yashsingh1/xdaforums huggingface dataset:
[Magisk] zgfg:
No, it's not true. I have 50+ JSONs where the original FIRST_API_LEVEL (generated from their build props and/or by info found on the Net, what was the original Android version when a particular phone was released to the market) gives only Basic Integrity, but when FIRST_API_LEVEL is lowered to 25 then both Basic and Device Integrity pass

And those 50+ are only the result of retesting the last two days where I use my pif-test.sh script (it was posted earlier in this thread), the script starts from the given folder on the phone and crawls through subfolders, automatically testing each JSON it finds in the folders

Folders are organized by vendors, phone models and their fingerprints corresponding to OTA updates. Hence there are thousands of JSON files to test and only 7-8% will be found to work

So I added that if only Basic passes, that script edits the JSON and lowers FIRST_API_LEVEL to 25 and retests again

And by crawling through the hundredths of JSON files and testing them automatically (SPIC, am start -n, input tap, uiautomator) for hours (I still tested only about 20% of the JSON files that I have downloaded) it produced now those new 50-+ working with the FIRST_API_LEVEL set to 25 instead of their original values 26, 27, 28, 29, 30 or sometimes even 31

And I doubled checked for several of them, on GsmArena and other sources, what was the year when the phone was released to the market and what was the original Android version. And by no mistake, particular phones were released eg in 2019 with A10 or in 2020 with A11, but their JSON prints work (Device Integrity) only when FIRST_API_LEVEL is lowered to 25 (corresponding to A7.1)

---

And FIRST_API_LEVEL 29 is not the upper limit (but 32 seems to be). I have dozen and more (I stopped paying attention, it tests automatically) JSONs working with 30 (not even lowered to 25) and I'm currently using the one with the original FIRST_API_LEVEL 31 - and yes, it's from the relatively new phone that was released to the market with A12
[Magisk] majorfigjam:
GitHub - chiteroman/safetynet-fix: An universal fix for SafetyNet and Play Integrity on Android 8–14 devices with hardware attestation.

An universal fix for SafetyNet and Play Integrity on Android 8–14 devices with hardware attestation. - chiteroman/safetynet-fix

github.com

And look for the module, unless he deleted it again.
[Magisk] dmenezes:
You're joking, right? Unless some basic flaw is found in ARM's Trustzone or whatever hardware feature is being used for TEE, this is supposedly impossible... unless Google has effed-up. If it's case of a broken TEE implementation then its keys will just be banned and you would have "destroyed" nothing.

That is, unless everything I *think* I know is wrong... 🤣
[Magisk] sethieplayz:
Well I've tried to find a custom pif a few times now, haven't succeeded and I can't tell if it's because the Fp isn't valid, or I'm im just doing something wrong 😂

TLDR don't try without pixel flasher (I've no access to computer ATM and was trying through my phone)
[Magisk] Essentrix:
Hi mate,

Only play integrity fix there, no SNF. 🤔
[Magisk] Essentrix:
PIF there but no sign of SNF. 🙄
[Magisk] simplepinoi177:
Stick with it! If I, as a completely utter hopeless noob in all this, was able to find one, i'm sure anyone can!

You can visit below if you want to read a noob experience figuring it out (mine), some tips, and/or a safe place to seek assistance....

How to search & find your own fingerprints [noob friendly]: A Comprehensive Guide w/ tips & Discussion for Complete Noobs (from one)

It seems Google has banned more than 95% of custom fingerprints, so this thread/guide has kind been laid to the wayside. But it's still a great resource to understanding the foundations of fingerprints and all that... This is for any/all utterly...

xdaforums.com
[Magisk] sethieplayz:
Sn is deprecated no? Isn't it only PI that matters?
[Magisk] sethieplayz:
Thankyou for the encouragement, at the moment I'm considering just going back to using physical cards for the foreseeable future, although will try find a PIF for my side hobby

Would you recommend I wait until I have access to pixel flasher? Seems like it speeds up the process quite a bit
[Magisk] majorfigjam:
I don't doubt that they work.

I also have multiple release props for a couple of devices, each with a different fingerprint, and each one passes with various apis. My supposition is that google don't check the lower api bound for that particular device fingerprint, and take whatever value is present as being correct.

But, by extension, once the fingerprint key is compromised then the api will be irrelevant.

That said, until Google change the validation process, individual working prints will likely survive. Once they change the process, none of them will survive.
[Magisk] GabbyWC:
Ah, I misunderstood what you were asking for. https://github.com/chiteroman/safetynet-fix is the correct URL but no releases of it are available there at this time.
[Magisk] chiteroman:
Just a leaked keybox...
[Magisk] simplepinoi177:
It certainly does speed up the process, but I read it's not too bad doing it on the phone...if you look up android dumps of ROMs, run osm0sis' script (which can be run on the phone), copy the outputted pif.json to the applicable folder (chiteroman's and osm0sis has it in different folder locations), restart GPS (Google Play Services) and/or reboot, then test. This is from what I remember reading vaguely, but I think it goes like this. With PixelFlasher, something like the script comes up, the program creates and applies the pif.json all without the need to restart GPS or the device -- that's all.

YMMV
[Magisk] dmenezes:
Yep, and again it happened right on schedule. Major difference is that the new FP on 14.5 reportedly took just a few hours to get banana-ed this time... 😔

This is *exactly* my point. Giving people "free" fingerprints just effs it up for everyone, *including* the freeloaders themselves.

People who root their devices should take responsibility and get their own fingerprints also, or revert back to Stock if they just can't bother.

I'm wondering what @chiteroman and the Xiaomi.EU devs are going to do now. I just hope they don't go the "let's just get a random FP from a large pool" approach as this could just get us all effed up (see my next post).

Exactly. "will of the majority" doesn't work when said "majority" just wants a free lunch, and worse, wants it to be pizza... 🤣
[Magisk] dmenezes:
So it's just a matter of Google banning that particular key, right?
[Magisk] simplepinoi177:
I've been on the Telegram channel all day, not too many are saying it doesn't work/is-burned, and of the ones that it doesn't seems that they were just implementing things wrong and/or didn't clear data GMS and all that (delete pif.json, reboot, clear data Play Services/Play Store/Framework/Play Protect [some of these are just what I feel is good measure])...

most others are saying/showing it's passing (for now)....

but still, I agree to a degree with your sentiments, especially how "human nature" will have most/all of them just want it spoonfed vs. doing any kind of due-diligence footwork to get it proper...
[Magisk] maxmax0:
Mine is working since Dec 9th.
[Magisk] dmenezes:
Until Google gets tired of these little games with massive FPs showing up on their radar everyday, and drops the hammer with "only STRONG will work now", and then we all get effed.

The best part of everyone just searching and using their own FPs (or reverting back to Stock if they can't be bothered to) is that it makes that extreme end-game scenario much less likely.

See above. Using random FPs from a poll could be just the move that gets Google pi$$ed up enough to start requiring "STRONG" and ending it all for everyone using a custom ROM.

And people sharing FPs publicly and developers getting them used automatically will just hasten this.

Let's be smart, people, an angry Google is not good for anyone.
[Magisk] chiteroman:
Yes.

BootloaderSpoofer module has a banned certificate. I won't share unbanned keybox.
[Magisk] chiteroman:
Mondays and Thursdays 😂
[Magisk] maxmax0:
No, Xiaomi is a chinese brand, and as has been explained to you, not a synonym ("short"...) for xiaomi.eu.

Doubt that.
[Magisk] dmenezes:
Oof. Less than 3 days away from this thread and I had to spend 2 hours just to speed-read through the 10 *pages* of stuff posted here.

Folks, the volume of posts here is quickly becoming unmanageable.

If someone would create a "readers digest" or similar of this thread with just a summary of the best/important stuff every week or so that we can read it instead, it would be much appreciated. I would even PayPal a little something to its author, and I bet other people also would do that (hint! hint!) 👍
[Magisk] zgfg:
I don't know if lowering below 21 would work (there were subtle changes with Lollipop), and I have only few working JSONs made from indeed the old A5 phones

But the point is, we don't understand why that fake lower 1st API level works but it sometimes does

Also, I tried with 23 if 25 did not work, but it did not produce any additional working JSON so far

And yeah, G will go nowhere if they continue to 'ban' one by one, they can do that daily (so far they banned at most 1-2 per week) for almost two years (they ban one FP/OTA for the given phone, but 5-6 FPs corresponding to the the other FOTA builds still work). Sooner or later they will fix the flaws generally in the attestation process and all the mined JSONs will become useless (even without forcing Strong Integrity)
[Magisk] maxmax0:
The idea that you can distribute FPs to random dudes all over the internet with your API while keeping them "secret" from Google is hillarious.
[Magisk] Essentrix:
Thx mate. Appreciate your follow up.
[Magisk] Claus….:
You helped everyone, but now burning fp will ruin it for everyone. Why are you keep burning fps?
[Magisk] awarexda:
Well, I may restate my opinion that the whole cat and mouse game relies mostly on how many fp's are compatible (until STRONG is required and then welcome to the retro world of plastic credit cards).

It is obvious that even when a fp is banned, then for some hours GPay still works and in the meantime if we have an update by the legendary chiteroman THEN we are covered.

Also for the sake of all comments regarding the laziness of rooted users to find a working fp, may I please say some bits of opinion:

1. I tried to install PixelFlasher on win7 with lots of dll errors and the like. I don't know if I eventually could install it if it would be an easy task on how to use the program to test the fp's. To my knowledge, there is no step-by-step guide and yes I am busy with other things too to bring bread to the family's table.

2. I found some custompif.json files but I can't use them with 14.5 because they lack build_id and vndk lines - I don't understand why these are necessary given the fact that 14.1 worked with custom pif.json that didn't need them..... So, in essence, if I want to try the custompif.json files, then I need to flash 14.1 (which gladly enough I have downloaded). This a hassle IMHO...

3. Of course, I may try the Fork version but again this seems overkill IMHO

4. As such, I prefer to wait for 14.(x+1) version to avoid all this headaches

5. BTW the termux command returns "no such process" which means that I need to reboot for every fp... Me saying loudly "no more madness please!!!!"

I don't think I am lazy in this case - I believe I am incompetent.
[Magisk] Fishawy:
Hi,

Not sure what exactly is being debated here, but I said that I'm using the word to reference the developers community. I don't mean the manufacturer.

If that is an issue somehow, then hope the above clarification sorts it.
[Magisk] zgfg:
Yes, Xiaomi (incl. brands Redmi and Poco) is the 3rd biggest Smartphone vendor in the world (only behind Samsung and Apple):

Top 10 Mobile Brands in the World 2023

Since its inception, mobile phones have come a long way. From merely being used for making calls and occasionally sending messages, to now capturing high-resolution photos and even have the processing power of a basic laptop, phones have completely redefined the way we live our day-to-day lives...

www.globalbrandsmagazine.com

and their phones and ROMs (Global, CN, EEA, India, RU etc) are properly certified and pass PI out of the box. They have proper TEE and pass STRONG INTEGRITY if released over the last years with A11 (some even older, originlallly released with A10 and maybe A9) , following the Google's requirements for A<n> phones

However, Xiaomi.eu (community, Web site and forum - originally started several years ago in Poland) are custom ROMs, cooked from the official Xiaomi ROMs, debloated and so (hence popular among the users) - but as the custom ROMs they are not certified by Google and hence they cannot pass Play Integrity (and of course, they cannot be flashed with the locked Bootloader). All together, they must be spoofed with either Magisk + PI Fix/Fork module or by XiaomiEuInjector (their own app that does the same/similar spoofing with the 'stolen' prints) to trick the PI API and to obtain the verdict with Device Integrity pass
[Magisk] mike.s:
Because Google doesn't own any Android phones, nor do they have anyone capable of installing Magisk and modules?

Publicly distributing keys in any form is a terrible idea.
[Magisk] GabbyWC:
I think it's better to include the .eu at the end to avoid any confusion. Typing those three characters is not really too much to ask for. I don't mean any of this as personal criticism, of course, because you are one of the more helpful members here.
[Magisk] Fishawy:
Thank you for your kind words, and will do.
[Magisk] mike.s:
I don't think that's a known fact. One other thing the banned fingerprints have in common is that they can be easily found at a consistent location. And not just github. Anyone who can install a magisk module has potential access.
[Magisk] majorfigjam:
On the contrary, I think it's pretty well known. No limited use print has been banned, and the ones hitting thousands of checks are regularly banned. None of that well known repository prints has been banned either.
[Magisk] mike.s:
Whoosh. Point to one which has been published.
[Magisk] majorfigjam:
I invite you to look at that well known repository, or maybe the Baby Bell that handily identifies prints on its website. I can pm you a link.
[Magisk] HippoMan:
If you think that's a pain, check out the TG channel, where there are literally thousands of new messages every day.
[Magisk] zgfg:
They can and they will maybe do if putting under their noses.

But so far they banned only up to twenty (ie, we know for that they worked and later they stopped working) and those were the ones that were massively used by PIF module and as of recently, by XiaomiEUInjecctor.

I have roughly 70+ JSONs from twenty days ago when started to mine (from the sources and by the procedures publicly available, and some of those JSONs were by now even published to GitHub and TG channels), and I retested them over the last night, and all of them still work
[Magisk] Lassie111:
"Google play system updates" fails. Device reboots twice to undo the update. Is it possible to fix this?
[Magisk] dmenezes:
That would be hard as I don't even have Telegram installed on my phone! 🤣😅👍

But seriously, I already access a different TG group via a Matrix Bridge, and the experience has been more than enough to convince me that I don't want to get anywhere nearer to that cesspool of noise..
[Magisk] sethieplayz:
I feel in the same boat here. I guess it's a fault of my literacy, or ability to follow guides, because I can usually do stuff akin to this, but all the custom FP instructions are very hard to follow for some reason
[Magisk] dmenezes:
Or rather, would be hilarious if it wasn't tragic, as in "the path we take to avoid something is oftentimes the one that leads us right into it"...

I urge everyone to kill that idea right at the cradle before it effs up everything for all of us.
[Magisk] maxmax0:
Hey, sorry, was a bit short on time, I now realize the posting might come of as a bit rude, thanks for staying cool anyway!

What I meant to say is that a lot of folks (even in this thread) think that xiaomi.eu is somehow run by Xiaomi, and they are using the two synonymously. Even the xiaomi.eu forums are full of people who install the ROM, believing it is developed by Xiaomi, and then command the devs around in the forums if something does not work as they expected... It's really sad and hillarious at the same time...
[Magisk] dmenezes:
Folks, don't give up. You can do it!

But be observant and come back here to ask intelligent questions (just don't ask us to hand you a fingerprint as most of us won't, it's just wrong).

Seriously, a bit over 2 weeks ago I first spent 2 full days trying to find one to no avail... then I came back here, re-read everything, asked a few questions and BANG! figured out what I was doing wrong, started doing it right and in less than 10 minutes I had a working FP, and even better, one that's working to this day!

So, again: don't desist, just persist and you will get there, like most of us already had.
[Magisk] miimaa:
I may have celebrated too early.

Yesterday I got green light on Device and Basic Integrity. But today it only shows green on Basic Integrity.

I'm using Pixel Flasher and I have now tried over 20 dumps but I only got green on Basic.

When I add the build.props with "Process build.props. -button", test the Play Integrity and I got a bad one, am I suppose to do something (cleaning, reboot or something) after every shot? Or can I just try new one right after another?
[Magisk] sawdoctor:
Not entirely true. PIF forks built with shadow hook are having trouble with the latest A14 beta firmware whereas those built with Dobby seem to work fine. So if your json is working on one fork but not the other it maybe because you are on beta firmware
[Magisk] Fishawy:
I had that for almost 3 months since July, and I saw it reported several times on Reddit and here. Tried everything and nothing worked, then I could only solve it with a factory reset and a clean flash.

Could be lack of information on my part. I would say don't wipe everything now and try searching, maybe your luck is better than mine. Or hopefully someone here with more experience would be able to suggest a more viable solution.
[Magisk] Fishawy:
No, just move on to the next one (if you're using PixelFlasher).

I would suggest searching for the not-so-famous brands and manufacturers. Less known could mean less chances of common use.
[Magisk] Lassie111:
I have magisk root, I want to keep it.
[Magisk] sawdoctor:
Pretty sure it will still be in his telegram group if you search for it. Sorry but as @chiteroman didn't post it on xda i won't either
[Magisk] Fishawy:
Same, but I don't think it's root-related. It was reported to be an issue for both rooted and unrooted users.

It was also reported/rumoured that Google Play System Updates will be pushed differently from November. Haven't seen that happen either.

Server-side issue? Not sure.

Your last resort could be wiping then rooting again, but I would wait for a while and search before taking such a drastic measure. I know how painful restoring everything can be, even with full backups.
[Magisk] zgfg:
Yes:

Eg, tested this morning by the automated script directly on the phone (while riding and watching out), only paying the attention that screen does not turn off and that it stays in the portrait mode - both can be also forced automatically, and that test runs in the foreground - so ignoring the notifications for incoming mails, messages, etc), from one of the publicly available collection of custom-pif.json files (don't ask me for the link), ready-made from another publicly available collection of build.props

Script was crawling through the Poco collection, although the folder and subfolders contain JSON files for 25 Redmi and Poco phones (and their FOTA builds in the subfolders).

By the end, 117 JSON files were tested (roughly 20 seconds per each JSON) and of them only 3 worked (Basic and Device Integrity), but for all three FIRST_API_LEVEL had to be (automatically) lowered to 25 from the original values 27-30 to get them working.

And all three continue to work with 25 even when PRODUCT, DEVICE, MANUFACTURER and BRAND are removed from the JSON files

My hunch is (tested or observed on many JSON files and based on some earlier comments, guides (Osm0sis) and posts here and elsewhere and in the PM conversations), that FISRT_API_LEVEL can be safely lowered to 25.

Moreover, when FISRT_API_LEVEL is lowered to 25, that JSON files will continue to work (if they worked with) even when PRODUCT, DEVICE, MANUFACTURER and BRAND fields are removed - so keeping only the MODEL, FINGERPRINT, SECURITY_PATCH (those must not be improvised) and with that FIRST_API_LEVEL set to 25

Maybe a fraction will fail when PRODUCT and DEVICE are omitted but that way it is generally faster, easier and less error prone to create the JSON files for testing
[Magisk] GabbyWC:
What's also funny is that your quote leads to a completely unrelated post from dmenezes but oh well, those who read the last couple of pages know who it was intended for. 🤝
[Magisk] miimaa:
Thank for the tip.

Brands that I have tried starts with letter A, O and V. But no goal at the moment. I keep searching.
[Magisk] Vision:
I don't think the problem caused by this module but anyone know or have the same why Google System Updates has stop to 1 May (in my device) ? Xiaomi stock rom Android 10 with Magisk 25.2 and this module

Edit: https://support.google.com/pixelphone/thread/227979976/play-store-system-update-failed?hl=en

Google play system update stuck at checking for updates - Android Community

If anyone try this and work, please tell me
[Magisk] Lassie111:
Are you using Samsung Galaxy phone?

Massive bug prevents Google Play system updates on many Galaxy phones

While Samsung is now updating numerous Galaxy phones to One UI 6.0 without issues, Google Play system updates are broken ...

www.sammobile.com

If this is the issue, maybe we should just wait for samsung updates to fix it?
[Magisk] mike.s:
You're not clear on the concept. Not lists of stuff with a bunch of chaff among the wheat, but publicly known, working fingerprints. Why not post the fingerprint you're using here? If it gets banned, how will you know whether it's because a lot of people start using it or because someone at Google follows this thread?
[Magisk] Lassie111:
Same question as to Fishawy: Are you using Samsung Galaxy phone?
[Magisk] mike.s:
They were also ones which were easily discovered, by examining the source code which exists in well known locations. How do you know that they were banned due to usage vs. someone at Google simply watching the sources?

Correlation is not causation.
[Magisk] woody4165:
Hi all

I've updated to 14.5 yesterday and today I've tried to pay with Google wallet but it didn't work

Redmi note 10 pro with pixelos android 13 with latest magisk

View attachment 6045773

I've turned on NFC and the opened google wallet.

When I tried to paid, I've got a message inside wallet that NFC was not on, but it was.

So I turned off and on again and tried to pay again, but same message.

Anyone succeded to pay with Google wallet?

Thanks
[Magisk] zgfg:
Xiaomi.eu custom ROM?

If so, search for the answer on the Xiaomi.eu forum - not related to the PIF module
[Magisk] Lassie111:
No, magisk patched official image, Galaxy S21 FE.
[Magisk] Vision:
Xiaomi stock rom Android 10 with Magisk 25.2 and this module

Edit: https://support.google.com/pixelphone/thread/227979976/play-store-system-update-failed?hl=en

Google play system update stuck at checking for updates - Android Community

If anyone try this and work, please tell me
[Magisk] nero10:
so is it a good thing or bad thing?

also the device is passing device integrity with 14.5 module but nothing difference with or without module. google play licensed but netflix, disney+ are not compatible. also i can't add card to wallet. passing device integrity did not made any positive impact.
[Magisk] husharon:
For me it's the same. It's stopped working at 14.5