yashsingh1/xdaforums huggingface dataset:
[Magisk] Dkpost3:
Hello, please tell me how to add the firmware according to this manual to pass the test. When trying to sign an assembly, gp files are skipped, with the comment that a special key is needed.

Signing Builds | LineageOS Wiki

wiki.lineageos.org

PS I signed the firmware and assembled it OTA. When I try to flash the recovery it says that the signatures do not match. I ignored it and asked for it as is. I launched it - the GP does not pass the test as expected :( :(
[Magisk] 4RCH1 H4CK3R:
I previously tried that in lineage violet with magisk root, and got device_integrity
[Magisk] chiteroman:
To sign a ROM that way you need to download the Android source code and compile it....

An easier way would be to use avbroot!

GitHub - chenxiaolong/avbroot: Sign (and root) Android A/B OTAs with custom keys while preserving Android Verified Boot

Sign (and root) Android A/B OTAs with custom keys while preserving Android Verified Boot - chenxiaolong/avbroot

github.com
[Magisk] Dkpost3:
One more question for experts: will it change anything if use a ready-made kernel from the official firmware, as I understand Google Play does not skip certain lines from the kernel sources? (as a temporary solution, a workaround). I'm sorry if I wrote nonsense.
[Magisk] Dkpost3:
That's what I need to build the ROM

keys gp skip(
[Magisk] wileecoyote7:
Hello everyone,

Is there anyone passing device integrity on custom ROMs right now?

I'm using an Official CrDroid on my lmi and as far as I can see it is a signed build.

I'm using latest version of PIF by chiteroman and removed every trace of customization (I was using the old pickaprint.sh script), but I can't manage to pass device integrity. I've already tried uninstalling and reinstalling the module.

Any tips?
[Magisk] Dkpost3:
+1
[Magisk] Eula13:
but you only pass basic that way unless you have an older device (<=android 8?)
[Magisk] samhhmobil:
Yes. On different devices. It's working.
[Magisk] Lobod:
Will check cert in a minute but as far as i know CRDroid builds are signed with test-key.

Edit:

crDroidAndroid-14.0-20240519-lmi-v10.5.zip	Version: 3 (0x2)

Serial Number:

93:6e:ac:be:07:f2:01:df

Signature Algorithm: sha1WithRSAEncryption

Issuer: C=US, ST=California, L=Mountain View, O=Android, OU=Android, CN=Android, emailAddress=android@android.com

Validity

Not Before: Feb 29 01:33:46 2008 GMT

Not After : Jul 17 01:33:46 2035 GMT

Aka android test-key
[Magisk] 4RCH1 H4CK3R:
I got device_integrity on violet with lineage(magisk)
[Magisk] sawdoctor:
Just watch this thread and wait, pretty much all you can do. Most of the lead Devs from the custom roms are already posting their findings in this thread and working hard to find a solution. Hopefully it won't be much longer as they have most of it figured out.

If you can't wait then rooted stock will work
[Magisk] zgfg:
Yes for me on the custom Xiaomi.eu ROM (Xiaomi.eu is custom) with PI Fork (with Sailfish and private prints)
[Magisk] joeyhuab:
This doesn't seem easier in the slightest. It requires relocking bootloader which is sketchy at best for xiaomi devices and I can't even comment for realme and the others.
[Magisk] EAZY BLACK:
i tried setting kernel string to perf or even empty nope still only basic on the los 16, i guess its that signed builds now that chiteroman said
[Magisk] razz0s:
Hi, I've got strange issue that play integrity check shows either no integrity, or meets device integrity in consecutive test.

This is without doing anything, just re-running the check. I suppose this is not how it should work, but I have no idea where to start troubleshooting. Any tips?View attachment 6106441View attachment 6106442
[Magisk] GN-z11:
Bruh? How have you done your "personal experiments"? It's already known info that anything that have hardware enforced integrity devices' FP will automatically be basic once used as spoof to any custom ROMS.
[Magisk] beeshyams:
Maybe cached info? Delete the cache of app and test
[Magisk] zgfg:
On Xiaomi devices Bootloader can be relocked easily, by Fastboot (no interaction with Xiaomi)

However, it must be (all vendors) full stock official firmware (and ofc Factory reset)

And they can be unlocked again - didn't try but found confirmed

(Btw, as said above, with custom Xiaomi.eu PI still work, but that's also MIUI, not AOSP)
[Magisk] Vgl12258:
Actually there is a "easiest way", just generate your private keys and use PRODUCT_DEFAULT_DEV_CERTIFICATE poiting to your private keys, btw: View attachment 6106447
[Magisk] Lobod:
Just started to think: "What will google gain by forcing us to sign our builds?"

They will probably hide behind "Cultivating good practice"

They will have a universal way to distinct all custom ROMS cuz it will use different keys.

TBH we can use common signing key but it will be banned as well...

But why is it that important for them?
[Magisk] sawdoctor:
Perhaps like osmosis said a few months ago they just want us to be "quiet" ? If they can make it more difficult to root/run custom rom and reduce our numbers so that we are less noticeable by banks etc they will leave us alone?

They don't want to kill off the rooting/modding community as they contribute to the AOSP
[Magisk] Dkpost3:
Xiaomi.eu - this This is a Chinese miui in which, with the help of available utilities, something is added or removed. De facto, this is how miui was and remains.
[Magisk] Lobod:
Sure, I didn't think about that. To be honest when I have checked this thread last time when it was like ~300 pages long.
[Magisk] osm0sis:
I honestly think this is a good thing. This was low-hanging fruit yet again, and they're pushing the community in the right direction. testkeys are only meant to be just that.

I think my exact words were "they're inviting us to be more clever" and in this case also more secure. 😛
[Magisk] Dkpost3:
contribution is the wrong word.

AOSP is what is called android.

come to China and tell me about the problem with Google Play. )))) Google what? who is this?)
[Magisk] zgfg:
Yes, it is Although made from CN (not for all devices) it is tuned to work internationally

(And nonetheless, I like it more than LOS and AOSP ROMs)

But my point was that Xiaomi.eu team builds and signs the Xiaomi.eu CUSTOM ROMs (and yeah, they pass PI)
[Magisk] 4RCH1 H4CK3R:
I meant editing system files in the update package, also tweaking existing modules.

And no module or ROM ever tried to use default FP, so I stated it personal experiment
[Magisk] Dkpost3:
noooo. this hacked and recompile only.

it is not difficult to add what is not in the Chinese firmware, simply transferring it from the global one, while it is the same device
[Magisk] zgfg:
Ok, they don't build from source. But since changing the comtent, it must be redigned

And with Xiaomi signature, it would not require unlocked Bootloader
[Magisk] EAZY BLACK:
just signed my build , and yep device passes

before it passed only basic

pif module 15.9.9

kernelsu

microG + Phonesky (Play Store)
[Magisk] Dkpost3:
this phenomenon has a name - localized miui

View attachment 6106475
[Magisk] zgfg:
IMO, with Xiaomi signature, custom MIUI/HyperOS ROMs should not require unlocked Bootloader

But ok, I don't know whose releasekey it is, pem is password protected
[Magisk] Chrisch_91:
Since update i lost safetynet cts and play integrity just basic.. have playcurl installed (oneplus 9 pro, a14 aosp cuatomrom).
[Magisk] chiteroman:
Updated OP to avoid repeated posts about the same issue...
[Magisk] purgy:
As if anyone reads that at this point 🤪
[Magisk] joeyhuab:
Do tell which ROM as well so everyone can try for themselves.
[Magisk] immortalwon:
Can someone make a guide how to sign custom roms like evolution x?
[Magisk] osm0sis:
You'd have to build the ROM yourself.

The way forward right now seems to be that all custom ROMs start using their own private release-keys.

I've got a DG stackplz output from this morning, but it's 4.5mb and I doubt I'll find anything useful.
[Magisk] pndwal:
Just for technical clarity/understanding (not that I'm suggesting it makes much difference regarding your observation 😉), I don't think S/N (or PI) reside in DroidGuard (despite the GSM unstable process being referred to as SafetyNet process by TJW and others before DG functions were better understood).

Both S/N and PI APIs use DroidGuard measurements but not all attestation measurements are obtained from the DroidGuard VM... Simple root and SELinux checks are performed in a Java class of GMS Core while advanced checks for root, bootloader status etc are handled by DroidGuard... Of course, Google controls the attestation parameters; DroidGuard is a custom VM that runs proprietary bytecode which is dynamically downloaded from the Google backend servers and unique for each attestation request, and both GMS core + DroidGuard check results are included in the Protobuf message that is sent to Google's back end; That's where determinations for S/N basicIntegrity & ctsProfileMatch or PI BASIC_INTEGRITY, DEVICE_INTEGRITY etc are made.

So while the realtime DroidGuard calls may ask for more or different measurements, the algorithms used by either S/N or PI APIs to give passing or failing verdicts are implemented serverside, and must be updated there rather than in on device in DroidGuard.

🤠 PW
[Magisk] EAZY BLACK:
it was crdroid android 11
[Magisk] Cristiano Lira:
Yeah, so, with a signed rom PIFork would work or only PIF?
[Magisk] Lobod:
Both will work ONLY if your rom IS signed.
[Magisk] DeannWinchester:
Can confirm, crDroid Android 13, signed build.

Sailfish FP

View attachment 6106558
[Magisk] Lubo99:
chiteroman thanks 12.1 works ! you're the man!!!
[Magisk] V0latyle:
No...It either uses a VPN (non root) or Systemless Hosts file (root)
[Magisk] HippoMan:
I re-enabled AdAway, and now Wallet and GPay are working again on that device.

Maybe I did something incorrectly in my earlier test.

Let's see if this is consistent now.
[Magisk] thesingular:
Oh, that's great to hear!
[Magisk] Marvin732:
whats the difference between 12.1 and 9.7.2?

Magisk didnt notify me of a new version until i saw the post here
[Magisk] HippoMan:
I'm going to install PIF on my everyday device now.

Question: if I set the device date to be several days in the future and then go though the install procedure, how long does the device date have to remain at that future setting?

After PIF is successfully installed, can I reset the device date back to the real date? Or should I wait a while before doing so? If I should wait, how long?

Thank you very much.
[Magisk] thesingular:
@chiteroman did not implement auto updates in his modules so that's to be expected.

As for the differences, there are a lot but the biggest one is that v12 and v12.1 fix Google's latest attempt at breaking the module.(v12.1 is a bug fix to V12)
[Magisk] thesingular:
You don't need to set the device date to the future to install PIF at all. That is only for fixing the complaining Gapps after installing it (Wallet refusing contactless payments or Play store saying device is not certified), an alternative to clearing the data of the related apps that I came across.

As for when to set it back, you can set it back as soon as that is fixed.
[Magisk] HippoMan:
Well, without changing the date, I am being told that I need to install a Google Security Patch when I try to run GPay on this device. When I accept the security patch, Google downloads it and then tells me that there was an installation error ... and they give no explanatory details about that error.

Would tweaking the device date avoid this problem?
[Magisk] thesingular:
Sorry, Gpay isn't available in my country so you'll have to try and see(this is the first time I hear about a Google Security Patch, the issue here might be totally unrelated too). The only reason I claim Gpay should work after using change the date method is that it works pretty much the same way as Play Stored device certification thing from what I can tell about it, and I have tested it on that one instead.

The same method can be used to intentionally make Gapps complain (by having device integrity fail before using the method) so you can try it that way too.
[Magisk] CaptainFedora:
OnePlus 8T running OxygenOS 13.1 (Android 13)

Magisk 26.3 (26300)

Play Integrity Fix v12.1 + Zygisk Next

Google Pay finally works again after it just decided yesterday to randomly fu*k up my payment method. After a long time without having any problems. Thank you!!
[Magisk] HippoMan:
Well, it seems that this "Google Security Patch" issue is just a red herring.

I ignored it and went ahead to add something to Google Wallet via GPay, and with PIF installed, this worked just fine.

I'm now just going to ignore this "Security Patch" nonsense from the Googlefrinchians.
[Magisk] Xx-Ness-xX:
Pixel 5 running stock Android 14 (UP1A.231105.001)

Magisk 26.4 (26401)

Play Integrity Fix v12.1 + Zygisk

Google Pay is working again! Thank you

Donated
[Magisk] ripereira01:
bro, I think your module, it doesn't work on all the roms, I was using a miui rom for my pro k20 called Ori, and it was working, I switched rom, and I went to a miui also a13 miui 14, and it didn't work. Do you know what the problem is? Will there be any correction?
[Magisk] HippoMan:
I'm wondering: is there any way that a future version of this module could spoof that my device has "Screen Lock" set, when it actually is only set to "Swipe Lock"?

I never want to lock my device, and it's a major inconvenience for me to have to lock it in order to use GPay and the Wallet.

If I decided to temporarily lock the device and then add my payment methods to the Wallet or to GPay, as soon as I unlock the device again, those payment methods disappear, and I would have to re-add them to Wallet or GPay if I ever want to utilize them again.

<rant>

My banks issue me debit cards which don't require PIN or Face or Fingerprint locking in order for me to use them. The same banks refuse to allow me to use my Android device to make payments in exactly the same way that I can use their debit cards to make payments, unless the device is locked.

In my opinion, this is stupid, stupid, stupid on the part of the banks.

Furthermore, these same banks are perfectly happy for us to access them via our Windows, MacOS, and Linux desktop computers, all of which are rooted in the same way that Android devices can be rooted.

Under Linux and MacOS, I can do this ...

% sudo -s # sign in to "root"
# chown root:root /path/to/executable
# chmod og+sx /path/to/executable
# exit # return to "non root"

After doing this, any users who run the executable, whether or not they are root users, will be running that particular executable in root mode. This is exactly the same as what happens when Magisk marks an app to run in superuser mode. Windows offers a parallel method to cause any executable to run as "Administrator".

Banks stupidly (IMO) go out of their ways to make things more difficult for rooted Android users than for the millions of people who use debit cards and rooted desktop computers.

</rant>

Anyway, if a future version of PIF offers a way to spoof screen-locked mode, I will be very happy!
[Magisk] thesingular:
I just tried that and failed to make my device not certified. The other way might have been a fluke too, so someone please check and tell me. I apologize in advance for posting wrong information if I'm wrong about that and it was indeed a fluke.
[Magisk] 130ryokohama:
I'm still an error with Google pay/wallet - is anyone able to help?

Android 12, magisk 26401 with PIF v12 and Magisk prop hide config

I've waited about 8 hours now
[Magisk] BillGoss:
PIF 12.1 fixes that.
[Magisk] thesingular:
No it doesn't, that error is because Play Integrity API Checker app has hit its daily API calls limit again.
[Magisk] pr3dicament:
Was it a nightly build? That's the only shot I have without having to manually sign. Someone just posted the scripts so I grabbed those as well. I have a KB2005.
[Magisk] osm0sis:
Official Lineage is signed correctly with their private release-keys, so it's one of the few working custom ROMs currently.
[Magisk] pr3dicament:
How would I sign a rom I want to use manually? I'm not so sure about that wiki people keep showing.

I also run Linux with adb and fastboot built in, along with possibly trying to sign these.
[Magisk] osm0sis:
You'd need to build the ROM from source. Several sets of simpler instructions on the last couple pages of posts here. If you're up to that then give them a read.
[Magisk] pr3dicament:
Alright I'm not a developer so building a rom would feel probably impossible to me unless you have a link or two that are actually helpful. Does running Linux and never using Windows help or hurt me in this case? I want to sign Nameless, for instance. I'd love to build it but I don't have its source. I don't think I can get it.
[Magisk] joeyhuab:
You can't sign a built ROM. It has to be built and signed afterwards. You can't build ROMs who have closed sources (unless you're part of their team) or ROMs that have been discontinued.

Anyways, I'll report back with my signed K20 Pro build once it builds. Give it an hour or 2.
[Magisk] simonpunk2013:
soon then google will ban lineageos, it has so many ways to detect official lineages os, now it only checks for signed bilud.
[Magisk] pr3dicament:
Yeah I asked for some help, like osmeone to point me in the direction with how to build one. Could you give a couple of links maybe? I do have capabilities beyond networking and bash.
[Magisk] osm0sis:
If they wanted to do that they already would have. Same goes for banning 100% of known prints instead of the current 99%.
[Magisk] pr3dicament:
Do you have any other links you could give on BUILDING the rom? I need to grasp this first. Call this an introduction. And yes I am googling as well and looking on here.. most seem to use Windows. I need to know if having Linux hurts me, because pretty much most of what I see is in Windows, all of these tools specific to Windows. Usually I am very simplistic.

But I do have a development environment on my box.
[Magisk] xSnowLeopardx:
To be completely honest, this does not really apply to Google. They will eventually do it, does not matter how much they want it. They want it and they will do it, question is when it will happen.
[Magisk] joeyhuab:
Gotta look for known ROMs to build. They're available on GitHub. Start with LineageOS as the most simple ROM you can build. Or crDroid if you need a bit more features. Or Evolution X (totally not biased). Check their MANIFEST repository for more information. This is beyond the scope of this thread so I really can't help any further.
[Magisk] pr3dicament:
I wish I could just reverse engineer the current rom I have..
[Magisk] simonpunk2013:
yeap, just my guess, I think the DG teams don't want to do it once for all, maybe that is how they survive and save their jobs, otherwise they will get fired for having no place to improve, they are showing their values to google.
[Magisk] pr3dicament:
Is it possible to reverse engineer an existing rom? Theoretically?
[Magisk] pr3dicament:
I'm gonna try LineageOS yeah unless I find the source of the one(s) I want...
[Magisk] makeyourself:
Possibly, although I'm not sure what they were doing for about the last 5 years before the fingerprint wars started lol
[Magisk] sawdoctor:
Tbh it's not that difficult anymore, all the main custom roms have building instructions on their website and have done the heavy lifting for you.
[Magisk] pr3dicament:
It's not beyond the scope of the thread because it's just leading in the right direction to get this to work.. also, is EvoX the one you use? you mentioned BIASED :P
[Magisk] elemenehei:
Yep after the elixirOS piece of malware code..... there i find this as a gentle response from Google . They just basically say that Custom OS makers got to be taking responsibility for what **** they include in the code they distribute or things wont work ...
[Magisk] pr3dicament:
I'll look on the Nameless wiki.

Nope.. not for the latest one. Only the Android 12 has a link that points to here: https://github.com/Nameless-AOSP

I want the one that runs Android 14, the latest one etc. So that's where the source is? I looked under kebab and it didn't look like source code to me.
[Magisk] osm0sis:
Check his forum signature. 😛

joeyhuab

xdaforums.com
[Magisk] pr3dicament:
Yeah yeah I see :P
[Magisk] pr3dicament:
I see that only for LineageOS and uh.. I'm not very good with this, I'm learning the development on the fly the best I can anyway..

Which ones have the instructions to actually rebuild and where are they? When I searched, i didn't exactly find the directions or maybe I msised something?
[Magisk] pr3dicament:
This is where most of the links for Nameless point to when I click on "Source Code": https://github.com/Nameless-AOSP/OTA.git

I cloned it, saw just changelogs. No source of any kind. It makes no sense why they'd say that's where the source code is. Any developers want to chime in here?
[Magisk] InsaneNutter:
I'm passing on lmi.

Official LineageOS 20 build from 21/02/2024

Magisk 27.0

Play Integrity Fork v7

Sailfish PIF I presume most others are now moving over to.

Magisk configuration:

Magisk app is hidden

Zygisk enabled

Enforce DenyList enabled

Google Play Store, Google Wallet, Pokemon Go and my banking apps on the deny list.

No other modules installed apart from Play Integrity Fork v7.

View attachment 6106610

I hope that is of some help.
[Magisk] joeyhuab:
Official LOS means it's signed so yeah. It just needs an updated pif to pass which you already have.
[Magisk] HippoMan:
Yes. So the best we can do is alter some of the parameters that Droidguard obtains from our devices and then sends back to the black boxes (from our point of view) that run on the Googlefrinchian servers. And we can't know when the Play Integrity analysis code running within those black boxes ever gets altered and enhanced.

We're therefore fighting a losing battle with our device fingerprint efforts.

IMO, the only way we rooters and modders are providing value to the Googlefrinchians is by bringing flaws in their Play Integrity algorithms to light so that these flaws can be corrected in order for them to better identify such spoofing.
[Magisk] R55cz:
Hi, im using evolution x (a13) on pyxis, i was using playintegrity next and today, i was shopping and i was unable to pay. Is there any easy fix for it(Easy means you don't need to build rom), or am I stucked and have to bring my card in the pocket? Thanks.

I pass only basic integrity.
[Magisk] shaidshab:
hi

i used sir chiteroman's generate.sh and sign.sh

proccess failed with this error,,any ideas to solve it ?

View attachment 6106617
[Magisk] immortalwon:
I created it a signed zip rom, but when I apply it as an update the device doesn't boot. Should we format everything first and try again?
[Magisk] osm0sis:
Different release-keys changes the encryption key, so on an already encrypted device, yeah, that'll probably be necessary.

I know Lineage has been able to provide "transition" builds before, so hopefully the other major ROMs will be able to do something similar when they start signing with private release-keys.
[Magisk] chiteroman:
I don't use Lineage commands because I sign my builds with same keys for rom, apex and vbmeta.

Just generate your own private key:

openssl genrsa -traditional -out your_key.pem 4096

Run generate.sh one and save ".android-certs" dir, remove that script.

Then when you want to build the rom just run compile.sh

WARNING: these scripts have my own code, you must change to your own.

Then you can compile any rom with same keys, just move ".android-certs" dir and done 😋
[Magisk] shaidshab:
thanks alot sir
[Magisk] Claus….:
I think @chiteroman deserves a lot of credit! We should not take it from him. But ofcourse also you and many other on the forum! I love this forum, most people try to help and contribute. I hope this forum stays alive and never give up!
[Magisk] Bonoboo:
I'd like to remind for those who plan switch from un-official to official LineageOS builds.

To do this without wiping /data you can use script. Here files itself. First is for exporting keys to format used in script, so this applicable for any other ROM. Just keys should be changed in script to corresponding old / new.
[Magisk] chiteroman:
View attachment 6106626

Building signed ROMs is easy 😋