yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
The objective is both to spoof a device that Google hasn't determined is HKA (hardware key attestation) compliant, and to find prints Google haven't blocked for spoofing purposes either with whatever cross-checks they are doing...

Samsung A50 launched with Android 9 (HKA was mandatory from Android 8, Keymaster 3.0) so is most likely on Google's list for hardware backed evaluationType enforcement... Many OnePlus, a few Xiaomi and other models were exempted due to OEM messing up Keymaster/chain of trust implementation, but I think Samsung generally got HKA right.

This understanding may help you to select devices too spoof and print/prop/field sets to test more logically. 😉 PW
[Magisk] SHERMINAT0R:
thanks a lot
[Magisk] Radzią:
Why is my deny list empty? Lasted magisk 27

View attachment 6092935
[Magisk] Wolfcity:
Have you put something on it?
[Magisk] Vision:
But before tick it a app in Denylist, it should show apps inside to choose what want to tick it
[Magisk] V0latyle:
Yep, even if nothing is enabled, apps should still be listed

@Radzią did this happen when you installed this module?

If this is a Magisk problem you need to ask for help in this thread
[Magisk] VFL:
Are that not ban today ? Or does it still work ?
[Magisk] SHERMINAT0R:
It is currently working
[Magisk] VFL:
Why happned today all FAIl i havent changed anything not touching. until yesterday was everthing ok

what can be reason
[Magisk] SHERMINAT0R:
I have no idea, I don't know much about this issue myself
[Magisk] Claus….:
It works for me.
[Magisk] pndwal:
See this:

https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-89462632

🤠 PW
[Magisk] menuisier3:
Good morning,

Apart from France Identity, everything works, a big thank you for your work
[Magisk] chiteroman:
The purpose of the module is to pass the Device verdict and not to bypass app protection, that app you mention gets the device's certificate chain and checks if the bootloader is locked.

It may also detect Zygisk, LSPosed, if you are using a custom rom...
[Magisk] hungyip84:
Several payment apps in my country is starting to require Android 12+ and above, and require passing strong integrity. I hate this but I guess sooner or later we all will not be able to use banking apps.
[Magisk] ardiesel:
I'm not a beginner but I'm also not a pro at all this stuff. I take your word for it and your suggestions to fix issues. What is the apk you posted on your telegram channel for?
[Magisk] zgfg:
Do they really require Strong Integrity (or it just 'looks' to ppl that they do - in many cases 'banking' apps can be still tricked by Shamiko, DenyList, HMA, possible by using Magisk Delta or Alpha for better hiding)
[Magisk] hungyip84:
The new feature of the app specifically required Android 12 or above. The local community tried all kind of methods but still cannot get it to work. It is reasonable to conclude that it is requiring Strong Integrity. Another payment app seems to be following soon as it is stopping support on Android 11 or below in the coming week.
[Magisk] zgfg:
Try to find somebody with the Rog phone , unlocked BL and fake Strong Integrity (possible, although I don't know if on Rog with A12+) to test if he could break - that would be a good test to see if the app really goes for the Strong Integrity
[Magisk] Dzonins:
Do RCS chats in google messages work with module installed?
[Magisk] LordDemecrius83:
I think the fingerprint has been banned once again

EDIT: It was zygisk assistant that made it fail DEVICE
[Magisk] fbirraque:
Already checked and Play Integrity still fine
[Magisk] casouzaj:
For me, yes! Sony Xperia 1 II, running Pixel Experience 14 Beta (it comes with KerrnelSU). I installed Shamiko, as well.
[Magisk] Nergal di Cuthah:
If you mean griffin it still passes device here
[Magisk] AzeriVandam:
Hello dear people. I get this error message please help.
[Magisk] CZ.Kostra:
FP XEU Checker

Edited and exported as application.
[Magisk] ardiesel:
What does that apk do, sir?
[Magisk] zgfg:
Click to his link and read
[Magisk] ardiesel:
Well thank you sir for that wonderful suggestion I appreciate that very much I'm talking about the APK that he posted in the telegram group or channel rather, but thank you very much for giving me information that doesn't tell me what the APK does thank you
[Magisk] ardiesel:
Just so we're all clear I do have the magisk module installed on my rooted device I'm asking what the latest APK that he posted in the telegram channel does
[Magisk] zgfg:
Address to whom and specify precisely which app you are asking for. Eg, put the screenshot from TG channel (since links to TG are generally not allowed), name of the app, something

Otherwise, there are hundreds of users here and endless numbers of TG channels out there - how do you expect who could understand what are you asking and whom. Btw, make sure it is not out of topic for PIF

(Unless you wanr to pkay hide and seek or something)

Also, decelopers of modules and apps uaually have their GitHub accounts, with usually a good Readme describing how to use, etc. Hence, google eg for:

"GitHub <developer name> <app name>"

Or quote and ask directly on TG channel you are thinking about
[Magisk] dosbuddy:
Do you mean this?

View attachment 6093862

This app supports generating, saving, loading, parsing and verifying Android key and ID attestation data.

Github: here
[Magisk] ardiesel:
Thank you
[Magisk] ardiesel:
Yes, the first time I inquired today was about this APK posted by the developer. My original but not novel question had to do with him posting in his TG channel. Then zgfg got all smart alecky with his read the link nonsense. Thank you for telling me what the app does.
[Magisk] Nergal di Cuthah:
To be fair your post, with zero referring quotes or user tags, came directly after a post with an apk linked in it

View attachment 6093879

Edited for proper grammar
[Magisk] zgfg:
What was nonsense?

Asking you to say precisely what 'app'' you were questioning about?

Or suggesting you to use google and to find the link to the 'app' Readme on GitHub and read things you wanted to know?

You never named the 'app' but asked couple of times... Think if somebody would ask similarly, would you help and how, how would you guess what he asks about

Besides, the same developer has several different projects on GitHub (all related about the same interests)
[Magisk] pndwal:
Can you name the apps 'requiring Strong integrity'? 👍 PW
[Magisk] ingkey:
"Ingress is not supported on this device configuration." Error (Android Only) — Ingress Help Center

In an effort to combat cheating, as of 2.138, Ingress only supports Android devices that meet Google Play Integrity’s (GPI) BASIC_INTEGRITY

niantic.helpshift.com
[Magisk] ardiesel:
You didn't see that I had posed a question specifically about the key attestation app first. Apologies for the confusions, I will be better next time.
[Magisk] zgfg:
Ok, there is also a specific thread about

🔐Spoof locked bootloader | "Bypass" TEE check

Modify the root of trust in local attestations. This module modify the byte array obtained from certificate extensions (link) to spoof a fake root of trust, so we get a fake attestation with a locked bootloader. More info about certificate...

xdaforums.com
[Magisk] Kurt Krummbein:
If you'd spent as much time and words on your first request, this thread would stay smaller ...
[Magisk] pndwal:
Interesting... So we have a heads-up that Ingress game will require STRONG_INTEGRITY for 'scanner' from May 2024... Guess it may be expected that game Devs would be leading the rush... Old/popular game Fate Grand Order (and others) beat most banks in developing Magisk/root detection methods too...

Please explain to a non-gamer what 'scanner' is... Will that restriction make the game unusable w/o STRONG?.

Still very interested in details of 'payment' apps already 'requiring Strong' @hungyip84 referred to however. 🤠 PW
[Magisk] ardiesel:
Good point, but let me add this why don't
[Magisk] osm0sis:
Thread would be a lot smaller if people would stop piling on and dragging things out as well.
[Magisk] Vision:
For something like this I had worries, because I don't use bank apps. Etc. but I want the games 😢
[Magisk] Wolfcity:
The "scanner" is a part of the game, Ingress is an augmented reality game where you have to walk around and interact with things ( special points like monuments). GPS is needed and without the scanner the game is unplayable.

I played that game for a long time and the only method the developers ("Niantic", formerly part of Google,also the developers of Pokemon Go) used to check out rooted devices was a TWRP folder (you just have to rename it to TWRX or something similar and you're good to go).

So I'm really astonished that they go from a very low check to a very high one now.

As Pokemon Go is most probably affected too it would be a hard hit for the community of these games.

Sounds to me as if several (game) devs start to use strong now.

Not a good sign.....

Niantic, Inc. - Wikipedia

en.m.wikipedia.org

Edit: Added link
[Magisk] Vision:
This is not good, not only for games, but if put that in Netflix etc. we totally lose the game (GAME OVER), because can't pass strong
[Magisk] osm0sis:
Yeah but neither can older devices, so anything wanting/allowing a broad spec'd usership won't jump the gun on enforcing STRONG.
[Magisk] blanktape:
Hi how did you resolved this? I can't pass integrity all red now.

Thanks in advance
[Magisk] majorfigjam:
If you don't have Device Integrity, or don't know what that means or have other questions, then read the Most Liked All Time posts and the linked FAQs.

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)​

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. You will need root and Zygisk, so you must choose ONE of this three setups: - Magisk with Zygisk enabled. - KernelSU with ZygiskNext...

xdaforums.com

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)​

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. You will need root and Zygisk, so you must choose ONE of this three setups: - Magisk with Zygisk enabled. - KernelSU with ZygiskNext...

xdaforums.com
[Magisk] Vision:
Yeah understand, still lot of people use old devices without strong, if enforcing STRONG from now, lose costumers, now the Google Play Protect send false positive alert in lot of apps when go to install because have minimum sdk Android 7 or 8 etc., want us to buy new phone with Android 12+ because have more control there 😂🤣
[Magisk] Wolfcity:
Only for information:

Ingress Prime: Android 8.0 or higher

Pokemon Go: Android 9.0 or higher....
[Magisk] fbirraque:
Hardwares and OS became deprecad (or vintage) so as expected soon thing goes hard. Android 15 will be a huge challenge for the custom ROM. 😔
[Magisk] infans_stultus:
If I right understand,

I can run this script on my phone

and my kernel name will be changed?

And second question. Do I need to do it with "su"?
[Magisk] intel_core_i7:
Netflix in this case already requires Android 7 minimum. It's not difficult for them to drop support for it sometime in the second half this year or in 2025

Quick edit: until now netflix has never used PI to function. PI is only used within Google Play to block app downloads, and with that you can just grab an apk and install it normally. The main concern here is Widevine DRM, Netflix will refuse to work unless yours certificate level is L3 or L1
[Magisk] TheFreeman193:
Yes, this script can patch the kernel release name if you pass the --auto switch and a new name with the --patch parameter.

The script needs to be marked as executable and run with su because it has to copy the boot image, extract the kernel, find the offset for and modify the release name in the UTS structure, repackage it into a new boot image, and flash that back to the boot partition. It does all this using Magisk's busybox and magiskboot binaries.

As described in the post you quoted, the script doesn't allow you to change the numeric part of the release name (the part before the - dash/hyphen) so the value you use with --patch shouldn't include this.

For example, if uname gives you the following release name:

uname -r
# 4.19.230-lineageos

And you run my script as follows:

su
chmod 755 ./kr_offset.sh
./kr_offset.sh --auto --patch "-newvalue"

Once you have rebooted you should see the kernel release name has changed:

uname -r
# 4.19.230-newvalue

newvalue can be anything you like as long as it's not in the Banned Kernel Release Name List.

Please back up your existing boot image beforehand. If something goes wrong with flashing the modified boot image, it could leave your device unable to boot.
[Magisk] infans_stultus:
Thank you for explanation
[Magisk] pablo8989:
Is it possible to pass device integrity on LineageOS 16 Android 9 (API28) ?

For a while it worked using magisk and play integrity fix but now nothing helps.
[Magisk] CZ.Kostra:
Isn't your core banned?
[Magisk] pablo8989:
I have renamed it.

uname -r
# 4.4.189-myown
[Magisk] konstantinos_general:
Also wondering the same, running LOS A11, it was passing device integrity for 10-15 days and then suddenly stopped, now only basic integrity is passing on play integrity check and both cts profile and basic integrity on safety-net, tried using Griffin FP, also tried using a custom FP extracted from a build.prop, playcurl, playintegrity-fix, playintegrity-fork but no luck at all. It seems like DG somehow detects that the FP is not correct fot this specific device or somehow it detects the custom OS.

My device is Huawei p10 lite (WAS-LX1) and running the stock kernel:

Linux localhost 4.4.23+ #1 SMP PREEMPT Fri Mar 1 12:42:37 CST 2019 aarch64

Can we somehow decompile DG and look what it checks on the OS?
[Magisk] zgfg:
Verdict is given on the G server side, hence not possible to debug/decompile.

And they can make changes the logic there anytime they want, we cannot know

DroidGuard:

/data/data/com.google.android.gms/app_dg_cache/*/the.apk

mainly collects the data

Whitepaper PDF with some info about reverse-engineering DG attached.

IDK if there were newer results/attempts, and was it published openly
[Magisk] zgfg:
(If not mentioned earlier) new Wallet now requires biometric authorization before a payment (except for Public Transportation - but it must be disabled in the Wallet Settings)
[Magisk] intel_core_i7:
I had seen the banners inside the app earlier this month. Though in my case it only asked if I wanted to have biometric autohrization for Public Transport, everything else was pretty much the same.

Spoiler content hidden.

Probably because my phone was for Japanese market, so it didn't really say settings have been changed since I must unlock the phone beforehand, and when phone is unlocked I can just tap at the home screen without any additional verification. Tap to pay when phone being locked is reserved for Felica cards.

P/s. I don't live in Japan, and our public transportation don't take credit cards so this change is meaningless.
[Magisk] beeshyams:
Apologies, wee bit off topic but just as FYI

As I explained to @pndwal many pages ago, in India we have Gpay (no wallet) which doesn't require device integrity, so this print spoofing didn't really bother me.

However, for the last month or so I saw an additional feature in Gpay which allowed me to add a card. This obviously needs device integrity so I added and with Griffin print I am good to go but yet to use (frankly, I am not likely to use it since scan to pay is as easy with just basic integrity and one never knows when Griffin gets banned and I am in no mood to spend time hunting those 5% custom prints)

Just as FYI on the variations of Gpay
[Magisk] HippoMan:
Thank goodness that my leather wallet doesn't require anything like that for me to be able to use my plastic cards.
[Magisk] InsaneNutter:
I suspect rolling out strong integrity on Ingress is more of a test run for deploying it on Pokemon Go, where a big chunk of Niantic's money is made these days.

On the subject of that, what some might find interesting is theirs a modified version of Pokemon Go that proxies safetynet calls to real devices that can actually pass, allowing the game to work on pretty much anything that can run Android, including emulators and in Docker containers: https://www.romainthomas.fr/post/21-11-pgsharp-analysis/#safetynet

With that in mind I wonder if it would be possible to proxy strong integrity checks to devices with a broken TEE?

Granted even if possible, not really a solution as you wouldn't want to be using modified banking apps for example, or even games if you care about your account.
[Magisk] wilsonhlacerda:
I've been already suggesting something like that for Android in general, to implement something on system itself/root/Google Play Services. Similar to what CS, IKS (Card Sharing, Internet Key Sharing) have been done on Satellite piracy for more than a decade. First time I mentioned it was to Magisk dev himself years ago, Android 8 age, but he rejected the idea immediately.

Nice to known that we have kind of Proof Of Concept already working, although for an specific app. I didn't know that.

If no exploit are found for Strong I do believe that could be an alternative solution for Android.
[Magisk] zgfg:
Excellent analysis and the novel cheat

But to break SN, PGSharp relies on:

- PokemonGO app 'patched' by PGSharp

- PGSharp server (with a real PokemonGO app behind)

On top of that, all that won't work if Niantic (vendor of PokemonGO) would not ignore the incorrect apkDigestSha256 being received with the cheated SN attestation

---

Hence, for the similar general cheating of Strong PI verdicts, it would also require a 'patched' version for each and every 'banking' app (banking apps, games, MD, etc) and also the weaknesses on their servers (banking servers, gaming app servers) when they process the submitted PI verdicts
[Magisk] BunnyPig1:
Deleted
[Magisk] HippoMan:
https://xdaforums.com/t/discussion-...ding-cat-and-mouse-game.4425939/post-89475102
[Magisk] BunnyPig1:
Very true, it was way OT when there is a dedicated thread, forgot about it and jumped straight in. Thank you for pointing it out.
[Magisk] chiteroman:
That's software enforced, I don't know if it's possible to spoof that without root.
[Magisk] zgfg:
That part is going on on the Niantic server checking the submitted verdict (that was in fact obtained from the other, stock device in the PGSharp yard)

I don't see the root here. It looks (as mentioned in the article) as a flaw on the Niantic server, that properly checks the signature and the verdict itself but not the token

And the PikemonGO app patched by PGSharp does not require root (as per the article)

---

But the article is about SN, not PI - and 2,5 years old, from Nov 2021
[Magisk] sonepib591:
chiteroman can you add default sensitive props from mhpc or here? i've checked your postfs doesn't include some of it. I have dumb apps that still detect prop value.
[Magisk] pndwal:
Have you tried running MHPC (w/o configuring anything)?... That will fix original MagiskHide sensitive props as needed per device (default setting; only one not needing configuration)... If that's already working, I agree that it would be beneficial to have any missing added in PIF and other current solutions. 👍 PW
[Magisk] osm0sis:
There aren't any from MHPC or USNF that are missing in PIF.

If you or anyone figures out a new one that is actually important, and non-dangerous to reset, then please report it to us here or open a Pull Request.
[Magisk] pndwal:
That's what I thought, but since member said some aren't included I wanted to be sure there's a difference with MHPC installed in addition to PIF... PW
[Magisk] osm0sis:
Well, kdrag0n and I brought them over directly from Magisk when MagiskHide (which I was also involved with) was removed, and as far as I know MHPC never really added any beyond that either:

History for riru/template/magisk_module - Displax/safetynet-fix

SafetyNet & Play Integrity API workarounds for Magisk - History for riru/template/magisk_module - Displax/safetynet-fix

github.com

History for magisk - Displax/safetynet-fix

SafetyNet & Play Integrity API workarounds for Magisk - History for magisk - Displax/safetynet-fix

github.com

Anything that's been removed since in USNF or PIF was done for the specific reasons in the commits. It's all open source. Peruse away.

Here are the newest ones I've added to PIF and weren't in MagiskHide, USNF or MHPC:

Reorganize slightly and add missing props · osm0sis/PlayIntegrityFork@a963090

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - Reorganize slightly and add missing props · osm0sis/PlayIntegrityFork@a963090

github.com

Edit

:

MHPC is significantly more convoluted, but you can see we had the same props:

MagiskHidePropsConf/common/util_functions.sh at master · Magisk-Modules-Repo/MagiskHidePropsConf

This tool is now dead... Contribute to Magisk-Modules-Repo/MagiskHidePropsConf development by creating an account on GitHub.

github.com

MagiskHidePropsConf/common/propsconf_late at master · Magisk-Modules-Repo/MagiskHidePropsConf

This tool is now dead... Contribute to Magisk-Modules-Repo/MagiskHidePropsConf development by creating an account on GitHub.

github.com
[Magisk] SHERMINAT0R:
Hello, could you please explain why, if I log into Google Play and go to security settings, sometimes it shows Motorola Z and sometimes my real device? If it displays Motorola, it's logical because my PIF .json has the Motorola fingerprint. However, sometimes my real device is displayed. What causes this? Is there a way to always display my real device there?

View attachment 6095914View attachment 6095915
[Magisk] Vision:
Is a little know issue.

View attachment 6095922

Read more here, excellent guide by @osm0sis

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com
[Magisk] sonepib591:
@osm0sis @pndwal

mhpc default failed with errors, something must be changed in newer magisk

i've manually edited my buildprop to match what's changed in mhpc and the 2nd source

my dumb app doesn't complain anymore, nothing funny happen, that's all i know
[Magisk] ashish1989:
Can not give external storage permission to it in my J7 Prime custom One UI android 9 rom. Can not grant required permissions from an permission manager app too.
[Magisk] jesusmolon:
So it doesn't work for xiaomi.eu? :(
[Magisk] 0czko:
No, it doesn't. I have eu too.
[Magisk] Catarsi:
Apparently not, needs to be addressed by the xiaomi.eu team
[Magisk] MikeZh:
Works in xiaomi.eu on A12 and MIUI13. Cheers!
[Magisk] MikeZh:
I've already addressed the same info about the previous problem. An answer was "do not use Magisk". Seems useless 😁
[Magisk] Morhoo:
You're a Man!
[Magisk] towe96:
Thank you so much for the incredibly quick fix. A thanks is underway. Maybe you could set up a Patreon too?
[Magisk] docnok63:
I installed v12, wiped in this order, rebooted, fired up the Play Store, and YASNAC now times out on my P8P. Any advice you have or log you need?
[Magisk] Ginosius:
I didn't had to clear anything.. it started working right after the reboot from v11 (pre-release) to v12.

It was funny because the card reader at the store rejected because the Google Pay Wallet app told me the phone was tempered with.

An update to v12 and a single reboot had it working right away.

I didn't even needed to "re-add" my card to the Google Pay Wallet lol.
[Magisk] docnok63:
Based on a post in TG, I uninstalled the YASNAC app and tried again. Everything works now!
[Magisk] ripereira01:
Friend, I believe it doesn't work on Miui, will there be an update to make it work? If not, everyone will stop using Miui kkk

Have group in telegram?
[Magisk] fkofilee:
Works for me after USF Displax stopped working :)

Back to Google Pay now :)
[Magisk] famusc:
Latest working version on 13 Ultra xiaomi.eu v14.0.20 android 13 was v9.9 for me, so it was working recently.

I see v12 changed a lot: hope xiaomi.eu team can integrate it.