yashsingh1/xdaforums huggingface dataset:
[Magisk] Umgak:
If your old 5T is rooted, it will still fail due to the other props (ro.boot.verifiedbootstate, ro.debuggable, ro.secure, ro.build.type, ro.build.tags, ro.build.selinux, you get the point) and signs of tampering (su binary, unlocked bootloader, some other things). I just dusted off my old 5T and wiped it fully back to stock, locked bootloader, stock recovery, and it does pass. PIF will still hide many of these things from DroidGuard even though it doesn't ship with props any more.

IIRC old USNF would trick a BASIC attest by adding a space to the device's model name, then throwing not supported error on hardware attestation attempts. Without the space, Google would block the BASIC attest as the device was known to support HARDWARE attest. A hacky workaround that worked for a while, but is now patched.
[Magisk] V0latyle:
Maybe.

Again, I don't fully understand all the workings here so people much smarter than me will have to ponder and explain these things. One of the things I was wondering about was whether there's any custom firmware that has passed CTS; ostensibly, this would have to rely on basic attestation because AFAIK hardware backed attestation is not possible with SelfSigned boot state (custom root of trust)

If such a project (intended for multiple target devices) has indeed passed CTS then I would imagine we could spoof those prints for the forseeable future. Right now, though, we are talking about spoofing STOCK prints from other devices.

Yep

I'd be careful about throwing terms like "fascist" around. There's no Stasi, no militarism or forcible suppression here. As we've discussed ad nauseum previously I think a lot of it just has to do with Google trying to "improve" their product - since they want PI to be reliable and correct, they're plugging holes and dealing with vulnerabilities that result in incorrect responses. They're bug fixing, basically.
[Magisk] Genmutant:
Unfortunality, it doesn't pass any more. It worked with 1.37 until 1-2 days ago, now it doesn't without spoofing props. (Also doesn't work with spoofed ones, but that might be unlucky selection from me).

I might have a few new tries tomorrow...
[Magisk] rodken:
Can anyone develop or present a theory in detail relating to this?
[Magisk] BettlePimp:
Tried 50 different fingerprints with no luck. Giving up for now...
[Magisk] GGYT_YT:
just tried a combination from my STOCK Poco X3 rom and to pretty much no surprise - it doesn't work. help.
[Magisk] Annie the Eagle:
FIRST_API_LEVEL is too new. Any phone that RELEASED with Android 9 or later wont work.
[Magisk] DP FH:
FIRST_API_LEVEL 33 will never pass. Try setting it to 32.
[Magisk] EuK_V:
Hi, need help with one of my phones samsung a70q. I'm trying different versions of the module (with custom pif) and either play integrity works but banking app see root or vise versa play integrity doesn't work and banking apps don't see root.. And not together ( I think I tried all the versions. Maybe I'm missing something related to samsung phones? Two other my phones pass integrity and banking apps do not see root.
[Magisk] Umgak:
Your FIRST_API_LEVEL is set to 33, which will DEFINITELY cause a HARDWARE_BACKED attestation. You could try lowering it to 32 or lower, though it probably still won't work as most devices that have FIRST_API_LEVEL of 28 or higher will reject any BASIC attestation.

See osm0sis' guide here for a rundown of what devices will almost definitely not work and what kind of devices you're looking for.
[Magisk] V0latyle:
As a reminder folks if you find a print that works DO NOT POST IT HERE. This forum can be viewed by the public, and our site is constantly being crawled by people without accounts:

View attachment 6039056

And robots:

View attachment 6039058
[Magisk] wide_load:
I was a guest and just after advice :)
[Magisk] GGYT_YT:
LOOKING PROMISING! I tried api level 28 and instead of the security error it now shows that something is wrong with my card so i will update it and most likely it will work (hopefully) - thanks!
[Magisk] Bobb_o:
Even if you have a device that would pass and only you have it what are the chances of Google banning it?

Edit: I'm not clear, is the fingerprint for each unique device or does every device of a single model have the same fingerprint?
[Magisk] V0latyle:
Please don't ignore my warning.

If you find that this works, you've just posted a working print on a public forum, meaning anyone else using that print will also be screwed when it gets blacklisted.

Please remove your screenshots and any mention of specific device or software version.
[Magisk] V0latyle:
Hard to say, because (again!) we don't know exactly HOW Google is defeating these spoofs.

If they're checking each and every individual print to make sure it matches with the rest of your props, it's just a matter of time until they get to yours.
[Magisk] GGYT_YT:
update - doesn't work

can you guys please help me with trying to understand that fingerprint thing? even with that guide it still doesn't help me
[Magisk] simo2001:
First of all, thank you very much for all your support guys. Without you this would not be difficult but just impossible.

I've read the post of @osm0sis but I would like to ask you a question on where to search online (I don't have any old device unfortunately).

(without saying the source name, for obv reasons) Is the Open Source lab for developer a good place where to search? If not which places can be considered good to search? (speak in code if you want)
[Magisk] V0latyle:
I think you're on the right track, you just have to find a print and FIRST_API_LEVEL that works
[Magisk] V0latyle:
Build.prop from firmware for devices that launched before Android 9
[Magisk] GGYT_YT:
which ones would you recommend? like from <=28-29?
[Magisk] Umgak:
@Desi tharra that app is rate limited. Best way to test is to put Play Store into developer mode (tap repeatedly on Play Store Version under settings) and then do a check under General -> Developer options -> Check Integrity. You are looking for a result with [MEETS_BASIC_INTEGRITY, MEETS_DEVICE_INTEGRITY] in the Labels section.
[Magisk] V0latyle:
Use a different checker. You can use Play Store to do it natively

I'm not going to recommend any specific ones but it can't be 33 and it can't be lower than 21

This might help
[Magisk] Desi tharra:
Ok
[Magisk] thomaskmaagaard:
Integrity check in Play Store still reports my previous FP, model and such, after changing it in the json. OP Nord PixelExperience A13. Is it not supposed to show the spoofed FP? Anyhow, not passing anyway.
[Magisk] immortalwon:
It's not supposed to show the new fingerprint in P.I checks because the module spoofs GMS process of google.
[Magisk] wrongway213:
It's been a long time since I moderated. That said, I believe mods should immediately delete any prints posted. Derailing/endangering the project in discussion may cause irreparable harm to all users in this thread & the entire root community. I don't think it'd be mod overreach to delete the offending content before it has the opportunity to be seen by prying eyes. Moreover, I think more heavy-handed warning about said behavior may be needed to keep all of this from being lost sooner than later.

I hope you don't take this as me trying to tell you how to do your job. I just want to see everyone be able to outlast Google.
[Magisk] zgfg:
Sorry if I missed the mouse and cat scores today, can someone confirm:

Nvidia TV has passed away?
[Magisk] V0latyle:
That's a fair point and if you want, you can bring this up to the moderators assigned to this section.

XDA Staff List, the Magisk section falls under "All Other Forums"

However...we generally don't remove things that do not specifically violate the Forum Rules. Yes, someone posting a print is pretty careless and inconsiderate towards others but there's nothing technically wrong with them doing so, and we honestly don't even know if Google is monitoring this thread or was decompiling previous PIF releases.

I personally find it more likely that they are reinforcing PI to check props for mismatch; since this module only spoofs the print for GMS, comparing it to the "real" props is pretty elementary, so we're all on borrowed time really
[Magisk] dmenezes:
With @chiteroman's v14.0 on, it's actually `/data/adb/pif.json`, correct?
[Magisk] Umgak:
YASNAC is rate limited and has been for some time. Google Play has its own integrity checker test built in that still works, under the developer options menu (tap version repeatedly, then go to general).
[Magisk] Clasimodo:
I'm sorry, but I really don't understand how it works with the custom.pif.json file. I did look at the opening post, but I simply don't get it. Is there somebody that can be kind enough to systematically explain the steps for a nitwit like myself?
[Magisk] dnfm:
There's a link in the first post to a howto.
[Magisk] GROOVYJOSHCLARK:
Using Pixel 6 Pro (Raven) and the latest release PIF v14.0 (from a few hours ago), with MagiskHide Props Config enabled and configured (this was required) all is well again. Though, when updating PIF, it did warn me to disable it (but dont), its needed or CTS will fail. Now with PIF + props, it passes both integrity checks again. However, without props enabled and running, it failed CTS, so I enabled it and rebooted. After reboot, I SU'd terminal, configured props and rebooted.

This time, with MagiskHide Props Config enabled and configured (with options 1 and 2 - BOTH set to Pixel 6 Prop / Raven), all is well again. I am certified in Play, pass both basic and device integrity, with all of my banking apps + GPay working (with being ROOT'd) plus Netflix / Hulu show up in store, ETC., so THANK YOU devs!!!!

I took screenshots to show the results (good or bad), but thankfully, it all just worked (once I had props back up and running + PIF v14 --> latest PIF), so there are a few things needed to get this working properly!! I blanked out as much info as possible to prevent G-Man from blocking us:

View attachment 6039076View attachment 6039077

*** FORGOT to mention my OS *** --> LOS (lineage-20) and its ALWAYS up to date with EVERY Monday's release (done so ASAP that day). I am currently running 'lineage-20.0-20231127-nightly-raven-signed.zip' --> but IDK if it matters here or not (what OS I am running). I added it in there just in case it is needed in regards to the Integrity Fix / check process.
[Magisk] Clasimodo:
Thanks. I saw that, but I did not get it there.
[Magisk] V0latyle:
Correct

TB checker also seems to be pretty reliable

Use a file manager such as Root Explorer to open the pif.json in a text editor

You need to fill in the places between the quotes with items from the build.prop of your choice

I can't stress it enough:

DO NOT POST WORKING PRINTS HERE at least not in the public view
[Magisk] Abomb:
I ran "adb shell getprops" on an old moto X4 and used the values from that for the pif.json - but in testing I only get Basic Integrity, not the Device one. Is there something I am missing?
[Magisk] dmenezes:
You mean "MagiskHideProps" module, right?
[Magisk] i5lee8bit:
Wow, that was actually pretty easy. Found my first working pass; gonna work on finding others eventually. So far just gonna go through physical devices I own. From my first donor I didn't even need to unroot. It was an old device sitting in a drawer forever... had Magisk v23 installed 😂. Thankfully, it was on a STOCK rom.

I originally pulled system and vendor build props (easy with root, lol) and was able to get (what eventually I was able to confirm) the correct values for all fields. When it wouldn't work, reaching a point where I got DEVICE pass but BASIC fail, I actually added a little troubleshooting step. I upgraded to Magisk 26.4 just so I could enable Zygisk and install PIF (I installed an older one just to see spoofed values I recognize in logs) so I could do logcat | grep PIF. This will also show the original values being replaced, which helped me confirm I was using the correct values. As it would turn out, I didn't even need to do this (see below), but nonetheless, maybe this sort of logic could help others in their hunt for a working config.

The ONLY part that gave me a headache was that I had to decrement the first API level by 1 compared to the true first API level. Once I did that, it passed basic and device.

I'm gonna check out some of my other devices now. A huge thank you to @chiteroman, @osm0sis, @badabing2003 for their tools and everything else contributing towards this, and @zgfg and @pndwal for their general knowledge sharing (always interesting lurking and reading their insights 🙂). And I'm sure countless others I haven't thought of atm!
[Magisk] GROOVYJOSHCLARK:
yup, sorry I wasn't clear, I will edit my post! Thanks for the catch!
[Magisk] AzeriVandam:
Hello everybody I suffer without nfc Google wallet can anybody make a guide for this please? My phone is galaxy a3 2016 android 11
[Magisk] arda99:
1. Google hasn't started checking different props, at least for now. Otherwise obviously all fingerprints will be gone.

2. My educated guess: by "banning" there is no side effect for real users, as they go through enforced hardware attestation.

3. There're working fingerprints from much newer devices. There was one in v13.3 release.
[Magisk] rseiler:
Which MagiskHideProps are you using? I wasn't aware that it was even needed. Is that common or something particular to your config?
[Magisk] GROOVYJOSHCLARK:
In my original post, I noted for PROPS, options 1 and 2, BOTH set to raven (Pixel 6 Pro). That being said, I dont know what device you run, so it could help / not help.

From what I understand (regarding CTS), Pixel's are known to Google (obviously) and they are known to have X,Y,Z fingerprints so it fails CTS without props setup and running. I am fairly certain its why us pixel owners, need props, to force basic attestation (I could be wrong) but without props running (as my official raven, option 1 and 2), it fails. But with props, set to raven, all is well again and everything works. I believe its because it IS a known Google device, by Google, from Google, so its needed to force basic as other signatures wont work with a pixel (I believe).

I could be wrong, but it works flawless for me, so take it with a grain of salt and good luck...
[Magisk] Clasimodo:
Thanks for this. I tried this using data of an old phone. If I test it in developer options from play it still gives the old fingerprint. Is this how it should be and should I fill in all fields of the pif,json file or only the fingerprint field?
[Magisk] V0latyle:
All of them, although in some circumstances leaving FIRST_API_LEVEL blank might work

{
"PRODUCT": "ro.product.name"
"DEVICE": "ro.product.device"
"MANUFACTURER": "ro.product.manufacturer"
"BRAND": "ro.product..brand"
"MODEL": "ro.product.model"
"FINGERPRINT": "ro.build.fingerprint"
"SECURITY_PATCH": "ro.build.version.security_patch"
"FIRST_API_LEVEL": "not sure, I think this is ro.build.version.min_supported_target"
}

So, using the Pixel 5 on the latest update, it would look like this: (This won't work for spoofing, Pixel 5 is too new)

{
"PRODUCT": "redfin"
"DEVICE": "generic"
"MANUFACTURER": "Google"
"BRAND": "google"
"MODEL": "mainline"
"FINGERPRINT": "google/redfin/redfin:14/UP1A.231105.001/10817346:user/release-keys"
"SECURITY_PATCH": "2023-11-05"
"FIRST_API_LEVEL": "31"
}
[Magisk] Clasimodo:
Wow, much appreciated. So all data from the old phone should be there, I understand?
[Magisk] hubernomiddlenamesng:
Alright I'm new to this whole fingerprint business. If I'm running stock Pixel 7 rooted, how would I get a valid fingerprint? Seems like people saying you get one if you are running stock, but I am (rooted but not CFW). I have an old stock unrooted Pixel 1 XL. If I were to extract the fingerprint there, it would make my phone show up as a Pixel 1 and cause issues since the Pixel 7 can only run arm8 or 7a, i forget, correct?

Would I need to reflash firmware, extract fingerprint, then reroot and perform the file edit as mentioned from this module?
[Magisk] xSnowLeopardx:
New to fingerprints as well. Have 2 questions.

Following the nooby guide right now (:

1) Do I have to name the .json custom.pif.json or without the custom part and replace the file already in there?

Just tried the first time and went to check in the Play Store, but it fails + it shows my own fingerprint (from my OP device while using something else).

2) I did not touch the 7th and 8th line in the .json file. Do I have to? I changed, like the tutorial said, the first 6 lines.
[Magisk] gpvecchi:
Device launched with Android 9, and then updated to 10 are acceptable? Can I extract build.prop for a firmware file?
[Magisk] dnfm:
Yea, I can't get this to work at all. All the previous versions of PlayIntegrityFix worked for me until google blacklisted them, but then I installed 14, edited the pif.json file, rebooted, and not only do I not pass certification, getprop/nothing else gives any indication anywhere that it's actually doing anything.

I see it loading in the magisk logs, and there's nothing odd that appears to be going on or any errors, it just.. doesn't seem to do anything.

getprop should show me the fingerprint/settings that i put in my pif.json, yes? The *only* thing I see in logcat | grep PIF is 'ro.product.first_api_leve' 29 -> 23 (although they show their original values in getprop too)
[Magisk] i5lee8bit:
Lol, I flashed back to oldest possible firmware I had and pulled that print, working. Luckily I also had OTA zips archived on my old laptop and updated to next oldest firmware version. Pulled that info, working. I could probably get quite a few this way!

Of course it would be a good idea to not put all my eggs in one "basket" (device), so I tried using values from some publicly available firmware dumps for another device and those are also working. Some didn't, some did and I swear sometimes there seems to be no rhyme or reason - definitely a good bit of trial and error here, but after just an hour or so (plus the time it took this morning to get my first working config), I have nearly a dozen working configs across 3 devices... But I believe the ones I will need to "protect" the most will be the ones I pulled from old personal devices (devices I have in physical possession) for which I don't see publicly available firmware dumps (at least from a quick Google search)...

Happy hunting!

Edit:

I don't believe so. The module is injecting those values only to the unstable gms process. It doesn't simply modify / overwrite the props file.

You're only seeing that one line likely because you're running the logcat command too late. Do it immediately after boot.

Perhaps also make sure you're using latest Termux (if that's what you're using) from their GitHub, then also do

pkg update

pkg upgrade

to ensure everything is up to date.

Edit2: I'm guessing you already did since you saw output, but also make sure you run the logcat command on superuser prompt.

Edit3: It probably is working, since it did at least change the first api level... although I haven't looked into everything enough to know whether that's the new intended behavior when it's left blank.

apology for all the edits - i'm also doing all this while watching after my 2 kids, and i don't really have the opportunity to double check and reference stuff as much as i'd normally want to...
[Magisk] Revontheus:
The easiest way is to get a 2nd-hand phone (like a used iPhone or Android) and put your banking apps there. That way, your main device can be rooted without having to worry about your banking apps not working.
[Magisk] dmenezes:
I'm happy for you. I don't own any physical devices except the one I use, so I was reduced to look for online dumps containing system/vendor build.props; found a specific site with a TON of these.

Regardless, I just spent the last 5-6 hours filtering them to conform to @osm0sis recommendations (ie, vendor/build.prop with first_api_level <28, skipped all Google devices) and selected about 20 of them.

For each one of these devices, I put system/build.prop (more often than not, system/system/build.prop -- yep, double "system/" ) as build.prop, and then vendor/build.prop as vendor-build.prop on the same directory as @osm0sis's gen_pif_custom.sh script and ran it, then copied the resulting custom.pif.json to my device's /data/adb/json.pif, then put it into Airplane mode, and for both Play Store and Play Store Services, force-stopped then deleted all storage; finally, I rebooted, turned Airplane Mode off, and used SPIC to Make Play Integrity Request: ALWAYS got only MEETS_BASIC_INTEGRITY, *never* MEETS_DEVICE_INTEGRITY.

And yes, I have the latest v14.0 PIF module installed in Magisk, and also have denylist enabled and properly configured (was working with PIF 13.9 until Google started rejecting its built-in fingerprint).

Just as an example of the pif.json contentes for my latest try (which did NOT work, so I understand there's no problem posting it here):

View attachment 6039103

Using `logcat | grep PIF`, I see PIF is working and returning the values that I put into json.pif (but only for FIRST_API_LEVEL and SECURITY_PATCH, nothing else gets logged so I guess the other props are not being requested):

View attachment 6039105

I have *NOT* installed MagiskHide Props Config as its main page says clearly it's obsolete and abandoned, and no one here except @GROOVYJOSHCLARK (no offense meant) has mentioned needing it.

What can I possibly be missing?

TIA!
[Magisk] bakaekze:
There are several

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89189572

and

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89189970

RU: https://4pda.to/forum/index.php?showtopic=826244&view=findpost&p=126613823
[Magisk] dmenezes:
Yeah, that would be great -- until other apps besides banking start requiring Play Integrity too (games would be first if not there yet, because of cheats etc). These could be put on a 2nd hand phone too -- but then it would have to be a much more powerful phone for good performance. And where does it stop? Potentially all apps will one day require Play Integrity.

We need a better solution than that.
[Magisk] digger16309:
That doesn't help people who use Google Wallet, which I think most of the posters in this thread do use (I don't). I need Integrity for other reasons - primarily for MS apps for work. I have a backup non-rooted device in case my daily driver security is no longer acceptable. Google blocking the fingerprint in PIF every half a day is lame. Really, how many users are doing this as a % of the whole of Android users? It seems deliberately petty like someone has an axe to grind, rather than a serious security gap.
[Magisk] V0latyle:
See my post above

You get the fingerprint from the build.prop of an older device's firmware, usually in /system/system/build.prop

No because this module only spoofs the print for GMS specifically and does not change global props on your device

You don't need to do anything with your current firmware. If you wanted to experiment with your Marlin you would download the factory image from here and extract the build.prop. If you have the ability to flash the firmware, you have the ability to get the information you need without flashing the firmware

v14 just uses pif.json in /data/adb, don't rename

in some circumstances first API level can be blank, not sure about security patch

Device launched BEFORE Android 9

doesn't matter what it was updated to, has to have been launched with 8.1 or lower

If you're passing BASIC and DEVICE then what's the problem? it's working properly

At that point just carry cards and do your banking online
[Magisk] dmenezes:
OK re: carry cards, problem is that many banks require their app working on the phone to provide one-time codes to confirm operations (similar to Google Authenticator, except these banks do their own thing). So moving to online banking does not solve it.
[Magisk] sawdoctor:
I have a couple of old really obscure Chinese phones that launched with android 8.1.0 are the fingerprints from these likely to be useable? Think that's all that's needed isn't it
[Magisk] dnfm:
I never said it was passing basic and device. Because it's not.
[Magisk] bakaekze:
Hey! Please update the link in your great guide to the latest version tag on github!