yashsingh1/xdaforums huggingface dataset:
[Magisk] kylechen:
I fail to understand why the "banned fp" keeps working on the real original device.

I copied the fp from my wife's phone.

The fp got banned from an earlier wave of banning.

Her phone (stock rom) still works well with the fp we consider banned.
[Magisk] HippoMan:
Is her bootloader locked or is it unlocked?

Is her phone rooted?
[Magisk] wrongway213:
I'm assuming her bootloader is locked, no? If so, that's why. Spoofing = bootloader unlocked device using a print that doesn't belong to it. A bootloader locked device has no reaosn to spoof, so the logic isn't really important unless your wife's phone is unlocked, which I am 99.9% sure it's not.
[Magisk] purgy:
It's a bit soon to call it quits I think, the xiaomi.eu people managed to find a working print quickly, and there's a lot of clever people working on this.

We just all got a bit complacent, aside from kernel strings this is the first hurdle in months, and it is still able to be cleared with correct FP.
[Magisk] 4sz0m:
Has anyone already tried to play with this?
[Magisk] GabbyWC:
Google Messages RCS is not working on rooted, custom ROM Android phones

In recent weeks, Android users with rooted or bootloader unlocked phones have found that RCS does not work in Google Messages.

9to5google.com

I remember RCS on Google Messages working as long as the phone passes basic integrity but maybe things have changed since I tested this. Perhaps more people here can test RCS out on their rooted phones and report their observations.
[Magisk] osm0sis:
Latest GitHub Termux does include a working dalvikvm wrapper by the way, but you need to do `pkg upgrade` first to get it to update their old broken one. Play Store Termux is beyond broken and won't even complete a `pkg upgrade` ...

I'll see about adding a workaround to use theirs when Termux is detected.
[Magisk] vMAC:
Revisiting the Black Sunday Hack

One of the most impressive hacks I've ever read about has to be the Black Sunday kill. Since the original 2001 Slashdot article I read on this [http://slashdot.org/articles/01/01/25/1343218.shtml] is 99.9% quote, I'm going to do the same. I can see why

blog.codinghorror.com
[Magisk] AstronxD:
Its working now after updating the playintegrityfix to 15.9
[Magisk] GabbyWC:
What does satellite TV hacking have to do with this topic? 🤔
[Magisk] intel_core_i7:
I'm glad that our country is less dependant on these google services requiring PI to work. Most people use plastic cards if they are paying with credit/debit cards, and nobody uses RCS.

Dealing with PI these days are more exhausting than working around banking app's custom (quite advanced) root detection since the update frequency from local banking apps are just way less often. Our banks have never used PI for root checking.
[Magisk] vMAC:
RCS indeed does not work when a valid fingerprint is not on the device. I found this out about two weeks ago during the last kerfuffle. Verified today as I don't have a working print any my wife can't text me.
[Magisk] justDave:
RCS doesn't fail gracefully. It doesn't fall back to SMS, it doesn't really warn the sender. You just stop getting your messages as if you were offline. If you check the RCS status it tells you that it's connected.

Poor design.

Does turning off RCS still bomb all the RCS groups you're in to tell them you've left the group? I know it used to.
[Magisk] osm0sis:
It's spam. Report and move on. 😉
[Magisk] manjaroid:
A print that worked for three months finally stopped. Fixed for now with autopif.sh, thanks @osm0sis.

RCS not working was the first sign of trouble. I was thrown off the scent by device integrity still passing but turns out it wasn't. Lesson learned about not trusting 2nd rate 3rd party PI checkers. Play app had the real facts in real time.
[Magisk] Captain_Throwback:
Fortunately, it doesn't (anymore). I turned it off earlier when I was just only passing basic and all of my groups remained intact. Then, after getting DEVICE back, I re-enabled and the conversations all remained.
[Magisk] vMAC:
It actually wasn't SPAM. I was responding to V0lyte and stating that I hope Google is not doing to us what DirectTV did to all the H and KA signal hackers in the early 2000s. If GabbyWC would have read the article he might have understood
[Magisk] justDave:
The cool kids don't use termux anymore? What do they use now? Even GitHub/f-droid termux hasn't been updated since 2022.

Upgrading the packages did give me a working dalvikvm. It can be referenced at /data/data/com.termux/files/usr/bin/dalvikvm which is in user path but not root. The script did work after the pkg upgrade and after adding the explicit path.
[Magisk] justDave:
That's great to know. I've been afraid to try it again. Maybe I should have realized it was fixed since I haven't seen any of those left the group barrages in ages. In spite of all the how to docs that say to fix RCS by turning it off and on again.
[Magisk] osm0sis:
Updated autopif.sh again with the Termux workaround.

I've never used Termux, personally. I prefer raw Android shell through Terminal Emulator. Nowadays TermOne Plus is the successor to it for newer devices, but it needs a bit of setup to behave the same:

[TOOLS][ZIPS][SCRIPTS] osm0sis' Odds and Ends [Multiple Devices/Platforms]

osm0sis' Odds and Ends -- Misc./Batch Tools, Flashable Zips, Scripts, etc. General Information In a nutshell, I just wanted a single thread to gather links to some of my other, larger projects, but also serve as a spot I could put some smaller...

xdaforums.com
[Magisk] GabbyWC:
I'm already familiar with the events described in that article. You haven't mentioned what "KA" stands for, though.
[Magisk] V0latyle:
I'm guessing Ka band - 36GHz satellite links
[Magisk] HippoMan:
Termux is fine to use for lots of tasks. It can be very helpful to have a mini-linux environment on an Android device.

It's just that because Termux is based upon linux and also set up to run in a special set of Termux-specific directories, some of the PATH and directory values used by Termux are different from the standard PATH and directory values that are used by Android utilities.

The scripts that are being utilized here for these PIF-related utilities are dependent upon standard Android conventions because not everyone runs Termux, and these scripts therefore will sometimes fail when run in a Termux environment with its somewhat different directory and PATH structure.

This is not any kind of disparagement of Termux itself. It's just that it will sometimes fail to properly run some of the scripts that are being used and discussed here.
[Magisk] GabbyWC:
Yeah, it probably is the Ka band described at https://blog.solidsignal.com/tutorials/ku-band-ka-band-what-are-these-things/ but it seems off-topic for this thread. As for the earlier link from vMAC, I highly doubt that Google is planning electronic countermeasures (ECMs) which would deliberately damage the bootloaders of devices that are unlocked.
[Magisk] osm0sis:
I'll disparage them for it! 😛

If you've switched to a root prompt in Termux then everything should be like a normal raw Android shell, including PATH. But apparently it's not. No idea why you would hardcode a PATH that can get outdated instead of taking the underlying actual one. Big f*ckup on their part, in my opinion...
[Magisk] simplepinoi177:
my HTC custom fingerprint (not from a repo) that i had since Dec 8th finally got banned today ...:(

I'm not keeping up with the thread right now because Internet issues, so just came on to say this; so if there's other reasons this is happening, sorry I'm unaware and just posting this ignorantly
[Magisk] yeswap:
I use ConnectBot from fdroid. It works to out of the box run autopif.sh. Plus it's a good SSH client.
[Magisk] HippoMan:
I understand.

Actually, by creating some sort of startup file (I haven't done much work under Termux for a while, and I don't recall the expected pathname of that file), the standard Android PATH values can then be set to automatically be in place whenever Termux is launched.

But I know that Termux doesn't work that way out of the box, and I understand how that throws a monkey wrench into the use of Termux for normal "Android-like" tasks. And there's no simple Termux option to enable this feature, either. Users have to look into the Termux docs and piece it all together, so this makes Termux prohibitively complicated for lots of users who are simply experienced and familiar with normal Android conventions.
[Magisk] purgy:
Mass fp axing of 29th Feb 24, never forget.

Short version > use @osm0sis' autopif.sh https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89233630 to grab the xiaomi.eu FP, or prepare for a much more arduous search than was previously required

(If anyone here has privately found a working one since, I missed that post).
[Magisk] Nergal di Cuthah:
I was using terminal emulator from jackpal, but suddenly realized that connectbot (which i had for ssh) could local term and I've been using it exclusively since.
[Magisk] hayvan96:
Just to report that a FP I was using since 1st of Dec has stopped working this morning. It wasn't listed in Freeman's repo. Well at least it's a good opportunity to migrate to osm0sis ' fork while searching a for a working FP
[Magisk] choantet:
My first fp passed away peacefully in the early morning. Knew her well.. nearly three months. Just ran osm0sis autopif. sh through mixplorer. Told Mixpl to execute it and it did. Got device integrity, play store certification and wallet back. Thanks @osm0sis, I mourned a bit today, but won't be missing that old gal tonight. We'll see what tomorrow brings.
[Magisk] frank93:
as someone else already said, neither dalvikvm seems to be in the path (using termux).

using another terminal ("terminal emulator" on f-droid) worked though, thanks so much! <3
[Magisk] osm0sis:
I've also fixed the issue in the latest autopif.sh update. 👍
[Magisk] AstronxD:
I finally managed to get build.prop from really old ROM and got pif that actually works. Had I found this pif earlier, would that be banned in yesterday's ban wave? How long do I have until this prop gets banned.
[Magisk] Nergal di Cuthah:
Nobody knows the answer to either of those questions, except the Play Integrity Guy (PIG) at google.
[Magisk] AstronxD:
Using this pif I am able to pass 2/3 but unable to use RCS chat. Any idea why?
[Magisk] kylechen:
Yea, her phone is stock.

Well, the point of spoofing is to fully mimic her phone's status,

including: Bootloader locking status and fingerprints,

excluding: hardware attestation (her old phone doesn't have it anyway)

From the "droidguard" point of view, my phone should be exactly the same as her phone.

But the droidgaurd somehow find a way to tell: this is a genuine old OPPO, that is a fake spoof OPPO.

==========================================

The most basic thing it does is faking the bootloader locking status,

(Otherwise if Google is able to easily detect BL unlock, this WHOLE PROJECT doesn't need to exist. They can simply ban all the phone with BL unlocked.)

======================================

Thought 1,

There are many popular FP got banned, some older samsung/nexus phone where there are millions of people are still using them.

There must be a loophole/flaw in the spoofing, so the droidguard is able to detect the FP is a genuine device or faked.

Without fixing that, we are just throwing all our weapons (the working fingerprints) to google mass ban them.

======================================

Thought 2,

Google has a secret method to detect the "real" and "fake",

Why doesn't google simple ban all the FP those are not running on the real device, once for all?

Why are they banning these like, little by little?

What are they afraid of? Backfire or mass protest?
[Magisk] Nergal di Cuthah:
Nothing to do with what i said and you already asked.
[Magisk] Nergal di Cuthah:
Try turning RCS off then back on, people have found some success with that (reboot in between for the fun of it)
[Magisk] Zaxx32:
Fwiw...

Google Messages is blocking RCS texts on rooted Android phones

If your Android phone is rooted, chances are RCS might not work for you even if it says otherwise

www.androidpolice.com
[Magisk] justDave:
Clearing the data for carrier services worked for me when I had RCS problems. Just that. Without turning RCS on/off and without clearing messages data.

Assuming play integrity is passing.
[Magisk] Lord Sithek:
Well, I'm also inclined to the theory that they are not swiping off fps one by one. I just wonder, why xeu is different. What's special about it that it passed through the Google's big ban(g)? 🤔

Fortunately my bank's app provides the standalone NFC payments and it doesn't care about PI. All it cares about is Zygisk and only for that particular featute, and it's still easy enough to fool 😅
[Magisk] AstronxD:
RCS chat works when I am using default prop from play integrity fix. But when I put my custom pif file, its passes the test but RCS chat doesn't work. . Its confusing
[Magisk] beeshyams:
To all asking about RCS this link from Mishaal (ex-XDA) Tg channel may be of use.. I didn't read it since I don't use RCS

Mishaal's Android News Feed

Heads up: Users are reporting that the Google Messages app won't let them send or receive RCS messages if the OS is rooted or hasn't passed GMS certification (like most custom ROMs). It seems that Google Messages has implemented Play Integrity API attestation checks, so be aware if you root...

t.me

Sharing in good faith (hoping it isn't against some XDA rule)
[Magisk] remoh:
Wondering about this too.

Can anybody confirm at least ONE other fingerprint than the xiaomi.eu one is still working?
[Magisk] FrogMaster-:
I added a little snippet to autopif.sh just in case I do end up needing to run the script on more than one occasion, I figured it'd be nice if it also cleaned up the residual files when it was done.

# Cleanup residual files
for file in *; do
# Check if the file or folder name contains "XiaomiEUModule"
if echo "$file" | grep -q "XiaomiEUModule"; then
# If found, delete it
rm -rf "$file"
echo "Deleted: $file"
fi
done
[Magisk] FrogMaster-:
Just a few messages above yours there has been a single person who has confirmed they've been able to find a new FP that is not the Xiaomi print.
[Magisk] ablak44:
I read the last 10 pages of this topic with curiosity and try to understand something, but the results are poor. What's with these internet fingerprints? Probably no one will want to explain it.
[Magisk] trevtdogg:
without giving too much away, can the people who have found current working prints (other than the Xiaomi one) give any general hints as to what others can look for?

eg. android version, test vs release keys, API level, security patch date range, well known or obscure manufacturer / model, etc.
[Magisk] FrogMaster-:
To get a full understanding of exactly what is going on there's a lot of reading you'd have to do to understand each piece of the process. Well I'm no expert here's a rough breakdown from my understanding.

To break things down the best I can. Google has added a the Play Integrity API which some developers have begun adding to their applications as a form of security check. What this API does is validates multiple security checks against your device. Basic, Device, and Strong. Newer devices have keys built into the hardware which can validate the device state (Strong). Older devices did not have this built into them. Essentially what the module is doing is spoofing the fingerprint of an older device to DroidGuard. This causes these integrity checks to default back to a less strict form of security check (Software Attestation) / (Device Integrity) rather than stronger checks (Hardware Attestation) which rely on the the key's stored in the devices Trusted Execution Environment (TEE) within the hardware.

You can see more information about what each check really means here:

Integrity verdicts | Google Play | Android Developers

developer.android.com
[Magisk] GabbyWC:
The answer to that question and more can be found at https://xdaforums.com/t/pif-faq.4653307 so read through it to better understand the situation. By the way, @osm0sis, the line below will need to be revised or removed after yesterday's events.

"I'm still on my first one, which I found Nov. 19th, when PIF v13.1 first added pif.prop support."
[Magisk] BrimoFan123:
In which folder my own pif.json should be placed in 15.9?

In /data/adb/ or /data/adb/modules/playintegrityfix/ ?

I copied my second "working" in December '23 pif.json file int the folder /data/adb/modules/playintegrityfix/ after I did an update from DEV2 to 15.9 and now I pass Device and Basic but I'm not sure if I copied it into correct folder.

Please clarify...
[Magisk] FrogMaster-:
The information to your questions is present in some of the most popular posts.

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

The TL;DR you're looking for is for chiteroman's version of the module you must put your pif.json exactly in the following location:

/data/adb/pif.json

/data/adb/modules/playintegrityfix/ Is for osm0sis' fork.
[Magisk] zgfg:
You have on-line dumps from Xiaomi phones from the stock ROMs, hence search for and validate there.

Or extract from the Xiaomi stock ROM repo

I've seen that there, in many dunps - not necessarily the test keys but rotally useless, qti (Qualcomm) prints, not just for FP but also PRODUCT, etc.

Hence 'normal', don't panic and look into the other build.prop as answered above

Unfortunately, since the script(s) for extracting json from a dump does not accomodate that case, Ive seen hundredths of created jsons that cannot pass even Basic (in Yasnac), but if you take the prints from the same sump but the other build.prop than passes Basic, sometimes even CTS in Yasnac and (of course, rarely) switches from TEE to software attestation and passes Device Integrity
[Magisk] GN-z11:
My hiding behind the curtains is now over as the FP I mined last Dec was also borked by Google. Even without using PIF modules and not rooting (using PPU to instead manually override things), I was not able to escape from getting bananaed lol. I was using FP from a RCA device though.
[Magisk] CZ.Kostra:
Run su -c "logcat | grep 'PIF'" kill the DG and perform an integrity test. You will see what is spoofed.
[Magisk] zgfg:
I just womder how they picked the working one so quickly, we had failures all we tried ourselves
[Magisk] zgfg:
Look on PIF TG. It's possible but only if your phone has broken TEE chainstore

Then, with the special version of PIF (ask dev about), you can pass Strong

Seems it's for real, not the fake news/screenshots

But check on TG, I don't kbowbmore and N/A for my phone
[Magisk] TheRomRooster:
Either another ban wave rolled out or i happened to use the same pif as chiteroman.

In any case, some info smart ppl can try to figure out what happened.

Device Type: Camera

Android Version: 6.0

API Version: 23

EDIT: Seems like most of my backup PIFs got hit too😔

EDIT 2: Every single one of the 13 PIFs i had left got banned
[Magisk] FrogMaster-:
When I tried applying to the system process it causes all checks to fail. Including Basic.
[Magisk] BrimoFan123:
Thank you.

So I can confirm: none of my own pif.json files found in December 2023 are working - only Basic attestation.

Without pif.json in /data/adb/ Basic + Device attestation is positive.

How the hell G was able to burn all our own FPs found as working in December?

My guessing is that FP included in 15.9 module will be useless within few hours :-(
[Magisk] Oswald Boelcke:
Hello and good afternoon, @Peter12205

As a one-time courtesy for I've translated your above quoted posts. With reference to rule no. 4 of the XDA Forum Rules, please post in English or add at least an English translation to your Spanish posts.

Spoiler content hidden.

Regards

Oswald Boelcke

Senior Moderator
[Magisk] ablak44:
View attachment 6074722View attachment 6074723
[Magisk] PandarianFury:
If someone is willing to create a step by step guide of how to fix the latest fingerprint bans, I'd appreciate it. I have done it before, so I reckon it's someone else's turn ;)
[Magisk] pershoot:
Hi all. I just noticed RCS started breaking yesterday. I just updated to chiteroman's 15.9 today and confirm DEVICE and BASIC pass. Cleared carrier services and messages and trying to get RCS verified. Anything else need to be done in order to facilitate? Thx.
[Magisk] TheRomRooster:
rebooted my phone after a successful pass and RCS worked again without any extra steps
[Magisk] pershoot:
Thx. I just cleared them out and recovering. Will monitor the verification (its still trying).
[Magisk] jrotaetxe:
Another fallen angel with my very long lasting print.

Will migrate to xiaomi later, but how disgusting is this play
[Magisk] theCroh:
When I run autopif.sh, I get a custom.pif.json with completely empty fields except api_level is 25. Am I doing something wrong or is the script somehow broken for everyone?

I tested it from Termux, Terminal Emulator and ConnectBot. Same result from all of them.
[Magisk] TheRomRooster:
worked fine with the integrated terminal in FXExplorer, it needs to download ****, make sure u have strong internet
[Magisk] theCroh:
I read the log and when trying to download Apktool the script prints:

wget: TLS error from peer (alert code 80): 80
wget: error getting response: Connection reset by peer

Edit: Seems to work when I manually download Apktool before running the script.
[Magisk] bakaekze:
Just update the module
[Magisk] pythonimus:
v15.9 does not work for me even with custom pif, play store play integrity does not detect any fingerprint being injected, so naturally, it fails. What is happening?
[Magisk] FrogMaster-:
Updating is unnecessary if you know how to apply a custom pif, autopif.sh will also pull the same print.
[Magisk] devilsshadow:
My one and only mined print that I got back when this whole mess started got borked. If it weren't for the Google RCS ban, I wouldn't even have noticed that I got downgraded to basic integrity because my gpay still works 🤔

View attachment 6074747

View attachment 6074748
[Magisk] FrogMaster-:
It's normal for Play Store not to show you the spoofed print. It is only spoofed to droidguard.

Where are you putting your pif.json?

Have you tried using @osm0sis v7 fork?
[Magisk] bentree:
Really stupid question for ya all. I need to reset droid guard back to how it was before I tried to install a custom PIF. Do I just simply remove the module from Magisk and that will reset droid guard?

The reason I ask is because last time I used Pixel flasher to do all the work but it seems to be breaking for me at the moment and now I have Playstore unable to detect anything at all.

I.E. Play store fails to even show any integrity status at all. Just blank <> brackets.

Cheers, Bentree
[Magisk] GabbyWC:
A couple of weeks ago, I switched to a different cell phone provider and ported in my phone number. The Google Messages RCS status was stuck on trying to verify my phone number but the instructions here solved that problem.
[Magisk] FrogMaster-:
It was a bit of a surprise for me, my mined FP got burned. I changed to another one I had, then in less than 24 hours that one was gone too.

Now none of the ones I'd originally had work. I may take some time later this weekend to look for something that works but the speed at which my prints got banned was definitely intriguing

Your Google pay has a cached result. It'll continue to work for a brief period of time. Some have reported 24 to 48 hours. It will eventually fail unless you pass Device Integrity.
[Magisk] pershoot:
same! i would not have noticed if RCS didn't just bork. i use wallet frequently. I even opened a google support case! hehe.
[Magisk] frasca61:
Until yesterday everything worked very well with my first fingerprint of the first days of December, today it is burned, I also checked the ones I had in the archive, all burned....
[Magisk] pershoot:
Thx. Ya, I've seen this and will give it a re-go once i sort things on my end.