yashsingh1/xdaforums huggingface dataset:
[Magisk] osm0sis:
Ah, sorry, got lost in the WOT. 😆

I see you just wanted it slightly more specific with what the Zygisk side was doing, where I was comfortable lumping that all in with "device spoofing".

So yeah, I'll consider between

"! Installing global scripts only for Android < 8.0; Zygisk attestation fallback and device spoofing disabled"

And

"! Installing global scripts only for Android < 8.0; Zygisk device spoofing disabled"

Because, honestly, I'm pretty sure even in the default/normal mode, without a json the attestation fallback is automatically not still happening anyway. The whole Zygisk part of the module bails.

Edit: Yep! https://github.com/osm0sis/PlayIntegrityFork/blob/main/app/src/main/cpp/main.cpp#L164
[Magisk] pndwal:
But both fallback trigger (fake keystore) and device spoofing (props/fields) are disabled/unnecessary!.. You mention the secondary function, I just added the key one not needed for old devices... PW
[Magisk] pndwal:
Yeah, (we've been there before)... The key function needed is the fallback, needed from the time Google began opportunistic use of hardware attestation... The fallback blocked the opportunity to use HKA and no prop/field based spoofs were needed for another 9 months!... That only came for certain late devices when Google simply blocked the alternative (basic attestation) by enforcing hardware evaluationType serverside for some devices as they tested for compatibility... Device like my Xiaomi RN8T continued to need no device ID spoofs/mismatches (which began with model props/fields, then fingerprint) for as long as I remember...

The need for 'device spoofing' has certainly become more universal (especially with banning prints for spoofing purposes), but I think that for proper understanding we recognise that the fallback trigger is the primary Zygisk function (it always was, and device spoofing to allow G servers to recognise basic-only attestations simply couldn't work if device has working hardware keystore based attestation anyway) and don't conflate it with device spoofing. @kdrag0n differentiated these functions from each other, and it's important for users to understand the basics too... Sorry for another WAT, but I feel it's important (as you can tell). 😬 PW
[Magisk] pndwal:
Sorry... Installation message then... 🤷 PW
[Magisk] osm0sis:
Pleasure doing business with you sir

Fix mistakenly forced scripts-only mode on clean installs · osm0sis/PlayIntegrityFork@75cf629

- use manual opt-in trigger of a scripts-only-mode file existing in the PIF module subdirectory - clarify installer message since Magisk Zygisk actually functions on Android < 8 now, but the Zy...

github.com

😛
[Magisk] GabbyWC:
I thought those developers archived their GitHub repositories. Is Shamiko development still active?
[Magisk] osm0sis:
Easy enough!

Went with:

sh migrate.sh [-f] [-a] [in-file] [out-file]

migrate.sh: allow specifying an output file · osm0sis/PlayIntegrityFork@8414785

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - migrate.sh: allow specifying an output file · osm0sis/PlayIntegrityFork@8414785

github.com

(-i is already in use as the undocumented switch for the more brief -i|--install|install mode script output: https://github.com/osm0sis/PlayIntegrityFork/blob/main/module/migrate.sh#L11)

CI #204 Build (GitHub login required): https://github.com/osm0sis/PlayIntegrityFork/actions/runs/8447108380
[Magisk] pndwal:
Beautiful!... Thanks for listening...

FWIW, re. "clarify installer message since Magisk Zygisk actually functions on Android < 8

now

"... Zygisk has always actually worked with pre-A8 Android installations with the exception of a few Sammy devices as detailed below.

Spoiler content hidden.

With Sammy's limitations overcome, seems all Magisk users can have Zygisk.

👀 PW
[Magisk] pndwal:
Yeah... Hope LSPosed, Shamiko, HMA Devs will be back from sabbatical soon... 🥹 PW
[Magisk] sawdoctor:
I know you frequent some of their telegram groups and are normally up to date with things. Is there any sign of them releasing new updates? Shame it's come to this, we all suffer because of one or two idiots causing trouble
[Magisk] osm0sis:
They're all back contributing to various projects, and all except the main LSPosed repo are unarchived again. Whether Shamiko and LSPosed remain in development is yet to be seen however.
[Magisk] pndwal:
Yeah, I skim-only several group threads and check what files are linked (there can be hundreds of posts a day at times, mostly gibberish to me) hopefully... No signs I've seen yet, but have a feeling they'll get back to it at some agreed time...

But then, what do I know?

[On GitHub, LSPosed still archived, HMA only one recent commit from dev unknown to me (last release from July, but her ZygiskNext is active) and Shamiko isn't public except a download/release page (last from January)...] 😅 PW

Feelings

Nothing more than feelings...
[Magisk] pndwal:
Interesting... Does that simply turn off all Zygisk parts if JSON is empty?... Same if JSON is absent? 🤔 PW
[Magisk] osm0sis:
Yep. That's catching the data read that's empty, so either of those cases would result in a bail.
[Magisk] pndwal:
So doesn't that mean we don't really need a separate way to toggle script-only mode?...

Can Usage notes to this effect:

Script-only mode

In case of devices launched with Android < 8.0 or some with broken OEM keymaster implementations where the Zygisk based PIF spoofs (ie. broken/fake keystore for fallback to BASIC-only attestation and targeted changes to device identifiers for HARDWARE enforcement bypassing) are not needed at all, users can simply not add (or remove) JSON file and scripts-only mode will be triggered. Only the needed global spoofs for 'sensitive' props etc. and root hiding for DreodGuard/GMS will then be applied.

simply be included as users should be removing JSON for these scenarios anyway?

(The above assumes module still does the root hiding which may also need to be re-triggered since Zygisk parts are disabled, I'm not sure... This would be a more intuitive solution than telling users to add GMS processes in denylist however.)

🙃 PW
[Magisk] osm0sis:
Lots is happening outside of that from the common_setup.sh being run and other things which need to behave differently at boot-time. Check the script function changes in the original script-only mode commit. That's why I decided to make it a separate option in the first place.
[Magisk] pndwal:
Ok, so I see

# Add Play Services DroidGuard process to Magisk DenyList for better results in scripts-only mode
magisk --denylist add com.google.android.gms com.google.android.gms.unstable

in module/post-fs-data.sh, so see at least hiding will be done with DenyList (which should be ok since no DroidGuard/GMS injection or spoofing is being done) or Shamiko... So that'll happen also with "manual opt-in trigger of a scripts-only-mode file existing in the PIF module subdirectory" now too...

So probably the way you have it is best... Use my usage description when you push as release build if you want...

Revised version FWIW:

Script-only-mode

For devices launched with Android < 8.0, PIF Fork will install in scripts-only-mode automatically, and if users want this mode for some more modern devices with broken OEM keymaster implementations the manual opt-in method of adding a file named "scripts-only-mode" in the PIF module subdirectory can be used. This is useful because the core Zygisk based PIF spoofs (ie. broken/fake keystore for fallback to BASIC-only attestation and targeted changes to device identifiers for HARDWARE enforcement bypassing) are not needed at all in these cases.

In scripts-only-mode only the needed global spoofs for 'sensitive' props etc. and root hiding for DroidGuard/GMS (module adds com.google.android.gms.unstable and com.google.android.gms Google Play Services processes to DenyList so this will now need to be enforced or Shamiko or other hiding module used instead) will be applied.

Hope something there is useful...

Nb. Line 1 in module/customize.sh should be changed:

"# Allow a scripts-only mode on older Android without Zygisk

# Allow a scripts-only-mode on devices launched with old Android (<8) and some later devices that don't support hardware backed attestation for PI."

Without Zygisk users would need to use a stand-alone MagiskHide module as Zygisk is obviously needed for DenyList (or Shamiko)... That may change if Make denylist work when zygisk is disabled #7631 opened on Dec 17, 2023 by vvb2060 (using logd) gets merged.

👍 PW
[Magisk] pndwal:
Uber Driver and new XPL-EX Xposed module

But now this current evidence that the rumoured move by Uber Drive to require STRONG_INTEGRITY is false:

You too can be an Uber Driver 🙂 PW

...But you can't have a body like mine...
[Magisk] ashish1989:
@Vision @pndwal sorry for this late reply. Just installed @osm0sis bro's playintegrity fork for below android 8 on my android 7 device, installed without any issues. And before restarting I Cleared the play store and play services data and cache. But I am still at same problem meets_device and meets_basic integrity still fails. Zygisk and Enfore Denylist both are enabled.
[Magisk] zgfg:
For the PI Fork you must provide YOURSELVES the custom.pif.json, module does not install install and you will not pass without

Please find and read FAQ post. Look under Most liked posts. Everything is there
[Magisk] CZ.Kostra:
Add 'com.google.android.gms.unstable' to DenyList in Magisk.
[Magisk] ashish1989:
Already added
[Magisk] ashish1989:
I placed a custom.pif.json file in the desired directory and used fp_downloader.apk by daboynb. pif.json downloaded successfully notification has also come, but still not passing basic and device integrity. I also checked the folder, there is no custom.pif.json file present now which I placed manually in /data/adb/modules/playintegrityfix folder
[Magisk] zgfg:
Did you put as:

/data/adb/modules/playintegrityfix/custom.pif.json

And, is it the json with motorola griffin prints?

In Terminal emulator, execute:

su -c killall com.google.android.gms.unstable

su -c logcat.c

Then test Play Integrity

and then execute:

su -c logcat -d | grep PIF

you can save to Download/pif.log by:

su -c logcat -d | grep PIF > /sdcard/Download/pif-logcat.log

and share your pif logcat
[Magisk] ashish1989:
Yes I put it there only. But I am running fp_downloader.apk it is deleting that json file

No, I don't think so, can you plz share me personally the json. It will be very appreciated, thanks in advance.
[Magisk] CZ.Kostra:
Please describe your device build including versions (device, ROM, magisk, modules, etc.).
[Magisk] Vision:
But i think in older devices no need the custom.pif.json
[Magisk] ashish1989:
View attachment 6085106
[Magisk] ashish1989:
I have put it in and restarted. Now what to do?
[Magisk] Vision:
I don't understand, why the original safetynet and the mod not working in your device
[Magisk] ashish1989:
That's what irritating me the most. I don't know what to do now. Basic and device, both integrity are failing
[Magisk] Vision:
More info?

What device ? root method ? setup? what other modules ?

You have custom rom ? viper os ?
[Magisk] ashish1989:
Samsung J2 2016 rooted by Magisk v27.0

Modules - External SD Write Access Enabler, Xposed Magisk Framework and playintegrityfork

Using this rom

https://xdaforums.com/t/port-rom-viperos-coral-3-1-1-for-sm-j210f-android-7-1-2.4200199/
[Magisk] Slim2none4u:
You seriously need to stop spoon feeding people.
[Magisk] Vision:
Maybe this ROM have inside already the PIF to pass ? and try to disabled all other module except PIF
[Magisk] Vision:
I get your point, but if i can help why not ?

I was in the position of many users (noobs, still i'm in some things) and to learn, some others helped me first
[Magisk] pndwal:
Are you using latest GitHub CI actions build? Need GitHub account... (Or where did you get it?)

Older one had issues ... Actually needed Zygisk directory removing to activate scripts-only-mode...

Neither need JSON, and GMS processes (X2) should be added in DenyList automatically...

👀 PW
[Magisk] Vision:
Thank you.

This had in my mind to write it right now
[Magisk] pndwal:
For everyone's understanding of PIFork Scripts-only mode:

@osm0sis's notes:

Bring back USNF's scripts-only mode for older Android, but better March 26​

- do scripts-only mode automatically on Android < 8.0 since it doesn't support Zygisk and generally doesn't need a PIF module to pass at all

- clean up all unused files in scripts-only mode, and modify script behaviors for it, including allowing GMS on DenyList, and even add it if missing since it's necessary on some scripts-only configurations

- allow manually entering scripts-only mode by deleting the zygisk

directory

of the currently installed module and reinstalling

- intentionally don't alter the Enforce DenyList state, since we don't know what other modules are installed that might depend on it one way or the other, so leave that up to the user

Nb. Edited this to bring in line with March 27 CI build behaviour. (PW)

Fix mistakenly forced scripts-only mode on clean installs March 27​

- use manual opt-in trigger of a scripts-only-mode file existing in the PIF module subdirectory [may need to reinstall, PW]

- clarify installer message since Magisk Zygisk actually functions on Android < 8 now, but the Zygisk attestation fallback and device spoofing aren't necessary to pass on these (and also some later) devices

FWIW, I put some (clarifying) usage notes here (too):

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89424307

🤠 PW
[Magisk] ashish1989:
He is not spoon feeding, he is just curious. Also this problem will help many users who are below android 8

I don't think so, if it already had, the banking apps should have worked earlier

Using latest one which @osm0sis bro has updated recently. I am also attaching the file which I have downloaded and installed
[Magisk] pndwal:
Is that a CI build from March 27?... Should be named PlayIntegrityFork-CI_#203 or PlayIntegrityFork-CI_#204... Do you have a GitHub account?? PW
[Magisk] ashish1989:
Yes I have a github account, also I have renamed it for my convenience only
[Magisk] Vision:
View attachment 6085178View attachment 6085179
[Magisk] Vision:
I think something else make fails, like Xposed because is older version and not have the spoof like have the LSPosed, first dibabled all module, and only the PIF enabled
[Magisk] CZ.Kostra:
What @ashish1989 posted above is 'PlayIntegrityFork-CI_#204.zip'.
[Magisk] ashish1989:
I think Xposed is triggering something, because I have another Samsung mobile with android 9 having Xposed in it and device integrity can not be passed in it even it is android 9 and have all updated modules and mechanisms

And the worst part is, I can not disable xposed as I needed it badly to make apps to use external storage as I am low in memory in both the devices

Its like living with the problem and accept it like nothing happens
[Magisk] pndwal:
Looks correct... Suggest try rebooting after all other modules disabled, checked 2 GMS processes are in denylist, denyList enforced, Zygisk working, removed JSON file...

You may be @osm0sis's guinea pig! 😁 PW
[Magisk] Vision:
Yeah just now i compare the file @ashish1989 upload and the 204, is the same zip, just renamed say
[Magisk] Vision:
Exactly all this, so simple. and i think the Xposed is the problem

Thanks you again
[Magisk] Vision:
Yeah because the Xposed is too old not have the necessary spoof like the new LSPosed have, and try the above say @pndwal
[Magisk] ashish1989:
Even playintegrityfix_next can not pass device integrity in my other Samsung device with Android 9 with same Xposed setup. I think devs should consider doing something for Xposed related issues.
[Magisk] ashish1989:
Can not say for sure, bcoz in my other samsung A9 device I am using Lsposed
[Magisk] Vision:
I think the old Xposed it's abandoned.

So with little words, when you disabled all other modules and the Xposed, with PIF only enabled you pass 2/3?
[Magisk] ashish1989:
No, its with lsposed as the device is A9
[Magisk] Vision:
I mean in the other with 7.1.2. in this exist the problem right? for the 7.1.2 i think we discussion can't pass
[Magisk] ashish1989:
Ya you are right, that's the one with old Xposed
[Magisk] Lord Sithek:
Honestly I have an impression you're going to beat some kind of posting record or something...
[Magisk] V0latyle:
Not for a while!

View attachment 6085191
[Magisk] Vision:
For that send me this before 1 week 😂🤣

View attachment 6085196
[Magisk] Lord Sithek:
I mean in last two weeks or so :sneaky: But in this pace he'll beat everyone in a blink of an eye 😂 (sorry for OT)
[Magisk] Vision:
The irony is i'm blind from my one eye 😂🤣

I have free time for this i write too much and can help if i can
[Magisk] osm0sis:
You're on some random custom ROM, with all kinds of different values from stock. Of course you can't pass. A scripts-only-mode install only gets things passing on stock or ROMs that were smart enough to keep all the stock values.

Did you already try running my fork in normal mode with the Xiaomi.eu print? Curious if that'll work on such an old custom ROM. Could also be traces of Xposed being detected.
[Magisk] Vision:
So in the 7.1.2, when you disabled all other modules and the Xposed, with PIF only enabled you pass 2/3?
[Magisk] Vision:
Yeah,i say about custom ROM and for the old Xposed maybe cause the fails because too old
[Magisk] ashish1989:
I don't have Xiaomi.eu print. Didn't try it.

Can't disable Xposed bro, my internal storage will get affected once the module stops working
[Magisk] HippoMan:
Yes, but this conversation ultimately uncovered the fact that the old, deprecated XPosed framework is the cause of the problem, and it makes it clear to readers that this old framework is not usable with today's PIF utilities. That's useful information for people to be aware of.
[Magisk] Vision:
Exactly, thanks you
[Magisk] osm0sis:
Extract everything manually from my CI 204 fork zip and put it in /data/adb/modules/playintegrityfix then get this file from chit's and put it there too renamed to custom.pif.json https://github.com/chiteroman/PlayIntegrityFix/blob/main/module/pif.json then run migrate.sh
[Magisk] Vision:
So is simple now the old Xposed cause the fails, and unfortunately can't solved until now,have you tried the Dreamland ?
[Magisk] osm0sis:
Yeah, I forget if PI looks for Xposed directly, but if so, without a functional Shamiko on Android that old he might be out of luck. A Magisk fork with built-in MagiskHide revived might help.
[Magisk] Vision:
Yeah like Kitsune Mask or the standalone magiskhide

Maybe this?

GitHub - HuskyDG/magisk-xposed: Legacy Systemless Xposed Framework by topjohnwu

Legacy Systemless Xposed Framework by topjohnwu. Contribute to HuskyDG/magisk-xposed development by creating an account on GitHub.

github.com
[Magisk] osm0sis:
He needs to test PIFork in normal mode first to see if that'll help. Once we rule out everything else he can consider trying MagiskHide and Xposed alternatives.
[Magisk] ashish1989:
I am already using this in my A7 device
[Magisk] Vision:
Oh with this can't pass? I thought with the original Xposed, and try this @osm0sis say above

and other option

GitHub - canyie/Dreamland: A third-party Xposed framework implementation which supports Android 5.0~14.

A third-party Xposed framework implementation which supports Android 5.0~14. - canyie/Dreamland

github.com
[Magisk] osm0sis:
Pretty good chance that's what's being detected, since it's mentioned even from this old SafetyNet white paper:

DroidGuard: A Deep Dive into SafetyNet | Romain Thomas

SafetyNet is the Android component developed by Google to verify the devices' integrity. These checks are used by the developers to prevent running applications on devices that would not meet security requirements but it is also used by Google to prevent bots, fraud & abuse. <br /><br /> In...

www.romainthomas.fr

So between Xposed and the old custom ROM he won't pass without something actively hiding things like DenyList or Shamiko with MHPC or PIFork, because he needs Zygisk for PIF module but needs an active DenyList or MagiskHide to block PI from seeing Xposed, and of course Shamiko doesn't work below 8.1.

Maybe MHPC with a full stock device prop clone and Enforce DenyList could work for his scenario?
[Magisk] HippoMan:
I'm having problems with Uber Rider which also might be fixable via XPL-EX, and so now I'm thinking of trying that utility.

I want to make sure that I won't hose my device, however, so does anyone know whether I might have problems using XPL-EX with Magisk Alpha 27002 and LSPosed 1.9.2(7024) ?

I'm not in a position to be a guinea pig for trying this, given that I only have one working device that I need for my job, and that I don't have much spare time for reflashes and re-installs, if they turn out to be necessary. That's why I'm asking here if anyone might have experience using XPL-EX under this environment.

Thank you in advance.
[Magisk] Vision:
Yeah, i don't remember exactly, but in my old 7.1.1 all stock, something i have tried (Dreamland?) and pass 2/3 with the old safatynet
[Magisk] Vision:
About shamiko read this i had write before

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] Vision:
@ashish1989 Last change to try to pass, with custom ROM and Xposed, is install Kitsune Mask with MagiskHide
[Magisk] ashish1989:
Ok, let me try
[Magisk] Vision:
Try the latest stable first.

Delete all old Magisk and modules and do a fresh install of Kitsune Mask
[Magisk] osm0sis:
Also, since I see there's a possible use case for it now:

Make scripts-only mode opt-in only · osm0sis/PlayIntegrityFork@8215587

- older custom ROMs may be able to pass only with the Zygisk components active, since the custom ROM doesn't have the correct stock ROM values

github.com

CI #205 Build (GitHub login required): https://github.com/osm0sis/PlayIntegrityFork/actions/runs/8468946258
[Magisk] ashish1989:
Will try this, thank you for this quick update and understanding the problem
[Magisk] osm0sis:
You'll still need something to hide Xposed. Probably MagiskHide in Kitsune could work? And if that doesn't work you'll have to try my idea at the bottom back here: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89425433

Edit: Actually, might be easier to try my MHPC + DenyList idea first, since if it does you won't need a working PIF print.

MagiskHidePropsConf/common/prints.sh at master · Magisk-Modules-Repo/MagiskHidePropsConf

This tool is now dead... Contribute to Magisk-Modules-Repo/MagiskHidePropsConf development by creating an account on GitHub.

github.com
[Magisk] Captain_Throwback:
To be fair, I'm using scripts-only mode on Android 14 on my "broken" device and it works fine, so you don't necessarily need to qualify the Android version in the comment there.
[Magisk] osm0sis:
Well there's normal intent for use, and then there are special cases. 😛

Android 10 is where I observed the DroidGuard behavior change to become more strict and fail without normal mode on stock on my OnePlus 5, so that's just my general guideline for where people might be able to successfully use scripts-only-mode.
[Magisk] ashish1989:
I already tried it, but it didn't work. It was my first choice since I don't have any option below A8. Also for hiding xposed I found rootcloak will work. Let me try that
[Magisk] osm0sis:
You'd need both things though: you need to spoof stock values for your device using MHPC, and also to have gms.unstable on Enforced DenyList to hopefully hide Xposed from it. Try it again just to be certain please.
[Magisk] zgfg:
Use autopif script also from Osmo0sis and it will create the json for you - find in the FAQ post