yashsingh1/xdaforums huggingface dataset:
[Magisk] Zytrel:
Does your script grab a random one out of this pool, or just downloads the one included in chit's release? (Excuse me still busy and haven't had time to look at the actual code).

If it does the former, yes, my point it moot and I apologize. If it's the latter, well, yes the included print is prone to banned soon, but it's already out there and better than nothing.

Regards,

Zy.
[Magisk] osm0sis:
Please go at least read the post for the script, it's very clear what it does.
[Magisk] GabbyWC:
For those who noticed the post above, I have updated it with more details and embedded links to the FX app, autopif.sh script and PIF modules. This makes the instructions even easier to follow.
[Magisk] Legitsu:
rom authors should also NOT be including fp's instend they should be including autopif or some other automatic grabber that retries untill it gets a print

a bunch of devices using the same print is a imediate red flag which gets the print banned which futher depleats the pool

@osm0sis would rotating fps at boot or every x day be a wise mitagation to slow googles ablity to ban finger prints we would need like a hot-spare system that would flip/flop rotate though a list of known good fps every so offen to slow googles ablity to ban finger prints

might be time to start considering looking at the traffic and performing a Man in the middle type attack to see if something might be gained towarding keeping googles nose out of where it don't belong

google is clearly very afraid of the capablitys of a unrestricted device which means there is probly something there they don't want found
[Magisk] Zytrel:
No worries, the script just pulls the latest Xiaomi print, and that's it. You're previous reply just made me question my memory. Please don't get me wrong. I'm extremely grateful for your (and the other devs) work and especially your documentation of the whole mess. It was just a thought that in this special case, where it's kinda hard to find a unique FP that works, to just include the print to make it easier for the average guy. But I also totally see your point of not including any prints.

Regards,

Zy.
[Magisk] GabbyWC:
When accessing a public fingerprint becomes too easy by including it in a PIF release, this increases the rate at which more users share that fingerprint and makes it a bigger target for the PIG's countermeasures. 🎯 Of course there are people who prefer the path of least resistance but with a convenient solution such as osm0sis' autopif.sh script and my post with detailed instructions, it's only fair to require some basic effort from users who want to have device integrity. Any public fingerprint that works today could fail tomorrow and that's to be expected. Google always has the upper hand in terms of strategies and resources.
[Magisk] Legitsu:
PLEASE REFRAIN FROM USING APPS LIKE YASNC or SPIC to Check Play Integ Status these apps increase visablity for google and allow them to (more)quickly ban finger prints

*unless you really understand what you are doing*

*yes I know this post will fall apon deaf ears but what the hell*
[Magisk] Nergal di Cuthah:
Well yasnac won't tell pi status so shouldn't be used anyway, and the alternative to those (and the one i use) is playstore and I'd bet google can watch that too

Edit: also instead of being helpful your post is hard to read both the big and small text. Just my opinion
[Magisk] Nergal di Cuthah:
In fairness to both my above reactions, i added an edit after you reacted, feel free to unlike if my edit changes your opinion
[Magisk] rseiler:
Yes, which leaves, what, never checking at all and taking it on faith? Is there some clever way of knowing without checking that someone is aware of?
[Magisk] GabbyWC:
I agree that adding large, colorful text or really small text is unnecessary and annoying. My like remains unchanged.
[Magisk] GabbyWC:
See here for a post about this topic which was made months ago.
[Magisk] Nergal di Cuthah:
Yes that is what i was saying too :)

We must check somehow (@GabbyWC i agree netflix is a way but slightly unreliable as playstore certifies maybe every 24 hours) playstore integrity checker is how i check because it has a way higher token count than play integrity checker or spic (which i haven't tried but reminds me of a derogatory slur everytime i read it)
[Magisk] GabbyWC:
I think people should try to resist the urge to check the Play Integrity status unnecessarily. Too much activity makes the popular status checking apps hit their daily API limits sooner and provides even more information for Google to analyze. When a fingerprint works, just let it be for as long as it lasts.
[Magisk] Legitsu:
part of the issue is to many guides and too many people spamming FPs

I was talking about this in the evox discord what about moving FP's off device store them only in memory downloaded at every boot stored only in ram. (with a option to cache them if you must)

maby even rotate known good finger prints every so offen(days?) to make it less obvious

taking that a step futher what about some kind of zygisk module that only loads the finger print when a app that requires PI is run some kind of module much like magisks deny list where apps that are on this list only have access to a sandboxed version of play core services (not sure of the fesiablity of this).

but load/unloading of a finger print on the fly is something thats already possible the tricky bit is going to be loading the fp and getting the attestation ready before the app checks it.

this module should be keeping the fp in ram in a encrypted state. and only passed to along to anouther module responsible or loading the fp when a app that requires attestation is run this handoff/scheduling would be tricky.
[Magisk] i5lee8bit:
Finally found one of my old configs is still working. Definitely was tested at least 1-2 times at the time I mined it (like all of them I found), but somehow it didn't get burned.

This particular config's launch version and API level falls within the recommended range for success for those wondering. Launch between Android 6-8 / initial sdk between 23-25 (edit: been brainfarting this whole time, should be initial sdk / api between 23-26 and print with Android version of between 6-8. Thanks os!)

Now keep in mind, this is out of a huge amount I've already tested til the first good hit. I still have a few dozen to migrate (these were all made when PIFork was v3 or v4) and test, and thanks to some tweaks I made to osm0sis's migrate script, I've been able to bang them out quickly. But the fact I've gone through several dozen already and only hit 1... I mean, good news that a previously used print survived, but also bad for obvious reasons.

Just posting this because I'm not sure if ANYONE ever confirmed an old config they used and tested before Feb 29 still survived and is still working today.
[Magisk] crayoneater:
One sneaky way to check if you meet device integrity is to check if you can send an RCS message. RCS used to require only basic integrity, but now it requires device integrity too.
[Magisk] zoisa:
I have a question, i had 8.2 EvoX with v7 fork without any FP, it worked all time (like a month), yesterday i updated to 8.3 and now it dont work, my question is i dont really understand this, why i could pass both without FP and when i update i cant, is anything i do wrong or maybe the rom change something, i dont really understand.

Without v7 fork i cant pass basic, but the developer say i should pass both without do nothing, so i confused... :(

Edit: i dont really what i did, i use 6-7 times the pickaprint.sh without fork v7, then i realize than i need first install it and then start to check FPs, and after i installed i pass both without do nothing more, so i got lucky or i dont know, i dont really understand anything, i dont even know what FP i have know, im so confused but im passing both :)
[Magisk] PandarianFury:
I get 2/3 pass on TB Checker, but google wallet still says my phone does not meet security requirements. Do I still need to wait?
[Magisk] 4sz0m:
I just wanted to report back on this. 24+ hrs after the reapplication of the xiaomi eu print, my Wallet still isn't green, but I just managed to pay with it. Interestingly, my Wallet continues to state "does not meet security requirements", but it's clearly not relevant.
[Magisk] zgfg:
As mentioned several times since Thursday, both the Chiteroman's hardcoded amd what autopif.sh script downloads (and some other tools/methods do) are now all the same prints, from the Xoaomi.eu injector

Xiaomi.eu Multilang MIUI ROMs - Browse /xiaomi.eu/Xiaomi.eu-app at SourceForge.net

OFFICIAL mirror of MIUI Multilang ROM by https://xiaomi.eu/

sourceforge.net

Prints can be also manually extracted by unzipping the downloaded apk and finding the xml with the prints in

Likely, the same will happen tomorrow, and Osmo0sis will not need to deploy the new module since he doesn't pack the prints to the module
[Magisk] zgfg:
Those apps are published on the Google's Playstore, no way that Google does not know about them😁
[Magisk] PandarianFury:
Thanks for this. I tested mine now and was able to pay with Google Wallet, even though it said my device did not meet security standards
[Magisk] zgfg:
If you're not managing your cards, there is no need to manually open the Wallet - just enable NFC, move the phone to the terminal and pay

That's actually the advice for the opposite case - when Google (will) ban(s) the prints you're using. Better don't open Wallet, let it continue to use for 12hrs its last time cached PI pass

With that, Wallet can gap over the few hours you don't have the working prints (I always pay and I came to the situation that I open Wallet and that it tells me that the phone is not secure although I've been the whole afternoon in shopping and paying but without the working prints)

You only need to use PI checkers to validate your old/new prints, no need to test from the Wallet
[Magisk] Dark_Diver:
Hundreds props, extracted right from the ROMs (not found in the Wild), found only a few working.

Have to say, that this Google model is good, it has very little error rate.

But, I think, they are just going to add some more data and train the model a lil bit more.

And pif "passing rate" will be near to zero next time.
[Magisk] InsaneNutter:
If I have an old device with a locked bootloader can I get everything required for a fingerprint from adb shell getprop?

PRODUCT = ro.vendor.build.fingerprint

MANUFACTURER = ro.vendor.build.fingerprint

BRAND = ro.vendor.build.fingerprint

MODEL = ro.build.display.id

FINGERPRINT = ro.vendor.build.fingerprint

SECURITY_PATCH = ro.vendor.build.security_patch

RELEASE = ro.system.build.version.release

TYPE = user

TAGS = release-keys

I wasn't sure about the following:

FIRST_API_LEVEL = ? not sure, 25?

DEVICE_INITIAL_SDK_INT = ? not sure

INCREMENTAL = ? not sure

I can check the CPU Abilist is the same as my device with ro.system.product.cpu.abilist, needs to be arm64-v8a,armeabi-v7a,armeabi

Not sure how popular this device was, so I figured its worth a try as it should have ended support on Android 6-7 if memory serves me correctly.
[Magisk] beeshyams:
Apologies for repeating my point, at the cost of being called out for spamming

This banning has to do with region also as pointed out by me earlier:

I am from India using Pixel 6a:

1. Google wallet isn't available but Gpay works fine just with a) device certified b) only meeting basic integrity (1/3)

2. I can see Netflix on Playstore (I don't use it)

3. RCS never worked for me (likely due to carrier restrictions though my phone isn't carrier bound)

This is contrary to what some have reported in this thread, so my 2C is that region plays a role in the Google calculus
[Magisk] Vision:
IMPORTANT

Mini Guide.

When dev say go to module directory, and you don't know what mean ?

This mean: /data/adb/modules and after inside in the module folder, you see all your module store there, each with its own name

Example: @osm0sis fork go to /data/adb/modules/playintegrityfix

View attachment 6075580
[Magisk] Vision:
To tell the truth, me to before learning (still learning) all this, don't understand all, and make lot mistake.

Now i have learning this, but now i make another mistakes 😂🤣
[Magisk] pershoot:
Give it time; I noticed in my own personal testing that times increased by a factor of ~x2-x2.5 for it, in this last iteration (compared to previous). You have confirmed that it is working (aside from the status it shows), so you 'should' be ok, for the interim.
[Magisk] pndwal:
In G Pay, Pay contactless setup, do you see 'Your phone meets security requirements'?... PW
[Magisk] Captain_Throwback:
It's important to get the details right here; the folder is "playintegrityfix", not "playintegrity", as is clearly evidenced in your screenshot.
[Magisk] Vision:
Thanks you note this, i correct
[Magisk] Utini:
Yep I wonder the same since I got several Samsung Android 13 phones at work that I could extract from to use the fingerprints on my Pixel 8 Pro.
[Magisk] Slim2none4u:
This is just ignorant!!
[Magisk] Captain_Throwback:
If you think Android 13 phones will be helpful, then you need to read more about how all of this works...
[Magisk] Utini:
Hm I couldn't find anything regarding the requirements of the Android Version :o
[Magisk] zgfg:
For 1st API level search on the Net, like GSMArena, what was the original Android version the phone was released with, use Google table (Google is your friend) to translate A version to API level

Device Init SDK Int is the same, depending which PI Fix/Fork and version you use

Fill one and use Osmosis migrate.sh to make extract Type, Tags and other fileds from Fingerprint - if you plan to use it with his Fork
[Magisk] Vision:
You can try with Total Commander with lock BL and without root (if the adb not work), in the old devices go to root folder after system copy and paste the build.prop. This work for me in my old devices without root, and after use PixelFlasher to generated the proper json
[Magisk] zgfg:
It will be mostly waste of time trying to use Samsung A13 prints - they will for sure require TEE/Hardware attestation, hence no use of putting them to another device to spoof instead the software based aka Device Integrity Attestation

To the contrary, you need an old device... But even with that, chances that the prints from your old phone you might have at home are not 'banned' by Google now are like getting on lottery, specially for the well known brands and models
[Magisk] beeshyams:
I don't know what you mean by "contactless setup" (never was asked to it), but here in India the transactions are made by a) scanning the bar code of the vendor b) paying through their mobile number c) sending / receiving through your contacts d) Third party services/ utilities raising a request for payment through GPay

I guess you are probably referring to NFC . No, we never use that here, in the sense of "tap and pay". It's not needed at all because we've got 5 or 6 agencies like Gpay and they are interoperable riding on a nationwide Unified Payment System with transaction modes as described above.

So to that extent , I may be wrong in my theory
[Magisk] V0latyle:
Android 13 prints will not work at all.

We had previously discovered some working prints from builds later than Android 8, but Android 13 seems to be the absolute cutoff where you will not find any working prints at all.

You don't have to have a physical device to get the props you need for a print. You can use any firmware archive or build dump.
[Magisk] osm0sis:
Slight correction to what you've said there: when I originally said Android 6-8 I meant that's the ROM version of the print itself, and, in addition to that, also having a first API/initial SDK of 23-26.

So not the same thing since it could be an Android 8 print with a first API/initial SDK of 23.
[Magisk] Utini:
Thanks I need to re-read all the info again then. I was under the impression that I could "fake" a device by extracting the info from that specific device. I also still have my Nexus 6P (no idea which Android version that is) but it sounds like that will most likely be banned already anyway and that online searching is a better chance.
[Magisk] i5lee8bit:
Whoops, so for the last 2 days I've forgotten sdk 25 = 7.1 (not 8 which = 26) and additionally have totally been brainfarting some bits of your advice... but luckily it didn't really make a difference in terms of the [relatively] small areas I looked into so far. Thanks for the correction, will edit the post now 👍

Yet another edit: also, make that a total of 2 working old configs. I happened upon 1 more last night as I wrapped up the testing of the batch I'd been working on. And additionally I still have [just a very small amount] left to migrate and test, but at this rate it was indeed <5% survived. 😳😢
[Magisk] mates21:
Is there an application that allows you to check whether the found fingerprint is correct without a phone using a computer?
[Magisk] Vision:
If you mean to see the spoof FP value, i think there a script can run directly in your phone

logcat | grep 'PIF'

it should work with most (all?) terminal emulators
[Magisk] mates21:
I want to check if the print I found is correct. I would like to check on the computer whether it is good and only then use it for the module in the phone
[Magisk] Vision:
Oh sorry i read the reverse, like i understand now you want to check FP in computer if pass 2/3 ?
[Magisk] mates21:
exactly. when it works then upload on the phone
[Magisk] V0latyle:
Nope, don't need to have the actual device. We are extracting fingerprint values from various sources within the ROM such as build.prop, and this can be done using ADB on a physical device, or by simply extracting the build.prop from an Android build.
[Magisk] droidman1992:
@osm0sis Do you plan to improve your autopif.sh to make it automatically copy the print to the directory so it works with your Play Integrity Fork v7 automatically?

I find the current solution so convoluted, I feel like giving up on working play Integrity altogether. I'm not sure if you can help me, however, I have a problem running your autopif.sh in termux on Lineage OS 21 (Android 14) as it reaches the APK extraction stage and throws some code 8 about missing libraries.
[Magisk] Vision:
Understand, unfortunately, i don't think this is possible to check if pass 2/3 from a computer, maybe i'm wrong, if anyone else know about that can tell you better than me
[Magisk] Utini:
Thanks, for now I used the autopif.sh which downloads the xiamoi PIF. I am passing device integrity now.

It is a pain to find a way to execute scripts on Android though lol.

Amaze doesn't support executing scripts.

Termux spams random erros as well.

Mixplorer fixed it in the end.

Should I also be possible to run the script via adb from my laptop?
[Magisk] zgfg:
Previously I had couple of A13 and even one A14 prints but no more after the Bloody Thursday
[Magisk] :
https://f-droid.org/en/packages/jackpal.androidterm/
[Magisk] Utini:
last update was 6 years ago :S
[Magisk] :
Still working fine.
[Magisk] Vision:
Mini Guide.​

For those want extraction the build.prop from old devices and don't like to work with adb.

With Total Commander (locked BL and without root), in the old devices go to root folder after /system/build.prop copy and paste.

After follow the existing ones instructions from here for the rest

This work for me in my old devices.
[Magisk] osm0sis:
You find copying a file from one place to another, a thing you had to do when using your own custom print anyway, convoluted?
[Magisk] Vision:
@osm0sis waiting for this 🤓

View attachment 6075672
[Magisk] osm0sis:
Yeah, didn't feel right to continue on to release it right away with all the turmoil of the "Leap Day 2024 Mass Ban", so I'm still working on things while the dust settles, then we'll do another round of testing to make sure no new issues.

Commits · osm0sis/PlayIntegrityFork

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - Commits · osm0sis/PlayIntegrityFork

github.com
[Magisk] Vision:
Oh understand, it's ok no rush, you have all time you want
[Magisk] zgfg:
Many have fallen this Bloody Thursday
[Magisk] :
Can Total Commander access root folder without root?
[Magisk] okij:
If Google decides to do the next mass ban on the next leap day in 2028, I'm fine with it. ;)
[Magisk] droidman1992:
Yes I do, since before the mass banning I used @TheFreeman193 pickaprint.sh, the script did everything and the solution lasted for 1.5 months, whereas now with the Xiaomi print it will probably get banned every 3 days, requiring lots of tinkering.

I also couldn't even get your script to finish in termux for some reason, I'm certainly not going to plug into a computer via ADB every 3 days to run this convoluted process just to get Play Integrity.
[Magisk] Vision:
Yeah in some parts, like /system etc.

View attachment 6075693

but in other, if try to go to the /dev folder you get this

View attachment 6075694
[Magisk] zgfg:
You can use more modern MiXPlorer, too.

It's actually due to the chmod 755

Besides, adb shell getprop will also list all props without the need for root
[Magisk] der.lange:
XPERIA XZ2 premium with LOS 20 meets basic AND device integrity

(magisk 27; Play Integrity Fix 15.9; ih8sn)
[Magisk] Vision:
Sweet, yeah without read permission the other apps without root they wouldn't be able to read the build.prop for correct info of device.

Thanks for info. I appreciate as always
[Magisk] rseiler:
Just something I'm wondering about: I see references again and again to the "xiaomi print" issued by autopif.sh. I used it only once, but what I got made no mention of xiaomi. Is it possible that the pool includes mostly xiaomi but is not exclusively that?

Does it happen right away or is there significant delay like with Wallet, which can be used for hours, maybe even a day, before the effects of not having device integrity kicks in.
[Magisk] PatrickJK:
it's called the xiaomi print as it's extracted from the apk the xiaomi eu team is using to pass integrity on their roms, not because it's a print from a xiaomi phone
[Magisk] pndwal:
You are correct that G Pay/Wallet doesn't require PI DEVICE_INTEGRITY to function, even to make online payments...

When users here speak if G Pay/Wallet not working with failed DEVICE_INTEGRITY they are referring specifically to contactless payments, and a Settings, Pay contactless dialogue reports that the device does not meet security requirements for this... Contactless debit/credit/reward and other cards are deregistered, but other functions continue to work. 👀 PW
[Magisk] zgfg:
The whole System is chmod 755, read and execute permissions for all

Write permission only for root group but actually, on the modern devices System filesystem is read-only, making it not possible even for root to write/change.

OTA overwrites the whole (dynamic resizable) partition

Magisk provides systemless mechanism of 'writing' - it just dynamically mounts the changes on every reboot, and the System remains untiuched
[Magisk] HippoMan:
To be precise, the "adb shell ..." command that you mention here is run *off* the phone via a USB connection via the computer.

The plain old "logcat ..." command that you also mention is indeed the one which runs on the phone, and it should work with most (all?) terminal emulators, in addition to running via Termux.
[Magisk] Vision:
Good to know all this.

Thanks for useful info. I appreciate as always

Yeah, when first buy my Xiaomi with A10, first i search and i read not touch anything in system because break my phone and going to bootloop, after found the Magisk, in my previous phone with 7.1.1 i chance in system whatever I wanted with my changes and all good
[Magisk] Vision:
Yeah i have note this before, i forgot to change, i take some of your words (it should work with most (all?) terminal emulators) and write it there I hope you don't have problem

Thanks for note and tell me. I appreciate