yashsingh1/xdaforums huggingface dataset:
[Magisk] Neppomuk_:
I guess this is the name behind die linux version number (cat /proc/version) right? So you're right. In my case it's "lineage".
[Magisk] manjaroid:
Yeah, easy for me to say when I'm running stock everything. Betcha the custom ROM and/or kernel are the trouble makers.

Edit - Beware of LOS kernel sigs mentioned in recent posts.
[Magisk] simplepinoi177:
I mean....there are some members who have had their one fingerprint not fail since November; mine has been passing since Dec. 8. So....

At the very least, it'll most likely last a lot longer than the xiaomi.eu fingerprint...
[Magisk] 666biker:
for future weekly or monthly LineageOS nightlies acros all currently supported devices temporary solution should be, that LOS developers will build nightlies with same kernel but should named it more generally? or this way can't solve current situation until some stable solution will be available?
[Magisk] osm0sis:
Yes, this. If every custom ROM and custom kernel developer removes any special branding from their kernel strings for their next builds all will be well again, for now anyway.

I'm currently trying to see if I can reproduce the issue on one of my test devices so I can make a list of known banned strings for us all to reference.

Edit: Got it to fail with Sultan and sultan on my OP9Pro, so we're off to the races, but one interesting finding so far is that it's not actually a case insensitive check like @Sultanxda thought, since SuLtAn passes, and it's definitely full name only since 5ultan passes too! 😮
[Magisk] manjaroid:
Dagnabbit, I was about to reply in many words but you're done already. (y)Glad you nailed it!
[Magisk] Umgak:
Exactly.

You can also find it in Settings -> About phone -> Android version -> Kernel version.

Mine is 5.4.259-qgki-g62f6bf8ea712 so mine passes.

In my case the qgki is the code name.
[Magisk] badabing2003:
That could be due to the print.

Have you tried with many prints?

Test with Xiaomi.eu print, if that passes, it means that you have to keep on trying to find a good print from pickaprint, if xiaomi.eu print fails, then it is either a setup issue or a kernel issue.
[Magisk] lupastro82:
Ty. Here found valid with Nokia/Panther 😊
[Magisk] Neppomuk_:
Ah ok, this is the same. Was not sure about.

Funny, one device with AICP Rom pass, lineage not because above reason, except one. My old Nexus 5 with unofficial LineageOS 17.1 does pass with spoofed device fingerprint. This one is shown as lineage. I guess the exception proves the rule.
[Magisk] osm0sis:
Just got there in my testing actually. 😏

Amusingly, the banned string isn't lineage or Lineage, it's specifically lineageos and LineageOS. 🤷‍♂️
[Magisk] 666biker:
it is very complex for an average user with root to change this LOS string in the kernel? :) re-build is needed, so all needed environment set and running on computer? not possible to change it via root and device itself?
[Magisk] osm0sis:
Answered earlier today here: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/page-516#post-89307799

I'm doing my testing with a hex editor on my laptop, but there's only one specific spot that really needs to be changed, and it's obvious since all the other uname info is spaced out into distinct strings around it.
[Magisk] zgfg:
Good work but it looks to me very primitive from the Google's side

Strange that G does not pair FPs with the Kernel names

Suppose you have a phone with a Qualcomm chipset, with the stock Kernel with its 'validt' qgki name

You spoof by PIF and with prints from a phone with an MTK chipset

And that would work - apparently it does now since the Kernel name is 'valid' on one side and prints are on the other?!

Or even, you spoof with the prints from another Qualcomm based phone but whose real Kernel name was different than yours (like qgki with a different number/version)

So DroidGuard finds and collects spoofed prints from a phone with First API from eg 2018, but together with the Kernel name belonging to a Snapdragon released in 2023, and that would be valid (for now), passing Device (and Basic) Integrity 😉
[Magisk] sawdoctor:
As @osm0sis keeps saying "low hanging fruit". Google have to appear to be making an effort to keep partners happy. They could easily ban all the prints if they wanted
[Magisk] osm0sis:
Yes... there is this though... https://github.com/chiteroman/PlayIntegrityFix/issues/236#issuecomment-1917496929

Excuse the mixed metaphor, but how likely is it that they spent all this time developing a better mouse trap just to have it be a sword hanging over our heads that they never plan on dropping?
[Magisk] simplepinoi177:
but it sort of begs the question, who are these companies (i imagine it was banking institutions more than any other) that were pressuring Google to do this? What exactly do they think LineageOS, and custom kernels (which are used mostly to improve device efficiency; although once upon a time on my Pixel 2 a custom kernel was needed to get GPay working with root; but that was so many years ago and not currently applicable) is going to compromise for them?! And I don't understand if Google was worried about devices removing the stock ROMs and kernels that allow users to input their own preferred -- thereby compromising "integrity -- as supposedly it's "our devices"/devices-we-own to break/compromise if we so chose to...!

And Google had always seemingly been open to modding the devices, or they wouldn't even give the option to achieve it and would lock it down like Apple.

So where are these supposed pressuring coming from? And why (how do they think LOS and custom kernels will "beat" them)?
[Magisk] Neppomuk_:
So two of my devices, wich do not pass, are both flashed with official LineageOS and the string is just lineage. I've got two working device fingerprints on other devices, but they do not on this, by the way both LeEco devices.
[Magisk] zgfg:
Seems to me they couldn't that 'easily' as we/you think- they didn't properly design the complete SN architecture from the beginning (at that time it was still SN, not yet PI) and they didn't properly collect the relevant data, etc

Hence they now make only the small, urgent repairs (many ppl use particular prints - so they ban just them, kernel name shows LOS, they 'ban') etc

It's funny, they ban FP from an Acer, you continue to spoof with the prints from the same Acer model but with FP from a ROM three months newer or older and it still works, and so on

(IMO, they did not foresee originally this spoofing activity to grow as big and vivid as it did)
[Magisk] osm0sis:
Can you give me the output of `uname -a` that fails?

I literally tested lineage, Lineage, ineage, lineageos, LineageOS, ineageos, and only lineageos and LineageOS failed.
[Magisk] zgfg:
Yeah, they are certainly financial institutions here.

But nowadays there are more and more e-citizen apps (that are even kind of mandatory in some countries). You authorize yourself and you manage your taxes, you access and manage your medical data, etc

And I'm pretty sure, there are also 'certain' agencies who make a big pressure that you have to run stock ROMs, with the stock apps and services preinstalled

Regarding the Wallet - for most of the payments you don't provide a pin, token or anything. Yet, you pay with the major cards that require 3DSv2 authorization.

Hence you pay, you didn't authorize but by 3DSv2, liability for the payment goes to the (card) issuer.

It means, if the card holder later proves that it wasn't him, he will get his money back and the payment to the merchant will be covered by the issuer

There are a whole bunch of related regulations, and they require for the 'integrity' of mobile devices used for that contactless payments (two months ago or so I posted some links with the concepts, high-level design, related protocols and so)
[Magisk] majorfigjam:
This was raised before. So again, TLDR.

Rooting gives full control over a device, with limited exceptions such as TEE. By definition, LOS and custom kernels imply the device is unlocked and can be compromised.

Google allows those who want to "compromise" our device for our own reasons, in most cases well intentioned, to do that. Some of us perceive that the risk is with us, if our own device is rooted.

Imagine though someone was less well intentioned, and they spoofed your Bank's app on their phone into thinking YOU were giving it an instruction, and money disappeared from your personal account. In that case, you are also at risk because another person's device is rooted.

That's what banks, McDonald's, Uber, Netflix, health providers, state agencies etc are trying to stop. Because the access controls are in the app, not server side as they are for browser access, they need to trust that their app has not been compromised.

They can't get absolute certainty because many customers still have old devices, but they can expect Google and Apple to make it a difficult as possible for malicious into the future.

And let's not revisit the plastic cards are even less secure argument. Yes they are, but that cat is long out of the bag, and banks can only limit the risk. They can though try to eliminate risk from new technology, and that is what they are trying to do.
[Magisk] sawdoctor:
I really insightive and informative discussion, i learnt a lot and it's extremely worrying for modded users.
[Magisk] sga999:
I'm failing with Essential PH-1 and Leeco with Android 13 and 11 with lineage string. But I have another PH-1 with Android 14 without lineage string, and it works. I'm using Fork v7 with PixelFlasher Freeman.

android 13 on Essential 1 - fails

mata:/ # uname -a

Linux localhost 4.4.302-cip81-lineage-gf56ac4aeb1a4 #9 SMP PREEMPT Wed Dec 6 08:21:08 CET 2023 aarch64 Toybox

android 11 on Leeco - fails

le_zl1:/ # uname -a

Linux localhost 3.18.140-lineage-g4b91b133f4b7 #1 SMP PREEMPT Mon Jan 1 04:43:52 UTC 2024 aarch64

andoid 14 on Essential 2 - works

mata:/ # uname -a

Linux localhost 4.4.302-cip83-Tom-g1b522c7f9b9f #7 SMP PREEMPT Wed Jan 17 11:57:29 CET 2024 aarch64 Toybox
[Magisk] osm0sis:
Maybe we're still seeing a roll-out, with more banned strings being added in newer revisions.
[Magisk] sawdoctor:
Think you need to read this thread i just read and you'll see how easily they can do it

Some kernel strings are blocked by Goolag · Issue #236 · chiteroman/PlayIntegrityFix

For example Sultan kernel on Pixel 7/Pro/a is blocked from Goolag since it has a string named Sultan in it. They are checking for blocked words (case insensitive) in the uname kernel string, so I w...

github.com
[Magisk] osm0sis:
Figured it out, and it's even more hilarious...

-lineage- is banned, not lineage :rolleyes::ROFLMAO:

Going to have to retest my other found strings now to see if - placement matters. :p
[Magisk] Cargonausorus:
Hello, I have the same problem with my Samsung Note9 Android Q10.

I updated to PlayIntegrityFix 15.4 and since then I have not passed the CTF profile matching test. Error message when installing the playIntegrityFix 15.4 module:

Extracting module files

! WARNING, the MagiskHidePropsConf module may cause problems

! The module does not include a certified fingerprint.

! You have to get it from the internet, search on XDA how to do it

! The pif.json template is located in the module folder.

! Move it to /data/adb/pif.json to spoof the values:

-Do

1 1

Thank you, I read what the error message said with the French translation. It's the procedure to do it that I'm just asking for help. (I still know how to read even if I'm a noob)
[Magisk] HippoMan:
Yes. And none of this applies to the plastic cards in my hardware wallet.

No PIN needed, neither for swipe nor for tap-and-pay.
[Magisk] majorfigjam:
Well actually, the bit about getting money back if you prove it wasn't you that did the transaction IS true in most jurisdictions.

There are equivalent rules for plastic card transactions.

Point is though, as you seem to conveniently ignore, is that banks or the merchants involved now have to live with card fraud. If someone clones your card, you shouldn't suffer more than inconvenience. If banks could get rid of the plastic cards in your wallet, they would.

They don't want to repeat the loss experience in future with phone apps though, and so are pushing to ensure their apps are secure to use, with less fear of malicious misuse.

Which leads to inevitable conflict between them and us, as we want to retain the convenience of phone apps, AND the ability to mod our own phones as we see fit.
[Magisk] HippoMan:
Of course. But it will take a l-o-o-o-ng time before major banks (at least the ones in the U.S.) will phase out plastic cards.

And it's unlikely that in the interim they'd be able to urge very many people to switch to using mobile-device tap-and-pay and stop using their plastic.
[Magisk] majorfigjam:
Agreed, but that will not stop them from trying to minimise loss in the future. Trying to secure their apps from malicious compromise is one way they can do that.

Meanwhile, this group is trying to stay one step ahead, so we can do what we want with our devices, without malicious intent, and knowing the potential risks to us from doing so.
[Magisk] osm0sis:
Just for everyone's knowledge...

If the kernel isn't compressed you can hex edit it in the boot.img directly, BUT if it IS compressed you'll likely have to unpack the boot.img, then decompress the kernel (Image.gz or Image.lz4 nowadays, though Image.xz or Image.lzma are also a possibility), hex edit the decompressed Image, recompress it, then repack it back into a boot.img. magiskboot can do all the packing/compression stuff.

What you're looking for is this exact area in the file in your hex editor, and this is the only place you'll need to change anything.

View attachment 6062034

Oh, and don't change kernel version numbers, your ROM will probably freak out. :p

This is just for testing purposes however, the real answer for everyone at the moment is to go tell your custom kernel developers and ROM maintainers to remove their branding from the kernel build versions strings. (y)
[Magisk] Umgak:
Interesting that they didn't block +blu-spark-custom. I wanted to change it to blu-spank but you don't even need to.
[Magisk] osm0sis:
Yeah, I think they screwed up and hilariously only blocked blu_spark, which @eng.stk doesn't even use. :LOL:🤫;)
[Magisk] HippoMan:
Of course. That's pretty much the only reason for most of us being in this thread.

We will ultimately lose this cat-and-mouse game, but at least we're able to keep dragging it out for as long as possible.

And in the mean time, I'm very happy to always be using my hardware wallet.
[Magisk] osm0sis:
Here is the current known list of banned kernel release strings! They are case sensitive, exact substring matches. Check `uname -r` on your device to see if you are affected.

I won't share my complete "NOT Banned" list here, since I doubt Google will pay me a consultant fee for doing their homework for them (😛), but rest assured that I tried over 200 strings for various custom ROMs and kernels, old and new, and if I did get a fail that I then tried all possible variations of the keyword(s) and these were the only matches.

-AICP
-arter97
-blu_spark
-CAF
-cm-
-crDroid
-crdroid
-CyanogenMod
-Deathly
-EAS-
-eas-
-ElementalX
-Elite
-franco
-hadesKernel
-Lineage-
-lineage-
-LineageOS
-lineageos
-mokee
-MoRoKernel
-Noble
-Optimus
-SlimRoms
-Sultan
-sultan

This list is by no means exhaustive, so if you find one you think I missed, let me know and I'll test it properly and add it to this post if it does seem to actually be banned.

Congrats to the (un)lucky developers for being immortalized in DroidGuard! 🤘

(Also, funny that some of them haven't made a kernel/ROM in years... ;))

Edit

:

Since this list was published, kernel developers have quickly come up with ways to circumvent the check on their side, so if the kernel you're using really seems banned inform your kernel developer/ROM maintainer to either adopt one of the patches linked below or remove their branding for their next build:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

If the kernel/ROM is EOL and unmaintained then you can consider trying to hack it manually if switching to another kernel/ROM isn't an option. Please see the brilliant and safe patching scripts by @badabing2003 and @TheFreeman193:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] bleh815:
(Sorry for this delayed response. I was replying while stilling reading through the thread)
[Magisk] osm0sis:
No point in posting stuff like this; see my post above yours. People only need to type `uname -r` and see if they have a Lineage device kernel which matches the banned forms I've listed.
[Magisk] Umgak:
I was about to say, when was the last time anyone heard from SlimRoms? Optimus Drunk's dev is on crDroid now, and franciscofranco hasn't posted on xda in 2 years. Did you check for CyanogenMod and Resurrection Remix? :p
[Magisk] beeshyams:
I seriously suspect that it is ad-hoc reactions at various levels and at different points of time and NOT a part of policy driven approach.

I know that's unlikely in a mega corporate working but that's the best explanation (for me) that fits these data points over last quarter
[Magisk] zgfg:
I'm not talking about which kernel strings have been banned (currently on the surface) but generally about what is possibly going on on the G side and what can we or not expect in this game for future (based on the SN/PI evolution since eg 2021 and the patterns in spoofing-mice and 'banning'-cat side we have experienced so far)

(And I've been in this thread and the related/predecessor ones - starting with MHCP, over USNF, actively for long, so I'm not a newcomer to the SN/PI game, parashooted from nowhere and asking a newbie questions😁. But anyway, everybody can have his own opinions)
[Magisk] majorfigjam:
My assumption is that for now, this is all manual intervention driven by simple metrics. Their high volume integrity checking is likely not yet scaleable to check in real-time that every one of the millions of fingerprint checks is 1) from a locked device, or 2) the fingerprint matches against the full list of possible device characteristics in the Playstore whitelist from that class of device which it claims to be, and 3) the kernel matches a possible "stock" kernel ID combination for that fingerprint. So they deal with exceptions, and filter for "bad" kernels as well as "bad" fingerprints

In the same way as the most likely reason for blocking the initial packaged prints was the unnatural rate of checking from obscure devices (mostly driven by Telegram users), they will have gathered data that shows the kernel ids of those otherwise obscure devices that were blocked for unlocked devices. Maybe the long holiday hiatus was an opportunity to gather that data. It's then trivial to create the new blacklist for kernels and check for them as well

Time will tell how regularly they extend the kernel list, but without the very obvious spikes in devices, it may take some time to gather additional reliable data on devices being spoofed.
[Magisk] 666biker:
It is enough to download boot.img file from the LOS device nightly download page and edit it (most probably need to be extracted to see that kernel string data?) and flash back via TWRP?
[Magisk] sawdoctor:
It's not about kernel strings it's what /how droidguard is now checking. If you read osmosis comments it means it will be impossible to spoof if/when they inforce it.
[Magisk] eng.stk:
I need to rebrand to blu_spank, it's just too good :ROFLMAO:

This is so funny, I can't even lolol
[Magisk] 0purple:
Mind also testing strings from 4.14.320-perf obraxys 4pda
[Magisk] osm0sis:
Yes, TWRP or fastboot, but if you're not completely comfortable with all the instructions there, you probably shouldn't be doing that and should just go put pressure on your ROM maintainer to fix their kernel strings for the next build.

Will do!
[Magisk] 666biker:
I already posted that wish to thread for my device and LOS version, but without any response, so not sure, if it will be considered in next build or even if it will be considered at all for my device / LOS version :)

Regarding boot.img extract/edit needed string, just need to find the right step-by-step guide and will try it probably
[Magisk] osm0sis:
I had checked Resurrection Remix and it passed, but thought CyanogenMod was way too old! But nope! Hahah, added to the Banned list. 🤣

(Edit: AICP too! 😮)

I also checked myself (osm0sis, osmosis, anykernel, AnyKernel, AnyKernel3, AK3) out of curiosity (no hits, whomp whomp), just since whoever's assembled this list seems THAT level of uninformed. :p

No hits from obraxys, Obraxys, 4PDA or 4pda. If you're failing it is from some other reason. (y)
[Magisk] arter97:
"look mom, i got recognized by google"

"cool how"

"i got banned"

"you what"

This'll be an interesting family reunion.
[Magisk] Neppomuk_:
Sorry for delayed answer, The string is:

Linux localhost 3.18.140-lineage-g4b91b133f4b7 #1 SMP PREEMPT Mon Jan 1 04:43:52 UTC 2024 aarch64
[Magisk] osm0sis:
Yep, already solved. See my last few posts.
[Magisk] Neppomuk_:
Realized it right now as I read the missed posts.
[Magisk] 에어 론 리:
Android transformed from free opensource OS to not free semi-opensource OS
[Magisk] V0latyle:
No...Android is still open source. It's mainly supported and controlled by Google but Android itself has no closed source components.

Google services and other OEM aspects (bootloaders for example) are not open source.
[Magisk] 에어 론 리:
Essentially, this is an abuse of the monopoly on the Android market.

Google controlled every aspect in Android OS sphere, and only Google can license or make certification for work 3rd party payment, banking etc. no visible real alternatives to GMS (say hello to HMS due US sanctions).

Root almost illegal, everyone afraid to unlock BL.

"You will be free to install any custom open-source ROMs" they said before.

But they didn't tell us that these ROMs will be punpkin due Google want money.
[Magisk] in_dmand:
So I'm having an issue with RCS chats in messages. It's been working fine for the past month or two since I got my pixel 8 and rooted but now it is having issues. When troubleshooting I found that I'm getting a CTS fail when I run a safetynet checker...

View attachment 6062304

I have magisk hidden but found that the deny list keeps unchecking "Google services framework" so not sure if this is the issue?

View attachment 6062306

View attachment 6062307

I am on the latest update of the safetynet module (2.4.0) and as you can see I tried the displax mod to no avail.

Any ideas?
[Magisk] hyad94:
Please be sure you followed all my screenshot steps. For now use Play Integrity fix 8.8, not 9. If you use twrp recovery, you probably have folder named twrp in the storage deleted it (will reappear after reboot). If not working after all that. I dont know. My banking app working super fine with Shamiko.
[Magisk] UberNorse:
Working as standalone on P7P Android 14 and Magisk 26.3. Thanks as always.
[Magisk] matfcb:
9.2 works on Xiaomi Mi 9 Pro 5G. 9.1 didn't work. Let's hope 9.2 will stay for a long time.
[Magisk] zgfg:
Same for Xiaomi Mi 9T, Xiaomi.eu 12.5👍
[Magisk] excogitation:
Any idea what needs to be hidden for RFID payment to work?

Opening the wallet and then paying does work for me.

Thank you and sorry for x-post.
[Magisk] Rayeski:
My Samsung Note 9 (Exynoss) pass device integrity and basic integrity, but with latest shamiko and play integrity fix cannot pass strong integrity, can someone help me?
[Magisk] chiteroman:
Read OP
[Magisk] chiteroman:
Are you using Google Wallet? Check PI: https://play.google.com/store/apps/details?id=gr.nikolasspyr.integritycheck
[Magisk] chiteroman:
Is it necessary Shamiko? My banking app works with deny list on