yashsingh1/xdaforums huggingface dataset:
[Magisk] xcl1pse:
ptrace can bypass that but good luck to make it boot first on A8

Husky never implement fuser in his magisk. He just take ptrace init implementation from ZygiskNext. Good luck transform all that rust code into magiskd without breaking it lmao

Also, If Kitsune user are unhappy after copyright changed, their can still use newer ZygiskNext on Kitsune. So give thank you to LSPosed developer for that, especially after nullptr adding Kitsune compability to ZygiskNext as certified root manager
[Magisk] GabbyWC:
I followed that same guide from remoh and it worked for my mother's phone with the Pixel Experience Plus v12.1 custom ROM. It's not as complicated as you think it is. I recommend using the free HxD hex editor for Windows and reading the helpful posts here and here for additional instructions. chiteroman and osm0sis attempted to provide a solution for banned kernel strings through their PIF modules but those efforts were unsuccessful. Users can either edit banned kernel strings manually or update to a newer custom ROM version which is not affected by this problem.
[Magisk] Vision:
Oh yeah just now see it.

And maru thanks you i have forgot the name.

Thanks for the info. I appreciate as always.

Yeah little difficult now for the other devs if they want to have inside in the projects the zygisknext, need permission first
[Magisk] pndwal:
👍

Ah yes... Good for them.

https://github.com/Dr-TSNG/ZygiskNext/issues/81#issuecomment-1878332345

const MAGISK_OFFICIAL: &str = "com.topjohnwu.magisk";
const MAGISK_THIRD_PARTIES: &[(&str, &str)] = &[
("alpha", "io.github.vvb2060.magisk"),
("kitsune", "io.github.huskydg.magisk"),
];

🤠 PW
[Magisk] badabing2003:
I posted a script that extracts the kernel and patches it and repacks / flashes.

The only input that it requires is the offset and the text you want applied.

@TheFreeman193 posted another script that automatically finds the offset.

Between those two scripts you really don't need much to patch.

It's all in this thread somewhere which i don't have handy right now.
[Magisk] marisaleh:
please let me have those scripts

with some instructions on how to

use them, send me a link because

l can't find them.

This will be a life saviour

Thank you very much
[Magisk] BunnyPig1:
Random question, might be a bit ot.

Are manufacturers required to install a TEE-chip on their phones in order to sell them with play services?

I just noticed that my oneplus 6 has a broken TEE and got me thinking that if you don't have TEE, you can pass DEVICE but not STRONG from which I understand is basically okay since very few apps uses STRONG.

This just made me think if Google actually requires TEE or not and maybe someone might release a phone without TEE?
[Magisk] bombadier:
Check this post for badabing2003's script
[Magisk] makeyourself:
Yes I believe it's a requirement of Play Services to hijack a user's device with a TEE. I'm sure others will confirm but I think past a certain Android version it became mandatory.
[Magisk] badabing2003:
Yep, check that post linked by @bombadier

Here's the post / script from @TheFreeman193

You should also read posts in between the two, as I answered few questions here and there regarding the script and the proper usage.
[Magisk] marisaleh:
so where is the script and how do I

run it , on the phone or in windows

to be honest I am not familiar with using scripts.
[Magisk] zgfg:
Yes, since A9 or so TEE is required- not only bcs of PI but also for biometrics, Data encryption, KeyStore

Look to the Chiteroman's posts and other similar posts about ROG. He had explored 'broken' TEE to pass Strong. Look also to his projects on GirHub. He also posted about (with Strong Integrity screenshots) on Telegram but later he closed that debating channel...
[Magisk] BunnyPig1:
Interesting. So devices that have and will (might) have a broken TEE is rare. Might be worth some money in the future haha

Makes sense it's for more than just PI. I don't agree with the practices and measurements Google are doing but I understand why they aim for "security".

I've been following Chiteroman's work but it's way too advanced for me.

It would be interesting to join the project but I don't know enough to be any help. I can use my phone as a test device if needed at most.
[Magisk] wfred:
Unfortunately not.

You might want to check with whoever maintains your rom and see if there's an update that renames the kernel
[Magisk] makeyourself:
Yeah, with OnePlus (think you said that's the device you have) I think all or most of their devices had broken TEEs at one point. It was rumoured that the broken TEEs were deliberate! Though they would have had to fix it by now because I think broken TEEs would fail Play Integrity for devices released with the very latest Android versions.
[Magisk] BunnyPig1:
Which makes it interesting how Google is pursuing PI in the way they are. If they know broken TEEs are out there and might be able to "get around" the system in any way, how can they enforce PI..

If I had a working TEE on it, it would be able to pass STRONG if stock, right?

Which makes it incredibly stupid of any developer to enforce STRONG in any application at all. Would render so many decent phones useless.
[Magisk] HippoMan:
We can hope and pray that developers don't move to requiring STOCK. However, given some of the not-very-intelligent security checking that is performed by many banks and "banking apps" (such as the McDonald's and Pokemon Go apps, for example), it may very well be the case that STRONG-integrity checking might eventually start appearing, especially in some money-related apps.
[Magisk] makeyourself:
I'm not sure about passing Strong with broken TEE but possibly yes. I had a OnePlus 6 but sadly it's long since been discarded.

I think it's part of the reason that Google haven't enforced Strong for everyone yet and not many other apps have. In a few years time all devices with broken TEEs will be obsolete and almost completely out of use. So they could do it then.

Why they are pursuing their current strategy nobody knows for sure of course. Personally I suspect that in the early days of Android modders had some value to Google. Modders came up with half the new features that eventually ended up in stock ROMs lol. And modding drove sales and excitement for Android. Now, they and Apple have no competition. And everyone knows Apple is even worse. So I think Google just doesn't care about modders in the face of pressure from banks etc.
[Magisk] zgfg:
There are 700+ pages in this thread, you are probably new here and searching the thread would be almost useless

The story practically began (Google was embarrassed and started to pay attention to the PIF) when Chiteroman realized how Google was cheating with their own device that was not able (with the original ROM) to attest Strong Integrity

Hence they made it that PI was reporting Strong Integrity where in reality only Device Integrity was tested and passed on that old Pixel

Hence Chiteroman built-in those prints to the PIF (it was well before Fork and custom prints) and all of us were happily passing Strong Integrity (although with no real benefits - some 'banking' apps were still detecting 'root' the other ways) - for about one week until Google realized and 'banned' those prints

After that, over about 9 months (don't catch me for the words, months, numbers - I'm trying to sketch a big picture) all that had been duscussed here, with a lot of intersting posts, technical details, etc

However, we still don't know some simple things about Device Integrity and 'banned' fingerprints. - how exactly they 'ban', how they distinguish real users of those devices (with the 'banned' ROMs) from the spoofers, etc

Back to the Strong - here you have Google's list of the compromized vendor keys:

https://android.googleapis.com/attestation/status

Again, that list/link had been shared here many times and I'm puting it now just like a copy-cat
[Magisk] GeTex:
I can't tell but I think my private print just died for RCS about 10 minutes ago
[Magisk] zgfg:
For me, with 'my private' prints, RCS works fine (just tested)
[Magisk] GeTex:
My private print phone, I'm getting "message not sent" errors instantly suddenly
[Magisk] BunnyPig1:
Yeah.. There's no telling in when it'll happen but it probably will rather soon.

Can only hope that someone will be able to get something working so android can remain what it once was. Or something new will come along so we can say "screw you Google and Android".

They will have to wait a while then (at least I hope). People are still using older devices that is still perfectly fine and with broken TEEs even on later models like OP 9 will be used for hopefully years to come.

These are the main reasons why monopoly needs to stop. Android used to be great like you said. But you're probably right with the last part of your message. There are only 2 providers, of course you can use android without anything related to Google but that disables a lot of functions. For me my phone is pretty much "useless" since I only use it for calls, texts and payments basically. Saddens me.

Had no idea about the list, didn't know it was that many either.

I haven't been around since the beginning so a lot of interesting information there.

But this just frustrates me even further, since there were huge vulnerabilities in the beginning when PI entered the field. Sure they patched it and made it secure but this just shows that no system is bullet-proof.

I don't have the knowledge to backup any of my claims but I'm sure something will come up to bypass PI.

Be it a software or hardware modification.

Like you said, knowledge is pretty much the key in all this mess.
[Magisk] tom1807:
I can't really tell whether RCS works for me because not very popular where I live, but I assume yes, because just for fun, I disabled RCS, re-enabled it again and I was at once connected after verifying my mobile number.

Then I went through some messages, the only 2 where I found that RCS "should" work was a friend of mine (who never reads or replies) and Google messages who sent previously verification codes where it showed RCS message available.

Like I said, can't really test, so I can only assume it works.

Pixel 6 on April Update

GPS: 24.10.17 (19400-617915183)

PlayStore v40.3.28-31, certified.

Messages: messages.android_20240312_00_RC02_phone_dynamic

Magisk v27.0 hidden

PIFork v8 with Xiaomi Print, Shamiko 1.0.1 (300), Device Integrity passed.

Deny list, only Google Wallet (no other Google apps), banking apps, apps which provide a payment service + some (illogical) apps which complain about detecting root though there are no sensitive information required.

On a funny side note: The updated BBC News app can't now be installed when it detects root. :rolleyes:

First I thought it could be the Private DNS I use for adblocking, but it turned out as soon I added BBC to the Deny list, it worked.

Cheers

Tom
[Magisk] Nergal di Cuthah:
This one? https://play.google.com/store/apps/details?id=bbc.mobile.news.ww
[Magisk] sawdoctor:
No issues here with BBC news or any of the BBC apps
[Magisk] osm0sis:
😯

Still working here with my private print.
[Magisk] tom1807:
Correct.

Started for me as soon as they rolled out the new user interface, with the old user interface were no issues.

Error message: This app can't be installed (or similar)

Cheers

Tom
[Magisk] Nergal di Cuthah:
I didn't even get an error message just

View attachment 6088050

Once i added to denylist (enforced no shamiko) and cleared data for bbc it brought me to sign in register page. I confirm your finding. (Pixel 6 pro magisk canary. pif and systemless hosts but no other modules. No private dns but yes adaway)
[Magisk] pndwal:
Yes and no...

Trusted Execution Environment is required but the TEE OS* traditionally runs on the same processor as the Android (Rich Execution Environment, REE) OS although isolated from the rest of the system by both hardware and software...

In newer devices the TEE may be on separate silicone. With the Pixel 3, Google decoupled the TEE from the chipset and used a separate security module, the Titan M (separate) chip, which has now been replaced by the Titan M2 (Pixel 6+), a standalone processor not sharing resources like memory or cache with the main processor... The chip has its own flash memory for sensitive data and runs its own "microkernel" minimal OS.

Spoiler content hidden.

Yup... Banks and others are holding off from requiring STRONG verdicts as all pre-Android 8.0 and many OnePlus (and various other) device (with broken keymaster/chain of trust implementation) users would be instant collateral damage...

Hope the above helped...

Not likely. 😉 PW
[Magisk] BunnyPig1:
Very interesting!

It's incredible how much is actually happening under the hood of our devices. I don't agree with any of Google's ideology but it's so fascinating. With all the answeres I've gotten I have a better understanding why this is so hard to "overcome". Just a matter of time when I have to throw out my perfectly functioning OP6.

Thank you all for taking time to answer my question. It's very appreciated!

@pndwal @zgfg @makeyourself @HippoMan
[Magisk] ew:
I think I just found a way to test RCS. Use https://kitchen-sink-bot.appspot.com/. Just registered and tried - and RCS is working for me. Hopefully it is really accurate - and doesn't get overloaded.
[Magisk] maxim.a.petrov:
Help to pass Device integrity check, put different modules, nothing helps, is firmware MIUI 10.3.5 EU on 9 Android, kitsune 27001 before everything worked without problems. Now it wants. Well changing different mag suits doesn't help either 😭😭😭😭

View attachment 6088057
[Magisk] osm0sis:
To close the loop on this, @shoey63 mentioned the brilliant idea of restoring stock images BEFORE even doing the update check, and sure enough it served me the Incremental OTA for April where it previously wouldn't! Nothing special necessary on the Shamiko'd DenyList.

This means a check of the partitions must be what's happening when it briefly shows "Preparing system update..." and then disappears again!

Flashing the 38mb update went without issue, then before rebooting I was able to Direct Install and Install to Inactive Slot in Magisk (to keep both slots rooted), and all worked perfectly. 🤘

I'll be updating my previous instructions (from the OnePlus days) when I get a chance some evening next week month. 😁

[TOOLS][ZIPS][SCRIPTS] osm0sis' Odds and Ends [Multiple Devices/Platforms]

osm0sis' Odds and Ends -- Misc./Batch Tools, Flashable Zips, Scripts, etc. General Information In a nutshell, I just wanted a single thread to gather links to some of my other, larger projects, but also serve as a spot I could put some smaller...

xdaforums.com
[Magisk] briank6932:
Is it abnormal for the Xiaomi.eu PIF to fail CTS? I tried a few other PIFs from dumps, and couldn't find any that actually pass CTS either.

I haven't been able to pass CTS since late January, not sure what the cause is. I've used the stock boot.img from my ROM, used to use magisk, tried a custom kernel (didn't help), and now just use KSU patched onto my original kernel with AnyKernel3. I'm honestly at a loss.

Phone: Zenfone 9

ROM: omni-14-202403121645-zenfone9-GAPPS

❯ adb shell getprop ro.build.version.release
14

❯ adb shell getprop ro.vendor.build.id
UQ1A.240205.004.B1

❯ adb shell uname -r
5.10.81-android12-9-g9729dec572d0

❯ (ls Y:/data/adb/modules).Name
avbctl
Pixelify
playintegrityfix
ssh
xmlpak-RE
zygisk_lsposed
zygisk_shamiko
zygisk-sui
zygisksu

❯ adb shell su -c /data/adb/lspd/bin/cli modules ls -e
com.thinkdifferent.anywebview 10292 enable
es.chiteroman.bootloaderspoofer 10309 enable

For the sake of completion and debugability, I mount /system as rw with RO2RW, and append the following to /system/build.prop.

ro.config.vc_call_vol_default=3
ro.config.media_vol_default=15
ro.config.media_vol_steps=30
net.tethering.noprovisioning=true
ro.tether.denied=false
ro.telephony.call_ring.delay=0
ring.delay=0
ro.config.hw_quickpoweron=true
ro.HOME_APP_ADJ=1
profiler.force_disable_err_rpt=1
profiler.force_disable_ulog=1
ro.media.enc.jpeg.quality=100
persist.camera.HAL3.enabled=1
persist.service.adb.enable=1
persist.service.debuggable=1
persist.sys.usb.config=mtp,adb
ro.config.hw_power_saving=1
ro.config.hw_fast_dormancy=1
ro.config.nocheckin=1
[Magisk] Captain_Throwback:
I mean, if you went back to stock, you could pass Strong Integrity without any custom fingerprint...
[Magisk] briank6932:
Using the ROM at all trips integrity, I'm not gonna lock my bootloader, and I don't want to go back to the stock ROM.
[Magisk] Captain_Throwback:
I don't think @micky387 has implemented anything to fix Play Integrity, but you may need more than just the print to pass on Omni.
[Magisk] shoey63:
Omni is free of built in PIF fixes, at least for ROG 3 (Unlike Bliss and others).

Pretty sure it passes Integrity with just the PIF module (or fork V8 with your own supplied fingerprint).

If not, Shamiko will do the trick.
[Magisk] zgfg:
CTS is from deprecated SN - actual is Play Integrity, how do you go with PI Checker?

Check PIF logs in logcat to see does it inject the prints from Xiaomi.eu

Make sure that you have Zyygisk enabled, gms in the not-forced DenyList, etc - check the FAQ post
[Magisk] Captain_Throwback:
I didn't say anything about locking bootloader...on ZF9 stock you can have Strong with unlocked bootloader.
[Magisk] briank6932:
But ROM breaks it, interesting.

Afaik CTS' required to pass MEETS_DEVICE_INTEGRITY, currently I can only pass MEETS_BASIC_INTEGRITY.

Is there some type of filter I should use on my logcat? I don't currently see anything relevant when making the Play Integrity request with SPIC. I see the following when filtering by playintegrity.

1712335106.666 root 4118 4118 I KernelSU: ksud::module: path: /data/adb/modules/playintegrityfix
1712335103.312 root 4022 4022 I KernelSU: ksud::module: path: /data/adb/modules/playintegrityfix
1712335098.140 10274 3643 3723 D KernelSU: use default profile for: com.henrikherzig.playintegritychecker, 10303
1712335099.019 root 3979 3979 I KernelSU: ksud::module: path: /data/adb/modules/playintegrityfix
1712335096.130 root 3937 3937 I KernelSU: ksud::module: path: /data/adb/modules/playintegrityfix
1712335032.003 10274 3643 3722 I ModuleViewModel: "id": "playintegrityfix",
1712335032.001 root 3778 3778 I KernelSU: ksud::module: path: /data/adb/modules/playintegrityfix
1712335029.495 root 3704 3704 I KernelSU: ksud::module: path: /data/adb/modules/playintegrityfix

Not sure how to do that on KSU, I have Shamiko, and it says it's running as app profile 🤷‍♂️.
[Magisk] zgfg:
Filter by PIF. IMO, it must be in the FAQ post, on GitHub...

su -c logcat -c

su -c killall com.google.android.gms.unstable

test, then

su -c logcat -d | grep PIF

CTS is required but you could pass CTS and still fail PI.

And when testing with PI, open JSON (PIC, SPIC) and read more there

I dunno for KSU...
[Magisk] briank6932:
Seems like it works
[Magisk] Lord Sithek:
Off-topic, but... Shouldn't @zgfg and @pndwal be acknowleged as Recognized Contributors? I vote for (y)
[Magisk] i5lee8bit:
Since the OS is handling the OTA in a pretty straightforward way at this point, I'm assuming that if you have verity and verification disabled, you wouldn't want to do it this way? As tempting as it would be to simplify my monthly updates, I do need to keep my verity and verification disabled and I believe this would revert them back to enabled without a proper chance to disable them before the next boot... or is there a known way to do it from within the OS? That would be great to know although I doubt it haha.

Spoiler content hidden.
[Magisk] zgfg:
Per log, module injeccts.

Btw, its PI Fix, not PI Fork (II use Fork).

If so, PI Fix comes with the built-in Griffin prints - are you using them or you submitted your own pif.json (I'm puztled since the log complains about missing BUILT_IN field)

And - I changed CODE to SPOILER, cluck on and see why😁
[Magisk] shoey63:
You could use Vbmeta patcher by @capntrips to patch vbmeta on the opposite slot before rebooting, but I'm not sure if you would receive the OTA update in the first place with vbmeta disabled.
[Magisk] briank6932:
I've used both (neither works for me), and in the ls I did in my previous message, you can see I'm not currently using fork.
[Magisk] miXOnIN:
yep, I thought that it because of force update Google play services to latest
[Magisk] pndwal:
Just interested in your use case for this as I know Magisk doesn't do this by default any longer (since 2SI magiskinit injection refactoring in 25.0+ AVB flags and keys / vbmeta have been left intact as stripping these is no longer needed for magiskinit injection by patching the original init) and aims to keep AVB intact... Please say why you need that. (Old custom kernel?) 👍 PW
[Magisk] ashish1989:
Guys sorry for asking again, any solution for passing play integrity using older Xposed below android 8. Can not use any banking app because of it.
[Magisk] i5lee8bit:
Thanks for the info. The link from the GitHub to the XDA thread of that and the 2 other related projects looks like it really would have been useful for me like 2 years ago. Can't believe I totally missed them, but I guess that's what having 2 kids does lol. Btw about not receiving OTA updates, that's what I thought too! But apparently they can still slip through as it's definitely happened to me on multiple occasions.

Actually technically I don't NEED to do it anymore since the custom raviantha + shusky kernels have moved to monolithic builds and since those months ago it hasn't been required to boot. And while my wife's phone now keeps AVB intact since the unexpected forced OTA, I continue to keep mine disabled for testing purposes. Even in that case I haven't actually NEEDED to keep it disabled for the last few months but do so anyway in case some changes come along and I'm no longer able to use custom kernel without it (with the anticipated move from 5.1x to 6.1 kernels on newer tensor-based Pixels, who knows what to expect when that finally happens? At least in the first few release cycles...)
[Magisk] shoey63:
It seems QPR updates are pushed as full OTA packages, the so called 'forced update' and don't need restoring images.

Incremental OTA updates will work provided all images are unmodified stock prior to checking if there is an update.
[Magisk] pndwal:
Many custom Kernels were simply relying on AVB being stripped out for them by Magisk... With the whole new sepolicy injection mechanism introduced in 25.0, the “SELinux Problem” was solved "once and for all"... Since this is a "full paradigm shift on how Magisk hot-patch the device at boot"*, several behaviors (that many developers implicitly relied on) are gone, especially Magisk no longer patches fstabs in most scenarios keeping AVB intact.

*The reason for this change was that "With the increasing complexity involved in early mount and split sepolicy it is about time to rethink Magisk's sepolicy strategy as rebuilding init's functionality is not scalable and easy to maintain", but there are more advantages; Regarding Use /data as tmpfs mount point in 2SI setup:

- No need to switch root manually

- No need to modify fstab, which significantly improves compatibility e.g. avoid hacks for weird devices like those using oplus.fstab, and avoid hacking init to bypass fstab in device trees

- Supports skip_mount.cfg

- Support DSU

So custom kernels (I believe starting with @Freak07's Kirisakura and @dr.ketan's Dr Ketan ROM with help from @capntrips) quickly updated to methods not requiring disabled verity/verification...

I doubt Kernel Devs will regress to old methods personally. 🤠 PW
[Magisk] pndwal:
Did you ever try this?:

🙃 PW
[Magisk] Vision:
Unfortunately, he had try the Dreamland, now about the Xposed by huskydg, I'm not sure, i have lost the count 😂🤣

View attachment 6088813
[Magisk] markfm:
Thanks - I just tried it (RCS working, no surprise)
[Magisk] ashish1989:
Yes boss, but will try again with fresh install now. Let's hope it will work.