yashsingh1/xdaforums huggingface dataset:
[Magisk] antoinecimino:
Hi, I updated my OP to NE2215_14.0.0.710(EX01) version and had to flash Magisk again because the "Stock back up does not exist" message (update after OTA seems broken or i did sthg wrong).

My device passes the Basic + CTS profiles on YASNAC, but fail to meet strong integrity (I guess because of bootloader unlock) on Play Integrity API Checker.

I have hidden my bank apps + all apps detecting root on Zygisk but it still gets detected.

Here is my modules list :

De-bloater v1.0

GoogleDialerMod-Magisk v1.04

Play Integrity Fix v15.9.9

Systemless HOsts v1.0

Zygisk - LSPosed v1.9.2 (7024)

Zygisk Next v1.0.5 (not working currently bc I have Zygisk enabled)

Is Play Integrity currently broken on the new OTA update or am I doing sthg wrong ? And should I disable Zygisk to get access to Zygisk Next (what is the standard now ?)

If anyone also has ideas on the Stock backup (sorry not the best thread), happy to get insights there too.

Thx !
[Magisk] BunnyPig1:
What is your exact question?

Is it that you're not passing DEVICE, apps detecting root or that apps are detecting Zygisk?

To pass device you can read the FAQ or go through some of the pages in this thread, apps detecting root could be hard to avoid but a lot of banking apps need further hiding and not only DenyList. This can possibly be achieved with Shamiko, HMA (HideMyApps) etc.

Did your banking apps work with unlocked bootloader and root before the OTA?

You mentioned stock but does that apply to kernel as well?

Have you tried reinstalling PIF correctly? When you un-installed it, did you make sure to delete pif.json file so you don't use any old fingerprints?

If PIF isn't working, give PIFork by osm0sis a try, you have to provide your own FP but it's easily done, and you can grab the same FP everyone else is using.
[Magisk] antoinecimino:
Actually it is a bit of both. The most itchy issue is that Google Pay / Banks and so on are detecting root and stop functioning.

Yes before OTA (and with unlocked bootloader it was working fine), I had the same setup and banking apps were functioning

I'll take a look at Shamiko and HMA to see if it can solve it using one of them (I used Shamiko in the past I think).

I went to data/adb and I only had a pif.json.old that I deleted. I also went on modules/playintegrityfix to make sure everything everything was gone after uninstalling the module.

Regarding Zygisk - LSPosed / Zygisk Next, are these modules reliable ? It is quite hard to follow up with all this devs !
[Magisk] BunnyPig1:
Me personally, I use Zygisk Lsposed. It works for everything I need. Can't answer anything regarding Zygisk Next.

If you want to pass DEVICE and haven't tried @osm0sis fork (This one) I'd suggest you give it a try.
[Magisk] antoinecimino:
actually I think I managed to get back access to my banking apps after uninstalling Zygisk - LSPosed. I need to run a couple of checks now but it seems to be fine
[Magisk] kholdstayr:
I have the chito pif module and everything was working up until today. Now, RCS doesn't work, but I still pass integrity.
[Magisk] JazonX:
Anyone who has System R/W looked into this option ?

GitHub - chiteroman/FrameworkPatch: Modify framework.jar to build on system level a valid certificate chain

Modify framework.jar to build on system level a valid certificate chain - chiteroman/FrameworkPatch

github.com
[Magisk] aliantonio:
I'm passing device and basic on PIF 15.9.9 but RCS isn't working for me again. Man this is exhausting.
[Magisk] aliantonio:
And now I'm failing device as of just a few minutes ago.

Edit: disregard, it's back to passing again. RCS still not working.
[Magisk] angrypizza:
can't pass device integrity. modules installed are shamiko,play integrity fix, systemless host, zygisk next and universal safety net, which will disappear from modules installed after restarting the phone.

Apatch app installed.

enforce denylist tried enable/disable

deny list checked for wallet, store services, google play store.

check for google services framework on deny list under magisk wont stick after exiting re-entering deny list.

what I need to do to pass integrity check

I am on crdroid androd 11 on a samsung S7
[Magisk] Stаr:
You need a rom signed with a private key (not test-keys) to pass DEVICE integrity now, and until very recently Crdroid only signed roms with test-keys. Considering that's a fairly old rom, you'll have to move to a modern one or one that always signed their builds (eg. Lineage).

When downloading a rom you can also check if its signed by extracting the zip, going to META-INF/com/android and verifying the otacert file with openssl:

openssl x509 -in otacert -text -noout

As long as it's not signed by android@android.com, you should be good.

Edit: an even quicker way to check would be dragging the zip to LineageOS's OTA Verifier page. As expected it'll throw an error if it's not signed by Lineage, but it'll still show info about the issuer which is good enough for our purposes. And as long as it's not a generic Android from Mountain View, California, US signature you should be good.

Example of a good one:

View attachment 6113080

Example of a bad one (test-key):

View attachment 6113083
[Magisk] generalculprit:
So, what do we have?

- "old" prints not passing DEVICE, but RCS,

- sailfish with DEVICE, but no RCS,

- sailfish passing both (like me until now) and

- stock devices without RCS?

Doesn't add up. Rom, carrier, country, glitch?
[Magisk] pershoot:
RCS is currently dead with Sailfish. There is nothing you can do now except wait for Google to potentially change their mind on it, wait for a full ban of the current pub. FP to take place which would have Xiaomi search for a new one (i.e. cat and mouse), find a private print or use an old print which does not pass DEVICE but is not banned for RCS purposes (which would render your contactless payment(s) inoperable).

Ensure resend as SMS is enabled and notify your recipient(s).
[Magisk] Wolfcity:
Some weeks ago I posted here that Niantic (developer of Ingress, Pokemon Go) will use STRONG_INTEGRITY check from May/June 2024 on.

Looking at the screenshot and url June 3 was the day and as expected I can't log in to that game anymore which is ok by me, I knew what was coming.

My question: Is there a way/command to check if they're really testing on STRONG_INTEGRITY and how they do it ?

May be helpful for future methods to spoof/avoid those checks (if any).

"You recently signed into Ingress with an Android device that does not meet our upcoming Google Play Integrity requirements" Warning (Android — Ingress Help Center

Ingress has implemented Google Play Integrity checks to ensure a fair and secure gameboard for all players. Google Play Integrity helps verify

niantic.helpshift.com

(Translation of 2nd screenshot);

Ingress is not supported with this device configuration.
[Magisk] SchmilK:
My custom pif.json just got banned. :(
[Magisk] osm0sis:
So far mine (since March) is still good.. 😶
[Magisk] SchmilK:
Going to make a new one after lunch I guess. :-/
[Magisk] generalculprit:
I just killed carrier services, cleared cache and rebooted. RCS is still working here. By now.

Edit: Did it again, also clearing messages cache. Still working RCS.

Edit2: Repeat, still working.
[Magisk] pershoot:
It will flip back if it is a true RCS ban of print.
[Magisk] HippoMan:
Most of mine since March got banana-ed within the last few days. But three of them remain in a working state.

My fingers are crossed (but not at this moment when I'm typing) about those three.
[Magisk] phillibl:
Why is it that RCS breaks/fingerprint gets banned? Is it from unlocked devices or KernalSU/root/Magisk? Trying to figure out what I can do for stability, switch roms or go back to stock.
[Magisk] pershoot:
If you want the most consistency and stability which would get yourself out of this cat and mouse, return back to stock and lock your bootloader.
[Magisk] sawdoctor:
I really don't understand what is going on, I can RCS chat with some people but not others. My son can only SMS me and I have no option to rcs him (he's fully stock um rooted) but i can RCS some other people
[Magisk] angrypizza:
those 2 links are about the signing keys for crdroid but they don't explain anything on how to set them.

I have no clue on what to do with that script

crDroid.net - Sign your crDroid builds and keep Play Integrity happy

A guide to using signed keys for crDroid builds

crdroid.net

GitHub - 306bobby-android/crDroid-build-signed-script: Build script for creating signed crDroid OTA packages

Build script for creating signed crDroid OTA packages - 306bobby-android/crDroid-build-signed-script

github.com
[Magisk] samhhmobil:
Please excuse me, but you are offtopic, you're for your question in the wrong thread.

Here is discussed to reach DEVICE_INTEGRITY, with help of PlayIntegrityFix/Fork.

Here is NOT to be discussed how to build a custom rom and how to sign it.

You'll probably find a better thread for your topics.

Just my 2¢,

samhhmobil
[Magisk] pershoot:
Mod Edit: Quote removed since post deleted.

If you require RCS to be functioning in a more consistent and stable manner and are not in-tune with deeper technology constructs (i.e. able to hack / hack around / deploy contingencies, etc., etc.), then your best bet is to return to a stock configuration and lock your bootloader.
[Magisk] sawdoctor:
Mod Edit: Quote removed since post deleted.

Maybe just wait 24 hours before doing anything. The exact same thing happened about a month ago and 24 hours later rcs was working again
[Magisk] angrypizza:
device integrity (which is on topic) is dependent on key signing making my question on topic.

I excuse you
[Magisk] casouzaj:
One last try. On a secondary, already rooted phone of yours (or from a friend or family member), copy all the zip files (the ones you want to see installed in your phone, like magisk, the modules zip files) to it, go to https://xdaforums.com/t/tools-zips-scripts-osm0sis-odds-and-ends-multiple-devices-platforms.2239421/, click on `adb & fastboot installer`, download the zip and install it by the root manager app available on this secondary phone (Magisk app or KernelSU Manager or APatch Manager) .Reboot it, launch a terminal emulator app and connect this secondary phone to your phone. The secondary phone will act as a PC. You will be able use adb (devices, sideload, etc.) and fastboot (devices, boot, flash, etc.) commands, just as usual.
[Magisk] D€INOS:
Yeah RCS down is the same way as last time for me, i.e. it's "connected" in the message app settings but off/unavailable in the messages threads.

OnePlus 8T, Stock OxygenOS 14.

I bought a new Galaxy s24+, arriving tomorrow, was planning to root right away but this getting annoying. 🥴
[Magisk] nateify:
Where are these FP that pass RCS even when not passing DEVICE? Are they banned?
[Magisk] JoeRifle:
I was incapable in the end. Kinda was expected since I am on stock rom.

It was basically just another app opps setting I forgot about somewhere in the settings GUI that kept the test apps from actually calling / accessing playstore.

Thus access violation. Duh.
[Magisk] pndwal:
I tend to agree with this, but methods should really be given/cited/linked and technical discussion limited I think. (There's been some here to be found by searching) Probably should be something in faq about this... Looks like @osm0sis will get on it:

https://xdaforums.com/t/tools-zips-...tiple-devices-platforms.2239421/post-89543434

🤠 PW
[Magisk] chiteroman:
Tired of manually creating your pif.json from build.prop? No problem! I just created (with ChatGPT help 😅) this website:

https://chiteroman.github.io/

Just paste build.prop content here, press button and it will create a pif.json ready to test ^^

Useful command for fast checking props (remeber to grant root to Shell):

adb push .\pif.json /sdcard/pif.json; adb shell su -c 'mv /sdcard/pif.json /data/adb/pif.json'; adb shell su -c killall com.google.android.gms.unstable

Enjoy testing fingerprints 🤗

Source code
[Magisk] HippoMan:
I hope that ChatGPT has been more accurate and reliable for you than I've sometimes found it to be. :)

One of many examples: I asked it, "How many times do I need to recursively take the square root of my mother's age in years before the result is less than 1?" I asked it several times, and each answer was different, and none of them were the correct answer (which is that the result will never end up being less than 1 ... because any human's mother is going to be greater than 1 year old).

UPDATE: Maybe the infamous "PIG" who gets mentioned here a lot might actually be a Gemini construct ("Gemini" is the Googlefrinchian version of ChatGPT; it used to be called "Bard"). This might explain why there still are a few fingerprints which haven't yet been banana-ed.

:)
[Magisk] robbins:
Pokemon Go works correctly here, failing strong.
[Magisk] angrypizza:
thanks for your reply. I read that topic but still have no idea how key signing is done. and I can't find any "how to" by searching.

just wanted to point out this to others, if I'm the only one who posted the question, that doen't mean key signing for device integrity is effecting only my device, other custom firmware owners might be facing the same.
[Magisk] trevtdogg:
there have been many discussions about this, and of course many people are affected.

the solutions are to either get the custom rom dev to properly sign future builds, switch to a different custom rom that is signed, or learn how to sign a custom rom yourself.

sharing these points when relevant in this thread is of course fine.

but eventually this becomes a separate topic all of its own (how to sign custom rom builds) and should be moved out of here and to a more relevant thread.

not just to make it easier for this thread and this topic, but also to make it easier for other people interested to find it.

eg. if other people are looking for info in how to build and sign custom roms, they probably aren't first going to look here thousands of posts deep inside a play integrity magisk module thread.
[Magisk] Wolfcity:
Ingress has become the unloved stepchild of PoGo so I don't think they will do that to their flagship.

They will lose many players in Pokemon Go If they take the hard way and take violations of the TOS seriously and also check for strong there as almost every player is multiaccounting and a lot of them are spoofing their GPS signal.

Maybe Niantic wants to find out how many players they lose with that move. The official announcement is that it's done to avoid spoofing and cheating (which is b.......t). I really don't know why Niantic does such a hard move, as we all know an unlocked BL is enough to fail strong.
[Magisk] xc112:
you can only work with this if your a rom builder
[Magisk] freeza:
Rip to rcs? 😭 All of my prints are dead
[Magisk] 306bobby:
Yeah waiting 24 hours isn't working lol
[Magisk] 306bobby:
Because you do it at ROM build time. You create the ROM build environment, run the script, then build the ROM

Either you or your maintainer has to do it, and it must be done at build time
[Magisk] cambunch:
I fixed my RCS issues by just turning it off 😄
[Magisk] osm0sis:
Last time they did this it seemed like an attestation print-based RCS test ban for a weekend. Last time it also seemed to affect some unrooted people so it could also have been some kind of outage, or alternately the regular users caught in the crossfire could also be what ended the possible test.

Maybe they're doing a week-long test this time? Will be interesting to see if unrooted are affected again. Note that as with the griffin print in the last test, only the public print is blocked for RCS, and private prints still work fine.
[Magisk] angrypizza:
if there's no one answersing or knowing how to sign keys in a 800+ pages topic, I doubt the 20-30ish views I'd get in a separate topic could help.

I don't believe there are any signed cfw for a Samsung S7 new enough to run gpay, is there ?

I switched from stock nougat/oreo to newer cfw (android 11) to get google pay support. it worked for a couple of months.

I lost in the upgrade bt reliability (continuous sound disconnections), camera occasionally not finding sensor, discharges while charging, notification issues, typing issues, no volte (no internet during phone rings or calls), echos during calls, random ring/notification sounds changing, random restarts, and currently no longer google pay support, other (unsigned) cfws tested had more bugs than the listed.

I read people wondering why custom firmwares are dying, this is why

and sorry for asking questions you and the others don't know about.

cheers
[Magisk] generalculprit:
According to @zetsumeikuro and @sawdoctor they are.
[Magisk] aliantonio:
I'm getting error adb.exe: unrecognized option '-c' . Any ideas? Couldn't find anything online. I believe I have the latest adb tools
[Magisk] Ahmadzay:
Does anyone know a list of custom roms with signkey?
[Magisk] bynarie:
Yea my RCS isnt working right now, even though I'm passing both verdicts.. So I just turned it off for right now until new update
[Magisk] zetsumeikuro:
I tried unrooting on A14 to see if I would get RCS back and no dice. My guess it's due to Sultan being blacklisted. I should've flashed the stock kernel to confirm but I went to A15 beta instead. Haven't rooted A15 yet and set everything up and what do you know. Tons of RCS messages came flooding in asking why are you not answering or ignoring me. A user in the Sultan kernel beta group says they are still using the public sailfish print and RCS is working fine for them. So many inconsistencies just like the last time that makes me thing that Google just enjoys cucking when it can.
[Magisk] immortalwon:
That's what happens when people sacrifice liberty for security, in the end, you get neither.

Google has become exactly like george orwells 1984 big brother
[Magisk] bynarie:
Veteran newb here, but which build.prop file are we using? I'm guessing /system/build.prop
[Magisk] borisSweden:
There is a solution and its not about spoofing your phones status, it RCS without Google BS called UniversalProfile that exists in the background. We have yet found a open source client for RCS that works. Degoogling RCS chat is the best course of action and I hope Apple of all company's does this.
[Magisk] sawdoctor:
It's really weird , I can still RCS chat some people but not others. I don't have rcs option and am "off line" to some but others i still have rcs chat option available
[Magisk] osm0sis:
You actually need system and vendor, sometimes also product build.props to generate most valid prints, so that website isn't set up at all properly for that, and you should just stick to my long-standing existing script. 😄😛

[TOOLS][ZIPS][SCRIPTS] osm0sis' Odds and Ends [Multiple Devices/Platforms]

osm0sis' Odds and Ends -- Misc./Batch Tools, Flashable Zips, Scripts, etc. General Information In a nutshell, I just wanted a single thread to gather links to some of my other, larger projects, but also serve as a spot I could put some smaller...

xdaforums.com

@joeyhuab Oh, just for clarity, that's actually always been my array order, which by the way I did to match the order and contents of the fingerprint field for easy understanding and better coverage of any possible future cross-checks Google could add. chit only matched it very - recently.

Not faulting chit for this change though, quite the opposite! I'm extremely glad we finally both use the correct field names and have a sensible order now! 🙂👍
[Magisk] 306bobby:
The issue is you CANNOT, as an end user, simply just "sign" your build.

Not to be harsh, but custom roms are dying because users like this. All I just saw/read was a bunch of complaints about outdated firmware with no way to fix

I (and other devs) HAVE told you how to sign builds, it's just not an end user process. That's not our problem
[Magisk] s1dest3pnate:
If only someone could figure out a universal way to lock the bootloader without wiping, all our problems would be solved, but I know that's asking for the impossible.
[Magisk] 306bobby:
Even if that was solved, still gotta figure out avb as well as recovery options if someone bricks
[Magisk] trevtdogg:
do you mean that according to them, some people with unrooted (stock & locked bootloader) devices are also having RCS issues?

or do you mean that according to them, it's going to be a week long test by google?

or is it both??
[Magisk] generalculprit:
First one. From yesterday:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] angrypizza:
I CANNOT sign my build but you told me how to sign it. makes sense!

you're right, my fault if bluetooth coverage went from 130 foot with stock rom to 10 inches with cfw.

we're on the same wewavelenght mate.

but I doubt its bluetooth wave!
[Magisk] osm0sis:
You can sign it if you are the one building it.
[Magisk] generalculprit:
I'd prefer a relaxedpizza. 😉
[Magisk] Stаr:
Besides the OneUI repacks I don't think so, but I took a quick peek at the S7 forum and there are unofficial LineageOS builds still being put out monthly by @Ivan_Meler so I guess you could ask him to start signing his next builds in order for PlayIntegrity to pass DEVICE.
[Magisk] angrypizza:
I

whos angry ? the nicks literary translation is a recipe
[Magisk] angrypizza:
Thanks for your message, but those fw were the first ones I tested.

this video seems useful, but I am not sure theres a pif.json for the exynos s7

youtube

How To Fix Device Is Not certified By Google In Playstore.Play Integrity Fix Using Setprops pif.json​
[Magisk] Nergal di Cuthah:
Not sure what you mean, pif.json should NOT reflect actual device
[Magisk] angrypizza:
well the video shows it does. but I can't tell if its a fake. you can copy and paste the title on youtube if you wanna check it
[Magisk] sawdoctor:
I'm rooted with latest pif and fingerprint that everyone is using. For some really bizarre reason i have rcs chats working on some conversations/contacts but completely broken/showing me off line with others. I have no idea what the common denominator is unless it's a cache thing
[Magisk] Wolfcity:
Definitely not. 90% of the users in this thread use the same fingerprint. The video you mentioned is outdated.
[Magisk] flobo09:
Is there any "known" old fingerprint that work for RCS only since if i understand correctly, those are different banlist ? (i don't care about google pay or banks)
[Magisk] Stаr:
I know they're not signed, what I'm saying is that since this rom is still regularly updated, you should post in the rom thread to make the ROM builder aware that it's required that he signs them now in order for GPay/other things that require DEVICE integrity to work at all. This is a fairly new issue and from a quick glance, no one has brought up this issue there yet.
[Magisk] angrypizza:
is fingerprint related to the pif.json file of the video
[Magisk] angrypizza:
I can't use that specific rom so there is no point of posting there for me
[Magisk] immortalwon:
I tried to use your script on ubuntu to sign an older evox a13 rom and it was failing in the beginning. The script doesn't even define if it will encrypt 2048 rsa or 4096.

View attachment 6110460
[Magisk] 306bobby:
Correct message below
[Magisk] 306bobby:
Your CA line is too long it appears, all items need to be one word or in "quotes"

The ~/.android-certs directory should also be empty

The keys will be whatever branch of tools your ROM pulls, as the script does not force a change to 4096. So likely it is 2048

Sorry for the edits, at work right now

This script has been confirmed to work with crdroid 9+10 and lineage 20+21