yashsingh1/xdaforums huggingface dataset:
[Magisk] FrogMaster-:
You can get the Play Store to show you a device statuses again by rebooting your device. No device status essentially means you're not even passing basic; Unless you're hooking something into the system apps, rebooting should be enough.

A quick method to get a functional fingerprint right now is running osm0sis autopif.sh script from your device.
[Magisk] bakaekze:
Remove the custom print (/data/adb/pif.json) file and reboot or killall com.google.android.gms.unstable.
[Magisk] ArzZenic:
Not a single one of my mined (had like 15) ones work anymore. -.-
[Magisk] zgfg:
Sorry but you're missing the point

DroidGuard is a binary pushed by Google, it will be checked do you have the latest every time you test Play Integrity and G will push you the latest if you don't have (the latest)

Hence, you CANNOT 'reset' DroidGuard

You will find a whole bunch of DroidGuard versions at:

/data/data/com.google.android.gms/app_dg_cache

You have subfolders there, with diff names (hashes)and from different dates when they were pushed to your phone

If you delete that folder, next time you test PI, you will again have a new subfolder with the latest DroidGuard

And none of the tools (PF, modules, etc) do not mess with DroidGuards you have there (like 'resetting' them or anything).

They do with your PI Fix or Fork modules, their custom PIF json files, etc

Consult the FAQ post

---

Btw, the latest DroidGuard I have is from Feb 27 (when I successfully tested a whole bunch of prints) - hence they yesterday changed things on the Server side
[Magisk] sawdoctor:
Maybe they just banned every print that has been tested using the integrity checkers? Im sure they could just have banned every print thats been used to spoof so far, they certainly have the technology to do that
[Magisk] GabbyWC:
Seeing all these reports of custom fingerprint collections no longer working reminds me of something which I mentioned months ago. It can feel rewarding to discover and have many custom fingerprints as backup options but when Google cracks down with a stronger countermeasure as they did yesterday, all the hours spent on finding and collecting many fingerprints can feel like a wasted effort. A person who previously had 50 valid fingerprints may currently be in the same position as a person who had 5 if none of them are passing device integrity now. It will be interesting to see what plays out in the days ahead since even more users are using the public fingerprint as a matter of necessity (at least for now).
[Magisk] pythonimus:
I deleted my pif, reinstalled the v15.9, which should bring its own working fingerprint right? Still its not working.
[Magisk] devilsshadow:
I am almost 100% certain the print I was using did not end up in any public repos or dumps and it still got burned so I'm assuming something else is happening this time.
[Magisk] pershoot:
Yea, the in-built one in 15.9 does pass but it is only a matter of time. Ensure your pif.json has been renamed to pif.json.old
[Magisk] AstronxD:
The pif passes 2/3 test but RCS doesn't work. If this helps developers, I can share.
[Magisk] FrogMaster-:
Are you passing Basic? If not something else is wrong. You may need to reboot.

Yes though 15.9 is using the Xiaomi print which is functional... For the time being. (Probably not long)
[Magisk] pershoot:
Going after wallet is one thing, but native messaging is an entirely different thing! It doesnt even fall back properly, it just bombs. I can't believe I am considering re-locking the BL. What good is having the functionality on the phone if it cripples critical native service(s)? /vent|/rant off.
[Magisk] devilsshadow:
This is why I thought the whole hoarding frenzy was stupid and an exercise in futility. I only ever pulled one single fingerprint, got lucky and it worked the first try and that's what I stuck with. I will also be monitoring the situation in the following days, and won't bother updating my print for now. I'm at least happy that I didn't find out my print got burned while I was trying to use my phone for a contactless payment.
[Magisk] zgfg:
That was my long ago concern

Every time you test PI, the app you use must srnd its packet name (that's also the way how those chevkers go to over-qupta status when used to many times)

Normal users with stock and BL don't use (don't even lnow for) SPIC, PIC, TBC, hence every test with them is 'suscpicious' and can be turned back against the spoofed FP or against the phone it was tested from (the latter was my original convern while we still had a hundredths of working prints)
[Magisk] bentree:
I did consult the FAQ post but was still unsure. I wanted to make sure because for some reason updating to version 15.9 still has not allowed my play store to meet any sort of integrity. When checked via using PlayStore I just get one pair of blank <> and thats it. No meets Basic integrity or meets device integrity.
[Magisk] pythonimus:
I deleted pif.json and pif.json old.

Integrity Checker says I only meet basic, not device.

Play Store says I fail device, only pass basic.

Google Wallet says I fail.
[Magisk] GabbyWC:
Yeah, I don't really care about Google Wallet because I can easily use my plastic cards that are in my real wallet. However, Google Messages is the only app with RCS support and they have not released the API for other apps to implement RCS features. Now that Google Messages checks for device integrity to allow RCS functionality, that's more concerning to me.

I remember one night in early December when I downloaded factory ROM zip files and went through multiple rounds of extracting their contents on my phone to access the build.prop files within for testing. It was fun in a technical sense to learn new things but I only found a few working prints that night after hours of testing and that was enough for me. When Google implemented more bans and the kernel string check in late January, none of those custom fingerprints worked anymore. I then found a few valid fingerprints on Telegram and TheFreeMan193's repository and I stopped there.

On both occasions when Google cracked down in late January and late February, all of the custom fingerprints that I had were downgraded to basic integrity together. I'm interested in the technical analysis of the countermeasures more so than having a valid fingerprint at all times. Google's actions have not discouraged me enough to switch back to a factory ROM with a locked bootloader. The advantages of having a rooted custom ROM outweigh the disadvantages as they currently are.
[Magisk] frasca61:
I spent a lot of time with Pixelflasher and I tested hundreds of imprints of Thefreeman193,

No one works ......
[Magisk] bentree:
So for some reason my play store totally lost it brains. Had to reset the application and now after installing Osm0sis V7 and running autopif.sh I have it working.
[Magisk] awarexda:
So chiteroman saved again the day (maybe only one day but still it is a lifesaver)! Thank you!!!
[Magisk] kylechen:
Maybe the next update of your bank app would switch to using the "play integrity check" instead of root-checking by itself.
[Magisk] bakaekze:
Clear Carrier Services data.
[Magisk] xSnowLeopardx:
Have device now too with v15.9

Was chilling for so long on v14.4 - oh well.
[Magisk] Lord Sithek:
Very much doubt 😏
[Magisk] zgfg:
Since the latest PIF (yesterday) comes with the working but hard-coded prints, make sure you do not force your own pif json (with the banned prints)

If you have a custom ROM/kernel, make sure you've 'fixed' your kernel name

If you have Xiaomi.eu ROM, make sure their Injector is properly disabled - you must manually Uninstall Injector's updates (Settings, Apps, Show System apps, XiaomiEUInject)

Btw, @chiteroman has a problem in his post-fs-data.sh (causing that disabling the Injector cannot work properly). Namely:

.replace

must be touched to:

/data/adb/modules/playintegrityfix/system/product/app/XiaomiEUInject

not to:

/data/adb/modules/playintegrityfix/product/app/XiaomiEUInject

Bcs Magisk applies REPLACE only to /system and /product is slready linked to /system/product

His path may (?) only work on some versions/forks of Magisk (maybe Kitsune?) and some ROMs, but with the proper path REPLACE should always work.

Btw, in PI Fork, the path is correct

Check also how the others use PIF 15.9

I use (an old version of) PI Fork and cannot help you further

I only shortly tested PIF v15.9 and it worked for me, but to disable XiaomiEUInject (I do have Xiaomi.eu ROM), I had to manually fix the REPLACE path as mentioned above
[Magisk] Antonio200:
It happened to me. My bank had its own NFC payment app and now I have to use Google Wallet so probably "This is the Way" to make us stick to official ROMs and don't root
[Magisk] Lord Sithek:
Well, even if so, I still have my locked WearOS watch 😅 and I definitely don't care that much about payments on the phone to give up on root and custom ROM
[Magisk] Antonio200:
Good point, I didn't think about my SGW4!!! Doesn't it depend on Google Wallet on the phone?
[Magisk] chiteroman:
Oh, thanks for the info! Will fix in newer version. 👍🤗
[Magisk] Vision:
Thanks for info, yeah in other all good vendor and system_ext the build.prop

So is normal in Xiaomi phone in /system/build.prop line ro.build.keys=test-keys say this and not release-keys, for some reason the Xiami choose like this, irrelevant if Netflix show build: RKQ1.200826.002 test-keys
[Magisk] miho171:
I don't remember if I alteady uninstalled XiaomuEuInject when rooting, I have a 10T Pro and lots of services removed from the beginning. Since I don't find the packet, should I have to worry about?
[Magisk] sawdoctor:
What Magisk/root are you using? I know there's reported issues with kitsune and 15.9
[Magisk] sawdoctor:
Breaking rcs messages is a bit of a pain though, that's another thing to think about. Like you I use my watch for payments but fear more and more apps might just use play integrity to detect root as it's easier for app developers
[Magisk] zgfg:
I've actually seen dumps with the same problem (and useless json files made from) also for some other vendors and models with Qualcomm chipset
[Magisk] miho171:
By the way, version 15.9 gives me a Device Integrity fp, but Google Wallet doesn't have the security requirements. All the old fp previously farmed are no more valids.
[Magisk] pershoot:
Wait for refresh. It could take up to ~12+ hours. Same with RCS, which could take even that much longer+++ (I'm observing).
[Magisk] zgfg:
You can Wipe Cache for Wallet app to (try to) expedite
[Magisk] Vision:
Good to know that. Thanks for all info. I appreciate
[Magisk] Dark_Diver:
May be we need to spoof props not only for com.google.android.gms.unstable now?

Something like com.google.android.gms.snet or com.google.android.gms.identitycredentials...

But if the problem appeared because of just one more check somewhere - why xiaomi.eu props are working...
[Magisk] Lord Sithek:
Personally I don't use RCS, but I understand your point and agree, life of modders are getting harder
[Magisk] 4sz0m:
Interestingly, first time after a new print Wallet still not passing, while have had device integrity for about 20 hours now. Multiple times cache cleared and reboots. Something weird is happening.
[Magisk] Vision:
Yeah, my 3 FP R.I.P 16/2/24 - 1/3/24
[Magisk] khalisz:
No issue after the full ota update.

- Update full ota from OP (6Gb)

- Don't reboot, install magisk on inactive slot

- Reboot

- Reboot to BL and flash the patched init_boot on both slot

- Reboot

- Magisk OK with Safetynet pass OK

- Switch to slot A and reboot

- Everything works.
[Magisk] tom1807:
Damn it, didn't show up for a day and then reading this news.

So, of course I opened Wallet, get the message "Device doesn't meet.... blah, blah, blah", open Yasnac, pass Basic and Integrity.

Stopped Wallet, cleared Cache, reboot, Yasnac still tells me I am good to go.

Open Wallet, everything is fine.

FP from December 12, 2023, Play System Update is February 1, 2024, Play Services is 24.0713 and the PlayStore is 39.7.34-31

A temporary glitch in the Matrix?

Cheers

Tom
[Magisk] justDave:
On my two phones, RCS started working moments after I installed the new fingerprint (and killed gms). No other action required.
[Magisk] pershoot:
Do not clear anything for it. You may get stuck in setup / verifying limbo. Leave things be and be content.

Only reason I did all that, is because I thought it was a tower / carrier issue with RCS / end to end encryption with some stale / poisoned data gumming up the works.
[Magisk] osm0sis:
🤯

Literally the 5th or 6th time we've told you and explained it... 🤦‍♂️🤷‍♂️

Their current fingerprint is working for all of us, on every ROM, so what you're saying doesn't really make sense; Xiaomi.eu just found a new working one faster than the rest of us.
[Magisk] Dark_Diver:
Yeah, I know.

But today I downloaded a lot of (~40) ROMs for suitable devices (stock rom < 8, upgraded at least to 8), from different brands, with diferent Android versions, manually extracted system.img & build.props, created pifs with my scripts which perfectly worked till yesterday, uploaded and tested them on my device.

I even tested ROMs for XT1650-05 with other FPs.

Found none working. It is strange, 90091e can't block all of them.

But xiaomi.eu props working. Don't know what to think.
[Magisk] frasca61:
Sorry for the question that you have perhaps already answered ... on my phone Yasnac gives positive outcome with almost all the fingerprints that I have tested, Basic Integrity Pass and CTS Profile Match Pass .... all the other tests (Simple Play Integrity Checker , Play Integrity API Checker, TB Checker) fail with all my fingerprints.

Only Xiaomi works
[Magisk] V0latyle:
Did you read this?

[INFO] Play Integrity API - replacement for SafetyNet

THIS IS NOT A SUPPORT THREAD. For questions and support regarding how to fix your Play Integrity verdicts, see the Play Integrity Fix thread. ⚠️BEFORE YOU ASK A QUESTION, READ THIS POST AND THE FAQ!⚠️ ****Update 12/11/23**** Google has been...

xdaforums.com
[Magisk] frasca61:
thankyou
[Magisk] Vision:
Really what happens? i try more than 50+ FP, no one works (PIF v14) Google block it all at once ? :unsure:
[Magisk] dynamic_donkey:
Logging in to say I can't get the newest Xiaomi.eu fingerprint to work. Still failing device after multiple unstable, TB Checker, and Play Store force stops/cache clears, as well as reboots.

EDIT: I failed to realize that osm0sis' script doesn't move the file automatically.
[Magisk] Captain_Throwback:
One thing that may have gotten lost in this most recent mass-banana-ing is that there was also an additional crackdown on custom kernel strings. I had hex-edited my kernel with my own personal vanity string, and when all of the failing began, I wasn't even getting BASIC Integrity with any print. Once I reverted back to the stock kernel version, I was back to having BASIC. So if anyone is using a kernel with a string that wasn't previously blacklisted, they may want to confirm that's not an issue for them after yesterday's actions, especially if you're not even getting BASIC Integrity.
[Magisk] V0latyle:
That's a known issue, though. A lot of us such as myself are using stock kernels. All the prints I've been testing pass BASIC.
[Magisk] guniens:
Hi guys!

Been out for a while and just noticed my fp was banned, I've PlayIntegrityFork installed with a now non working fp found with PIFS.

Do I just need to run autopif.sh and then put the fp in PlayIntegrityFork's module dir and done?

Say this gets fixed and solved, is it better to use something like PIFS or autopif.sh?

One last question: I've a Pixel 8 and have been consistently wrong time when boot up in the morning after turning off at night, all time sync options enabled, time corrected itself as soon as I connected to wifi or mobile data.

I noticed time was right yesterday and so was today, I know it sounds weird but could be related to spoofing a fp?

Thanks in advance!
[Magisk] mac796:
I got sued by Dave back then to.
[Magisk] Vision:
@osm0sis fork can spoof lot, now if needed added all value for spoof

View attachment 6074831
[Magisk] osm0sis:
My fork literally already exists for this exact purpose. 🤔

And we (most notably @badabing2003, @TraderJack, @TheFreeman193 and myself) have already done a lot of this experimenting on banned prints and ones that work on some devices but not others with no luck.

No, my fork can already do everything, add any Build FIELD and it'll get spoofed to DroidGuard, add any system.property and it'll get spoofed to DroidGuard (if DroidGuard actually even looks for it - their list of properties is pretty small).

Have you all actually been paying this little attention? This is the exact reason why I say my fork is "more futureproof". 🤷‍♂️🤦‍♂️

GitHub - osm0sis/PlayIntegrityFork: Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - osm0sis/PlayIntegrityFork

github.com

Add anything from https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/os/Build.java you want, and add any property DroidGuard checks from my list in my latest release post https://xdaforums.com/t/tools-zips-...tiple-devices-platforms.2239421/post-89295899, or generate your own new fresh list for your ROM/device using my verbose logs feature.

This should be obvious from my example.pif.json and defaults, since it supports wildcards for properties and everything...

PlayIntegrityFork/module/example.pif.json at main · osm0sis/PlayIntegrityFork

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - osm0sis/PlayIntegrityFork

github.com

I can tell you they haven't added any new property checks, and haven't started enforcing vndk or zygote or anything like that yet from my testing. Fields would be a big undertaking to see what if anything there "unbans" one of our newly banned fingerprints, but besides the fact that we've tried that before, the fact that we've still got like 2-5% of the previous working prints and they work for everyone (Xiaomi.eu's for example) suggests they haven't just adding a new blanket check for BOARD or something to everything.
[Magisk] chichino84:
Old PIF v14.0, custom print that was working flawlessly since December '23 doesn't pass device integrity anymore, like none of the other few build.prop I had.

15.9 seems to work for now
[Magisk] Vision:
Yeah i know, sorry if i say the opposite (i say to user write this with all spoof value to understand your fork have already this), for that i add the image you say exactly this

Your fork to all that is futureproof and if Google add new check, we have already your fork
[Magisk] Vision:
It's time for the big brains, to join forces 🧐
[Magisk] zgfg:
You must test Play Integrity, not the deprecated SafetyNet

If not passing Device Integrity, Wallet will hunt you sooner or later

Btw, what's in the title of this thread😁
[Magisk] guniens:
Can you guys help please?

Specifically on the last question, I would like to have your opinion.

Thanks in advance!
[Magisk] V0latyle:
But we already know all of this. It's covered in the Play Integrity documentation. PI uses both Google servers and app developer servers to determine the app and environent are genuine.

Nothing new, so far. I won't quite say this is all common knowledge to the general masses, but those of us who have a good understanding of how PI works know this.

Again, nothing new here. I've said as much previously - that prints in common use are more likely to trigger mismatch detection. For a while, using random prints worked. But, now we are looking at a large scale problem that is affecting everyone, even those of us who are using prints we are fairly certain no one else is using.

I don't know why you're telling us things we already know as if it's some sort of grand revelation. Nothing you've said is news or offers any reasonable explanation to what is currently happening. There's still a few prints that still work, so it can't be mismatch detection.

Yeah, good luck with that. You'd need a way to not only break TEE but you'd have to compromise Google's servers - and this would get fixed very quickly.

Dude. READ THE POPULAR POSTS. @osm0sis fork already has the ability to spoof ANY property.

Well, since you seem to know things we all don't already, you must have a significant head start on these developments.
[Magisk] pershoot:
Added our new distressed friend ;)
[Magisk] badabing2003:
PF has an option to clear the DG cache, perhaps he used it.

If you cleared DG cache in PF, you have to at least run YASNAC once (do teh safetnynet check) or reboot for DG to start working again.

Waiting a while (perhaps a day) will make it work too.
[Magisk] Claus….:
When you know all this, do you have any new hypothesis? I am just curios.
[Magisk] V0latyle:
No. At first I thought it might be mass mismatch detection, but since there's a few prints that are still working, that's obviously not the case.

The only thing I can think of is the theory I personally considered to be less than likely - that they identified most of the same prints that we did, and have flagged those specific ones.

At the end of the day though I don't know, and at this point I don't think anyone does. We will figure it out, eventually.
[Magisk] inzaghi89:
I'm curious too. My wife's phone still runs on v14 since December 23. Today it stopped working (ofc on custom pif). Just updated pif on her phone to latest 15 version and it passes both basic and integrity.
[Magisk] pershoot:
15.9 contains an in-built print, which for now (likely not long), is allowing you to pass DEVICE alongside BASIC. The pif.json you had in place, prior, was renamed to pif.json.old .
[Magisk] Vision:
Yeah strange, for that i wonder if something else chance, except Google Block FP, so officially from today go to @osm0sis fork who can litterry spoof all field and is more futureproof
[Magisk] Lurxs:
autopif.sh is giving me a blank file, it lists the build fields but they are all empty?
[Magisk] Dan3ll1:
Same here. Did try with FX, and terminal One.

Gives me this

Xiaomi.eu pif.json extractor script

by osm0sis @ xda-developers

- Downloading Apktool ...

Connecting to github.com (140.82.121.3:443)

wget: TLS error from peer (alert code 80): 80

wget: error getting response: Connection reset by peer

- Finding latest APK from RSS feed ...

XiaomiEUModule_2024.02.29.apk

- Downloading XiaomiEUModule_2024.02.29.apk ...

Connecting to sourceforge.net (104.18.37.111:443)

Connecting to downloads.sourceforge.net (204.68.111.105:443)

Connecting to deac-riga.dl.sourceforge.net (89.111.52.100:443)

wget: TLS error from peer (alert code 40): handshake failure

wget: error getting response: Connection reset by peer

- Extracting APK files with Apktool ...

- Converting inject_fields.xml to pif.json ...

{

"FIRST_API_LEVEL": "25"

}

- Converting pif.json to custom.pif.json with migrate.sh:

- Deprecated entry FIRST_API_LEVEL found, changing to DEVICE_INITIAL_SDK_INT field and "*api_level" property ...

- Missing default fields found, deriving from FINGERPRINT ...

{

// Build Fields

"MANUFACTURER": "",

"MODEL": "",

"FINGERPRINT": "",

"BRAND": "",

"PRODUCT": "",

"DEVICE": "",

"RELEASE": "",

"ID": "",

"INCREMENTAL": "",

"TYPE": "",

"TAGS": "",

"SECURITY_PATCH": "",

"DEVICE_INITIAL_SDK_INT": "25",

// System Properties

"*.build.id": "",

"*.security_patch": "",

"*api_level": "25"

}
[Magisk] :
Waited 24h, cleared playstore and services cache, rebooted, changed fingerprint, cleared caches again and rebooted again.

Only BASIC attestation, no play protect attestation, but still Netflix and McD available.

They seem to have shifted requirements. Can someone confirm this?
[Magisk] tom1807:
Oh crap, thought Yasnac is doing the same like TB Checker.

Well, good news, Yasnac seems resetting Safetynet, so Wallet doesn't complain for a few hours and I can pay again.

Better than nothing until I tested my other FPs.

Cheers

Tom