yashsingh1/xdaforums huggingface dataset:
[Magisk] mkcs:
Seems going through the complicated procedure is required. I hate the signature stuff or else modifying like a text file would be simple
[Magisk] Vision:
Yeah the thing going more complicated
[Magisk] mkcs:
I'm outdated and realized that there is a red cross of device integrity for all the devices I have. Even though I upgraded PIFork to v8, it doesn't solve the problem. Is there a mass ban wave of fingerprints recently? The fingerprints I have been using were valid for a few months🤔 I doubt if all my fingerprints are banned.
[Magisk] chiteroman:
Use stock rom or AOSP :(
[Magisk] Depressed T.Bear:
Nothing would surprise me :D I recently saw a russian dude on telegram, rooted with Magisk Delta, Zygisk active and he was running all the games / (banking) apps which are known to be hard to bypass... Every root test app showed the device as "normal" and even "locked bootloader" (spoiler: it was not :D )...

So there are ways..

Regarding Magisk Alpha: I would never recommend using closed source root apps. If I'm reading things like this in the thread:

... no more words o_O:ROFLMAO:
[Magisk] osm0sis:
Uhhh, uh-oh.

😬

[Video removed, was of Play Store menu and Recommended actions option hiding and unhiding itself infinitely]

To be fair it was also like this with 9.2, so not a new issue.
[Magisk] zgfg:
Have you tried when you remove (rename their extensions to bak) system.prop and/or service.sh, to see if it's due to the global spoofs

Btw, I disable both system.prop and service.sh since I don't need those global spoofs (I already have them with my Xiaomi.eu)

But I still need one spoof that was never part of this module, so I use my own service.sh with:

Spoiler content hidden.
[Magisk] chiteroman:
Why modify this prop?
[Magisk] zgfg:
With prop equals to 1 SCheck fails Root detection
[Magisk] Vision:
Yeah, i had a same in past like this, some apps detected, if you have click on the oem unlock allowed in the developer options, even if not unlock the bootloader, just had click it for unlock another time, but if you really unlock the bootloader after Xiaomi say oem unlocking and is tick it and Mi Unlock Status say is unlock, i think this only happens if you still have developer options enable, is like somewhere i read it one app remember you have your phone rooted and don't run, and even if you lock bootloader and unroot
[Magisk] sawdoctor:
I'm using pixel fold which launched with A13 and currently using Displax safetynet mod 2.40 1.3. Which version of PIX is recommended to use instead on pixel devices 9.2 or 9.8?

I've a feeling it's Displax safetynet mod that is causing dual screen interpreter mode to soft reboot the pixel fold due to modified prop. Can't see it just being root that crashes it
[Magisk] pershoot:
no observed issues w./ 9.8 and 7a.
[Magisk] YKP-8:
Hey, I'm facing the same issues. Can you share how you fixed the same?

I'm using these modules..
[Magisk] chiteroman:
Use latest update: https://github.com/chiteroman/PlayIntegrityFix/releases/latest
[Magisk] FluffyPants:
Thank you
[Magisk] osm0sis:
Dude, why do you keep killing the commit history? Very counter-productive for tracking issues version to version...

What changed in 9.9?
[Magisk] chiteroman:
I had a problem with old gradle project because I did it in Android Studio canary. Sorry 😢

In v9.9 I removed all "optimization" flags (only give problems) and updated the code using C++ instead C.
[Magisk] osm0sis:
Nice! Appears to have fixed my Play Store menu Recommended Actions option infinite hiding/unhiding issue as well!
[Magisk] blinoff82:
I know that you were using an old version of the module. If I'm not mistaken 9.2. Have you updated to the new 9.9 and everything works well?
[Magisk] osm0sis:
9.2 and 9.8 both had the issue as described, but 9.9 seems good!
[Magisk] alfian89:
View attachment 6027682View attachment 6027683View attachment 6027684I still can't.View attachment 6027681
[Magisk] V0latyle:
@alfian89 you are passing BASIC and DEVICE integrity labels, that's the best you can hope for with an unlocked bootloader
[Magisk] zgfg:
Delete TWRP folder (or rename to TWRP.bak)

You cannot pass Strong Integrity - mentioned zillion times here and there

You must put any detector(think of detector as of a 'banking' app), so also TBChecker to DemyList (also, basic knowhow - and it has nothing to do with the PIF module)
[Magisk] eac5:
some load of bs about generategrammar error, yeah? I think it's related to antlr somehow. Java family really is the worst lol. I sent you a keybox for testing, just realized I won't be able to do the thing myself as I cannot write it to the TEE, which must be done, otherwise certs won't match to private keys.

Good luck
[Magisk] Vision:
Oh understand. Thanks you. I appreciate

I try my best, i go to learn more and i hope figured out, how make it work all this
[Magisk] Nergal di Cuthah:
Short answer: yes there was a giant ban on 29 February

Long answer: read posts since feb 29 there's alot of unrelated talk you'll have to slog through but it'll explain better than short answer
[Magisk] Vision:
@osm0sis A Big Thank for all your contribution and great work in all your project. We Appreciate.

We all know where to go for a donation
[Magisk] Vision:
Again this is not for pass Strong integrity (unfortunately)
[Magisk] Vision:
I mentioned the PIF and PIF fork, you mean the project to pass 3/3 ? With mod framework.jar ?
[Magisk] Vision:
Oh sorry, i misunderstood

I hope users can make the project with framework.jar and wr have little peace for some time
[Magisk] niko26:
Thanks for the task. Does it copy the files to the right places? The script from 0smosis needs manual action.
[Magisk] pndwal:
This help? (From public Alpha channel):

and

(Translated) 👀

Aw... I appreciate humour of that calibre!... It's tiresome enough keeping up here and sometimes witty posts are all that breaks the monotony. (Anyone who expects STRONG w/ PIF builds ATM needs to read OP and understand basics anyway!) 😜 😬 PW
[Magisk] KMohZaid:
Use colab notebook to compile smali, I had error in my pc so used colab
[Magisk] KMohZaid:
I don't know if it will work or not. We can try it but keybox.xml may differ?

And @CHiter
[Magisk] KMohZaid:
Maybe it works

I think keybox file may differ for people?

@chiteroman have repo which keybox file and in readme we can see they mentioned some adb push to device /data/native... Folder but I can't find it

Reprogram-TEE-on-Qualcomm-devices/keybox.xml at main · chiteroman/Reprogram-TEE-on-Qualcomm-devices

Guide to reprogram the TEE on Qualcomm devices to fix lost attestation keys - chiteroman/Reprogram-TEE-on-Qualcomm-devices

github.com

Don't know what to do, if we use those keybox file then ig we have to push them to mobile somewhere?
[Magisk] KMohZaid:
True

We should go to GitHub issue
[Magisk] osm0sis:
You guys know you'll be breaking your phone forever by reprogramming TEE right? 😬

From that GitHub README:

"The original keys that your phone may include in the TEE will be lost."
[Magisk] Nergal di Cuthah:
In other words you can get the holy three (on a short term solution) if you sacrifice your device's soul
[Magisk] Max-P:
For those scrambling trying to get the FrameworkPatch working, it's a complete waste of time without reprogramming the TEE. Don't bother if you're not going to also attempt that.

I did everything except

And predictably I don't even pass basic. Building the framework.jar went quite smoothly though, should be nothing crazy for anyone that's ever built Android apps.

I'm not sure I'm willing to reprogram my TEE just yet without a way to back it up first, which I'm going to assume is impossible otherwise I could just dump my own keybox.

That also feels like something that'll nuke your encryption and require a factory reset...
[Magisk] CZ.Kostra:
I use PIFork from @osm0sis and at me the task places the custom.pif.json correctly.
[Magisk] KMohZaid:
damn
[Magisk] KMohZaid:
yeah, don't have a device on which i can test experiments
[Magisk] Hybrid Divide:
Thank you for posting this. I followed your script directions, and now I have Device Integrity again.

Thank you very much, again!
[Magisk] wilsonhlacerda:
From someone that doesn't know exactly what talking about: isn't it possible to do it in RAM, real time only, using LSPosed or similar?
[Magisk] mrjuniork:
Thread has been cleaned (again..).

As I announced the other day, posts will be deleted without warning!

At times, there is just too much of weird chatter going on here. Too much traffic and information, hence the strict handling. Thx for your understanding and ongoing cooperation 👍🏻

Cheers,

mrjuniork
[Magisk] niko26:
Thanks. I have a few questions:

What is the variable "%testapp" for? It defaults to "gr.nikolasspyr.integritycheck"? What do I have to configure here?

When downloading the autopifs.sh from xda - do you have to be logged in?

What does the call to the app "Sluzby Google Play" do?

What do the SQL statements do? I remember there used to be a script which altered the SQL DB, but from what I can recall this was not necessary using the scripts from 0smosis/chit.
[Magisk] CZ.Kostra:
1) '%testapp' is the package name of the application you use to test Google Play Integrity (default is for 'Play Integrity API Checker')

2) you do not need to be logged in to download 'autopif.sh' (download will only be done on first launch)

3) task exits the GMS to kill the droidguard

4) SQL commands check Google Wallet status (card status and security requirement for NFC)

The SQL part is used from GPay Checker by @Bonoboo.
[Magisk] niko26:
1) ah, there is no way to use the "Googe Play" internal checker in an automated way, correct?

2) Ah, so if an update to that script is available we need to adjust the link to the attachement?

3) Hm, but ""Sluzby Google Play"" is the localized name for the Czech (?) version of Google play? Will this work with a different localized version?

4) Thx.
[Magisk] CZ.Kostra:
1) I don't know about that.

2) osm0sis edits the script in the same post, so the link should stay the same(?). Just delete the script in the working directory and the task will download a new one.

3) Corrected. I didn't know that Tasker exports it like this. Thank you. :)
[Magisk] :
At the risk of being banana-ed in the next OT cull (how ironic), I'm finding the last x pages to be well above my pay grade, stratospherically above even. For me, google et all have won. My fp is still working but I can feel the breeze of the pendulum axe swing. Come the hour, my decision will be stock or plastic. Plastic will win I suspect. I like my rooted device and, frankly, can no longer be bothered with the hassle of reverting to stock. Once, it was fun. Now, just too much of a learning curve. Therein lies the issue, I've no spirit to enter into a battle. In time I fear my phone will no longer be smart, simply a phone again.
[Magisk] osm0sis:
2) All attachments have their own unique increasing number, so any update to the attachment will create a new download URL.
[Magisk] jrotaetxe:
I think there is still an option.. Your credit card issuer bank may have (or not) not so strict conditions to make NFC payments, so switching from GPAY to your bank may keep your phone as a media of payment...

... And lessens the scope of GPAY...

Regards
[Magisk] Vision:
For that we all confused because with framework method we thought no need reprogramming TEE :LOL::ROFLMAO:

The one is this: https://github.com/chiteroman/FrameworkPatch

And the other users look is this: https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices

Before update README say this and after this

View attachment 6078827 View attachment 6078830
[Magisk] ahfjdxn:
I am confused. I have test devices, so do I need close to impossible keys for that new bypass or something or can I theoretically do it without such
[Magisk] osm0sis:
Yeah but, the one requires the other.

https://github.com/chiteroman/FrameworkPatch: "TEE must be reprogrammed with a valid keybox."

https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices: "The original keys that your phone may include in the TEE will be lost."

So this is the same "break your phone forever to hopefully get Strong" chit has always been talking about.

Plus, for bonus awful, when the leaked keybox you used gets banned (and it will, because they're leaked), you have to do the whole thing again.
[Magisk] Vision:
Yeah after search i learn that.

I get your point, the same thing i was thinking about

Unfortunately we thought this mean have a valid keybox and write it in Main.java and that's it after with all step pass 3/3
[Magisk] ahfjdxn:
So it is all based on leaked keys? How many are of these?
[Magisk] osm0sis:
Few and far between. They're leaked corporate/OEM keys. Google is your friend.
[Magisk] Vision:
Yeah confirmed, a users here say after do this can't even basic pass the same thing in GitHub issue

@chiteroman say why happen this

chiteroman/FrameworkPatch

Modify framework.jar to build on system level a valid certificate chain - chiteroman/FrameworkPatch

github.com
[Magisk] Vision:
IMPORTANT NOTE (For beginners and not only).​

First step which is necessary

TEE must be reprogrammed with a valid keybox.

If you want to try the method by @chiteroman with framework to pass Strong (with hardware attestation with TEE), is not simply (as many users thought it) and must be prepared to broke your device (or have a second)

We need a valid Keybox (lot of users still don't know what is it, included myself before days)

Like @osm0sis say: Plus, for bonus awful, when the leaked keybox you used gets banned (and it will, because they're leaked), you have to do the whole thing again.
[Magisk] Claus….:
Can you explain? New device or? @osm0sis
[Magisk] ahfjdxn:
Thanks.

Has anyone gotten it work on a device tho? Last I seen in this post is some gimp joke
[Magisk] Vision:
Yes, If you mean need it new devices with hardware attestation with TEE
[Magisk] Vision:
Until now no, only some users try it with even basic not pass because not do it the first step which is necessary

TEE must be reprogrammed with a valid keybox.
[Magisk] immortalwon:
Did Chiteroman's play integrity telegram group get deleted or something?
[Magisk] Vision:
Yeah

View attachment 6078852
[Magisk] crok.bic:
See here.
[Magisk] markfm:
See: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89386606
[Magisk] badabing2003:
And before you toss your tee away, you don't even know that leaked keys are even banned or not.

This is a self defeating process, aside from academic exercise no one should attempt it.
[Magisk] immortalwon:
Agreed, I was trying to do this on my oneplus pro 9 with a broken keymaster, but alas, there is no public engineering firmware available.
[Magisk] ahfjdxn:
If a key gets Banned would not however it also break strong on the real unmodified device? / If so then that way you could check it before breaking your own
[Magisk] eac5:
Not quite, you can know beforehand if you check Google's CRL. Per keybox there's 2 entries, one per the first EC and RSA cert in the respective chain, their serial numbers in hex.

I made a script here to quickly check a keybox xml against the CRL.
[Magisk] Vision:
If someone have a keybox.xml how can check with your script ?
[Magisk] intel_core_i7:
Yeah, nobody should do this at all. I think leaked keybox are from budget phones these days, so if one is banned then it would be super unfortunate for the users. Imagine your phone purchased with months or years of hard-earned money breaks (software, literally) because some bloke on the internet who don't even have the device messed with something that's out of your knowledge.

**** PI, it's a super duper proprietary, security by obscurity security model. You are a new phone manufacturer that wants all apps to work normally? You have to register with Google. It's somehow worse than Apple's walled garden
[Magisk] eac5:
Dude, with all respect, if you can't even figure out that simple script, you shouldn't be attempting this process at all.
[Magisk] Vision:
Yeah i get your point, i thought the same thing 😂🤣

Edit: Sorry for the noob question (apparently I'm still noob after all)
[Magisk] markfm:
Read the comment block at the top of the script, which provides Usage.
[Magisk] Vision:
Thanks, just confused, i thought it is drag&drop script (apparently I'm still noob after all)
[Magisk] Vision:
I think lot of us not try at first and little confused, the first step in guide to mod framework.jar to pass 3/3.

Because the other guide say if give any error, and if is normal NOT follow this guide and my phone is all normal in Key Atte. app

With short words, must first we broke our TEE to continue to mod framework?!

View attachment 6078905
[Magisk] chiteroman:
Disabled issues on my repos about TEE reprogramming and modding framework.jar.

The instructions are clear, and the code is understandable to those who meet the third requirement ("Intermediate Java and Smali knowledge").

If you don't know nothing about programming and don't know how a certificate chain work, this is not for you.

Please be satisfied that you can pass the device verdict.

If you want Strong, flash stock rom and lock bootloader, that's it.

I did it on my device (vayu) because:

1. I have more devices.

2. I know what I'm doing.

3. I have 199999 valid keyboxes unbanned and "private".

This is not for all people. Also, technically, it is not necessary to reprogram the TEE, you can replace all the certificates in the chain. But that won't help you to pass Strong verdict.

Besides, I think these things should be discussed in a separate post....
[Magisk] RockerAlex:
With all due respect this comes across as a bit elitist - I have followed your instructions clearly and don't get an error on any step now (after much messing about) yet my device cannot pass any integrity with this patch installed. My Key Attestation app does think the BL is locked with no hooking tho, but this is not what I thought we were going to achieve here. It felt as if you were releasing a way to patch Strong, are we mistaken? Revenyy claims to have done it also based loosely on your code but will not give up any information, his answers to my questions are like cryptic poetry and now that you've closed your group it is much harder to reach out to you via Telegram PM.

Hopefully you will be more active on this topic because I have many things not making sense on my side. If you don't want to answer/write it publicly you could check your PMs in Telegram. :)
[Magisk] Vision:
Good, yeah if you not have than more 1 devices is scary the step.

you say: can replace all the certificates in the chain. But that won't help you to pass Strong verdict.

if we can replace all the certificates in the chain, in device with hardware attestation this pass 2/3 ? and after no need for spoof FP anymore ? or is needed all ?
[Magisk] BesoC:
Hello

Spent a couple of hours with PixelFlasher. Tried Freeman's random fixes as well as OnePlus build.props. No success at all - DEVICE_INTEGRITY check fails

My setup:

Play Integrity Fix Fork v8

Latest Magisk with Zygisk enabled

Magisk DenyList configured to hide from Play Serviuces, Play store, Google Wallet, some banking apps and PIF

Magisk DenyList enforced

Maybe I'm missing something? Pls help
[Magisk] Nergal di Cuthah:
Freeman's database is burned 90% or more no longer work. He's closed it
[Magisk] osm0sis:
PlayIntegrityFork/README.md at main · osm0sis/PlayIntegrityFork

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - osm0sis/PlayIntegrityFork

github.com
[Magisk] HippoMan:
... except regarding things like Play Integrity.
[Magisk] BesoC:
Read the instructions, My bad, Google Pay Services was not in DenyList ( I wrote that it is)

Should I clear Google wallet, Play Store and Play services data and reboot before each attempt to apply new PIF json file?
[Magisk] osm0sis:
Start by using the Xiaomi.eu print to check the rest of your setup. No point in wiping anything until you've got it working. See Resources.

PlayIntegrityFork/README.md at main · osm0sis/PlayIntegrityFork

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - osm0sis/PlayIntegrityFork

github.com
[Magisk] BesoC:
Google Play Services does not have 'Force close' enabled.

PixelFlasher does the job of sending the .pif file to appropriate place (I'm using PIF Fork) and checking PI
[Magisk] Vision:
Mini Guide.

Really? strange mine have and is for those without pc
[Magisk] markfm:
Same here,. At least for testing regular PIF json files, my sequence is:

Go to Settings - Apps - Google Play Services, so you have the screen with the force stop button, then:

1. Load a test json at /data/ADB/PIF.json

2. Do a force stop of Google Play Services

-Note - when I force stop, Play services will automatically restart, so it may seem to not be doing anything, but it really is stopping briefly.

3. Run a Play Integrity check

4. Mark that test file as good or bad based on if Device passes, repeat the sequence if testing multiple candidates.

After you're done testing, have settled on a good file, that's when you do force stop/clear data on Wallet, Chrome (to get back autofill), etc.

View attachment 6079007
[Magisk] Vision:
Yeah exactly this i'm talking about so long. Thank you
[Magisk] makeyourself:
The Osm0sis fork v7 with playcurl to get the FP is working good for me right now, passing device integrity. Not tried updating to v8 but I expect it would work.
[Magisk] Vision:
Mini Guide.​

For those want a quick test if the pif.json or custom.pif.json work and without clear anything and reboot? and without pc or don't like to work with adb​

For quick and easy test if FP working.

Send the new pif.json file to /data/adb/ for @chiteroman

Send the new custom.pif.json file /data/adb/modules/playintegrityfix for @osm0sis

Replaced the existing (if you have it already).

Go to Settings/Apps/Google Play Services, and click Force Stop (no need close the internet etc.) Τhis step work depending on the ROM or trying under Developer Options/Running Services​

P.S I try it this with Total Commander the replace, you can with your file manager you have.

After all the step do the test to see if pass 2/3
[Magisk] BesoC:
On my Oneplus11 Google Play Services cannot be stopped
[Magisk] BesoC:
My FP was also working till February :(
[Magisk] Vision:
What android version ?
[Magisk] BesoC:
OnePlus11, A13

BTW - You can’t force stop or uninstall Google Play services. 🤷‍♂️
[Magisk] BesoC:
BTW - You can’t force stop or uninstall Google Play services. :)
[Magisk] Vision:
Because i have test it in Androud 7.1..1

As i suspect after A13 this options to click the force stop do not work anymoe, but before work can click the force stop, i have test it in Android 7.1..1, A10, A11, A11 different devices brands and emulator
[Magisk] BesoC:
So if Play Services should be stopped, only way is to restart the phone, I suppose
[Magisk] makeyourself:
Yes because they mass banned the prints which is why you have to use playcurl or some other method to get the current Xiaomi.eu FP.
[Magisk] Vision:
Yeah, and one command

`killall com.google.android.gms.unstable` from a root prompt in a Terminal emulator app
[Magisk] GabbyWC:
An easy way to force stop DroidGuard is to download and install the Material Terminal app from here or here and enter su -c killall com.google.android.gms.unstable. This app will save your recently used commands in its history and you can even set a command to automatically run when this app starts.
[Magisk] BesoC:
Thank you @Vision @GabbyWC @makeyourself .

killall command can be run from PixelFlasher. I will try to update pif, kill PlayServices, check FP and over and over until I got DEVICE_INTEGRITY green check
[Magisk] V0latyle:
I agree.

In case this isn't clear to everyone, this project is for EXPERTS ONLY. That's not elitism, that's a warning. Don't try this if you don't know what you're doing.

I don't know how to do this, and I'm not even going to try.....at least not until I have a thorough understanding of the principles involved and how to fix it if I do something wrong.

At @chiteroman's request, we should move the TEE/keybox/etc discussion to a new thread. I'll talk to my counterparts in this section about it.