yashsingh1/xdaforums huggingface dataset:
[Magisk] borisSweden:
Its a freaking joke and unjustified to act like this from AOSP team. FFS ATM still use Windows XP,7 and iOS isn't secure because Bapple doesn't recognise jailbreak and reverse iMessage, they just silently patch it to keep the charade going of closed source "security". Them going bananas hurt the advantage of Android experiment. Until Google stops the abuse of unnecessary use of SafetyNet and PlayIntegrity for some apps the fight goes on.

Adding security to streaming will just make pirates return, making Gpay unusable will make open source like Gnu Taler grow, being PIA will make people turn to sandboxes Gappa and MicroG to just send useless metadata.
[Magisk] EuK_V:
There have already been many posts here about how finding one's own print is not so difficult and we need to convince people to do it, but I think this is not an option at all. You saw the results of the survey, those 80% won't do this and there won't be enough time to convince them, while we do this we will run out of prints. And if @chiteroman and miui devs stop handing out prints, people will start posting them on channels and forums "helping others".

So a module that selects random prints from a pool is not such a bad idea, the best for today I think.
[Magisk] ArzZenic:
I belive, that even IF when the posting of relevant FPs will go through via disposable channels, it will still deter like 40-60% of the people (just leechers). So it might not angry the Google "Big boss" so much.

Pool, atleast from my perspective might be much more hazardeous. As I said, is it even possible to push E2E encrypted FP via Magisk? Somebody would have to also host the secured server. Much more trouble.

I believe that the best solution we can give to everyone (devs, not just noob as me) is to give them tool, to get their own FP (which already exists).

I am prepared to do comprehensive (like even my grandmother would understand) guide for getting own individual FPs, without posting any links to FW REPOs or anything else. Which could be pinned to the 1st page, if there would be demand for it.

Of course it would be completely useless, while XiaomiEU/Chiteroman should be still releasing versions with one4all FPs.

PS: If you have root, you should work for it.. (ofc not as much as our beloved DEVs, they should get a contribution from you)
[Magisk] xSnowLeopardx:
I saw someone mentioning Bard.

I asked Bard and he gave me a FP with Basic passing LOL.

Maybe after a few different prompts (or changing the API level perhaps), and I will have me 21st working FP :sneaky:

Edit

Well, I can't say I did not try... but, I did not succeed, unfortunately... Oh well.
[Magisk] V0latyle:
Sorry, I didn't realize it was the one already in the module.

Has anyone thought about how much of a boon it would be to have someone on the inside at Google? They obviously couldn't provide any proprietary information that could be used in an exploit, but they might be able to shed some light on how these prints are being detected...

Probably won't work for many prints.

Well, the pool of potentially usable prints is much MUCH bigger. But yes I think you're on the right track. I don't think it would necessarily have to be encrypted because as long as:

no print is built into the module itself

the selection process is random

the only indication of which print it could assign would be the pool itself

They wouldn't know which print to target, because everyone would be using different ones.

Of course if they wanted to, they could use the pool for a mass ban, but honestly at that point I think it would be more likely that they'd reinforce Play Integrity mismatch detection so that the prints used wouldn't matter, PI itself would handle mismatch detection.

We've already discussed in detail the criteria for working prints. Anyone who actually reads this thread already has that information.

But, I don't know if they're taking the time to do that. I suspect the ban has more to do with PI check traffic.

Keep in mind that the PI servers see a LOT of checks every second of every minute of every hour of every day, so they have to have a way to filter things. This probably includes:

App making the request

Fingerprint of device making the request

Frequency of request

So, if they see a particular print getting a LOT of traffic from apps that provide PI response to users, that's a big red flag.

So, assuming they aren't monitoring this thread, the "randomization" technique allows us to blend in. Sure, they can filter down to requests made through certain apps, but if all the prints are different, how do they know which ones to investigate?
[Magisk] V0latyle:
I think this is one of those situations where a developer should take responsibility for the situation and make the decision for the benefit of the community. People are selfish and lazy and will always opt for whatever is most convenient for them. But, necessity breeds innovation. So, if @chiteroman is actually interested in helping us at least buy more time in these efforts, he would stop building prints into his module, only support custom prints, and in the meantime work on a way to assign random prints when the module is installed. The selfish lazy people won't like having to find their own prints but it's the best chance we have to hold off the inevitable while also having a turnkey solution. Just means that people are either going to have to learn to find prints, or make friends with those who do, or they're just going to have to go back to stock + locked.
[Magisk] wide_load:
We could keep the full list private, well the devs that worked on the API could see it - Maybe use github issue for reporting ones that no longer work if they come up.

If someone would be kind enough to share a handful of working ones I can knock something up and do a pull request for the module.
[Magisk] Iridule:
Bit off topic but reminds me of how emulators used to come packaged. Many sites would give you the emulator and even tell you where to place the bios files, but they would not provide the bios files. So 98% of the work was done.
[Magisk] badabing2003:
Water runs through least resistive path, and just like water people prefer least resistive path too.

If you give them the option of providing a solution on a platter or asking them to put some work for it, the majority will choose the ready made solution, and that's just human nature, and I'm not exception to it myself, unless I enjoy the work or the challenge.

However when the option of being served on a platter is off the table, most people are capable and will put in the little work, if they still have the interest of keeping root.

For heaven's sake, if they can extract boot / init_boot, transfer and patch and transfer back, unlock bootloader go through developer settings , flash ..., you think they won't be able to test a pif.json.

Don't try to convince me that they can follow a more complex set of steps to root their phone but not a simpler pif testing?

Of course they can, they just don't want to do it if they don't have to.

The sad reality is that, someone or another or another will do it for whatever motives or good intentions.

I'd like a poll when the sh*t hits the fan and Google thwarts all spoofing attempts, what those voters going to react like?

And the rare few who manage to overcome Google's detections, will keep the new discoveries close to their chest.
[Magisk] V0latyle:
It's not that hard to reverse engineer something and find the source.

The absolute best solution overall is for everyone to find and use their own prints.

I'm just trying to suggest a middle ground - having a module that can simply be installed and "fix" everything with minimal user input, while at the same time providing strength in random anonymity.
[Magisk] badabing2003:
hahaha
[Magisk] ArzZenic:
//Actually this is quite what I am afraid of, if the E2E would not be implemented. You know, that there would need to be (or maybe not) a community effort to get 50-100 working FPs for the pool, for atleast some kind of randomization. I don't know and can't foresee how many users, in this case you might want to include xiaomi.eu & other customs, are using this solution.

Also WHO would store those, could he get some kind of "pre-court notice" from Google or any other interested subject? If this pool would get compromised, we would lose 50 FPs, which are more than 1 year of Chitero's & Xiaomi.EU solidarity banning (1ban per week).

The randomization would need to be completely secure, from the user to the source etc., or I am wrong? The pool would need to be hosted somewhere away from GH.

Every single humanely/computerly readable data are exposed, if higher number of people are using it, without E2E.

Also, if everything above would be implemented, the DEBUG for PIF would need to be reworked, because you could see the spoofíng happening via LOGCAT.

I am not the develeper unfortunately, but it's like this going from my common, unprofessional knowledge. I am completely happy to be corrected.

Thank you.
[Magisk] sethieplayz:
I think I've found an FP I want to try, but when I navigate to /data/, I can't see an ADB folder within...I'm using FV file explorer
[Magisk] ArzZenic:
Are you rooted? Try Total Commander.

Also, which Phone?
[Magisk] V0latyle:
It may be /data/data/adb
[Magisk] sethieplayz:
Is there any way I can do this on-device?
[Magisk] wide_load:
I guess by private I mean harder to get than just a .txt file on GitHub :P In the same way that some of the people here have private collections of 50+ jsons.

I'm not convinced we'd need to try and keep the single randomly issued fingerprint secret from the user of the device like that - just the full list would need to be hard to find.
[Magisk] sethieplayz:
Nothing there either :(
[Magisk] ArzZenic:
Yess, download Total Commander from Play Store :)

Check around in the /data/ folder. You might have a different system.
[Magisk] sethieplayz:
Total commander APK worked, thanks!
[Magisk] ArzZenic:
Thats exactly what I was saying. To be "customer friendly" its completely retardedly hard.

And thats I was saying I was okay to do the comprehensive guide for everyone, who wasn't completely lazy :) if it would be attached to the chiteros's 1st page.
[Magisk] ArzZenic:
They are going to throw sh*t on @chiteroman ofc, BECAUSE HE DID NOT FIX IT.

Screw you all (with public FP) My morning coffee did not work (..why? Coz this fu*king developer, to who I did not contribute a single dollar, did not have the answer for the multibilion company. Fu*k you, fu*k you.) This will be the first response from the public.

That's why I am going through the side of education. People should DESERVE and people should WORK for their Wallet.

Even for the case of @chiteroman, once it stops working, you'll get wrecked upon, even though your awesome work. Thats the sad thing about free stuff.
[Magisk] simplepinoi177:
*Apologies if any/all of these were already responded to; I can't go through the literal 141 posts (top of page 353) in the last 24 hours....actually, I recall some being addressed (the netflix one or asking if there is a permanent solution yet) and removed them

FWIW, I would fail DEVICE (also confirmed by not being able to search for Netflix and the Turo app "not being compatible" [but seen because I have it installed]), implement a working fingerprint, reboot, pass DEVICE and find Netflix and Turo pretty much immediately...this is on a Pixel 7 Pro if it means anything...

I believe he did, but the flaw in that plan was he polled on Telegram -- where most probably could/would be classified as just-wanting-anything-to-work-out-of-box

You keep saying "that API can be changed"....can you elaborate on when an API can't? I thought all of those are editable fields? So I had assumed all FIRST_API_LEVEL fields you can change the value....

If you are paranoid about not being able to Tap n Pay suddenly like me, you should check out this tool (I can't say whether it works or not just yet until my custom fingerprint gets burned, but it seems promising as I keep seeing a toast every time I unlock the screen...)

GPay Checker: monitor of Google Pay availability

Google Play Protect now triggers onto app (that's honor for me), but here nothing criminal. You can safely skip warning. There is non-zero theoretical possibility, that using this app increases risk of banning your personal fingerprint. There...

xdaforums.com

@ArzZenic , I attempted to do this 😅 .

How to search & find your own fingerprints [noob friendly]: A Comprehensive Guide w/ tips & Discussion for Complete Noobs (from one)

It seems Google has banned more than 95% of custom fingerprints, so this thread/guide has kind been laid to the wayside. But it's still a great resource to understanding the foundations of fingerprints and all that... This is for any/all utterly...

xdaforums.com

Spoiler content hidden.

And it seemed to get a pretty good response (20 likes) and have helped a number of people, but most of them like just coming here or Telegram because that's where the experts frequent and/or view this as "the source" and/or just don't care for a place....

But, in any case, mine doesn't seem to "be a demand for it" to be "pinned to the 1st page", although I'm flattered a member suggested for it/supported-the-idea
[Magisk] purgy:
It's a safe bet that many of those who "won't", would change that answer very quickly if they weren't being spoonfed an alternative.

Also I fear that any "pool" that fps were pulled from would quickly become a target for the pig (Play Integrity Guy) and just result in mass blocks of every FP in that pool.
[Magisk] simplepinoi177:
what I find ironic is those same lazy donkeys will "female-dog and moan" like that, but still be so desperate that they'll constantly re-install the module as it is (even if it won't work) and/or download each and every incremental update/commit in the hopes it'll still just be spoon-fed to them instead of going about the proper directions and/or required effort themselves...

If that were to happen, chiteroman should just troll and keep "claiming" he's updated the module, but it's just changing wording in the readme or something cosmetic and just watch all of them keep desperately grasping at every small change/update....
[Magisk] simplepinoi177:
I like that....! Assuming there literally is "a guy" (someone previously mentioned thinking it's an algorithm/A.I. doing it, but was pointed out things don't get banned on the weekends 😅🤪), but I'll be kanging that if you don't mind...;)
[Magisk] Iridule:
From my experience MOST API field changes ( talking about FIRST_API) will break the prints integrity. When an API can be changed only lower numbers seem to work and every print I've found can go as low as single digits 0-10 or even 00. So from my experience any print that can pass integrity by changing the API can be changed to any API lower than what it started with...I just change them to 00 for convenience, I'm not sure what this shows to droid guard or whatever looks at those things.
[Magisk] ArzZenic:
You know what the biggest joke is? That every single one of those people just need to ask. Honestly I can do public guide, but if someone, who did not just register today and have some posts. I am really pleased to share the REPO (I have 3, @simplepinoi177 if you need more, just ask),

OR EVEN

my personal FP, I will share it.

But this is just ridiculous, when we have no E2E encryption or secure server and every public FP can be read in the GitHub or thought apk decomp., then we are going nowhere.

I am sincerely here to help, and you as well, but until this is going to change, we do unfortunately nothing.. :(
[Magisk] Wolfcity:
Btw, at the moment no need (and no way) to pass strong integrity. It would be just for your satisfaction. This may change in the future.

And as @pndwal said: Relocking BL may cause problems...
[Magisk] chiteroman:
There are apps that are using Strong like Uber Driver.
[Magisk] Wolfcity:
Yeah, and there will be more in the future.

So have an unrooted device or hope for an exploit.
[Magisk] cr0wdelex:
I use Delta and enforce unmount + HMA => Intune work for me.

I'm using Poco F3 with GhostOS (A13)
[Magisk] supermansaga:
Would this work on Windows Subsystem Android's Magisk 26301?
[Magisk] pndwal:
Why do you think that?... Did something change?...

I didn't see any report that @FredMontteiro's Uber Driver running on unlocked devices:

1) Samsung Galaxy A5 2017 running LOS 18.1 / A11, unrooted, basicIntegrity only (launched with Android 6.01), and on

2) Xiaomi Mi A3 running stock Android One OS (presumably A11, latest), rooted, basicIntegrity and deviceIntegrity only ((LV Android 9.0),

per: https://xdaforums.com/t/module-play-integrity-fix.4607985/post-88934417 stopped working...

Last reported working Sept 3: https://xdaforums.com/t/need-help-uber-driver-app-not-go-online.4614295/post-88957287

An update was just pushed on Sept 13 however... @FredMontteiro, please could you say if it's still working on unlocked devices after updating?...

Nb. The only app I am aware there is real evidence pointing to it's beginning to enforce strongIntegrity is a photo editing app with face detection, and then the implementation is very strange and looks almost accidental as it only seems to apply strongIntegrity requirement to certain (one?) editing templates... Here:

https://play.google.com/store/apps/details?id=io.faceapp

🙃 PW
[Magisk] chiteroman:
It worked in a Nintendo Switch, I think it should works in Windows 😅
[Magisk] Johnn78:
Yoy mean that due to bootloader unlocking the keymaster has been broekn and all this is saved in persist partiton & If I have backed up the partition when the bootlader was locked & restore it now with unlocked bootloader then I will pass the Strong Integrity ?
[Magisk] pndwal:
No... Unlocking doesn't break this... If keymaster is the issue, OEM messed it up in factory... OnePlus devices are notoriously broken in different ways; some locked devices can meet strongIntegrity, some can't... And Google can revoke keys too, eg when devices pass strongIntegrity unlocked as Asus ROG Phone 3 did... These will also never pass strongIntegrity again either...

Assuming you currently have officially locked B/L (ie stock configuration), still can't pass strongIntegrity, and it's NOT due to broken AVB chain of trust, Keymaster implementations etc, nor due to Google revoking keys, it's likely that /persist has been messed up... happens on certain devices like Poco when flashing ROMs etc...

Not sure how you would have backed up persist with locked B/L, but a backup taken after unlocking and before modding (especially flashing custom ROMs) should restore your unique IMEI, S/N, BT and WiFi Mac numbers etc as well as fixing integrity verdicts... If all these functions appear to be good, it's also likely that /persist isn't the issue...

Nb. If you're lucky your device may contain persist.bak file etc... Nb. persist image in ROM is generic only and doesn't contain your unique device values... Depending on device there may also be ways to recover these from hardware using specialist software, but I've only read a little about that...

👀 PW
[Magisk] :
I honestly think Uber Driver uses Strong Integrity because with the use of shamiko + hide my applist everything is perfectly hidden to any existing app. And the method proposed by FreidMontero is just spoofing the device Ids, what does this have to do with root detection ?
[Magisk] pndwal:
Check 'Minimum requirements for your device' and 'Banned devices' here:

https://www.uber.com/gh/en/drive/driver-app/

Page is probably outdated as app seems to require Android 8 now, but seems they were/are banning use of devices with dual Sims, low specs etc... Just having such a ban list indicates that locked / unrooted is not Uber's only criteria... PW
[Magisk] :
Okay, this is perhaps explicating why the method of FreidMontero works for him because he have a old device, and his Uber Driver account doesn't yet require Strong Integrity. For me I have Pixel 7, update of August, magisk 26.3, shamiko, hma (void app data activated) and play integrity fix module. Only things that are potentially detected by Uber Driver app are zygisk injection in app (like in Momo), bootloader unlocked or doesn't pass strong integrity, or something unkown but I dont think so.
[Magisk] simpleatom7:
I managed to run it on my device... before adding it to deny list, it said ur device isn't certified bla bla... so I added it in deny list along with safetynetmod & cleared app data & now I can use the FaceApp & there is no certified warning.
[Magisk] simpleatom7:
U just need play integrity fix along with deny list apps added ( google, google play services & xyz bank) but don't enforce them & shamiko(I don't use shamiko). Clear data of playstore + banking app & restart..
[Magisk] aquino.andres:
Thanks, I tried with play integrity fix, deny list, rebooted and it worked great! As of Netflix I had to install a module called "liboem", rebooted and then every streaming services worked finally after a year of having this phone and Netflix not working!
[Magisk] zgfg:
Yeah, but you have to test all filters. Some will work and some not - that's the point

It was discussed here or in another thread. I also thought first that for me everything was ok until I understood which filter I had to test (I uninstalled the app and don't recall every detail anymore, but you can test yourself)
[Magisk] simpleatom7:
I would kinda agree since I also feel certain filters especially the ist ones were acting strange.... The issue is, it begs for pro version....
[Magisk] simpleatom7:
Try adding "shell" in HMA and see if it makes any difference.... {Bcz parasite lsposed if installed would stick with "shell" service.... Although if it checks for strong integrity then it is quite difficult to pass (currently I don't know any method...

Or u could be lucky with Asus Rog 2 or some one plus devices which have broken keys & it doesn't matter if bootloader is locked/unlocked, it would pass strong integrity.

[Verify the 2nd point as I rely on comments from an anon user]
[Magisk] zgfg:
No, I don't 'agree' with you

See the screenshot and test Impressions, Hollywood 2 filter
[Magisk] pndwal:
Need deviceIntegrity for most filters... But open app, get to page offering premium, close out with X at top, select a face, select Impression filter, select Hollywood 2 (non-Pro) effect...

Reset by clearing data...

Try this on unlocked and locked devices... PW
[Magisk] simplepinoi177:
Fascinating...the way @osm0sis and others have been going on about easily & directly changing the FIRST_API_LEVEL value, I would've thought there would be a disclaimer somewhere that this can "break the print's integrity" in some cases....

is that why some of the times I changed something or other on a fingerprint that was passing BASIC that all of a sudden it failed all 3? or is there some other way to see if a print's "integrity" is broken? Or is there some other reason in general (that it failed all 3)...?
[Magisk] Logix:
Hello all,

I got some reports of folks being less then nice...

Let's keep our discussions positive and on topic! 🌟

Respect each other, stay focused, and enjoy sharing knowledge.

Happy posting! 🚀
[Magisk] ArzZenic:
That's the part of the fun

View attachment 6045579

Even if this was the possible solution, just wait and try some customs. Nothing, except the guides, should be community effort sice 8hrs bans
[Magisk] Iridule:
I would be curious as to why some prints work when API is changed...I can't make sense of it. I don't know enough of how these things are seen by droid guard...but would love to learn if someone wants to throw some resources my way. I still also don't understand why some prints show no integrity yet you can change any value in the fingerprint string and it will pass basic... I was trying to see if I could get dev-keys or test-keys to work making the print more rare/unique and never got it to pass device but I can get almost every print to pass basic if it has no integrity. Not sure of the value of that but it's something...