yashsingh1/xdaforums huggingface dataset:
[Magisk] HippoMan:
Forgive me if I overlooked the answers to the following questions:

(1) When using v14.1, will it still be possible for us to supply our own pif.json files if we want, or will it always somehow use the one(s) that get downloaded via curl?

(2) If we can indeed use our own pif.json files with v14.1, is there a way to optionally tell v14.1 not to download any pif.json files from the central repo?

(3) And finally, I assume that the pif.json download would only occur during the v14.1 installation, and not in real time over and over again whenever the Googlefrinchian integrity checking procedure requests the fingerprint. Is that correct?

Thank you very for any clarification.
[Magisk] arda99:
Per the source code, the config file is still at /data/adb/pif.json, and PIF re-download it when the file is missing.

So when PI fails user needs to delete this file(and maybe killall unstable or reboot) to trigger the refresh.
[Magisk] Nodens:
Yes this was actually a bad move. It will just exhaust the pool very fast.

Also what needs to be studied is the banning mechanism. That's the part that needs to be solved.
[Magisk] Compass Linux:
According to the 14.1 release notes, we can still use a custom /data/adb/pif.json. If we want to use curl's, delete the file;

I've removed through Android Settings all access to the internet for the Magisk app (Magisk can't display the latest version of the app anymore). I'm not sure if this will also block the modules internet access, but in my opinion it should;

No idea about this one. Would have to check the source code. Maybe tomorrow as always.

I've updated to 14.1 with a custom /data/adb/pif.json and so far everything is working.

Compass.
[Magisk] zgfg:
I wanted to test myself but I see this evening the apps to test PI are throttled again, people are busy mining

Glück auf
[Magisk] rseiler:
Before installing 14.1, I deleted that file. Now that I have 14.1, it's still deleted, so it must put it somewhere else if it's actually putting it anywhere.
[Magisk] arda99:
you're right, it's in '/data/adb/modules/playintegrityfix/temp', I thought it would be moved to pif.json after DL but not...

so.

1. pif.json present: use it

2. pif.json missing: dl online and save to '/data/adb/modules/playintegrityfix/temp', and keep redownloading it everytime. In this way user keep up with the 'newest' fp.
[Magisk] Compass Linux:
@chiteroman, is it possible in the next version to add an option to disable the auto-download feature?

HippoMan's #3 comment is relevant.

Compass.
[Magisk] zgfg:
If updating to v14.1, then simply read the Changelog (screenshot)

So, if you delete /data/adb/pif.json

Module will use it's own built-in, hence you don't need mining yourself with v14 1
[Magisk] rseiler:
What's mind-boggling about it though is that it's the very same one that someone posted briefly here (I think it was, though maybe it was somewhere else) like 2 or 3 days ago. And it quickly stopped working. How on earth can it be working now?
[Magisk] notheowner:
Don't mean to sound rude, very curious.

How did this go from:

"Everyone needs to find their own prints otherwise they will be banned fast"

to

"Here is a fully automated public pif updater so we can speedrun fingerprint bans"
[Magisk] zgfg:
What do you mean by auto-update?

Magisk will update the module only if you press Update/Install - never automatically

If you don't want to see that Update button as active, open:

/data/adb/modules/playintegrityfix/module.prop

and change:

versionCode=14000

to eg:

versionCode=99999

it will be higher of all the module's versionCode numbers, hence Magisk app will always think that you have the latest possible version and will never bother you to update
[Magisk] arda99:
tbh, developer and (power) users have different interests.

developer wants more popularity for his work, and maybe test out new things.

users with usable custom FP want a stable solution and 'if it ain't broke, don't fix it'.
[Magisk] zgfg:
Read the post #4879 on the prev page (if you didn't read the Changelog😁)
[Magisk] Compass Linux:
View attachment 6039985

I understand that the fingerprint will be automatically updated somehow. If it is, an option to disable it would be nice (besides having a current /data/adb/pif.json). I could be wrong.

Compass.
[Magisk] rseiler:
Not following you. I wrote that post. Also, I did read the changelog. It didn't mention anything about where the download lands or what it's called (a later post revealed temp).
[Magisk] dosbuddy:
I strongly recommend not to install PIF v14.1. Sorry @chiteroman.

This version uses currently the same pif.json as was published in the telegram group.

And this was taken from PIF v14.0-beta.

So it is a question of a short time how fast working fingerprints will get blocked (banana-ed).

Please only install this version if you are really desperate after more than 20 hours of unsuccessfully mining for a working fingerprint.
[Magisk] Fishawy:
Or install it - even after you found your own fingerprint - without deleting it, as it has an option to use yours.
[Magisk] zgfg:
Didn't you ask:

Before installing 14.1, I deleted that file. Now that I have 14.1, it's still deleted, so it must put it somewhere else if it's actually putting

So the answer is simple, if you deleted that custom JSON, module will use it's built-in prints, just like v13.x and earlier versions did

If you want to find out which built-in prints it uses (when you remove custom JSON), grep PIF from logcat
[Magisk] V0latyle:
Just my 20 cents

I think that any solution that results in a lot of users using the same print will just result in Google banning that mismatched print faster. That's why I have been encouraging everyone to find their own. Until we have something that can truly randomize which print it's spoofing, to avoid too many users using the same ones, it's best that we all choose our own.
[Magisk] i5lee8bit:
How long y'all think before Google writes their own counter-script/bot to scrape and insta-ban every new public print? (I'd wager they already have...)

Imo, this new strategy should be AT BEST / MOST, something like: new config will be provided only once a week. Otherwise, go find your own. Even then, I don't see it being good for the collective in the long run.

Call me an a-hole, but this new strategy seems like a good way to take down the whole ship...
[Magisk] dosbuddy:
zgfg wrote:

> If you want to find out which built-in prints it uses (when you remove custom JSON), grep PIF from logcat

or look into

/data/adb/modules/playintegrityfix/temp
[Magisk] arda99:
We don't know how google find and ban certain fingerprints, but definitely not "mismatching" as it makes no sense. Either they're aware of the PIF project and checking the source, or by unusual large volume of certain FPs.

And no, I also don't think they would dig this 200+ pages thread to ban posted FPs here.
[Magisk] chiteroman:
The good thing about this version is that I can update the fingerprint in real time...
[Magisk] rseiler:
And it stopped working back then, which begs the question of whether an "unban" is possible, since otherwise I can't explain this.
[Magisk] zgfg:
His module never automatically updated the prints (by downloading them from somewhere or so)

Instead, when G banned previously built-in prints, he pushed new version of the module and it was up to users to update the module or not

That was all the time up to v14.0. Only v14.0 did not have the built-in prints and we had to put our custom JSON

With v14.1 we seem to be again to the old model - he will care to update the module when the previous would no more work (its prints would be banned by G)

However, you have the additional option to use your custom JSON if you want to use your prints instead of the built-in
[Magisk] HippoMan:
I see. Thank you.

So, this suggests a feature request for an upcoming version (to @chiteroman) ...

In this proposed new version, could we optionally point the PIF module to a directory on our device which contains our own pif.json files that we will have found? And then if there's a missing /data/adb/pif.json file when one is requested, the PIF module could select one of them from this directory?
[Magisk] casouzaj:
I think the new strategy is genius! If one wants to keep his/her custom pif.json, just keep it there. For those who couldn't find a custom FP which works, or simply doesn't wish to fetch for one, then delete that file.
[Magisk] Homeboy76:
Yahoo!

I'm 20¢ richer, thanks. :ROFLMAO:

Not laughing at the content, just the 20¢.

You made my day. Humor is th best medicine.
[Magisk] Compass Linux:
I'm using the pinned pif.json from Telegram and it's still working. 🤞

I've disabled Magisk's internet access so v14.1 won't auto-update the fingerprint (eg. if I delete /data/adb/pif.json by accident). I'd rather test/use the other two fingerprints I've generated first.

Compass.
[Magisk] i5lee8bit:
You could also just modify the update.json

Edit: I meant updateJson in module.prop
[Magisk] prot-:
use 14.0 for that functionality then
[Magisk] AK2H:
@chiteroman I gathered 15 working fingerprints and would like to donate them, send me a DM.
[Magisk] straightcore:
😂 So they are already doomed to be blocked.

As if you'd willingly hand them over to G-*** (y) God Job
[Magisk] Compass Linux:
Content of https://raw.githubusercontent.com/chiteroman/PlayIntegrityFix/main/update.json:

It's not related to the fingerprint as I understand it.

Compass.
[Magisk] arda99:
No need to overthink and dramatize.
[Magisk] User_15357:
XiaomiEu use a similar approach in their updated firmware - if the fingerprint stops working, you have to reinstall the apk that contains the new fingerprint. And they probably have even more users....
[Magisk] makeyourself:
There are plenty of devices still around that shipped with Android 8-12 but have broken TEE implementations right? Including some quite recent devices apparently. So if Google banned any of these devices' fingerprints by enforcing hardware-backed attestation then that would mean they wouldn't work for users with genuine devices on locked bootloaders. I'm not sure if @chiteroman has tried using such a device's fingerprint in PIF. But it would be interesting to know the result of such a test.
[Magisk] arda99:
By broken I believe these devices will report wrong (always locked) status and still pass hardware attestation, as seen in ROG3....so it wouldn't fail hardware-backed test just wrongly reported and always pass, or it's broken in certain implementation not affecting PI...

FWIW, usually ARM trustzone is used for TEE, this has been in ARM processors for at least 10 years, so you really shouldn't expect a completely non-working TEE especially in recent models.

Would change my mind if there is some untainted new phones pass only first 2.
[Magisk] jabennett:
And impatient, lazy, or simply less-sophisticated users (those capable enough to root their phones and install this module, but unwilling or unable to find their own custom fingerprint) want convenience and simplicity at the potential cost of ruining things for all of us. 😑
[Magisk] neelchauhan:
We're kinda going back to the custom ROM community of 2009: an expert solution for your phone.

I remember when CyanogenMod was so big in 2014 they had an installer for popular phones, including my then-daily driver, a Sprint Galaxy S3. I literally had no clue what an Android recovery or bootloader was then and yet I used CM.

And now to run a custom ROM you need to find your own fingerprint from the internet, or lose access to certain apps :confused:.
[Magisk] jabennett:
And until or unless you or someone else figures out exactly what is causing each new fingerprint to be rendered invalid, you've simply accelerated exhaustion of a finite resource.

"Tragedy of the commons:" The easier you make it for more people to automatically use the same fingerprint, the more volume it generates and the more attention it attracts (either from a determined human or simply an algorithm at Google), and the faster we all burn through whatever valid fingerprints are left.
[Magisk] dcarvil:
Please explain how that is not simply burning through the finite pool of working fingerprints more quickly.
[Magisk] BROKEN1981:
They probably think you are a spy. Everyone is running around with a tin foil hat now
[Magisk] xantrk:
Honestly we should use Play Integrity API to our advantage, nobody should see the fingerprint unless they fail integrity :)
[Magisk] V0latyle:
Yeah I still think it's not a good idea for everyone using the module to be using the same print. Especially since we'll all be checking PI responses en masse...
[Magisk] fbirraque:
Already.. DM
[Magisk] BROKEN1981:
Mine is still working and I never used a 3rd party checker. Only checked once this time from Play Store. The TG version got blacklisted on me very quick.
[Magisk] V0latyle:
He's Canadian but he's no goose

The only animal in the animal kingdom that wants anything to do with Canada gooses

Is Canada mooses
[Magisk] HippoMan:
For anyone who has already downloaded a group of custom pif.json files, I've written a script which allows you to randomly select one of them and install it as /data/adb/pif.json for use with PIF v14.0.

Alternatively, the script could be rewritten to remove the selected json file once it's been selected and installed, so as to not re-use it. I'll leave that rewrite as an exercise for the reader.

I call the script install-random-pif.sh. It requires the existence of a local repo directory called /sdcard/pif-repo which contains a group of uniquely named *.json files, each of which is of the valid pif.json format.

Of course, I would only install json files into that local repo that have been demonstrated to yield BASIC and DEVICE integrity on my device.

Assuming that this script is installed in the /sdcard directory, it simply needs to be run as follows:

/system/bin/sh /sdcard/install-random-pif.sh (from the device iteself)

or

adb shell /system/bin/sh /sdcard/install-random-pif.sh (from the desktop computer)

As you can see, it randomly selects one of the json files, copies it to /data/adb/pif.json, and then does a killall com.google.android.gms.unstable .

I plan to use this script on my device within a Tasker task, but of course, it can also be utilized in other ways.

Feel free to use this script as desired and to modify it however you see fit.

#!/system/bin/sh
# -*- sh -*-

ls=/system/bin/ls
su=/system/bin/su
cp=/system/bin/cp
true=/system/bin/true
killall=/system/bin/killall
pif_dest=/data/adb/pif.json
repo_dir=/sdcard/pif-repo
gsf_prog=com.google.android.gms.unstable

pifs=( $( ${ls} -1 ${repo_dir}/*.json 2>/dev/null ) )
n_pifs="${#pifs[@]}"

[[ ${n_pifs} -lt 1 ]] && {
exit 0
}

pif_idx_to_use=$(( ${RANDOM} % ${n_pifs} ))
pif_to_use=${pifs[${pif_idx_to_use}]}

[[ -z "${pif_to_use}" ]] && {
exit 0
}

${su} -c ${cp} ${pif_to_use} ${pif_dest} || ${true}

${su} -c ${killall} ${gsf_prog} 2>/dev/null || ${true}

echo "### ${pif_to_use} installed."

exit 0
[Magisk] BROKEN1981:
No it not. My mother loves Ad Away. Only reason she is rooted. V13.3 works for her. No one here can run v13.3. something else is going on. Maybe it's the constant checking? I just checked her phone tonight. Still good.
[Magisk] dcarvil:
Exactly. If we all use the same fingerprint, it will be blocked within a matter of days. We should all find our own prints. If @chiteroman feels he must provide one, it should come from a rotating large pool of prints so the next person pulling from the pool receives a different print.
[Magisk] BROKEN1981:
You could actually show them. They will not get blacklisted. It's something else. It's so obvious. Even a noob knows that.
[Magisk] Fishawy:
Agreed, one-click-ban-all is truly bad, but this can be used as a fallback/backup option.

You're on v14 and you've got your private print already. Updating to v14.1 without deleting your previously-obtained print will still use yours primarily, with having the print included in v14.1 as a potential backup (in case your private one gets banned, which has lesser chances).

To be honest, the whole thing is bananas, and having as many options as possible can help a bit amidst all this chaos.
[Magisk] BROKEN1981:
Yeah, I was at the Mobil station and Discover wasn't working. Card is good but they always seem to have an issue. So I used my phone to pay with Bank of America. I never carry that card.
[Magisk] BROKEN1981:
Delete data from Play Store
[Magisk] rodken:
Discover's fraud prevention system is a WIP.
[Magisk] D€INOS:
"It's so obvious", yeah right. If it's that OBVIOUS, then please put fourth why that is.

So no I won't show them , they are probably all in the Chiteroman pool anyway.

I hope 14.1 is made so every dl print is assigned randomly from the pool, that way there won't be as much load on each print.

In other words, instead of sequencial going down the print stack. 3000+ users doing that oppose to 3000+/300 print= 10 users per print on average
[Magisk] BROKEN1981:
I don't think that's what it is. Many times after that I went grocery shopping and used it. Worked just fine. I always use my Discover card because of the cash back and I pay it all off so I don't get any interest and that's free cash.
[Magisk] BROKEN1981:
Again, some people are able to use fingerprints that others can't. The TG version stopped working after a few hours for me while it wasn't for other people. My mother is still on v13.3.

Take off the tin foil hat man
[Magisk] D€INOS:
I don't believe someone that have someone, their mom..., that 13.3 works on. Sounds more like you got something wrong.
[Magisk] wfred:
13.3 using my own pif.prop values is working fine for me

Is there any real reason to switch over to a newer version using json?
[Magisk] blu.italia:
Your mom can use a private dns server to block ads that doesn't need root 😉
[Magisk] HippoMan:
But why should she bother, given that 13.3 seems to work for her?
[Magisk] fillwithjoy1:
T

The wright brothers...
[Magisk] fillwithjoy1:
Tell me you can explain what a private dns server does to your mum....
[Magisk] osm0sis:
A stable solution and 'if it ain't broke, don't fix it'. 😉
[Magisk] fillwithjoy1:
Hey everyone,

Currently it seems both play integrity api apps are being throttled due to us trying to find another fingerprint to live on

So it seems like there is a new app on the store that does play integrity and I can confirm that this one is currently working

TB Checker - Play Integrity - Apps on Google Play

All in one tools check android devices

play.google.com

P.S. I am NOT the developer of this app, just wanting to help everyone :)
[Magisk] fillwithjoy1:
NO WAY, HE IS BACK
[Magisk] ApeironTsuka:
Does anyone know what, exactly, all of the data sent to Google's servers is during a Play Integrity check? I'm wondering if every device has a GUID that's being sent as part of the request, and simply the act of checking with the popular PI checking apps flags you as a potential spoof in whatever system they've set up.
[Magisk] osm0sis:
Y'all know he's just keeping the pif.json in the root of his git repo now right? He just curls it from there: https://github.com/chiteroman/PlayIntegrityFix/blob/main/pif.json

There is nothing clever done to conceal anything.

This will be banned Monday morning when Mr. Play Integrity walks into Google's offices and sits down at his desk. Just like all the other ones.

Find your own prints. Feel free to join me on my fork where I don't plan on updating things unless they break. This mod seems hell bent on decreasing the pool of viable prints.
[Magisk] cmstlist:
To be clear I wasn't banned from the Play Integrity Telegram group, my GV numbers got instantly banned from Telegram itself. Still unable to get in with my normal cell numbers. But I did find me a fingerprint, it works, tap works. Will revisit the thread when it fails again 😅
[Magisk] TKruzze:
To mourn with the rest of us... :mad:
[Magisk] BROKEN1981:
You sound vaxxed. Go take that next booster and take off the tin foil hat.

V13.3 works for her. I'm using a print that someone said is blacklisted about 1000000 pages back.
[Magisk] BROKEN1981:
I installed Ad Away from GitHub on it.
[Magisk] dcarvil:
Damn, I'll have to remove that one from my small pool of working prints.
[Magisk] acwcanada:
My family have 4 phones. I myself using a Pixel 6P and a 7P, my wife has Pixel 7 and I got my son a 8P, all 4 them are either on A14 stable or A14 QPR beta, I rooted them all and we all using almost identical apps and settings. I obtained a private print for my 7P and the other three phones are using the json from the TG group. As of the present moment, one of them my son's 8P is "banned" but my 6P and my wife's 7 are still running strong, we both using GP/Wallet heavily today for holiday gifts shopping (must be over 20 transactions just today).

So, just my 2 cents (I don't have 20 cents to give, my money are gone with today's shopping!):

What I am trying to say is that it seems it is not working in a way as we are thinking, because it couldn't explain how/why the TG json is working in two of my phones and banned in the other. Perhaps @chiteroman now knows more thus give him the reason to issue 14.1, otherwise it doesn't make sense that he wouldn't see that going back to the old pattern is not a smart move.
[Magisk] niko26:
In short - does your solution work? Does it work without having to go through the cat+mouse game? If so.. how do you achieve this?
[Magisk] BROKEN1981:
{Mod edit: Quoted post has been deleted. Oswald Boelcke, Senior Moderator}

That's funny considering she paid me 10k to fix it up. Maybe I should move in.
[Magisk] GiraffeCubed:
I was with you, if it works it works. Bit of a weird twist bringing up vaccines, though.

I would prepare, though, for when 13.3 stops working for her, it sounds like it's inevitable. If you have the time I'd gather up some working prints for the seeming inevitability that her 13.3 one gets banned. 14.1 might be a better alternative if you want an easy route but it's looking like it might be less reliable if the Goog continues on this spree.
[Magisk] BROKEN1981:
This is what I have been saying. Something else is going on. Hopefully someone figures it out. I doubt it though because people are wearing tin foil hats and acting super paranoid.
[Magisk] BROKEN1981:
I have 5 spare prints. I didn't go nuts like others have with 20+ 😂😂. I had to get them because she would be super PO'd if Gpay stopped working. Again though, I expect it to keep working. She's not checking status. I think it's 3rd party apps killing it. I have been fine. I'm using a blacklisted print and only checked once via Play Store.
[Magisk] asisandroid:
Hey people reading. I have a question. What's the plan when all fingerprints are banned which work? (asking because people are super paranoid about working fingerprints) Is there any insight on how they are banned? It's for device integrity right?
[Magisk] Nergal di Cuthah:
We know little of what google is doing, only that they were able to squash users within days/hours of a working version.
[Magisk] osm0sis:
Sorry, but you must not have been following this thread for very long. He goes back and forth on everything, repeatedly, ad nauseam. There is no method to it, and was generally introducing more regressions than it fixed, which is why I forked.

The solution is we all use our own found custom prints so we don't generate any statistical data for Google to ban them by.

I think it's pretty straightforward actually.

Google either a) literally just watches his repo and bans whatever's in his repo or his release zips, or b) sees the spike in their statistics. Same difference.

He needs to stop feeding them prints to ban.
[Magisk] Umgak:
Most likely: chiteroman uploads print, users all download, everyone spams integrity checker, Google sees a spike of thousands of API calls on an ancient device with (normally) very low usage and bans it. That's why spreading the userbase over many private prints would (again, most likely) slow down the rate of bans.