yashsingh1/xdaforums huggingface dataset:
[Magisk] strayh_:
Thank you for your reply, I'm using Magisk alpha And this modules , I also added the application within the option DenyList , It still doesn't work, I don't use a custom recovery , What is the solution in your opinion ?
[Magisk] zgfg:
I told you where to start, what to search for on XDA, then read, try that, retest

It depends on your particular app, it depends on your ROM

Try to search how the others solved for that PARTICULAR app

Sorry but questions like: An app (undefined which one) still finds root (ROM undefined), please help how to fix are pointless and no one can give a (straight) answer
[Magisk] Johnn78:
Is this module for passing safety-net ?
[Magisk] Lord Sithek:
No. For passing Play Integrity
[Magisk] chiteroman:
Yes

What?
[Magisk] chiteroman:
Which app?
[Magisk] famusc:
@chiteroman a quick update for better compatibility.

As I wrote on my previous post, version 7.1 didn't work correctly on my xiaomi 13 ultra with xiaomi.eu 14.0.17: it passed attestation randomly, but of the times didn't.

So I tried version 7.0 and works perfectly good: it passes attestation all the time.

13 ultra is a native Android 13 device but for some reasons it doesn't like your last commit. Maybe is the first_api_level check? Or the Provider setProp?

Any idea?
[Magisk] pndwal:
🤔 I thought this was 🔧 [MODULE] Play Integrity Fix thread! 😂

What apps still use SafetyNet?... Good thing Migration deadline is extended to January! 😄 PW
[Magisk] pndwal:
To use Impressions in Face app? 😋

Only fix is lock bootloader...😜 PW
[Magisk] strayh_:
I've discovered my problem, this app seems to have started to unravel Lsposed
[Magisk] jamesmurat0001:
Hi, the Uber driver app is detecting root no matter what i do, uber let you do everything on the app except going online. when strong integrity was passing, i was able to go online no problem. please someone help, I know there's a way because Ive seen people use it on rooted devices but they wont tell you how. I am using a oneplus 9 pro running Crdroid 9. thank you
[Magisk] pndwal:
Yeah, several drivers have reported that detections were added for Uber Driver app on Aug 4... Have you seen it working with root since then?... No-one has found fix with unlocked bootloader yet AFAIK...

App opens and can sign in fine, apparently even sign up with Uber, but detection occurs when you press GO button to proceed with a job and you see "unable to authenticate device" error.

I can't test further but suggested one user try the app with Alpha Magisk (has native bridge loaded Zygisk) and Shamiko hiding here:

https://xdaforums.com/t/need-help-uber-driver-app-not-go-online.4614295/post-88851595

This has been done (not enough to bypass detection), but may try the last suggestions I made in that thread, especially how to spoof OEM unlocking disabled. No response about that yet...

If that doesn't work there may be some other detection used that can be bypassed but I suspect they may be using Google's published model for "Verifying hardware-backed key pairs with Key Attestation" to poll VerifiedBootState along with Keymaster/KeyMint version:

https://developer.android.com/training/articles/security-key-attestation

If apps are now doing this instead of relying on Play Integrity API, I'm sceptical any solution will be found short of re-locking bootloader. 😬

🤠 PW
[Magisk] mapleshadow:
I am a translation engine. Translating the given text to English: "My phone is Xiaomi 13 Ultra. After using this module, the Google Play Store cannot be opened. It always stays on the homepage, and some applications freeze for no reason."
[Magisk] Johnn78:
What is "Play Integrity" ? Like safety-net ? Because it refers that is alternative with "Universal Safety-net Fix of Dragon" which is for passing Safety-net.
[Magisk] chiteroman:
[INFO] Play Integrity API - replacement for SafetyNet

THIS IS NOT A SUPPORT THREAD. For questions and support regarding how to fix your Play Integrity verdicts, see the Play Integrity Fix thread. ⚠️BEFORE YOU ASK A QUESTION, READ THIS POST AND THE FAQ!⚠️ ****Update 12/11/23**** Google has been...

xdaforums.com
[Magisk] chiteroman:
Uber driver require Strong integrity, you must use stock rom and lock bootloader to use it.
[Magisk] zgfg:
SafetyNet is deprecated and most of apps have already switched to Play Integrity API as required by Google

With the old and out-dated KDragon's USNF module you may still be able to pass SafetyNet (and Play Integrity since they share some technical aspects), but for most devices users have already needed to update the USNF to the fork from Displax or to this PI Fix module

Read the posts here in this thread, in the original KDragon's thread, google about Play Integrity
[Magisk] dosbuddy:
wow, that was fast!

empty pif.json

Thats the future!
[Magisk] martyfender:
Why were all of the releases and beta builds removed from github?

@chiteroman

UPDATE: Never mind, it only appeared to be a temporary problem a few minutes ago.

Thanks
[Magisk] HippoMan:
Yep, same here as of this morning.

The Googlefrinchian Telephone Sanitizers strike again!
[Magisk] TheRomRooster:
cause they are dead, google banned all the fingerprints
[Magisk] 130ryokohama:
for PIF v14, can someone please write a quick guide as to how we find a valid finger print and install it?

this is for us non devs and android savvy people
[Magisk] Gilg@mesh:
hmm, after many years not having to carry cards it might be time to do it or worst case go back to Samsung device which at least lets me modify it quite a bit without root.
[Magisk] HippoMan:
PS: I'm not trying to claim that the Googlefrinchians are actively out to get us. Rather, they just have other priorities and agendas, and they simply don't give a s**t about us modders.

And they therefore don't mind walking all over us if we happen to get in the way.
[Magisk] dmenezes:
III

Ditto here, as of about 1h ago:

View attachment 6038962

This is just plain fascism from Google :-|

Well, guess now's the time I will have to sit down and go through the whole rigmarole of finding a still-working fingerprint and building my own pif.json... :-( and I really don't have the time for that right now.

But it is what it is...
[Magisk] IAMAB:
A step to step guide on how to make v14 work would be really appreciated. If it can be pinned in the OP
[Magisk] Donut_Man:
Where can I find my own custom fingerprint? Can I extract it from my phone? I don't really follow this stuff so it would be really nice if someone knowledgeable would share a guide on how to do this if it's possible, it would be much appreciated.
[Magisk] V0latyle:
That's pretty much the nature of the game here

Everyone needs to find their own fingerprint to use. Honestly this fix as it is right now, is slightly counter productive - until @chiteroman or someone else develops a script that randomizes the print on each device, it's very easy for Big Brother to monitor this module and simply defeat each new print used

The only way around this is to remove prints from this module entirely, and either use an aforementioned automated script, or for the individual user to find their own print.

Even then it's just a matter of time until all mismatched prints are banned
[Magisk] V0latyle:
It HAS been linked in the OP but since no one reads the OP....

No,, you can't use your own phone. You have to find a build.prop from a different device.

Guide
[Magisk] makeyourself:
How is Google blocking these fingerprints when they are being spoofed yet still allowing them to work on the actual devices in question? Are they examining the state of other props not currently being changed by PIF? The answers to that would seem the pertinent questions to me.
[Magisk] UberNorse:
Confirming 14.0 with custom PIF.JSON passes PI.

Pixel 7 Pro

Magisk Canary

Android 14 Stable

EDIT - Since people will obviously have troubles on how to do this I would recommend in the future that you stay up to date on the thread throughout the day. It's better than playing catch up.

If you don't have the time or not willing to make the time then you must deal with the consequences. We are all busy but if passing PI is THAT important to you, you will find a way. No need to clog up the thread with multiple guide requests when it's in OP as well as pages back. The module has instructions on GitHub.
[Magisk] UberNorse:
They aren't necessarily. They are intercepting mismatched prints and stopping that in some way.
[Magisk] dragonball818:
where can i find fingerprints
[Magisk] c3k:
Simple question: I see custom pif values (product, device, ecc) in adb logs, but play store json result still report the real one. It's ok?
[Magisk] St0RM53:
Bad GOOGLE. What is their problem anyways. I started using wallet just 2 months ago for years now they mess up every other day and got me failing over at least 5 times so far. EU should regulate their ass with fines and split them in 100 companies already. Same with Amazon and Apple.

{Mod edit: Inappropriate language edited or removed. Oswald Boelcke, Senior Moderator}
[Magisk] UberNorse:
Yes. From my understanding droidguard is the one that receives the spoofed key but for apps that check prints they receive the real ones.
[Magisk] Lu5ck:
I know it is fixed because I reported the issue.

Singpass 19.2 detected KSU · Issue #991 · tiann/KernelSU

Describe the bug Singpass 19.2 detected KSU To Reproduce Steps to reproduce the behavior: https://play.google.com/store/apps/details?id=sg.ndi.sp Run the app Got detected Expected behavior Not dete...

github.com
[Magisk] Vision:
Oh understand, thanks for info, now the latest is v14, i think to try it (without resetprop). If @osm0sis, @pndwal, @zgfg agreed is good and better than v13.3
[Magisk] :
Fabulous m8
[Magisk] c3k:
Thank you.

I can confirm v14 working ATM, [MEETS_BASIC_INTEGRITY, MEETS_DEVICE_INTEGRITY] on S21
[Magisk] Gilg@mesh:
btw, is it only Google Wallet/Pay that this effects? I noticed my bank does have a wallet app that lets me pay, would that work? (I will obviously try it out next time)

{Mod edit: Inappropriate language removed. Oswald Boelcke, Senior Moderator}
[Magisk] Lu5ck:
I was using that but after the previous fingerprint, it doesn't work, even when I changed to the nvidia fingerprint. So I assume you need to do more to spoof. If someone managed to get it working, please share the know how.
[Magisk] pndwal:
It must also achieve USNF/PIF main purpose, ie to cause the on device fallback to BASIC-only attestations which has nothing to do with props...

It probably alters code in GMS to register a fake keystore triggering an exception that causes fallback like USNF/PIF, but following @kdrag0n method for Proton ROMs... Nb most (all?) Custom ROMs have RW system partitions so this can be done without hooking/code injection simply by flashing a patch... Also, there were other ways to achieve this, eg setting inbuilt flags to disable hardware key backed attestations, but this was deemed too obvious although it did work fine, and was abandoned in USNF in favour of the fake keystore registration trigger..

Setting prop values is really a secondary (fairly simple) function of these device integrity fixes. 👀 PW
[Magisk] ShaDisNX255:
Bank specific apps usually have different methods of detecting root. The ones I use just look for Magisk so it's very easy to bypass their checks.
[Magisk] Gilg@mesh:
yeah I noticed it when I first installed the bank wallet app it would detect root, but after hiding it in Magisk it let me add my card, but do I lose anything else than Google Wallet/Pay?
[Magisk] _mysiak_:
I am probably missing something, but can't get it working. I have an old stock Android device which passes BASIC and DEVICE integrity, but not the STRONG one. I suppose that this is a good candidate. I extracted values from running system and put them in the pif.json file. In logcat I can see that they are applied correctly, but DEVICE integrity on the target device doesn't pass. Has this fingerprint been already "banned", or is there something else I need to modify?

12-01 15:48:24.964 9389 9389 D PIF/Java: Spoof KeyStoreSpi and Provider done!
12-01 15:48:24.964 9389 9389 D PIF/Java: [PRODUCT]: gauguin_eea -> XXX
12-01 15:48:24.964 9389 9389 D PIF/Java: [DEVICE]: gauguin -> XXX
12-01 15:48:24.965 9389 9389 D PIF/Java: [MANUFACTURER]: Xiaomi -> XXX
12-01 15:48:24.965 9389 9389 D PIF/Java: [BRAND]: Xiaomi -> XXX
12-01 15:48:24.965 9389 9389 D PIF/Java: [MODEL]: M2007J17G -> XXX
12-01 15:48:24.965 9389 9389 D PIF/Java: [FINGERPRINT]: Xiaomi/gauguin_eea/gauguin:12/SKQ1.211006.001/V14.0.4.0.SJSEUXM:user/release-keys -> XXX
12-01 15:48:24.965 9389 9389 D PIF/Java: [SECURITY_PATCH]: 2023-06-01 -> XXX
12-01 15:48:26.694 9389 9405 D PIF/Java: DroidGuard detected!

Edit: found another device fingerprint which works, so I guess that my first device is detected/blocked by Google somehow
[Magisk] chiteroman:
Hi @osm0sis can you change the json path plz 🥰
[Magisk] hieudung999:
Is there any way to change device id without root?
[Magisk] Gilg@mesh:
ok so I went and bought a drink and I could still pay with Google Wallet/Pay.
[Magisk] ShaDisNX255:
Some apps that do depend on Play Integrity will probably be hidden from the Playstore and will probably not work if sideloaded. Other than that I can't think of anything major.
[Magisk] V0latyle:
Mismatch

Other device props are visible to Droidguard, so they can easily compare the spoofed print against what the device actually is.

However, we don't know what they're actually doing under the hood to defeat these fixes. They could be monitoring this thread and targeting devices using the spoofed print in each update...Which is why it's best for each one of us to find and use our own print. The "one size fits all" solution is gone and will just result in those prints getting defeated quicker.

The only way we could have a "flash and go" one-size-fits-all solution would be for this (or similar) modules to NOT include prints, but have an automated script that will generate a custom (and unique!) pif.json for each user...BUT, such a thing would most likely still depend on the end user sourcing a build.prop from the build of their choice

@pndwal I just had another idea - are there mainstream custom projects that are CTS certified, i.e. CalyxOS, GrapheneOS, LineageOS, etc? I realize many of these are designed to operate OUTSIDE the Google ecosystem

My thinking is, if any of these were indeed CTS approved, could we not use prints from them semi-permanently, as they're custom OS designed to run on user supplied target device, ostensibly not capable of hardware backed attestation due to self signed boot state?
[Magisk] HippoMan:
Aha! So now we know how to pass the integrity checks: have a drink when using any banking/payment apps! :)
[Magisk] V0latyle:
This only affects apps that use Play Integrity API. Google hopes that everyone would but many don't and instead use their own solutions
[Magisk] ZzEzZ:
I don't think they hide from store, they just say "not compatible with your device". Side loading in theory should still be able to install them.
[Magisk] Gilg@mesh:
lol, what I meant I did not use the banking app but Google Pay and it worked.
[Magisk] awarexda:
When changing pif.json, is it enough to ONLY change line of "FINGERPRINT"?
[Magisk] makeyourself:
I take it these other device props that DroidGuard can see can't be easily spoofed without messing things up elsewhere on our devices? If we could work out which ones they're looking at anyway.
[Magisk] V0latyle:
It's a point of debate right now, @pndwal had some thoughts on this. I don't know that much about propts etc but we have some very brilliant minds that can provide their insight
[Magisk] dmenezes:
It's not a "matter of time" in the case of the "aforementioned automated script", which "randomizes the [finger]print for each device", right?

Because then there would be an infinite number of prints and not even effing Google can do an infinite -- or am I missing something?
[Magisk] Oswald Boelcke:
@St0RM53 @Gilg@mesh

Ladies, gentlemen! I've edited your quoted posts and removed the inappropriate language from them. We don't mind if you talk this way on other social platforms but not on this website that is visited by users of all ages. I suggest that you both review the XDA Forum Rules with special emphasis on rule no. 2! You both agreed to adhere to them when you registered on this private platform.

Just as a friendly warning: Expect more severe consequences to your account in case of further rule violations - especially if you were already in contact with a moderator in this respect in the past. Thanks for your cooperation.

Regards

Oswald Boelcke

Senior Moderator
[Magisk] Genmutant:
Can you (or someone else) give me a rough idea or link a source why I can't use the one from my own device, and how you would pick which kind of different device one should use?

I looked up the fingerprint and props of my devicetype which were dumped and uploaded somewhere, and they are the same as the one currently used by my phone. But they don't work, and using the same to overwrite them is obviously pointless.
[Magisk] GGYT_YT:
Hello guys, my first message here. 😶

Since yesterday my Google Wallet app on my rooted Poco X3 Pro running Lineage 20 randomly stopped working because of the classic - "your phone doesn't meet security reqs bla bla bla" (and btw thank you Google for ruining my school lunch today).

Since that it has been pretty much a roller coaster - I have factory reset my Lineage (and then installed Pixel Experience), re-rooted my phone like 7 times, installed 14.0 of Play Integrity fix, configured zygisk deny list multiple times, storage and cache reset Play Store, services, Wallet and tried to create a fingerprint of my older not-rooted Mi 10T, but it still doesn't work (your phone doesn't meet security yada yada) and after YASNAC and SPIC checks my phone passes just BASIC security, not the needed one for my Wallet to work.

I just recently (about 3 months ago) started ROMing so I am considering myself as a semi-noob and I have pretty much ran out of options I know. I need to get my Wallet fixed by tomorrow or else I won't be able to purchase tickets to a futsal game (really important game for my local team + context - I use a virtual card).

I would like to know your opinions on how to fix this major issue.

Thank you for reading

-GGYT ❤️
[Magisk] Gilg@mesh:
so can anyone explain why I can still pay with Wallet/Pay?
[Magisk] dmenezes:
and if they insist on not working after one drink, just have another... and another... I bet after a few, they will start to work alright! 🤣

I propose we call that the "Irish Wake" method of passing Play Integrity! 😁
[Magisk] rseiler:
The post linked in the OP is the best information I know on that. It implies that we're looking for middle-aged devices. Can't be too old, can't be too young.

My question is whether which 14.0 you use (now that both flavors prop) affects your chances of passing, because if so I want to use the one giving the best chance given my miserable experience with 2.1. I see the note about "should fix detections on some apps, could be unstable in some Android builds," but that aside.
[Magisk] V0latyle:
It depends entirely on how they're detecting and blacklisting mismatched prints.

If they are monitoring this project and simply blacklisting the prints this project uses, then what I proposed would force them to figure something else out.

If on the other hand they are making PI check for mismatches on each device, it is just a matter of time until they detect the particular print you're using and blacklist it

As far as prints...They are finite. Yes, we have quite a few to choose from, but many of those have already been blacklisted, and eventually I imagine we will have no more left. But, hopefully, we would have enough time to figure something else out.

Look at the guide I linked, @osm0sis pointed this out.

The cliff notes:

Play Integrity can use either basic attestation or hardware backed

This "fix" works by spoofing the print of a device that relies on basic attestation

Newer devices (such as those launched with Android 9) were always capable of hardware attestation, so using a print from one of those will trigger PI to use hardware attestation

So...If I'm on a Pixel 8, for example, which launched with Android 14, I can't use the Pixel 8's print because PI knows hardware backed attestation should be possible.

Make sense?

What is your PI verdict?
[Magisk] Lu5ck:
I do not know what I am doing wrong.

I have edited the pif.json but in my check, it show up as my original device key?

I am using KSU with ZygiskNext
[Magisk] V0latyle:
PIF v14 does not include a print. You have to source your own. See here:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] Gilg@mesh:
Basic
[Magisk] V0latyle:
Don't worry about what it shows in your check, only concern yourself with whether you're passing BASIC and DEVICE_INTEGRITY
[Magisk] V0latyle:
Weird
[Magisk] dmenezes:
The only way I can make sense of that along with the "aforementioned automated script", which "randomizes the [finger]print for each device", is by assuming "randomizes" is not truly random (ie, generating a new fingerprint entirely from scratch) but rather "random choosing" one already existing fingerprint from a list.

Is that what you meant?
[Magisk] V0latyle:
Precisely, my dear Watson

I don't mean a true "randomized" print where the print itself is unique; this wouldn't work because we have to use prints that have already been CTS approved. In other words, we have to use prints from factory builds on existing devices. We can't just make one up.

"Randomization" in this regard meants choosing a print at random from an available pool.

But, this would just create a new problem: Google then blacklists every single print in that pool. So, we don't use a pool, which means each user has to figure it out for themselves and supply their own print.

Again, this depends entirely on how they are detecting and defeating mismatched prints.
[Magisk] Genmutant:
That makes complete sense and sounds much easier than I expected. What I don't understand then, is why my OnePlus5T - which is much older - not already passing out of the box with the default props.
[Magisk] HippoMan:
I know what you meant. But given how crazy this situation has become, we need some humor around here once in a while!
[Magisk] V0latyle:
@pndwal probably knows, I don't off the top of my head. It launched with 7.1.2 so technically PI should revert to basic attestation regardless of whether the bootloader is locked or not

However...it will only pass BASIC_INTEGRITY and DEVICE_INTEGRITY if the bootloader is locked, OR if appropriate measures are used with root to pass,. I don't remember off the top of my head how USNF worked but I believe there were some props that had to be spoofed to hide unlocked bootloader and declare secure environment, but I think there were other mechanisms that hid root or otherwise prevented Droidguard from detecting root
[Magisk] dmenezes:
Thanks for the explanation. Now everything makes sense.

The way I see it, that means we opensource ROM users (LineageOS or not, it does not matter), rooted or not (doesn't matter either) are well and truly effed: sooner or later that pool will run out and we will stop being able to use our phones the way we do today.

All we can do is slow down the process (by each of us choosing a different fingerprint and not telling anyone about it), but sooner or later Google will start rejecting it and then it's back to square one (and then game over, when the pool finally runs out).

I hope and pray that someone can figure out a way around all this Google fascist nonsense before then. Only way I see is finding a hardware way to break into ARM's Trustzone or other sufficiently widespread TEE, then sort of forcing everyone to replace their phones for one with a new, more hardened ARM processor, Google would have no recourse).