yashsingh1/xdaforums huggingface dataset:
[Magisk] zgfg:
o

Oops, sorry, Griffin prints are A6.0.1 prints

"FINGERPRINT": "motorola/griffin_retcn/griffin:6.0.1/MCC24.246-37/42:user/release-keys",

"RELEASE": "6.0.1"

I made a mistake since I was using and looking to another, ' private' A11 prints

---

Nevertheless, attest PI in Playstore/Dev options or TB Checker

On top, you will see your real A version, like Android 13.

Below you will see Passing Basic and Device - that was obtained by spoofing DroidGuard and G servers with A6 Griffin prints

That's bcs Playstore and TB Checker see your factual Android version (manufacturer and model - like your Samsung or something)

Spoofed Griffin prints are applied only to DroidGuard (that was called by Playstore, TB Checker or any other app), only for the purpose of attestation

---

That's also what you already have with this latest version of Wallet (beg of May). It requires A9 or up for installation (actually, Playstore requires that by looking to the Wallet app Manifest) and for running

So it correctly knows that your phone is eg A13 and allows you to install and open the Wallet app

But when it comes that Wallet calls for Play Integrity, PIF spoofs DriidGuard as if attesting A6.0.1 Griffin, si it passes Basic and Device - what is currently still enough for Wallet, and you can pay by NFC

Wallet only sees the final verdict that only says: Meeting Basic and Device Integrities - JSON verdict does not reveal what were the spoofed prints the verdict is based on (open the Verdict in Play Integrity checker, there are no such details in verdict - and that's also how the PI API specification desribes the flow and architecture)

Otherwise, Wallet and other apps would already know that PI attestation was stinky, by comparing the phone and ROM details in Verdict vs how they see thenselves.

But it doesn't happen since verdict does not share technical details it was based on, just the final results, passing 1,2,3 or not

Even for me when I run Wallet on my Xiaomi with A13, and attest Play Integrity with the spoofed A11 prints <let me say here eg from Samsung>

Hence, "strictly speaking, these are two different things" - new Wallet app requirement that phone must be A9 or up, and spoofing PI attestation by the not yet banned Griffin A6 prints

---

Nevertheless, please somebody with A9 or up, with the latest Wallet, who uses the 'public' Griffin A6 prints, please double-check paying (and adding a card) in your Wallet
[Magisk] pndwal:
👍

Sure... It's not clear who these chapters are for however.... 😜 PW
[Magisk] fichatel:
Hi,

Not sure if it's the right place to post.

After a clean install of my old Samsung GT-I9506 with LOS20, I'm fighting with my bank app, telling me my phone is probably rooted (whereas it is - was - not).

I tried many things without positive results.

Currently I have Magisk (SafetNet Fix + LSPosed) and HideMyApp installed.

Root Checker doesn't detect root, but Play Integrity Check is not good (and my banking app still refusing to start)

Someone to help there ? :cry:

View attachment 6103174

View attachment 6103175
[Magisk] Vision:
Have you try to disabled others modules if exist, except the PIF? To see if pass again

EDIT: you mean old safetynet? adding com.google.android.gms/com.google.android.gms.unstable to DenyList
[Magisk] beeshyams:
Maybe the kernel is banned? Please scroll through earlier posts which talk of kernel banned and how to detect it. Once you post your finding here, some knowledgeable folks will help you
[Magisk] zgfg:
This is Play Integrity Fix thread so please uninstall SN Fix module and install PIF module (coming with the Griffin prints buit-in) or PI Fork module (to install prints you must use its autopif.sh script from GitHub or other modules like PlayCurl). At the end, all will give you the same Griffin prints

That will cover PlayIntegrity (Basic and Device - you cannot get Strong), as enough for Wallet and many other apps

Btw, SafetyNet is deprecated, you must make sure to pass Basic and Device from Play Integrity.

You are on A13, you must go with PI Fix/Fork and with prints - script-only mode won't be enaugh, hence Zygisk must be enabled in Magisk

Then test also your Banking app but you will maybe need additional tricks to hide 'root' from that app

Btw, pay attention to your LOS Kernel name..IMO, you will be better off with PI Fork. Start reading from the Most liked posts in the thread
[Magisk] fichatel:
It seems I finally found what was wrong. Until now I cleared only cache from my banking app to make tests. I just tried to clear data also and it's ok now.

Sorry for the disruption :rolleyes:

Perhaps it'll helps someone else one day :)
[Magisk] zgfg:
Nevertheless, you are still passing Basic Integrity only, not Device Integrity.

It will catch you sooner or later, but up to you
[Magisk] dmenezes:
Another month has gone by -- so, 2 months total since I last had to get a new fingerprint (actually, use `autopif.sh` to get it for me) and my phone still has both BASIC_INTEGRITY and DEVICE_INTEGRITY:

View attachment 6103191

I just updated LoS to the latest official, and everything just keeps working (spent almost 2 months without being able to update, was getting "Install error" or something equally non-specific from System Updater, but yesterday figured it out: had just 5GB free on my internal storage, and it seems System Updater fails in that cryptic manner unless there's 10GB or so free).

Also, in that period I managed to install and get working two very root-hostile banking apps (Nubank and ITI, the former was specially fickle), and after installing and configuring the Shamiko Magisk module (and in the case of Nubank, a few chats with their support), managed to get everything to work.

So everything under the sun 🌞 is good, and life is great! 👍

Thanks again @chiteroman, @osm0sis and everyone else for everything!
[Magisk] zgfg:
The Griffin prints you use (taken from Xiaomi.eu Injector) are valid and working since Feb 29

Since almost everybody uses now that same prints (it's possible but very hard to find your other, 'private' prints for yourself), once they get banned (or G attacks the other way), that will make a big blast - Play Integrity will stop working for practically everybody and this thread will be shelved with several pages of messages in just few hours .

Until then it works for everybody, tomorrow will be 11 weeks. Long live the Griffin
[Magisk] dmenezes:
Thanks for the additional details! 👍

I hope it takes a long time for that catastrophe to happen! 😵‍💫

Agreed, and Long live LoS, rooting and our freedom to use our phones the way we want with as little interference as possible!

What will eventually save us all, IIUTC, is cracking the TEE -- so we can get STRONG_INTEGRITY and stop playing these spoofing games with Google. I've been following @chiteroman's and other folks (@Vision, etc) posts in the TEE thread, it all sounds promising but can't understand much of what's being discussed. I hope it doesn't take too long for it to become viable!
[Magisk] zgfg:
IMO, Strong low hanging fruits will never happen, and/or not last (last time, G killed in few days and it was based on particular Pixel prints, not the keys). Nobody will openly publish the keys and if G finds that some are misused, they will be promptly marked as Compromised

Besides, it's not like misusing the openly available fingerprints, these are vendor keys and sharing them around may trigger legal actions
[Magisk] wilsonhlacerda:
Hi ALL / @osm0sis , do you know if below kernel is banned?

unane -r:

4.14.326-lineageos+

uname -a:

Linux localhost 4.14.326-lineageos+ #1 SMP PREEMPT Sun May 5 07:33:14 UTC 2024 aarch64 Toybox

It is from newest Official LineageOS 20 for Poco X3 Pro (Vayu).

Uname is not an *exact* match of a known banned one, but it does match in part a banned ( -lineageos ).

Device with Magisk Kitsune SuList mode + PIF is passing BASIC only.

Thanks!
[Magisk] dmenezes:
What about we plucking the keys from our own devices before unlocking bootloader, installing LineageOS and rooting, and then using them with the checked TEE?

Ah, yes -- "Intellectual Property" and all that. But if that comes to pass, there are plenty of ways to anonymously share files and avoid the IP mafias...
[Magisk] dmenezes:
Dude... that "-lineageos" substring is literally included in @osm0sis' list... 🤦‍♂️
[Magisk] mrmrkmail:
Looks like the griffin key got banned ☹️
[Magisk] V0latyle:
No, they aren't. The only thing they have done is make Play Integrity rely on hardware attestation by default for Android 8.0+ devices. If they were making hardware attestation mandatory, PI would not work on pre 8.0 devices, and there would not be a fallback for legacy basic attestation. They don't mandate that anyone require a STRONG verdict for their apps, because they don't even use it themselves!

What companies? This statement doesn't make a whole lot of sense. Fragmentation has always been a problem in the Android market, and no manufacturer is going to support their devices indefinitely. At least they aren't artificially crippling old devices like Apple was doing with iOS.

I've said it before and I'll say it again: The doomsday hysterics are neither accurate nor helpful, and I find it irritating to have to continually correct misunderstandings on this, especially when people who don't understand the principles and mechanisms at play continue to spread false information despite the knowledgeable people making it clear this isn't the case.
[Magisk] dmenezes:
What makes you say so? Mine keeps working just like I reported a couple of posts back.

EDIT: just refreshed and retested, and uh-oh:

View attachment 6103225

So it looks like @mrmrkmail is right and that fingerprint indeed got bananaed... 😞

OTOH I just checked and my banking apps seem to continue to work, so perhaps they cached the last good result from earlier today?

Hope `autopif.sh` can get us a new FP before long...
[Magisk] wilsonhlacerda:
See the *exact* written by osm0sis and me.

It depends by what exact means: full string match (not my case) or banned string matching a kernel sub string (my case).
[Magisk] dmenezes:
I'm pretty sure it's substring based...
[Magisk] zgfg:
Ooops
[Magisk] Claus….:
EDIT +1, do not meet device integrity
[Magisk] esatch:
+1
[Magisk] dmenezes:
Cache? Clear it, restart and retest and tell us what happens.
[Magisk] wilsonhlacerda:
Who has private fps better test them and let us know if some working yet. May be the public fb ban only, but may be a massive fp ban or change on droidguard checking.
[Magisk] Claus….:
Yes, unfortunately it is banned. Really pain in the ass.
[Magisk] Claus….:
@chiteroman you may have a private one? :)
[Magisk] fbirraque:
Yeah... Google remembered to deprecated our PIF after the Google IO yesterday.

View attachment 6103236
[Magisk] V0latyle:
I've been on the same private print since February. Still working here.
[Magisk] zgfg:
I just tested one private from A5, one from A6, .., one from A12 and one from A13, nine of them, plus two other that I use, and they still all work

This attack is isolated but with the big impact to users
[Magisk] justDave:
Time to turn off your RCS, folks.
[Magisk] HarryTurney:
Yep, it's gone. Oh well, it did last quite some time, time to wait for another.
[Magisk] zgfg:
This is Alioth A13, not Griffin A6.0.1

Your private printsor you had them built-in with some custom ROM?
[Magisk] dmenezes:
Why? (sorry for the ignorance, but a quick Google search doesn't tell me what RCS has to do with that).
[Magisk] pershoot:
RCS uses Play Integrity which will cease to function, if you do not pass DEVICE.
[Magisk] zgfg:
Sorry, I think this is your fault today ;-)
[Magisk] dmenezes:
😁 Yeah, looks like I jinxed it! 🤣
[Magisk] generalculprit:
Play store integrity checker always shows the real device, no matter what fingerprint you use.
[Magisk] dmenezes:
Thanks, I did not know that (but then, I've never used RCS...)

So it's not exactly "time to turn off RCS" as it will rather cease to function all by itself, right? Or am I (still) missing something?

And BTW, what's so special/important about RCS that makes Google require DEVICE_INTEGRITY for it to function? Eg, is it used for authentication? if so, then why not make SMS require it too, given that SMS is much more frequently used for that purpose?
[Magisk] fbirraque:
XiaomiEU's pif.json imported to Play Integrity Fork V8 (osm0sis)
[Magisk] pershoot:
It will cease to function and will revert from RCS to sending in SMS / MMS, if you have the option enabled. There may be issue if someone tries sending to you on an RCS chat, for a time, dependent on fallback.

I believe they wanted to reduce | alleviate abuse / malicious activity of / on the service.
[Magisk] HippoMan:
Beware the Ides of May!
[Magisk] zgfg:
Yeah, didn't pay attention what it was. I saw your post/screenshot also on Xiaomi.eu Forum and thought that it's maybe an FP related to them
[Magisk] osm0sis:
Ditto.

Everyone wait a little bit for Xiaomi.eu to catch on and update, then grab the new print using my autopif.sh. 👍
[Magisk] kornball:
God this is so annoying. Ugh.
[Magisk] zgfg:
Yeah but Caesar was assassinated on March Ides 44 BC
[Magisk] Syoenth:
Good day:

anyone have the guide to generate a new pif?
[Magisk] osm0sis:
Not terribly surprising however. It's currently at probably ~175,000 users. I think that's a new record. 😯

PIF:

GitHub Release Stats

Get the latest release stats like download counts, release dates, author on any GitHub project

tooomm.github.io

PIFork:

GitHub Release Stats

Get the latest release stats like download counts, release dates, author on any GitHub project

tooomm.github.io

(Plus Xiaomi.eu themselves and any other ROM using the same)

Hence the joke. 😛
[Magisk] CZ.Kostra:
I'm working on new version FP XEU Checker and old version it just told me 'griffin' died. 😞

... long live 'clark' 👍
[Magisk] generalculprit:
I may be the general culprit, but this wasn't me. Honestly. :cool:
[Magisk] bakaekze:
it's on https://sourceforge.net/projects/xiaomi-eu-multilang-miui-roms/files/xiaomi.eu/Xiaomi.eu-app/
[Magisk] osm0sis:
Gitty up! 🤠
[Magisk] StrifE:
Works like a charm mate, thank you!
[Magisk] trevtdogg:
well if it only happens once every two months or so from now on, then i'm happy :)
[Magisk] wilsonhlacerda:
Hi osm0sis, before thread gets flooded, can you please check this message that I posted just before the ban?

Thanks!
[Magisk] osm0sis:
@dmenezes already told you correctly. 👍
[Magisk] justDave:
I think someone else mentioned this but the problem is incoming RCS messages. If your carrier still thinks you're on RCS they won't be delivered.
[Magisk] trevtdogg:
you were answered already...

edit - beaten...
[Magisk] awarexda:
Playcurl doesn't help anymore?
[Magisk] AlexS2412:
so what exactly do we do now that its banned again? i downloaded the xiaomi app but it doesn't seem to do anything? im very confused.
[Magisk] AlexS2412:
the current fingerprint is banned thou?
[Magisk] pershoot:
There is a new current (public) FP c/o Xiaomi.eu. Your service(s) will be restored, thereafter.
[Magisk] wilsonhlacerda:
Thanks for replying!

So for better understanding of other future users I suggest you to change the way it is written on your original banned list post, specially because you give emphasis on the *exact* word.

The "exact" on that context refers to Google's perspective when checking (as you linked there by clicking the word), but on ours - what matters for users reading your post - it is enough that the banned strings you list are only part (substring) of user's whole kernel uname, not exactly "exact" 😁.
[Magisk] trevtdogg:
i would suggest using both the play integrity fork by @osm0sis as well as their autopif.sh script, you'll be up and running in no time.

both can be found in their big thread: https://xdaforums.com/t/tools-zips-scripts-osm0sis-odds-and-ends-multiple-devices-platforms.2239421/
[Magisk] AlexS2412:
im using a pixel 6, it would be helpful if there was more clear instructions on how to replace the 15.9.7 play integrity fix with whatever works.
[Magisk] pershoot:
I linked you; from the author of the main shell script (osm0sis).
[Magisk] CZ.Kostra:
Try this app: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89390931
[Magisk] wilsonhlacerda:
It does help.

I've just run app FP Downloader that is the companion app of Playcurl module in one of my devices and it fetched the fresh new FP as expected. Now passing BASIC and DEVICE again.
[Magisk] Androiduser2390:
Moving Google Wallet to require Android 9 will be the start of forced hardware attestation.
[Magisk] dmenezes:
Yay! \o/

Great news, thanks for keeping us posted!
[Magisk] aliantonio:
Keep getting XEUInjector.rss not found
[Magisk] CZ.Kostra:
Have you granted the app all the permissions (that it asked for)?
[Magisk] sawdoctor:
8 po

Chiteroman has kindly posted the print with required Fields for you on a well known social media app we don't post links to on here. You can just copy and paste it if you find that easier
[Magisk] HippoMan:
I know about Caesar and March Ides. But it's May Ides for the griffin key.

I wonder what awaits us on June Ides.
[Magisk] aliantonio:
I believe so. Didn't deny any of the permissions
[Magisk] G5-User7080:
hm so I just happened to install the may OTA (Pixel 6a) today and now my fp I pulled from some nokia firmware is rip...

tested about 6 other devices' firmwares, but no luck, did something weird happen where they blocked device passing for good?

or am I doing something wrong... I try to pick some from 2018 and 2019, A8 and A9 respecttively I think but no luck, neither with their default api level 28 or smth, nor with setting it to 25.

chiteromans PIF btw, or am I supposed to use osmosis'?
[Magisk] HippoMan:
Hmm ... maybe if we all use the Caesar Cipher when publicly and frequently communicating about the next widely shared FP, the Googlefrinchian Telephone Santizers won't get alerted about its existence so readily.
[Magisk] V0latyle:
Nothing more than an assumption. Ok, so they stop supporting older versions of Android, so what? It's likely to mean absolutely nothing for all of us who are already running 12,13, and 14 anyway. PIF only spoofs the print for DroidGuard; no other apps can see the spoofed print, because when they call Play Integrity for verdicts, they don't get any details about what information was presented to PI.

So again, the doomsday hysterics are unfounded and unhelpful. If Google ever does require STRONG for Wallet, or implements some other measure that defeats all current and future countermeasures on unlocked+rooted devices, we'll cross that bridge when we get to it, but at this time there is zero indication whatsoever that they're going that direction. Google practically owns Android, yet chooses to utilize their own proprietary APIs to determine environment integrity and security. They've had the ability to use built-in Android features to determine things like unlocked bootloader and AVB status - which are both verified by TEE and therefore cannot be spoofed - but for whatever reason, they don't.

IMO the only thing this will change is that Wallet will simply require 2 things - an Android 9.0+ environment, and Play Integrity responses of MEETS_BASIC_INTEGRITY and MEETS_DEVICE_INTEGRITY.
[Magisk] anthonnyb98:
I have installed the application that you mentioned above and have granted root permission and the necessary permissions, but it still does not update, do I need to do any more steps?
[Magisk] osm0sis:
No, it's the exact substring, as is clear from context clues from reading the rest of the post and the linked examples. I'll add the word "substring" so that part is absolutely clear however...
[Magisk] CZ.Kostra:
No need to update anything. What did app write?
[Magisk] zgfg:
This new Moto Clark prints are still.A6 and all works fine (Wallet and RCS)

But we will see the next moves
[Magisk] zgfg:
@ingbrzy was really "brzy" - thanks from everybody

Somebody called 911 on Xiaomi.eu Forum soon after Griffin was banned and the Clark came to save the show
[Magisk] rrusek:
Sorry, installed this but not sure what else needs to be done?
[Magisk] chiteroman:
It lasted long enough, then I update PIF and make some improvements.

Meanwhile you can use this: https://github.com/daboynb/autojson/blob/main/pif.json
[Magisk] chiteroman:
Tried to implement code from FrameworkPatch to build a valid certificate chain, but seems like DroidGuard can detect it :/
[Magisk] zgfg:
What rxactly did you install?

Only the users of Xiaomi.eu ROM need to install Xiaomi eu injector - only for them, if not using PIF module, the a

Injector app will inject the prints to Xiaomi.eu ROM

Otherwise, you only need the prints that are in the inject_fields.xml file im when you unzip the Injector apk file.

And you need to create your custom PIF json file with those prints

Now simply - install the PI Fork module from Osmosis and run his autopif.sh script from Termibal Emulator. Script will download, extract the prints, create and 'install' the JSON file for you

Find his post from today afternoon a page or two behind
[Magisk] generalculprit:
Unfortunately I keep getting wget TLS errors (handshake failure) from netcologne.dl.sourceforge.net on 2 different devices working weeks ago.
[Magisk] kodein:
Chieroman and topjohnwu are geniuses, I think they will come up with something against google...

I would never want an unrooted phone
[Magisk] dmenezes:
And just like that, seeing the news here that a new FP was made available by the good guys at Xiaomi.EU:

- ran `sh autopif.sh`

- moved the resulting custom.pif.json to /data/adb/modules/playintegrityfix

- restarted my phone, and...

...VOILÀ:

View attachment 6103325

Now I have DEVICE_INTEGRITY again!

Most effort/time was spent trying to remember just where the F I had saved it all back in March, and that I needed to use ConnectBot and not Termux to run it.

Thanks again @osm0sis for the great job!

I love this thread and everyone in it, but here's to it being a long time before I need to return here again! 🤣
[Magisk] chrbur:
I installed AutoPIX Next APK an the modules AutoPIF NEXT Form 15.9.3 + Shamiko 1.0.1 + playcurl + Zygisk LSP 1.9.2 but since today i cant pass deivice i. anymore. Pixel 8Pro
[Magisk] zgfg:
If I recall correctly, you have downloaded the XiaomiEUModule_2024.05.15.apk

Renane to zip and unzip. Find inside

res/xmlle_2024.05.15/inject_fields.xml

Open - see the screenshot, find inside the values for MANUFACTURER and six other fields. Fill them to your custom pif.json file

Omit all other fields. Make sure there is no comma after your last field (SECURITY_PATCH). Run migrate.sh script from Osmosis to create the rest of the fields. Move to

/data/adb/modules/playintegrityfix/custom.pif.json

Reboot and Voilà
[Magisk] neonblind:
A8 and 8.1 devices passing device integrity again with clark print. Let's see how long it lasts.

Funny that G blacklisted griffin on A8-A9 months before they blacklisted it completely today.

Maybe it was all preparation for the upcoming pay/wallet update.
[Magisk] Vision:
So the next FP, it's that too Motorola?

Google can block all Motorola FP for us? 😂🤣
[Magisk] Vision:
Google make our lives more difficult time to time.

You try make this you mentioned on TG?

View attachment 6103350
[Magisk] G5-User7080:
Which is the PIF moduel we're supposed to use atm, Chiteroman's or osmosis'?

I'm currently using chiteroman's and I tried a bunch of different factory images but none worked, then I tried osmosis gen_pif_custom.sh script on one of the extracted build.props and that worked, though when I later applied the print using PixelFlasher again as I did with the others, it led to slightly different values but still worked so that was probably just a coincidence.
[Magisk] Vision:
Yeah, me too, can't understand much of being discussed, I ask other users and research on internet and try to mix all together and maybe something working 😂🤣

I hope @chiteroman make it for all of us, and only need a keybox.xml (of course every user must have his one), and more difficult for Google block this, if we keep the game more private.