yashsingh1/xdaforums huggingface dataset:
[Magisk] V0latyle:
A lot of this has to do with improper security implementation by said OEMs. Google has revoked the keys for several devices because they were either broken (easily compromised) or leaked

Keep in mind that many MANY OEMs, Samsung included, do NOT follow the prescribed Android model for security implementation; many Chinese OEMs implement broken security, possibly due to political reasons; Samsung on the other hand likes to think they're still a software developer so they use Android as a basic template and try to reinvent everything, while at the same time sticking to archaic methods...for example, they still haven't implemented seamless system updates
[Magisk] V0latyle:
Using profanity is not tolerated on XDA. If you don't understand this, read the Forum Rules.
[Magisk] niko26:
Can't we just intercept the calls and spoof an answer?

I thought we're using a rooted device ;)
[Magisk] Lubo99:
sorry but that was my personal oppinion and I dont understand your action at all. sometimes ugly truth needs to be told by ugly words so it would resonate with/to people responsible for this mess... these people does not listen to "apropriate language" they are the ones doing inappropriate actions...
[Magisk] V0latyle:
No...Play Integrity is designed to be secure, and not only relies on device attestation but Google back end encrypted authentication as well

See here

And especially here

You can still express your opinion without using profanity

And are their actions really inappropriate?

They're trying to market a security API for app developers to use

We are using a known vulnerability that results in their API providing an incorrect verdict of device security state

They're working to improve it so that it accurately reports device state

They're already struggling with marketing PI API because most app devleopers use their own solutions

Google does require a certain amount of device security for their own financial apps, and they do so to absolve themselves of liability

Bottom line: I think your anger is misplaced
[Magisk] HippoMan:
Agreed to all of this.

And I just want to add that there are already non-"banking" apps that are requiring STRONG integrity, or else the app is crippled. The Uber-rider app is one of a number of examples. I'm pretty sure that the McDonald's app and Pokemon Go are two other exampled.

Android is on a downward spiral.
[Magisk] V0latyle:
Yeah, there are a lot of developers out there who require what seems like unreasonable security

For example....the app I use to remotely control the smart thermostat in my house declares that my phone is rooted and I have to accept the risk. Risk of what, exactlly? That I might grant root permissions to a rogue app that will then try to run my heater during the summer?
[Magisk] lm089:
I didn't read your post, so can't comment on the moderator's actions.

But try to be realistic:

why should "Google" (whoever that is supposed to be in that multinational/multibillion company) or any Bank Managers bother to read through 5000+ messages in a discussion thread about spoofing? In fact I really doubt any ordinary Bank Manager would even know about the XDA forums while holding on to their beloved iPhones :ROFLMAO:

(please don't bother to answer; I won't be back in here within the next 24+ hours, and by then this thread will have 2 or 3 additional pages...)
[Magisk] Oswald Boelcke:
Madam, Sir!

I don't need to add anything to that what my esteemed team mate @V0latyle already told you. However, if this doesn't yet convince you - what I doubt otherwise I'd personally assess you completely wrong - feel free to contact me privately to discuss our obvious diffrent opinions about my action.

Very respectfully

Oswald Boelcke

Senior Moderator
[Magisk] mumuli:
Kinda strange, and funny. We cant say bad google bad, but its ok to use turd gif to signature. That is BAD
[Magisk] LucasBS1:
Agreed.

The """profane""" parts could be censored; Instead, the whole post was removed.

And the message I manageg to view WAS already censored anyway...

We all know that google is trying to sell their stuff. Problem is: this war is EXACTLY like the Factory Reset Protection (FRP) feature: 99% of the people trying to circunvent it are legitimate owners who forgot their passwords, while the 1% left is of stolen phones...

Hurts more than helps
[Magisk] osm0sis:
Yeah, a few things here:

- test-keys suggests you got this from a custom ROM, which would never pass in the first place.

- a normal valid fingerprint prefix is in the format "BRAND/PRODUCT/DEVICE:" and those match the values in the corresponding fields, so something wrong there as well.
[Magisk] Oswald Boelcke:
Oh, you can certainly "bad google" but the expressions in the post, which I've removed were differently... I accept that you can note it for that reason.

If you're unhappy with what I did, please contact me privately and I'm convinced we'll solve it but I'd appreciate if you refrain from such public posts.

This thread is already shortly before that it derails and under observation of many moderators. I suggest that everybody thoroughly reviews what's intended to beposted before it's posted.
[Magisk] simpleatom7:
My 2/3 integrity failed & playstore not certified. Seems the cat and mouse game is pacing up.

:((
[Magisk] V0latyle:
Every time a fix includes a print, that print is quickly banned. Best course of action is to build a custom pif.json by finding a working print.

I won't lie, it's neither easy nor simple, but using a print shared by many other people seems to be the problem.
[Magisk] wapsterz:
Dont give up,mate. So far ive found 24 working prints,and saved for later use.
[Magisk] zgfg:
IMO, when that one gets banned, he will replace by the next from his list

So module downloads from the same source and he decides when to replace the source

However, that will IMO just speed up exhaustion of the list

That will also explain why somebody claimed that the v14.1 JSON was already banned - but not for others

Maybe first was banned and he already replaced

So when. posting such comments - please first grep PIF from logcat to find which values were in JSon.

And if next time v14.1 passes, compare to what you had in the previous logcat
[Magisk] maxmax0:
Nah, just don't care to keep up on daily news of a ROM I don't use, and seems they are still uploading the ROMs as we speak 😉

Nevertheless, interesting development for sure.
[Magisk] Vision:
@chiteroman in previous version you have hardcode the fingerprint and we can't see it, neither Google, in v14.1 can you do the same or something similar ? Very usefull the feature updated the fingerprint without update the module, but the fingerprint you add maybe blocked and if other users (like me) have the same in v14 blocked and for us

Edit: I mean make the module like one previous version, have the source code close (for v14.1), so google can't read the fingerprint inside (or take more time to read it) and when @chiteroman updated only the fingerprint and not the module, fingeprint is hide and not visible and not blocked again lot of fingeprint, and for other users who have the same with previous version like v14
[Magisk] dcarvil:
It doesn't matter if the fingerprint is in a file on your device. Google can simply see what devices are hitting their servers.
[Magisk] Lubo99:
why did you remove whole post?? and words written i used * in them so the whole word were not seen.... you could delete only those words and message would be clear...
[Magisk] xSnowLeopardx:
2 days later, my 1st FP still working perfectly.

Don't think I need the other 14 for a long time lol.
[Magisk] Lubo99:
yeah so you are an expert on what google and banks do, right?! :D not every bankers especially in europe use iphones... lol

and you can confirm 100 percent that they dont have whole departments for developing their apps where folks dont know about dev/users android community ?? :D good luck with your knowledge :D
[Magisk] sawdoctor:
I've checked the fingerprint included in 14.1 again and it's still passing 2 out of 3 so really not sure what is happening. It's working for some but not others by the looks of it
[Magisk] zgfg:
By su -c logcat | grep PIF you can read spoofs (unless Chiteroman blocks his logging)

However, Google can ALWAYS SEE, DroidGuard sends all that (that's the purpose of spoofing) to G server that will then respond the verdict

Hence if G eg filters out (by packet names of the requestor apps - that is even visible in the JSON verdict response) all requests coming from SPIC, TBChecker and Play Integrity API checker, they cab see what the spoofed values ppl are using - BCS normal users, who didn't mod their phones, probably never needed/used (or even heard of) those apps to test PI

Then they just need to do statistics (for those passing) and make a decision to ban them
[Magisk] bebop80:
Help needed :)

Please don't be bad with me :-) I am not very good with this root things!

Can someone help as my phone is only passing BASIC integrity ?

Phone is oneplus 8 pro

I have magisk with Zygisk active, hidden magisk, block list active and playintegrity fix and shamiko module installed.

I would be happy to being able to use again google wallet.

What should I do to make it working again? thank you in advance for your huge help!
[Magisk] V0latyle:
Use 14.0 (not 14.1) and find your own fingerprint using the guide linked in the OP.
[Magisk] BrimoFan123:
May

Maybe G is playing game with us? Funny game to them when they could see our confusion?

I can imagine a simple routine here: if there is coming a call with X fingerprint taken from PIF 14.1 then return "fail" for device integrity for every 1 of 10 calls? And next day 1 of 6 calls, and so on...? And watch how people scratching their heads on xda forum.
[Magisk] bebop80:
Thank you so much! I'll start straight away! thank you again!
[Magisk] frank93:
dude. chill.
[Magisk] Vision:
I mean make the module like one previous version, have the source code close (for v14.1), so google can't read the fingerprint inside (or take more time to read it) and when @chiteroman updated only the fingerprint and not the module, fingeprint is hide and not visible and not blocked again lot of fingeprint, and for other users who have the same with previous version like v14
[Magisk] sawdoctor:
I'm still using 14 rather than 14.1 but using the same fingerprint ATM. So far all the failed have been on 14.1 not 14 with the same fingerprint which is really strange
[Magisk] mike.s:
Take it to PM. If you can't avoid using profanity, work on your vocabulary.
[Magisk] V0latyle:
I mean there is some degree of truth to the "game"
[Magisk] Ginosius:
Let's say you can get your own private fingerprint which will work on all current and future custom roms passing both basic and strong integrity, as long as you don't share it of course.

But in order to acquire it.. all you need to do is run around naked through some very busy place, like a shopping mall for example, with your phone (which has the custom rom installed) clenched between your butt-cheeks, flapping your arms like a bird...

Would you do it?
[Magisk] xSnowLeopardx:
Wtf
[Magisk] rom-g:
Google certainly has a pool of servers dedicated to analyzing and processing Play Integrity requests. These servers are probably located in different geographic areas, and may not all be updated at the same time. They can also do A/B testing with their detection code and deploy it in certain specific area.

In the same way, they surely have tools for detecting abnormal activity (for example, a fingerprint corresponding to a device marketed in a restricted geographical region which suddenly starts spamming hundreds of requests per day from all over the world, etc. ...)
[Magisk] titomax82:
14.1 never worked to me (only basic) :(
[Magisk] Nergal di Cuthah:
Did you delete the json file as described in the change log? Or are you using your own fingerprint.
[Magisk] sawdoctor:
The Google servers could also do what we are doing (and a lot faster) and find all the fingerprints and ban them
[Magisk] HippoMan:
Your analogy doesn't relate to anything in the real world that has to do with this fingerprint situation.
[Magisk] EinderJam:
Pardon my ignorance, but what happens to the original phone when Google bans its fingerprint because someone used it to pass device integrity?

Are people using these phones with stock ROM unable to pay?
[Magisk] titomax82:
Never had my own fingerprint, always used default versions of PIF by chiteroman (until 13.9 and they always worked).

Never found /data/adb/pif.json, so no need to delete anything... I'm a very confused
[Magisk] bebop80:
I reply myself. After V0latyle help and checking a bit how to find the fingerprint (and giving up straight away given of the quite "nerdy" stuff and accept the fact to use back again my physical cards for payments) I installed the last version of playintegrity fix module and followed the instructions removing the custom props given by the creator:

"If you don't want to use your custom props to spoof, remove the file."

On terminal as root: rm -f /data/adb/pif.json

It worked for me passed the basic and the device integrity and I have been able to add my cards back again in googlepay :) Hoping it will last long...
[Magisk] Nergal di Cuthah:
Doee your file explorer have proper root access, can you see anything in the adb folder?
[Magisk] Gilg@mesh:
if I understood it correctly, that phone already passes STRONG INTEGRITY so no need for DEVICE to pass.

edit: I was wrong. 💩
[Magisk] Umgak:
Google doesn't need to read the fingerprint inside the module - and looking at how Google has been blocking prints, I doubt they're even using the module to check. Many users all suddenly using the print of a 7 year old phone is statistically significant enough to assume abuse and block it.

The idea of all users finding own prints is to not be statistically significant enough to stand out from the statistical noise inherent in the system on any one single print.
[Magisk] Nergal di Cuthah:
And 14.1 gives that option, as well as the option to have it provided by the module for "ignorant lazy noobs" like me (I'm not i just have yet to find a fp, but others have decried that i am a I.L.N. because i haven't found one)
[Magisk] V0latyle:
No, they only ban the print in mismatch situation

Someone using the original device where print seen by PI matches global print has no problem

you do not understand it correctly

STRONG_INTEGRITY means that BASIC and DEVICE pass and are guaranteed by hardware backed proof of system/boot integrity

it is not possible to pass STRONG if either BASIC or DEVICE fail

The prints we are using are from devices that CANNOT pass STRONG because they were launched before Android 8

Exactly - regardless of how they might be detecting print mismatches, the best way forward is for everyone to use a different print because a bunch of people all using the same print AND calling PI checks is what draws attention
[Magisk] EinderJam:
Ok, are there phones from this era that do not pass strong integrity ? Or does every phone with a locked bootloader automatically pass strong integrity?
[Magisk] titomax82:
Yes, see attached img
[Magisk] Nergal di Cuthah:
Try the modules folder

Or maybe it's already working with the module provided one, try

Logcat | grep PIF

And run a pi check from playstore
[Magisk] Phk:
How did you manage to get this working?

1. installed play integrity fix

2. rm -f /data/adb/pif.json

3. clear cache of google services

4. reboot

^^ if it's this then it's not working for me. Google play store settings still show "device not certified"
[Magisk] Nergal di Cuthah:
What other modules do you have, maybe something else is triggering the fail
[Magisk] manjaroid:
A working print I had working with 14 doesn't work with 14.1 or the v3 fork. Going back to 14 with that print yields device integrity again. The [temporarily] working print shipped with 14.1 works with v3 fork but not 14.0.

For all we know, our Material You colors are having an effect.
[Magisk] bebop80:
I have
[Magisk] Phk:
None. Just coming from a clean format
[Magisk] bebop80:
I have also installed the shamiko module (don't know if it makes any difference). Zygisk is active in magisk and I hide magisk.

I also inserted in the activated block list in magisk PlayStore, Google services and Google wallet.

Double check your settings, maybe there is something I did you didn't 😇
[Magisk] titomax82:
What do you mean by "Try" the modules folder?

Logcat | ... in terminal emulator? I have to install it
[Magisk] Nergal di Cuthah:
There's a folder in your picture that says modules

Yes you need a terminal emulator for logcat, or maybe you can do it via adb. i just use "terminal emulator" from f-droid others use termux (also available on f-droid) but i think it's a little more advanced than i need
[Magisk] Nergal di Cuthah:
Did you kill unstable gms (or reboot as i did because killing the process said no process found) after deleting the json?

Stock rom or custom?
[Magisk] Lubo99:
best way is to use adb wifi to connect and type it all on computer's keyboard. using termux on phone is killing me. and if he has basic of linux he can check folders content via terminal app on pc.
[Magisk] Lubo99:
maybe a stupid question did you check playintegrity folder?if file is really deleted i was aksed by my friend who did same action as you describe but file was NOT deleted :D

xxx:/data/adb/modules/playintegrityfix # ls -l

total 30

drwxr-xr-x 2 root root 3452 .......... __MACOSX

-rw-r--r-- 1 root root 7024 .................classes.dex

-rw-r--r-- 1 root root 261 ,,,,,,,,,,,,,,module.prop

-rw-rw---- 1 root root 305 ................... pif.json

-rw-r--r-- 1 root root 1089 ....post-fs-data.sh

-rw-r--r-- 1 root root 1608 ..... service.sh

drwxr-xr-x 2 root root 3452 ............ zygisk
[Magisk] titomax82:
Logcat | grep PIF in termux

Logcat | grep PIF in termux does nothing....

PI check from playstore only basic

Attached images for folders
[Magisk] Umgak:
Phones from this era (pre-9.0 launch) do not support Trusted Execution Environment (TEE), which is required for hardware-backed key attestation. As such, phones from back then will not pass strong integrity no matter what - even an unmodified, out-of-the-box phone that has never been unlocked or rooted will still fail strong.
[Magisk] Nergal di Cuthah:
Delete the json from your second picture, kill unstable gms

The logcat needs to be running when you run the check (i just learned this)
[Magisk] dmenezes:
Ditto here, 51 hours and counting!

View attachment 6040321
[Magisk] Pakabidu:
First of all - massive thanks to @osm0sis for his guide and also @badabing2003 for his UI Workflow. I'm a complete noob and best I can do is follow instructions. I do like Android and all my phones have always been rooted (thanks to XDA), but this time I nearly gave up - things were going over my head. Spent half Sunday reading this thread thoroughly and by the end of it I felt like I know what needs to be done, another hour spent searching for dumps online and EUREKA!!! - I'm passing device integrity again on my A14 Pixel 6A with Magisk 26.4 and PIF v14.0 and successfully added the payment card :)
[Magisk] arda99:
Please...no more mismatch. If so all FPs even this module will be useless(until fixed).

So do you mean google see some suspicious FP and goes back for extra check? If so why not just check from beginning. IT MAKES NO SENSE.
[Magisk] Lada333:
At this point, we need to add this to OP.

..as if anyone read that
[Magisk] Lada333:
Same here, I installed v14.1 the minute it got released, using its built-in values still passes 2/3.
[Magisk] norberto_:
That closed source is like a minute to read the fingerprint from. That includes the downloading. 🙂

Out of curiosity i have checked one of those earlier versions where it was closed.

Just wanted to see what fp was used.
[Magisk] badabing2003:
Well done, that's what XDA is all about.
[Magisk] wfred:
Wallet will work fine if you uninstall the modules and unroot your phone. No need to relock the bootloader

Edit: ignore that part - meant to type You need to relock the bootloader
[Magisk] Nergal di Cuthah:
The mismatch forces basic check which is how you pass both.
[Magisk] Phk:
Yes i did try the killall and the reboot. coming from custom rom.
[Magisk] arda99:
Force basic is made by providing a custom keystore. If you mean this as mismatch then all FPs are already "mismatched" so this doesn't explain the selective ban.
[Magisk] zgfg:
Google is not like some dumb users that must see the spoofs posted publicly

The right thing that Chiteroman should do is to go back to the model like in v1.40 - his module to be only a framework for spoofing, but that each user must find and set the values for spoofing himself (there is still a pool of available spoofs that work)

That would not prevent Google to eventually close the pipe but will prolong it
[Magisk] Nergal di Cuthah:
They said no more mismatches, so i commented that the mismatch is what the module does.
[Magisk] Nergal di Cuthah:
There's no reason to go back to 14.0. 14.1 works with custom fingerprints like .0 . It just gives people like me an option to have it provided, which I'm doing until i can actually find these mythical (tongue in cheek) databases
[Magisk] meiser:
Hi,

I found a valid fingerprint which passes with PlayIntegrityFix 14.0, but fails with PlayIntegrityFork v3. What might be the root cause? In which aspects do the modules differ?

Thanks,

meiser
[Magisk] V0latyle:
Maybe not but that's what is happening.

Google has been blackisting prints used for the fix but only in mismatch situations, the blacklisting does NOT affect users of those actual devices

For example, one of the previous prints was for Google Pixel 2 XL. That print no longer works - unless you have a Pixel 2 XL, in which case you aren't affected

We don't know how they are alerting to specific fingerprints and it is possible that ALL spoofs will be defeated at some point

Well, the guide is linked in OP, but apparently no one can be bothered to figure out how to find their own print

False

Unlocked bootloader on stock unrooted firmware (Android 8+) will fail all 3 Play Integrity verdicts

Why? Because PI knows that the device is supposed to have hardware backed attestation, and unlocked bootloader means no hardware proof of integrity. PI uses hardware attestation to prove BASIC and DEVICE and therefore report STRONG.

Pre Android 8:

Locked unrooted: BASIC, DEVICE (cannot pass STRONG)

Unlocked unrooted: EMPTY (fail all 3)

Unlocked rooted: EMPTY

Unlocked rooted + fix: BASIC, DEVICE

Post Android 8:

Locked, unrooted: BASIC, DEVICE, STRONG

Unlocked, unrooted: EMPTY

Unlocked, rooted: EMPTY

Unlocked, rooted + spoof pre A8 print: BASIC, DEVICE

Use Osm0sis fork

Matter of time until new print is banned

I hate to say this because I hate it when someone says "it can be done but I won't prove how" but a group of us has gone through about 400 prints and found 32 working

It's extremely tedious though especially without scripts and automation
[Magisk] arda99:
Check the logcat does json properly appiled?

Technically there is some difference underhood, PIF keep switching between dobby/shadowhook and V14 is using doddy, and the PIFFork is shadowhook. I don't know which one is better my phone passes with both.

c/p my post yesterday.

For newer FPs(A8+?), google can force them to go through hardware attestation, and fail these with only basic, just like majority of FPs(as in your new samsung/pixel/xiaomi etc.), which works in real device and never for spoofing. <----and that's what happens on pixel 2.

For older FPs I have no idea, but maybe it's too old to have any real users around, and/or the real users don't use PI at all, or it's too old and G doesn't care.

And no, while I don't know how google detects spoofed FPs, I'm quite sure G doesn't crosschecking spoofed and real props.
[Magisk] meiser:
Sorry, but you didn't get the point. I use a fingerprint which passes PI test with PlayIntegrityFix 14.0, but fails with PlayIntegrityFork v3.
[Magisk] arda99:
sorry wrongly edited with multi quotes. see my updated post.