yashsingh1/xdaforums huggingface dataset:
[Magisk] zgfg:
Why would he need device spoofing if he has a genuine device that cannot attest on TEE. His device must go for Device Integrity attesting and he only needs standard hiding (at that time it was MagiskHide) plus the 'generic' props that were already covered by USNF

That also gives an insight why 'banned' prints do not affect Play Integrity on those original phones with locked BL and stock ROMs. Prints are valid and they have nothing to hide hence they pass Device Integrity - and Google cannot 'enforce' Strong Integrity since those users will never be able to attest and pass

So back at the square 1. On 'rooted' devices with the spoofed banned prints, Google somehow detects the spoof - despite all the efforts by PIF (-ix or -ork) module, extended json format/props, etc

Therefore alao no needs (nor hopes) in un-banning

---

For those having problems with Microsoft Intune. It's not Google but Microsoft... PI is not enough, but it all depends on the various, complex and differently applied policies by the particular company's administration

Look into the Intune thread here on XDA Some complain that the latest Teams (recently updated version) detects insecure device. And some solved by reverting Teams version - but the company policies may not allow reverting the MS apps versions

Btw, I use both Teams and Outlook (latest versions) but no Intune. I always keep Outlook and Teams in DenyList (I used to have some issues with Teams withiut)

I have never problems. Yesterday I even removed them from DenyList, rebooted the phone, restarted them several times.and I encountered no issues

---

And one more thing (before I go to the background mode again until something interesting, out of the daily routine posts pop up), I'm akin to belive that contactless payments (only) by Wallet may work with just Basic Integrity (but I'm not ready to risk othet things by disabling the PIF for days, waiting and checking)
[Magisk] pndwal:
That's much as I've been saying, but as I acknowledged above I forgot for a moment that USNF print (angler) spoof isn't applied if OS is A7... Of course the native print was used in fact... And I said I'll go back and edit errors when I have a minute... PW
[Magisk] straightcore:
It may not always be true.

Stock ROM :unsure:
[Magisk] ananskom:
it doesn't work anymore, since Yesterday

only me or you too guys?

I have tried many pif.json on internet and prop, but all banned

View attachment 6080704
[Magisk] menuisier3:
Thank you for the answer. I made the mistake of protecting the Message application in Magisk. It works again. Thank you for your work and your responsiveness
[Magisk] Darth Bidder:
I'm confused ever since I had to reinstall LineageOS 18.1 on my phone w/ Magisk, it doesn't pass SafetyNet check anymore. On the Play Store, it just says "Not Certified".

I previously had MagiskHide Props Config to change the fingerprint and the Universal SafetyNet fix by kdragon.

It keeps on failing on the CTS Profile match on YASNAC app but passes on Basic Integrity.

I can't get the MEET_Device_Integrity to work.

I already tried installing the Play Integrity Fix and USNF by Displax but it doesn't work.

My phone is still using the Magisk 25.2.
[Magisk] samhhmobil:
It was written hundreds of times here before.

Google did change from SafetyNet to PlayIntegrity.

USNF will not help anymore.

And even MHPC is completely outdated and not helpful anymore.

The one-and-only way yet is to use PlayIntegrityFix or PlayIntegrityFork and find a working fingerprint.

And... read, read, read backwards in this thread.

samhhmobil
[Magisk] ashish1989:
I am running a custom rom with Android 7
[Magisk] ashish1989:
But that's the main problem, PlayIntegrityFix or PlayIntegrityFork is not available below android 8.0
[Magisk] samhhmobil:
Yes. You're right.

Nevertheless...:

Google(!!!) did change from SafetyNet to PlayIntegrity.

So, if you cannot upgrade your system software (i.e. the ROM), you just only can upgrade your phone hardware.

And... (just my 2¢):

Running security-sensitive-apps (which are forbidden on modded phones by the app-developers) on such historic Android-Versions, which didn't get any system-security-patches since 5 years or more, no no no, that isn't reasonable.

samhhmobil

PS

Sorry, but:

"When you’re riding a dead horse, the best strategy is to get off"
[Magisk] pndwal:
The method I gave may still work if ROM is built with a fingerprint from before March 2018... If it's dated after, you will likely need to spoof security patch to match fingerprint or spoof an older working print... PW
[Magisk] pndwal:
That reply was for another user/situation. (Android 11 device)... PW
[Magisk] pershoot:
Your bootloader is unlocked. You will not get DEVICE without a spoof. You will require Magisk (Zygisk) + PIF / PIF fork + a working thumb / finger print, at the minimum.
[Magisk] pershoot:
Try Shamiko (turn off enforce denylist):

Releases · LSPosed/LSPosed.github.io

Contribute to LSPosed/LSPosed.github.io development by creating an account on GitHub.

github.com
[Magisk] V0latyle:
?

You aren't passing STRONG, my point stands
[Magisk] chiteroman:
Certificate chain banned, same like @shoey63

Which device do you have ?
[Magisk] Vision:
For users ask for Android 7 this 2 version not work ? I remember some of these i had it in my Android 7.1.1.

View attachment 6080743 View attachment 6080744

if not work this 2 in the image try the following.

And this 2 had it, i don't remember exatcly, i have it in backup.

Not flash it, just extract and copy&paste in /data/adb/modules/

Is 2 different mod version first try 1 and if not work try the other
[Magisk] pershoot:
Take note of the first sentence. If you are not passing DEVICE, get it to that state, then leave it be for some hours and observe. If it does not get restored / resurrected, then proceed on starting with 'Take a Google backup'.

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

<edit>

Also, take note of this particular scenario:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] straightcore:
iGET SMART L203
[Magisk] markfm:
I've got the matching MHPC strings for a couple of working (for PIF) prints, including the current working Xiaomi.

(When things first went sideways is when I did my pull-properties.ps1, it generates the MHPC string as part of the output.)
[Magisk] osm0sis:
Ah thanks, I must have misremembered, or a lot of our working ones from MHPC were also in tadi or others so we didn't have them recorded with MHPC as the source.

Edit: Wait... Xiaomi.eu's current griffin print isn't from MHPC, what are you talking about?
[Magisk] straightcore:
If I'm not mistaken, the certificate chain is the same like SMART L203

This is iGET SMART L206 MEETS_STRONG_INTEGRITY will pass

I'm a deer for it :rolleyes: :ROFLMAO:
[Magisk] markfm:
You remembered right.

What I did was pull MHPC off github, spent some time learning the code, experimenting with adding my own fingerprints to it. My script takes a build.prop and generates both V15_PIF and MHPC format outputs from a build.prop.

One of the build.prop I ran it on is the same as xiaomi. It's not in the original github MHPC file.

View attachment 6080776
[Magisk] zgfg:
Thx. In the mean time I had included to use Play Integrity from TB Chwcker when SPIC goes overquota
[Magisk] FrogMaster-:
Would you mind sharing your updates? I was thinking of including a switch to change which Integrity Checker is being used, but haven't gotten around to it. 7AM over here and I think it's about time for bed. Haha
[Magisk] zgfg:
I completely retested all prints from MHPC at the beg of March, testing with every fingerprint for many devices that had fingerprints from more than a single ROM (OTA) version, testing also by lowering API value to 25, but none of all together 743 JSON prints that I tested passed Device Integrity

(Before the Feb 29, I had about 70 prints working from the same set)

C# source included I used to create the JSON files

1.13 MB file on MEGA

mega.nz
[Magisk] osm0sis:
Curious where you found that griffin print Xiaomi.eu is using; was it from the Moto factory image page? Or do you mean you just added it once they started using it?

Thank you for corroborating! 🙌
[Magisk] zgfg:
Here comes the function that tests PI with TB- Checker. Compatible with my original script, to be plugged-in instead of

test_spic()

Btw, I posted around the beginning of March about that automated testing with TB-Checker

Spoiler content hidden.

Btw, I had a newer version of the pif-test.sh script on GitHub (from the NY 2024), but still without TB-Checker

Etc/pif-test.sh at 01eb87469130f15d186b06528f42620d06ad8242 · zgfg/Etc

Et cetera. Contribute to zgfg/Etc development by creating an account on GitHub.

github.com

PS

File on MEGA

mega.nz
[Magisk] markfm:
View attachment 6080822

The Motorola print came from firmware center, though there's a nice set in another site's obsoleted area.

The partial screenshot is from the /common/prints.sh in my own copy of MHPC. I've been doing a couple of small updates to it, but the prints.sh file can be dropped directly into the github copy of MHPC and used.

(I purposely clipped the shot, so the actual models and fingerprints aren't visible. It presently contains a couple of prints that are valid currently.)
[Magisk] chiteroman:
So fingerprint is partially banned 👍
[Magisk] Bladius:
why has there been no auto update option for your module for some time now?
[Magisk] kkjb:
Please read a few of the previous pages in posts on this thread. Your answer will become clear. I don't know what the fault is here, my obstinate attitude or just that as a reader of this very informative thread and it's valuable insight into literally a important part of development. A little bit of time searching and reading isn't too much to ask. People here are not ¬¬ [circle to search]
[Magisk] FrogMaster-:
For anyone that's curious after pulling all the build.prop files I could locate on Tadi, then processing them into PIF Fork V8's format. The majority of prints pass Basic, but I wasn't able to locate a single one that passed Device. Tested 981 different fingerprints without success.
[Magisk] Nergal di Cuthah:
Yup that lines up with it being (mostly?) burned
[Magisk] FrogMaster-:
Completely burned according to my testing. I processed every single firmware from Tadi that had a build.prop, system build.prop, vendor build.prop or product build.prop file into a use able PIF Fork V8 JSON format.

Not a single one of them was able to pass device.
[Magisk] osm0sis:
Not entirely burned, but almost... From our testing there should be around 30 left there, maybe more if they overlapped with other dump sources. Needle in a haystack, as I've been saying... 🫤
[Magisk] FrogMaster-:
Hmm. Perhaps I need to look over my script that processes the build.prop files then. I tested everything my script processed and didn't find anything that successfully passed Device.

I know the automated testing is working as I tested Xiaomi's current print and it was flagged correctly by my tests as passing Device.
[Magisk] Jirachilover:
It's best just to use xiaomi's prints since it will be inevitably be banned because of the company itself using it across a tonne of devices and they will also be actively finding new ones that will also be banned. The other prints that people are coming up with are just showing google more things to ban
[Magisk] intel_core_i7:
One note though: xiaomi.eu is a miui/hyperos modding team and is unaffiliated with xiaomi. They are just a team of developers, not a company. Their ROMs are pretty much built with a dedicated script these days, so as a result of good mass scripting techniques, those guys probably created a script behind the scenes to very quickly scan the whole internet for an unbanned one.
[Magisk] MPK99:
Damn. Today, Amazon's app update kicked me out of my account.

View attachment 6081101

Couldn't even screenshot caz the app restricts them too lmfao. Now I will dig into this pif rabbit hole. Bless me guys.
[Magisk] ykjae:
Why not use disable flag secure lsposed app or magisk module? I screenshot Amazon all the time. I did not even know Amazon had a problem with integrity.
[Magisk] MPK99:
Same here. It used to work until I updated it through Aurora Store yesterday. I'm not even sure if it's Integrity issue. The error as you saw says "The specific device could not be authenticated. Please try again (8)".

I can't seem to spoof to any device.

I'm on ponces GSI btw. Could be totally my setup issue.

Anyone with GSI here have these issues ?
[Magisk] InsaneNutter:
Its good to know that some prints still work for now. I wonder what's so special about the Motorola device most of us are now using the print for?

Perhaps that device is still has a significant user base certain parts of the world? or the person revoking prints is simply on holiday?

I guess realistically long term a lot of us are going to need to get a device we're happy using the stock rom on that has guaranteed updates. It would be nice if Google let established roms, like LineageOS for example, gain certification if the rom project wanted to.
[Magisk] sawdoctor:
It's probably nothing to do with the device but the actual firmware itself. From what I've been reading through the thread it seems to be the fingerprint from firmware releases that are more obscure. Perhaps the actual firmware the print was taken from wasn't widely shared on the internet. Remember the Moto device we are using will have dozens of different prints on the same firmware version
[Magisk] mrjuniork:
FYI:

Any further discussion about all the TEE and strong integrity stuff is to be continued in this thread.

@chiteroman Thx for setting it up 👍🏻
[Magisk] markfm:
The attached are for people wanting to merge Motorola sparse chunks from factory firmware into a usable system.img file, to extract build.prop

I use this with a Ubuntu WSL installation on my Windows PC. It's a slightly modified version of the original found at: https://gist.github.com/erfanoabdi/7ff14d614f4919fee5159fccd7885370
[Magisk] chiteroman:
Released v15.9.5 !

Release v15.9.5 · chiteroman/PlayIntegrityFix

Strip libraries and reduce their size. Fix attestation not passing on some devices. Do not auto remove conflict apps, users should remove them manually.

github.com
[Magisk] Moscha:
@chiteroman

Update Form15.9.4 to 15.9.5 breaks Funcionality on my Pixel 6a (Latest Stock ROM with Magisk, using Pixelflasher and Xiaomi PIF). No Basic or Device Integrity passend.

Downgrade to 15.9.4 and everything works again (Basic and Device Integrity)
[Magisk] miho171:
Same issue, down to 15.9.4 to make it work again, but with nomore working fp, I just stay with the one the module provides it.
[Magisk] Sheist!:
I downgraded back to 15.9.4. The update fails repeatedly Basic and Device. The json recreation is always the same contents.

And how do I uninstall these module apps that are not visible in the tray?

- You are using custom fingerprint!

- If you fail DEVICE verdict, remove /data/adb/pif.json file

- If pif.json file doesn't exist, module will use default one

- EliteDevelopmentModule app found! You should uninstall it manually!

- XInjectModule app found! You should uninstall it manually!

- XiaomiEUInject app found! You should uninstall it manually!

- XiaomiEUInject-Stub app found! You should uninstall it manually!

- hentaiLewdbSVTDummy app found! You should uninstall it manually!

- PifPrebuilt app found! You should uninstall it manually!
[Magisk] osm0sis:
You can't have all of those on the same ROM, so clearly something remains quite buggy. Feel free to try my fork where I've got all the ROM app stuff well worked out.
[Magisk] Sheist!:
Same issue on my other phone. Downgraded back to 15.9.4. Passes Basic and Device again.

- Installing Play_Integrity_Fix-v15.9.4(15940).zip

- Removing conflict apps...

- EliteDevelopmentModule app doesn't exist, skip

- XInjectModule app doesn't exist, skip

- XiaomiEUInject app doesn't exist, skip

- XiaomiEUInject-Stub app doesn't exist, skip

- hentaiLewdbSVTDummy app doesn't exist, skip

- PifPrebuilt app doesn't exist, skip

- Done
[Magisk] Clasimodo:
Same here on Samsung S23 Ultra
[Magisk] anthonnyb98:
Is it still necessary to have a custom pif to use your fork or does it already include it?
[Magisk] osm0sis:
Doesn't include it, but it's easy to get the Xiaomi.eu one (which is what chit includes) by using my autopif.sh, until you have the desire/time to try to look for your own. It's linked under Resources in my Fork's README.
[Magisk] anthonnyb98:
Okay, I don't know if this question has been asked before, but could you give me a brief explanation of how your branch differs from that of chiteroman?
[Magisk] osm0sis:
I've answered that many times. You can read

through my README and Releases page changelogs for the broad strokes of the features differences, and/or go follow the links in the PI Fork blurb in my Odds and Ends thread OPs for more background/context for my decision to fork.
[Magisk] anthonnyb98:
I have already read it, thanks for answering and sorry for the question.
[Magisk] trance89:
Same here, LOS20. Downgraded to 15.9.4 and removed google play /services/framework data now it's ok
[Magisk] aimless0079:
Nearly panicked 15.9.5 breaks it, 15.9.4 still working again lineageos 20 Alioth
[Magisk] menuisier3:
Hello, since the update this morning, I no longer have access to the RCS chat or to the France Identity app, despite caching in Magisk.

thank you for helping me
[Magisk] woodpe:
Go back to 15.9.4
[Magisk] chiteroman:
v15.9.6 released to fix that issue, should pass BASIC now.

Release v15.9.6 · chiteroman/PlayIntegrityFix

Fix BASIC verdict not passing.

github.com
[Magisk] Clasimodo:
Works for me now. I pass basic and device as in 15.9.4. Thanks
[Magisk] matfcb:
Xiaomi Mi 9 Pro 5G Android 11. Play Integrity Fix 15.9.6. I passed both Basic, Device.
[Magisk] menuisier3:
Hello again,

There you have it, with the latest version 15.9.6, RCS chat is working again, the only one that isn't working is France Identity. Hopefully the next update will be good for this app.

Thank you for your superb work!
[Magisk] chiteroman:
If I'm not wrong, that app checks for unlocked bootloader.
[Magisk] BesoC:
Passed BASIC, DEVICE. Wallet opens without warning. However in the Tap to pay setup there is still a message 'Phone doesn't meet security requirements'. Cleared Wallet data and killed GMS, but the message remains. What can I do further?
[Magisk] markfm:
@chiteroman - v15.9.6 appears to be functioning okay, just need to clean up the coding in the installer where it's now declaring false positives for modules the user should disable or remove.

(Everything you check for is now declared as being there, even when they aren't, with the user warned to remove them.)
[Magisk] markfm:
I don't know if this is what you're running into, but there's a note I have relative to Wallet use:

Adding Cards Back to Wallet

-Delete the cards via https://pay.google.com, then

-Open Wallet - Add to Wallet - payment card - Add credit or debit card - enter card details

-Back to pay.google.com - turn on the Virtual card option for cards that offer it

(I run into this when I've had cards already in my Google Pay set, then at some point had to do a force stop/clear data on Wallet - cards may show at the bottom of the Wallet main window, but you need to remove them, then re-add, cannot simply try to select them for active use in Wallet.)
[Magisk] markfm:
Windows Powershell 7 script to extract the fields in a build.prop and generate a properly-formed pif.json: https://github.com/markfm62/Pull_Properties

I make liberal use of comments, explaining what is going on in it.
[Magisk] sturmii:
The module does not work with Xiaomi 13T Pro, there is an infinite loop with YASNAC without anything happening. And Google apps crash or freeze.

Can anyone help with want to use Google Wallet on rooted xiaomi 13t pro.

Root with magisk Delta, as my banking apps detect root with the normal magisk. But not with Delta.

I have unlocked bootloader.
[Magisk] chiteroman:
Are you running latest version? Did you tried any other version?

Maybe they are detecting Zygisk.
[Magisk] mac796:
I don't think yasnac is working anymore. Needs updated I think
[Magisk] sturmii:
I use PlayIntegrityFix_v9.9.zip & Magisk Delta v26.1

other version of playintegrityfix?
[Magisk] Stillhard:
If you're using ZygiskNext, the problem lies on it, nothing's wrong with Pl Fix

Edit:

Recent unreleased patch from 5ec1cff's pull seems able to fix it
[Magisk] chiteroman:
I tried ZygiskNext in KernelSU and I didn't have problems with v9.9
[Magisk] mac796:
I don't believe I'm using zygsk next. Not sure what that is?
[Magisk] sturmii:
When I use PlayIntegrityFix_v9.9.zip with magisk Delta, all Google apps crash or freeze. I can't even open the Playstore. How to fix it?
[Magisk] chiteroman:
Are you using global unmount ?
[Magisk] sturmii:
I don't even know what that is. I set everything up according to how-to instructions. root and install magisk Delta
[Magisk] skvalex:
Here's some feedback on Pixel 8 (UD1A.230803.041) rooted with KernelSU (v0.7.0) and installed modules:

- ZygiskNext: v4-0.7.1 (89-release) - newer versions don't work with systemless hosts module

- Shamiko: v0.7.4 (188)

- Zygisk - LSPosed: v1.9.2 (7029)

- Play Integrity Fix: v9.9

- systemless hosts KernelSU module: v1.1.1

Though, sometimes I have an issue with passing "CTS profile match". It usually happens after reboot. For example, I install Play Integrity Fix through KernelSU, reboot and "CTS profile match" passes with no issues. But if I reboot, then it fails. To fix it, I have to reinstall Play Integrity Fix module again and after reboot it passes. But sometimes I need to reinstall the module several times in a row until it passes the check again.
[Magisk] chiteroman:
For all people who v9.9 didn't work well, check v10 prerelease build: https://github.com/chiteroman/PlayIntegrityFix/releases/tag/v10

In this build Shadowhook is used for ARM and Dobby for x86.
[Magisk] skvalex:
Works for my setup. Though, the issue with "CTS profile match" not passing is still there, but it seems like it happens less frequently, than before.

After installing this version, I made 4 reboots. After one of a reboot the SafetyNet didn't pass. I rebooted again and the test passed.
[Magisk] chrbur:
Has anybody problems with wificall??
[Magisk] chiteroman:
Interesting... Is this problem present using safetynet-fix of kdrag0n or Displax ?
[Magisk] chiteroman:
Do you have problems with it ?
[Magisk] skvalex:
Just checked the module by Displax and "CTS profile match" didn't pass at all
[Magisk] chrbur:
Not with Pixel 7 Pro but with Pixel 7. WiFiCalling doesent Work
[Magisk] CiLiBi18:
Wow it finally works on my OnePlus 11!!! Thanks @chiteroman
[Magisk] DougMG:
Sorry to go off topic but I have been unable to get KernelSU to work on my Pixel 6 Pro. I have downloaded the boot image that matches my kernel version and flashed it however all I get is a bootlloop until I reflash the stock boot image. I have been following the install instructions on the KernelSU website but apparently I am not doing it correctly and am unable to figure out my mistake. Any help would be apppreciated. Again sorry to go off topic but even after doing searches for the solution there seems to be very little discussion about KernelSU.
[Magisk] BesoC:
Thanks for the answer. Followed your instructions, result is the same:

DEVICE and BASIC are green in Play Integrity API checker

Wallet opens without error message

Tap to pay setup - 'Phone does not meet security requirements'.
[Magisk] CZ.Kostra:
If you don't necessarily need GWallet, give it time. It will fix itself if you have device in PI.

Otherwise, you need to delete the data in Google Play services. But that will delete your cards in GWallet.