yashsingh1/xdaforums huggingface dataset:
[Magisk] Yeedatoy:
Out of curiosity, when you remove the play protect app from a device entirely, the play store immediately still responds on its own and has controls and notifications for play protect independently. What is the actual point of the play protect app? I wish there was a solution possible that could somehow generate random strings in rotation. If Google is watching this thread, they've likely taken 500,000,000 snapshots of it already so removing anything is potentially useless. It may be necessary to make a more secure thread elsewhere for discussion more specific to details of the development, separate from general support
[Magisk] xSnowLeopardx:
Google search "Magisk" and the very first hit:

"Magisk is an app which helps users to root their phone"
[Magisk] pndwal:
I already explained to you in detail why we can't simply spoof devices that pass STRONG_INTEGRITY generally here:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89168792

and what made spoofing Pixel 2 different...

In a nutshell, most devices that pass STRONG_INTEGRITY but shouldn't have bad OEM low level Keymaster/chain-of-trust implementations which CANNOT be spoofed in other devices... The only exception we are aware of was Google's Pixel 2 where the pass was due to server end prop based overriding of measurements that should properly prevent a STRONG_INTEGRITY verdict, and those props could be spoofed for other devices... Google aren't likely to have overlooked similar wrongful cases of STRONG_INTEGRITY... PW
[Magisk] Yeedatoy:
Maybe it depends on the device, and I should have taken into consideration there are probably many other factors as well. For me, on a pixel 7, many times wallet would show zero issues but pay would immediately give me a message about device security.
[Magisk] Vision:
Yeah now understanding better. Thanks you, this tell me and the chiteroman here:View attachment 6034429
[Magisk] TraderJack:
Once more for the people in the cheap seats...

Wallet does NOT need to be on deny list.

Neither do any Google apps.
[Magisk] Yeedatoy:
I understand that, but for me it's made it work immediately after coming from a non working state
[Magisk] Yeedatoy:
Normally I never put anything on the deny list or even touch it
[Magisk] Yeedatoy:
My experience was this (referring to list last go around with Googles changes)

With nothing on the denylist and the older version of the module: wallet would give me a message about the state of my device security.

With wallet and pay on the denylist: it would allow me to insert info for a card, but after clicking enter I would get an error just saying something went wrong

With the new module and wallet and pay on the denylist: tap to pay works as well as adding additional cards and my pay balance to tap to pay
[Magisk] TheFreeman193:
It's almost certain that some data on the device's integrity state is stored in GMS, same as with the card information, so it would be persistent even with a complete wallet data wipe. The assumption behind that strategy is the ability to trigger some kind of re-check of the current PI verdicts. As of now I'm able to pay over NFC, and the security requirements show as met in settings:

View attachment 6034427

It seems like the security requirements failure isn't a permanent/fused state, at least on my device/OS, but what actually triggers the clearing of such a state, I have no idea. I simply settled on a technique after trying all manner of things in an effort to avoid having to wipe/re-add all of my wallet details. It's possible this happens automatically in some cases, based on users' reports of the wallet spontaneously working after a few days.

I'd be intrigued to know if you're able to restore wallet functionality or whether it happens on its own, as it might shed some light on why some users are struggling to clear the failing state. Without giving too much away to the G-shaped overlords, my current config is Magisk systemless root, Shamiko, v13 of this module, (no GApps/GMS in denylist) with loader unlocked.
[Magisk] xSnowLeopardx:
OT, but, I am curious why you have hidden that text above Turn on NFC, since I don't see any personal info or similar on mine.
[Magisk] Yeedatoy:
I use Delta, v13, the unmount list but not enforced, and bootloader spoofer but just currently testing with it. Checking off the wallet systemui plugin as well
[Magisk] Yeedatoy:
Mine
[Magisk] Yeedatoy:
Sorry about that.. accidental
[Magisk] Yeedatoy:
This last go around the device doesn't meet security requirements disappeared about 2 seconds after showing, I just kept wallet open and the message went away and everything began to work
[Magisk] Lovely_Ribbon:
I will report back in a few days. My current situation is just Magisk, this module v13, and the below denylist:

View attachment 6034444

Honestly, dealing with all this has really got me weighing the pros/cons of having a modded device in the first place. Unrelated, but for me the current list looks like this:

Pros:

-AdAway system-level adblock.

Cons:

-Can't use device as BYOD work device.

-Hours of my time (and literal money because of transit card BS) lost to make sure my phone is in good boy standing with Google.

Honestly, I'm not really seeing the point anymore when I can likely just have an adblock plugin in my browser. I pay for the apps I use anyway so I probably wouldn't even have to worry about the ads.

/rant
[Magisk] TheFreeman193:
It's just a quirk of that page - I scrolled down to show all the requirement statuses but the top part of the page above the Turn on NFC button is a fixed header causing the bottom half to scroll under it. The OP5 only has a 1080p display...

View attachment 6034445
[Magisk] TheFreeman193:
Interesting... It's almost as if some kind of internal schedule is refreshing its copy of the PI verdict. Did you simply open wallet after activating the module/restarting and see the message go away in real time?
[Magisk] TraderJack:
Likely coincidence
[Magisk] djtechno98:
Hi guys, just for info:

On the new HyperOS 1.0 23.11.8 by Xiaomi.eu, the v13 of the module works and wallet let you pay. You pass safetynet and integrity API.

Screenshot attached

Wallet and play services are hidden by shamiko and I clear cache and data for Wallet, Store and Services, flash v13 and reboot.

Regards.

View attachment 6034455View attachment 6034456View attachment 6034457
[Magisk] TheFreeman193:
I definitely relate to this. The big G is making it harder and harder to operate normally with custom software/firmware, and it rather feels like the motivation is not really security anymore.

It's particularly annoying because users with older devices that no longer receive OEM updates have no reasonable choice. We either leave ourselves vulnerable to a multitude of unpatched exploits with stock ROMs, or flash up-to-date firmware and have to constantly fight the GMS devs to be able to use our devices properly.

Infosec isn't my area of expertise but it seems odd to me - they're fine with highly vulnerable devices that have an android security patch 4 years out of date using wallet/financial apps, but are purposefully hindering anyone with secure, up-to-date, signed third-party ROMs from well-known sources. I can only assume they either want to sell newer devices by damaging the functionality of older ones, or they want to be the ultimate root of trust in the android universe despite well-established chains of trust back to root CAs.
[Magisk] Yeedatoy:
Yes, Its not the first time I've seen this happen either. Possibly around the 3rd or 4th. I'm testing different things on 5 different devices right now to try and figure out what effect each has on wallet/pay. 2 Pixels, one OnePlus, one Motorola and on LG
[Magisk] Yeedatoy:
I've also seen this happen before we had this module specifically, back when it was as simple as just adding to the deny list, or magisk hide and I've seen it happen using Safetynet fix when it would automatically add play services and gms to the deny list. Like I mentioned, I've been in several situations where I've had to get pay working while I was in a checkout line or literally at the self-checkout line with 10 people standing behind me waiting for me to finish. I flash devices so often that there are many times I forget that I don't have contactless pay setup. Sometimes I will flash my main device five times in a day, so I've probably been in a position to see this happen in real time more than the average person using their main device. Mostly out of choosing to ignore my own consciousness regarding what the sensible choice to make is
[Magisk] RakshitYadav:
Greeting Guys, just had this problem of Tap to Pay not working again. I am outside right now in a meeting and I am stuck with no way to pay. I can't go through the whole thread since I last had this problem 2 weeks ago and also posted about it in this thread. Can anyone just please tell and link the post in this thread that tells the fix.

My Device is Certified in the Play Store, My Module in Magisk is updated to v13, play store PI check says that my device meeting basic and device integrity. My device is OnePlus 7t, with PixelExperience ROM and rooted(obviously).

Huge thanks in advance to whoever pins me a message.
[Magisk] Yeedatoy:
Been here several times, almost being stranded. What other modules if any do have installed?
[Magisk] Yeedatoy:
Also, what version of Android? 13? Or is it the alpha or beta version of pixel experience 14?
[Magisk] Yeedatoy:
The quickest thing I can think of to try is remove your fingerprint or biometrics and see what happens with just a pin lock, especially if it's one of the test versions of pixel experience
[Magisk] Yeedatoy:
I don't know if that will force you to lose your card enrollment however. I know that would happen you removed a lock entirely but I'm not certain if just removing biometrics affects it. Let me try it now actually.

Edit. I just removed my face and fingerprint leaving just a pin and it didn't unenroll me
[Magisk] RakshitYadav:
it is android 13, and it is a stable version.
[Magisk] RakshitYadav:
did that, didn't do anything, wallet is still at 'doesn't meet security settings'
[Magisk] RakshitYadav:
Man, **** google really. like what problem do they have with us people using our phone like we want to
[Magisk] fbirraque:
The new Xiaomi EU Stable REBUILD without Play Integrity Fix already available for download.

It will be a wild ride for many users... Cheers,
[Magisk] chiteroman:
View attachment 6034484

👀👀👀👀👀👀
[Magisk] Vision:
This is with feature random fingerprint, if Google block one, a reboot and get another fingerprint, something like that or something better?
[Magisk] Lobod:
Also intrested what's new...

But I think random fingerprint will be a little overkill right now...
[Magisk] fbirraque:
Do you have ETA?

I would like to test it with the new Stable REBUILD from Xiaomi EU
[Magisk] Bec de Xorbin:
v13 works just fine.
[Magisk] wide_load:
I'm using v13 and google wallet unexpectedly stopped working this morning. The usual message about the device not meeting security requirements :(
[Magisk] TKruzze:
EXACTLY! The last 3 times we lost Device Integrity I simply waited overnight and things were fine the next day. A far better solution for me than the often painful side effects of wiping critical apps.
[Magisk] chiteroman:
In pif.prop file you can edit the device to spoof.
[Magisk] xantrk:
I realized when my wallet refused to let me pay, updated, and My wallet still says my phone doesn't meet security requirements in the relevant menu, but it still works after updating PIF to latest version.
[Magisk] fbirraque:
I would like to confirm that your Play Integrity v13 Module works flawlessly with new MIUI 14 Stable EU REBUILD - link

Thanks your work rocks!
[Magisk] mixfold3buyer:
I've been trying all day to fix Google pay. It passes 2 of the 3 integrity store is certified but Google pay still doesn't work. Ive hid magisk to make playstore certified and put Google pay/wallet on the deny list along with playstore. Hopefully there's a fix soon. Spent over 10 hrs today trying to fix it. My wife is very patient with me.
[Magisk] pndwal:
You don't need to hide anything manually incl. root from G Pay/Wallet... Don't put anything Google in denylist (other than G Pay/Wallet if you insist).

Either wait (can take several days) for cached verdicts to clear, or clear data from G Pay/Wallet (and possibly Google Play Services) and set up cards again... 😉 PW
[Magisk] pndwal:
Hoping to see ability to revert or alter/add any spoofed prop values for targeting GMS/Droidguard (especially ro.product.model, ro.build.fingerprint and first_api_level, but ability to add more would be excellent).

...This will allow users to test/use many working configurations (and break stuff 😆... Better add disclaimer about likelihood of thermonuclear war etc!)

Will look forward to seeing if your PIF.prop file works this way. 👍👏 PW
[Magisk] pndwal:
See post 2 above this... PW
[Magisk] halcy0n9001:
I think I've tried everything listed in this thread but still unable to use Google Wallet (was working previously on PIF 1.2 and USF before that.

Setup

Samsung Galaxy s21 Ultra (SM-G998B)

Android 13 (November 23 security patch)

Magisk 26.4

PIF 1.3

Shamiko

I get to the last step of adding the card and see the attached message.

Have cleared the cache/data of wallet, play store, services, rebooted before attempting to re-add am always stopped at the last step.

Any advice would be appreciated, thanks as always 🙏
[Magisk] Flr Power:
Sometimes, taking the time to read would save you much more time and give you in return the great success you deserve 🙏
[Magisk] pndwal:
Screenshot doesn't mean (necessarily) that you have a contactless setup issue... May be issue with card/bank as indicated...

Please click "Pay contactless setup" in Wallet and post screenshot... 👍 PW
[Magisk] HipKat:
Pixel 8 Pro Stock/'Rooted w/Nov 05 Security patch.

Oct Google Play System Update

SELinux - Enforcing

Magisk 26.4 Stable.

Mods: Systemless Hosts, Zygik - Lsposed, PIF v13.0

Deny List disabled.

YASNAC and Play Integrity Checker both time out - too many requests

What am I missing?
[Magisk] DougMG:
Nothing. Both of those apps use Googles free API and are limited to a specific number of checks per day and have apparently reached their limit for today.
[Magisk] Lex_Dysia:
Hi Folks,

FWIW, Google wallet stopped working for me about a week back. I was using Magisk Safetynet-fix module. I've now removed that and installed Play Integrity Fix and all is good again (wallet / gpay working).

Current setup:

Pixel 5, LineageOS 20 Rooted.

Google Play etc all up to date.

Magisk 26.4 Stable.

Play Integrity Fix V13.0 by Chiteroman

Zygisk enabled

Deny List active & includes Google Connectivity Services, Play Protect, Play Services & Wallet.

YASNAC is happy
[Magisk] pndwal:
In Play Store Settings, About, click Play Store version several times to enable Developer options... Find those in Settings, General and click Check Integrity there.... (No call quota daily limit applies to Google apps AFAIK) 👍

Nb. SafetyNet is deprecated, no longer used by current bank apps etc and backend support will be turned off at end of January 2025 (forcing stragglers to update their bank apps if they'd been avoiding it)...

🤠 PW
[Magisk] HipKat:
Good to know. I hadn’t heard that before
[Magisk] HipKat:
Good info about Safety Net.

Not following you on checking integrity in Dev Options, though
[Magisk] quasyl:
Installed the very last version of xiaomi.eu for Redwood. Everything is ok and now PIF13.0 works perfectly. Thank you very much for the enormous effort!
[Magisk] pndwal:
Did you read/follow instructions to enable/open the

Developer options in Play Store

?... NOT Developer options in device settings!... PW
[Magisk] DougMG:
If you activate developer options in the Play Stores settings menu and expand the top general section you will find an option to run an integrity check which if everything is working will say you pass basic and device integrity.
[Magisk] phone_etix:
Geez, I didn't step out the house for two days and missed everything. Got caught out at the shops just now, panicked but then checked magisk and was thanking @chiteroman profusely in my head, while I quickly updated the module in front of the cashier. Got Wallet working again (OP5, LOS 20). Dev saves the day, again!! Can't express how grateful I am for the quick work.

For real though is there any way to get notifications when the module's been updated, especially if it's going to be a potentially weekly thing...
[Magisk] quasyl:
@chiteroman I sent you a little donation

Codice transazione

4YN24888WN783141W

Thank you for what you are doing!
[Magisk] Bladius:
After updated Google Play Service to 23.30.12 hardware pass not work
[Magisk] zandatsu06:
View attachment 5964769

Yup, they patched it.
[Magisk] zgfg:
+1

We made too big a fuss and it didn't go under the radar
[Magisk] Displax:
This bug was discovered a ≈ month ago and was open source, so it was only a matter of time ;)

I just put it all together)
[Magisk] Bladius:
can this be fixed so it works again?
[Magisk] immortalwon:
Moral of the story - keep good things quiet. ;)
[Magisk] DougMG:
Only if another exploitable bug is found.
[Magisk] supermansaga:
Good days are short. I wonder if I could roll back the Google play services update
[Magisk] DanGLES3:
The exploit got patched serverside, downgrading wouldn't fix it
[Magisk] Hausemaster:
It was good while it lasted! Now it's time to keep using Bootloader Spoofer for local root of trust apps, and if any app needs strong integrity, well that'll be interesting...
[Magisk] Кirito.:
MOD TRANSLATION

"Just fixed it yesterday, but it didn't clear the google store data, so far it is not invalid, waiting to fix it again."

*****************************************

刚在昨天修复，但没有清除谷歌商店数据，目前它没有失效，坐等再次修复。

Kirito., Greetings, and welcome to XDA. As a friendly reminder, we ask all members to please post in English as stipulated by Forum Rule 4 (quoted below) -- that you just agreed to when you first registered your account. Please consider this when you are creating a post in the future. Feel free to include your original message under the English message if you wish. If you do not know English, I encourage you to use any of the resources in the quote below. Your post has been translated as a one-time courtesy.

Thank you for your cooperation, and have a good one!

simplepinoi177 FSM (Forum Specific Moderator)
[Magisk] chiteroman:
We've run out of free stuff guys, we've made too much noise and Google has been annoyed. Too bad but I highly doubt we will find another "exploit" like this one. At least this module will serve as an alternative to @Displax's safetynet-fix.
[Magisk] 에어 론 리:
Google force to close Android OS, making it similar to iOS.

Everyone see, that Google deny ROOT and making it ILLEGAL, while Android was build firstly open-source and freely to get superuser rights. But now, Google Play Services have MUCH MORE rights compared to device OWNER, and Google deny OWNER to have FULL ACCESS.

It's really weird situation, guys.

That's why we have to use Magisk with all these modules to use ROOT with banking apps etc, just to have more freedom on OWN device, while someone forbid us to do anything, hiding behind "security" reasons.

That's why I must say that you're not right, we've run out of free OS. Android is not free now.

And never will be again.
[Magisk] sawdoctor:
Google are doing nothing to stop you rooting, pixels are some of the easiest phones to root. App developers are putting more and more checks in thier apps for things like twrp, magisk and bootloader unlocked. It's not Google putting these checks in just app developers
[Magisk] Lughnasadh:
This.

Google even gives Pixel owners the tools and directions on how to unlock your bootloader. And if I remember correctly, TJW has even stated that Google is not against root, per se. They even let him continue developing Magisk (with a few adjustements, of course) after they hired him.

And just think of how many apps you can use with your bootloader unlocked and rooted, including almost all Google apps. They vastly outnumber the apps you can't use due to being bootloader unlocked and/or rooted. The "fault", if you want to call it that, really does fall on app developers in my opinion.
[Magisk] pndwal:
Not true;

Google have even sanctioned (approved) TJW Magisk project!...

They certainly oppose manipulating/spoofing (expected) security related signals ("subverting their security model") and are taking progressive measures to ensure strong (reliable) attestations to device (especially un-tampered code execution environment) state are available to counter such spoofing... And that's both unsurprising and actually beneficial to the modding community also in the long term...

However they don't lock down this mobile OS like iOS at all...In fact they provide explicitly for unlocking bootloader (while providing Android Verified Boot chain of trust for accurate attestation to B/L state... You can go from Green to Orange or Yellow states by official means unless OEMs themselves disallow it...

See this also:

https://xdaforums.com/t/module-mod-universal-safetynet-fix.4553699/post-88810503

👀 PW
[Magisk] 에어 론 리:
Okat what you'll say about Google making harder and harder SafetyNet check? Google certification for Google Pay (wallet) and Google Play Store's security warns you about many rooting apps as Potential unwanted app or even uninstall it without your permission? SElinux state selectors, LuckyPatcher etc?
[Magisk] westruk:
An example of apps using Strong verified Play Integrity. Can you check this out: https://play.google.com/store/apps/details?id=io.faceapp

on "impressions" tab
[Magisk] chiteroman:
WTF
[Magisk] 에어 론 리:
and after that ppl say that "Google do not stop you to root your device"...\

yeah... it's all app developers...

yeah...
[Magisk] ViduzZz:
Google pay stopped working for me today on MIUI 14 rebuild with v13 fix, failing all tests. Worked fine 2 days ago
[Magisk] voetbalremco:
There's a new rebuild you have to download
[Magisk] ViduzZz:
Ahh okay didn't know about that. Thank you
[Magisk] whewdroid:
Register on GitHub and activate the notifications. Once the Module gets updated you'll get an E-Mail notification
[Magisk] halcy0n9001:
Thanks for the reply, I get the same with other cards too.

Card details are accepted, then contacting bank, see the terms then after accepting I see the previously posted screen.

This card and others worked previously so 99% sure it's not card related.

Play Integrity check shows device_integrity and basic_integrity pass.

Any other suggestions?
[Magisk] Vision:
Useful feature, that is needed
[Magisk] jurluk:
I see everyone is saying that their devices are passing PI check and Wallet and other apps requiring PI are working, but can you actually pay something with Wallet? Because I can't. I can explain it detailed if needed

edit:

I see now that I have installed fix using Play_Integrity_Fix-v13.0(130).zip (size 90 KB, 24DD850890A011E62EF295D968D83D731E3C796CDFCF3AB1285380BBC2620E61 SHA-256), but current v13 on GitHub is PlayIntegrityFix_v13.zip (size 88 KB, 698A0A8BBD46C3886F72742E3B9299AC8CFF5E1BA085F6E94A847AA3B05A9F61).

Could that be the reason? Why are there two v13 versions? I'm sure I've downloaded the first one also from GitHub (or from this thread).
[Magisk] croleg:
Ho
[Magisk] niko26:
Using Pixel 7 Pro - 12.3 stopped working. 13.0 works again :)

@chiteroman I didn't quite get what the change between 12.3 and 13.0 was. I've read that you have change a fingerprint. Does this mean that his is a static fingerprint for all installations and that Google has blocked the specific fingerprint in 12.3 meaning that it can also (soon?) block 13.0's fingerprint?
[Magisk] croleg:
Ecxuse me, I am new in all of this. How to download from that file?
[Magisk] iruiz2:
It's not ready yet. wait and see...
[Magisk] HipKat:
How the heck have I never known about this?

That worked!

But Wallet still shows my device is rooted.
[Magisk] Lovely_Ribbon:
Reporting back. I checked this morning and I was all checks on wallet. Phone meets security requirements. I tried it at the store to make sure and I was able to tap to pay with the phone.
[Magisk] croleg:
Thank you!