yashsingh1/xdaforums huggingface dataset:
[Magisk] Johnn78:
With USNF KDragon, I pass only basic integrity, with UNSF Displax I don't pass any test while with Play Integrity I pass basic & device integrity but NOT the Strong & Virtual Integrity. How can I pass in these tests ?
[Magisk] chiteroman:
You can't.
[Magisk] Johnn78:
Ok. In other tests which has the TB Checker (Root Check & Xposed Check), I failed in "Root management apps" in Root Check & in "TWRP", "com.topjohnwu.magisk" of PM Convertional/Sundry APIs and of PM Intent Queries and all Xposed Modules in Xposed Check. Does it exist any fix about them or any fix for some of them ?
[Magisk] zgfg:
I told you that the point is to install the module that will let you pass Basic and Device Integrity

If you want/need to pass Strong Integrity, you MUST flash back your stock/official firmware and relock the Bootloader

Please read through the thread before asking questions that have been answered (many times)
[Magisk] FredMontteiro:
Hi bro,

It was very good to know about your module. The Uber Driver app has been saying my device is not authenticated for days. I did everything to solve it, I even went back to the Stock Rom with bootloader locked and, believe me, it still didn't solve it. My device ia Xiaomi Mi A3.

So I re-rooted the device to use your module, after installing the module the Uber app was all unstable, Play Store also unstable, Chrome as well.

This instability also occurred with the Displax module. It made me think that these modules don't handle stock rom well. What do you say?
[Magisk] chiteroman:
Very strange, I don't know why, I'm using Poco X3 Pro global stock rom and everything is working well.
[Magisk] quasyl:
I installed the latest version of this module and when I run the integrity test I observe a strange behavior: one time all 3 fail, next time the first two pass and the third one fails. Repeating the test I obtain again the same results, once yes and once no. I do not know what to think. My bank app works fine, I don't use Google Pay. Some suggestions?
[Magisk] anthonnyb98:
@chiteroman Is there any possibility that you will develop a version for riru?
[Magisk] chiteroman:
Updated V7.2

Changelog:

- first_api_level now is always modified to bypass Device integrity in some devices
[Magisk] chiteroman:
Try again with new update.

No, Riru is obsolete. Why use Riru instead Zygisk ?
[Magisk] anthonnyb98:
I use riru with husky loaded, it's much less detectable than zygisk. I had to resort to module 1.3 of displax.
[Magisk] quasyl:
Thank you for your hard work!

I just tried the latest but unfortunately it now gives triple fails. Even previous version gives now constantly triple fails: Google also is working hard!

Edit: I added "Google services framework" in the deny list, restarted the phone and remade the integrity test. Now I have again the previous situation: "one time all 3 fail, next time the first two pass and the third one fails. Repeating the test I obtain again the same results, once yes and once no"

Edit: I modified the deny list reducing the number of applications, I cleared data in Play Store and in Play services, I cleared art and cache in recovery and now I obtain device and basic integrity.

Thank you for this hard work!
[Magisk] sawdoctor:
Do you mind me asking what device you have as the same thing has started happening to me on the pixel fold.

All my banking apps and Google wallet are still working but i keep getting 3 red crosses (3 fails) but if I reboot I'll pass device and basic again. Interesting enough even when im failing all 3 on P I checker Google play store still shows the device as certified
[Magisk] quasyl:
My phone is a Poco X5 pro (Redwood). Running xiaomi.eu 14.03. Play Store is no more certified. My banking app works normally. Testing integrity I have alternatively, without restarting, once 3 fails and the next time basic and device integrity green (strong is red).

Edit: Play Store is now certified after I cancelled data and restart.

I had a lot of app in the deny list and wanted to remove a lot of them. Now it seems that finally basic and device integrity are now green! I hope to maintain this result!

Perhaps the contents of this "deny list" is partially responsible of bad results?
[Magisk] idyllc:
Samsung Galaxy S23 Ultra Play Store still stops at 7.3
[Magisk] idyllc:
The Samsung Galaxy S23 Ultra play store stopped after 7.1, and also in 7.2, the play protection mechanism certification shows that the device has not passed the certification, but the installation and download shows that it has passed the certification
[Magisk] dlads:
Love your enthusiasm to continue fixing this, I've been updating for some time now, really appreciate your work.

With the latest change I'm failing.. can see I'm not alone here..

Does anyone have any ideas?
[Magisk] TotallyAnxious:
Looks like you didn't enable root in Mixplorer settings.
[Magisk] zgfg:
Obviously, those that Google have 'banned' do no more work

Hence "all" will not work. And we don't know what Google was doing and how many they have already 'banned'

(Although, I still don't know how they 'ban', specially by not affecting their real owners/users)
[Magisk] V0latyle:
Or....they improve PI to the point where it can natively detect mismatches

They could have this entire time but haven't. Why would they now?

I have written a comprehensive post here:

[INFO] Play Integrity API - replacement for SafetyNet

THIS IS NOT A SUPPORT THREAD. For questions and support regarding how to fix your Play Integrity verdicts, see the Play Integrity Fix thread. ⚠️BEFORE YOU ASK A QUESTION, READ THIS POST AND THE FAQ!⚠️ ****Update 12/11/23**** Google has been...

xdaforums.com

No

PI is independent of Play Store. Play Store actually depends on PI to some degree if I'm not mistaken

I don't think this will get you anywhere. We don't know what apps use Play Integrity. Google's certainly do (Wallet and GPay at least) but third party app developers often use third party solutions

So, you'd essentially be complaining that you can't use Google's own apps outside of their prescribed security environment

it's either /data/adb or /data/data/adb

This

I understand we all want a turnkey solution, but the problem is every time someone releases one, Google defeats it in short order. So the only semi-safe way to do it for now is use this module WITHOUT a bundled print, and instead supply our own. Yeah it's inconvenient and tedious but it's either this or clean flash back to stock and lock your bootloader.

No profanity on XDA, please.

I will say that my handle is the same across many forums and platforms...But, I still won't sell to you. And it's not just because I don't know you - it's because I believe people like you who don't know how would benefit from learning how.

The information is here.

@badabing2003 made it stupid easy with Pixel Flasher; all you have to do is find the build.prop of your choice, and process it with Pixel Flasher to generate the pif.json

Once again that guide is here

You can find build.prop in any device firmware. Regardless of how it's packaged, it'll be there, usually in /system

Not true

We can complain all we want but what is at stake here is NOT the ability to unlock and modify our phones, but only using security sensitive apps like Google Pay/Wallet on unlocked/modified devices.

The only thing that makes Pixels different from everything else is that they essentially run the vanilla Android experience, and for the most part they follow the prototypical AOSP model. No phone will allow you to lock the bootloader on a custom ROM, and no phone will pass Play Integrity if the bootloader is unlocked.

You have to supply your own print now. Please read the last 5 pages

Bro...You can do it yourself. You just want an easy solution.
[Magisk] V0latyle:
My guess is they're checking for mismatches between the print that GMS sees, and the print in global props

If they start implementing these checks on every device, we'll all be screwed.
[Magisk] iakoboss7:
Thank you for answering.

edited: yeah you are right, such a silly mistake >.<

thank you again!
[Magisk] arda99:
Think it another way, most new fingerprints are not working from beginning....does this affect real users?
[Magisk] TotallyAnxious:
There's an option in Mixplorer settings to enable root access. It can still view root folder without it. But you won't see adb folder until you enable it. Once you enable that in all settings, the app will request root access and then you'll be able to see adb. This is a safety feature to keep people unaware of the dangers of root access, but still root their device, from doing something they shouldn't unless they manually enable root access on the app. It would also allow you to pass your phone to your child or someone with no knowledge of root, and pretend them from being able to do something that requires root in the app and could brick the phone. Some file explorers don't do this though.

Root folder ≠ Root access
[Magisk] machuidel:
I rooted the original stock firmware (OxygenOS 13.1) that was already installed on my phone (One Plus 11) so I think that means I must have the original fingerprint somewhere (probably now non-destructively overwritten using a bind mount). What should I do? Disable the SafetyNet Fix? Temporarily disable it to get my original fingerprint, then enable it again and change the prop file?

Edit: Ah it has to be an old device, but not too old. I guess my HTC Dream / G1 and One Plus One are too old then :D

Edit 2: Unbelievable. Why can't I decide myself if I want my phone to be rooted to use a banking app. Times have really changed. Android used all be about being open (like Google used to be). I really want to have full control over the hardware I use.
[Magisk] zgfg:
I know that there were today like 10 new pages if not more

But 2 days ago I answered and described on the similar Q - actually nothing new, many know here very well and there were similar posts and discussions

I also put to the answer the link to the official G documentation - and the same was also present in earlier posts

So, if you could scroll back (maybe 15 pages back, IDK), maybe you find it

But mining for that in this thread is now probably like mining for bitcoins = working pif.jsons
[Magisk] dlads:
So have to supply your own print..

Oky doky.. will have a look... Definitely not something I've had to do before and yes a "install this and you're good" solution would be great but we've had it easy for a while now.

I'm about to read it all now, but in short do I need to grab a phone that works (not rooted) then grab the required JSON file from it then merge to my phone? If so I've got a non rooted s20Fe.
[Magisk] Hitorijanae:
It has to be an old device, one that launched with Android 8 and got updated to 9. After 9, it moved to hardware-backed attestation, so you can't use those props.
[Magisk] Gersp52366:
happened :)
[Magisk] Gilg@mesh:
would Galaxy S8 that launched with Android 7 and got 9 upgrade work? or S9 that launched with 8 and got 10?
[Magisk] Hitorijanae:
Yeah those should probably work fine
[Magisk] Claus….:
Nope, nothing about easy solutions or learning. About time, we need this. Can you help us? I can brief you on a video call.
[Magisk] Nergal di Cuthah:
Spy

Just incase there's a language barrier, that was a joke
[Magisk] downhere:
Reminds me of attempts of the community to setup a dual-boot device a few years ago... But I guess you'll have to modify the bootloader itself... so... going in circles.
[Magisk] Lu5ck:
It is about the chain of trust. ATM, most phone doesn't allow avb_custom_key but many google phones can and some oneplus phones too. It is literally a matter of time when Play Integrity API being used on more and more apps. All other phones users are doomed!
[Magisk] i5lee8bit:
Could have been halfway there by now if you used the time to research and learn, that you instead used to complain... Just saying.
[Magisk] Nergal di Cuthah:
A little dramatic, but i see what you're driving at
[Magisk] Immortalis:
Hello, I have a question to those who got it working - what's your environment configuration?

Nothing Phone 2, NOS 2.0.4 - on PIF 13.9 I had Magisk 26.4 with Zygisk enabled, Shamiko and GMS process added to DenyList, both main and unstable and Wallet. Is that correct?

I have a feeling that even though I tried several different prints, but none of them worked. Is that configuration correct or I'm just unlucky?

In logcat I can see that prints are applied every time I save them via Pixel Flasher. I suppose that it boils down to saving a print then going to Play Store and checking integrity there? Is killing unstable process enough?
[Magisk] arda99:
you can lock bl with custom keys, but this will report as selfsigned by hardware attestation... so it wouldn't defeat strong PI.
[Magisk] gloops100:
In the pif.json ,do we need to fill all lines , or only the Fingerprint ?
[Magisk] simo2001:
I have a question. Because I don't have an old device I'm trying with old firmware version from different manufacturer. I have these file.

View attachment 6039158

Do you know if I can extract the build.prop from these? If so how?

(I'm on Ubuntu 22)
[Magisk] kevinwu128:
Is it possible to get fingerprints from another samsung model. Example: i have an s20fe, my wife has s10e but not rooted, if i extract her fingerprints, will it have issues on my phone?
[Magisk] downhere:
Sorry, but I don't think so. I'm not going to compromise the hard work of all the contributors here nor myself.

You'll have to help yourself in this situation for the benefit of the whole project. And in the end it's your own advantage as that will increase the chance of a longer lasting solution before Google closes that door.
[Magisk] M4KiF:
Yep, today I've decided, that I am sticking to my wallet again as long as It doesn't start to bother me again and I am going away from modded phones. Fighting with banking apps, gpay just got to the point where It is too much effort.
[Magisk] dmenezes:
Thanks for the tip. I thought com.google.android.gms.unstable would not be running because I had just force-stopped it.

And in fact the `killalll` returned an error message to that effect:

`com.google.android.gms.unstable: no process found`

Any more ideas?
[Magisk] V0latyle:
I don't think you understand.

I would rather you (and everyone else here) learn how to do this on your own. Teaching to me is more valuable than doing the work myself and selling it.

I will not share the props I use, period.

I understand this is frustrating to people who are used to having a ready made module to flash, but as I explained before, Google has quickly defeated every fix we've had that's included a print.

When one of us has time, we might write a more comprehensive guide, but getting a build.prop is not difficult at all, and PixelFlasher will process it for you to get the fields you need.

Still doesn't matter because as far as we know, PI will not work with a user set root of trust, and because PI defaults to hardware backed attestation, a Pixel running GrapheneOS (for example) with a locked bootloader will fail all 3 Play Integrity labels.

Stock latest firmware on a fifth generation Pixel here.

Magisk 26.4

PIF 14.0 with custom print

Nothing added to DenyList besides third party apps. Adding GMS to DenyList actually results in DEVICE_INTEGRITY fail
[Magisk] sawdoctor:
I'm in the exact same boat on the pixel fold running qpr2 beta 1.1. I've tried 4 different fingerprints which I'm sure should work and checked they are being saved to the pif.json file but none will pass device. I've had this issue with most of the json fixes. The last one that worked for me was @chiteroman modded safetynet fix.
[Magisk] pomzoña:
I guess that switching to ksu isn't going to help anyway?
[Magisk] Immortalis:
Whoops, maybe that's why I was getting only basic_integrity, I will try again, thanks
[Magisk] zgfg:
No. That is totally wrong judgement

New fingerprints cannot work for spoofing BCS new devices must have TEE and MUST be attessted for Strong Integrity

But Strong Integrity fails on the modded phone (you cannot cheat TEE), hence you will never pass Strong Integrity with those new fingerprints on any modded phone (not on that phone itself norr on any other phone where you use its spoofed prints)

Once Strong Integrity fails, Play Integrity does not attempt to test Device Integrity, hence PI fails (you get at best Basic Integrity)

But that does not affect real users of those phones - if they didn't mod their phones

If they did mod, then they can not pass PI and they have to use this module and spoofs from some old, not yet 'banned' phone to be able to avoid Strong attestation, so that they could cheat and pass Device but with the spoofed prints

Please before quoting, take time to study how PI works and specially the basics how this module spoofing works and why

Otherwise no point of discussing (and sorry, I will no more read/answer)
[Magisk] V0latyle:
Well, since PI defaults to hardware backed attestation for everything, a custom root of trust would fail all 3

All of them except FIRST_API_LEVEL, sometimes this works when blank

Extract system.img using 7zip

Look for build.prop in /system

Shouldn't

Feed a man a fish, teach a man to fish, or let him learn how to fish on with lots of not so subtle hints
[Magisk] V0latyle:
Nope
[Magisk] arda99:
that's normal, just the unstable process is not running, you can either

1. run logcat...from console and start checking PI on phone.

2. checking PI on phone once, and run killall ... logcat... and check PI again.
[Magisk] V0latyle:
Just another thought on the sharing of prints...

Assuming that Google is defeating these by checking for mismatch, DO NOT share your print even if it doesn't work or stops working for you. It might still work for someone on a different phone, but if you share it, they'll know what prints to target.
[Magisk] HippoMan:
My idea is two different devices in the same case, with two different boot loaders. Each boots up separately.

They just share the screen and the buttons, and a hardware switch changes the screen and buttons to use one or the other device.
[Magisk] i5lee8bit:
There's also for many of us an alternative solution we forget about. For smartwatch wearers whose watches have tap to pay. It's been mentioned before, I'm pretty sure 🙂. And I doubt that even most phone modders are rooting their watches...

The events of these last few weeks are what's finally gonna push me to set up tap to pay from my Garmin Fenix 7X... I have this nice fancy watch, but still haven't ever set up tap to pay yet. But it's on my list 😂
[Magisk] Claus….:
Sorry, I do not understand. Not asking to share yours, or to expose. I need something that can last years, not weeks. I need the expertise.

And sadly asap.
[Magisk] HippoMan:
Even if you find a print via some sort of internet search of boot props, once you start using it, it's now targetable in the same way.
[Magisk] HippoMan:
I think the market for used stock Android 8 devices is going to pick up now.
[Magisk] dmenezes:
I haven't used anything under the "google" folder.

And I just tested with another manufacturer's ROM that met the exact conditions you stated: was originally released with an older Android (FIRST_API_LEVEL=25) and then was upgraded to Oreo. I used the system and vendor build.prop files from that upgraded ROM, but the result was the same.

> Note some have had some success with them by adjusting first API level up/down by one/some however. Hence all that being alluded to in my guide.

I tried changing it to 26 and 27, always with the same result.

To top it off, SPIC is now returning the TOO_MANY_REQUESTS error, so I tried with the Integrity Check option under Developer options in Play Store, and noticed the build fingerprint, brand, device and model are all for my ACTUAL device (ie, not the fake one I put in pif.json). But I'm pretty sure pif.json is in effect because `logcat | grep PIF` shows it returning the ro.build.version.security_patch and ro.product.first_api_level that I have configured in pif.json.

So, what gives?
[Magisk] Claus….:
Please qoute my complain if it is there or help if you can.
[Magisk] mates21:
All I need to do is find the appropriate fingerprint and add parameters to the pif.json version 14 file and then include the entire ZIP in magisk? what is this about copying the file to/from data/adb/pif.json?
[Magisk] Claus….:
Ok. How long do you think that this solution might last? Your best guess?
[Magisk] PikeNote:
Normal behavior, I have a working set of prints that passes device integrity in which the Google one also shows my actual device. Just a behavior of how the values are spoofed by the module to only DroidGuard/PI.

Edit: You just have to keep trying. Keep in mind some fingerprints are also not working due to Google banning them. I don't think it is known 100% how Google is combating it/exact requirements for a pass.
[Magisk] kevinwu128:
When you say i shouldn't use my wife's fingerprints, is it because it's a risk for hers to be banned? Or is it because it's the wrong model. You mentioned to use pixel flasher, so if i use that, will i need to set all the fields as Google? Or i can just use all my samsung fields except for the extracted fingerprint?
[Magisk] downhere:
Hmmmmm... the step of having two separate real devices for two different purposes isn't that big any more then. And probably cheaper for the investment while the maintenance is almost the same.
[Magisk] Nezorflame:
The only process reading your props which is talking to the PI is the DroidGuard, all the other apps read your actual device info, so this is normal.
[Magisk] PikeNote:
It just won't work as far as I am aware (device is too new and forces hardware attestation). When you set the fields in Pixel Flasher, fill in the Samsung fields. Nothing should be Google related unless you are spoofing a Google device (which all of them don't work anymore for fingerprint spoofing as far as I am aware).
[Magisk] HippoMan:
This enhanced integrity checking on the part of the Googlefrinchians is probably the last straw for me.

Unless there is some sort of miracle that results in reliable integrity spoofing or in Android changing direction, I now hope to be saying goodbye to Android in the foreseeable future.

I certainly don't want iOS, and I think I'm now going to begin to experiment with devices that run a version of Linux.

I know that the currently available linux-based devices are not running at a high functionality level, but most of what they offer would probably be sufficient for me. There are a few apps that I' probably have to come up with workarounds for, but I think I might be able to do so. I'm not into games or watching videos on my device, and I don't need more than a mimimally functional camera. And I don't use contactless payment.

And, of course, linux devices could run root.
[Magisk] Nergal di Cuthah:
All of us want solutions that will last years. But right now google is focused on this project and has very smart people/AI workingon it as fast as it can be produced. Just because someone has a working print:

A) doesn't mean it will last years, months, weeks or even days.

B) doesn't mean it will work on your device...and if it does it'll be faster, with more than one running it, for it to be squashed. At least while android actively pursues this project.
[Magisk] HippoMan:
Yes, but I'm willing to pay extra for two devices in one case with shared screen and buttons.

Of course, I don't expect anything like this to actually become available in the real world any time soon.
[Magisk] Nezorflame:
One thing that has been working for me is the smart watch (Google Pixel Watch in my case) with working GPay. Been using that all day since the phone stopped working.
[Magisk] Claus….:
Okay, sounds as Google will win no matter what.
[Magisk] Hitorijanae:
Pretty much, I mean they've had us in a chokehold for a long time already anyway. At any point in time they could just switch to using strong integrity, which they likely will, and then all these conversations are moot.