yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
I was considering the fact that it already doesn't work for many with griffin (even passing D_I) but does once they change prints... If nothing changes with PI verdicts, isn't it reasonable that the apps are somehow seeing the print set data that's targeting only the one (DroidGuard) GMS process? 🤔 PW
[Magisk] HippoMan:
I agree that the Googlefrinchians are far from being "evil". On the other hand, I don't believe they have any intention to offer any further help to modders, either. We modders make up much less than one percent of Android users, and I don't believe that today's Googlefrinchian management gives any thoughts to us modders whatsoever, neither positive nor negative.

Our woes are just unintentional collateral damage that's associated with the implementation of their various corporate goals.

Yes, I'm sure that there are some individual Googlefrinchian employees who are aware of modders and who sympathize with us. But these individuals' personal views have no influence on official corporate decisions and policies.

So, basically, we're just some tiny, unnoticed insects under the trodding feet of today's Googlefrinchian management.
[Magisk] badabing2003:
My point being that if there is a cross check of what print DG sees and what print RCS sees , either done on the backend servers or through cross app communication, it will always trip no matter what print is used because currently we don't spoof for RCS.
[Magisk] makeyourself:
I have Device Integrity passing again using the extracted Xiaomi.eu print. Am I in the minority? Can't keep up with this thread so unsure!
[Magisk] pndwal:
That depends on whether cross-checks are actually done for RCS... I agreed it would be easy for Google to do so but was responding to another member who suggested that that might be occurring:

... But for whatever reason, they may in fact be relying only on one measurement, eg backend fingerprint (or whole print/prop/field set) that registration, Find my device, Backup facilities etc already see... They may simply be disqualifying certain devices like Moto Z which launched with A6.01, for some technical reason, no?

And there has to be a plausible explanation for RCS's ability to detect changes in print sets spoofed only to GMS DroidGuard. 🙃 PW
[Magisk] sawdoctor:
The xaiomi griffin fingerprint is still passing device integrity but for some reason it's failing RCS chats
[Magisk] aliantonio:
I'm having a hard time just receiving texts at this point. I turned off RCS and cleared storage and carrier services storage and some texts still do not come through. Testing with my wife. The weird thing is if I send a text to myself, then her texts magically come through. This is incredibly frustrating.
[Magisk] Vision:
Exactly this, for that i had wonder a long time ago, and i have write a similar before month, what happens if DroidGuard read the spoof FP and send to the other apps which read the original FP and after send again back to DG and this make intersects the 2 different FP and this make it fails?
[Magisk] pndwal:
FWIW, some have found that D_I comes back with griffin print simply by disabling DenyList, using Shamiko hiding and adding Google Play Services com.google.android.gms and com.google.android.gms.unstable processes in denylist...

Could those also who simply have RCS failing with that print set also test to see if the above fixes your issue? 👍 PW
[Magisk] makeyourself:
Thanks, so this Griffin print is the same one that's been in use by Xiaomi.eu for a while then? Yesterday I noticed I was failing Device Integrity. Now that I've updated all KSU modules and re-extracted the Xiaomi.eu print using PlayCurl I'm passing again. Wallet is working again, I don't use RCS.

However interestingly in the past couple of days Capital One UK credit card app has stopped working due to a so-called "security" mismatch. And it's still not working. Didn't even think they checked PI but seems a bit of a coincidence that this stopped working at the same time as RCS apparently did for others. Just thought it was worth mentioning.
[Magisk] shoey63:
So changing PIF print away from Griffin can result in DEVICE failing but RCS working again, is that the general consensus?

So maybe Google has different print bans for each?

Edit: I have custom/private prints on 2 devices which both pass DEVICE, and can RCS message between them without issue.
[Magisk] bombadier:
Device and basic integrity for me are passing which has been the case since I started using the griffin, wallet works, have tried adding messages and gms, gms.unstable to denylist (Shamiko hiding) RSC still isn't working,last time I know RCS was working was 1 March, status is connected but it doesn't work, is there data/cache I should wipe from something or is a reboot enough ?
[Magisk] deechte:
Google makes money on your data. So you're not hurting them by buying a second device and continuing using their services. Take your messaging to a different app, like Signal or WhatsApp or whatever. Save the planet from the resources for a second device.
[Magisk] ardiesel:
Is this latest update that broke RCS messaging again, is it a fixable problem or is this the end of it on rooted devices? I love my pixel 6 pro rooted but RCS in GMessages is a deal breaker for me
[Magisk] makeyourself:
Luckily I'm in a country where people don't use RCS much, or SMS these days. But if I were then the problem with that is persuading everyone else to do the same. I wish I could also persuade everyone here to switch from WhatsApp to a FOSS alternative too!

For those that RCS isn't working for, surely you can just uninstall or disable the Google messaging app and download a standard SMS app instead? I know it doesn't have the features of RCS, but at least you can still communicate with those using it!
[Magisk] flobo09:
You are misquoting me there.

I did not call the decision evil, i called the implementation evil.

I feel blocking Google Pay on rooted device is stupid as it's still more secure than a plastic payment card.

Still, it's done in a clear way. If they detect something they dont like, the app tells you you are not secure and unable to use the service.

With RCS in google messages, it detects it BUT gives no error and makes you believes you are still connected, and you don't receive messages sent to you by other people until you notice it by yourself.

This is malicious behavior and not remotely comparable to google pay where it is at least honest.
[Magisk] GeTex:
So at the moment, from what I have found that I could understand from some minimal testing that it seems Google uses your fingerprint as part of how to generate your end to end encryption key. When your print is banned while RCS connects it actually will most likely fail the conversation setup to provide you an end to end encrypted key. The connected state is simply just phone number verification because every conversation individually configures RCS. Messages provides little to no feedback of the setup process but I've noticed changing fingerprints between my working private sets immediately caused my RCS encryption key to change and actually caused the chats to "cycle" between SMS and then encrypted RCS again. I found this interesting, including the weird part of if I change to banned fingerprints on the fly, RCS seems to break after some token expires, not the exact second a banned print is used. Switching to a banned print can be anywhere from an hour to a day before RCS suddenly breaks without warning. Unfortunately I cannot prove this exactly yet but I think the fingerprints are individually banned by the actual RCS service in use. Making it totally different from the device integrity. It simply asks carrier services for the fingerprint itself is my guess?

Please prove me wrong, I like embarrassing myself on public forums

Edit: I have more info to share soon, I have a gross but probably good fix for those of you who can live with RCS, just without end to end encryption working. I think I found a way to force the device to enable RCS without encryption and it works with any banned fingerprints
[Magisk] GeTex:
Those who use Google messages can flip RCS off in the settings to accomplish this goal as well
[Magisk] sawdoctor:
No one knows yet as no one has managed to figure out/reverse engineer what Google are doing yet. There's plenty of talented Devs/modders working on it so patience is the only thing atm
[Magisk] s1dest3pnate:
How do we use our own custom print?
[Magisk] Vision:
Please read this excellent Guide by @osm0sis is explain everything about this

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] ashish1989:
Magisk with Zygisk enabled (and Enforce DenyList enabled if NOT also using Shamiko, for best results)

@osm0sis I am little confused, do we need to enable enforce denylist permanently or not. As it is not advised to not enable enforce denylist option if you have zygisk enabled.

Or does it mean if we are not using Shamiko we need to enable enforce denylist option
[Magisk] psone:
I have older rooted devices around, but need a bit more details/instructions on how to accomplish this. If anyone makes the guide a bit more noob friendly or makes a video how to, that would be much appreciated.
[Magisk] sawdoctor:
There's so few working prints left it really is a needle in a haystack. I've tested 100s with no joy.

If you have a pc then pixelflasher (will work with most phones) makes processing build props and checking fingerprints easier
[Magisk] osm0sis:
Can't really word that much more clearly... Your last sentence and mine basically match...
[Magisk] osm0sis:
All continues to be fine here, but of course I've been using my own print, and I guess we've all reached consensus that somehow RCS is checking the print and the XEU griffin one is banned there while generally still passing PI? Weird though, since the print is still only spoofed to .gms.unstable either way. 🤔

For reference, I use Shamiko, with "Enforce DenyList" disabled accordingly, then the GApps on my DenyList are as follows:

:/ # magisk --denylist ls
com.android.vending|com.android.vending
com.google.android.apps.messaging|com.google.android.apps.messaging
com.google.android.apps.messaging|com.google.android.apps.messaging:rcs
com.google.android.apps.privacy.wildlife|com.google.android.apps.privacy.wildlife
com.google.android.apps.privacy.wildlife|com.google.android.apps.privacy.wildlife:projection
com.google.android.apps.subscriptions.red|com.google.android.apps.subscriptions.red
com.google.android.apps.tachyon|com.google.android.apps.tachyon
com.google.android.apps.walletnfcrel|com.google.android.apps.walletnfcrel
com.google.android.dialer|com.google.android.dialer
com.google.android.gms|com.google.android.gms
com.google.android.gms|com.google.android.gms.persistent
com.google.android.gms|com.google.android.gms.unstable
com.google.android.gms|com.google.android.gms:snet
com.google.android.ims|com.google.android.ims

Those who've changed to a DEVICE verdict failing print and gotten RCS working with that, what is the Android version of the new print? My all-around working print is 8.1.0 where the griffin print is 6.0.1.
[Magisk] Vision:
This answer to your question
[Magisk] Vision:
Very interesting.

I think Google make experimental with something again.
[Magisk] CZ.Kostra:
This is perhaps why PIG did the mass ban and let Griffin live. This way he has many users "in one place" for his experiments.:unsure:
[Magisk] osm0sis:
It's just baffling that they would bother to maintain 2 separate ban lists, one in .ims/.messaging and one in .gms.unstable, especially when they both seem to operate based on info retrieved from .gms.unstable (otherwise changing print with a PIF module wouldn't have any effect). Though even that doesn't completely make sense because the verdict info itself is the only thing returned from DroidGuard and the print isn't part of that. 🤨
[Magisk] i5lee8bit:
Very interesting thought but unfortunately I can be the one to somewhat scratch that off the table. Both prints I used when testing RCS [edit: if you recall, successfully working RCS] on my 2 particular devices last night were using 6.0.1 prints...

Edit2: btw, the donor print device also happened to genuinely launch with 6.0.1. Is griffin actual launch version older?

Edit3: moto z was initial launch android 6.0.1 too
[Magisk] Vision:
Exactly, and many of us, we fell into the trap 🥸

Probably they have change something in the system how all this works
[Magisk] badabing2003:
Perhaps DG can be called with different arguments, and RCS is calling it with special argument that makes DG check perform different checks.

This gives Google ability to even test different combinations and perform A/B testing without actually hitting wallet, until they refine it further and perform one big blow.

Of course yet another speculation amongst the numerous others.
[Magisk] Vision:
Exactly, for something like this, i worried for long time ago.

If this checks is experimental phase and after permanently, this is not good for us.

We still don't have a solution for something like that.
[Magisk] RAZINARES:
RCS is working for me again after adding these apps to the denylist.

View attachment 6086021
[Magisk] osm0sis:
Awesome! Now figure out exactly which one(s) (and which processes) actually needed to be there. 🤘
[Magisk] Vision:
I think Google Play Protect Service, Google play Store can exclusive.

The same app messages with RCS, Google Connectivity Services look interested.

Maybe The messages in DenyList when add it with some of the other combination, not send back to DroidGuard the original spoof and still work, when the DG still read the spoof and they do not interact with each other
[Magisk] Link2811:
I tried that but it still not working for me.
[Magisk] osm0sis:
Don't guess. Let the guy test and find out. No need to be filling up the thread with vague supposition responses that don't actually help to test anything.
[Magisk] Ultimoose:
Negative here after adding these to deny, rebooting then reconnecting RCS. Threads still show E2E is not available to me.
[Magisk] bombadier:
Just tried adding the same as your list and rebooted, RCS still not working, is there any app data I should clear?
[Magisk] RAZINARES:
clear messages data. i have tried disabling enforce list and it didn't work. after enabling the denylist it's working for me again right now.. i am still trying to figure out which apps are responsible.

note: i am not using shamiko

Sent from Pixel 7a using ReLabs
[Magisk] Vision:
Yeah, sorry about that, my bad, users no need another guess and confused without proof
[Magisk] Dark_Eyes_:
SDK 23 here, RCS still working since this morning (+/- 5 hours). PI failing.
[Magisk] bombadier:
I do use Shamiko but after clearing message app data and setting up RCS it's still not letting me send any messages, tells me connected and is successfully setup but can only send as sms, not a big deal for me as can live with it turned off, wallet working is more important for me
[Magisk] kornball:
The Xiaomi print is no longer passing DEVICE for me. Must have happened within the last few hours since I still passed BASIC and DEVICE earlier today. If others have already mentioned, I apologize.

*edit* never mind based on @osm0sis 's message directly below mine. I am not using Shamiko and added gms to DenyList.
[Magisk] osm0sis:
If you aren't using Shamiko then your enabled Enforce DenyList with .gms on it would actually break the PIF module. 🫤
[Magisk] RAZINARES:
yeah, for some reason RCS is working without passing the integrity. I don't know why

Sent from Pixel 7a using ReLabs
[Magisk] zgfg:
Did you put these apps to DenyList
[Magisk] zgfg:
In PI API Checker, TB Checker or directly in Playstore/Settings/General/Developer options/Play Integrity - it doesn't matter, it's always the same PI API (gsm.unstable, DroidGuard)
[Magisk] m0han:
Device environment same as before. Still getting 'Strong Integrity' pass result with TB Checker app.

How to execute adb shell "logcat | grep 'SNFix'" ? Can this be done on the device? No access to PC.

I ran logcat -d -f /sdcard/logcat.txt on the device. Checked the logcat for SNFix and PlayIntegrityFix; found nothing.
[Magisk] psychoela:
Thanks..temporary solution for now i just copy services.sh from Universal Safety Net Fix v2.4.0-MOD 2.0.zip n into folder service.d then done

View attachment 5962225

Yes
[Magisk] pndwal:
I put workarounds + comments here:

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88795381

🤠 PW
[Magisk] chiteroman:
I think the best solution is one build with Magisk unmount for users who don't want Shamiko neither custom fonts. And another build with Shamiko support, so custom fonts can work.
[Magisk] pndwal:
Yup, but messy having parallel builds... Not so 'universal'...

But inbuilt fix emulating Shamiko's may be difficult I guess... PW
[Magisk] Captain_Throwback:
Just a quick update on my ZenFone 9 (the device with the weird font problem):

It turns out that eventually no matter which version I used, the lock screen and SystemUI were getting broken, so I ended up just doing a factory reset, which appears to have actually fixed the problem. I now have my custom fonts apk installed (not via a Magisk Module, btw, again, the UI for changing the fonts is built into my device's settings), and everything is working fine. Using the PlayIntegrityFix.zip from the OP and no issues, Strong Integrity passing.

What may have actually been the culprit (and I didn't realize this until I went through device setup again after my reset) is that ASUS offers some customized settings, which affect the lockscreen and SystemUI; I think that is what was getting broken. I chose the stock Android settings this time around and since everything is now fine, I'm thinking that could've been part of the problem. But I'm not presently willing to try the ASUS settings to test, after this past disaster, lol.

Thanks again to everyone for all of the help and input, but I think it all may have just been a device-specific problem after all.

I'll throw some screenshots down below for fun.
[Magisk] chiteroman:
RikkaW may have a solution:

GitHub - RikkaW/FontLoader

Contribute to RikkaW/FontLoader development by creating an account on GitHub.

github.com
[Magisk] WhoIsJohnGalt1979:
P7P A13 July stable Magisk Canary 26104

Play Integrity API checker shows 3 green check marks in both cases. Enforce deny list disabled. No google components in deny list. I deleted Play Store and Play services data in airplane mode before rebooting post flashing the PI and Shamiko magisk modules.

Found the files modified by magisk modules shows up after flashing AOSP mods. People who don't use it won't see it. I am not using HMA yet, just one step at a time.
[Magisk] WhoIsJohnGalt1979:
In AOSP mods there is a font subsection in the theming section. Up until now ai had it always enabled to load a Google Sans font, when I disable it, interesting change. No Zygisk detection. I don't have gms in deny list though.
[Magisk] AnyNameYouWish:
I already posted my problem in other threads, but maybe this one is more relevant.

(here and here, sorry for reposts but I'm really confused, as mentionned below)

I'm a bit lost with all recent updates and new modules.

I have a rooted Pixel 5 with official firmware and july update.

Wallet app worked perfectly fine until last week, but I tried and failed to pay today.

I don't pass any integrity anymore

What should I do in order to pass at least device and basic integrity?

I tried Displax's latest safetynet fix 2.4.0 MOD 2.0

play integrity fix from OP (v4.0 I think) and from this post (v3 by Displax)

Also safetynet fix test4 from this post

Each time I try a module, I clear data from Google play store, Google play service, Wallet and reboot.

These apps are also on my DenyList and DenyList is not enforced

I use Zygisk, shamiko 0.7.3

Latest Magisk canary 26104

I have the following modules :

AOSP mods full 2.9.0

Debloater terminal emulator 17.3.3

Magisk bootloop protector 1.5

Magisk Built-in busybox 1.0.6

mindetach 2.3

Shamiko 0.7.3

Youtube Revanced 18.23.35

Zygist LSPosed 1.8.5_mod (6821)

Any idea what could be the cause of failing integrity check?
[Magisk] WhoIsJohnGalt1979:
Please do not include play store or play services in deny list. Clear data from all three apps preferably with air plane mode on and reboot.
[Magisk] chiteroman:
- Remove all Google apps from deny list. (Don't need to enforce it).

- Remove any safetynet-fix or PlayIntegrityFix modules and reboot device.

- Test Play Integrity, you should faill all 3.

- Install Play Integrity Fix from OP and reboot.

- Should pass all 3.

You don't need to add any Google app to deny list. Also, if you want to clear Google attestation data you must remove GSF (not GMS) data. GSF -> Google Service Framework
[Magisk] WhoIsJohnGalt1979:
@chiteroman Could you kindly elaborate on GSF data and the attestation procedure. https://developer.android.com/training/safetynet/attestation
[Magisk] AnyNameYouWish:
Unfortunately it still doesn't work :(

I tried following exactly your steps + a second time with also clearing cache and data from play store, GMS and GSF and with airplane mode as suggested by @WhoIsJohnGalt1979 , but I'm still all red.

Is there a prompt command I could use in order to post a helpful log?
[Magisk] chiteroman:
Maybe some module are interfering into GMS process... I don't know.
[Magisk] ruthl3ss_:
Working perfectly on Redmi Note 8T on Evolution X ROM, thanks!
[Magisk] Displax:
Send yasnac result.
[Magisk] Hausemaster:
Galaxy Tab A7 with Magisk Alpha passes all three checks with this module!
[Magisk] V0latyle:
Failing here, Pixel 5 with @Displax mod 1.3
[Magisk] scottlam1:
As much as it sucks at least its not just me. My phone had a meltdown yesterday had to restore reroot repair and then setup my galaxy watch between yesterday and today then I verify integrity and it fails been trying to figure out where I went wrong then I came here to see it's not just me now just have to wait for a new fix
[Magisk] Xemi_KryTeT.pl:
Not working on Realme Gt Neo 2:

- stock rom rui 4.0 EX01

- rooted with magisk 26.4

- app is hidden

- denylist set as always

SafetyNet Pass

Play Integrity: only Basic Integrity (so nfc payments ded)
[Magisk] sawdoctor:
What effect is it likely to have? Google wallet and banking apps seem ok atm
[Magisk] Lord Sithek:
Seems like Google gifted us with universal Play Integrity unfix 😂
[Magisk] fajarmalik:
for me, the McDonalds App will failing to activate vouchers (also cant log in if you clear data the app)
[Magisk] ko_hi:
Just wait it'll stop working very soon;)
[Magisk] alfian89:
who knows what Google is doing and none of us can pass the integrity device 😂 .

But Google allows Magisk to be included in almost all banking apps.

The good news is, I didn't have to do anything to pass Magisk from being detected by banking apps and Ewallet.