yashsingh1/xdaforums huggingface dataset:
[Magisk] drahtwurst:
i did as you showed with your screenshots. thank you. i have only PlayIntegrityFix_v8.7 + 9.0 stored. i tried with both versions. Right now online there are only version from PlayIntegrityFix_v9+ available. would you upload your recommended PlayIntegrityFix version + safetynetfix version combination please. i will try again. thanx
[Magisk] drahtwurst:
what is the best foss/other open source tool to check root?
[Magisk] drahtwurst:
all other critical banking ect. apps work with denylist on. only this on is stubborn :rolleyes:
[Magisk] zgfg:
OP post #1 - what does it say about Strong Integrity?

For additional info, search in the thread

PS: If not clear, Google patched the bug on their side
[Magisk] excogitation:
Yes. Pass first two on OnePlus 8t.
[Magisk] Rayeski:
Thank you so much for your info
[Magisk] Depressed T.Bear:
Which banking app if I might ask? From the starfinance group?
[Magisk] banerni:
Hello,

I use Lineage OS 20 on my Samsung S10e.

I use Magisk delta canary, Zygisk, Lsposed, Shamiko, Play Integrity Fix v9.2, HMA.

All banking apps work, except epa electronic patient record apk.

It detects root!

Any suggestions?
[Magisk] pershoot:
Perhaps try Shamiko.
[Magisk] banerni:
No success with Shamiko either. Have you tried it yourself?
[Magisk] H4R0X:
Did that, bricked my phone, oh well...

Doens't even boot loop, just shows the boot logo / powered by android and nothing happens.

I think I had this before and it was related to encryption.

edit: flashed original kernel back and it boots again
[Magisk] rat7lol:
use PlayIntegrityFix along with Shamiko and grab a PIF config from PixelFlasher, all should work well then.
[Magisk] chiteroman:
For people failing Device verdict, try to use stock kernel and APatch instead Magisk.

DroidGuard can detect Magisk patched boot image.
[Magisk] in_dmand:
Thanks... I'm getting a failure when trying to install the latest version of shamiko...View attachment 6062312
[Magisk] Nergal di Cuthah:
First: I see you have systemless hosts, so assume that you use adaway. Try to change adaway to default, rumor has it that an entry is causing rcs issues, iirc.

Second: Yasnac and stafetynet modules are both defunct you need to 1) get a play integrity checker (such as the one built into playstore developer options) two switch to play integrity fixer (fix, fork or next) and find a working device-fingerprint.
[Magisk] rat7lol:
Set your Custom channel to https://channel.topjohnwu.com/canary.json and after updating the app (and Magisk) change it to Canary, you can install Shamiko then
[Magisk] osm0sis:
What? Details? No it can't, definitely not currently with Shamiko anyway. I use Magisk+Shamiko on all of my devices with no issue.
[Magisk] V0latyle:
There's not a monopoly...there's only a monopoly on the Google Services ecosystem.

False. Android is available without GMS by default.

There doesn't need to be, any app developer could choose to not rely on Google Mobile Services at all. Google has simply offered the most attractive solution - an app store, device compatibility requirements, and integrity verfication all in one.

It's not even close to illegal. Google themselves have made it extremely easy to unlock THEIR phones. GMS still works on custom ROMs although it takes some work if your build isn't CTS approved.

SMH
[Magisk] sawdoctor:
Exactly 💯. You don't and never have needed Google play services to run android. Google aren't and so far never have done anything to make it difficult to root your device. They like many banks are just saying you can't use any payment/money app if you root your phone.

The stupidity of it is though I have 2 bank apps I can not use anymore no matter how hard I try but i can still use their web page on my phone to make payments so I really don't see the point. Is a website on a rooted device really that much safer than an app?
[Magisk] V0latyle:
Stock kernel, Magisk patched boot image here, no issues.
[Magisk] in_dmand:
I just disabled Adaway for now... Also, I got the play integrity checker and installed a play integrity module instead of the safetynet fix. It's still not passing though... I don't think I need a fingerprint fix because I don't use that.

View attachment 6062315

View attachment 6062316

Thanks that worked and now I have shamiko
[Magisk] V0latyle:
Except they aren't. But, you are correct - as @pndwal has pointed out previously, Android has native means to provide hardware backed integrity, such as hardware backed key stores.

I'd think not. As others have pointed out, there's other attack vectors that are much MUCH bigger issues. Telephone scammers steal billions every year.

I think it may be necessary to point out that Play Integrity is not in of itself a security solution. All it does is attest to the integrity of the software environment. If you think about it, BASIC and DEVICE don't really mean that much in of themselves - BASIC integrity just means

I can't myself explain exactly what this means, more knowledgeable people like @osm0sis and @pndwal can

DEVICE integrity on the other hand means

All this means is that the software environment matches an approved CTS profile, so the app developer can be assured there won't be compatibility issues.

The reason why this is harder is that Play Integrity by default on Android 8+ devices relies on hardware attestation to "prove" the integrity verdicts. This just means that Android Verified Boot reports that bootloader is locked and boot image has been verified with OEM key. AVB is an Android function, not a Google function.

Play Integrity is just meant to give app developers the warm fuzzies that their app is running on a CTS approved device that passes basic system integrity checks. That's it.
[Magisk] rat7lol:
You need a fingerprint (ideally your own using a build.prop or from PIFS), you cannot pass MEETS_DEVICE_INTEGRITY without spoofing your fingerprint (and kernel version string, if it's banned) if you're on a custom ROM or using a rooted device.
[Magisk] Nergal di Cuthah:
Not literal fingerprint like in security a device fingerprint

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com

How to search & find your own fingerprints [noob friendly]: A Comprehensive Guide w/ tips & Discussion for Complete Noobs (from one)

It seems Google has banned more than 95% of custom fingerprints, so this thread/guide has kind been laid to the wayside. But it's still a great resource to understanding the foundations of fingerprints and all that... This is for any/all utterly...

xdaforums.com
[Magisk] chiteroman:
Yes it can, I cannot pass Strong in my "hacked" setup.

I have a boot image with a patched kernel cmdline, dtb and ramdisk to avoid avb:

- No root -> Strong pass.

- Root (Magisk) -> Device and Strong fail, only Basic.

- Root (KernelSU) -> like magisk.

- Root (APatch) -> Strong pass.

Seems like Google can detect more things...
[Magisk] Nergal di Cuthah:
I still support calling it a footprint, both for translation hic-ups, and for staving off confusion as above
[Magisk] in_dmand:
That's weird though, why would it work fine for a month up until yesterday? I have been passing CTS all this time

I'm rooted on a stock rom btw
[Magisk] V0latyle:
Buuuut you're using a hacked setup, I think something else is broken for you.

Pixel 5, stock kernel, stock firmware, rooted with Magisk. No Shamiko. Only PIFork v7 + custom fingerprint. Pass BASIC+DEVICE
[Magisk] V0latyle:
Yeah, Could use signature. Regardless of the vernacular we choose, the meaning is the same - to spoof the properties that Droidguard sees so as to think ti's on a different environment than what we are actually using.
[Magisk] Nergal di Cuthah:
Cts is outdated you need a play integrity checker, there's one built into playstore. In playstore setting tap version until it says your a developer, then in general you'll see developer option check pi from there. (i rolled up and you have one, but cts profile is out dated no longer go by yasnac)
[Magisk] rat7lol:
because PlayIntegrity updates on the server-side and Google is constantly changing the way your phone is validated and whatnot.
[Magisk] in_dmand:
Thanks... Since changing up modules

I'm now getting this
[Magisk] H4R0X:
I can't install newer kernels it won't boot, flashed back the kernel I had running before and it works.

@osm0sis how would I patch this kernel version string, it has a image.gz-dtb that I can't extract using 7zip and I guess magiskboot is for arm devices ? https://github.com/GZR-Kernels/Opti...ownload/v11.24/Optimus_Drunk_Surya_v11.24.zip
[Magisk] Nergal di Cuthah:
Now you need the fingerprint. follow @simplepinoi177 's guide

or get pi next

, the former is better the latter is "easier"
[Magisk] osm0sis:
I'm not going to patch things for people, sorry. I already explained roughly how to do it, but if you can't do it based on that I will not be automating any of it because it's already way outside the scope of PIF.

PIF absolutely should not be hacking the actual kernel of your device on-the-fly during installation or at any other time.

Custom kernel/ROM developers need to fix their own sh*t, or people need to go back to stock kernel.
[Magisk] in_dmand:
Thanks, I'm not familiar with the guide or pi... Any links you could share? I appreciate it
[Magisk] Nergal di Cuthah:
I shared them to you above :cool: the faq so you have basic questions answered and the link under is the guide
[Magisk] osm0sis:
I mean, those are very special circumstances you've got there... But what about with Shamiko?
[Magisk] lupastro82:
Hi, just to best understand, can I use this for my p7p instead of pickaprint.sh?

Is a magisk module.

Releases · Pixel-Props/build.prop

Bash script to build your own system.prop. Contribute to Pixel-Props/build.prop development by creating an account on GitHub.

github.com

---

Edit: tried, this is the result. I come back immediately 😅
[Magisk] V0latyle:
People, PLEASE spoiler your screenshots!
[Magisk] sawdoctor:
Read the kernelsu website there's a guide and files for using magiskboot on windows and Linux machines
[Magisk] in_dmand:
Ah thanks. I've rooted my phone for the past 10-15 years and stuck with the pixel specifically because of this reason (I like rooted call recording and ad blocking).

But this is over my head haha, makes me sad Google has made it so difficult.
[Magisk] majorfigjam:
How many times do we have to say this? A browser on a rooted phone is as safe as a browser on a Windows PC with admin rights, or a Linux browser with root.

All the security verification happens server side, whereas in an app it is user side.
[Magisk] IJOJOI:
Nope, you need to have a fingerprint for the module to fix the CTS mismatch
[Magisk] TotallyAnxious:
I'll be the first person to the demand you teach everyone how to build a kernel for their device.

Do it or you're selfish.
[Magisk] Nergal di Cuthah:
I was (still am) also very in over my head too when this all started. If you have a pc/linux/mac(?) you can use pixel flasher to relatively automate the process. There should be a Pixel flasher thread in your pixel board here on xda.
[Magisk] simplepinoi177:
i mean... it says there in the log... "Please install Magisk Canary", right?

did you really have to come on here because you truly had no clue, even with that screenshot and what it clearly says in it?

edit: this isn't meant to be sarcastic. I'm seriously inquiring because maybe I'm just missing something, or I'm literally a bit concerned for you that you might need to be told there's something concerning possibly happening to you since you went through all the trouble to screenshot it and come on here and post but missed something plainly obvious...
[Magisk] zgfg:
Isn't it clear from the screenshot you have attached that Shamiko v1.0.1 requires Magisk v26404 or higher (today released v26405)

Find an older Shamiko, v0 7.x or upgrade Magisk - switch Magisk Update Channel from Stable to Canary and upgrade ro v26405. Then install Shamiko v1.0 x
[Magisk] HippoMan:
I avoid Android banking apps like the plague, and I just use browser access for banking -- either on my phone or on my desktop computer.

Many, many fewer headaches!
[Magisk] simplepinoi177:
i mean... you could've just gone to my profile and do the "Find" and see all the threads i created...

but here ya go. it has all the foundational knowledge, but keep in mind that it's for "noobs"; the comprehensive guide below is made just with that in mind — but since it is for "noobs", it presumes no experience on the part of the reader so to make it applicable to any level, it has to be explained in plain speak which makes it not-concise at all...

How to search & find your own fingerprints [noob friendly]: A Comprehensive Guide w/ tips & Discussion for Complete Noobs (from one)

It seems Google has banned more than 95% of custom fingerprints, so this thread/guide has kind been laid to the wayside. But it's still a great resource to understanding the foundations of fingerprints and all that... This is for any/all utterly...

xdaforums.com
[Magisk] pulpf:
They'll succeed in discouraging root use, but they may also encourage people to switch to iphone.
[Magisk] Nergal di Cuthah:
Meh
[Magisk] Captain_Throwback:
I'll take a locked Android over an iPhone any day, despite all of this, personally. I can't imagine I'm the only one, either...
[Magisk] Craftyawesome:
TBF, something probably should. There's probably a good chunk of people on custom roms that aren't getting any more updates.
[Magisk] osm0sis:
The amount of room for error and breakage that unpacking, decompressing, hex patching, recompressing and repacking introduces, especially when automated (even with magiskboot) is just way too much; different compile options could result in kernels storing the release version strings in different places with different padding, etc., so I just don't see a way to safely make a one-size-fits-all fix. And I don't recommend anyone trying something that claims to be.

I might finally have some time to update my Android Image Kitchen (AIK) project soon, so people can at least do most of the steps that way and will just have to do the delicate/dangerous part of hex patching themselves.

But, if you're on an EOL ROM on an EOL device you should probably be looking at your options for a different ROM (or device), or at least invest some time into learning some more power user skills like hex editing to keep the old thing limping forward. 😛
[Magisk] Angelo_95:
Hello, can someone help me?

I have Redmi Note 9 Pro 4G 8GB with LinageOS20 Android 13 and i can't pass device integrity.

Im using PIF module from chiteroman. Before some weeks I didn't have any problem with the same setup.

Thanks for any help.
[Magisk] Nergal di Cuthah:
Please read (at least) the last 3 days of posts, your answers probably lie there.
[Magisk] BunnyPig1:
Sorry if this theory has been brought up before.

Since Google is starting to act up on custom kernels and such, are they one step ahead this time because they have found a way to "hide" root entirely?

Let's say they have found a way to get root which is "entirely" hidden from PI and other methods of detection. So now they are finding ways to detect custom kernels and "banning" them to make sure custom kernel developers loses interest from the public to try and defuse the situation. The last part might be exaggerated but just to add an idea if what I mean.

Again, just a silly theory since I don't know anything about android development but curious about the whole situation.
[Magisk] khusika:
everything will become -perf in a short time
[Magisk] purgy:
This is a very informative thread, at least when an fp hasn't been axed in the past few hours.

I've learned a lot reading this, thanks everyone.

Would hex editing a boot.img extracted from the phone itself (rather than unpacking the compressed image.lz4, then packing it all up again to be flashed etc) be a viable method?

Seems a lot easier, if it would actually work that is.
[Magisk] osm0sis:
The boot image is always from the phone itself, it's just a dump of the boot partition. If the kernel binary is compressed or uncompressed it's inside of the boot image.
[Magisk] Umgak:
Highly unlikely that Google is using an exploit to gain root. If such an exploit existed, as it has in the past, it would be a prime vector for malicious actors to abuse.

Hell, the su binary isn't even present on an unmodified device for them to gain root from. They'd have to be using an undisclosed exploit to get root - and abusing that would be not only unethical but dangerous as it could give malicious actors hints for how to compromise Android security from userspace.

Google is most likely just running uname or finding kernel string in a similar fashion - that data is accessible from userspace without privilege escalation.

Edit: finished the rest of the post. The button is just so pressable.
[Magisk] Nergal di Cuthah:
Is part of your post missing?
[Magisk] Umgak:
Yes.

Edit: No.
[Magisk] Slim K:
Are you saying that if I took my pixel 7 pro and:

Built AOSP+GMS for it.

Patched the built ROM with magisk/KernelSU/APatch or whatever.

Generated my own custom AVB_key and signed the patched custom built ROM. Flashing it to avb_custom partition and generated a custom Vbmeta.

Locked the Bootloader on the custom Build and disabled OEM unlock.

That my device won't meet strong_integrity? Excluding Apps that detect root separately that would mean Google is actively trying to hinder Root and the TEE/chain of trust argument falls completely. Are security-oriented ROMs like CalyxOS/GrapheneOS also affected? Since they also follow the same routine (excluding root).
[Magisk] majorfigjam:
Pretty sure the answer to that is a resounding yes.

Because to do that, you have to unlock the bootloader and that breaks the chain of trust. Even if you relock it, unless the device is returned to factory stock, the chain is not there. TBH, it;s not clear whether your comment "the TEE/chain of trust argument falls completely" is an opinion or is based on a reasoned argument.

From an outsider's perspective, they don't know if you are an honest modder, or a dishonest hacker who shoud not be trusted.

Google is not hindering you from rooting, just limiting what you can do with apps that require a trusted environment.
[Magisk] Nergal di Cuthah:
While i don't know the answer for sure, there is a how to lock your bootloader with GrapheneOS thread in the pixel 6 pro board, so maybe not ?
[Magisk] TotallyAnxious:
Google has access pretty much everything on your device. It's not an exploit if it's by design. And as someone else mentioned, an exploit of that magnitude would have serious reprocussions.

Also you'd probably be shocked to hear the creator and developer behind magisk works for the Android Security team at Google. The job is why magisk hide was removed. It was a condition for hiring. And he worked for Apple before that.
[Magisk] Umgak:
Doing all of that will still not pass Strong without a leaked keybox. It's a big headache, and even after all that work, TEE will see self signed root of trust instead of vendor root of trust and you'll fail PI.
[Magisk] Slim K:
that was the answer I was looking for. So PI doesn't really care If there is a valid root of trust (sort of), instead it checks If it's vendor or a user set. What a mess but understandable since it's google's own proprietary stuff.

the chain of trust is not really broken per se with a self signed key as quoted from AVB2.0:

In fact, im using my own ROM built by me with my own OTA server on a locked pixel p7pro and everything, the only part that I don't have or really know about is the Google play suite. I don't use it on my daily driver and don't want to unlock my phone again, losing my data, build/do the experiment I listed to see if it works or not.

I guess Google's Meets_Strong_integrity requirement includes a Vendor Root of trust? That was the question. In the past before PI you could do What I described with no problems, even when it was hardware backed attestation (when it was only safetynet/CTS).

@osm0sis If you don't mind me asking and have some time to answer, I saw you were part of OpenGApps in the Past. How was the "License-to-distribute" acquired back then, seeing it wasn't for commercial use? Was it paid for? What If an individual wants to deploy their own Gapps on their own device (non-commercially ofc), would I need to become a vendor in this case?
[Magisk] osm0sis:
That stuff was way before my time, but from my understanding Google asked CyanogenMod pretty early on to stop bundling GApps into the ROM, so they did, but Google didn't say anything about adding them separately, and so the entire GApps modding community was born. Of course, more recently many big name custom ROMs directly bundle in GApps again and Google doesn't seem to care, so who knows the legality of any of it. 🤷‍♂️
[Magisk] Umgak:
Correct. PI requires that the device meet the criteria of Green state (locked bootloader, signed with vendor keys). If you flash a custom AVB key, you can boot, but you'll be in Yellow state (locked bootloader, signed with user keys). Yellow state still fails PI. Unlocked bootloader is Orange state (unlocked bootloader), which also of course fails PI. This is why we have to do all of this work - back in the day, the only way to detect the state was by checking the ro.boot.verifiedbootstate prop, which is easily bypassed via magisk resetprop. However, TEE can see the real AVB state regardless of that prop and will tattle on you.

There's also a fourth Red boot state, which is reserved for either a locked bootloader with untrusted keys (so, flashing something custom and then relocking) or a corrupt boot partition.
[Magisk] Craftyawesome:
So you expect this to just be the state of things? This isn't something that can ever be spoofed without modifying the actual boot image?
[Magisk] majorfigjam:
With regard to RCS in messages, the answer seems to be as follows:

1. Do all the setup to get device integrity, ie find a working print, and use it. I think I read you've done this. Edit: maybe I misremembered, but you need to get device integrity to fix RCS.

2. Force stop the messages app in settings, then uninstall updates from 3 dot menu at top right.

3. Reverify your phone number, which may take a minute or two.

4. You're good to go.

Edit 5. You can now reinstall updates.

This worked for me, so hopefully will solve your problem.
[Magisk] trax69:
There are problems with ADA and OnePlus 12 and playintegrityfix?
[Magisk] remoh:
Some silly questions.

I have a Redmi Note 9 pro and lineageos (device miatoll) - unfortunately it has the lineageos string in the kernel.

I would like to ask the maintainer about a change, but have no clue who that may be and how to contact them.

Does Lineagos have something like a bug report?

Are there XDA threads?

Should i ask in github and who... ?
[Magisk] 666biker:
Is here some good soul :-) which can help just with the right commands to use to unpack boot.img?

[unpack the boot.img -> decompress the kernel (Image.gz ...) -> hex edit the decomp. Image -> recomp. it -> repack back into a boot.img.].

Tried to find the right commands, but for now, I was not fully lucky.

I am on LOS (there is for now no response if kernel string should be removed by default in device tread by the maintainer), so I have to extract boot.img from my device by my own, seems it is compressed, because directly hex edit does not see the kernel string inside.

thank you in advanced.