yashsingh1/xdaforums huggingface dataset:
[Magisk] BunnyPig1:
Pixel 7 Pro, stock rom (A14, Dec update), passing STRONG, amazing...

I have no hopes it'll last long but very interesting that it's working! Amazing work everyone.
[Magisk] njaya95:
Oneplus 12R, couldn't pass even Device with 16.0 only passing Basic, so went back to 15.9.9, other than 15.9.9 no other module has been able to pass Device for me like FW Patch, PI Fork. I mean for my banking apps that's enough for now. Also what's this TEE, as per Dev OP devices loses it, it seems.
[Magisk] simonpunk2013:
works after setting api level to 34, but it will be banned within 24 hrs I guess XD
[Magisk] snuk0:
Xiaomi Mi10T Pro, ArrowOS Android 12, Magisk v27

Spoiler content hidden.
[Magisk] samhhmobil:
Sony Xperia XA2 (H4113, pioneer)

LineageOS21 (A14)

Magisk 27 (27000)

Shamiko 1.0.1 (300)

BusyBox 1.36.1 (osm0sis)

ACC v2023.10.16 (vr25)

PIF 16.0

TEE is working!

Only Basic and Device integrity,

NO strong integrity.

----------------------

Xiaomi Mi10T-lite-5G (M2007J17G, gauguin)

LineageOS20 (A13)

Magisk 27 (27000)

Shamiko 1.0.1 (300)

BusyBox 1.36.1 (osm0sis)

ACC v2023.10.16 (vr25)

PIF 16.0

TEE is working!

Only Basic and Device integrity,

NO strong integrity.

----------------------

EDIT:

Updated to PIF 16.2:

Both Devices passes STRONG!!

@chiteroman: You're GREAT!!
[Magisk] _tyler_:
REVVL 6 Pro stock ROM MTK Dimensity 700 Magisk 27 not strong with PIF16. Not sure how to find if TEE is present

Edit: Instructions in post #17,278 worked!
[Magisk] Sucharek 233:
I'm on munch AOSPA Uvite Beta 4

v16 passes device for me

v16.1 only passes basic

how can I check my TEE?
[Magisk] jnss98b:
Google messages wasn't even requiring strong integrity before anyway
[Magisk] RinaZet:
Release v1.6.0 · vvb2060/KeyAttestation

Contribute to vvb2060/KeyAttestation development by creating an account on GitHub.

github.com
[Magisk] LLStarks:
Winning combo for RCS, wallet, and hiding: Alpha, PIF, Shamiko
[Magisk] osm0sis:
Looks like you partially violated your own GPL by making a pre-compiled closed source classes.dex which you've written as dex.h? 🤦‍♂️

v16.0 · chiteroman/PlayIntegrityFix@ecd3b82

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com
[Magisk] MrLumin:
v16.0 - Triggers hardware backed attestation, resulting in failing to pass SafetyNet and PI as usual

v16.1 - Passing DEVICE as it was in versions pre v16.0

Redmi Note 11 NFC (spesn) - DerpFest Android 14

TEE's fine + Widevine L1

Running KSU

Key Attestation sees that the bootloader is locked, but at the same time it reports that the certificate is untrusted. Could that be the case?
[Magisk] jnss98b:
Trusted Execution Environment
[Magisk] romashkatea:
Xiaomi Pad 5 (nabu), HyperOS Global 1.0.1.0 stock ROM with Magisk, Strong passes fine PIF v16.1
[Magisk] David B.:
I pass STRONG, but RCS is still broken for me and Key Attestation still detects an unlocked bootloader. Is this expected?
[Magisk] Sucharek 233:
I think I do have it working. Well, I'm not really sure how to check with that app, but I do have TEE next to almost every single entry in Authorization list.

Still, tried v16.1 and now new v16.2 and it's passing just basic.

v16.0 does pass device though, so I guess I'll stick with that.

Edit: I backed up every single partition (from TWRP) right after unlocking my bootloader, so I can reflash any partition to it's original state if that might help.
[Magisk] ardiesel:
This is all getting to be nothing but a constant rabbit hole getting deeper and deeper.
[Magisk] alekyiv:
Hi. How are you hide in momo detected line

Device is running a custom ROM, i have RMN 11 spesn to but use EvolutionX 9 signed?

Sent from 2201117TG using ReLabs
[Magisk] thecoolkid:
Is a TEE with a banned keybox or AOSP keys enough? Contemplating if it's worth reprogramming TEE, bc mine is broken.
[Magisk] chiteroman:
If you can't pass Strong, try this module: https://github.com/chiteroman/PlayIntegrityFix/releases/tag/v16.2
[Magisk] cmstlist:
At this point it's Pray Integrity Fix 🙏
[Magisk] MrLumin:
I've unmounted the modules, and then removed the addon.d as it was reporting that the device was running the custom ROM. Should I do smth else?
[Magisk] cabagekiller:
Is there an easy way to fix OnePlus TEE? I see one way but requires an engineering ROM which I can't find for the OP12. Any hope for strong with this for OnePlus?
[Magisk] alekyiv:
Removing addon.d somehow affects the work of recovery or other root applications or magisk, busybox modules, what is it specifically for?

Sent from 2201117TG using ReLabs
[Magisk] arunchegz:
View attachment 6115124Thanks for your great work 👍
[Magisk] mac796:
Awesome pixel 8pro👍
[Magisk] passionicon:
16.2 and 16.1 pass strong on starqlte.

No luck on op 12 yet
[Magisk] MrLumin:
OnePlus devices have broken TEE once you unlock the bootloader AFAIK, if so then do not count on passing the STRONG verdict.
[Magisk] bakaekze:
On Xiaomi eu (hos 1.0) device doesn't pass with this

Poco f5
[Magisk] badabing2003:
View attachment 6115125

Thanks

Ah Pixel 5 first API is not 34, the module does not set it?

Do I have to do this on each reboot?
[Magisk] stanley321:
This is Off topic but with 1+, I can pass Strong with re locking BL and no root fully stock, TEE shouldn't be permanently broken I believe
[Magisk] chiteroman:
Modifying first_api_level prop is a bad idea...

Check if it passes with v16.2
[Magisk] ninjakira:
Is there anyway to fix a broken tee on a Moto edge 2021 (berlna)??? Would like to try this lol
[Magisk] flakeforever:
Does this mean the TEE is work?
[Magisk] passionicon:
I don't even know what TEE means but i know what TEA means and I'm about to drink me some rn😔
[Magisk] immortalwon:
For me it did not work on custom rom a14, only passing basic.
[Magisk] MrLumin:
oh
[Magisk] ninjakira:
I'm sure someone here is about to tell you what tee means since its been asked like 10 times lmao, we basically need it working if we want to pass strong though lmao, not sure how long that will last I'm just curious
[Magisk] cmstlist:
Chiteroman posted on Telegram "Also you can use your device fingerprint - ONLY IF YOUR TEE IS OK"

Is there a specific way to tell the module not to attempt to spoof my fingerprint and just use the one that comes with my ROM?
[Magisk] EldigoR:
Mipa Arrow a13, PIF v16.2, Magisk and Shamiko only passing basic only...
[Magisk] Rares6567:
Change DEVICE_INITIAL_SDK_INT to something else or blank
[Magisk] geokilla:
Just updated to Play Integrity Fix (STRONG) v16.0. Cleared Google Play data and Google Play Services cache. Restarted the phone while in Airplane mode. I only pass basic integrity. Can't pass device integrity. Using regular Magisk and that's the only module I have. Others are BCR, Systemless Hosts, and YouTube Revanced Extended. Have Zygisk and Enforced Denylist enabled.
[Magisk] tom510:
Poco f3, pixelos

v16.0 Device+Basic

v16.1 Basic

v16.2 Basic
[Magisk] ninjakira:
Welp NVM I guess, my keys are lost 😭 View attachment 6115131
[Magisk] EldigoR:
Tried DEVICE_INITIAL_SDK_INT: "", null and "26" didn't make a difference
[Magisk] Sucharek 233:
same for me (munch on AOSPA)
[Magisk] Rares6567:
Did u even killed gms?
[Magisk] ScottIsMyName:
Not to sound rude, but what is the point of passing strong at the moment? Won't RCS still fail? I guess if certain apps require strong to pass, this is a fix for that.
[Magisk] joeyhuab:
Some apps, banks, Microsoft, Pokemon GO, Ingress and others are rumored to require strong to open.
[Magisk] EldigoR:
Yes...

Tried combo's of PIF 16.x with or without Shamiko
[Magisk] tom510:
Update: with "DEVICE_INITIAL_SDK_INT": "" and v16.2 I now get Device+Basic
[Magisk] stanley321:
I can finally get into a payment app after passing Strong. Thank you chiteroman for Pray Integrity Fix 🙏

Which Microsoft app needs strong? I would like to test it now with this PIF strong.
[Magisk] sygmstr:
View attachment 6115138

I thaught this ment any fingerprint will pass but i tried using an old one and it only passed device. How do I get it working with another fingerprint and do I need to use the 16.2 version for this to work?
[Magisk] ScottIsMyName:
Actually I forgot I had to downgrade both Microsoft Outlook and Microsoft Teams to older versions even with Shamiko and HMA hiding everything I could because they detected root. This was because company portal required it, so it may not be easy to test.
[Magisk] vldrs:
I tried with my last stock pixel 7, it didn't work (basic only), while inbuilt into the module works (including strong)

{
"MANUFACTURER": "Google",
"MODEL": "Pixel 7",
"FINGERPRINT": "google/panther/panther:14/AP2A.240605.024/11860263:user/release-keys",
"BRAND": "google",
"PRODUCT": "panther",
"DEVICE": "panther",
"RELEASE": "14",
"ID": "AP2A.240605.024",
"INCREMENTAL": "11860263",
"TYPE": "user",
"TAGS": "release-keys",
"SECURITY_PATCH": "2024-06-05",
"DEVICE_INITIAL_SDK_INT": "34"
}
[Magisk] kholdstayr:
Should this new version 16.2 pif module pass device integrity? I'm using APatch with zygisk next and pif 16.2 is only passing basic.

Should I try switching back to Magisk instead?
[Magisk] stanley321:
What does "your device fingerprint" mean here?

FP that we mined?

Or Original FP from the current ROM?

If you are on stock ROM, just extract it from build.prop with gen_pif_custom.sh
[Magisk] tryigitx:
Finally the certificate chain in the module wa (I still remember you write it was impossible haha)

Now it is necessary to discuss which module makes more sense to develop

Obviously fw file replacement is more easily detected but more advantage. Automation such as deleting the module after a rom update might make sense.

Also more mediatek certificate chains will be leaked soon
[Magisk] IBq536XJaWThZsjwwwApTUiV:
I'm getting the same issue, the workaround doesn't work, and am passing strong integrity with version 16.0
[Magisk] pershoot:
16.2 (pre): strong pass on lynx (7a).
[Magisk] ilysmh.zz:
Same in Redmi Note 11 (Spes)
[Magisk] ilysmh.zz:
in what should this be executed? sorry, i don't have much knowledge
[Magisk] osm0sis:
It was a test for @badabing2003, not something everyone should be repeating. 🤦‍♂️
[Magisk] espionage724:
Ingress needs Strong, Pokemon GO didn't as of a few days ago.
[Magisk] cabagekiller:
Terminal such as termux.
[Magisk] Thebear j koss:
Fantastic job @chiteroman

View attachment 6115147
[Magisk] Cabalisto02:
Any workarounds on devices with broken tee?
[Magisk] David B.:
What do you mean by "sewing into the module"? I am seeing the same issue on my Pixel 6 Pro and would like to fix it if I can.
[Magisk] Sucharek 233:
After changing DEVICE_INITIAL_SDK_INT to the one from the one from build.prop (I used the site to getting pif.json from my build.prop) it passes basic+device on v16.2 and v16.1 now. Using my fingerprint passes only basic.
[Magisk] tryigitx:
If you are not using a custom rom, just do this .d

I tried this at first because I don't know how the code works.

Also, support for custom roms (other than port) needs to be cut. Nowadays this is a complete barrier for development.

Instead of using custom roms, please fix the problems with official roms 2024 😞
[Magisk] David B.:
I only pass BASIC when I do this.
[Magisk] tryigitx:
Must be a broken tee or a different detail

Add fingerprint of a different new phone

As long as the fingerprint file is extracted from an original rom there should be no problem. There is a certificate chain inside the module 🍬
[Magisk] L3_N0X:
I had an valid hash value, but now I only have a verified boot hash of AAAAAAAAAAAAAAAAAAAAAAAAAAAAA= after experimenting, does this mean I don't have a working TEE? Can I get this to work again?
[Magisk] WujaWojtek1:
Hello!

Im having problem with safenet. I can pass basic integrity, but in cts profile match it fails.

Device: Samsung Galaxy s5 sm-g900f

Os: Lineageos 21

Gapps: Fake gapps nlp ( https://fakegapps.github.io ), but I tried also on mind the gapps and other fake gapps packages and without gapps - same result

I tried versions 16.0 and 16.2 - same result

I tried Play integrity fix next ( https://github.com/daboynb/PlayIntegrityNEXT ) - same result

I tried universal safetynet fix ( https://github.com/kdrag0n/safetynet-fix ) - it fails both basic integrity and cts profile match.

I tried lsposed and pixel spoof ( https://github.com/LSPosed/LSPosed https://github.com/RisenID/PixelSpoof ) - lsposed keeps closing

What I consider weird (idk if it's related): I can open netflix and it works fine. I can't login into pokemon go (authentefication issue). On other device with same safetynet results (basic passed, cts failed) netflix yells that my device is not compatibile.
[Magisk] David B.:
My TEE is fine. I have checked it. 🤷

I just tried using this. I generated it using the @osm0sis gen_pif_custom.sh script, but it did not work.

{
// Build Fields
"MANUFACTURER": "Google",
"MODEL": "Pixel 6 Pro",
"FINGERPRINT": "google/raven/raven:14/AP2A.240605.024/11860263:user/release-keys",
"BRAND": "google",
"PRODUCT": "raven",
"DEVICE": "raven",
"RELEASE": "14",
"ID": "AP2A.240605.024",
"INCREMENTAL": "11860263",
"TYPE": "user",
"TAGS": "release-keys",
"SECURITY_PATCH": "2024-06-05",
"DEVICE_INITIAL_SDK_INT": "31",

// System Properties
"*.build.id": "AP2A.240605.024",
"*.security_patch": "2024-06-05",
"*api_level": "31"
}

I am going to try changing the API levels to 34 next.
[Magisk] vldrs:
If you just install module and make sure that there is no file /data/adb/pif.json. And if there is, disable the playcurl module.
[Magisk] sawdoctor:
Some apps are now requiring strong. I believe pocomon and McDonald's do
[Magisk] David B.:
Oh, I know it works fine without the pif.json file being present, but I would like to use a custom fingerprint because without one, RCS is still broken.
[Magisk] BarackMitzvah:
I am currently passing Strong on a stock P8P Pro, using Shamiko and the slew of other modules

I currently have no pif.json file at all, does this help in any way in terms of getting RCS back up?

Regardless this is awesome!
[Magisk] BarackMitzvah:
Yep, trying to determine if there's a path to getting RCS again
[Magisk] tryigitx:
No no

This should be at least required for cts. The module is not what I thought it would be

Or the one added to the service.sh file etc.

But on some phones, this is not a direct solution

Use this:

{
"TAGS": "release-keys",

}
[Magisk] RAZINARES:
My device fingerprint doesn't work either. Only pass basic.

Is there anyone who is actually able to pass device+strong integrity with their device fp?
[Magisk] David B.:
From @chiteroman

View attachment 6115163

I have not been able to reproduce this though.

This does not work:
[Magisk] CZ.Kostra:
There is nothing, an easy way. You have to test and share the results.
[Magisk] vldrs:
Try changing in yours pif:

"DEVICE_INITIAL_SDK_INT": "34"
[Magisk] David B.:
That does not seem to work for me either. I'm still only passing BASIC when I do that.
[Magisk] vldrs:
Then I won’t tell you, I just noticed that now Pif uses a public fingerprint, but with a changed DEVICE_INITIAL_SDK_INT, from 24 to 34.
[Magisk] BarackMitzvah:
In practice, does this just mean have no pif.json and your stock print is used?

I'm really hoping this gets us over all of this RCS breaking bs

I miss the days of Google not getting so up in what you do to the device that you own
[Magisk] IBq536XJaWThZsjwwwApTUiV:
Ok not sure what is going on, it only happens sometimes, and I can't figure out when it would occur.
[Magisk] SuperMaximus:
@chiteroman

Tried to check Play Integrity within Google Play, but it didn't return any positive results:

View attachment 6031411

Google Play Services and Google Play are fully mounted in Magisk Delta (Should I unmount GMS?).

UPDATE: I excluded Google Play Services, Google Services Framework and Google Play from mount list (hidden them completely) in Magisk, and SafetyNet passes successfully. Somebody wrote that Google Services should not be hidden (included in Deny List), but in my case they should be hidden to pass the SafetyNet.
[Magisk] digger16309:
I've run this app for months without issue. Are you running a custom ROM? TWRP folder?

P6P - stock ROM A13

Magisk stable

Magisk hidden

LSPosed

Shamiko

All app hooks checked in blacklist

USNF / PIF
[Magisk] marcopit-92:
I run clean rom Asus zf 8 flip. Stock recovery

Magisk latest version

LSPOSED

SHAMIKO checked wallet play store play serv and some banking app

PIF

HMA
[Magisk] marcopit-92:
I have tried paying yesterday for first time and it worked but the first two time failed and then asked me the screen password, then it starts working regularly.. try this
[Magisk] pndwal:
T

🤔 Play Integrity API Checker is nothing to do with PIF, except maybe having users in common... 😉 PW
[Magisk] pndwal:
What does "SHAMIKO checked wallet play store play serv and some banking app" mean? And do you see MEETS_DEVICE_INTEGRITY?...

I'd try with nothing in denylist... May not even need wallet in denylist...

Also, seems you might be missing some app in HMA... Check suspicious apps carefully for blacklist mode... Or try whitelist mode...

Also, be sure to clear Bonvoy app data (not just cache) before opening app again after every failed attempt... 🙃 PW
[Magisk] sawdoctor:
Am I correct with this. ATM even if you can't use your bank app on a rooted device you can still access it via a web page/web app on a rooted device? If/when banks reach their "critical mass" will they also be able to block you accessing the bank through the web on a rooted device?
[Magisk] marcopit-92:
I have meets device integrity as I show yesterday.

Wallets is working properly.

This is my magisk enforcing list and HMA.

BONVOY the last release will not work. It can detect Magisk.

I tried cache and data cleaning.
[Magisk] aygul12345:
Also good tip, to enable Hide magisk enabled, otherwise other apps will detect that you being rooted.
[Magisk] pndwal:
Generally yes... Protections, protocols and vulnerabilities are very different for browser and app based banking... See this (towards the end):

Post in thread '[Discussion] Magisk - The Age of Zygisk.' https://xdaforums.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-89087838

Many banks already restrict which browsers are acceptable however, and there will undoubtedly be further tightening...

Also, part of the push for ensuring OS integrity on mobiles especially is driven by use of NFC for contactless, use of biometric identification/scanners etc that don't feature in web-based banking solutions... Also there's a greater need for mobile devices to be secured by hardened password, biometric, cryptographic and other protections... More below.

Require STRONG_INTEGRITY for web banking?... I'm guessing they could... Don't know if they would, or technically how they'd differentiate between devices that have STRONG_INTEGRITY, those that fail such attestation and those (PCs etc) that don't even require it, use Secure Boot etc instead etc... Also, until contactless, biometric scanning or other similar facilities are implemented in web solutions, I'm not sure there'd be the same call...

Others here have pointed out the differences between the security model for apps (which increasingly relies on verification of OS integrity on mobile devices especially but more and more on PCs etc too as well as sandboxed environments etc) and the model for browser based services (which, depending on a banks restrictions on which browsers are allowed, relies on inbuilt protections against data theft, phishing attacks, fake websites etc and use automatic login functions, sandboxing, security certificate checks etc)... For example browsers are risky because there are trojans designed to collect banking information whereas apps are risky because most banking apps probably have security flaws and fake/malware apps can be present, so again the security requirements for each are quite different...

A good argument for verifying OS integrity whether apps or browser services are used is sandboxing... Sandboxing means a web browser, app or an individual piece of code is isolated inside a safe environment against external security threats. In the case of a browser, this stops malware from escaping the browser onto the system effectively... The fact that none have really demonstrated a good level of protection for stopping malware on the system affecting the browser however, is a good argument for including guarantees of system integrity such as Android Verified Boot and Secure Boot (PC) along with their strong attestations on devices even for browser based banking etc... PCs are catching up, but mobile OSs have preempted this it seems due to additional security concerns related to ease of compromise, use of NFC/contactless transactions, biometric identification etc etc...

Here's one interesting article outlining different security protocols and considerations for apps as opposed to browsers:

https://www.theguardian.com/technol...-safer-to-use-an-app-or-a-browser-for-banking

👀 PW
[Magisk] pndwal:
Applist detector shows XPosed modules detected...

I said to you

and earlier

See bold text... That's what you seem to be lacking assuming it's not detecting current TJW Zygisk... (I have Alpha but a member earlier said Bonvoy was still working with TJW builds)... Let us know... 😉 PW
[Magisk] talk2g:
Is it possible to pass STRONG INTEGRITY using this module on los 20?
[Magisk] marcopit-92:
Apparently now xposed section it is fixed. I fixed this by using blacklist templates to hide this LSPOSED modules and magisk to applist detector as I see in a video.

All the root app are hidden in manage app section, I double checked.

Magisk is hidden natively.

HMA is hidden in LSPOSED.

Now that also xposed is hidden I will try again and let you know
[Magisk] alfian89:
how to meets_strong_integrity 😁
[Magisk] pndwal:
... Buy a new device... It should always pass if you don't play with it too much...

And you can test STRONG_INTEGRITY verdict with a hammer... PW
[Magisk] marcopit-92:
Unfortunately there is still no chance to access this app with my setup at least. There is no chance to use this **** updated. Sorry but I give up and use the old version. Nobody has solved this, seems the app use a software called appdome that in some ways can detect root anyway.
[Magisk] Klappp:
Gonna go give it another try then
[Magisk] alfian89:
actually I just want to test. what if magiskhide works, will it get meets_strong_integrity . because that's the only part that doesn't exist. active on my device.

View attachment 6031494
[Magisk] sawdoctor:
As long as i can use my watch unrooted for contactless and a rooted phone to access my accounts and pay bills/transfer money etc I'd be fairly happy. Thank you as always for your knowledge and well described/thoughtful insight 👍👍👍
[Magisk] David B.:
I believe that it's using the sailfish fingerprint when you don't define a custom one.
[Magisk] BunnyPig1:
With v16.0, are we still spoofing our fingerprint to droidguard or is there something new that has happened?

In a screenshot from Chiteroman in TG, he stated we could use "our own device fingerprint" if we have a working TEE, this confuses me, are we still using the Sailfish fingerprint to pass STRONG?
[Magisk] RAZINARES:
Currently strong is passing with sailfish fp.

Haven't seen anyone passing device+strong integrity with their device fp yet.
[Magisk] David B.:
Yes I think @chiteroman was wrong, unfortunately.
[Magisk] Vision:
Please, if can write here what need what.

Apps&Games need PI (List)

Here you can post what apps&games need to pass 2/3 (Play Integrity) to show it on Google Play. Some apps&games appear and can download but when open (for apps until now) can't use if not pass DEVICE, because required to pass 2/3. Also from now...

xdaforums.com
[Magisk] mac796:
So I can put my private print on top of this and RCS will be back to working?
[Magisk] Vision:
Yeah 👍 if not block it.
[Magisk] sygmstr:
Nobody in this thread has been able to get strong integrity working with a custom fp
[Magisk] sawdoctor:
If you have an unbanned private print yes you can have strong and working rcs
[Magisk] mac796:
I'm going to put it back the way it was. I don't really need strong. Untill all the bugs get worked out. I'll give it a shot though
[Magisk] David B.:
Are you sure of this?