yashsingh1/xdaforums huggingface dataset:
[Magisk] Thebear j koss:
You can disable signature verification but never seen spoofing. And disabling is only done in a limited time frame now as it breaks too much stuff when enabled fully, from my limited comprehension.
[Magisk] ThePrinceofBirds:
TB checker (and other checkers) always show my phone's build fingerprint and not the fingerprint I'm spoofing.

T
[Magisk] TheRomRooster:
I've read alot of reports about how sailfish is supposedly RCS banned but it's not for me. Pixel 7 Pro with Kitsune Magisk (and later switched to APatch and still works) + osm0sis latest module and default google messages app
[Magisk] 306bobby:
Idk, I've attempted the apatch root method, it was not a guarantee for me. Couldn't get it to work at all on lineage 21 stock on a Pixel 7a and it's about 70% for everything else
[Magisk] markdewet:
I'm sorry, but NOWHERE did EVER say I REFUSE to read anything, please do NOT put words in my mouth. That is neither appreciated or warranted.

I what I say offends you, so be it. I cannot help that I do not have as technical a mind as yourself, but there is no need to be rude or to falsely accuse somebody of doing something they are not doing.

Not to worry, I will no longer request ANY more information from this thread or forum,I will simply read.

I will say thank you to all those that chose to actually assist me. I am done.
[Magisk] 306bobby:
That's how all the checkers work. Only droid guard is spoofed, so the spoofing only happens when PI is called
[Magisk] 306bobby:
People are taking things too personal here, and not just the guy being quoted ... 😴
[Magisk] Mitezuss:
i am not asking about that

i am asking about the Rom Signed (to pass Basic/Device integrity) (is not the same)

@osm0sis

can u implement that spoof on youe PIF?

(to pass bassic/device with rom with testkey)
[Magisk] osm0sis:
It's been talked about before, and I don't think that's something we can spoof. I have already tried simply replacing otacerts.zip and that's definitely not what's being checked by DroidGuard.

If someone running a testkey ROM, only failing DEVICE integrity because of that, and with a kernel Linux version higher than 5.2, could provide a full stackplz output from the command below after a reboot maybe we could see for certain if there are any calls to intercept in there.

./stackplz -n com.google.android.gms -s all | grep $(pidof com.google.android.gms.unstable) > /sdcard/stackplz.log

Latest stackplz Actions build available here: https://github.com/SeeFlowerX/stackplz/actions/runs/9076310573
[Magisk] Thebear j koss:
That is exactly what I'm talking about. Signature verification. If your ROM is signed with private keys, you can't install updates unless signatures match. You can disable verification to do certain things like upgrade apps, downgrade apps, signature mismatched updates, and other things, but spoofing or disabling signature verification breaks many other things.
[Magisk] ThePrinceofBirds:
Thanks for the confirmation. I figured it was like that but didn't want to say it factually in case I was wrong.
[Magisk] ThePrinceofBirds:
I wasn't able to get RCS to work with sailfish on pixel 7 with any of the methods (mostly involving patch) that I saw here.
[Magisk] majorfigjam:
Are you able to send and receive messages as RCS, or are you relying on the RCS status of "Connected"?

My Pixel showed Connected, but wouldn't send or receive as RCS.
[Magisk] Mitezuss:
stop....

i am not talking about signature verification. That is Android/framework side...to bypass the check of Apk...

do u know what is the otacerts?

anyway, osmosis replied me...

i will try to get that when have time
[Magisk] Mitezuss:
@osm0sis

did u tried replace (or spoof) the file:

/system/etc/selinux/plat_mac_permissions.xml

? (android 11+)

there is the sign key
[Magisk] denzel09:
Probably stupid questions but guys i read over 100 pages here and i am TOTALLY confused. My brain is completely down now.

I have a Pixel 4 XL. Stock rom, rooted with magisk and chiteroman module. Only Device and Basic integrity. Wallet works, RCS not.

What i need to do to have RCS working? How can i make a working private fp in an easy way?

I don't want change magisk with apatch or similar because google could in future break also this for what i read and change all only for RCS is not a viable solution for me now.

About Strong integrity, how to have a working keybox?

I ask these "stupid" things because you all write and write and write but DON'T write working easy solutions and all seems a private thing here.

Thanks for possible help...
[Magisk] majorfigjam:
Follow the very clear hints given in recent days to identify a donor device (I don't know if that one still works, but likely it does) and source the rom, follow Osm0sis's very clear guide on how to create a pif.json from it, and then use it.

If using a 7zip and shell scripts are beyond your definition of easy, then there's no easy way.
[Magisk] TotallyAnxious:
You can get a working print in less than 30 minutes. Use osmosis generate with the build.props it asks for renamed as the script requests. Google provides a working prop as discussed recently. Or use one of the dump websites.

If your brain is "down", then now isn't the time to try.

You'll need to find a leaked keybox. You'll likely be scouring the Internet or paying for it.

But it doesn't matter. RCS will eventually ban more prints. It's happened already. You should be prepared to lock your bootloader to get strong and RCS working long term. I'm just waiting for the Pixel 9 Pro before I stop rooting.

The only other hope is a dev is secretly working on something that'll fix this. But Google will likely patch that fix.
[Magisk] Mitezuss:
about "keybox", on PlayIntegrityFix said: "Google fixed the bug, no more Strong pass with SW keybox"

so, keep working or not ? (the keybox to pass STRONG ?)

can share some "dump websites" ? (or how search)
[Magisk] passionicon:
Rcs doesn't work because your fingerprints (sailfish i assume) is banned for Rcs.

To get a working fp, search dumpsites like "tadiphone" and extract,then test, maybe you might be lucky but i warn you, most of us have tried and a few have tried harder and gotten some. Folks keep it private because the more the users,the higher the chance of google banning the fp and it can be stressful and frustrating finding new ones. As well as keybox you gotta find it.

Regarding the specific steps on how to find, folks here are frustrated because people have asked this same question 6,544,556.44 times already and devs have posted links to pages that highlight these steps. Just read a few pages back or goto pg. 1.

Summary is goto any or all dump/rom sites of your choice,go after unpopular devices or models and check for build.prop files in system,vendor,products. All 3 are different folders. In most cases the system build.prop is enough but if you find in all 3 or 2 or just 1(system) grab the build.prop and use pixel flasher software to convert to finished product as json file and test. For better understanding, search for the steps as I'm a complete noob myself.

P.s pls don't pay for fp in private😌
[Magisk] TotallyAnxious:
Google android dump firmware website. First page. I shouldn't have to explain how to use a search engine. This a website for tech enthusiasts. Or use the print Google themselves are providing as recently discussed.

I won't discuss keybox stuff. It's already been discussed in depth.
[Magisk] pndwal:
Even on a custom ROM the built fingerprint can work if the security patch date is properly matched to the print. BUT:

Your device fingerprint will only work if Google don't enforce HARDWARE_BACKED evaluationType using that print.

Basically, they enforce for devices they've confirmed have Keymaster 3+ hardware key attestation working when locked, so devices launched with Android 8+ with the exception of devices with broken OEM Keymaster implementations and other devices they presumably haven't confirmed to have working HKA...

Strangely, exemptions currently include OnePlus devices that appear to have working HKA and that meet STRONG_INTEGRITY when locked (perhaps it's not consistent enough?) but for which unlocking breaks the attestation... Many other A8+ LV devices with HKA broken whether locked (only meets DEVICE_INTEGRITY) or not are naturally exempted too.

🤠 PW
[Magisk] majorfigjam:
Just a random thought ... when looking for images to source prints on certain sites, make sure you're looking at English language pages!
[Magisk] Neontc:
What is the quickest way to check if a fingerprint is not banned from rcs?
[Magisk] osm0sis:
Cool find, but we don't want to break the actual ROM in the process, and I'm certain changing that would.

Only the mass-used public print is banned currently (sailfish), and probably the older one from the last test ban (griffin).

If you can find anything else that passes DEVICE integrity you'll be fine.
[Magisk] Neontc:
After I installed a fingerprint and rebooted I only pass basic but all my RCS conversations came back!
[Magisk] denzel09:
It's not completely true. I am using a working json sent to me from a Friend here but RCS in my only case doesnt' work, on Pixel4XL and this passes ok Basic and Device but not RCS. Yes, RCS is working on my friends phones with the same json.
[Magisk] passionicon:
maybe it's sailfish
[Magisk] osm0sis:
Well, using an otherwise banned print for RCS is another matter of debate, yeah.

That's curious. Wonder if there's something else going on in your case. 😯
[Magisk] denzel09:
I don't know what else I could try, I tried more or less everything in pm with the help of this friend here.

I have a simple Pixel4XL with stock rom, kirisakura kernel from @Freak07, magisk with some modules and lsposed.

Obviously tried with both Pif modules from you and chiteroman.
[Magisk] Nergal di Cuthah:
What modules of lsposed

Nobody Can help if you don't tell us which and whether your friend has the same lsposed and magisk modules (all the same)
[Magisk] pershoot:
🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

Take note of the change I made for RCS to function w./ contactless (against my own device) and give it a go, if you have a known working print.

Note: my API level may differ from yours (I have a newer phone), so you 'may' also need to look in to that, if a no go, at first.
[Magisk] denzel09:
lsposed: don't kill and luckypatcher;

magisk: a module from the kernel, anti bootloop, Google Dialer Features, Google Photos Unlimeted backup, JamesDSP manager, builtin Busybox, Play Integrity Fork, SQlite, Universal GMS Doze, Wireguard command line tools, Zygisk-LSposed v.19.3 mod (7244).
[Magisk] Nergal di Cuthah:
99% sure if you remove lp (which is basically warez) you'll be in better sorts to pass rcs. Really there are a lot of suspects for why in your list. I'd start by at least disabling/uninstalling any your working friend doesnt have. Then work backwards from there.
[Magisk] denzel09:
Seems i am in this situation:

Magisk w./ a FP (spoofed via PIF) that is not banned for RCS purposes and allows for a DEVICE verdict:

RCS is non-functional; Contactless / Wallet is functional

You mean that i should try APatch?
[Magisk] pershoot:
Yes and use LSPosed mod by mywalkb (latest is in the Apatch thread).
[Magisk] majorfigjam:
Assuming your pif print is good, then I suspect at very least that the dsp module and dialer features will be interfering with RCS.

Try disabling all modules, retest, and then reenable selectively.

My otherwise stock 4A is fine with a nonSailfish print.
[Magisk] AnyNameYouWish:
Displax's safetynet fix basicintegrity was also failing.

I really wonder why it stopped working with no reason. between th moment it worked and the one it stopped working, I didn't update or install anything on my phone :unsure:

Anyway, no more XPrivacyLua for me for the moment. I can pass all integrity checks and use my banking / wallet apps and that's all that matters.

Huge thanks to all of you for the support!
[Magisk] zgfg:
And just one more comment

By removing/disabling XLua you pass SN/PI (if there are no other reasons to break)

But some files remain and they are detectable by (banking) apps seeking for 'root'. You need to read XLua GitHub page, FAQ section to find what must be manually deleted

Probably you were already advised about - I didn't read yet the whole conversation
[Magisk] pndwal:
Good for you... But why were we going in circles?... Didn't you ask and I said others needed to remove Xprivacylua?... Did you just put it back after you got passed deviceIntegrity?... 🤔 🤷‍♂️ PW
[Magisk] AnyNameYouWish:
I followed @pndwal instructions to remove data/system/xlua (I finally found that folder) and now Applist Detector says I'm XPrivacyLua free :)
[Magisk] pndwal:
Yup:

https://xdaforums.com/t/module-play-integrity-fix.4607985/post-88798091

... Bit of a wild goose chase. 🤷‍♂️ PW
[Magisk] pndwal:
3 Benefits of Alzheimer's:

1) - You always make new friends,

2) - You get satisfaction fixing the same issue every few minutes,

3) - ... Wait, what's 3?....

Oh, it's gone...

Oh wait... I remember now... You always make new friends! 😋 😜 PW
[Magisk] chiteroman:
I think it's possible to pass Strong for your device but that Android version is too old and and maintaining such an old version would mean more work that I don't think is worth it, almost nobody uses those versions nowadays.
[Magisk] zgfg:
Doctor says: "I have bad news. You have Cancer and Alzheimer."​

Patient says: "Well, at least I don't have cancer"

I got pulled over by a cop with alzheimer’s.​

He said, “Do you know why I pulled you over?”
[Magisk] pndwal:
Selinux permissive was already mentioned by a user, and may be your biggest clue...

It's surprising you get passing PI basicIntegrity with that... Usually fails, but could be different for older devices...

Publishing a permissive ROM is generally irresponsible (Security Linux enhancements all disabled) and indicates a half-baked ROM with serious issues... Permissive is only for ROM development/testing (allows many functions to work before compatible with security requirements), and these builds should not be released publicly.

This also indicates that there are likely issues with device integrity signals/functions (ie, a security feature also) that simply haven't been addressed as Dev was just focusing on making ROM/functions work... In other words you may never get proper attestations working with that...

Best I can suggest is to find a responsible Security Linux enforcing ROM for your device and likely then everything will work as expected... 🙃 PW

Edit:

This one looks ok:

https://xdaforums.com/t/rom-11-lineageos-18-1-go-for-galaxy-grand-prime.4246293/post-84647067

Nb. it does spoof props for SafetyNet (so might possibly have compatibility issues with USNF; I prefer a spoof free ROM for use with Magisk personally) but worth trying (and wow, what a jump! 7 --> 11!)...
[Magisk] V0latyle:
Heisenberg, Schrödinger, and Ohm are in a car...
[Magisk] AnyNameYouWish:
No idea why but this solution worked for me. Maybe because I fully removed XPrivacyLua and then tested the solution...

Anyway, just wanted to keep you updated, you can go back joking about Alzheimer, I enjoy reading those ;)
[Magisk] pndwal:
Do you mean removing Play Services from denylist fixed, or that using DenyList Unmount module allows integrity verdicts to pass with Xprivacylua (or other)?...

FWIW, DenyList Unmount is proper hiding, like Shamiko but with only basic hiding functions (and open source alternative)... Denylist of course is denying, not designed for hiding...

View attachment 5963489

😋 PW
[Magisk] AnyNameYouWish:
The DenyList Unmount part. I already removed all google apps from denylist following some of the firsts help I got here
[Magisk] pndwal:
Think curiosity killed the cat but I'm uncertain... Still, thought someone might move to resist...

View attachment 5963495

🙂 PW

one cannot assign exact simultaneous values to the position and momentum of a physical system.
[Magisk] Fif_:
I mean do NOT add Google Play Services to ANY LSPosed module's scope.

I prefer using the open source DenyList Unmount to Shamiko since it's enough to hide LSPosed.

The way to use DenyList Unmount is exactly the same as Shamiko: enable the module, enable Zygisk, disable Enforce DenyList and only add to the deny list apps that detect Magisk. You do not need to add Play Store nor Play Services to the DenyList.
[Magisk] pndwal:
So

🤔 PW
[Magisk] pndwal:
Yup... Works (like Shamiko) as it's proper hiding, not Magisk/root modification reversion.

FYI, some add gms to denylist (in hidelist mode w/ Shamiko) when using font modules which break system UI... It's double root hiding (USNF, PIF hides root from GMS itself of course), but Shamiko's (v7+) font compatibility fix works (allows system to access to module font files again and doesn't crash)...

This is also benefit of an @ipdev commit (for USNF) preventing removal of GMS from denylist on reboot where Denylist is not enforced... It's doubtful DenyList Unmount module would integrate the Shamiko font fix(?)... Yet. 🙂 PW
[Magisk] metafaniel:
Thanks, I've followed the advice you gave me, to no avail... I'm still unable to pass MEETS_DEVICE_INTEGRITY.

I've installed MagiskHidePropsConf v6.1.2 before and I saw it just didn't change anything (is deprecated after all) using Official Magisk, so I uninstalled it before posting here. I reinstalled it following your advice now with Magisk Delta but nothing changed.

I've also installed Magisk Process Monitor Tool v2.2 and AppDataIsolation Legacy Support v1.2 as suggested, but I see no difference.

I see I'm not able to change SELinux to enforcing. I've attempted

# setenforce 1

command on a privileged terminal using su, but using getenforce I always get Permissive. I even installed SELinuxModeChanger as advised elsewhere in XDA, but it remains Permissive... 🤷‍♂️

Yup, it's really old I know (I'd really need to save some money to buy me a new device!). I'm not even trying to pass MEETS_STRONG_INTEGRITY, I just want to pass MEETS_DEVICE_INTEGRITY to be able to use my bank app. I used to pass device and basic integrity with this ROM before, but one day it failed both 🙇‍♂️

Well, that's pretty... honest, yeah!

Until today I find I'm not even able to set SELinux to enforcing as described before, so I'm sure you have a point 🤔

About the ROM you shared with me, I'll give it a try (I have my full TWRP backup for my present ROM anyway, so I won't lose anything!)

About the jump... Well, this device had Android 5.1 😲So I don't expect that much... From 5 to 11???? 😵‍💫 Will it go as fast as a snail? haha. I'll give it a try later.

EDIT: Oh, the ROM is for G530FZ (gprimeltexx) only and I've got G531H (grandprimeve)... But well, your message is: use another ROM. I'll try another one I guess :rolleyes:
[Magisk] pndwal:
Some permissive ROMs won't even boot with enforcing, others will but stuff invariably breaks... selinux switch is generally used to switch properly enforcing ROMs to permissive (to test apps etc), not the other way round... ROMs are only released permissive because running with security enhancements is untested or still broken... That's why they're irresponsible to publish and risky for users as there may be many security vulnerabilities and protections are turned off...

Permissive ROMs are relatively uncommonly offered now... You can usually assume se enforcing if nothing about selinux is mentioned...

All the LOS builds I saw were unofficial but that doesn't mean they're not good... I use an excellent unofficial ROM on Xiaomi Mi Pad 4... For your device I saw several LOS 'Go' builds... These reduce overheads on low memory / older devices... Go will likely be a good bet if device is slow or has only 1GB ram or less...

🤠 PW
[Magisk] NICKCHEESE:
For what its's worth to anyone - this worked on my phone.

Xperia 1 III
[Magisk] chiteroman:
Don't use PIF in xiaomi.eu roms
[Magisk] Catfriend1:
Hmm okay, it worked before. Can you please point me to another fix that works there?
[Magisk] HippoMan:
To those of you who are reading this admonishment for the first time, PLEASE (!!!) try to make it a habit to always read the OP (1st post) of threads like this before jumping in and reporting issues or asking questions. And if you know others who haven't come here before but who want to ask a question or raise an issue, please advise those other people to read the OP before posting, as well.

In addition, please read the last few days of messages in the thread before posting queries or issues.

Thank you very much.
[Magisk] chiteroman:
For me it's working lol
[Magisk] aygul12345:
What else to use then?
[Magisk] DanGLES3:
Wait for Xiaomi.eu to push a build with the fix for your device
[Magisk] HippoMan:
This issue has been discussed during the past few days of messages in this thread.
[Magisk] aygul12345:
Check, so on the xiaomi.eu release wait for them push a new build.
[Magisk] zgfg:
If you have Xiaomi.eu 14 Stable - update the ROM, there are new versions provided yesterday:

- without root, ROM passes Device and Basic

- with Magisk, just use Shamiko, don't use PIF, USNF or MHPC, and you will pass Device and Basic and Wallet will work
[Magisk] aygul12345:
Check ✅ thanks for this!

Please put this info on the first post.
[Magisk] Reynald0:
Solved by reflashing LineageOS, module 12.3 worked fine on other 3 devices at first try.
[Magisk] digger16309:
It is in big bold underlined type.
[Magisk] cangurob:
@chiteroman

Here is my kernelsu log.

Running kernelsu with zygisknext and 12.3 PIF - still won't pass device integrity.
[Magisk] pndwal:
Not at all... I've been encouraging you to persist and 'crack' your issue...

But I don't understand why you said "If you search on the web nobody was able to use MARRIOTT BONVOY with Magisk" knowing that at least two of us here have it working with Magisk, and now several more... like you didn't believe it...

Yup...

Well seems it's confirmed that it's not the TJW Zygisk being detected as several seem to have Bonvoy working with that. PW
[Magisk] Catfriend1:
Sorry to insist, but I have now solved the basic only problem on xiaomi 13 with xiaomi eu firmware.

The fix was:

- upgrade from weekly to stable 14.0.31.0

- downgrading PIF to 8.7 (without it I do not pass anything)

- kept Shamimo 0.7.4 as before the upgrade, magisk too

So PIF is required from my perspective as a user. Whyever that is.
[Magisk] pershoot:
I needed to re-install it (observed in the last update cycle as well), otherwise I would get hangs after FP unlocking.
[Magisk] Mattski:
With the modded SafetyNet Module now failing CTS, this Play Integrity Fix module fixed my issues. Thank you!
[Magisk] DanGLES3:
Probably because Play Services is not on the Denylist, which will cause Basic and Device integrity to fail unless you use a module that triggers the Denylist unmount on it even when it's not on the Denylist (like Play Integrity Fix)

Just adding Play services (GMS and gms.unstable) to the denylist should fix it without the module in your case if Xiaomi.eu already does the keystore and device spoofing to Play Services
[Magisk] pndwal:
Wouldn't try to change your mind on that... What you said was:

I said they haven't been, and arguably should have been much more aggressive with device security and integrity attestations...

Nah... I've pointed out their deceits even in that post... Still, I think the truth shouldn't be taken for granted, including the fact that Google is the custodian of the only relevant mod-able mobile OS we have, not modders enemy even if they must perform a balancing act with device security... If they weren't to do that, Android would cease to be the viable mobile platform that it is for all the reasons I've given...

🙃 PW

A ponkle:

You can please some of the people some of the time but you can never please all of the people all of the time...