yashsingh1/xdaforums huggingface dataset:
[Magisk] purgy:
Yeah I can't really blame google for wanting to assure people that they can be relied on to differentiate between a device that has never been unlocked / "tampered with", and one that has.

There have been a few cases of roms being modified between place of manufacturing, and point of sale, I even had some cheapo Chinese tablet that came with Google certification, also pre-rooted, but with no root management app. I'm sure there are other devices like that in the wild still.

If the average user were to buy one of these things, and get bitten, they'd obviously hold google responsible to a large degree.

We consider ourselves "the good guys", but the methods we are using don't care what your intentions are.

All this to say that really sourcing your own fp is obviously the only way to go, as even if it's flagged by the server, the fact it's only coming from a single device also signifies it's a personal effort, and not a group (whoever that group may be) one, so it's more likely to be left alone
[Magisk] makeyourself:
What has been the consequence of, I don't know the exact numbers, but a lot of people, over a period of many years using rooted phones daily to make NFC payments and use banking apps? The consequences so far as I can tell have been absolutely zilch, not even one reliable report of a single security breach due to the above. It's possible it's happened and not been disclosed I guess. But I doubt it and very unlikely in significant numbers or we'd have heard about it. So personally I sort of do hold it against Google, and the banks, for doing this.

I'm sure plenty of people have misplaced their laptops. Of course nothing happened at least 99.9% of the time because there were software-based security features (both server and client side) which stopped anything from happening. The fact that the laptop was open to root access made no difference. In the same way people with rooted phones, have on occasion left them at the bar. But unless there was a genetic replica of the person who also had the same fingerprint nearby then they wouldn't be able to do much, aside from steal the phone and only be able to use it again if they wiped all data, because it's all encrypted anyway. At worst you could get someone who somehow knew your lockscreen pin, but being rooted or not makes no difference to that either.
[Magisk] HippoMan:
That's exactly my point. There is no need to jump through hoops in order to try to block rooting/modding detection when I use plastic cards directly.

People can hack the cards or steal the cards just as easily in their plastic form as in their electronic form on a rooted device.

I don't even have to enter a PIN to use my "VISA Debit" cards. These are issued by my banks and serve as PIN-less debit cards. These same banks prohibit me from using those exact, same cards without a PIN or some kind of screen lock under Android.

There is *less* security around using those same cards directly than there is around using them via a mobile device. And the banks and CC companies are *glad* to issue us these plastic cards for us to use directly at the supermarkets. That is what I call nonsense.
[Magisk] Depressed T.Bear:
Thanks for your response. It was not my point though, strong integrity can't even be archived with a locked bootloader and without magisk or any other modification on my rom.

I was just referring to the potential detection- /(miss-)match method which might check for a locked bootloader.

Cheers
[Magisk] Nergal di Cuthah:
Actually, from some replies, some countries/banks require it be phone and don't even issue physical cards or some incentivize by offering more points for the cardless transaction. Banks want a cardless world, both because of the insecurities of cards and the expense of making them (esp those metal cards lol)
[Magisk] HippoMan:
Yes, I realize that this is the case some countries.

But here in the U.S. where I live and where I do my banking, no one at any of the banks I use has made even the slightest attempt to try to convince me to use some sort of electronic device to interact with my funds or my credit.

Perhaps that might be coming in the future, but nowadays, the policies of these financial institutions are *encouraging* us to use plastic, because they make us go through more effort to initiate payments via these same accounts when using our electronic devices.
[Magisk] osm0sis:
Call me crazy here, but maybe we could just, like, leave this thread alone if we're not directly talking about this module? 😯😛
[Magisk] HippoMan:
Good point. This other thread was created for us to rant about the cat-and-mouse game ...

https://xdaforums.com/t/discussion-magisk-the-root-hiding-and-mod-hiding-cat-and-mouse-game.4425939/
[Magisk] Nodens:
Right on. Let's just focus on finding a solution that will render PI useless until deprecation of older devices ;)
[Magisk] Iridule:
Do we have to use phones for fps or will any android device work?
[Magisk] osm0sis:
Any device will work. chit burned a foster (Shield TV) print awhile back in the module, IIRC.
[Magisk] intel_core_i7:
The whole SN/PI thing is even worse than Apple's walled garden. Because of that, Apple never expect people to jailbreak their phones and if people do then there's no server based verification system to check if the system is "compromised". Their risk management department probably has acknowledged that the number of people trying to jailbreak/softmod (non jailbreak mods) their phones is minimal, and most users are automatically on the latest software version right when it releases so it's unnecessary to just make a mechanism similar to PI.

Mass adoption of PI/SN? I don't see it coming to my country at least for several more years, if it's implemeted then probably DEVICE only. The minimum Android version required to run those apps are usually 4.x and 5, so implementing SN will just leave many users behind. Another thing is many banks here also have their app available on the Huawei AppGallery, so implementing PI will just leave another considerable amount of users.

I may see it coming to the US first, since how the smartphone - carrier market works really makes the PI model work well, almost 0 Android phones coming internationally can activate on AT&T and Verizon.
[Magisk] Nodens:
Aye

I wouldn't be so sure about that mate. They're not forcing it down anyone's throat, they're pitching it in as the best security solution on android. Not sure if you have worked on development for a big company but if you have, you will immediately understand what I'll say next. Wish me good luck, when I'll be trying to convince the product manager, as the software engineer, that the security solution that Google marketing just pitched them as perfect, should not be implemented for our android app. I could possibly manage it if I have working PoC that renders it useless (like a Magisk module ;) ) along with the list of negatives. Without a PoC? No chance whatsoever.
[Magisk] HippoMan:
Given that this post is OT for this forum, I wrote my response to it in a different forum where such kinds of discussions are welcome. Let's continue the discussion here:

https://xdaforums.com/t/discussion-...ding-cat-and-mouse-game.4425939/post-89204366
[Magisk] bigknowz:
I work at a bank, risks are paper checks and phishing. This community is more security conscience than any IT Department. Have us accept a waiver that if our account is compromised due to unlocked bootloader, we won't make a claim.
[Magisk] HippoMan:
I'm in favor of that. I'll gladly sign such a legal waiver in lieu of my modded phone being crippled. So would a number of other people I've spoken to.
[Magisk] pndwal:
I can't keep up here anymore... Probably only respond if pinged now...

The conversation about why? is clearly an emotive one that will never be resolved to everyone's liking, and doesn't belong here... Let's keep it about How? folks!

I can feel another mass mod transfer of posts coming... Bring it on!... 😜 PW
[Magisk] BROKEN1981:
Don't know about anyone else, I had to hide root from the Pixel Watch app just to add cards on my watch.
[Magisk] BROKEN1981:
I get mine mine to work right away after a successful fingerprint. I never had to clear data or cache. Only on Play Store if I want Netflix.
[Magisk] BROKEN1981:
LoL.......

Now I need new prints
[Magisk] BROKEN1981:
Try it and find out
[Magisk] Nergal di Cuthah:
I think the guide says all pixels and nexus that would qualify are burned, but I'd say try.
[Magisk] Nergal di Cuthah:
i guess i was wrong, maybe try your 4a
[Magisk] purgy:
Someone however many pages back managed to use actual props for their pixel 6 via MHPC to pass. Didn't see anyone confirm this, but the thread moves way too fast to read it all lol
[Magisk] aygul12345:
How did you fix the fingerprint? Is there a tutorial?
[Magisk] aygul12345:
Could you tell me how to pass it?
[Magisk] sawdoctor:
Yet the latest print released is a pixel 2xl
[Magisk] xcl1pse:
With latest security patch...
[Magisk] majorfigjam:
I wouldn't recommend that you read all 5770 odd postings in this thread, but at least read the FIRST one. It points to a tutorial.

The hard part is finding a working print, but many of us have done so, and our prints are largely surviving still.

As a clue, look for a build.prop or stock image dumps from Oreo 8.*.* there are literally thousands out there.
[Magisk] rseiler:
Meaning that's what 14.2 uses? I think I looked when I had 14.2 (which I don't have currently), but I don't believe it's written to the "temp" file anymore (as it was in an earlier version) so I didn't see it. Oreo in any case, so it makes sense.
[Magisk] sawdoctor:
The Dev version has no fingerprint, the none Dev version has the fingerprint hard coded and can't easily be changed by the user like previous versions
[Magisk] rseiler:
But I think it can easily be changed by him absent a whole new version, right? Because originally the plan to do that was either by rebooting or killing android.gms.unstable (the latter can be arranged via a Tasker app, for example).
[Magisk] sawdoctor:
There's no pif json in the none Dev version so changing the fingerprint isn't as easy as the Dev version for the user. If this fingerprint gets banned quickly then the Dev will probably stop releasing zips with an included fingerprint to save the pool
[Magisk] AnyNameYouWish:
{
"PRODUCT": "taimen",
"DEVICE": "taimen",
"MANUFACTURER": "Google",
"BRAND": "google",
"MODEL": "Pixel 2 XL",
"FINGERPRINT": "google/taimen/taimen:8.1.0/OPM4.171019.021.R1/4833808:user/release-keys",
"SECURITY_PATCH": "2018-07-05",
"FIRST_API_LEVEL": "26"
}

Taking this example from osm0sis' tutorial, if I understand properly

taimen:8.1.0

refers to Android version, Oreo 8.1.0 here?

If so, then I found a working build.prop with Android 10.

From what I've read on this topic, Android 8 is the best shot to get it work but it might work with latter versions, is that correct?

I pass both device and basic integrity with play integrity fork, I would just like to check if I've set it properly (using pixelflasher method) or I'm just beeing randomly lucky ^^'

Now is also a good time to thank you for all the work and tutorials that support all of us, I've been reading a lot of last days messages and I'm really grateful there are people sharing their knowledge to the community 💪
[Magisk] aygul12345:
So I have a Oneplus 8 Pro, can I use a different fingerprint device?
[Magisk] maxmax0:
Yes, you can use any device for fingerprint.
[Magisk] majorfigjam:
Yes, 8.1.0 means Oreo, as does the O in the build ref. Yes other versions might work. You have a Q that works, which should give hope to others and expand the pool of their options further.

If Play Store shows Device Certified, and its Developer option check shows Basic and Device, then you're set right.

The Osm0sis fork is at least static, and you're in control of what you are spoofing PI with. I'm on day 6 now with my own print from a relocked stock phone I had as my backup device.

Maybe you were lucky, but you make your own luck sometimes!
[Magisk] maxmax0:
This is not about consequences of cases that already happened, but about contractual/regulatory obligations and risk management. Quite simple. I am amazed that this is so difficult for so many people to understand.

Sure you can do that, but it's both within a. their rights and b. perfectly understandable from a business/risk mgmt POV.
[Magisk] majorfigjam:
Sure can. The working print in my Pixel is certainly not from a Google device.
[Magisk] zgfg:
Suppose the phone was released to the market in 2018, with A8.0 (26)

Then it received an update for A8.1, next year for A9 and a year later A10

You can make and test four JSons, each has a different FINGERPRINT and SECURITY_PATCH (corresponding to the new build/OTA)

But the other 6 properties in JSON are the same/common - it's the same manufacturer, model, etc

Even the same FIRST_API_LEVEL 26, BCS that was its original A8 the phone was designed and certified for (repercussions on partitions layout and formats, requirements for BL, TEE, etc - Google changes them over time and vendors must meet new requirements for Ax if they want to release a new phone with Ax, but when they later release OTAs with Ay, they cannot update hardware and meet new requirements for the phones that are designed for Ay)

However, there is a murky area about that FIRST_API_LEVEL. It might be related to how G distinguishes users with that phone in their hands from the others who spoof the prints pretending to have that phone

Or to how the module (successfully and completely?) spoof the API LEVEL, it could even depend.on the version of the module and ofc phone in your hands

So don't ask but try all those four JSON files also with API LEVELs 27, 28, 29, even 30. There is a chance that you pick one working combo.

Or even with the removed API LEVEL from the JSON file

Don't waste time if Basic fails - changing API LEVEL with not help.

Actually, if your Fingerprint/Security patch is proper and if it fails Basic with that, then taking the second pair of Fingerprint/Security patch will not help - it shall also fail Basic

These were some practical notes
[Magisk] casouzaj:
+1. Back to Displax' 2.4.0-MOD_1.3 for the time being.. Xperia XZ2 (H8296), running LineageOS 20.0. Latest Magisk Delta Canary, if it matters.
[Magisk] zgfg:
All good for me
[Magisk] shoey63:
Rog 3 on Omnirom 13 all good too
[Magisk] lihaoking:
这个模块会造成tee损坏吗😂
[Magisk] zgfg:
"Will this mod cause TEE damage?" - Please, use (Translator and) English

Not, it's systemless module to pass Basic and Device Integrity, hence targeting GMS process only by help of Zygisk
[Magisk] Ginosius:
Can someone post a link to the previous version?
[Magisk] Catfriend1:
Xiaomi mi 8 Android 13 pixelexperience rom : pass
[Magisk] RSDamasceno:
PlayIntegrityFix_V7.zip

drive.google.com
[Magisk] chiteroman:
Update to v8.1

- Migrated from Dobby to ShadowHook (better hook framework for Android)

- Remove useless code in module files.
[Magisk] chiteroman:
Provide logs so I can know where is the problem 👍
[Magisk] lihaoking:
I'm sorry I didn't use English.I see. Thank you for your answer.
[Magisk] Ginosius:
So I've reverted back to v7.4 and CTS Profile/Device integrity is passing again.

With v8.0 and v8.1 only basic integrity is passing.

This is on my OnePlus 7T Pro running LineageOS 20.

I can provide a log, but do you need a logcat or the logfile from Magisk?
[Magisk] chiteroman:
Logcat
[Magisk] Ginosius:
So at which point, should it print something related to SNFIx?

I've started this command as early as I could:

adb shell "logcat | grep 'SNFix'"

logcat is working... but grep doesn't find this string...

This is with v8.1 by the way.
[Magisk] Ginosius:
@chiteroman

I can PM you the full logcat and the magisk logfile if you like.
[Magisk] pndwal:
This has (happily) proved to be incorrect.

A user has been running Uber Driver on old Samsung Galaxy A5 (launched with Android 6.01) for some time and has now published newly devised method to make it run on Xiaomi Mi A3 (LV Android 9.0, Android One OS) here:

Key elements were Zygisk on KernelSU running in Magisk, Alpha Magisk or KernelSU and use of Android Faker, xPrivacyLua, and App Manager modding utilities...

Hope it helps Uber Driver modders! 😋 PW
[Magisk] chiteroman:
This is very strange...
[Magisk] Ginosius:
yeah I also tried "grep -i" to search case insensitive and made sure to connect the shell as early as possible.

I'm not so familiar with Android, but on Linux the "dmesg" log is only certain kbytes large.

So far only 7.4 passes device integrity, from 8.0 it seems broken on my device.

But it seems Play integrity is enough to keep google wallet working (that's all I care about anyways), so I'll keep v8.1 for now.

Let me know if I can provide any other information :)
[Magisk] chiteroman:
Update to v8.2

Changelog: https://github.com/chiteroman/PlayIntegrityFix/blob/main/changelog.md
[Magisk] sawdoctor:
I got an API 30 to work
[Magisk] AnyNameYouWish:
Just now I realize I could use one of my old phone or tablet to do so ^^

I'll stick with my working pif but if it stop working I'll try that, reinstall OFW and relock bootloader, thanks for the idea!
[Magisk] majorfigjam:
Even better.

There's 20% or so live devices still on 8 -10 according to Statcounter, and over 35% on 11 or under. That is a huge number of devices and releases to mine for prints. It also restricts Google's options for blanket enforcing hardware integrity for a while.

For those who haven't found a print yet, keep trying, be logical in what you try, and you will eventually succeed.
[Magisk] 4YB:
Work Fine?
[Magisk] 4YB:
Link Send please?
[Magisk] BROKEN1981:
NO! Especially since you are a new member
[Magisk] d4m4s74:
Custom rom with some sort of root, or just a custom rom?

edit, didn't notice it was july
[Magisk] bigd4ve:
That was several months ago on an old version of the module that will no longer work. Read the OP and instructions again.

When everything is working, you will only pass BASIC and DEVICE integrity. It is no longer possible to pass STRONG.
[Magisk] zgfg:
And some comments about JSON formatting:

- The order of properties does not matter, hence you can put eg FIRST_API_LEVEL to the top

- Each one must end with comma:: ,

but last property must not.

However, many JSON readers survive (seems this module, too) if there is a comma after the last property

- Whole JSON can be even in a single line (I didn't test with this module).

Not practical for human reading and editing

- You can add a Java/C++ style comments into the JSON: // Some comment

It may help for managing your pool of tested/working JSON combinations

Three examples (I'm not posting the JSONS that will really pass Basic and Device Integrity)

{
"FIRST_API_LEVEL": "27",

"PRODUCT": "cheryl2",
"DEVICE": "aura",
"MANUFACTURER": "Razer",
"BRAND": "razer",
"MODEL": "Phone 2",
"FINGERPRINT": "razer/cheryl2/aura:8.1.0/O-MR2-RC009-RZR-181124/2009:user/release-keys",
"SECURITY_PATCH": "2018-10-05"
}
// Original A8.1 FINGERPRINT/SECURITY_PATCH
// Tested Dec 4 with v14.0 on Renoir A13
// Basic only

{
"FIRST_API_LEVEL": "28",

"PRODUCT": "cheryl2",
"DEVICE": "aura",
"MANUFACTURER": "Razer",
"BRAND": "razer",
"MODEL": "Phone 2",
"FINGERPRINT": "razer/cheryl2/aura:9/P-SMR7-RC003-RZR-210107/3225:user/release-keys",
"SECURITY_PATCH": "2021-02-05"
}
// Fake FIRST_API_LEVEL 28

// FOTA A9 FINGERPRINT/SECURITY_PATCH
// Tested Dec 4 with v14.0 on Renoir A13
// Basic only

{
// "FIRST_API_LEVEL": "27",

"PRODUCT": "cheryl2",
"DEVICE": "aura",
"MANUFACTURER": "Razer",
"BRAND": "razer",
"MODEL": "Phone 2",
"FINGERPRINT": "razer/cheryl2/aura:8.1.0/O-MR2-RC009-RZR-181124/2009:user/release-keys",
"SECURITY_PATCH": "2018-10-05"
}
// Without (commented out) FIRST_API_LEVEL

// Original A8.1 FINGERPRINT/SECURITY_PATCH
// Tested Dec 6 with v14.2 on Renoir A13
// BASIC & DEVICE INTEGRITY !!! <--- Just a JOKE, NOT REALLY

JavaScript Object Notation:

JSON Formatter and Validator - GeeksforGeeks

A Computer Science portal for geeks. It contains well written, well thought and well explained computer science and programming articles, quizzes and practice/competitive programming/company interview Questions.

www.geeksforgeeks.org
[Magisk] david2089:
I've created a PIF from the 14.2 version logs and shifted back to Dev V1 and despite the "DroidGuard detected!" message - play store show "Device is certified" - so can confirm it's False Alert.

I've also automated the PIF testing part to easily check for new PIF files - you can use that to verify again no restart is needed :

Rem Disable all gms services

adb shell pm disable-user --user 0 com.google.android.apps.walletnfcrel

adb shell pm disable-user --user 0 com.android.vending

adb shell pm disable-user --user 0 com.google.android.gms

Rem Delete Play and Wallet storage and cache (no need to delete GMS cache for this to work)

adb shell cmd package clear com.android.vending

adb shell cmd package clear com.google.android.apps.walletnfcrel

Rem Copy new PIF to the adb folder

adb push pif.json /sdcard/Download/

adb shell su -c "mv /sdcard/Download/pif.json /data/adb/"

Rem Enable back every thing

adb shell pm enable com.google.android.gms

adb shell pm enable com.android.vending

adb shell pm enable com.google.android.apps.walletnfcrel

Once this script is executed, simple check the certification status in the "About" section of the play store (may take up to couple of minutes to show)

Despite testing over 10 different PIF files extracted from different vendors and phones I was unable to find even one that working (apart from the one used in ver 14.2)

Would love to get a private PIF file as I'm reluctant to continue using the same PIF used by the Ver 14.2 and most defiantly going to be blocked by Google.

Please share privately if anyone have one - also happy to check and confirm any new PIF shared privately - thank you
[Magisk] zgfg:
Why don't you test directly Play Integrity passing - waiting on Device Certification status update can take time

To force testing with the new/edited/updated pif.json, simply execute:

adb shell su -c killall com.google.android.gms.unstable

Finally, you can automate testing of Play Integrity by use of /system/bin/uiautomator (as in Pixel Flasher)
[Magisk] sawdoctor:
What i have found is changing 1st API level on newer devices can sometimes work .
[Magisk] d4m4s74:
Without defaults to 23 in the newest versions.
[Magisk] zgfg:
And again for those who struggle with finding instructions about mining and testing the working pif.json combinations

Open this thread from browser on the PC and check on the right for the two Top liked posts.

Not visible in the mobile browser or in the (new) XDA app
[Magisk] david2089:
clearing the data for play store + wallet is not required after replacing a new PIF?
[Magisk] zgfg:
No need for just testing the pif.json in PI API Checker, SPIC, TB Checker or Playstore/Dev options.

You just test if the new pif.json produces Basic and Device integrity or not

Testing checkers are not related to the apps they will later request PI API checking themselves

Later, when you find a working pif.json, you will clear Cache for the apps you want to force them to ask for retesting PI and thus to obtain now the new passing verdict
[Magisk] frasca61:
it does not find Magisk installed on my phone ... Can it be because the hiding option is enabled? However, I need this for the operation of some apps ..
[Magisk] purgy:
In advanced options of pixel flasher, you can set the package name of your hidden magisk manager, it should find it then.

Also make sure that shell has root.
[Magisk] sawdoctor:
Shouldn't, I've always hidden magisk and PF still finds it. Pull a support log and send it to badabing
[Magisk] Fishawy:
Magisk hidden here and is detected by PixelFlasher. Ensure that shell has root as @purgy said.
[Magisk] frasca61:
the phone has root with magisg 26.4

i put the new package name in setting (new name is "lyjpfdeb.uiwtiezdwz") but pixelflasher does not find it....

any suggestions?
[Magisk] frasca61:
Also make sure that shell has root....

Sorry for my inexperience ....

what does it mean ??? That the phone has root privileges? I'm trying pixflasher on pc with windows