yashsingh1/xdaforums huggingface dataset:
[Magisk] Nergal di Cuthah:
Oops that did it i guess i conflated my first attempt at the command (months ago when custom was added and i was donated a fp but didn't try the run check first test) and today's mistype that i copied.

Got a killed with "signal 15" result
[Magisk] sdmatto:
This comment of yours triggered something I remembered, so I went back to the github page for avbroot (https://github.com/chenxiaolong/avbroot), and realized that v.3.0.0 changed the system partition.

So, I rolled back the avbroot ota mod to avb v.2.3.3 (i.e., which makes no change to system partition) to see if there might a different result, and sideloaded the resulting Magisk-Delta-rooted, bootloader-locked, self-signed ota, and . . . same result (i.e., otherwise working custom.pif.json (from testing with Moto Z2 Force running hybrid stock, rooted ROM) does not yield "Device is certified" attestation on my P8P for reasons you elegantly set forth below).

After my exploration above with Magisk Delta (i.e., no change to system partition using avbroot 2.3.3), I wasn't satisfied that I had exhausted all possibilities, so I applied the same avbroot v.2.3.3 method (i.e., which makes no change to system partition) using APatch (instead of Magisk-Delta) (previously referenced in this thread - see https://github.com/bmax121/APatch) as my root solution (and I had to follow the cli directions from v.2.3.2, since the v.2.3.3 cli directions are incomplete). After sideloading the resulting APatch-rooted, bootloader-locked, self-signed ota, . . . same result (otherwise working custom.pif.json does not yield "Device is certified" attestation for reasons you elegantly set forth below)

I wish I knew this relationship as well; would provide potential means to engineer solution to my problem.

Until then, I am stuck without the benefits of "Device is certified" attestation.

C'est la vie!
[Magisk] CZ.Kostra:
Information for @osm0sis.

I updated to the PIFork v6 module and it collides with XEUInjector again.

PIFork v5-CI_#108 works perfectly.

I can send unedited logs to PM.
[Magisk] carlese:
So I used pickaprint.sh and osm0sis PIF, now my device meets device and basic integrirty but Wallet still tells me my device doesn't meet the requirements. I deleted play store data and cleared wallet and play services cache, should I wait one day or delete wallet data and add cards again?
[Magisk] TheRomRooster:
you need device inegrity and a working pif, not the one from your own device
[Magisk] carlese:
Like I said I used pickaprint.sh from https://github.com/TheFreeman193/PIFS to get a working PIF and it passed DEVICE/BASIC integrity. Is there something I'm missing here?
[Magisk] Lord Sithek:
You would need to clear not only cache of Play Services but also data. But you can also wait some time, if DEVICE is passed, Wallet should get fixed soon
[Magisk] vjx012:
I downloaded the script since using my bank app to add the card to Google Pay resulted in it telling me my device doesn't meet requirements. Even though it passed all YASNAC tests.

So I ran the script without any arguments as root. Left the Termux app in background and tried again. It said the same thing. I marked the fingerprint as not working. It then applied another fingerprint. And then it worked.

So I guess you apply the fingerprint, try adding the card, and if it says it doesn't meet the requirements, mark it as not working, try again, and repeat until it successfully adds the card.

I didn't have to clear data or anything. In fact, that didn't work at all, only running the script and it applying the fingerprint worked.
[Magisk] Feduz:
Hi to all! Since last week everything was perfect, but in these days I saw that the check of Device integrity doesn't pass, and google wallet detects the root.

This is the current setup

OP 8t Android 13.1

Kitsune Magisk 26404 (tried also the update from 26403 to 26404 but changed nothgin)

Magisk module: PlayIntegrityFix 15.1

LSPosed 1.9.2

Someone is in the same situation? Do I have to check or do something else?
[Magisk] xChickens:
I just updated my Pixel 7 Pro and PlayIntegrityFix to 15.1 and now my fingerprint doesn't pass device integrity even though I just used it today to pay with Wallet. Not sure how this possibly could happen?
[Magisk] xChickens:
Just worked for me on my 6th try! Awesome.
[Magisk] Affana:
To make life easier here you can see all the forks that been made for this module. PLAY•INTEGRITY•NEXT is working perfectly as we speak...

Forks
[Magisk] zgfg:
I hope the killall -v answer yesterday night helped you

And for all who ask for the Help
[Magisk] carlese:
Well now I meet device and basic integrity but still wallet is not working, I already have it set up with all my cards. I will wait some hours for a refresh, if it still doesn't work tomorrow I will wipe data and add cards again..
[Magisk] carlese:
I did this but Wallet still fails, while my device passes basic and device integrity. Guess I'll need to wait for the refresh, no problem :)
[Magisk] V0latyle:
Hmm maybe it's time to try the whole thing. Per the module instructions:

I would have thought that as long as you're already passing the issue would just be with the payment app but maybe things get cached in such a way that it blocks the payment API or something.
[Magisk] osm0sis:
There was no change to the replace mechanism between #108 and #115 (v6), so you may just need another reboot for the replace directories to become active again? 🤔

PM with install log for when it worked and when it didn't and we'll see about an edge case in maintaining them through an update or something. 👍
[Magisk] SteweEliteModder:
With the latest Galaxy S22 Ultra firmware update (S908BXXS7DWL3) the play integrity fix v15.1 isn't passing google play store certification 🥲
[Magisk] V0latyle:
First steps first. Are you passing BASIC and DEVICE_INTEGRITY?
[Magisk] SteweEliteModder:
View attachment 6057022

View attachment 6057030

View attachment 6057023
[Magisk] V0latyle:
I feel like I have said this a million times...

SafetyNet is obsolete

Read this post

[INFO] Play Integrity API - replacement for SafetyNet

THIS IS NOT A SUPPORT THREAD. For questions and support regarding how to fix your Play Integrity verdicts, see the Play Integrity Fix thread. ⚠️BEFORE YOU ASK A QUESTION, READ THIS POST AND THE FAQ!⚠️ ****Update 12/11/23**** Google has been...

xdaforums.com
[Magisk] osm0sis:
He checked both... Which is a valid thing to be looking at, to know if you're at BASIC evaluationType in SafetyNet.
[Magisk] V0latyle:
Oh I didn't see the Play Integrity screenshot.

@SteweEliteModder you need to find a working fingerprint. You can use Pixel Flasher to pick a random print using PIFS and test until you find one that passes DEVICE.
[Magisk] chiteroman:
Release v15.2 · chiteroman/PlayIntegrityFix

Fingerprint is not included.

github.com

v15.2 released (without fingerprint) to fix few bugs.

BTW, official Dobby was updated but I cannot compile it so I'm using LSPosed one: https://github.com/LSPosed/Dobby
[Magisk] BunnyPig1:
Regarding a locked bootloader with root.

I am not a programmer and I don't know a lot about software, but what exactly is it that makes it impossible for us to spoof a locked bootloader?

I know this is a massive question that probably can't be answered easily but might as well give it a shot.

What I mean is, all information has to be contained within the device itself. I guess there is a specific memory chip containing some sort of information, or possibly the CPU itself.

But what I can't get my head around is what makes it so difficult to "just" send false information to Google servers.

Where is the information stored and would it be possible with hardware modification?

Again, I am not very smart when it comes to software engineering and this is not meant to sound rude. I'm more into hardware but extremely curious how they have made devices almost impossible to hack without the system knowing it.
[Magisk] osm0sis:
Oh no, jmpews deleted all the Dobby releases and tags... Feeling... familiar? 😛

Kinda looks like they pushed to their master branch instead of their dev branch by mistake... Anyway, just must not be stable enough for a new release yet, so we shouldn't try to build with it at HEAD until there is one.

Note the LSPosed fork was from Nov 19, 2022, where the previous official repo release tag was from Mar 28, 2023. Looking like some significant stuff on the official repo between those dates... 🤷‍♂️

Have you noticed any advantages to building Dobby/the module using the up-to-date official topjohnwu libcxx instead of the older Rikka prefab?
[Magisk] justacuriouscat:
There is a module to spoof the bootloader status, but apparently you can't both hide the unlocked bootloader and root. Since the apps that check the bootloader also check for root, the module is not very useful in most cases.
[Magisk] V0latyle:
I had answered this before. Let's see if I can find it...

Here
[Magisk] osm0sis:
Broken link above. He meant here: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89257038
[Magisk] V0latyle:
Fixed, thanks
[Magisk] droidman1992:
@osm0sis

Is there any disadvantage to having google play services, framework and play store on the denylist with enforce denylist in Magisk? Everything is passing and working correctly, however, I'm wondering.
[Magisk] DougMG:
That is no longer necessary and if you do add them then PIF will remove them automatically.
[Magisk] Umgak:
Yes. Denylisting play services will result in all magisk modules unloading within GMS processes, which is why the boot script removes it from denylist. Don't put it back, it'll break.
[Magisk] ioto:
Is there a way yo regenerate original PIF from my device?

Thanks.
[Magisk] Umgak:
No. If you attempt to use your own device's fingerprint, DroidGuard will expect you to be using HARDWARE_BACKED evaluation (STRONG_INTEGRITY). If your bootloader is unlocked, or locked with SelfSigned keys, you will fail HARDWARE_BACKED evaluation (STRONG_INTEGRITY) no matter what. As such, you have to find a fingerprint and props from an older device which does not support TEE (Trusted Execution Environment) to force a fallback to BASIC evaluation, which allows you to pass DEVICE_INTEGRITY as it is much easier to bypass.

Look around, mainly at devices which released prior to Android 8 (this is not a hard and fast rule), and dump the prop files from those - or use the PIFS pickaprint.sh method to choose one at random from @TheFreeman193's stash.
[Magisk] acwcanada:
My question may be OT here, but seems a lot of people here are using TB Checker, so perhaps worth to ask here:

Before integrity checking is needed, I never use TB Checker as always has simple root checker to see if I have rooted my phone successfully or not. Those kind of apps would just provide a simple yes/no feedback. The TB Checker has a "Root Check" feature and I got as shown on attached picture after I run it. Most of them I don't understand/know what they mean. Can someone kindly enough to give ideas.
[Magisk] WhoIsJohnGalt1979:
Kindly add TB Checker to Deny list. Reboot phone, delete cache and data of TB, force close app, open it and re-run the test.
[Magisk] acwcanada:
Thank for the advise, following your instruction, now I get all "pass" except the first one "Root Management Apps". It is not really a big deal as far as that I know my phone is successfully rooted, but I really wish there is somewhere that I can get explanation for those items whether it is "pass" and " fail".
[Magisk] Nergal di Cuthah:
Fail means it detected something under the heading (root managment shows fail because magisk it not hidden if i understand)

Pass means you successfully hid that part (or no trigger like lsposed not installed)

It's not a root checker like you've used before to tell if your correctly rooted, it's checking many of the ways apps like banking or McDonald's detect root and reject you from using the apps.
[Magisk] WhoIsJohnGalt1979:
Glad to be of help. The root management app corresponds to the magisk app itself. If you have hidden it by giving it a name, you would get to see the spoofed apk name on the home page of the magisk app. One of the most convenient ways to hide that is through a lsposed module called HMA (Hide my app list). Now am not sure of your use case, hence do not wish to over communicate here. You would find ample documentation to use HMA should you wish to. Good luck!
[Magisk] acwcanada:
Thanks for the info, at least now I have better idea what the TB Checker app's features are for.
[Magisk] Feduz:
updated to 15.2 but device intergrity still not pass, g wallet detects the root :( someone with Oneplus 8t has the same issue?I don't know how to fix it

View attachment 6057156
[Magisk] xcl1pse:
No need hma tho, as it only detect TJW magisk lol

View attachment 6057158
[Magisk] simplepinoi177:
Clearing data is for those who finally pass MEETS_DEVICE but Wallet still won't work...

I can't remember if any of you have gotten your answer (but hopefully if you haven't, quoting you and directing you here will help), but 15.1 embedded fingerprint got banned a couple of days ago -- for 15.2 or any future versions you will need to supply and implement your own custom fingerprint to get it working...
[Magisk] Feduz:
Thank for explanation! why we can't use our fingerprint instead of the embedeed one that was banned by G? sorry for the stupid question haha
[Magisk] simplepinoi177:
when you say "our fingerprint", are you talking about the device you are currently using's ROM fingerprint, or a custom fingerprint you found online?
[Magisk] Feduz:
Maybe I don't understand how it works, but, I mean "mine" fingerprints in my Android 13 rom (I've the original one, oxygen os, but seems the same stuff). I assume that everyone has a proper fingerprint on his device, or not? thanks!
[Magisk] simplepinoi177:
Unfortunately it's not

that

easy, or it wouldn't be so much trouble for everyone....

newer devices cause DroidGuard to require a more stringent integrity check (hardware attestation); like devices post Android 8/Pie. so we take fingerprints from older devices (many that are newer than Android 8, you just have to adjust a certain value in the custom pif.json file to match older devices [i.e. lower than 34]) so we can pass the less stringent integrity check (software attestation). But for the most part Android 14 and 13 will most likely be a bust with an infintecimal chance at passing because of how absolutely new they are.

So while "everyone [does] has a proper fingerprint on his device" like you said, unless they are using a 4 year old or so device, most likely it wouldn't work (the newer, the less likely). Then again there was a case where there was a device that released last year (on an older Android OS version though) that passed after adjusting that certain value...
[Magisk] Feduz:
So, I had an old device (i don't remember the model, lol, I've to check..), i suppose that has 5/6 years, already rooted. Can I do something? like extract its fingerprint and put in mine OP 8T?
[Magisk] simplepinoi177:
yes. if you look at the 2nd All-time most liked post of this thread (on the right), you will find all the info you need -- it's in the 3rd bullet of the 1st section if you need an exact point of reference....

or use the Pixel Flasher tool "Pif print" option in Device and it will output it in the output window...
[Magisk] BunnyPig1:
Perfect, must've missed those posts, exactly what I was looking for, thank you!
[Magisk] chiteroman:
🤣🤣🤣🤣🤣🤣

Yep, I saw that ShadowHook updated yesterday, so maybe I will use it instead Dobby.

Few users reported me that old Dobby versions didn't work for them.

Libcxx shouldn't be a problem but who knows...
[Magisk] osm0sis:
Might just be Xiaomi.eu/EliteRoms users that didn't fully uninstall the injector app: https://xiaomi.eu/community/threads...ates-and-block-future-ones.70769/#post-710491
[Magisk] blu.italia:
@V0latyle

Now i am certified back again. I've nothing changed. I think it is the same way as google wallet. After a new FP it takes a day in google wallet to get all security checks. And in play store it seems to be need some more then one day, that we get back certified.
[Magisk] V0latyle:
Why not just use PIFS or Pixel Flasher? You can select a random fingerprint, and keep trying until you find one that works

You can easily get around this by clearing cache in Wallet and clearing data for Play Services, then kill Droidguard.
[Magisk] blu.italia:
What's the difference between PlayIntegrityFork and PlayIntegrityFix?

What we should use? And why you both come together with one Magisk Module? I would prefer that (y)
[Magisk] simplepinoi177:
EDIT....

[TOOLS][ZIPS][SCRIPTS] osm0sis' Odds and Ends [Multiple Devices/Platforms]

osm0sis' Odds and Ends -- Misc./Batch Tools, Flashable Zips, Scripts, etc. General Information In a nutshell, I just wanted a single thread to gather links to some of my other, larger projects, but also serve as a spot I could put some smaller...

xdaforums.com
[Magisk] osm0sis:
You've got that all backwards, but yeah. 😛

If someone's wondering what the differences are we should probably just link them to my Odds OP and they can read the description there and follow the links for more context.
[Magisk] simplepinoi177:
sorry.....I thought I saw somewhere you wrote thanking chiteroman for help making the fork or something....

I'll edit and just do that then...
[Magisk] zgfg:
You do have proper fingerprints but you must be on:

no root,

Stock ROM,

locked Bootloader

then you own fingerprints will work and you will (most likely - depending how old is your phone) pass also Strong Integrity

Otherwise your own prints force Strong attestation and you cannot pass with your:

root,

maybe custom ROM,

unlocked BL

That's the whole point, and why you need some other prints - how and why, please get informed in this thread and elsewhere
[Magisk] Feduz:
Do you have a link about it? don't know what is it
[Magisk] mancman:
For those having issues:

I used the latest fork from @osm0sis

[TOOLS][ZIPS][SCRIPTS] osm0sis' Odds and Ends [Multiple Devices/Platforms]

osm0sis' Odds and Ends -- Misc./Batch Tools, Flashable Zips, Scripts, etc. General Information In a nutshell, I just wanted a single thread to gather links to some of my other, larger projects, but also serve as a spot I could put some smaller...

xdaforums.com

and the nice helper guide using PixelFlasher written by @badabing2003 found here:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

I am on a Samsung S22 rooted and have no issues now.

So far the "normal integrity fix" from chiteroman worked for me really good, but now I needed a working fingerprint, where the above guide helped me.

Really thanks to @chiteroman and @osm0sis for their great work.

mancman
[Magisk] V0latyle:
Don't be afraid to use Google.

Pixel Flasher

This one is a little harder to find so I'll forgive you

PIFS

You don't need to use both. Pixel Flasher already has the ability to select a random print from PIFS.
[Magisk] ipilcher:
Woke up to discover that the print I've been using since December 9 has apparently been banana'ed. Switched to a different print, and PlayIntegrityFork v3 is working again.
[Magisk] osm0sis:
Don't be afraid to try v6! It'll auto-migrate your custom.pif.json. :)
[Magisk] mrjuniork:
That moment when you comb through all the knowledge here and on GitHub in order to achieve MEETS MEETS, only to realise you don't even need to meet the MEETS 😂

You gotta love the internet and especially this community for what is has to offer. Amazing!

It's truly appreciated 👍🏻
[Magisk] V0latyle:
If you're talking about passing STRONG_INTEGRITY, yes...

However, if you are not passing any verdicts, or only passing Basic, Play Store will not show "Device is certified" and you will not be able to install many apps.

Speaking of, for the sake of everyone else, I did some testing, so here's your answer on Play Store certification vs Play Integrity verdicts

Changed to print that I knew would only pass BASIC.

Killed Droidguard, cleared data for Play Store.

Opened Play Store. enabled Developer Options (tap Play Store version 8x)

Go back to main Play Store screen, then check Play Protect certification (profile icon > Settings > About > Play Protect cerification: "Device is not certified"

Changed back to working print, killed Droidguard

Cleared data for Play Store

Opened Play Store, enabled Developer Options

Go back to main screen, then check Play Protect certification: "Device is certified"

Result: You must have MEETS_DEVICE_INTEGRITY to be Play Protect certified. If you are passing DEVICE but Play Store does not report certified, clear Play Store data.
[Magisk] rodken:
Interesting, after a recent clean re-install of my Custom ROM, these are my findings on my OP8 on a Custom ROM running PlayIntegrityFork v6:

I am not passing any verdicts, Play Store does not show "Device is certified" and I am still able to install apps and updates apps without any issues.

Killed Droidguard, cleared data for Play Store.

Opened Play Store and enabled Developer Options

Went back to the Play Store screen, then checked for Play Protect certification

I never changed the working print, killed Droidguard

Cleared data for Play Store

Opened Play Store, enabled Developer Options

Went back to the main screen, checked Play Protect certification: "Device is still not certified"

Nevertheless, I am able to add cards and use Google Wallet at 2 different establishments within the past 24 hours.
[Magisk] V0latyle:
Play Store certification won't necessarily affect your ability to use Wallet. If you don't already have Netflix installed, try to install it, you should get a message "Your device is not compatible with this version"
[Magisk] osm0sis:
Did v5 migrate your print for you? If so, did you forget to back the updated file up? If so, when you set up your device again did you try reflashing v6 *after* placing the older custom.pif.json so that it would migrate it again? You can also run migrate.sh manually on it. Also, when in doubt, check the logs.
[Magisk] bl3d2death:
Since a few days wallet don't work anymore. Even last fix update helped.

Wallet is still on deny list in magisk.

Anyone some idea?
[Magisk] TotallyAnxious:
Just updated all my jsons. Each one still passed after migration done by the module.

I wasn't aware that this didn't happen automatically when changing the json but you have to use the script or flash module and reboot to do it.
[Magisk] majorfigjam:
Read the last few pages. You'll see the same question as yours answered multiple times.

In short, Google blocked the print in v15.1, YOU need you find a print yourself to use with the latest version, or switch to a fork that does it for you.
[Magisk] V0latyle:
Does Wallet say your device meets security requirements?

If not, have you checked your Play Integrity verdicts?

If they're failing, have you tried finding a custom print?
[Magisk] SteweEliteModder:
So... after downloading a new PIF (old one was missing) through this guide:

[MODULE] [DATA] Custom PIF.JSON files collection for Play Integrity Fix

A collection of pif.json profiles for the Play Integrity Fix module by @chiteroman or the fork by @osm0sis. TheFreeman193/PIFS on GitHub Detailed instructions are on the repository homepage but you can either copy a file manually or run the...

xdaforums.com

the device integrity is ok, and so now works the play integrity fix v15.1 and latest version 15.2 too, so was a problem with the old PIF, so new question... would be possible make a magisk module or an app to download easily a new PIF? 🤓