yashsingh1/xdaforums huggingface dataset:
[Magisk] GabbyWC:
My mother's Redmi Note 5 Pro (whyred) with the Pixel Experience Plus v12.1 custom ROM was downgraded from device to basic integrity after Google implemented more countermeasures in late January. The custom fingerprints which currently pass device integrity on my phone don't do that on her phone because of the kernel string which contains EAS. However, I tried an RCS chat on her Google Messages app yesterday and it still functions properly. The post at https://xdaforums.com/t/info-play-integrity-api-replacement-for-safetynet.4479337/post-89277475 and some later ones indicate that the PI status does affect RCS.

I also have a Redmi Note 9 Pro (joyeuse) phone which is from the miatoll series of devices. There are XDA threads for LineageOS ROMs but the policy for official builds is that they do not bypass integrity checks according to https://wiki.lineageos.org/quirks/snet/. You're better off doing a clean flash of a different custom ROM which passes basic and device integrity to begin with. I'm using PixelOS 14 which generally works well aside from a few issues such as silent Bluetooth phone call audio and battery performance that isn't fully optimized yet. Evolution X is another custom ROM which is based on Android 14 and contains more customization options.
[Magisk] trevtdogg:
I think it was pretty obvious and clear that @osm0sis suggested the best fix is for custom rom devs to change the kernel name in future builds / updates.
[Magisk] osm0sis:
And kernel devs already have a patch making the rounds to still try to have their cake and eat it too 🎉:

kernel/sys.c: implement custom uname override · arter97/android_kernel_nothing_sm8475@8861034

The uname system-call will return CONFIG_UNAME_OVERRIDE_STRING on struct new_utsname->release when a process with CONFIG_UNAME_OVERRIDE_TARGET included in its cmdline calls it. Signed-off-by: J...

github.com

(courtesy of @arter97)

Or

kernel/sys.c: Strip localversion from uname for GMS processes · kerneltoast/android_kernel_google_zuma@a62571e

Play Integrity now hashes the kernel's localversion and compares it to a blacklist of localversion hashes for the purpose of failing Play Integrity attestation. Among the banned localversion h...

github.com

(courtesy of @Sultanxda)
[Magisk] mike.s:
...because, as everyone knows, iPhones are easily rooted and customized. Apple allows you to sideload applications. In fact, the basis of iOS is even published as open source!
[Magisk] rodken:
[Off-topic] I agree, that some popular custom ROMs have started bundling GApps again, seemingly without explicit objection from Google. Maybe, the shift could be due to various factors, such as evolving licensing agreements or interpretations, recognition of the importance of GApps for user experience.

Even though some big-name custom ROMs are back to bundling GApps, maybe Google seems chill about it?
[Magisk] mike.s:
Show your work.
[Magisk] H4R0X:
Anything I try with magiskboot won't work, I will just compile the whole kernel myself once I've setup the environment for it.

Just wondering but wouldn't it be possible to create a magisk module which changes the kernel version output for everyone to some generic string ? can magisk modules act as kernel module ?
[Magisk] IJOJOI:
I've just updated my Pixel 7 Pro and rerooted it.

I'm running the newest Magisk/Play integrity fix and have a valid footprint and pass basic integrity.

However I fail at the virtual integrity check.

What did i do wrong?

Spoiler content hidden.

Apps still detect root aswell, even though I pass root detection in TB Checker
[Magisk] chiteroman:
Virtual verdict is only for emulators... (You can read it in your screenshot)
[Magisk] osm0sis:
AnyKernel3 already exists, but I've explained to you and others multiple times in the last 2 days why using it to try to automate something like this is a bad idea: it'll break as many devices as it fixes.
[Magisk] IJOJOI:
Ohh, thx for the quick answer.

So I shouldn't have any problems.

Maybe I'll need to delete App Data again.

Also thx for your great work!
[Magisk] V0latyle:
Actually everything that happens at the hardware/bootloader level is OEM, not Google. However, Google does have the ability to revoke keys for devices with bad/broken keystore implementation. This does not affect Android itself, only GMS

Correct

Bootloader uses key matching to determine whether the AVB key is OEM or custom, boot state is verified by TEE. There are four states:

GREEN for locked on OEM key + verified firmware

YELLOW for locked on custom key + verified firmware

ORANGE for unlocked - key is ignored, firmware is not verified

RED for locked, firmware failed verification

Again these are all confirmed by TEE, so while we can spoof a locked bootloader in userspace, TEE still snitches on us

The only circumstances under which we've been able to bypass this is with bad/broken keystores

Otherwise, you'd need the OEM key - easy enough to sign modified firmware with a key, but if it leaked, it would get revoked

Or, you'd need a hacked bootloader to recognize a different key, but then you're opening a whole new can of worms because SoC OEMs use hard coded verrification methods to determine bootloader is genuine and untampered
[Magisk] rat7lol:
I've made a pull request like this here:

revert nx659j.config changes by katazina0 · Pull Request #1 · DD3Boh/android_kernel_nubia_sm8250

remove the "-LineageOS" local version string which causes PlayIntegrity checks to fail MEETS_DEVICE_INTEGRITY more info on XDA: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.46079...

github.com

If the build is UNOFFICIAL, you could try contacting them directly through private messages or wherever you can find them
[Magisk] Bladius:
Still not fp
[Magisk] Zenman85:
I cannot pass device integrity anymore and I have the latest play integrity fix installed.

I only have Revolut and one other banking app in my deny list.

Can someone help me? I've seen people saying that I need a fingerprint, but I have no idea how to get one. Isn't there a more simple solution?
[Magisk] :
Come again?
[Magisk] :
Read https://github.com/TheFreeman193/PIFS carefully.

On top oft this, post the outcome of "uname -r" from a terminal emulator.
[Magisk] sawdoctor:
The very easiest way but it is not the best is to use play integrity next fork. But the fingerprint is more likely to get banned. If you want to find your own which is the best way then pixelflasher is the easiest way. Try reading one of the guides on finding a fingerprint, honestly it's not as hard as it seems and as long as you are willing to try plenty of us will help
[Magisk] Zenman85:
Ok, thanks! Will do, when I have some more time(next couple of days)
[Magisk] pulpf:
I also prefer a locked Android

But I think Android has attracted a lot of users because it allows customization.

They take risks.
[Magisk] pulpf:
My pif doesn't work anymore and I'm not on a custom rom my oneplus is just root with Magisk canary
[Magisk] Nergal di Cuthah:
New fingerprint time
[Magisk] :
I'd think that most users choose android because of hardware capabilities and price.

I'm choosing hardware because of Lineage compatibility, but I'm aware that I am part of a very small minority. There are jail breaks for IOS as well. $ 0.02
[Magisk] zgfg:
Just a warning for those who use Hide My Applist (HMA)

If you have a 'banking' app that needs to check Play Integrity (you never know so better assume it does), and for whom you use HMA (to hide Magisk app and/or LSPosed modules) then either configure in HMA for that app:

- Blacklist mode with a Proper Blacklist template

or

- Whitelist mode with "Exclude System Apps" enabled

Ie, do not try to use:

- Whitelist mode with "Exclude System Apps" disabled

In the latter case, the particular (banking) app will not be able to check Play Integrity (or SafetyNet)

The following screenshots show how TB Checker, SPIC, Play Integrity Checker and YASNAC report errors if Whitelist mode with the disabled "Exclude System Apps" is applied in HMA to them

(Btw, some of them wrongly complain about 'missing' Google Play Store although the API for attesting PI/SN comes through Google Play Services, nott through the Play Store)

And a Playstore (Developer Options) - it shows no Integrity (empty list) without describing the problem

Hence a given 'banking' app would similarly fail but usually with no explanation
[Magisk] Nergal di Cuthah:
I prefer the exploitless root of my pixel. Problem with jailbreak is that they're exploits which get fixed and you have to jump hoops/wait every update (though if i remember correctly samsung has to be exploited too. Love my pixel)
[Magisk] :
Agreed, but with G banana'ing fingerprints or kernel suffixes the difference becomes smaller. 😉
[Magisk] 0purple:
Hi, can anybody help me?

Device: Redmi 9 (lancelot)

ROM: crDroid 10.1

Kernel: Lineage with KernelSU v0.7.6

uname: 4.14.320-perf

Related modules: Shamiko v1.0.1, ZygiskNext v4-0.9.1.1

PIF: Cat (well-known but not banned, won't publish here)

Case 1: PIF v15.4 - NO_INTEGRITY

Case 2: PIF v15.2 - BASIC_INTEGRITY

Will be happy to share any additional info, thanks!
[Magisk] V0latyle:
not to mention that Apple intentionally bricks exploited devices...the closest thing to this is Samsung's Knox, which only affects a few Samsung specific features and doesn't affect the operation of Android itself in any way

Samsung devices don't have to be unlocked or rooted via exploit, they just make it difficult because they don't follow the Android model - they don't use fastboot interface, they use a proprietary download mode
[Magisk] pulpf:
The atmosphere has changed here, before it was mutual aid, the moderators seem to be there to make fun now.
[Magisk] Nergal di Cuthah:
Not sure if you mean my response to you (as i see no moderators replied to your posts), which (apart from the laughing emots that some people put on it) was completely serious
[Magisk] Flr Power:
Don't use 15.2 and also using lineage kernel is now being detected by google...
[Magisk] 0purple:
Well, 15.2 gives me better results than 15.4. Also, the uname does not contain any banned strings, so it should not be detected, right? There is no other kernel for me to use anyway...
[Magisk] V0latyle:
Not sure what you mean, we mods are all held to a professional code of conduct. That's not to say that we are immune to the same frustrations as everyone else when people repeatedly ask questions for which answers are readily available. This issue has been beaten to a pulp, and it is now well established that people need to read before asking questions, and be willing to look for information instead of asking for someone to hold their hand and walk them through baby steps.

Contrary to popular belief, there is such a thing as a "stupid question" - it's the question that has been answered in detail many times but is asked again anyway.
[Magisk] rat7lol:
Use uname -a instead to see the full string
[Magisk] zgfg:
Btw, uname -r gives just the kernel name (-a prints additionally domain/host name, hardware name, userspace type, etc)

Btw, full info about the kernel build, with the kernel name and version (date/time of build) can be obtained from cat /proc/version
[Magisk] osm0sis:
To be fair, uname -r is all Google is checking currently (except they're doing it via syscall, not the command, of course).
[Magisk] Nergal di Cuthah:
@pulpf you quoted me but said nothing
[Magisk] pulpf:
It didn't concern your reply but the reactions to your reply 😂 Is indeed a reaction from a modo but it's not important
[Magisk] V0latyle:
No need to read into it, you'll quickly arrive at assumptions that are incorrect

Nobody here is making fun of you
[Magisk] Nergal di Cuthah:
Back on topic. Does kernelsu use a vanity string? Are they overreaching to capture that novel way of root. Or is it not a kernel and I'm reading into the name too much
[Magisk] pulpf:
Wouldn't it be possible to put a summary of the different methods on the 1st page and upgrade them as they evolve to avoid this problem, as we end up with more than 500 pages.

And I wasn't asking a question.
[Magisk] pulpf:
Ok
[Magisk] osm0sis:
They do not, if it's one of their official default prebuilts they have no branding whatsoever, since they're meant to mimic AOSP stock GKI, but add root.

If it's a custom kernel that has KernelSU support added to it for a legacy non-GKI device, then all bets are off.

`uname -r` should clear it up in a hurry every time.
[Magisk] V0latyle:
Well...this particular thread is owned by @chiteroman so it is completely up to him, and we moderators are not in the habit of telling people what to post - outside of what's prohibited by the rules, and what is required per the GPL policy for development

@osm0sis got tired of a lot of the repetitive questions and created a FAQ:

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com
[Magisk] osm0sis:
Dude, I literally just made a FAQ because nobody else was stepping up. 🤦‍♂️

It's stickied. 😛

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com

If there's something you think I should add, I'm open to it. (y)
[Magisk] Nergal di Cuthah:
@osm0sis has a faq up, but yes it could have mention to the various ways and means (still, it's very informative)

Edit:ninja'd by the man himself
[Magisk] osm0sis:
Ways and means go in my README which people are directed to once they understand the basics from the FAQ.

Learning curve goes like this: My FAQ -> My README -> My PIF Guide + scripts, or @badabing2003's UI Flow Guide + PixelFlasher. Alternately @simplepinoi177's Even "Noobier" Guide if people are finding the first 2 guides too advanced.
[Magisk] V0latyle:
My mistake, I haven't been paying close attention to this thread and I'm sure you understand why (not)
[Magisk] pulpf:
It's hard to keep track of all the changes from page 1 to 525.

There are several ways to get your fingerprint, but after a while it doesn't work.

So which method to use, the most reliable, etc.?

Even when you're willing to do the research, it's complicated.
[Magisk] osm0sis:
You reacted to my PIF FAQ thread OP with 😍 on Sunday when I posted it.. 🙃❤️
[Magisk] remoh:
I opened a bug report at lineageos, but it got closed after a few minutes.

... just one part of the cat and mouse game ... feature request, we dont do that
[Magisk] osm0sis:
Yeah they don't accept that stuff on GitHub, you'd have to open an issue on their bug tracker. And it has nothing to do with "hiding" or actively "evading", it's just that they need to not mistakenly contribute to being detected due to their technically unnecessary kernel strings on some devices. I'm sure they'd be open to fixing it globally it if it's framed correctly.
[Magisk] V0latyle:
All the ways to "get" a fingerprint still work. If you pick a print used by many others (such as the Xiaomi.eu prints) there's an increased chance it will stop working sooner.

I will admit this can be a little difficult because from your end, you have no way of knowing if there's something wrong with your configuration, or the print you're using doesn't work. The only thing I would suggest is see if someone is willing to share a known working print with you (if the Xiaomi/PiNext one doesn't work) to test your configuration, BUT you should still find a random print.

I know. Trust me, I know.

Fortunately a lot of it has been streamlined, especially with Pixel Flasher. I made a small cache of working prints this way:

I found a device with a working print mostly through trial and error

I then downloaded the build.props for all builds for that device on Tadiphone

I used Pixel Flasher to process the build.prop into JSONs, then push those JSONs to my phone

I tested each JSON and saved the ones that worked

And promptly forgot about it, I had every intention of reading it and bookmarking it

My attention span is very short these days...having a 5 month old tends to do that to you
[Magisk] 0purple:
Linux localhost 4.14.320-perf #1 SMP PREEMPT Thu Feb 1 12:50:38 +06 2024 aarch64 Android

Linux version 4.14.320-perf (vas@WORKCOMP) (Android (8490178, based on r450784d) clang version 14.0.6 (https://android.googlesource.com/toolchain/llvm-project 4c603efb0cca074e9238af8b4106c30add4418f6), LLD 14.0.6) #1 SMP PREEMPT Thu Feb 1 12:50:38 +06 2024
[Magisk] osm0sis:
Yep, nothing wrong with your kernel. Something else is wrong with your setup.
[Magisk] remoh:
I followed tgis one, i think it is their official way to report bugs?

How to submit a bug report | LineageOS Wiki

wiki.lineageos.org

Anyway, i either will find a way to change the kernel myself or get a new phone and say goodbye to custom roms. Would like to stay, but meanwhile it causes so much more effort than just taking stock and live the downsides.
[Magisk] 0purple:
Interesting, I have confirmed with the kernel dev he has the same issue on his device. Not sure about the exact setup, but the integrity symptoms match. Where should I look for an issue? Of course, there is the good old "clean flash, see where it breaks," but I really don't want to spend that much time.
[Magisk] osm0sis:
Ah, yup, I can relate to that one! My very-nearly-2-year-old had us running on fumes for quite a while there! It's a grind but once they sleep the night it gets a lot better, then getting her fully on food only, and then daycare were the next big milestones that made us feel like we had some of our lives and sanity back. :)
[Magisk] sawdoctor:
Several of us are still using our first found fingerprint from the end of November so stopping working after a while isn't all that common
[Magisk] V0latyle:
Yeah, we are hoping to settle into a good routine soon

To say we are sleep deprived is an understatement

Yeah I forgot to mention that, using a fingerprint that few (if any) others are also using greatly reduces the chances that print will stop working.
[Magisk] justDave:
I haven't had much luck editing my Pixel 2xl LineageOS boot image. "-lineage-" appears in 2 places. I've tried changing either one and then both to "-lineege-" and none of the patched images will even boot. I changed them back and it boots again so I don't think VSCode is corrupting the image.

A patch is coming in next week's build (thanks @npjohnson !) but I was getting impatient.

Is there a checksum or something on these boot images?
[Magisk] osm0sis:
Sometimes! But it's not usually enforced. Maybe your kernel is compressed even though the strings were visible, and so when you changed them it broke the decompression during boot-up.

Glad to hear @npjohnson is on the case! That's a good sign for all of Lineage removing the branding from their affected device kernel strings like we were hoping. 🥳🤞
[Magisk] mike.s:
People have gone through the effort to document what's needed. Those posts are easily found by looking under the "TOP LIKED POSTS" section found on each page. One could also read the most recent 10 or 20 pages to discover current status. It doesn't take a lot of effort.

But, lots of people are too lazy or ignorant to do that, so the same questions get asked and answered again and again.
[Magisk] Nergal di Cuthah:
Though in the case of this thread recent 2-3 days as 10 pages might only cover that day when this thread gets busy (even more busy than it is today).

Edit never mind 26 pages is friday (and this week was pretty busy)
[Magisk] kiwigi:
Just a bit off track...

And all of a sudden, believe me, you belong to the grey brigade and the kids have left home.

Enjoy them as they grow. It is tough at times.
[Magisk] chiteroman:
I modified kernel/sys.c and added this:

static void override_custom_release(char __user *release, size_t len)
{
char *buf;

buf = kstrdup_quotable_cmdline(current, GFP_KERNEL);
if (buf == NULL)
return;

if (strncmp(buf, "com.google.android.gms", 22) == 0) {
copy_to_user(release, "4.14.180-perf-g2c687cdb9430", strlen("4.14.180-perf-g2c687cdb9430"));
}

kfree(buf);
}

SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
{
struct new_utsname tmp;

down_read(&uts_sem);
memcpy(&tmp, utsname(), sizeof(tmp));
up_read(&uts_sem);
if (copy_to_user(name, &tmp, sizeof(tmp)))
return -EFAULT;

override_custom_release(name->release, sizeof(name->release));
if (override_release(name->release, sizeof(name->release)))
return -EFAULT;
if (override_architecture(name))
return -EFAULT;
return 0;
}

(Thanks to @arter97 for the original code)

Using my new module with "magic" fingerprint I can pass Strong again 🎉
[Magisk] Fishawy:
Doing something like this the first time around is what got Google to start the ban campaigns in the first place.

I'm not sure what the end purpose of this is (can only guess), but as there's no 'real benefit or practical win', please don't give Google more reason to screw us up even more.
[Magisk] Slim2none4u:
Oh you got a line on what google thinks and does? You don't know that guy! Get off your high horse!
[Magisk] Stаr:
I have a similar issue on a Redmi 10C running SuperiorOS with 4.19.157-perf kernel (stock kernel from Xiaomi) that suddenly stopped passing DEVICE with a custom fp that still passes on two other devices so it's not banned. I'm guessing this is some A/B test thingy and we just got unlucky, or something else we didn't catch from the Jan 25 update.
[Magisk] Fishawy:
No point in arguing over this. I'll leave that for the mods and members to decide if there's any 'high horse' in the matter.
[Magisk] Umgak:
You do realize that the old Safety Net Fix by Displax was working for months with no fingerprint changes, and then a week after we started playing with STRONG integrity PI immediately became a game of whac-a-mole, right? I'm not saying that anyone here knows what Google thinks, but we know what Google has done and specifically when they've done it. For a glorious week in July 2023, you could bypass Strong, and ever since, PI has been a big pain for a lot of people with sometimes daily rollouts of new patches. There's no reason to be antagonistic to others for sharing concerns about things that literally have already happened several times.
[Magisk] osm0sis:
You're kinda glossing over the part where you needed to break your device for this, yeah? 😛
[Magisk] HippoMan:
And in the mean time, I'll just stay on my High Hippo. :)
[Magisk] intel_core_i7:
At least when I "root" my ifone I don't have to mess around my device every month or so because apple pay would stop working. It doesn't give a f if my device is modded.

Finding an exploit to mod (not every mod is a jailbreak, newer ios versions/devices only have "semi-jailbreaks") on ios devices is difficult, but when it's discovered and properly documented it's just more fun and rewarding than rooting an Android device. Because most mods these days carries jailbreak features but the way it works is not a full jailbreak, it's a worry-free experience because it's undetectable by banking apps or such.

Customizing things that some is not even achievable on a rooted android device without worrying about your device being cripped because some apps deemed it "too unsafe" seems better to me. On Android I suppose we have custom ROMs per equivalent as modern iOS modding (same features without full root/jailbreak), but then you have to play the cat and mouse game with PI

I prefer modding iOS devices more these days, nothing goes wrong if you don't update your device. I have never seen anyone reporting apple itself bricking your device, it's mostly the user doing something wrong that it's just unable to recover, just like android.
[Magisk] Nergal di Cuthah:
View attachment 6062939

It was supposed to be a hippoman riding a hippo, but bing can't do hybrid animals yet
[Magisk] HippoMan:
I love it!
[Magisk] Nergal di Cuthah:
Have at it, it's bing dal-e drawn so no copyright on my or other's part
[Magisk] HippoMan:
Oh, that's good. Thank you! If I can find some spare time, maybe I'll be able to tweak it so that the holster is actually a hardware wallet holding plastic bank cards.