yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
FYI/FWIW, I'm pretty sure we had no such issues with pre-2.4.0 USNF builds that used 'full-time' spoofing.

@kdrag0n delayed publishing 2.4.0 for some time so users were using @Displax 2.3.1-mod builds as his basic hardware backed evaluationType enforcement bypass fixes had become essential due to Google changes in the meantime and @kdrag0n was reluctant to include the new prop/field spoofs before finding a way to 'scope to Play Integrity code by identifying methods it calls near the beginning and end of integrity checks, and adding hooks to set and restore the fingerprint.' https://github.com/kdrag0n/safetynet-fix/pull/207#issuecomment-1195452147

When @kdrag0n finally published 2.4.0 (including the hardware backed evaluationType enforcement bypass fixes) he said:

but while it seemed to be ok for many bank apps, transient issues (I think especially immediately after booting phone) broke G Pay pretty much universally... If users reset G Pay it would only last a short time (also, seems G Pay can detect failed device integrity, disabled lock screen etc and disable bank cards in the background even when not running; possibly by using play services to flag the changes) so users moved back and continued to use @Displax 2.3.1 based builds...

@Displax produced more builds based on 2.3.1 (without dynamic runtime spoofing) and they seemed to work well for all. Later he switched to 2.4.0 base after committing a couple of fixes for the transient issues... These seemed to work ok for most, but we've seen such reports of G Pay failing spasmodically for some devices ever since, so I think his fixes for @kdrag0n's dynamic runtime spoofing were never fully adequate... Many users moved back to @Displax v2.3.1-MOD_3.0 for that reason.

I know you've basically re-written this code but if core PIF behaviour is much like @Displax v2.4.0-MOD_2.0, my guess is that dynamic runtime spoofing probably still needs work. (I think @Displax wasn't able to fully troubleshoot the 2.4.0 issues but he produced 5 2.4.0 based builds.)... I believe there were no such problems with full-time spoofing (perhaps the runtime-only approach will always have issues?)... Hope this bit of history may help diagnose the issue. 🙂 PW
[Magisk] samhhmobil:
Yes, I did expect so.

But... even without spoofed fingerprint of an old device (PIF disabled, cache and data of playstore and playservices deleted), it's the same. It seems Google looks for other traces of custom roms and provides that to the app developers...

samhhmobil
[Magisk] zgfg:
So, with MicroG and FakeStore you get the error when testing Play Integrity:

CANNOT_BIND_TO_SERVICE (-9)

and with MicroG and Playstore you get:

PLAY_STORE_NOT_FOUND (-2)

Errors documentation:

IntegrityErrorCode | Android Developers

developer.android.com

And you say that with MicroG and PlayStore, you can pass SafetyNet (YASNAC)?

Do others claim that they can pass PI with MicroG and PlayStore?

Btw, it would be interesting to know who returns the errors, gms.unstable, DG or G server when receiving the DG blob with data

Btw, you say that MicroG comes with gms.unstable. But with the official GApps we have also DroidGuard the.apk:

/data/data/com.google.android.gms/app_dg_cache

It is called from gms unstable and it actually communicates with the G backend

One for SN, the other for PI, updated every few days by G when testing PI/SN. Do you see something similar with MicroG (or MicroG gms.unstable provides its own fake DG)?
[Magisk] dominicsyyy:
BPI app is detecting root again, please verify on your end if this is true? thanks
[Magisk] zgfg:
Generally speaking, Play Integrity Fix (this thread is about) serves to fix Play Integrity

Apps like yours, use additional techniques to detect 'root', hence they also require additional techniques to hide (Shamiko or even ZygiskNext, DenyList or SUList in Kitsune or even KSU, maybe HMA, etc). Somebody who uses the same app may check but that is generally OT here
[Magisk] dominicsyyy:
Im using kitsune, shamiko is not working (unsupported due to kitsune). i will try other modules you said. thanks

i will reach out to those modules if anything goes wrong. sorry to bother this thread.
[Magisk] martinsegura84:
1) No, weirdly enough there is another error when testing SN with MinMicrog+Phonesky (screenshot). microG with fakestore, with Zygisk ON, Shamiko and USNF, I pass SN with flying colors, and it's been like that for years. All my bank apps work perfectly. But at the end of this year G will shutdown SN completely, and I'm screwed. I know that I could flash gapps (nikgapps, mindthegapps, opengapps, etc.), but microG has been such a blessing, no lag, no battery hungry G apps, non intrusive. I have another phone with stock rom and I can't use it for more than 2 minutes without wanting to smash it against the wall. As soon as I pick it up, I start getting notifications from playstore, it gets all laggy and sluggish, trying to update things all the time, or trying to suggest/recommend things to me, I hate it, it's annoying and a privacy nightmare.

I'm going to try with a different module, maybe microgRevived with a playstore downloaded from apkmirror or something like that. I'm realizing that even though people claim have used the same package as me (minmicrog-phonesky-updately) and say it works, it could be a tweaked version of playstore or something like that. I'll make sure is the official one.

2) Yes, I've seen several people claim that, @EAZY BLACK is one of them.

3) I'm 100% sure it is not G server, because without internet connection those same errors appear anyway.

4) Same. With microG that same folder has other folders with numbers, and inside a 'the.apk'.
[Magisk] Bonoboo:
Current method to check whether ROM is signed by "test" keys is executing command:

unzip -l /system/etc/security/otacerts.zip

On other forum I found app that performs check in other way, attached below post.

App ultra-simple, not require root or any permissions. Author: vladrevers

It just reads signature of system app "android" (framework-res.apk) and compares it with "test" key. Here decompiled code:

Spoiler content hidden.
[Magisk] EAZY BLACK:
in microg safetynet settings there is a option use embedded DG Runtime which is by default

but if google updates their DG for stuff how does microG DG get updated then

i mean like google bans new kernel string

microG DG is not updated

so its something in play store..
[Magisk] zgfg:
Thank you for the detailed answer. Since you have investigated deeper, maybe you could get more if you try with stackplz (Translate)

GitHub - SeeFlowerX/stackplz: 基于eBPF的堆栈追踪工具

基于eBPF的堆栈追踪工具. Contribute to SeeFlowerX/stackplz development by creating an account on GitHub.

github.com

I never used but I think Osm0sis mentioned recently here

Btw, since you live with SN/USNF - are you on Oreo or lower (or maybe the banking apps you use don't mind about PI)
[Magisk] pndwal:
So is that @Displax USNF-mod build for microG? 🤔 PW
[Magisk] martinsegura84:
Thanks. I'll check that tool and see if it can be of any help tracing what is going on.

I'm on LineageOS 18.1 (A11) (signed). I have banking apps from Argentina, like 10 of them, and 2 banking apps from Australia, and they all work without issues when I can pass SN. If I can't pass SN, most of them stop working. I guess they still accept SN checks, even though they have implemented PI already, since G has made it mandatory since a couple of months ago. They can accept it until end of this year, OR they could drop it any time they want, that is why I'm trying to fix this, so they don't catch me by surprise.
[Magisk] amexH:
You should look for META/misc_info.txt in generated signed-target_files.zip. Seems that it is missing.

Show me your adapted compile.sh/generate.sh skript and try to redirect the output to a file (in bash

compile.sh 2<&1 | tee logfile.txt

).
[Magisk] zgfg:
Yeah, I was thinking about that. IMO, they should start with PI - but maybe since they obtain API errors (not attestation failures) they fall back to SN for now
[Magisk] martinsegura84:
I'm actually using @kdrag0n 's USNF 2.4, but since you mentioned this one:

https://github.com/Displax/safetynet-fix/releases/download/v2.4.0-MOD_1.3/safetynet-fix-v2.4.0-MOD_1.3-microG.zip

I just tried it, and it also works to pass SN.

Funnily enough @Displax 's latest version USNF2.4.0-MOD_2.0 fails to pass SN on microG.

If @chiteroman based PIF from @Displax 's latest version, we may have a clue on why there are issues with microG.
[Magisk] osm0sis:
That's also not in the Play Store, it's just sent to a server by GMS unstable/DroidGuard to be checked.

The only thing Play Store does to have the device be Certified is do a call to DroidGuard for a PI check. This is now also split out into a separate Play Protect app, but the call is still to DroidGuard.

See FAQ #8 + #11:

https://xdaforums.com/t/pif-faq.4653307/
[Magisk] dosbuddy:
better use 2>&1
[Magisk] TestaMic:
Yep. In the new zip it isn't (the misc info file). I will log it today once i get home.

(Will edit post when i do)
[Magisk] amexH:
Maybe it is better you send me PM to not clobber this thread too much.
[Magisk] AnyNameYouWish:
Here's a screenshot and the json

{
"advice": "RESTORE_TO_FACTORY_ROM",
"apkCertificateDigestSha256": [],
"basicIntegrity": false,
"ctsProfileMatch": false,
"evaluationType": "BASIC,HARDWARE_BACKED",
"nonce": "MmRhODMzNzMtMjBmYi00OTRiLWJjY2YtYmQxNTA5NzA5NDJmCjIwMjMtMDctMjZUMDY6NTc6MzYuODcwKzAyOjAwCmdvb2dsZS9yZWRmaW4vcmVkZmluOjEzL1RRM0EuMjMwNzA1LjAwMS8xMDIxNjc4MDp1c2VyL3JlbGVhc2Uta2V5cwozMwoyMDIzLTA3LTA1Cg==",
"timestampMs": 1690347458754,
"deprecationInformation": "The SafetyNet Attestation API is deprecated. It is recommended to use the Play Integrity API: https://g.co/play/safetynet-timeline."
}
[Magisk] metafaniel:
Hi! First, thank you all for all your efforts and progress. Keep up the good work!

About myself, I've already done my research and all my homework, which has finally led me here. At present, I'm unable to pass SafetyNet by any means including the most recent discussed in this thread. Having said so, I've already tried basic configurations in this regard like using Magisk, SafetyNet Fix in its different versions, MagiskHide Props Config, etc.

I've already tried your latest Play Integrity Fix but I wasn't able to get 3 green ticks.

My device has currently the following:

Device: Samsung Galaxy Grand Prime

Model: SM-G531H

Android Version: 7.1.1

Guide to root: XDA SM-G531H Master Thread

Custom ROM: Resurrection Remix

OS version: RR-N-V5.8.2

Open Gapps: arm-7.1-nano

Recovery: TWRP 3.0.2-0

Root: Magisk Delta fdac22ba-delta (25210)

SeLinux: Permissive

Modules: Play Integrity Fix v4.0 (only module installed).

Magisk Delta configurations:

Zyisk: Yes

Ramdisk: Yes

Bootloop Protection: Enabled

MagiskHide: Enabled

Enforce SuList: Disabled

Configure MagiskHide: Nothing selected.

Enforce SuList remains disabled because if I enable it when the device boots, I got a blank/black screen and I'm unable to do anything except long-pressing the power button to be able to power off or restart the device (to restore my latest backup using TWRP). I haven't found a solution yet...

I've also deleted Google Play Store, Google Play Services and Google Services Framework data/cache with airplane mode on.

I've attached some screenshots with the output of:

Play Integrity API Checker

YASNAC

RootBeer Sample

Magisk Delta Logs

I can only distinguish this error E : write failed with 5: I/O error (x5)

I've read, studied, downloaded and attempted everything to my knowledge to pass SafetyNet check to no avail...

I'm clueless about what to do next...

I'll try any advice given and if I may help with logs or something with my device, please tell me.

Greetings and thanks in advance!!
[Magisk] Hausemaster:
You can't pass STRONG_INTEGRITY on Android 7.1.1, most OEMs didn't implement keymaster at all at that time, try MHPC to pass DEVICE_INTEGRITY. That's the best you'll be able to do

Edit1: Regarding root detection(on Android 8 and below, I have an Android 7.0 device), I've personally seen some degree of success with HuskyDG's "process monitor tool" and "enhanced data isolation" module, along with delta's magisk house should give you pretty much all the functionality...

Edit2: Also, SELinux permissive could impair some apps from running, have it set to "Enforcing" unless you need permissive specifically
[Magisk] AnyNameYouWish:
After further investigations and thanks to your advices, I found that XPrivacyLua is the cause.

If I disable it in LSPosed, all integrity marks turn green.

Is it just me or did I miss a recent information about XPrivacyLua breaking integrity?
[Magisk] pndwal:
Actually comes up pretty regularly in these threads still... Nb.banks may still detect your XPrivacyLua residual folder. See this comment:

🤠 PW
[Magisk] westruk:
Try disabling only advertising id hook and try again, all modules that help to change ad id add problems with passing strong integrity
[Magisk] AnyNameYouWish:
I disabled AdvertisingIdClient$Info.getId hook in the pro functions and rebooted, but still fail integrity check.

So if I get it right, hiding XPrivacyLua would probably solve the problem, but it's still detectable even if selected in HMA (which I can confirm, all other apps or modules are hidden in Applist Detector but XprivacyLua still shows in Abnormal Environment).

I don't have any data/system/xlua folder, only 2 folders (xlua and xlua pro) in data/app (see attached screenshot).

To sum it up, my only option would be to give up using XprivacyLua?

[Edit] There's probably a trick, because when I disable XprivacyLua in LSPosed then reboot, I can pass all integrity check and yet Applist Detector still sees XPrivacyLua :unsure:
[Magisk] westruk:
What apps selected in xlua?
[Magisk] pndwal:
Not sure it can be hidden properly due to folders it creates...

Well it's depreciated, and apparently of little value now compared with its uses previously... Dev got a bit exasperated too sadly...Others have had to uninstall and clean up folders avoid detections... Someone may know better... 🙃 PW
[Magisk] pndwal:
It gets detected with nothing set (even after uninstalling as residual folder remains until removed manually)... I think that's the issue... PW
[Magisk] AnyNameYouWish:
9gag

Aliexpress

Dreamehome

FMWhatsapp

PowerTube

Spotify

UniversalAuth

I've seen the posts about the why he stopped maintaining it, I've been shocked when I read about the hate and threatening. Can't blame him
[Magisk] sawdoctor:
I had app settings reborn lsposed module installed and that caused all my bank apps to fail/detect root. Guess some xposed mods don't hide themselves well enough unfortunately
[Magisk] Displax:
Set SELinux to enforcing
[Magisk] pndwal:
I think people can pass S/N w/ permissive but not PI deviceIntegrity... Not always/consistent? PW
[Magisk] AnyNameYouWish:
I followed these steps, and I still fail integrity
[Magisk] pndwal:
Without changes, does Momo detect selinux issue? PW (after a reboot) what is

su
getenforce result? PW
[Magisk] AnyNameYouWish:
"Enforcing"
[Magisk] pndwal:
So permissive selinux is not your issue as I thought... USNF can hide permissive selinux from GMS so clue for this being culprit is (generally) S/N basicIntegrity passing but PI basicIntegrity failing (as extra checking is done by the new API for this verdict/label)... 😬 PW
[Magisk] zgfg:
XLua is deprecated for long and it has been mentioned/advised in these threads about SN/PI/USNF several times - other users had the same problem with XLua breaking them SN/PI
[Magisk] BillGoss:
I was getting the error on v12. Then I updated to 12.1 and the error went away. 🤷
[Magisk] thesingular:
Are you sure we're talking about the same error here?("Error getting token from Google", as shown in the screenshot in the post you quoted first.) If we're truly talking about the same error, go ahead and try again since you'll also get the error, I sure do get it with 12.1 right now.
[Magisk] zoisa:
it works for me on android 13 on evolution x rom, thx
[Magisk] 130ryokohama:
I've just disabled magisk prop hide config

cleared cache and data for play services, store and wallet then immediately rebooted

added play store to deny list but still getting an error in google wallet that it doesn't meet security reqs :(

PI in playstore still passes basic and device integrity too

any ideas?
[Magisk] V0latyle:
I've been using AdAway with the systemless hosts module. It should have no bearing whatsoever on Play Integrity or your ability to use payment apps.
[Magisk] BillGoss:
Lol!

I just checked Play Integrity again, and you're right - I'm getting the error.
[Magisk] zgfg:
No use whatsoever of putting Playstore to DenyList. Playstore does not look like the banking apps may do, if your phone is 'rooted' or not

Playstore exclusively tests the Play Integrity - hence you need to use PIF module to spoof

Also, putting Playstore or Wallet to DenyList is also of no use for Wallet

Unfortunately, Internet is full of such useless guides that 'instruct' to put Google PlayStore, Google Framework, Google app and who knows what (maybe Google Maps🤪) to DenyList
[Magisk] sawdoctor:
Snap which is why I was asking the question was it device specific before
[Magisk] zgfg:
Use TB Checker app, it has also an option to test Play Integrity

Or do it directly from Playstore, you must enable Developer Settings to unlock the option to run Play Integrity test
[Magisk] BillGoss:
Do you mean the one in Play Store>Settings>About>Play Protect certification?

Because that's always been showing "Device is certified" throughout these recent changes.
[Magisk] RakshitYadav:
Guys I just faced this issue. Using PixelExperience, Oneplus 7t(hotdogb), no root.

Wallet tap to pay stopped working. I have now installed magisk, hide it, enabled Zygisk, enforce DenyList, Added Google Wallet to it.

Installed v12 integrity fix, basically everything that was needed, but my wallet is still not working.

CAN SOMEONE PLEASE HELP !!
[Magisk] thesingular:
No, he meant Play Store>Settings>General>Developer options>Play Integrity>Check integrity

To unlock developer options, click on the play store version in the about section a few times and click yes on the prompt that appears.
[Magisk] osm0sis:
Nah, just in Play Store go to app Settings > About > tap Play Store Version until Developer Options are enabled, then Settings > General > Developer Options > Play Integrity > Check Integrity. Should never run out of tokens 😛

Edit: @thesingular beat me to it!
[Magisk] zgfg:
Not sure does it really fit under the name Play Integrity Fix

Please search if there are other modules spoofing that. IMO, it's something that would have to be targeted selectively ('spoofing' it globally would probably result that the phone itself acts as if you set the lockscren on)

So look under the LSPosed modules, is there any for your case, where you will be able to select for which banking apps you want to spoof that

Besides, it's IMO not controlled by properties. You can look in Terminal emulator (with su) for some properties related to lockscren by eg (I don't find any):

getprop | grep lockscren

Instead, it's afaik controlled by Settings, so run settings to get help

Imo, the following gives you if the locksceen is enabled:

settings get secure lockscren.disabled

For me (I have of course screenlock on, for food - for security, and set to unlock by fingerprint)

And with the following you can probably disable (I don't want to test bcs I don't want to waste time on enrolling my fingers back in):

settings put secure lockscren.disabled 1

By combining settings list and grep you shall search for additional one(s) that control if unlocking by fingerprint is enabled, etc
[Magisk] RakshitYadav:
NO JOKE MAN, your method of clearing the cache and rebooting worked for me. I hope you find a way to get this working but maybe just clean your Magisk, only install this module and do this clearing cache and immediately reboot. It should work. Nonetheless, thanks again
[Magisk] RakshitYadav:
thanks boss, i got my wallet to work because of this thread. You guys are amazing. (￣^￣ )ゞ
[Magisk] zgfg:
No but you got answered in the meantime

Anyway, you could also use TB Checker app - it has also an option (first one) to test Play Integrity

And since much less people know about, they didn't run over quota (so far) like the Play Integrity API Cecker
[Magisk] 130ryokohama:
thanks appreciate it.

I don't know what to do as I pass integrity for basic and device levels but wallet still shows that I don't meet requirements

installed v12.1 PIF also
[Magisk] HippoMan:
Yes, but if I actually do the official "disable" of the lock screen (whichever method I use), all my payment methods disappear from Wallet and from GPay.

I have already extensively searched for my desired feature, and I couldn't find it anywhere.

And realistically, I think it's extremely unlikely that I will ever find such a thing.

It's just one of my wished-for dreams.
[Magisk] chiteroman:
Xiaomi.eu devs will rebuild their ROMs and fix the issue 🥳

Resolved - Google wallet stopped working/Device doesn't meet security requirements

It's not a system bug, regardless of whether you agree or disagree. Since when not bypassing a remote security measure successfully is a bug? Just because "it is precisely written that there is support for Google Pay certification" doesn't make it a gaurantee, simply because we don't have any...

xiaomi.eu
[Magisk] GeTex:
Went to bed 6 hours ago, RCS was working. Woke up now, to some emotionally heavy and worrying texts and immediately tried to text back, failed to send RCS

Swapped from my private print to public, still cannot get RCS back. Did I miss something? I looked some pages back and didn't see anything new.
[Magisk] generalculprit:
Maybe a cached result.Try clearing cache of carrier services (system app) and reboot.
[Magisk] Flr Power:
I have had this problem too and what fixed for me was to clear cache and then uninstall updates, reboot and update again. All is good now.
[Magisk] GeTex:
Switched fingerprints again, followed as above from idea of it being cached, all is good, thankyou, I am not at any PC and my life is coming apart due to events involving those I love and I was near thrown into a total anxiety attack. You have no idea how much it means to me. Thankyou!!!!!!

P.s. my private print is confirmed banned now, sad it lasted forever