yashsingh1/xdaforums huggingface dataset:
[Magisk] HippoMan:
With this in mind, does anyone know of a specific app that will *crash* right after launching if DEVICE integrity is not present, and which will otherwise start up normally?

If so, I can write a Tasker profile and task which do the following to test for DEVICE integrity:

The profile would be an "App Changed" context which runs a task that sets a global variable named, for example, "TestAppRunning" to 1 when the app launches and to 0 when it dies.

The task would be something like this (pseudo-code, not actual Tasker code):

set count = 0
set TestAppRunning = 1 # Just to avoid a race condition on the test of this variable
launch app "TestApp"
while TestAppRunning > 0 and count < 30
set count = count + 1
wait 1.0 seconds
end while
if TestAppRunning > 0
alert "We have DEVICE integrity"
kill app "TestApp"
else
alert "We do not have DEVICE integrity"
end if

This also could probably be done without Tasker via a shell script that does a "ps" or something similar to test whether the app is alive or has died.

I'm guessing that there might be one or more banking apps which will die immediately after launch if DEVICE integrity is not present. Does anyone know of such an app (banking or otherwise)?

PS: It's probably best to answer my question in a PM to me, so as not to alert the Googlefrinchians who are lurking here.
[Magisk] GabbyWC:
Technically, Google is able to hold users of those apps back when the daily API limit is reached but by that point, Google has collected plenty of data that can be analyzed.

Yeah, I understand your concern and agree that Google could easily make things worse than they have so far for unlocked phones. Does SPIC work without being logged in to Google Play?

This is what concerns me when people go on extended fingerprint-testing marathons for hours at a time. It may feel rewarding to have dozens of valid fingerprints but the process of testing them without spreading out those tests provides enough unusual data to Google that they could more easily detect such activity.
[Magisk] D€INOS:
I agree, there have been lots of this hoarding and somewhat compulsory checking each print for validation, that may, or may not be good in the long run. We don't know, but why risk it for some short lived dopamine hit.
[Magisk] GabbyWC:
Yeah, and in a worst case scenario where Google implements security measures that cannot be spoofed with current methods, imagine the feeling of disappointment for people who spent hours or even days in their attempts to collect many custom fingerprints. It can be fun when power users test things out and accomplish technical goals but it's also important to keep the bigger picture in mind. The software provider (Google) always has the upper hand.
[Magisk] HippoMan:
Agreed. This cat-and-mouse game is ultimately a losing proposition for us mice.

As soon as the Googlefrinchians decide to make Wallet, GPay, and possibly other services no longer function without STRONG integrity, we're screwed.
[Magisk] me_droid:
My success rate finding working prints is about 1 per hour. Maybe my sources aren't as good as others. I'm just going to quit this for now. I've got 4 working prints and maybe that will suffice until some genius dev finds another solution. Life's too short to be spending it on this.
[Magisk] Tirofog:
Is it possible to verify integrity via adb in isolation or would a token also be required if so?

At this stage I'm tired of all Safety net fixes, Magisk hide, Shamiko etc, and now this. Personally, I don't use a physical wallet so have to carry my card on me as the phone can't be relied on, which makes it pointless.

Before splashing out on a shiny watch, I need to have a definitive answer on whether or not the wallet would work if the phone doesn't pass integrity.. some say yes, others say no.. is it device dependent?
[Magisk] Wolfcity:
I'm interested in that server part of SPIC too.

GitHub - herzhenr/spic-server: Server component for Simple Play Integrity Android-App

Server component for Simple Play Integrity Android-App - herzhenr/spic-server

github.com

Server component for SPIC - Simple Play Integrity Checker which receives the encrypted json verdicts, decrypts and verifies them locally on the server or sends them to a Google API for decryption and verification and sends the response back to the client. It is also used for nonce generation as the initial step of attestation.
[Magisk] mike.s:
Where did you get that idea? With regard to this topic, they're only examining stuff which your phone sends to them. AOSP is out there if you don't like even that. Google isn't forcing you to do anything, it's a free market so go out there and get a different phone if you don't like it.
[Magisk] wugga3:
Gonna see who quits first PIF vs Big "G"

Besides, isn't modules like safety net fix and PIF really just wonderful works in progress from volunteers with a skill and a passion? I wish I had any of this kind of talent to do what's accomplished here..... Thanks
[Magisk] Klappp:
Nobody is trying to undervalue the work the devs have put in, but the current approach does little good and is not worth pursuing any more. I would be sorely livid if the fingerprint that took me days to find got used in a future mod update and eventually banned by Google.

I only keep coming back here to see if there's another method in the works.
[Magisk] chiteroman:
Play Integrity Fix

https://www.paypal.com/paypalme/chiteroman	https://github.com/chiteroman/PlayIntegrityFix	https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/

t.me

A great sacrifice to my phone (vayu), but a great knowledge gained.
[Magisk] cabagekiller:
I am stilll getting no integrity even with 14.4. I can't figure out the issue. 14.3 worked just fine for me. I even tried a new fingerprint that I know works and it still fails. anyone have suggestions?
[Magisk] osm0sis:
Uhh @phhusson did it yesterday. 😄

https://twitter.com/i/web/status/1735097409930182707

Check the replies. 😯
[Magisk] Klappp:
Use the fork v4 and fill out all the fields. I had the same problem.
[Magisk] chiteroman:
Yes, in fact if you notice we are using the same Keybox, but I didn't do it by software because I wanted to try new things and I ended up reprogramming the TEE using the engineering rom.
[Magisk] cabagekiller:
link to v4?
[Magisk] Klappp:
top reply on the right side
[Magisk] cabagekiller:
thank you
[Magisk] intel_core_i7:
Few quesitons:

Does your device pass STRONG?

If yes, has google revoked your hardware keys?
[Magisk] wugga3:
New Google Wallet... Spoof not required.

Sorry... Back to Reddit I go...
[Magisk] badabing2003:
Yes, and so does PIAC (Play Integrity API Checker)
[Magisk] zgfg:
Verdict is not from Google?

There would be differences then in the passing or not results between them and Dev Options in Playstore

Something will pass in SPIC or PIAC but not in reality if Google improves their catching the cheaters methods

Btw, if you delete the.apk (DroidGuard) and test with PIAC, it will download to your phone the same, latest the.apk as if you test from Plsystore (and Google every few days updates the.apk)

On the other side that's an interesting point, I had a PM with a user who claims that some JSONS pass for him when testing from Playstore Dev Options, but not when testing in SPIC (?)
[Magisk] awarexda:
Win 7
[Magisk] beeshyams:
My 2C. Whenever SPIC/TB/Play Integrity gave device passed verdict while testing FPs, as a final test ran through all of them followed by Play Store. Never found a discrepancy in 28 I have
[Magisk] krakout:
Guys, is it possible for GPay Checker to report failure and yet be able to use the Wallet? I have Basic Integrity pass only, no Magisk Hide or anything else, Fix 14.3 (not that I had issues with previous versions either)...
[Magisk] zgfg:
It caches older results, hence yes, for some time

I've been paying hours after the spoofs were banned

Do not manually open Wallet and try to add cards, just use it for paying and it will still work until its older, cached verdict expires - then Wallet will test again and won't let you to pay anymore
[Magisk] krakout:
This makes sense, and thanks for pointing it out. However, strange thing is, I've opened Wallet several times over the past few weeks and it still works :D
[Magisk] pndwal:
But they seem to be wrong about Netflix... How is that "marked as incompatible if certification fails"?... It used too but hasn't been for ages, so marking as incompatible is no longer "a representation of whether you are passing or not"... Better find a different app for test purposes....

... For those observing Netflix failing on OnePlus, Realme, other(?) devices when PI DEVICE_INTEGRITY is lost, Please note that Widevine DRM certification (which Netflix DOES rely on) can be affected by PI attestations depending on OEM implementation... some devices (OnePlus, Realme etc) need passing PI DEVICE_INTEGRITY to pass L1 certification although it seems there's no requirement from Google for this, so these may be marked as incompatible (since they cannot decide HD streams in TEE OS), but this is a result of loosing Widevine L1 security compliance in reality... That's why for other (most?) dvices Netflix continues to operate unaffected and show in Play Store when PI DEVICE_INTEGRITY is lacking...

👀 PW
[Magisk] badabing2003:
I don't know why it wouldn't be?

Even though I haven't created a Google account, I'm still getting droidguard updates.

And the PIAC can still make Google API calls.
[Magisk] real_milux:
Interesting. If I understand correctly, one may use leaked private keys to achieve STRONG INTEGRITY with this, although he did not check?

But wouldn't this lead to an even more short-lived cat-and-mouse game when rolled out for users? There are certificate revocation lists involved in the checking process...
[Magisk] zgfg:
Do you really see STRONG INTEGRITY?

I didn't read beyond the screenshot but it shows KeyAttestation result with BootloaderSpoofer

Besides Chiteroman's back and forth 'jokes' about having and not a private version of BF that makes him possible to pass STRONG, that has never been proven so far.

Except that BF indeed makes KeyAttestation app to think that Bootloader si locked

On the other side, if you use BF to trick Momo, Momo wll also think that BL is locked but will then additionally bump more detections (su, Zygisk) caused by BF
[Magisk] sawdoctor:
Pretty sure he said he achieved strong integrity with it but unfortunately Google were going to ban it soon and then he'd never pass strong again even if he could lock his bootloader.

Think he just wanted to stick two fingers up at Google to show it was possible
[Magisk] GabbyWC:
What's also interesting about this X thread is that it contains replies from the one and only topjohnwu who mentioned that he isn't working on key attestation, DroidGuard or Play Integrity (if I understood his acronyms correctly).

https://x.com/topjohnwu/status/1735228477635469545

The older thread below contains replies from another Google employee who mentioned that any known TEE exploits would result in revoked access as necessary. The conversation between him and others there provides some insight in to how Google handles hardware-backed security matters.

https://x.com/shawnwillden/status/1237836365238337536
[Magisk] zgfg:
Did you read the back and forth Chiteroman's Strong and then 'just joking' comments here about his own Bootloader Spoofer - that module that tricks the Key Attestation app (as on the quoted twit screenshot ) to think that Bootloader is spoofed

Unless phhussonn has really something else in his hands, or Chiterman's 'joke' is not a joke and he has really a private holly grail version of the BF
[Magisk] Vision:
Yeah exactly, we no need another trolling

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] sawdoctor:
Yes I did but this isn't bootloader spoofing at all hence once blocked by Google his phone will be "broken" for ever. What he did was extremely dangerous and very likely to hard brick
[Magisk] Sven Onderbeke:
Tried it yesterday, indeed more stealthy, but the play integrity in the app still fails. It is not because I use frida but because I use a repacked apk. I hooked the android.app.ApplicationPackageManager.getInstallerPackageName() to return com.android.vending but I guess there still another way on how they detect that app integrity is broken, Any ideas perhaps?
[Magisk] real_milux:
AFAIU, BootloaderSpoofer only works locally because it uses a completely different root key. It will never pass a real remote verification then.

But if there are actually leaked private keys of vendor TEEs out there, I don't see why it shouldn't be possible to use these in order to fake valid-looking signatures of the corresponding TEE in software...

Maybe it's just a hoax, as you think/say. Maybe it's not. 🤷‍♂️
[Magisk] real_milux:
Exactly. If that's really working, then the corresponding leaked TEE certificate will end up on the CRL, killing STRONG for all devices using this certificate.

It would be quite similar to the PIF situation, where abuse is detected and the FP denylisted at some point.

However, I'm really wondering... If big G doesn't even drop all the fingerprints of superseeded device ROMs, how would they deal with such a situation? It's the problem of the vendor, I guess, though. I wouldn't see any other option but banning the certificate in such situation.
[Magisk] GabbyWC:
If you scroll up and view the second X thread that I linked to in my previous post , you may see the answers to your questions directly from a Google employee.
[Magisk] xcl1pse:
I dont think he pass strong since that screenshot only show that he achieve lock bootloader without relock with reverse enginered rom + modify TEE and leak KeyBox. So key attestation verify that hes using key which using software attestation instead relied on verified boot key or TEE so bootloader can be spoofed into lock bootloader

BTW, as far I see Rising OS already implement bootloader spoofer into their framework
[Magisk] zgfg:
I was referring to BootloderSpoofer - do you know what it is?

It is available on GitHub, it has been discussed here about (recently yesterday - so please scroll back to find and read) and you will not brick your device

Etc
[Magisk] sawdoctor:
Yes but the screenshot/osmosis post/twitter screenshot wasn't anything to do with the bootloader spoof your on about
[Magisk] zgfg:
It is Key Attestation that BF is used to spoof the Bootloader status

Yesterday there was a question here about BF. And later response about both BF and KA and with screenshots

Why the same things have to be asked here every day?
[Magisk] osm0sis:
Yep, and the leaked keys will likely be revoked very quickly in an update or something. Remote Key Provisioning (RKP) will also solve this type of hack forever.
[Magisk] tom1807:
Just for fun.

Some GitHub statistics:

PlayIntegrityFix: https://tooomm.github.io/github-release-stats/?username=chiteroman&repository=PlayIntegrityFix

PlayIntegrityFork: https://tooomm.github.io/github-release-stats/?username=osm0sis&repository=PlayIntegrityFork

Cheers

Tom
[Magisk] Claus….:
>18.000 it will ban this method totally
[Magisk] sawdoctor:
Think one thing this does help show is just how many people are using the bundled fingerprints rather than their own. Harder to tell know branches have merged of course
[Magisk] xSnowLeopardx:
13 days in, same stuff: FP still working. Have 19 back up prints. Easy life.
[Magisk] grassknife:
Would redirecting the attestation request from a rooted phone to a valid locked phone at home allow it to pass STRONG?
[Magisk] zgfg:
It was posted here couple of days ago - parallel counters

Etc/PIF.md at main · zgfg/Etc

Et cetera. Contribute to zgfg/Etc development by creating an account on GitHub.

github.com
[Magisk] BROKEN1981:
Why do you run KSU over Magisk?
[Magisk] xSnowLeopardx:
Was also wondering that.
[Magisk] xcl1pse:
Other people using that, so why not
[Magisk] BROKEN1981:
What is the purpose? Does it work better than Magisk? What are the benefits? From my side of things KSU doesn't seem so great.
[Magisk] xcl1pse:
KSU is better at hiding than magisk if your kernel => 5.10
[Magisk] BROKEN1981:
Ahh ok
[Magisk] xc112:
pass some banks XD, crdroid i cant make it work around magisk
[Magisk] Nergal di Cuthah:
There are ways to hide those in momo but this thread isn't for that. I assume when you say "pass some banks" you mean that PIF helped and worked for you?

I have no clue what the first picture (3 free transfers) is a image of, is that one of the banks working (not working?)?
[Magisk] BunnyPig1:
Is there a way to check what kind of intergrity an app is looking?

I reverted my phone back to stock because I need Google Wallet... So I thought.

My bank has a seperate app apparently for contactless payments. The regular banking app I have do not care for anything (maybe BASIC_INTEGRITY) so I thought maybe the contactless payment app also don't care. This would be huge for me because I don't really care for DEVICE_INTEGRITY since Gwallet is the only one that needs it.

So, instead of me jumping head first in reinstalling my phone, getting root, just to find out that it was all in vain and having to revert back to stock, is there a way to just check an app what it checks for?
[Magisk] switchem:
Hi, I just installed 14.4, but perhaps I did something wrong. YASNAC times out ("Attestation response timeout"). Google Play integrity check returns "Labels: []". Are the chinese rom Lenovo tablets (ZUI) like the Xiaomi eu devices in that they need special treatment? I was reading about that.

I've hid magisk, enabled Zygisk and DenyList, and denied Play Store, GMS, and Netflix. Should I be doing anything else or using any other modules?

From reading this thread, I gather I will eventually need to figure out how to get and use my own FP, but right now I'm just trying to make sure I have the basics in place.

My device is a Lenovo Legion Y700 (2023) tablet running ZUI 15.0.677. I've rooted with Magisk, bootloader unlocked, of course. The device came (sealed) with ZUI 15.0.654 and I had to full install 15.0.677 from a stock rom I downloaded (to fix a boot loop issue I got trying to relock after rooting). Not sure if that matters.

Thanks in advance for the help.
[Magisk] Nekromantik:
my bank app detect zygisk but not zygisknext on ksu
[Magisk] xSnowLeopardx:
YASNAC is not reliable anymore. Either use:

1) Play Integrity API Checker

2) Simple Play Integrity Checker

3) TB Checker (my favourite out of the 3)

4) Play Store (settings -> about -> tap the Play Store version a bunch of times -> scroll up -> general -> developer options -> check integrity | my favourite out of the 4)

Then, check if you pass both, if not, then find a custom FP and use PixelFlasher to check quickly (no reboot needed, it kills gms for you).

Guide here:

📳🔥 PixelFlasher, a GUI tool for flashing / updating / rooting / managing Pixel phones.

DESCRIPTION As the name suggests this is an application to flash (update) Pixel™ phones (possibly all Google™ made phones/tablets, YMMV.) PixelFlasher at its core is a UI layer (with bells and whistles) on top of adb / fastboot commands, hence...

xdaforums.com
[Magisk] zgfg:
I don't know about Lenovo ZUI, but Xiaomi.eu are not official/stock and therefore not certified ROMs.

Do not mix custom Xiaomi.eu ROMs with stock/official Xiaomi ROMs for EEA region
[Magisk] onesolo:
P6P on a rooted Qrp2 beta 2 stock build.

Yesterday safetynet stop working. I switched to PIF but still fails on Strong Integrity... Play store is certified, Wallet works, but some apps still managed to detect root, like bank app and macdonalds (lol).

Any fix for this??
[Magisk] HippoMan:
PIF will always fail on Strong integrity. It can only help with Basic and Device integrity.

As for banking apps ... many of them make use of their own tests for whether the device has been modded, and they go past the standard integrity checks that the Googlefrinchians supply. In these cases, PIF and other 3rd-party utilities might not be able to help.

It depends on the bank itself.
[Magisk] simplepinoi177:
EDIT: I didn't realize HippoMan stated the same things...apologies...

Yes, bank (and for some reason mcdonalds) has more than generic root detection and is much more aggressive (also Uber Driver app for some reason as well). So, because it's like that, they're required more methods than the general "DenyList", but it is possible.
[Magisk] simplepinoi177:
If you want a good starting point or a place dedicated to getting/using your own FP, for reference (a personal noob experience), you might want to consider checking out my thread...
[Magisk] dmenezes:
11 days here and in the same situation, original FP getting me BASIC+DEVICE. Didn't even bother getting any backup FPs yet.

I'm pretty sure my FP will stand until it's eventually trampled by @chiteroman in his mad attempt to accommodate the people that can't bother to lean searching for their own.

But at least he seems to be going slower about it lately.
[Magisk] dmenezes:
I'm sticking with Magisk vs KernelSU, at least while Magisk's still working great, because of the Principle of Minimal Mess: better to just add Magisk to the standard LoS kernel than to rip out the entire kernel and replace it with a manually built one like KernelSU needs to (at least on non-GKI kernels).

EDIT: just noticed my Lisa is running a GKI kernel, so perhaps I'll give KernelSU a try one of these days.
[Magisk] switchem:
This is helpful. Thank you. I downloaded TB Checker and was failing everything, so installed Universal SafetyNet Fixer and now I at least pass basic. I didnt think i needed both but i guess so? But I'm still failing device integrity so I guess I need to find a FP. Thanks for the heads up on PixelFlasher.
[Magisk] dmenezes:
+1 to both the above. My original FP find has 11 days and still working good, but it's a certainty it will someday end up being trampled.

I only hope a better method comes along before that.
[Magisk] dmenezes:
IMO people not willing to learn how to find their own fingerprint have no business running a custom ROM, much less demanding it passes any checks; they should just shut up and go back to Stock, period.
[Magisk] intel_core_i7:
Don't blame him too much. Now he just uses whatever fingerprint that custom roms are using (xiaomi.eu), he has done his best to not to burn new ones.
[Magisk] dmenezes:
I'm just glad I've stayed with 14.0+custom prop -- if it ain't broken, I'm sure as heck not going to fix it! 🤣
[Magisk] dmenezes:
Agreed, I've been out of this thread for a few days and just catching up, just reached @chiteroman's post about that. Now that he's using the same FP as Xiaomi.EU, he will at least burn FPs at a slower rate (will be just accelerating the burning of the same FP instead of burning a different one in parallel).

Better yet would be not to burn them at all, but given the current situation, it's good to see at least some effort in delaying the burning.
[Magisk] tom1807:
Universal SafetyNet Fix is obsolete. You need PlayIntegrityFix preferable with your own CustomPIF.

A lot resources for this in this topic.

Cheers

Tom
[Magisk] switchem:
Oh okay. That's what I thought (only need PIF), but I thought it was weird that I wasn't passing even the basic test with only PIF v14.4 default FP.
[Magisk] sawdoctor:
You do realise @chiteroman has started to supply the fingerprint that the xaiomi Devs release first. All though I agree with the principle of your he's only sharing a fingerprint that someone else released 1st so don't blame everything on him
[Magisk] sawdoctor:
There's an updated safety net fix from chiteroman that works on older devices
[Magisk] MUNISH MONGA:
Hi,

If I relock the bootloader, will Strong Integrity check green??