yashsingh1/xdaforums huggingface dataset:
[Magisk] shoey63:
Make an executable <logs or whatever>.sh file in /data/adb/service.d and put this in it.

#!/bin/sh

su -c logcat | grep PIF >/data/adb/logcat.txt

It will execute on boot.

So restart the phone and check play integrity.

The logcat.txt should start populating with PIF entries.
[Magisk] arda99:
in termux root

logcat -c

killall com.google.android.gms.unstable

logcat | grep PIF

run PI test app and check termux output.
[Magisk] sethieplayz:
I've noticed that if I run a PI check on boot, the check returns as normal, but whenever I try to use the pickaprint script, it hangs indefinitely and doesn't return a result.

This is fixed by restoring my original FP and restarting my phone.

Anyone else noticed this?

Edit for additional info; using osmosis fork v5
[Magisk] BROKEN1981:
All smartphones. My first Acer smartphone print got banned when Chit used his camera prints.
[Magisk] MrSteelX:
Which version chiteroman or osmosis did you use?
[Magisk] sawdoctor:
Maybe share one of your banned prints via PM with someone you trust like osmoSis or one of the mods? See if they can confirm if it's banned or not. OsmoSis checked a print for me when I was having trouble with different PIF forks
[Magisk] TheRomRooster:
Considering you used a mainstream brand Im wondering if it got flagged maybe and banned some other way. Have you tried to find a PIF of a lesser known manufacturer and attempted with that?
[Magisk] lmvuong1997:
Hi, i made a custom pif using build.prop from factory android 7 image, but after copy to data/adb/modules/playintegrityfix and clear data of gsf, gps, playstore, it still showed the default android 8 fingerprint and still only meet_basic_integrity when i checked it in playstore dev option. I'm currently using latest stable magisk + playintegrityfork + shamiko. I've tried magisk delta/playintegrityfix/without shamiko/another los 20 rom, and it was the same.
[Magisk] TheRomRooster:
Not all PIFs work, when it shows basic integrity, it means you got a bad print. The Attestation checkers will still show your current device, thats normal, but if it only passes basic, id try with another PIF
[Magisk] dmenezes:
This is really interesting. I've been buying Xiaomis for the last 6 years and always heard about "Regionalized" models but wasn't ever sure about what exactly that meant.

So, there's a physical (even if totally artificial) difference, *and* a ROM difference... the ROMs can be interchangeably flashed AFAIK (eg, an Indian phone can be flashed with the Global ROM), so what's the physical difference used for?
[Magisk] dmenezes:
Thanks for the new year wishes, but my own self-mined Custom FP from last year just keeps working perfectly:

View attachment 6050794

Today it just completed a month! May it last still a lot longer!
[Magisk] dmenezes:
You were lucky. "Normal" rates are from 5-10 tries for a single working fingerprint.

First time I tried, I was doing a part of the procedure wrong, and wasted almost a day and over 20 tries without finding anything. When I realized it and started doing it right, it took me less than 5 tries to find the one I've been using now (and has been working for exactly one month today).

So, congrats on your success, and welcome to the club! 👍👍👍

EDIT: just noticed you mentioning having used the pickaprint script. This could have enhanced your chances of success considerably, since it picks from a much smaller set of fingerprints...

I do plan on using pickaprint if/when my current FP ever gets bananaed, so I'm very glad to hear it worked well for you! 👍
[Magisk] TheRomRooster:
Once you know what to do and what to look for, it will go A LOT faster, my first 3 took me about as long to find as the 10 after. And mine has been working for pretty much a month now too, private PIFs are the way to go for now
[Magisk] dmenezes:
You're *definitely* doing something wrong. Just stop, sit down and re-read the instructions and review your procedure. I know because at first I was in a similar situation (see my previous post).
[Magisk] dmenezes:
Not a PixelFlasher user (I do everything at the command-line), but I do appreciate the work you do for the community. Thanks!
[Magisk] dmenezes:
So I probably don't know what I'm doing yet! 😆

Seriously, I stopped after finding this first print, and since it's still working (a month today and still going, yay!) I haven't had to get back to it.

In this case, I think ignorance may really be bliss... 😆
[Magisk] TheRomRooster:
i never take my wallet with me and dont wanna get ****ed when the pif gets banned. Its embarrassing enough having to say "just a moment please" and waiting for your phone to reboot after updating the module
[Magisk] dmenezes:
Thanks for your post, and thanks for the concise explanation of what APatch is.

I think kernel-level solutions are the next step and was considering KernelSU but was really bummed when I learned I would have to compile my own kernel for it, so APatch might be what I was hoping for.

TG is a septic mess, I already participate in a TG group (via a Matrix bridge, since I don't have the TG client installed) and I'm trying like hell to avoid any more.

Is there a secondary source of information on APatch besides the TG group? Its github page is pretty spartan...
[Magisk] dmenezes:
This sounds really promising! Thanks for the info!
[Magisk] dmenezes:
What is needed is someone to get really heavy-handed into this, like decapping the SoC with acid and then using an electron microscope + microprobes to read the key directly instead of trying to find software flaws.

Granted, it's a lot of work and needs specialized equipment, but looking forward it's the only "guaranteed" way of busting Google's attempts of limiting what we do with our phones.
[Magisk] lmvuong1997:
I checked the json again and the osm0sis's gen_pif_custom.sh made a wrong "/n" in the json file. Deleted it and also switched to another a10 factory image build.prop, now it's working
[Magisk] osm0sis:
Can you show me the bad output and tell me what you were running it on?
[Magisk] dmenezes:
You must be pulling our legs...
[Magisk] dmenezes:
Or maybe his karma just caught up with him and he got run over by a bus or something... 😆
[Magisk] dmenezes:
Oof! Just came back to this thread from the weekend/new year's holiday and found just 6 pages to read through! Things have really slowed down (thanks Dog!)

Seriously, it's a pleasure to see how much the signal/noise ratio has improved, and to keep learning from @osm0sis, @chiteroman and @badabing2003 posts, among others. Please keep posting, folks -- there's still a lot I need to learn from you! 👍
[Magisk] lmvuong1997:
View attachment 6050820View attachment 6050823

Running on git bash on windows 11 23h2
[Magisk] V0latyle:
This wouldn't help with integrity verdicts anyway. TEE still functions when the bootloader is unlocked...the problem is the broken chain of trust.

The bootloader reports the verified boot state depending on lock status and what root CA has been installed.

VerifiedBootState

The only thing TEE does in this regard is "certify" that what VerfiedBootState reports is true:

Source:

https://www.reddit.com/r/Android/comments/l8pv70/_/gldtde9
[Magisk] dmenezes:
So, flashing an "engineering ROM" like @chiteroman mentioned in the github page wouldn't help us get STRONG on bootloader-unlocked devices? That was my impression (and shows how little I know).
[Magisk] pndwal:
Spoiler content hidden.

👀 PW
[Magisk] pndwal:
These cases often involve having messed up /persist partitions and results in ctsProfileMatch/DEVICE_INTEGRITY failing... Even restoring stock ROM images and relocking bootloader doesn't restore integrity verdicts in these cases... Very common on Poco devices...

I've seen other ways to fix broken integrity verdicts caused by messed up persist on XDA (especially for poco) but @chiteromans guide (for his POCO X3 Pro, vayu) may be invaluable where bad ROM flashes or other has messed up persist partition... 👍 PW
[Magisk] V0latyle:
For the benefit of everyone here, do you think you could explain root of trust, chain of trust, TEE, and what all of this has to do with hardware backed attestation?
[Magisk] mesiu84:
Why last working version for my Xiaomi Mi9T Pro is 14.6? I tested it with and without custom pif.json and it works. If I try to update it it stops working (with and without custom pif.json). Even the latest version doesn't work. Anyone knows why it's like that? Especially the case with custom pif.json which I guess should be working.
[Magisk] BunnyPig1:
Silly question but I'm curious.

The future for root is uncertain at this moment, someday PI will prevent the method we use today and we'll be unable to hide.

Here's my question, as silly as it may sound, would it be possible to release a sort of emulator on Android that could function as the phone?

Everything PI checks in hardware will be fine but the emulated android you're running can be "anything". The phone and stock os is untouched, but basically you launch "an app" Fullscreen that is able to communicate with different chipsets like radio and such.

I know this is a silly question and I'm sure there are checks and whatnot for this idea.

I know there would be drawbacks in areas like performance, stability, not entirely automated, and other things but if anyone who has knowledge in this field, why is this not possible?
[Magisk] V0latyle:
Common misconception, and it's no more true now than it was 5-10 years ago, regardless what the naysayers might claim. Play Integrity does not prevent the use of root, and as @osm0sis related in his communications with a Google employee, the Big G isn't interested in screwing us over, either.

Individual app developers on the other hand are a completely different story. There's some out there that enforce ridiculous policies, like you can't even have USB Debugging enabled.

You can run emulators in Android Studio, but there's not really any point to this because what you're asking is regarding the phones we use on the daily.

Yes, we can potentially emulate everything in userspace, but there's a lot of Android mechanisms that are specifically designed to prevent, or at least detect, the use of an emulation enviornment for the Android runtime.

No - this is what TEE prevents. TEE verifies things such as the boot state, and because TEE is signed with the OEM's private key, it cannot be broken.

Stated above.

The short answer: Forget STRONG integrity, we'll never be able to pass it because the only circumstances where it DOES pass with unlocked bootloader have been bad implementation / broken keystores / etc and are quickly addressed by Google

We should for the forseeable future be able to continue to trigger fallback to basic attestation, thereby passing DEVICE. I'm sure they'll eventually make it harder for us, but we'll just find new ways to break things.
[Magisk] HippoMan:
Interesting idea.

However, the functions that get limited by PI are not the use of the phone services themselves.

PI restrictions limit Android system software that performs payment-related functions ... such as GPay and Wallet.

Those PI restrictions are also used by some 3rd-party apps (banking apps and also some non-banking apps) to limit those apps' functionality.

Re-routing phone-based functions themselves will not bypass those restrictions.
[Magisk] Vision:
I write some similar and i get answer, with simple word No (Can't spoof the locked bootloader and chain of trust (normally). but maybe this you say is different

Theoretically, if from a normal phone can take the info (test results, id and etc.) and put it in the rooted phone and send this info from rooted via module etc. to Google server to pass 3/3 ? The Normal Phone and rooted phone same model, android and all
[Magisk] BunnyPig1:
@V0latyle incredible explanation! Just shows how little I know about this, I'm just a random tinkerer so this was very useful information. Learnt a lot from this, thank you!

So basically, it's the developers of certain apps that looks for this and not Google themselves, they just provide a way for developers to check security without having to develop such a tool themselves?

@HippoMan interesting! Thank you! I've noticed that is seems to be related pretty much only to payment apps or apps that handles money in general. But nevertheless it was very good to have it confirmed!
[Magisk] rodken:
Remember, instead of focusing on completely bypassing PI, it might be more productive to explore alternative rooting methods [if the need calls for it] that adapt to the changing landscape of security measures. Open-source projects, communities, messaging boards, constantly innovate in this area, offering ways to gain root access and customize your Android experience while respecting security concerns and ethical considerations.

Keep in mind that using technology responsibly and ethically is crucial, and any attempts to circumvent security measures should be carefully weighed against the potential risks and consequences.

Developing such an emulator would be a complex task, requiring deep understanding of Android internals, device hardware communication protocols, and virtualization techniques, so on and so forth. Emulating radio communication, sensors, and other hardware functions presents an added challenge. Even at my age, it might post a challenge.
[Magisk] HippoMan:
My idea is to create a "dual phone" ... two complete Android devices in one case, but they share the screen, the buttons, the SIM card, etc. This "sharing" would be done via a hardware switch which selects one Android device or the other one to be using the screen, buttons, SIM, etc. at any given time.

Also, there could be shared storage under /sdcard.

One device could have its bootloader locked and not be modded in any way. This would be the device to be selected for GPay, Wallet, banking apps, etc. The other device could be totally modded and rooted.

This would be an expensive device, but I, for one, would definitely be willing to pay for it.

Of course, finding a manufacturer for such a device is probably impossible.
[Magisk] V0latyle:
GPay and Wallet aren't part of Android system. They can be installed as "system" apps (e.g., Pixel phones) but Android itself, while supporting NFC, does not natively support contactless pay. So, the apps in question simply use NFC through Android APIs to complete the transaction.

Play Integrity doesn't limit anything in Android system; it is part of GMS, and is not integral to AOSP. All it does is report attestation verdicts to apps that request it.

Again...PI itself doesn't restrict anything. Apps themselves request verdicts, and developers of said apps may limit functions depending on what PI verdicts are available.

And would likely break pretty much everything

You can spoof a locked bootloader....but TEE will always tell the truth.

Play Integrity is specifically designed to resist this by means of encryption and unique tokens for each device.

Happy to help

Correct. Google does require some of these verdicts for their own apps. but Google Mobile Services (and Play Integrity) do not themsevles restrict, inhibit, or otherwise prevent any normal device function. PI is just an indicator.

Alternative rooting methods won't help. Yes, you can potentially escape root detection with things such as KernelSU...but you can't escape an unlocked bootloader.

I'm not sure this is even practical, aside from two fully separate hardware configurations with no I/O between the two. This would mean shared storage would be a no-go, at least when it comes to user data and internal storage.

If for example it were possible to lock the bootloader on one slot of an A/B device, the other slot could still compromise the locked slot.

Personally, I'm willing to accept the inconveniences that come with having a rooted device. I can still use GPay and Wallet, and my banking apps still work. Granted, this isn't the same for everyone because some app developers really do seem to have it out for power users...but that's just the sacrifices we make.

@BunnyPig1's question actually gave me an idea, though. Android has the capability to load a guest OS via Dynamic System Updates - using signed Google GSIs. I will have to experiment with my Pixel 3 and see what sort of Play Integrity verdicts I get.
[Magisk] osm0sis:
Ah, weird that MSYS/git bash/echo apparently can't handle \n in the on-screen output or the file output, but I'll tweak things to make it more portable, probably this evening. 👍
[Magisk] badabing2003:
This didn't work on Pixel 5 with A14 on it.
[Magisk] osm0sis:
@lmvuong1997 I found a little time on my lunch, check out the new version attached here and let me know if it's working now on your setup:

[TOOLS][ZIPS][SCRIPTS] osm0sis' Odds and Ends [Multiple Devices/Platforms]

osm0sis' Odds and Ends -- Misc./Batch Tools, Flashable Zips, Scripts, etc. General Information In a nutshell, I just wanted a single thread to gather links to some of my other, larger projects, but also serve as a spot I could put some smaller...

xdaforums.com

🤞🙂
[Magisk] Iridule:
Just for fun I dumped my quest 3 print ofc it doesn't work 😄 ...it's running android 12
[Magisk] V0latyle:
Try changing API to <27
[Magisk] Iridule:
I did...didn't work.
[Magisk] HippoMan:
That's exactly what I meant when I called GPay and Walled "system software". And I later contrasted them with "3rd-party apps".

And that's why I wrote the following: "Those PI restrictions are also used by some 3rd-party apps (banking apps and also some non-banking apps) to limit those apps' functionality." In other words, I described how the apps themselves limit their own functionality based on the PI verdicts.
[Magisk] Iridule:
It is nice to know PF works with nearly every android device even quest...thanks @badabing2003
[Magisk] manjaroid:
Yes, a very level headed explanation. Recall that it wasn't that long ago when Mr. Wu became a Google employee and the root community's assumption was that Magisk would fold. That was that and here we are.
[Magisk] chiteroman:
You can pass Strong when the root of trust extension in leaf cert is valid and the certificate chain is signed by Google key. That's it.
[Magisk] Umgak:
Getting such a device certified by Google would also likely be impossible, as it's explicitly designed to exploit and bypass their protection methods, meaning you'd have to spoof another device anyway, and then we're back to the current scenario.
[Magisk] ipilcher:
The fact that Google allows these applications in the Play Store is the primary reason that I don't feel bad about working around Play Integrity.

I have no desire to use my phone for payments, but I'm sick to death of hotel and airline apps, Reddit clients, etc. that require DEVICE integrity just because they think it's a magic "make everything secure" button.
[Magisk] HippoMan:
Yes, probably, although there is technically no spoofing going on, because it's actually two separate devices sharing one case and one screen, etc.

But anyway, even if Google could be persuaded to allow such a device, there's probably zero chance that anyone would manufacture such a thing, in the first place. My idea is more of a dream than anything else.

A compromise alternative is to get a cheap smartphone that is kept with its bootloader locked, and to use it for contactless payments while using my rooted/modded phone for pretty much everything else.

I'm considering that possibility.
[Magisk] simplepinoi177:
If you are paranoid about that like I am (and if you haven't come across this tool yet), you should check out this tool below. I can't completely confirm it works until my fingerprint gets burned, but I see the toast every time my screen unlocks so it looks promising! And a member said it in the thread that worked for them in the exact intended circumstance it was made for...

GPay Checker: monitor of Google Pay availability

Google Play Protect now triggers onto app (that's honor for me), but here nothing criminal. You can safely skip warning. There is non-zero theoretical possibility, that using this app increases risk of banning your personal fingerprint. There...

xdaforums.com
[Magisk] Vision:
Yeah exactly, like the feature have now the new phone with second profile, if we can have 1 phone but 2 bootloader, 1 unlock and the 2 locked and when booting choose what profile you want to start with unlock or locked
[Magisk] V0latyle:
Ah OK, I had read it like you were saying PI somehow limits Android core functions

Exactly

"Leaf cert"?

Well, Google does have their own motives, and they aren't always good. They don't host anything in the Play Store that blocks ads, for example; I download the NordVPN app direct from the website instead of using the Play Store version. I also use Amazon and Kindle, and I find it irritating that I can no longer purchase books through Kindle or the Amazon app, because Google demanded a 15% cut of all content purchases through those apps.

Question is, at that point, what's the point when you can just use the cards (assuming your bank provides contactless cards) or maybe a smartwatch with contactless pay?
[Magisk] vamteusz:
does TheFreeman193's solution still work? i cant even pass basic integrity 😐
[Magisk] simplepinoi177:
Because it's been determined that the fingerprint that was embedded in 14.6 is passing (for the time being). So much so that chiteroman actually released the newest version (15.1) with the same fingerprint embedded, so it passes for users who don't want to look for their own fingerprint and who install the new version, but has stated that once Google bans it (it is inevitable), he will once again no longer go about embedding a working fingerprint...
[Magisk] V0latyle:
What module are you using?

I've been a bit out of the loop but I believe what Freeman provided is a script to pick a print at random. You'll need to keep trying prints until you find one that works.
[Magisk] simplepinoi177:
Had it worked before previously? Or is this your first time running it?
[Magisk] EuK_V:
I found working fp with first api level 32 and android version in the fingerprint line - 14
[Magisk] pupochek:
FWIW, there is an obvious fairly cheap alternative - a smart watch :-) No problem paying with a smartwatch paired with a rooted Galaxy s23+
[Magisk] sethieplayz:
Osmosis v5
[Magisk] sawdoctor:
Google have added "safe space" and "quarantine" hope I've got it right in QPR beta. So theoretically these maybe able to be modified and isolate bank apps etc from the rest of the system.
[Magisk] sawdoctor:
Yet i can install Mullvad vpn from the playstore that has DNS add blocking, wierd
[Magisk] HippoMan:
Yes. I accidentally wrote "cheap smartPHONE" above when I meant to write "cheap smartWATCH" as an alternative.

Now I'm looking for the simplest and cheapest Android-capable smartwatch I can find which always shows me ONLY the date and time without my interacting with the watch at all, and which keeps all its other features totally hidden unless I specifically interact with the watch to request them.
[Magisk] Vision:
I heard long time ago some similar, Google and other manufacturers want make ROM with rooted feature with safety.

imagine buy new phone and is already rooted (what a dream)
[Magisk] Umgak:
If you're failing basic, something is wrong with your setup. Try disabling other magisk/lsposed modules and see if it comes back. Pickaprint will only help you after you're passing basic.

Also make sure that GMS processes are NOT in the Denylist. The module will attempt to remove them but if you add them back you will fail PI.
[Magisk] vamteusz:
play integrity fork (i tried with v4 and v5). i've tried so many times that i feel something is wrong. i can't even pass basic level.

previously i had pixel experience (android 12) and it worked fine. today i flashed pixel os (android 13) and it didn't work.

play integrity fork is the only magisk module that i have. after flashig new custom rom i had basic level but when i used pickaprint for the first time then basic disappeared.