yashsingh1/xdaforums huggingface dataset:
[General Questions and Answers] lordman1135:
I did that,but still have the same problem.

I think its from abled the OEM unlocking from developer options in setting, i can say that i am sure that because:

1. Went to twrp recovery mode and reseted to the factory and wiped all options in wipe advanced with old system.

2. then flashed the offical rom by odin( after flaching the OEM unlocking option stayed on).

3. installed uber driver App and signed in, after that i have had the same problem.

4. after that i unabled the OEM unlocking and that reguested factory reset.

5. now after OEM unlocking became off, I installed uber driver App and I singed in and went online without this problem.

But I want to go online with root, to be able to change my location when I work
[General Questions and Answers] pndwal:
Good find... But please confirm you had PI deviceIntegrity w/ root...

Issue may be a number of things as factory reset wiped all data, ie configuration for everything...

Re. detecting OEM unlock, many apps do do that...

Not sure about OneUI (?; Sammy) devices, but on my MIUI (Xiaomi) phone I can just set OEM unlocking off in Developer options (only asks for restart) and it's not detected any more but still unlocked... Actually I can disable both that and USB debugging then turn off Developer options also to avoid detections for banks that check all 3 with no issues... Maybe more complex with Sammy Vaultkeeper etc, but not sure if LV A8 Sammy had that...

You could try try adding this code inside /data/adb/modules/safetynet-fix/service.sh

# May make bank etc apps happy
resetprop sys.oem_unlock_allowed 0

Per:

# Late props which must be set after boot_completed
{
until [[ "$(getprop sys.boot_completed)" == "1" ]]; do
sleep 1
done

# SafetyNet/Play Integrity | Avoid breaking Realme fingerprint scanners
resetprop ro.boot.flash.locked 1

# SafetyNet/Play Integrity | Avoid breaking Oppo fingerprint scanners
resetprop ro.boot.vbmeta.device_state locked

# SafetyNet/Play Integrity | Avoid breaking OnePlus display modes/fingerprint scanners
resetprop vendor.boot.verifiedbootstate green

# SafetyNet/Play Integrity | Avoid breaking OnePlus display modes/fingerprint scanners on OOS 12
resetprop ro.boot.verifiedbootstate green
resetprop ro.boot.veritymode enforcing
resetprop vendor.boot.vbmeta.device_state locked

# May make bank etc apps happy
resetprop sys.oem_unlock_allowed 0
}&

if you are confident it shouldn't cause issues for Samsung devices / have backed up your stuff; trick has worked fine for many users but not sure of devices...

Nb. May also have been detecting USB debugging or Developer options (or other things) too since you did wipe /data... You could simply try with these disabled, or take a look at this XPosed module:

https://github.com/Xposed-Modules-Repo/xyz.xfqlittlefan.notdeveloper

... Guess you have LSPosed for HMA...

🤠 PW
[General Questions and Answers] lordman1135:
i installed iamnotdeveloper App and enabled it in LsPosed, still detected unlocked bootloader.(these screenshoots with orginal Magisk 26.1:

for code writting, i really dont know how to write this code on my phone, can you please explain that in detail to try it.

thanks a lot anyway.
[General Questions and Answers] pndwal:
So need more/other than hiding USB debugging / Developer options...

Very old USNF... Why not use 2.4.0 mod 1.3 or 2.0?...And why put LSPosed + modules in denylist? Do you want to hide/deny root to them?

Just find the .sh file I linked using a root explorer and copy/paste the line as detailed with a text editor, save it there with same permissions set and reboot... Standard disclaimer about denial of all responsibility if you start a thermonuclear war or your cat drops dead as a result of these actions applies... 😬 PW
[General Questions and Answers] pndwal:
BTW, you won't fix vv's Key Attestation app's bootloader status this way... It can be done but only because her POC app validates keys/certificates on device... If/when banks start using Google's method here:

https://developer.android.com/training/articles/security-key-attestation

bank, Uber etc use for modders is finished!... I'm no longer holding my breath...

Bypass for Key Attestation verified on device:

https://github.com/chiteroman/BootloaderSpoofer

... Nb. It breaks stuff.

🤠 PW
[General Questions and Answers] FredMontteiro:
I no have idea how solve it. I reinstalled the stock rom with blocked OEM.

Developer options disabled.

Curious that I can go online on another device with official LineageOs even with the developer options enabled, more curious is that on this other device Play Integrity also does not pass.

I'm guessing that the Uber Driver app knows my phone's Serial Number or IMEI. Were you able to get online somehow?
[General Questions and Answers] Yuri_Rosas:
Curious indeed. I thought it was the bootloader unlocked the trigger. The same trigger detected by some banks, even with magisk.

I'm with lineageOs and even then I can't get online.
[General Questions and Answers] simplepinoi177:
I wonder if you guys did something like Android Faker and changed your IMEI & Serial Number (probably Android ID for good measure) -- if that is indeed what is being blacklisted (i was under the impression that Uber app was detecting unlocked bootloader as well) -- and see if it would work then. Sorry @FredMontteiro , that's an LSPosed module and, as you've already relocked your bootloader and disabled Developers Option, you'd have to re-root and all just go see if this would work....
[General Questions and Answers] FredMontteiro:
My dear, it's not the bootloader, it's not the root, passing Play Integrity won't solve it either.
[General Questions and Answers] FredMontteiro:
I changed the Device ID and was only able to go online for one day, but soon Uber knew that I still had the same device.

I am using Android Faker module on Lsposed, free version, but I believe the module just doesn't work. I downloaded one of those apps that show some device data and then I applied Android Faker, nothing changed.

I conclude that the only way is to make the Play Store identify the device as another. I don't know of a way to do this.
[General Questions and Answers] simplepinoi177:
Did you run it with detectors like Applist Detector and/or Ruru? If those are detecting it, then you may not be setting it up right; and it proves that if they see it then there's a good chance Uber app can too.

Trust me, I'm a veteran in Android and my profession is in computer tech and I still had trouble setting it up and implementing properly....

Also, App Manager also changes Android Device IDs....
[General Questions and Answers] FredMontteiro:
I ran Ruru now, it could see Magisk and Lsposed modules.

I changed ID by editing /data/system/users/0/settings_ssaid.xml.

I have App Manager, could you teach me how it can solve this?
[General Questions and Answers] simplepinoi177:
I made a mistake in my post....When I was speaking on "trouble setting it up and implementing properly...", i meant forgot to mention doing that through HideMyApplist -- that's where I had the most difficulty setting up, then applying it to completely hide everything from Ruru & Applist Detector so if they don't see it then when I apply it to another app that app probably won't see it either. I don't know for sure if using that to successfully hide root from Uber app, but it's not a giamt leap to assume if Ruru and Applist Detector can see it, other apps can too...

If you changed the ID by editing an .xml file, then you did not use Android Faker correctly -- if that's what you meant...

You open App Manager, find the Uber app, and there should be a small button under the title that says "SSAID", that is the Android ID to change. Reboot for it to take effect...
[General Questions and Answers] FredMontteiro:
I also changed the ID with the App Manager, from what I noticed the App Manager does exactly the same as I did manually, ie nothing has changed here, Uber Driver continues to identify my device.

I'm going to try migrating from Magisk to Kernelsu and then changing the Uber ID again. I believe Ruru and Applist Detector cannot see KernelSu. Do you think it can?
[General Questions and Answers] simplepinoi177:
Android Faker changes a whole host of things that might be identifying it (Imei, Hardware Id, Mac Address, Mac Bssid, Mac Ssid, Bluetooth Mac, Android Id, Sim Serial Id, Sim Sub Ids, Mobile No, MediaDrm ID, Sim Operator) There are 2 or 3 that are only available in paid -- i know not IMEI, hardware, phone number, ad id, and Android id.

Also there's IAmNotADeveloper if you think it's detecting Developer Mode or USB Debugging.

I know there is a locked bootloader spoofer, but i think it doesn't work a lot of the time or it only works successfully in certain things only.

I know Ruru has a field that shows detecting KernalSU, and i was getting flagged for it with my Magisk, but i was able to hide & resolve it.
[General Questions and Answers] FredMontteiro:
I'm using Lsposed Riru version. Android Faker is installed and activated perfectly, yet the Android Faker doesn't seem to be able to allow Uber Drive to identify my device.

I Think AF is working well because the app can change my Wifi SSID and MAC successfully.

How did you hide Ruru from Magisk?
[General Questions and Answers] FredMontteiro:
As I said earlier, I think Uber knows my device model, because Play Store knows too. So i think is need make Play Store

not identify my device model, how?

If I try to go online on Uber with another cell phone of the exact same model, I probably won't be able to, I think.
[General Questions and Answers] pndwal:
As I said to you, seems likely they are now enforcing strongIntegrity... If this is so knowing your device model is immaterial...

As app requires A8+ device anyway, there won't be much collateral damage from this requirement; only A8+ devices with broken keymaster implementations (or otherwise broken AVB chain of trust) like many OnePlus devices...

So again, do you users know of any OnePlus devices that launched with A8+ that won't work with UD even locked?... That could be a good confirmation... Clearly we can't test with locked basic-only attestation (sub A8/keymaster 3) devices as A8+ is mandatory... PW
[General Questions and Answers] FredMontteiro:
I run Uber in my other device, Its a Samsung with oficial LineageOS. This Samsung only meets basic Integrity. How can I run Uber normally in this other device?
[General Questions and Answers] simplepinoi177:
In LSPosed setting, on the top right, make sure nothing is checked under "Hide" and make sure you got all Uber related entries.

You need to confirm if AF is, indeed, working. Try applying it to the Play Store or game (or an app that does the following as well) that saves progress & stats server side, clear data, and apply AF and see if you do start the app/game back from scratch -- if you don't, then AF isn't applying correctly, and if you do, then simply including it in the LSPosed part of the app should ensure it should be applying to the Uber app just as much. Also, just as with the game/app, be sure to remember to clear data on the Uber app when applying AF.

I hid Magisk from Ruru through Zygisk DenyList. I tried it with HMA, but it wasn't successful.

Also Displax has had issues with his USNF MOD 2.4.0-MOD_2.0, try the app with USNF MOD 2.4.0-MOD_1.3
[General Questions and Answers] FredMontteiro:
Yes, I checked and all entries referring to Uber are marked in AF. I also applied AF to Play Store and cleared PS data, after reboot I noticed that PS started up as if it was the first time.

So I assume AF is working.

I did the same with Uber and I still can't go online using my device. About USNF I already use MOD1.3.
[General Questions and Answers] pndwal:
I'm not clear what you're saying here... Do you mean UD is working on one unlocked device with LOS and it (presumably) meets PI deviceIntegrity? And you're trying to get it working on another unlocked Samsung device that only meets basicIntegrity? 🤔 PW
[General Questions and Answers] FredMontteiro:
No I just said UD runs normally on my Samsung which just meets basic Integrity and I can't use UD on my Xiaomi which meets "basic Integrity" and "device Integrity".
[General Questions and Answers] pndwal:
Ah... Well that's actually very good news... Even Dev for PIF concluded UD is enforcing strongIntegrity... If its working on unlocked Sammy it clearly isn't...

Maybe the MIUI factor is why I didn't succeed either (RN8T, stock MIUI A11)... Please say what Xiaomi device and OS...

Also, even though you should easily pass deviceIntegrity with @Displax v2.4.0-MOD_2.0 or v2.4.0-MOD_1.3 (may still have MHPC active and interfering or other issue... not running selinux permissive?... Other mods/modules?), knowing UD isn't even enforcing deviceIntegrity is another prize piece of info...

Suggest you check and post Momo detector results for working Sammy and failing Xiaomi device for comparison... 👍 PW
[General Questions and Answers] FredMontteiro:
My Xiaomi is not Miui it is Android One. Mi A3 model.

MHPC is active in Magisk, but I didn't apply any commands in Termux, just to be sure I reset all MHPC settings in Termux.

No mods here, just AF in Lsposed, the Riru and USNF Displax MOD_1.3 magisk module. Developer Options and USB Debugging are enabled, but on Samsung too and there UD runs fine.

Samsung is unrooted. But I already tested UD on my unrooted Xiaomi Mi A3 with locked BL and I couldn't go online.
[General Questions and Answers] pndwal:
Ah... I bought that phone for a friend... Wished I'd got one...

With MHPC not configured one function is still active by default; sensitive prop resetting (MagiskHide sensitive props)... Doubt this affects however...

'Broken Tee' (actually it won't be; Tee OS for decoding DRM, fingerprint scanner etc is probably fine... Really just OEM keymaster implementation for AVB signals as used by droidguard etc is broken) on A3 is interesting too...

Ah... So likely some trace of root is detected in other devices...

So couldn't use A3 even stock and locked!... Now looks likely that it's checking Key Attestation Certificate extension data (Nb.this is done independently of device integrity APIs):

https://developer.android.com/training/articles/security-key-attestation#certificate_schema

since Keymaster implementation is broken on A3...

Please say what working unlocked Samsung device you are using... PW
[General Questions and Answers] simplepinoi177:
If I were you, I would revisit the fact that you're Magisk & modules are still being detected. Also, "init.rc is modified" is also being detected in another screenshot you made.

I didn't realize how finicky Uber driver app is with rooting! I only looked into it just now looking into your issue, and man are they really finicky about it.

I mean, I know you suspect that they totally blacklisted your actual phone number and IMEI -- so passing all of this might be moot, but regardless; you shouldn't/wouldn't be able to get it working even if you are getting Android Faker working perfectly as you intend as the root detecting will still stop you. And, as I said before, if Ruru is detecting those -- and as finicky as I've now found Uber driver app is about root detecting -- then you can be sure Uber driver app is detecting it also...!

If you think Android Faker is working, then that should take care of being blacklisted. I read somewhere here how capable that module could be if used cleverly -- one member claims to use it to repeatedly (end-to-end) get free trials from a carrier; making them think it's a new phone each sign up!
[General Questions and Answers] FredMontteiro:
No I remove MHPC and install Safety Net Sensitivity Props by HuskyDG. Also i use Magisk Delta from HuskyDG, I always use Delta. About Samsung device is A5 2017 with oficial LineageOS.
[General Questions and Answers] FredMontteiro:
I used root with UD for 4 years on that same Xiaomi, the Uber restriction started this August.

Anyway I don't think they are that meticulous with root, as I said I can't go online even with BL locked and unrooted on Stock Rom, with Developer Options and USB debugging disabled.
[General Questions and Answers] FredMontteiro:
I'm pretty sure I'll only go online on UD if I can change how Google identifies my phone model.
[General Questions and Answers] simplepinoi177:
based off of the thread below i read through a little bit, i would say they are that meticulous with it.

https://xdaforums.com/t/go-online-from-a-different-device-unable-to-authenticate-device.4610975

and the fact of having a locked bootloader on stock ROM might not bear too much weight based off of the below thread; also it seems to show them ramping up on root detection just recently (which is why you could run it with root for 4 years before). But, in this instance, it was an error on Uber's, but i think it goes to show that their setup in the app is at least so very sensitive that that may be an indicator of it not being a given.

Can't to go online - Unable to Authenticate device

www.uberpeople.net
[General Questions and Answers] simplepinoi177:
if this is true, wouldn't MHPC be enough to bypass it all then?
[General Questions and Answers] FredMontteiro:
In the past MHPC changed that, now it doesn't.
[General Questions and Answers] pndwal:
Ah... You said "MHPC is active in Magisk..." above...

Be aware that it's very experimental... Does have native bridge loaded Zygisk, but based on old commits for POC from Maru fork, not the newer WIP NB-Z for official Magisk from Shana's Metagisk LSP forth as built in Alpha fork... This one works to bypass detection for many more banks already...

Ta...

So no strongIntegrity is even possible as launched with 6.0.1... no fallback to basic is needed (USNF registers a fake keystore to cause the exception that triggers this for A8+ launch version devices) and no prop mismatches needed to bypass server end hardware-backed evaluationType enforcement to achieve deviceIntegrity either... Of course none of this is needed for UD anyway, but the only time thing preventing deviceIntegrity on that device is likely a matching security-level patch prop date value that matches the fingerprint prop LOS built with...

Further, the fact that so far only a LV A6.01 device is known to work with UD suggests to me that it's even more likely that UD is polling key attestation extension data and simply enforcing

VerifiedBootState: Verified (0) or similar when attestationVersion is 2 or greater (keymaster 3+)... If my guess is correct, this is effectively the same as enforcing Google's PI APIs strongIntegrity while allowing devices that don't meet the hardware requirements to be exempted...

I'm not certain of this, but I have wondered why there's little evidence of apps using the Key Attestation verification model Google has laid out so plainly, for some time... I just can't see why they wouldn't... 😬 PW
[General Questions and Answers] FredMontteiro:
I was able to change the way Google sees my phone model, now it's unknown, see the screenshot. Now I can go online.

Ruru now does not identify Magisk on my device.

These two steps were necessary, only one of them does not solve.

It was not necessary meets strong integrity.
[General Questions and Answers] pndwal:
So UD now opens / works?... Well done! 👍

Please say how you changed this...

Not sure what you mean by this... Do you mean Riru hooking/injection was detected before?

Please say what you did...

Well we knew this since it woked on Galaxy A5 which doesn't even have complying hardware for strongIntegrity... But Good stuff n. well done!... PW
[General Questions and Answers] FredMontteiro:
A long trial and error procedure, I will attach the procedure below.

Ruru not Riru, its a fork of the ApplistDetector

GitHub - byxiaorun/Ruru: An android sample app of detecting suspicious apps like magisk manager

An android sample app of detecting suspicious apps like magisk manager - byxiaorun/Ruru

github.com
[General Questions and Answers] pndwal:
Many thanks for your great efforts and allaying UD modder-users worst fears!...

The procedure outlined will definitely assist others...

Ah yes... I have it... Misread! 😜

Incidentally you can hide all LSPosed modules by adding in Hide My Applist LSPosed module template... (Same Dev as ApplistDetector.)

Guessing proper root hiding (Nb. Denylist is NOT; it's actually a development tool that happens to retain some original MagiskHide code, and actually breaks modules that inject code in processes in list... Proper hidelist based solutions won't do that; they don't 'deny' Magisk modifications and have additional mechanisms to hide Zygisk and other traces of root properly) like Shamiko (hijacks inactive Denylist's list as a hidelist for convenience) should also work fine and will be needed for other apps...

Nb. xPrivacyLua may cause issues for other apps as it generally cannot be properly hidden AFAIK... Apparently causes deviceIntegrity to fail on some devices...

... So key elements were Zygisk on KernelSU running in Magisk, Alpha Magisk or KernelSU and use of Android Faker, xPrivacyLua, and App Manager modding utilities...

🎉👏👍 PW
[General Questions and Answers] simplepinoi177:
It's amazing to think that after all of this detecting that's stated through all the threads I've seen discussing this issue, the one thing Uber driver app doesn't detect is XPrivacyLua?!?!?!? Everyone was under the impression that Uber driver app detected bootloader status, USB Debugging, Developer mode, Magisk, Riru (possibly), LSPosed, SafetyNet, Play Integrity API, that and possibly more, and yet it doesn't XPrivacyLua?! That's incredible...

I'm very happy you figured it out and will probably help others figure it out as well. I'm also very glad I gave you vital clues that helped you with the process like Ruru, App Manager, Android Faker, unhiding everything in LSPosed, and even HMA (though it seemed you ruled it out as requiring it).

If you don't mind, can I ask why you didn't post the steps and went about attaching a text file? It might probably be more helpful to those who are having the same issues (or need the ideas) if it were posted/published here (if anything, so the keyword terms would be in search indexes for Google and this site as well). I can understand you not doing this if this is precisely what you don't wish/intend (maybe you don't want Uber to get wind of it?)
[General Questions and Answers] :
Doesn't work on Pixel 7, and checking play services and play store on lsposed for Android faker and xprivacylua breaks safety net and play integrity
[General Questions and Answers] FredMontteiro:
I don't know why. Which Magisk modules are you using?
[General Questions and Answers] :
Magisk alpha, last version, I did exactly what you have explained, several times, but still Uber can't authentificate. If now we are sure that UD doesn't require strong integrity or bootloader locked, we should figure how exactly they are detecting rooted devices
[General Questions and Answers] FredMontteiro:
If you are already using the Play Integrity Fix module, you can try removing it and using Displax's Safety Net Fix.
[General Questions and Answers] :
I have to clarify for those who are interested that this problem "unable to authenticate device" exists since at least since April. Uber implements these features step by step by accounts of the drivers. Not by the app updates. And still some drivers are able to go online with rooted devices.

Tried that but you can't select any google apps with any lsposed modules or it breaks play integrity
[General Questions and Answers] simplepinoi177:
I'm unsure if it's just because it's my device or not (Pixel 7 Pro), but I'm able to do just that on many multiple apps and am able to pass Play Integrity -- at least enough to do Google Wallet, find Netflix and such in Play Store (device is certified), and very few apps keep from working from detecting root.

I've seen USNF-MOD work successfully at hiding stubborn bank apps & Microsoft Teams on Xiaomi & OnePlus devices with or without LSPosed modules applying to Google services...