yashsingh1/xdaforums huggingface dataset:
[Magisk] osm0sis:
Google doesn't seem to know that most ROMs don't ship sqlite3. IIRC they also have the quoting wrong either way. 🙄🤔

A good quick workaround is to install Google TV (i.e. formerly Google Play Movies & TV), go to Google TV Settings and copy your Device ID from below About there.

Edit: Also on my stock rooted Pixel 8 Pro data/data/com.google.android.gsf doesn't even exist. 😯

I guess that's why on the official instructions it updated to /*/*/*/, also looks like Google fixed their quoting, but phh still has the old broken one.
[Magisk] sawdoctor:
There's a new fork actively maintained

GitHub - pumPCin/LSPosed: LSPosed Framework

LSPosed Framework. Contribute to pumPCin/LSPosed development by creating an account on GitHub.

github.com
[Magisk] defroster:
Isn't Device ID different to the Google Service Framework Key that google ask for?
[Magisk] osm0sis:
Interesting.. looks like they got latest chaotic Dobby HEAD code working as well.
[Magisk] osm0sis:
Nope. Not in this case.

Edit: Just to be certain, I have confirmed my Google TV method still works and the shown Device ID still matches the Google Services Framework Android ID sqlite3 output from the corrected command! 👍

su -c ' sqlite3 /data/*/*/*/gservices.db "select * from main where name = \"android_id\";" '
[Magisk] FlexWheeler:
please help me
[Magisk] defroster:
I will give it a try tomorrow, it's 2am :( if it's going to ask me to sign in to my Google account to access the information it won't work because it just screams unauthenticated device whenever I try to log in to anything.

I feel so stupid getting back into all this stuff and wasting my first day off in months on it.
[Magisk] osm0sis:
You just need to keep trying with pickaprint until you get one that works... It's literally in the instructions for it.
[Magisk] V0latyle:
Try using Pixel Flasher, all you have to do is click a button.

See here:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

The pickaprint script picks a random print from a pool of untested and unsorted prints. Some work, some don't. You have to keep trying until you find one that works. Make sure you're killing Droidguard every time you change the print. Pixel Flasher does this when you push the print to your device.
[Magisk] FlexWheeler:
Do I need all four checkmarks?
[Magisk] osm0sis:
No, 2 is correct.

See FAQ #6: https://xdaforums.com/t/pif-faq.4653307/

Also, congrats, you found one!
[Magisk] V0latyle:
Nope.

STRONG is not possible on unlocked bootloader

VIRTUAL is only for emulators
[Magisk] :
For me it took 3 to 5 times on 4 different devices. But keep in mind that your kernel string may render one's efforts obsolete.
[Magisk] rodken:
Yes, the dreaded reality of Google's continuing countermeasurings and proactive stance on kernel strings. Not to mention that GPU driver fingerprint banning are on the horizon of Play Integrity API checks.
[Magisk] :
They could do much more. But given the amount of devices and requests, even they must consider delays and computing time, IMHO. The kernel string seems to be an effective way to ensure a device is not as it should be. Besides the fingerprint.

Edit: https://github.com/chiteroman/PlayIntegrityFix/issues/236 was fascinating. Thanks to all contributors!
[Magisk] V0latyle:
Yeah, and that's the whole point of this - does the software environment match one that has been approved via CTS? If not, Google cannot guarantee to the app developer that the app will work on the device.

Granted, they have a lot of smart people over there that know just as well as we do that having a custom kernel or being rooted does not in of itself break compatibility. But, they still can't provide a guarantee that it will work because it doesn't match the original profile.

While I don't think they're necessarily out to develop specific counter-countermeasures to our current countermeasures, they aren't doing us any favors either, and I have to wonder exactly why they're doing this - like, I doubt there was ever any increased demand for custom kernel detection.

But, as others have pointed out, Google doesn't do a great job of managing their own projects. I think it was @osm0sis who said that often times there's no clear direction and everyone is more or less doing their own thing so there's little coordination on the project as a whole - because no one is steering the ship, so to speak.
[Magisk] Lord Sithek:
So it looks like the continuation of the frozen project by the same devs? Isn't it? 🤔

EDIT: No, not really
[Magisk] :
I think it's not about compatibility but about ensuring the app developers' intellectual property. The user shall not interfere between app and it's server. Or tamper with the app itself.

Where's the difference to other big players? 😉
[Magisk] pauljblo:
in pixel flasher does the xiaomi.pif work to pass to see if my setup is correct as doesnt work for me to pass
[Magisk] xcl1pse:
Lol crappy fork
[Magisk] rodken:
Care to elaborate?
[Magisk] Nergal di Cuthah:
I think so, but @badabing2003 can answer for sure
[Magisk] Umgak:
Yes. If you don't pass with xiaomi fingerprint, check your kernel name uname -r and ensure it's not on the known banned kernels list. If it isn't, you may have some Magisk or Xposed module which is detectable by Play Integrity, try without any modules enabled other than PIF.
[Magisk] lupastro82:
Indeed. Official is EOL. This looks like a valid alternative. I use lsposed just for update locker (cause revanced and some other apps like fairmail - i use GitHub release - and Facebook lite - I disabled via permission inappbrowser).
[Magisk] xcl1pse:
No joke, all LSPosed forks do is disable logd on LSPosed and LSPlant, replace xposed text with xp0sed and update some dependency which is useless. Do you really need that update? Just use official version. If you really need an update, why not ask all forks to support stripped ART version then
[Magisk] pauljblo:
it is a custom kernel i have but different name to on that list. could the custom kernel be messing with it
[Magisk] rodken:
[Off-Topic] I was just about to dissect that fork, but I figured that I'll wait for your response.
[Magisk] V0latyle:
The problem with having a known good "test" print is that it won't be good for long if everyone tests their configuration using it.

I know it's frustrating because we all want a way to be able to tell whether we just have a bad print, or if there's a configuration issue.
[Magisk] Nergal di Cuthah:
Won't be good for long anyway it's the one used by xiaomi and next (and probably "billions" of lookalikes).
[Magisk] osm0sis:
Won't know until you tell us what it is... 😉
[Magisk] ZG_DEV:
Oh, hello !

First time using PIF here.

When installing the module, the module said that "PIF.json" modification is required, a template is given" , I have found the template but not sure what to do or what to modify in there.

Thanks for help !
[Magisk] pauljblo:
its a old custom rom i havnt updated for years but the kernel is called Singularity-Custom its running on oneplus 5t

do you want the version number too
[Magisk] defroster:
This all sounds like a nightmare.. think I'll just go back to stock Android 10 :(
[Magisk] Spartacus500:
Kit Player detect root Magisk 27.0, hide all, but not work hide this app 🤷
[Magisk] frasca61:
You are right but everything works well to me ...

If it is not broken, don't fix it :)
[Magisk] ArzZenic:
🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

It's for different version of the tool, but still mostly usable.

Use lastest PixelFlasher, now it's way easier than in December. Now you can use Freeman list and just check diferent FPs really fast through "Pick random PIF" or button saying something like this.
[Magisk] sawdoctor:
Why not use zygisk disable if thats all you use it for? There's even an app for it now
[Magisk] pauljblo:
Singularity is with a capital S i put lower case before
[Magisk] ZG_DEV:
Thanks but Pixel flasher ? I use oppo a5s 🙂
[Magisk] lupastro82:
Idk this. I try, ty.

--

Ok, u mean detach. To be honest, tried in past a detach module, but sometimes app updated again. I can try this. Maybe now work best.
[Magisk] osm0sis:
Give me the exact output from the terminal command: uname -r
[Magisk] xSnowLeopardx:
I don't care if people will attack this comment of mine, but I will still say it from time to time:

Still passing 2/3 with V14.4 since Dec 2nd.
[Magisk] majorfigjam:
Use Shamiko, it works for me.
[Magisk] Nergal di Cuthah:
Don't be deceived by the name, if your phone works with adb and fastboot it'll work.

It's just a very advanced gui for platform tools
[Magisk] defroster:
No luck with Google TV, as soon as the app opens it goes to sign in to Google account and gives the play protect error :(
[Magisk] Spartacus500:
I have been using it for a long time, I currently have the latest version and it still detects root 🤷
[Magisk] pauljblo:
4.4.151-Singularity-Custom-V-1.0.29
[Magisk] defroster:
I was finally able to get a Google play key thing from Get ID, either by waiting for the error messages to pop up (by signing into Wi-Fi) or because I forgot to hold the bootloader keys that time and so magisk didn't load.

I registered the id at the Google address but it's still saying the device isn't play protect certified.

I guess I'll give it a couple hours in case it's a matter of waiting.
[Magisk] osm0sis:
It should still let you sign in...
[Magisk] ZG_DEV:
No fastboot in my device unfortunately:(
[Magisk] badabing2003:
You don't need fastboot to use the PIF manager in PixelFlasher.

You need platform tools and adb access.
[Magisk] defroster:
Nope, not until I managed to get the ID from the Get ID app did it allow sign in.

This is my new plan:

Get a vanilla lineage 20 rom, offline install, install magisk apk, install playprotect, microg module, microg gapps, enable device spoofing in treble settings, enable zygisk, denylist, block playstore but not google play services ...?... pray
[Magisk] ZG_DEV:
Ok, will check that and tell you the results.
[Magisk] majorfigjam:
Something else going on then, as I opened it no problems with app on (disabled) deny list.
[Magisk] sga999:
Apologies for being off-topic and not knowing enough about Magisk. If we start with the boot image that already included magisk, then we unpack that image and repack all components, why does Magisk need to be installed again? I'm wondering what parts of the boot image that relate to Magisk get "undone" with the repack?
[Magisk] osm0sis:
Should be none if you started with a Magisk patched image.
[Magisk] sga999:
I've been installing Magisk differently for quite a while. Not sure why, but I must have had some issues with the patched image. So I've alway been installing Magisk.zip in TWRP, After booting system and bringing up the Magisk app, I pick Direct Install, which says it's recommended. So I think you're saying that method must not be "correct", yet everything seems good.

Also, the post I was quoting from @remoh indicated that Magisk needed to be reflashed since "we changed the boot image". It sounds like you are saying the minimal patching of the kernel string means we should not have to reflash Magisk?
[Magisk] osm0sis:
Hmm? No, no matter if you use Direct or zip in TWRP you're still dealing with a Magisk patched image. So if your device is rooted by a Magisk patched boot partition, and you dump that and edit that then you'll still be rooted.
[Magisk] osm0sis:
Neither Singularity or Custom are banned keywords. Must be something else going on on your setup.
[Magisk] sga999:
Thanks, that sounds right. So I may have accidentally used the original boot image rather than one that has Magisk installed in it. Or it could be something wrong with the Windows port of Magiskboot. Most likely, it's the former rather than the latter.

I'll assume that using a boot image without Magisk is probably why that post said that he needed to reflash Magisk. The reason would not be that he had patched the boot image.

I'll try again later.

EDIT: Sorry, it was a false alarm, Thanks for steering me in the right direction, @osm0sis. Somehow I had not started with a boot image that included Magisk. @remoh, you should only have to reinstall Magisk if you started with a boot image without it.
[Magisk] pauljblo:
Thankyou for testing the keywords. I have disabled all other magisk modules but can only pass basic integrity. Any ideas what I could try?
[Magisk] owenjm:
I'm also one of the outliers here. Have been using a custom print since the start of December, never had an issues until the exact time when custom kernels started to be banned. But -- my kernel uname is clean with no banned words:

(obscuring the 4.x.x version and the standard format date string, since I figure it's not useful to post identifying data when specific strings are being banned -- but it's not a branded kernel and has no kernel name at all)

I've upgraded Magisk and app, removed all other modules, checked deny list (although apparently not required, but all goog* gms* apps are blocked anyway), using a custom appname for Magisk manager. No dice. I had several other working prints saved from my search back in December; none of them work. I've tried a lot of new prints via pickaprint also, none work. (All testing done with the latest version of pixelflasher; PIF is v15.5.)

Does anyone have any idea why things might have suddenly failed? It's really odd.
[Magisk] trevtdogg:
this means you have to try different fingerprints to find one that works for passing device as well.
[Magisk] defroster:
Just to confirm; I don't need to worry about all this fingerprint stuff if I don't care about banking apps/Netflix right? I just want Google apps and root.
[Magisk] Captain_Throwback:
If one of the Google apps you want is Wallet/Pay, then yes, you "need to worry about all this fingerprint stuff." Otherwise, you probably don't.
[Magisk] Nergal di Cuthah:
Gpay/wallet nfc payments can't be done. But other than that what you listed is comprehensive. I pass device with a fp so I'm not 100 percent there's nothing else but sounds right.
[Magisk] pauljblo:
But I have tried with the xiaomi.pif which is know to work by users on here
[Magisk] foldax:
Hello guys

I've got problem with Pixel 4a and Moto X4

Both on LineageOS + Magisk + Play Integrity Fork v7 + pickaprint.sh + some random pif

Deny list is enabled.

Is this setup enough to get CTS ?

I'm asking becouse i'm unlucky in finding good FP for CTS
[Magisk] majorfigjam:
Depends on your lineage kernel, which may be blacklisted.
[Magisk] ZG_DEV:
Sad, but strange news, Pixel flasher does not run on my pc, it just shows that screen that says "Pixel ⚡flasher" and then it is gone, does not do any action after that.
[Magisk] foldax:
Do you have any advice which should i use ?

So rest of my configuration looks good and probably lineageos is a problem now ?

edit/

I've found an answer -> https://github.com/chiteroman/PlayIntegrityFix/issues/236

So currently noone with lineageos has CTS right ? I need to go back to stock rom :(
[Magisk] tom1807:
What's your operating system? If it's Windows 7, you have to download Pixel_Win_2019.

Windows 10 and higher, just Pixelflasher.

Cheers

Tom
[Magisk] Loupingy:
Same issue here with a pixel 4a Stock Android 11.

As I install the PlayIntegrityFix_v15.5.zip (and remove safetynet-fix-v2.4.0-MOD_2.0.zip) basic integrity and CTS profile failed.

After remove V15.5 and reinstall safetynetfix, the CTS is back to green
[Magisk] chiteroman:
v15.6 released !

Release v15.6 · chiteroman/PlayIntegrityFix

Fix bootloop issue in modern devices. Move code logic to C. Minor improvements. Device verdict should pass by default. If not, try removing /data/adb/pif.json file. DO NOT REMOVE pif.json in modul...

github.com

Now using cJSON instead nlohmann !

Also, moved all prop spoofing code to service.sh.

Should work in every device 🤗
[Magisk] ZG_DEV:
Win 10, 64 bit.
[Magisk] Princknoby:
I managed to get 2/3 I just didn't get STRONG (normal).

I just edited the kernel string to something random (kept the number of characters).

My successful post is a few pages ago (Credits are not mine, another user posted the step by step).
[Magisk] bombadier:
I would take it to the pixel flasher thread, are you loading pf with your phone connected ? try to open pf before connecting your phone, dont know if you use multiple monitors but there is a post from someone who had a similar issue of pf not opening

📳🔥 PixelFlasher, a GUI tool for flashing / updating / rooting / managing Pixel phones.

DESCRIPTION As the name suggests this is an application to flash (update) Pixel™ phones (possibly all Google™ made phones/tablets, YMMV.) PixelFlasher at its core is a UI layer (with bells and whistles) on top of adb / fastboot commands, hence...

xdaforums.com
[Magisk] ZG_DEV:
Firstly I do not have multiple monitors, secondly tried PF without connecting my phone, still doesn't work :(
[Magisk] badabing2003:
I don't want to pollute this thread with PF support issues,

Follow the advise of others and head over to the PF thread.

Try running it from command line, with --console flag.

Post the output there if you see anything.
[Magisk] Gyalist:
Upgraded to v15.6 and keep getting this error:

P.S. I'm using Play Integrity Fix and Playcurl modules. Reverted to v15.5 and it's working again.
[Magisk] Spartacus500:
V15.6 and 🤷
[Magisk] osm0sis:
A bunch of prints got banned at the same time as the kernel ban rolled out. Like a popular Google tablet 8.1.0 print I was using got banned, and then I found all 8.1.0 prints for it were banned, but that going back to a 8.0.0 print for it still worked. Keep trying!

Also there's nothing personally identifiable in your uname.

cJSON doesn't support comments? So you broke every user that has comments in their json without telling them. 🤔

You've tried moving it all to service.sh before, you should know already that it won't work, and will break things for some devices. I believe we had this conversation in November. 🤷‍♂️

Also service.sh is too late to remove USNF, or remove GMS from the DenyList to prevent a conflict.
[Magisk] pedritopl:
Courious thing I noticed, which might help someone.

On OnePlus 3T with the latest LineageOS 18.1 build, apart from modifying the "-lineage" string in the kernel binary I had to remove Shamiko module to get the Play Integrity again.

As soon as I add Shamiko the device stops passing the Integrity check as well as old Safety Net (both Basic & CTS profile check). Without Shamiko I pass the old SN & basic+device Play Integrity.

All worked just fine with Magisk v26.4 and Shamiko 0.7.5 before the changes done by Google.

Current setup: OP3T + LineageOS 18.1 february build + Magisk v27.0 + PIFork v7

Shamiko 1.0.1 (removed / disabled)
[Magisk] osm0sis:
Surprising! Working fine with latest Shamiko here.

However, Shamiko is notoriously finicky with being disabled/reenabled, so you might want to try uninstalling it, then reboot, then reinstall it. If it doesn't show the correct preinit directory then try again.

And make sure your DenyList is disabled.
[Magisk] foldax:
simply by using hexeditor ? nice

where kernel is stored? boot.img ?
[Magisk] shoey63:
Hex editor not required if you use @TheFreeman193's Script
[Magisk] pedritopl:
Tried as suggested. Still same result. With Shamiko - no go. Without Shamiko - PI passing.

Where do I look for the "correct preinit directory" though? Magisk logs?

PS: same versions of Magisk, PIFork (same fingerprint) + Shamiko work fine on a OP7T.
[Magisk] Princknoby:
Exactly for both questions.

You must extract the boot.img from the ROM zip.

Then use magiskboot to unzip the boot.img.

A file called "kernel" will appear. You must open it with hexeditor and edit the kernel string (I use a randomly generated word with the same number of characters). Don't change a string when it opens paths.

Save the file and use magiskboot to repackage the boot.img.

Then flash the new boot.img (Fastboot or via custom recovery).

Boot a ROM, install Magisk again, install the modules (PIF and in my case SHAMIKO too).

Activate ZYGISK, hide the magisk app, clear Play Store and Play Service data, restart and that's it.
[Magisk] osm0sis:
It's in the output while installing Shamiko, it tells you if it found it or not.

Did you remember to leave your DenyList disabled? That's the only thing I can think of that would explain your issue.
[Magisk] intel_core_i7:
Original screenshot says the app only requires android 5.0 minimum, so any kind of hardware attestation in place is automatically out of the windows

This app probably requires Thai IP address to function, hence it doesn't work for you guys with a good cellular/wifi connection. Many other banking apps do the same, only work when connected with the same IP the country they came from.
[Magisk] pedritopl:
DenyList is disabled of course.

I can't see a word about preinit directory in the installation script output (or am I blind?) :)
[Magisk] xcl1pse:
Even minsdk is 27, only 1 app I test request special strong integrity
[Magisk] osm0sis:
Ah, I was thinking of a Magisk install, which tells you either way. Shamiko just tells you if it can't find it. When it can it shows the "Installing custom sepolicy rules" line. So that's all good, though I'm out of ideas for you. 🫤
[Magisk] blu.italia:
Previously I used 15.4 with no problems. After the update I get the following error:

Magsik 27.0, crDroid 10.1, Xioami Poco X3 NFC, Surya

Play Services now also crashes in several times.
[Magisk] foldax:
On Moto X4 uname -r gives me

4.4.302-perf+

i thought i'll find something like "4.x.x. - lineageos " :?

It doesn't look customized

So i should live version number and replace perf+ ?

On Pixel without any changes i've got:

4.14.261-g9d2fb45d1fc6

already looks random

why?
[Magisk] pedritopl:
Me too... Just wanted to let everybody know, that if You modify Your kernel strings and still can't find a working fingerprint, then it's worth checking without Shamiko. Especially on OP3T and Lineage OS :)
[Magisk] foldax:
When testing PlayIntegrity through Play Store developer options what fingerprint do you see?

On my phones always i've got genuine fingerprint. No matter what is stored in pif.json.

It behaves like PlayIntegrityFix module doesn't work ?
[Magisk] pershoot:
As long as you see DEVICE and BASIC, it is working. It is being spoofed at a more innards layer.
[Magisk] pedritopl:
The spoofed fingerprint is only passed to the gms.unstable process and is used in deciding the integrity verdict. All other apps (including the Play Store) see Your original fingerprint.

So, TL;DR - that's fine and that's how it should be.
[Magisk] foldax:
thanks for info,

still it doesnt work. I've got only BASIC
[Magisk] pershoot:
If your json file is in good working order; if you only have only BASIC, then you would need to find another print, that can be used on your specific device.
[Magisk] Gordietm:
Play services has been crashing for me also. I went back to 15.5.
[Magisk] osm0sis:
FAQ #9

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com
[Magisk] Spartacus500:
Same for me 😔
[Magisk] Zenman85:
After installing the last update, I can pass basic and device test again. Thanks @chiteroman
[Magisk] pedritopl:
FYI - at least on LineageOS for OP3 / OP3T the kernel local version will be modified in the next build (March).

https://review.lineageos.org/c/LineageOS/android_kernel_oneplus_msm8996/+/381870