[Magisk] pndwal:
So being A8+ LV device (Keymaster 3+), you won't pass Play Integrity DEVICE_INTEGRITY native prints unless Google has exempted your device from HARDWARE_BACKED evaluationType enforcement which is unlikely being Samsung (many OnePlus devices etc are exempted as OEM messed up Keymaster implementation etc)... You may be in luck only if you see only BASIC as evaluationType in YASNAC with no spoofing mods (eg PIF) running... But even if YASNAC shows SafetyNet API is not enforcing HARDWARE_BACKED evaluationType, it's possible for PI API to be doing so anyway...

Assuming HARDWARE_BACKED is enforced by PI (and it certainly will be if it's enforced in S/N per YASNAC test) you'll need to cause a fallback to BASIC-only attestation on device (ie. cause DroidGuard to send BASIC-only attestations via GMS). That is generally done currently by registering a fake keystore to cause an exception which triggers the on-device fallback. Next, you'll need to find a print/prop set to spoof a device that both doesn't enforce HARDWARE_BACKED (server end) evaluationType and, also, isn't 'banned' by Google for spoofing purposes (as we haven't yet been able to bypass their cross checks for such 'banned' prints... This involves finding a set using the methods given in this thread for PIF, or using one used by XiaomiEU ROMs etc, and using appropriate method to spoof the properties only to the GMS DroidGuard (Play Services) process (ie. targeted spoofing)... You'll also need to set sensitive props (eg old 'MagiskHide' props) to non suspicious values. Props themselves can be found in the PIF scripts... Some system properties are passed by the bootloader (via the kernel command line) to determine whether the bootloader is unlocked, so fake values must be set very early at boot... These are globally set spoofed properties (ie. not targeted).

I don't know where to find a current guide for ROM integration of the primary keystore/exception based fallback to BASIC-only attestation and the secondary property based HARDWARE_BACKED evaluationType enforcement bypass as well as sensitive prop adjustments, but @kdrag0n provided great details for SafetyNet Fix integration based on his Proton ROMs... Most ROM Devs have followed/adapted his template. See:

https://github.com/kdrag0n/safetynet-fix?tab=readme-ov-file#rom-integration

You'll need to adapt this for PI (guides were written when DroidGuard was regarded as part of SafetyNet, but, of course it's really the attestation engine for Google APIs used by GMS including both S/N and PI) which means spoofing the various (additional) properties and fields needed for DEVICE_INTEGRITY verdict since recently 'banning' for spoofing purposes began...

You'll find commits for:

- Spoof broken/invalid keystore (throw UnsupportedOperationException) for fallback to BASIC-only attestation • keystore: Block key attestation for SafetyNet [read 'for DroidGuard']

- Properties for HARDWARE_BACKED evaluationType enforcement bypass, CTS/VTS certification etc • Spoof build fingerprint [read 'print/prop set] for Google Play Services [read GMS DroidGuard process specifically]

- Sensitive props • Set properties to make SafetyNet [adapt for PI] pass

👀 PW