY on devices that naturally fall back to basic attestation due to bad OEM Keymaster implementation etc, so this pool has gotten considerably smaller) or not... Where Google doesn't enforce hardware backed verdicts, they can still attempt to restrict the use of prints and other props, and it now seems that many prints are cross-checked with other props to try to prevent them working for other devices... See my comment:

eg they blocked Pixel 2 print as used in @Displax USNF 2.4.0 mod 2.0 etc, but it's actually still usable with correct additional prop settings per:

👀 PW
[Magisk] osm0sis:
@pndwal So what's the consensus, use the first API from the fingerprint device (unless >32) now? I'll have to add vendor build.prop back to my script if so. 😅
[Magisk] HippoMan:
... and on my device with 13.8-beta, when anything at all comes back from logcat | grep PIF, it's only the following:

11-26 19:42:20.911 12720 13316 D PIF/Java: DroidGuard detected!
11-26 19:42:20.993 12720 13316 D PIF/Java: DroidGuard detected!
11-26 19:42:20.995 12720 13316 D PIF/Native: [ro.board.first_api_level] -> 25
11-26 19:42:20.995 12720 13316 D PIF/Native: [ro.vendor.api_level] -> 25
11-26 19:42:21.054 12720 13316 D PIF/Native: [ro.product.first_api_level] -> 25
11-26 19:42:21.141 12720 13316 D PIF/Native: [ro.build.version.security_patch] -> 2018-07-05
[Magisk] osm0sis:
You gotta catch it real early after boot to get anything else.
[Magisk] pndwal:
Like I've said for weeks, null breaks stuff now... (Worked with P2 STRONG_INTEGRITY spoof however.) I agree it shouldn't default to that, but still should be an option...

Re.

Of course it's not true 'null', but are you sure Google sees value?... Or actually does send device/system value?... Eg, do you see something like:

11-23 23:41:24.324 7668 7750 D PIF/Native: [ro.board.first_api_level] -> (poop)
11-23 23:41:24.324 7668 7750 D PIF/Native: [ro.vendor.api_level] -> (poop)

👍 Yup... PW
[Magisk] pndwal:
Personally I think it's best... See my response to @badabing2003:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89183200

🤠 PW
[Magisk] BROKEN1981:
V13.3 and no issues. This is the only version that is working for me.

P6P on stock
[Magisk] Nergal di Cuthah:
Are you totally stock (no lsposed no overlays etc), because my p6p, with only this module and systemless hosts, has passed every version except 13.5
[Magisk] osm0sis:
Brilliant! Thanks. Script updated with all this and pif.json output support, and now always includes first API to work around the current module behavior. 🙌

[TOOLS][ZIPS][SCRIPTS] osm0sis' Odds and Ends [Multiple Devices/Platforms]

osm0sis' Odds and Ends -- Misc./Batch Tools, Flashable Zips, Scripts, etc. General Information In a nutshell, I just wanted a single thread to gather links to some of my other, larger projects, but also serve as a spot I could put some smaller...

xdaforums.com
[Magisk] acwcanada:
Pixel 6 Pro with A14 QPR2 beta 1.1, everything works fine with v13.7, v13.8 beta failed device integrity.
[Magisk] pndwal:
@chiteroman

Just a heads up... Per:

I think this statement:

https://github.com/chiteroman/PlayIntegrityFix#about-pifjson-file

should probably read: "You can't use values from many recent devices due these devices having to use a hardware attestation... For some late devices Google doesn't enforce hardware backed evaluationType verdicts, so either build properties from these or older devices may work for your device."

... As I've mentioned, we need to spoof devices where Google doesn't enforce hardware backed evaluationType verdicts at server end, but Google has not enforced such verdicts for a number of devices that use/are compliant with hardware attestation... Eg. Pixel 2 print can still be used as working spoof for other devices but uses hardware attestation. (And it appears this was working at least for later shipments of that device too.)

I presume prints from many (even recent) OnePlus and other devices that naturally fall back to basic attestation due to bad OEM Keymaster implementations will likely be usable too as Google won't enforce hardware backed evaluationType verdicts for these...

👍 PW
[Magisk] osm0sis:
Also the 13.8 included pif.json taimen first API value is incorrect .. Should be 26 not 25.

Gotta say, in general 13.8 does feel pretty much back on track here. 👍
[Magisk] pndwal:
Was he trying to go below the A8 / Keymaster 3 threshold for hardware key based attestation again?... 🤔 PW
[Magisk] bobby8921:
I'm able to use Wallet however I can't add my credit card to it (PIF 13.8).

I tried to add this card with an other phone which is not rooted and has bootloader locked and it worked flawlessly.

Any idea on how to be able to add my credit card on my unlocked rooted Pixel 6 ?
[Magisk] casouzaj:
My wife's Xperia XZ2, running LineageOS 20.0 and with the latest Magisk Delta in SuList mode, had PIF v13.3 installed, and it passed both PI tests. I updated it to the 13.8-beta version, and both PI tests kept passing. Thank you, @chiteroman!
[Magisk] Vision:
@chiteroman someone looking for you

View attachment 6037353
[Magisk] Bec de Xorbin:
v13 only passes MEETS_BASIC_INTEGRITY now. I'll update to v13.7 and check it.

v13.7 works, crisis averted.
[Magisk] beeshyams:
Same here

Thanks @chiteroman

Can somebody please direct me to kitsune installation instructions? I notice there isn't a stable version yet. Is it safe to go with debug version? Just in case the cat does catch up, I want to be prepared

Currently on official Magisk 26.4 with configure deny list having banking apps and Zygisk enabled and app hidden (courtesy those apps)

Thanks for your help in advance
[Magisk] Michaelx9:
I can confirm the same. V13 stopped working today. V13.7 passes device_integrity again. Thank you!
[Magisk] makeyourself:
Long may OEMs continue to completely mess up Keymaster implementations on their new devices then. With any luck Google will never get to a universal Strong Integrity requirement 😁.
[Magisk] HippoMan:
... although even in that case, we'll still have to deal with an increasing number of apps which will cripple themselves or outright refuse to run if STRONG integrity is not in effect.
[Magisk] biTToe:
Go to app info and delete cache and files for wallet. Reboot.

I also have every Google app on my deny list.

This is what works for me. PIF13. 7
[Magisk] pndwal:
Yeah, but, as I've said a number of times now, it's very unlikely Google will flip the switch for that despite providing the means... The banks will flip it... When they're willing to accept the consequences...

🤠 PW
[Magisk] makeyourself:
Why will Google not flip it first for Google Pay then? I missed your previous answers on that so interested to know.

I'd hope that so long as there are a significant number of devices out there with either broken or non-existent (obviously that second category is getting smaller and smaller) Keymaster implementations then individual banks aren't going to want to. It'd push significant numbers of customers (most of whom have locked bootloaders) away.
[Magisk] HippoMan:
Either way, the switch is likely to be flipped, and the questions of who does it and why are irrelevant to me.
[Magisk] Eclipse1991:
Get the latest kitsune apk from github. Then rename it to .zip instead if .apk. Flash it as module, reboot. Rename it to .apk instead of .zip. Install it, delete the shortcut of your "old" Magisk and reboot. Check now on the kitsune magisk if everything is fine. It should. I have changed between really all Magisk Variants in the last 2 days and it worked for me flawlessly.
[Magisk] osm0sis:
Interesting! New blocked print in the ongoing battle I guess! Glad we've got custom pif mostly sorted out again thanks to @huskydg and @chiteroman! 🙌🙂
[Magisk] pndwal:
Further, manufacturer's were basically given a reprieve with Google's design, ie devices with broken Keymaster implementations would fall back to BASIC due to errors (exceptions thrown) and would still be allowed to pass SafetyNet or PI DEVICE_INTEGRITY unless Google blocked that by enforcing HARDWARE_BACKED evaluationType verdicts at server side, and they didn't for do that for Android 12 launch version devices or older...

That changed with enforcement based on shipping level props (first API); from LV A13, the reprieve is over... Stock (locked) LV A13+ devices ALL have HARDWARE_BACKED evaluationType verdicts enforced at server side (read 'are ALL blacklisted for BASIC-only evaluationType verdicts') so if the OEM messed up keymaster implementation now, devices will only pass BASIC_INTEGRITY...

Basically, OEM's can't afford to mess this up any longer... However, in cases where keys are revoked due to a device model being found to be compromised in a way that affects the trust signal of an attestation or if a key is leaked through some mechanism, devices may now be able to be recovered post-compromise by means of new Remote Key Provisioning ... The new scheme (mandated in Android 13.0) upgrades Android attestation...OEMs/ODMss are no longer provisioning attestation private keys directly to devices in the factory, removing the burden of having to manage secrets in the factory for attestation... Google servers now issue keys/certificates...

View attachment 6037432

See:

- https://android-developers.googleblog.com/2022/03/upgrading-android-attestation-remote.html

- https://cs.android.com/android/plat...in:hardware/interfaces/security/rkp/README.md

👀 PW
[Magisk] pndwal:
Wow... I can't believe this was a year ago now...

- https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-87548785

- https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-87550477

- https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-87551789

FWIW, @osm0sis and I both commented on that here recently, but this old stuff should be enough for you for now... 😉 PW
[Magisk] Homeboy76:
This threads OP has "...USE DISPLAX MODULE INSTEAD MINE:..." written in it. I think @Displax is pointing everyone toward his Magisk

safetynet-fix-v2.4.0-MOD_1.3-Aaaaa.zip

module.
[Magisk] sawdoctor:
He's not the one in his op is a newer version that fails device, the version before is the one people need if they are failing device. I know it's easy to find on GitHub just it will save repeat posts asking the same thing
[Magisk] chiteroman:
Updated to pass Basic and Device. Read OP.
[Magisk] Xennet:
Thanks for the update...

But with this update Xiaomi.eu rom doesn't pass both basic and device integrity...

KernelSU latest version

Xiaomi 13 pro

Xiaomi eu rom
[Magisk] chiteroman:
Can you provide logs? Run this command in windows: adb shell "logcat | grep 'SNFix'"
[Magisk] Xennet:
I hope this is what u want...

Very strange... 1st check it doesnt pass both basic and strong... Immediately after the failure within 1 to 2 seconds another check it passes both... But after 5 seconds it fails both again...

Only passes both when checked for the second time within one or 2 seconds after the 1st failed attempt...
[Magisk] Oncet:
Tried it on s22 ultra sm- s908N.did not work for strong integrity.
[Magisk] Oncet:
logcat attached
[Magisk] BioRider:
Google fixed the strong Integrity exploit, so strong will not pass.
[Magisk] zgfg:
Of course, and don't expect
[Magisk] chiteroman:
Xiaomi.eu is a very strange ROM. Their devs don't support rooting so most likely the bug is due to a conflict with the ROM. Wait for fix or try another ROM 😥
[Magisk] chiteroman:
Expected.

Are you using old version of module? Why is it spoofing to walleye product?
[Magisk] Open.Orange:
Same issue here on my OnePlus 10T too 🥲

Here's my logs and screenshot of my device status:

(MagiskHide Props Config v7.0.1-beta by Vithusel is used because my phone is sold in China then I flash official global ROM)

It's an amazing project!!😀

View attachment 5974441
[Magisk] Oncet:
I dont know. I am using dr ketans t10 system rw rom with magisk canary 26105 build. I installed the latest version i.e. v 6.0 from post#2.
[Magisk] Ginosius:
Hi I'm currently on LineageOS 20 with Magisk Delta 26105.

I've did the following:

- Hide the Magisk app by renaming it

- Enable Zygisk

- Enable MagiskHide (SuList enforced)

- Enforce SuList

I've also installed the following two modules:

- Shamiko v0.7.3

- Universal Safetynet Fix by Displax v2.4.0-MOD_2.0

I know this has been asked a couple of times already, but can somebody tell me how this module compares to the Universal Safetynet Fix mod by Displax?

And whats up with the "Strong Integrity"?

EDIT: I now understand what the strong integrity means.

So can I use this module together with Displax' Safetynet Fix mod?

Or should I replace it?

Thanks!
[Magisk] chiteroman:
New version released! Now it will always spoof ro.product.first_api_level to 25 (Android 7.1)

Shoul pass Device (CTS) veredict in all devices with Android +8.0

Set up CTS | Android Open Source Project

source.android.com
[Magisk] chiteroman:
It fixes system bugs in Android shipped with Android 13 and pass Device integrity. Also it should work in all devices with Android +8.0

You can read all info about Play Integrity veredicts in @V0latyle thread:

[INFO] Play Integrity API - replacement for SafetyNet

THIS IS NOT A SUPPORT THREAD. For questions and support regarding how to fix your Play Integrity verdicts, see the Play Integrity Fix thread. ⚠️BEFORE YOU ASK A QUESTION, READ THIS POST AND THE FAQ!⚠️ ****Update 12/11/23**** Google has been...

xdaforums.com
[Magisk] chiteroman:
Disable all Magisk modules, only enable mine (update to new version) and try again.
[Magisk] Ginosius:
Alright I've replaced Displax' Safetynet Mod with this one but now I'm getting an error when querying Safetynet..

View attachment 5974933

View attachment 5974937

Any ideas?
[Magisk] pndwal:
What bugs?... And please say why/how setting shipping level so low helps... 👍 PW
[Magisk] zgfg:
RIP bullhead, no matter if testing with particular PIF version with hardcoded bullhead values or if using v13.5 with custom prop for bullhead or v13.8Beta with custom json

Long live ta____ (omitting the letters)
[Magisk] Gilg@mesh:
13.7 worked fine with P8P, updated to 13.8 and now won't meet device integrity, back to 13.7.
[Magisk] swour:
Can confirm. 13.7 passed device integrity a few minutes ago, 13.8 doesn't.
[Magisk] pndwal:
v13.8 (stable) Latest

• Google banned old fingerprints :(

• This build has hardcoded the fix into Zygisk native libs like v13.0.

• You can't use pif.json or pif.prop files to spoof custom props.

RIP v13.8 (beta) w/ pif.json file to spoof custom props... Such a short life...

... Hope v13.9 (beta) w/ pif.json (or pif.prop) file to spoof custom props comes soon... I guess... 😬 PW
[Magisk] mrmrkmail:
First of all, thanks for your great work, chiteroman and Team. Keep up the fight.

Latest build 13.8 gives me only basic integrity ☹️. 13.8 beta was working great with custom pif.json.

May i asked, if somebody can upload the 13.8 beta here.
[Magisk] olimondo:
I've lost Device_Integrity with this build
[Magisk] rodken:
In the Original Post (OP), click on Dowload Latest Version and search for the beta via his Github under Releases.
[Magisk] UberNorse:
13.8 loses device integrity for me. Magisk 26.4 Pixel 7 Pro. 13.8 beta still working though.
[Magisk] pndwal:
PIF!... The fix that just keeps on breaking disappearing giving...

POOF!... 🥲 PW
[Magisk] wrongway213:
Am I the only one passing with 13.8 stable? Wanted to report it is working for someone since all I see is it's not passing device integrity. Working on Pixel 7 A14 RisingOS November build in case there's anything to glean from that
[Magisk] Vision:
I don't understand, for that it is the new feature pif.prop or pif.json, if Google block the old fingerprint, we write another and pass again, why removed?

View attachment 6037434
[Magisk] AK2H:
v13.8 stable works on Pixel 6a Android 14
[Magisk] HRSE:
Play Integrity Fix 13.8 b72efd6 (I mean the 852 KB version - there's another 76.9 KB version but I haven't tried yet)

Xiaomi Redmi Note 9 Pro Global (joyeuse)

MIUI Global 14.0.3 Stable (Android 12)

GPay 200.1.1

KernelSU 11366

ZygiskNext 4-0.8.1

KernelSU Unmount modules 1.11.2

Process Monitor Tool 2.3

LSposed (Zygisk) 1.9.2

Clear Google Wallet cache.

Clear GPay cache.

Clear Google Play Store cache and data.

Clear Google Play Services (com.google.android.gms) cache and data

Reboot

Check integrity (Google Play Developer mode): only MEETS_BASIC_INTEGRITY

Disable ZygiskNext

Reboot

Enable ZygiskNext

Reboot

Check Integrity (Google Play Developer mode): only MEETS_BASIC_INTEGRITY

Clear Google Wallet cache.

Clear GPay cache.

Clear Google Play Store cache and data.

Clear Google Play Services (com.google.android.gms) cache and data

Reboot

Check integrity (Google Play Developer mode): only MEETS_BASIC_INTEGRITY

I would prefer the dev to publish the new version with a unique name instead of reusing the old name, to avoid confusion.
[Magisk] Lobod:
I'm still passing on 13.7...

But i started failing basic without it...
[Magisk] zgfg:
Unfortunately

@chiteroman has deleted v13.8 Beta with support for custom JSON from GitHub, it's replaced by 13.8 having hardcoded values and not reading Json if you put it to the folder

It worked fine for me and I guess for many others - besides, we have now no other version on GitHub supporting the custom JSON?!

I don't understand why was deleteing was needed - who can please upload v13.8- BETA here, thanks
[Magisk] Lovely_Ribbon:
I think I've finally had enough of this. Back to no device integrity on my Pixel 8 Pro on 13.8. Does anyone know offhand if I remove AdAway host file modifications and flash back to unrooted OTA + lock bootloader will I be back to all green integrity checks (Basic, Device, and Strong) without having to wipe my data? I'm currently on the stock OTA rooted with PixelFlasher.

Edit: Nevermind. I found my answer that locking the bootloader does wipe all data. Welp. Super annoying but that's what backups are for.
[Magisk] chiteroman:
v13.8 updated without custom resetprop, this breaks DEVICE verdict in few devices, idk why.

I updated again and this should work for everyone:

Release v13.8 · chiteroman/PlayIntegrityFix

Google banned old fingerprints :( This build has hardcoded the fix into Zygisk native libs like v13.0. You can't use pif.json or pif.prop files to spoof custom props.

github.com
[Magisk] shkippo:
Same here
[Magisk] zgfg:
You must relock BL and that will do Factory reset - Formatting and Wiping your Data

Btw, it was mentioned elsewhere
[Magisk] Vision:
Here:
[Magisk] shkippo:
This build works with me
[Magisk] giociampa:
I'm getting both Basic and Device integrity with 13.8 (just Basic without) - and for the first time in a while have both Wallet allowing NFC payments, and a bank app (Starling) that seems not to be detecting root (I guess thanks are due to the resetprop changes)

Moto g 5G plus - Havoc 6 (July 15th) - Kitsune (aka Delta) 26.4.01 (build R656426A5)
[Magisk] Vision:
@chiteroman I think all this with resetprop and similar are to comlicated, this module need the simplest, with the best feature pif.prop or pif.prop, so that we can write another and pass again if Google block the old fingerprint, and we not depend at least to add old fingerprint in chiteroman for this. Keep the good work
[Magisk] HippoMan:
I hope! ... but I won't bet on it.
[Magisk] rogers11:
Yes, the "new" 13.8 works for me too. Pixel 7a with LOS.
[Magisk] shkippo:
Great yea me also . Galaxy Tab S6 A10
[Magisk] miho171:
same, back to 13.7 to my miui 13
[Magisk] shkippo:
Try the new build it works with me
[Magisk] HippoMan:
The Googlefrinchian Telephone Sanitizers strike again.
[Magisk] osm0sis:
Okay... Why throw the baby out with the bathwater and remove pif.json again?! 13.8 "beta2" is still working great here with my custom pif.json... 🙄😡
[Magisk] Pirateguybrush:
P8P user here.

This may be a stupid question, but I'm fed up with this constantly breaking (no disrespect to the developer, you're doing a great job and I understand this is Google's fault.

Is it possible to extract the build.prop/fingerprint of a donor phone, and somehow use that with this fix to reduce the odds of tripping safetynet/play integrity, rather than (as I understand it now) everyone sharing the same fingerprint?

If so, could someone knowledgable please write up a guide to this process? I have a P7Pro and a Pixel 1 available, but I'm at the point where I'd go to the trouble of buying a second hand donor phone, extract what I need, then re-sell it to get a more stable experience.

Apologies if this is a stupid question, and huge thanks to chiteroman for all his hard work on this.