yashsingh1/xdaforums huggingface dataset:
[Magisk] simplepinoi177:
as the warning explains, you will need to implement a custom working fingerprint. I wouldn't even call it an error (yes, it does include an "!", but it's more to emphasize and alert importance than to alert an error or problem).

Who says they aren't (in tandem with all this banning).....?!?!🤯😱

Lol...ikr?!?!? what a show off! 😜 j/k xSnow

It is better/best to ask these in the actual PixelFlasher support thread

📳🔥 PixelFlasher, a GUI tool for flashing / updating / rooting / managing Pixel phones.

DESCRIPTION As the name suggests this is an application to flash (update) Pixel™ phones (possibly all Google™ made phones/tablets, YMMV.) PixelFlasher at its core is a UI layer (with bells and whistles) on top of adb / fastboot commands, hence...

xdaforums.com

Then that most likely means that something is wrong with your set up as opposed to fingerprints not passing (if PINext isn't working either and its a confirmed working fingerprint...)

But it does seem that things have further developed that people who haven't touched anything are now suddenly failing all 3...

As I understand it, the second module is to trigger the pulling of the new unbanned fingerprint from xiaomi.eu and to restart gms (can't recall which one goes first)

yeah sorry @badabing2003 , I'm just going through the whole thread since I was last able to (yesterday, so missing yesterday afternoon, last night, and this morning). I figure I'd merely delete posts as I come across them not being applicable already....

EDIT: answered already
[Magisk] sawdoctor:
Pixel fold running qpr2 beta. Had zero issues until a couple of hours ago and now every single print including the current xaiomi one fails all 3 checks
[Magisk] sawdoctor:
Ok I've fixed my issue and am back to 2 green ticks. For anyone else with the same issue it was one of these 2 and i don't know which but removing them both fixed it.

1. Osmosis Magisk busybox module

2 xposed mod Adclose

Removing both of those fixed it. Seeing as Google seems to be checking kernel names it might have detected osmosis busybox . Strange thing is I've been using them both for months and only failed all 3 checks today
[Magisk] badabing2003:
It was alread answered here

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

Interestingly enough, sometimes when you run into a situation where it fails out of the blue, specially all 3 red.

One of the ways to fix it is to mess around with dg_cache.

1- Delete the cache

2- Run YASNAC

3- Test PI
[Magisk] desertcat:
Is anyone else seeing that Play Protect certification is showing "Device is not certified"?

My phone is a Pixel 5a. It's rooted, running the stock ROM, it passes basic integrity only (I gave up trying to find a working fingerprint) running Play Store verion 39.4.23-29 [O] [PR] 59996O685 (January 28, 2024).

I've tried to get Play Protect to certify but so far, I have not been successful.

I'm to the point of not rooting my phone anymore.
[Magisk] purgy:
I'm using osmosis busybox module, and still pass 2/3. I run other xposed mods, but not adclose.
[Magisk] majorfigjam:
You'll

You're not going to get certified unless you revert to stock locked bootloader, which will wipe your device, or find a new fingerprint to fool Google.

I'd pm a possible solution, but you don't seem to accept messages.
[Magisk] boualemdz:
there is no trick to passing strong
[Magisk] majorfigjam:
Yeah we know. Revert to stock and lock bootloader.
[Magisk] zgfg:
So what 3rd are you missing?

Maybe Strong🤩
[Magisk] sawdoctor:
He could have been having the same issue as me. Mine was either an xposed mod or magisk mod that Google are now detecting as id had them both installed for ages and only got the issue today
[Magisk] V0latyle:
Was this a question or a statement?

If a question, then no - you can only pass STRONG_INTEGRITY with a locked bootloader on stock firmware:

What this means is that the system is able to verify that the bootloader is locked on OEM key, and the firmware is signed with that OEM key and has passed Android Verified Boot.

The only "tricks" that have allowed us to temporarily pass STRONG is with server side bugs in Google's implementation.

Locking the bootloader on a custom key won't work, because TEE is used to verify the boot state, and the bootloader knows whether the key is OEM or not.
[Magisk] desertcat:
Try PM again. I changed the conversation setting.
[Magisk] zgfg:
What?!

I always pass and passed Device and Basic only (since BL is unlocked, running custom ROM, Magisk and PIF), hence no Strong Integrity, but my Device is and always was Certified
[Magisk] majorfigjam:
So as per my alternative way, you found a new fingerprint to fool Google, like most of us here have done.
[Magisk] simplepinoi177:
Yeah....I saw that! That's why I added/edited the last portion of that part ("people who haven't touched anything are now suddenly failing all 3...") -- was based on what you had said and the possibility it might be the same...
[Magisk] simplepinoi177:
yeah...i think he was mistaken and switched "STRONG" with "Certified"...
[Magisk] zgfg:
I don't know your alternative way but I mined, found and use FPs a month and more ago

But being in this business for several months, from the time when PIF module was brand new with the built-in FPs, and that was always the case - spoofing Basic and Device is and always was enough to have Device Certified, no need for locked BL and Strong
[Magisk] osm0sis:
Yeah, I have my own busybox installed on all of my devices, including my daily Pixel 8 Pro, and I'm passing normally everywhere.
[Magisk] Nergal di Cuthah:
I think the confusion is, the first poster said "they'd given up on finding a fingerprint" so it was suggested that they lock their bootloader if they were not going to find a fingerprint. That there are two ways to get certified 1) find a fingerprint or 2) lock and oem state your device
[Magisk] majorfigjam:
FGS, I said " revert to stock locked bootloader, which will wipe your device, OR find a new fingerprint to fool Google".

That was my alternative way (or suggestion) to the OP.

And yes, I pm'd a known working print, or should I say a print which is known to work in my set up.
[Magisk] V0latyle:
Please watch the language, it's not necessary here.

As a general rule it's a better idea to help try to figure out why someone's current configuration isn't working , because we have the resources readily available to find good prints. I suspect many of the new failures may be configuration issues that can be addressed, that new prints probably won't fix.
[Magisk] majorfigjam:
Already had edited F or G, sorry if I offended your sensibilities. Anglo-Saxon is my first language.

As OP had given up trying to find a print, I gave them a known working sample to try.

If that doesn't work for them, then it is a configuration issue not a print issue. If it does work, then they can be certified, until Google decides otherwise.
[Magisk] purgy:
I can't help but feel if they were actually looking at the contents of data/adb/<whatever> we'd all be stuffed already
[Magisk] osm0sis:
Oh definitely, but that directory was chosen for a reason, so we should be pretty safe there still, unless Google starts using root to find root.
[Magisk] HippoMan:
Just out of curiosity: does the /data/adb directory exist on non-modded stock devices with locked bootloaders? Or does that directory only exist as a result of Magisk configuration?
[Magisk] osm0sis:
It's a normal Android directory, super locked down by permissions and SELinux by design. So pretty much perfect for root to hide inside.
[Magisk] desertcat:
Just to close the loop - the file you sent works on my phone. Integrity check reports both basic and device pass and the device is certified.
[Magisk] majorfigjam:
And I can now happily confirm that OP has confirmed it was a print issue, not other configuration trouble. They are up and running again. Occam's razor strikes again!
[Magisk] zgfg:
Yeah, it's all find with /data/adb but I'm concerned with /debug_ramdisk

The magisk mount can be revealed with no need for root privileges

:/ $ whoami
u0_a240
:/ $ ls /debug_ramdisk
ls: /debug_ramdisk: Permission denied
:/ $
:/ $ cat /proc/mounts | grep ramdisk
magisk /debug_ramdisk tmpfs rw,seclabel,relatime,size=3685128k,nr_inodes=921282,mode=755 0 0
[Magisk] osm0sis:
Yeah but have you put that terminal app on the DenyList and checked the commands when either Enforced or with Shamiko installed? Doubt you'll find that mount then.
[Magisk] zgfg:
Btw, see on my screenshot how ls has no permissions

Frankly, I've seen on TG a similar question/issue posted for KSU and also /debug_randusk

Edit:

I have to test more carefully
[Magisk] zgfg:
Yeah, interesting - ls had no permissions and whoami was no root, so it looked to me that the test was valid

But when I added TE to DenyList, cat can still read /proc/mounts but it does no more list /debug_ramdisk
[Magisk] Umgak:
Yes, /data/adb is always present. However, it's locked down both as its owner is set to root as well as the u:object_r:adb_data_file:s0 SELinux context.

In practice, it's only possible for apps to know that the folder exists - but it's a normal Android folder that's supposed to be completely empty.

Yeah, any time an app in DenyList is launched all of those mounts get pulled within its context.

Spoiler content hidden.

Spoiler content hidden.
[Magisk] intel_core_i7:
I quit modding already and still look around here few times a week for the same reason

In theory, it is the only supposed way. I bet there are advanced modders or security researchers have found some ways to spoof strong but who would let the cat out of the bag, the method could be useless within a day/week. @chiteroman has already developed (private) ways to pass strong while rooted.

And what is the definition of a "custom" key is to be desired. I have seen Xiaomi users with TEE wiped from their devices regaining STRONG with locked bootloader by using chiteroman's leaked keybox in his TEE reprogramming repo (which is now blacklisted, it worked for a few weeks). So "custom" would probably anything that is not Google approved. Oh well I answered my own question, but still a discovery of mine
[Magisk] pndwal:
This:

https://xdaforums.com/t/magisk-the-magic-mask-for-android.3473445/post-74923643

👀 PW
[Magisk] pndwal:
FWIW, Google hardening checks for custom kernels/ROMs/mods should be no surprise... DroidGuard began checking the device codename with early SafetyNet API (for ctsProfileMatch), so prefixes such as aosp_ and lineage_ should have been removed from device tree product information long ago; the device name should match that of the stock ROM...

Clearly these checks have been extended, and current changes just show true form. 🤠 PW
[Magisk] HippoMan:
Thank you.

Are the permissions of /data/adb any different between devices with locked bootloaders and rooted devices?

The reason I'm asking is because I'm wondering whether simply by examining the /data/adb perms alone it would be possible to determine whether a device is rooted.

UPDATE: oh, our messages crossed.
[Magisk] m0han:
OnePlus 11 5G running stock official Oxygen OS A14. Can't seem to find

/data/adb

directory. Am I looking in the wrong place?
[Magisk] Umgak:
You're in Internal Storage, which is actually located in

/storage/emulated/0

Your app will need root permission to access /data/adb

EDIT: After a second look, it looks like you aren't in /storage

Those are all subfolders of /data, but there should be several dozen more. The exact layout of /data isn't always the same, but there should always be a bunch of stuff in there, like /data/media (which is actually the true location of /storage/emulated/), /data/misc, /data/cache, /data/system, as well as your magisk image backups, usually a /data/vendor, and a LOT of empty folders, one of which is /data/adb. However, with default filesystem perms, most of these folders are inaccessible.

I'm guessing whichever file explorer app you're using is finding its own apk in /data/app, its stored data in /data/data, and its cache in /data/user, which are directories it should be able to read. Everything else it's getting an error and not displaying as a result, as scoped storage is telling it not to access those folders.
[Magisk] badabing2003:
New Release:

Jan 29, 2024 v6.7.1.0 change log:

Added an checkbox in Pif Manager. Keep All Keys which allows any unrecognized key to be kept in the json file when using smart paste. This allows support for future keys that could be added but are unrecognized today. (Example: KERNEL)

Added Cleanup DG but in Pif Manager to clean up Droidguard cached files. Helps in some situations.

Miscellaneous small improvements.
[Magisk] m0han:
I was responding to a post asking: ....does the /data/adb directory exist on non-modded stock devices with locked bootloaders? My bootloader is locked and I'm not rooted.
[Magisk] osm0sis:
It exists, your non-root file manager just isn't letting you even see directories you can't go inside.

It gets created by Android during first boot up after a factory reset.
[Magisk] Nergal di Cuthah:
Right but the folder /data/adb is still there you just can't see it (or any of the /data folder) without root
[Magisk] m0han:
Ok.

I can see 3 folders in /data, viz., app (98 folders), data (1 folder), user (1 folder).
[Magisk] Nergal di Cuthah:
I was wrong i was going by the above idea, that was retracted, of your image being /storage/emulated/0. And, as the above poster fixed, now realize you weren't.
[Magisk] Umgak:
Whatever file browser you're using is definitely hiding folders that it can't access then, because /data/data should have a folder called android, as well as one for every single app including system apps installed on your phone. However, every single one of those app folders is "owned" by a "user" which is just a number uniquely assigned to each app, and apps can't access folders belonging to another "user" (app). Every single one of those folders will have an cache and code_cache folder, as well as anything else that they've decided to store in there.

/data/app similarly contains a bunch of gibberish-named folders, each containing another partially gibberish folder, which then contains the actual apk files and runtime cache files for each app.

/data/user will contain a folder called 0, which then has a folder structure largely the same as /data/data (so, an android folder and one for every installed app including system apps, each containing cache and code_cache as well as whatever they've thrown in there as well for userdata, still owned by each app user, blah blah blah).

To answer your original question since I misinterpreted it, yes, /data/adb exists even on fresh, unmodified Android installs. It's just in a spot where it's difficult if not impossible to interact with, which is specifically why topjohnwu decided to hide Magisk in there.
[Magisk] simplepinoi177:
I'm sorry if this has been answered before, but info on the subject is scattered throughout the last 20 pages (19 to be exact) since the bannings started happening and the news broke.....

So I thought finally ask for a clear and collected answer...

I've been told that if a user is on one of the custom ROMs or custom kernels that are blacklisted, to "change the name" or hex-edit & remove any naming reference.

How exactly does one go about doing that?

I can guess for kernels (since it is a single file that one has to modify, I imagine)....but how does one go about doing that for custom ROM like LineageOS (that's been confirmed as blacklisted, right?)
[Magisk] zgfg:
How do you expect your root explorer to see /adb directory that requires root privileges if you didn't/cannot grant su to your root explorer

There are many more directories on /data and even in /data/data that you cannot see without root

/adb is (usually) read/write/executable only for root

See the screenshots

:/ $ su
:/ # ls -l /data | grep adb
drwx------ 9 root root 3452 1972-02-27 13:47 adb
[Code]

Apps with no root privileges cannot even see /data/adb (nor lurk into)
[Magisk] m0han:
The original question was not mine, I guess. Thanks everyone for the enlightenment. :)
[Magisk] Fentadroid:
ElementalX Kernel is blocked too on Pixel 3a.

Stupid question: can i rename it by editing anykernel.sh file before flashing?
[Magisk] sawdoctor:
Hopefully not a daft question. If they are starting to block custom kernels because of the name? Will they be able to detect kernelsu kernel and block that? Or is it safe because of the name?
[Magisk] H4R0X:
Hi guys,

it hit me yesterday, wallet suddenly said your device is not supported etc.

AFAIK I only had GPay SQlite fix and Magiskhide Props Config installed to fix Google Wallet until now.

I disabled both and installed Play Integrity Fix 15.4 by chiteroman, setup disable list and tried like 30+ profiles using pickaprint.sh and that one app AutoPIF-Next.

But I just can't pass device integrity, tried to clear cache & storage on all Google Apps.

There is just too many threads to read trough, can someone point me at a fix, smartphone is Surya (Poco X3) with Optimus Drunk Kernel and Ressurected Remix OS
[Magisk] MrSteelX:
You could flash back to the stock kernel of your rom and see if that helps?
[Magisk] Cargonausorus:
Bonjour, j’ai le même problème avec mon Samsung Note9 Android Q10.

J’ai mis à jour PlayIntegrityFix 15.4 et depuis lors, je n’ai pas passé le test de correspondance de profil CTF. Message d’erreur lors de l’installation du module playIntegrityFix 15.4 :

Extraction des fichiers de module

! ATTENTION, le module MagiskHidePropsConf peut causer des problèmes

! Le module n’inclut pas d’empreinte digitale certifiée.

! Vous devez l’obtenir sur Internet, recherchez sur XDA comment le faire

! Le modèle pif.json se trouve dans le dossier du module.

! Déplacez-le dans /data/adb/pif.json pour usurper les valeurs :

-Faire

1 1

J’ai aussi essayé avec le module playcurl et apk autopif_next 3 rien à faire. Y aurait-il une procédure appropriée pour corriger tout cela dès le début ?

Le fil de discussion est très déroutant selon le scénario. J’ai également désinstallé magiskHidePropsconf pour tout nettoyer. Rien ne change. Merci beaucoup.

C’est une très belle réponse qui va m’aider à avancer...
[Magisk] sawdoctor:
What do you have in disable list?
[Magisk] osm0sis:
So I may have to eat the above quoted words somewhat... 😟:

Some kernel strings are blocked by Goolag · Issue #236 · chiteroman/PlayIntegrityFix

For example Sultan kernel on Pixel 7/Pro/a is blocked from Goolag since it has a string named Sultan in it. They are checking for blocked words (case insensitive) in the uname kernel string, so I w...

github.com

It's still detecting Lineage in the same kernel string as custom kernels because older Lineage devices were putting it there. Most GKI Lineage devices should remain fine, though @eng.stk tells me at least Lineage walleye is an exception and has "lineage" in the kernel string currently.

KernelSU's pre-built GKI builds don't alter the kernel string at all so should remain fine.

Yes, we could start hex patching using AK3/magiskboot (or even sed if we're more careful about it, though hex matching and patching would still be safest). However, that'll be getting pretty damn ridiculous when if you think about it we're going to all these lengths just to work around the custom kernel equivalent of a vanity license plate.

It's becoming more and more likely that my previous joke may be the best course of action:
[Magisk] eng.stk:
But if we can't put a vanity plate on the kernel string, we will loose at least 10% performance in geekbench :devilish:
[Magisk] zgfg:
Did you read and understand the Warning from installation that you quoted - module DOES NOT install spoofed prints

You have to search for, create your own pif.json file, test that it passes Device and Basic Integrity and use it them

Without, just luke you didn't install the module. Think like, you have a car but the tank is empty - you cannot drive

The thread has literally hundreds of posts about. There are also alternative modules that do install pif json files, and all the info is also in this thread

And how and why the PIF module does not provide the spoofs, reasons were also discussed in the thread, on the GitHub PIF repo, PIF TG channel, etc
[Magisk] H4R0X:
Google Play Store, Google Play Services, Google Wallet and some banking apps.
[Magisk] lupastro82:
P7P: Is there anything I can do? I just removed kdragon module and installed this. After reboot, this is the result. Ty.
[Magisk] TotallyAnxious:
Red cars are fastest. Make your kernel red for more speed. If it's anything like GTA, changing car paint is easy. Kernel should be too.
[Magisk] Umgak:
Don't need to add anything to DenyList for Play Integrity. In fact, adding stuff can make the module stop working - I'd remove Play Store and Google Play Services (and the module should automatically remove them on boot). Wallet shouldn't care either way.

You're a bit late to the party, friend.

The old paradigm with modules such as kdrag0n and Displax Safety Net Fixes, as well as early versions of this module, was to ship a built in fingerprint for the module. However, this resulted in Google treating this community as a big game of whack-a-mole, so the module no longer provides fingerprints. You will have to find an eligible 'donor device' and spoof its data by adding it to the pif.json file.
[Magisk] zgfg:
Too much, no need for Playstore and Wallet - they use PlayIntegrity through the Google Play Services

On the other side, banking apps usually implement their own checking methods hence they have to be in DenyList, they may require HMA, etc
[Magisk] lupastro82:
I've no more time, just this.Thanks for reply. Hope I can fix (just need to understand about this Json).
[Magisk] V0latyle:
Just put racing stripes on your phone. They add 20 teraflops each

You need to find a working print. Either use PIFS script or use Pixel Flasher to select one.

The reason why this is necessary has been explained many times. Please read my post here, I explained it under "What can I do to fix it?"

Basically, you have to spoof a build fingerprint to make GMS think your device isn't capable of hardware backed attestation, thereby causing a fallback to basic attestation.
[Magisk] lupastro82:
Ok ty. Now I check and try.
[Magisk] manjaroid:
Seems to me osm0sis's fork and TheFreeman193's pickaprint script go together like broth and noodles. Give it a try.
[Magisk] lupastro82:
I switched to osmosis module + pickaprint, but still cannot pass play integrity check. Seems all profile are invalid.
[Magisk] Umgak:
Are you running a custom kernel? Many of them have vanity names which have been blacklisted by Google and there's no easy way to change it at the moment. It can currently only be fixed by opening up the kernel image using a hex editor and replacing the name with something else. chiteroman and osm0sis are currently working to find a way to intercept the check and return a generic name, but currently either switching kernels or manual patching are the only fixes if you're on an affected one.
[Magisk] Neppomuk_:
Is official LineageOS affect by this?
[Magisk] sawdoctor:
Unfortunately in some cases it seems so
[Magisk] lupastro82:
No, stable p7p official firmware.

Tried now with: export FORCEABI="arm64-v8a,armeabi-v7a,armeabi"

But from play integrity app still all invalid.
[Magisk] Umgak:
It depends. On my phone (OnePlus 9 Pro) the official Lineage kernel is already using the generic qgki (Qualcomm Generic Kernel Image) codename that the official ROM uses. However, some use lineageos or lineage as part of their codename, and that is blacklisted.
[Magisk] H4R0X:
Still no luck :(

I will switch to lineage with stock kernel on the weekend.
[Magisk] V0latyle:
Maybe one of the other modules is causing problems. Hard to say. Busybox shouldn't, but maybe try disabling it.
[Magisk] lupastro82:
I think checked about 100times, but finally found one valid 😅

Ty so much. Hope can be ok for long time 😂