yashsingh1/xdaforums huggingface dataset:
[Magisk] majorfigjam:
Also worth noting, with regard to longevity, that 14.2 and 14.2.1 both have a print from a Google device that sold (with its non XL equivalent) over 4 million devices up to October 2022, launched with Oreo 8.00 and pushed by none other than Verizon. (Source is Wikipedia, so maybe take that with some caution).

I don't know how many of those 4 million are still in use, but Google will, and I think they may not want to unduly discomfort the Verizon user community with the holiday season upon us.
[Magisk] Compass Linux:
If I'm not mistaken, it won't matter because with a locked bootloader a bunned fingerprint works? :unsure:

Compass.
[Magisk] Compass Linux:
https://github.com/chiteroman/PlayIntegrityFix/releases/tag/DEV-v2

Compass.
[Magisk] badabing2003:
Because for a user it's much easier to fill in missing value or remove the line altogether (if wanted) then remember / realize what fields are missing and not know the exact syntax to add.

It's just a tool that simplifies your process, you don't like it, don't use it or write a better one instead of complaining.
[Magisk] arda99:
and worth noting, all these mean nothing for a real device with locked bl -- because it will pass strong PI.
[Magisk] majorfigjam:
It does, but because the Device can't do Meets_Strong_Integrity due to its age, it only gets 2 out of 3.

Which is what the spoofed prints also get, which is why they work until Google finds a way to discriminate.
[Magisk] majorfigjam:
Old devices don't do strong integrity - or so I understand.

Root certificates​

The trustworthiness of the attestation depends on the root certificate of the chain. Android devices that have passed the testing required to have the Google suite of apps, including Google Play, and which launched with Android 7.0 (API level 24) or higher should use attestation keys signed by the Google Hardware Attestation Root certificate. Note that attestation was not required until Android 8.0 (API level 26). The root public key is as follows:
[Magisk] niko26:
I think the consensus was here that Google probably uses other methods to find out that that finger print is not legit / spoofed. Probably other properties.
[Magisk] arda99:
Strong PI needs TEE, but this isn't sth new with A8. Old device(SOC) is well capable of hardware attestation, it's up to the OEM to implement it or not. And I'm quite sure google got it done.
[Magisk] arda99:
Why some devices FP work? the reason is simple: Google forgets.

I only interest in newer FPs and in my experience, you need to focus on some less popular manufacturers, major/known brands(especially in US) are much less likely to pass.
[Magisk] Tralaltro:
With latest 14.2 module is it necessary/recommened to hide Magisk app or use any other module?

FAQs only say Shamiko is not necessary and you should use deny list
[Magisk] Iridule:
I've noticed where I find API level 30 I can change it to 20 and many times it will cause the print to work.
[Magisk] Iridule:
If you want an extra one I've got 30 prints I'll give you one. Pm me.
[Magisk] HippoMan:
It would be interesting to find out whether different installations of 14.2 are ending up with different default fingerprints, or whether all 14.2 installations come with the same default fingerprint.

Please don't publicly post these fingerprints in order for us to investigate this. Rather, how about 14.2 users who aren't using their own fingerprints just posting their 14.2 default fingerprints' checksums?

Obtained as follows:

adb shell su -c md5sum /data/adb/pif.json
[Magisk] Nergal di Cuthah:
5391428ae767b6ca6e332692ed007804
[Magisk] pndwal:
For S/N and now PI HARDWARE_BACKED evaluationType (for ctsProfileMatch or DEVICE_INTEGRITY unless incapable/bypassed and for STRONG_INTEGRITY always) Google simply mandated compliance for Android 8/Keymaster 3 devices since in Android 8.0, Keymaster 3 had transitioned from the old-style C-structure Hardware Abstraction Layer (HAL) to the C++ HAL interface generated from a definition in the new Hardware Interface Definition Language (HIDL), and additionally Android 8.0 extended Keymaster 2's attestation feature to support ID attestation... ID attestation provides a limited and optional mechanism for strongly attesting to hardware identifiers, such as device serial number, product name, and phone ID (IMEI / MEID).

OEMs therefore couldn't implement this pre Android 8, and many actually messed up their Keymaster implementations and sometimes other components handling AVB chain of trust data in key pairs in a number of Android versions since...

Before Android 6.0, Android already had a simple, hardware-backed crypto services API, provided by versions 0.2 and 0.3 of the Keymaster Hardware Abstraction Layer (HAL), so you are correct that a key pair based attestation was present on Keymaster 0.2 devices, ie. at least on Android 5+ devices, however these iterations were not deemed 'strong' enough for S/N or PI HARDWARE_BACKED evaluationType purposes. 👀 PW
[Magisk] desertcat:
Version 14.2 has been running with basic and device integity passing since I installed it shortly after it was released. The only other module I use is systemless hosts so that I can use Adaway. Magisk is not hidden, Zygisk enabled, Enforce DenyList enabled, and a few apps added to the deny list.
[Magisk] sga999:
Apologies if I'm being dense. 14.2 (or 14.2.1) doesn't create pif.json, does it? I can certainly see some pertinent lines in the logcat. I can create pif.json from those myself, but I might have different spacing or whatever than someone else's, thus resulting in a different checksum. So I'm probably missing something.

Please let me know if 14.2 is creating pif.json for you.
[Magisk] sga999:
My setup is very close to yours, but I don't use systemless hosts module, and Adaway seems to work fine. I've seen the option in Magisk, but I didn't know why I needed it.
[Magisk] HippoMan:
I'm not using 14.2, so I can't answer from personal experience, but I thought I read something from @chiteroman somewhere where he said that 14.2 comes with its own pif.json, but that could be overridden by a custom version.

But perhaps I have that confused with a different PIF release.

PS: And this checksum idea is *only* for comparing any *default* pif.json files that might come with 14.2. Using checksums is a completely useless way to compare custom pif.json files, for the reason that you stated. So only perform this checksum test if you have installed 14.2 and *not* installed any custom pif.json of your own to go with it. If 14.2 doesn't come with a custom pif.json, then the checksum command will fail right away, and we'll then know that it's because no default came with 14.2.
[Magisk] rogers11:
It wasn't a complaint, just a question. Sorry for asking.
[Magisk] sga999:
I think 14.2 has its own hard-coded, but DEV-V1 (or now V2) allows override. But how will everyone create their pif.json exactly like someone else? So I thought you were implying that 14.2 actually created pif.json so we could do the checksum on that. That is not true for me.
[Magisk] HippoMan:
I'm not talking about comparing user-created pif.json files via checksum.

I'm only talking about using that checksum test for comparing hard-coded pif.json files that come with 14.2.

The purpose of that is solely to see whether or not different installations of 14.2 will come with different hard-coded pif.json files.
[Magisk] Iridule:
you can look at the entrypoint.java to find the fp
[Magisk] sga999:
We sure are on different wavelengths! I'm not talking about user-created files. How do we get the hard-coded pif.json file? I thought you were saying the dev put it in data/adb, but he does not, so we can't get if from there. We can see lines in logcat, and we could create one with his hard-coded values, but we won't all do that identically.
[Magisk] HippoMan:
Oh, I see. I mistakenly thought that there was a chance that he might download different pif.json files at the time the module is being installed on each person's device.

I can see from that Java code that this isn't the case, and so the proposed checksum procedure is meaningless.
[Magisk] cloudpeople:
Xiaomi.Eu has a different method, but there are still many banking applications that cannot be opened even though they are non-rooted or rooted with shamiko in the native test application still reads "property modified" or the props have been changed. I don't know what XEU developers are doing by modifying props without root or via zygisk. Some apps detectable even without root.

Can you post this in xeu forum, i cant register account it said rejected because spam-like or automated behavior.

@zgfg @chiteroman

View attachment 6042519
[Magisk] HippoMan:
Well, I see now that the hard-coded value is not installed anywhere under /data/adb. I mistakenly thought that "hard-coded value" meant a hard-coded pif.json file that would get installed under /data/adb.

But I now realize that is not the case, and instead, that the value of the fingerprint is hard-coded in the Java source code itself and not installed as a file anywhere.
[Magisk] sga999:
I don't know about java. Can you describe exactly what to do? I'll respond to @HippoMan in a different post about another checksum possibility.

EDIT: Sorry, this was a reply to Iridule, but I did something wrong.
[Magisk] sga999:
I don't know if anyone is interested in your checksum idea, but I'll say something here. We can see the "FINGERPRINT" line in the logcat display. I'm assuming that is unique for each build. Maybe not, but it still might be useful. You can select what's within quotes. Then you can paste it into some app like:

Checksum Calculator Online - AppDevTools

Calculates the checksum of a file or text and compares against it on your browser without uploading anything. Supports MD5, SHA-1, SHA-224, SHA-256, SHA-512, SHA-384, SHA-3, and RIPEMD160.

appdevtools.com

It allows either a file or a text string, which seems simpler. It computes an MD5 checksum (or 7 other types).

Others may have no interest, but I was just following up on your idea by using a single line rather than a pif.json file.

EDIT: In case anyone wants to compare their MD5 checksum to mine:

d6ef0c9df34c2bf540daf9d361e88091

EDIT2: Since all 14.2.x users should be alike, there's really no reason for anyone to tell me if theirs compares. It was an interesting exercise for me to go through.
[Magisk] fbirraque:
I also noticed that something doesn't working well with xiaomi.eu support for Play Integrity Fix patchs. Doesn't matter if comes from build in (xiaomi.eu), @chiteroman or @osm0sis module

NFC Payments, Play Integrity and SafetyNet certifications passing but almost all Bank apps crashing or detecting root after a few hours later every reboot. But I only tested and confirm this behaviour when rooted (Magisk or Kitsune).

The right place to push for some deeper investigation is on their Site. My suggestion is to create a new Bug thread, to insert some comment in this ongoing discussion or reporting that unstable Bank apps behaviour occurs even when non-rooted in the .EU Dev comment here.
[Magisk] cloudpeople:
How can I post the bug if the account registration was rejected 3x with different emails.
[Magisk] xcl1pse:
14.2 and 14.2.1 only provide fps on their module, can't update or download new fps or even lib. Only 14.1 does. So all people using this version has same fps.
[Magisk] fbirraque:
Create a GMail account that won`t be rejected.

If your country are blocked just install Tor Browser (VPN).

Note: You can check if your country are blocked accessing this link, https://miuipolska.pl/
[Magisk] Nergal di Cuthah:
Are you sure the banks are using PI? Most banks don't or use it in conjunction with other methods. You may need: Shamiko and/or HMA and/or hiding magisk and/or deny list
[Magisk] xcl1pse:
Test with native test v15 and unrooted that device, I want to see the result. The principle Xiaomi EU to patch PIF is patch framework to support native spoofing > adding 1 package support to pool the fps, find playstore droidguard and replace that value in runtime. Maybe it has same principle like EvoX did but, Xiaomi EU already fill the fps value in their app instead manually fill like EvoX did? So if the fps fail, can update that app and replace with new fps.

For banking apps, just ask to Xiaomi EU, IIRC banking apps detecting property modified for spoofing isn't that much and more detecting property modified from magisk etc
[Magisk] zgfg:
Just reorder, eg put MODEL first and PRODUCT second

Or instead of 2 spaces at the beginning use 1, 3 or 4 spaces

Or add a space before or after : or after the comma

Or extra empty line, etc.

Endless combinations just due to different creation/editing of the files

You will still have functionality the same pif.json but the MD5 checksum will be different

Hence no use of that method to distinguish if prints are 'different' or not
[Magisk] cloudpeople:
Unrooted and still same View attachment 6042545
[Magisk] sga999:
I proposed a different method by getting the checksum on just a single line (fingerprint). But I don't think anyone will be interested since they all will be alike. Until they are not!

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] chiteroman:
Try new update.
[Magisk] chiteroman:
Nah, I just removed it because I redo the project from scratch.

You can check again here: https://github.com/chiteroman/PlayIntegrityFix 🙃
[Magisk] quasyl:
I was yet passing device and basic integrity without any add-on in magisk (xiaomi.eu) but wanted to test this last version, the 8.4 after many unsuccessed tryings. This last version works perfectly. Perhaps it's now possible for you to know what in previous versions was breaking the functionality?
[Magisk] zgfg:
👍

:/ # logcat | grep SNFix
08-29 22:45:42.256 12744 12931 I SNFix/Java: Your ROM already spoof device props. If Play Integrity / SafetyNet still failing, contact @chiteroman on XDA
[Magisk] pndwal:
Did you read my linked info. for various devices?... Xiaomi generally retains L1 but new keys may be needed in some cases and MIUI ROMs often include a way to generate new keys...

OnePlus is different, but L1 can often be restored even with unlocked B/L... Seems it is also dependant on PI deviceIntegrity on some OnePlus devices too, which is not the norm for other OEMs... If a bad ROM update etc. breaks widevine keys however, it may be more difficult to restore working L1 on OnePlus than on other devices, but I don't have OnePlus...

👀 PW
[Magisk] zgfg:
Slightly adapted service.sh to provide service.log in the module's folder - for debugging which props were reset
[Magisk] Xennet:
That's it... v8.4 Works perfectly... Now u can proudly tell that ur module does it even on the strangest of xiaomi. eu roms too...
[Magisk] zgfg:
And a logcat from an older Xiaomi.eu that needs the module to pass Device Integrity - also working fine with v1.84
[Magisk] Ginosius:
Yeah, I even installed it on my Nintendo Switch running Switchroot Android 11 and now Netflix shows up in the Play Store !

This brings the switch to a whole new level lol.
[Magisk] chiteroman:
Mmm old xiaomi.eu roms are failing due Google changes in server, xiaomi.eu devs was using "walleye" to spoof device props and get a perfect attestation (Strong ✅).

But due Google patched the bug many of their devices lost Device veredict, thats why first_api_level joins the chat, if you set this prop less than 26 you will force a BASIC attestation, and if you set to +33 or empty you will force a HARDWARE_BACKED attestation. Values between 26 and 33 maybe work but setting this to 25 (Android 7.1) did the trick.
[Magisk] chiteroman:
Lmaoo🤣🤣 well Nintendo Switch uses an arm64 CPU. It will be interesting to try this in a x86 device.
[Magisk] De_Haos:
@chiteroman

Bootloader spoofer doesn't work with Op 11, right? :(
[Magisk] chiteroman:
Check Key Attestation Demo and see if Keystore is broken.
[Magisk] andrey-seo:
Hello, does not pass any verification, tried different modules, does not help. Phone Google pixel 6, android 13. How can the problem be solved?How can the problem be solved?
[Magisk] chiteroman:
You are failing BASIC veredict, DroidGuard is detecting hooking framework like Xposed or smth else. My module umount Magisk in all GMS processes so maybe it's something wrong in your setup.
[Magisk] zgfg:
Provide more details

Custom ROM?

GAPPS?

Permissive mode?

XPrivacyLua installed?

Magisk, which and version?

Does it show Zygisk Yes?

Shamiko installed?

Are you running Riru in parallel with Zygisk?

How is DenyList configured?

Provide details, describe additional, provide screenshots, etc

Based on your description and some other details (eg, first post on XDA), who knows what you have configured and how
[Magisk] andrey-seo:
Thanks for the reply, what are you thinking of trying to do? I deleted the magisk modules - it didn't help
[Magisk] andrey-seo:
Latest Stable official room android 13

Gapps Built into the firmware

Enforcing mode

XPrivacyLua installed? - Yes, it is activated, but I do not use it

Magisk, which and version? - 26.1

Does it show Zygisk Yes - Yes, it shows

Shamiko installed

Are you running Riru in parallel with Zygisk - No

How is DenyList configured?
[Magisk] zgfg:
For the beginning, uninstall third module from the top and reboot
[Magisk] andrey-seo:
I Turned off the module in lsposed "disable secure flags" and reboot , but it's didn't help
[Magisk] xcl1pse:
Lmao now property modified is 2 instead 1. Another reason I choose Custom ROM without spoofing at all
[Magisk] zgfg:
Good for a peer to peer communication, but there are ppl who have mined out several hundredths - a managed repo will be needed to keep track

And G could then just automate checking of hashes of their certified fingerprints against that list and they will know which of them are compromised
[Magisk] Yusef Kifah:
14.2.1, failing. Oneplus Nord running official LOS20
[Magisk] DaviidCou:
Quick question, if I use official miui rom global, and just unlocked bootloader and added magisk, do I still need to Spoof fingerprint?

Isn't fingerprint for custom roms only?

With SPIC I pass basic integrity and match CTS profile.

Can't pass device integrity tho.
[Magisk] mike.s:
Hypocrite.
[Magisk] wugga3:
Did 14.2 work? I assume it did... So may be uninstall 14.2.1 and try 14.2? Just a guess.... OnePlus 7T stock is still ok without the update
[Magisk] Yusef Kifah:
Yes, just tried that. Same thing - failing also. 14.2 /14.2.1 same fingerprint
[Magisk] intel_core_i7:
Another fingerprint banned... Google seems to have slow down the burning rate for a bit, around 2 dies in a week instead of banning one in less than 24 hours
[Magisk] woody4165:
Hi all

Yesterday I installed 14.2 and DEVICE and BASIC integrity were OK without doing anything else, Redmi Note 10 Pro with PixelOS Android 13 and Magisk 2.6.4 hidden with Zygisk, deny list active.

This morning I tried to use Google Wallet to pay and it didn't work even if I haven't got any message in the app

I updated to 14.2.1 but stil same issue.

I don't know if it's a coincidence, but from that moment DEVICE integrity in NOK

I installed now BootloaferSpoofer but I don't know what to do and how to check

Thanks
[Magisk] r00tcracker:
Very stupid question (I think).

I am running version 14.0 with a custom pif.json

Still passing Basic and Device Integirty.

So everything is working properly.

I want to get a few more fingerprints just in case the one that I'm currently using gets banned.

Now the question is, how likely are the chances that if I test new fingerprints with PixelFlasher, and after I'm done, I go back to my original that was working , won't work??

I don't really want to screw up my working fingerprint.

Thanks in advance
[Magisk] Emmes:
it will work again, no worries. i have jumped from several fp back to my first one, still working
[Magisk] simplepinoi177:
In keeping with asking for tips....going off of osm0sis' post/directions, he says usually ones above A8 (so A9 and A10), you'd probably have to change FIRST_API to below 32 or less -- did you find you had to do that for much of those? Like, how much did you have to experiment trial-and-error the FIRST_API_LEVEL to get them working (especially considering you had 19; I'm curious how many of those 19 required a bunch of experimenting)?

Thanks in advanced!
[Magisk] xSnowLeopardx:
Will answer you this when I am home!
[Magisk] simplepinoi177:
Thank you! I very much appreciate it! I look forward to your answer (and seeing if changing & experimenting the FIRST_API is as expected as what osm0sis made it seem and/or how I think it would be...)!
[Magisk] r00tcracker:
Great!! Thank you!
[Magisk] Emmes:
approx 25% of fp with only basic integrity got device integrity after setting Api Level to another (lower) number!
[Magisk] Michaelx9:
14.2 FP banned.
[Magisk] chiteroman:
Google banned v14.2 fingerprint (taimen)

Released v14.3 to fix this:

Release v14.3 · chiteroman/PlayIntegrityFix

BANNED. OUTDATED. DO NOT USE IT.

github.com
[Magisk] simplepinoi177:
how low did you have to usually go? like 2 API levels lower, or more? Just for future reference....

*I'm sure it'll prove helpful to those still searching that are looking in on this thread...
[Magisk] majorfigjam:
From my experience, very unlikely.
[Magisk] woody4165:
Thanks!

Just tried, works fine!
[Magisk] beeshyams:
For me it worked for one print only.. I eventually gave up on searching for prints after collecting a bakers dozen

Edit: one level lower. Tried with multiple levels though
[Magisk] niko26:
Works fine now.
[Magisk] majorfigjam:
Which should encourage others to search non-phone pre-oreo devices for working prints.
[Magisk] BrimoFan123:
"Thank you"

You decided to continue burning fingerprints.

All of us who spend hours to search and test own fingerprints are really "grateful"
[Magisk] zgfg:
You need PIF bcs of unlocked BL and Magisk

And you need to hide Magisk, etc - consider do you need Magisk and unlocked BL if you want to avoid PIF
[Magisk] sawdoctor:
There's an xposed mod with the same fingerprint that you could try

GitHub - rushiranpise/io.github.tehcneko.disablehardwareattestation: Play Integrity bypass

Play Integrity bypass. Contribute to rushiranpise/io.github.tehcneko.disablehardwareattestation development by creating an account on GitHub.

github.com
[Magisk] sawdoctor:
I changed an API level of 30 to 27 and then the fingerprint worked. Not something I know much about but that worked for me
[Magisk] Yusef Kifah:
Thank you, 14.3 fixes 💪🏼 But let's see for how long. We resonate with your module description.
[Magisk] Tralaltro:
Thanks. So I'll not hide Magisk app, because last time I did it stopped working properly.

I presume in DenyList you have google apps and services?
[Magisk] trevtdogg:
for what it's worth, i've been using a stock motorola a11 rom with just the basic up to date magisk only - no shamiko, no deny list, nothing fancy.

have had no problems with using the play integrity fixes for google pay and NFC use, both with chiteroman's module using a shared print and osm0sis's fork using a custom print.
[Magisk] mossywell:
14.3 on a xiaomi.eu ROM, and I have a pif.json

Working fine but I did notice this: when I use Play Store dev to check integrity, I notice that the fingerprint is the xiaomi.eu one not the pif.json. Is this expected behaviour?