yashsingh1/xdaforums huggingface dataset:
[Magisk] Vision:
Yeah, is difficult he say for that take it to a service center, because he say this:

View attachment 6083832

I believe after flash custom ROM broke TEE, so the service center 99% can fix this, because it wasn't broken in the first place
[Magisk] scorpion90:
How can I uninstall the apps/modules reported in the photo? Where I can find it?

View attachment 6083833
[Magisk] Vision:
@Hassankarim

I forgot to ask you first, before you flash a custom ROM, with original ROM and locked BL, you had pass 3/3 ?
[Magisk] Vision:
Read this:

How to UNINSTALL XiaomiEuInject updates and BLOCK future ones?

I've been using MIUI.eu since Android 12, always rooted running flawlessly. The previous SafetyNet (xiaomi.eu) solution was perfect! But the current XiaomiEUInject (Play Protect) as I already REPORTED DOES NOT works reliably when rooted (Magisk or Delta + LSPosed). Always to reboot to access to...

xiaomi.eu
[Magisk] Sheist!:
The problem is the messages in the app installation do not provide the PRECISE app names. My solution is to re-install the same module again, and if that does not give a notice that those apps are "not present", then roll back to 15.9.4 and then to 15.9.6 again. This worked.
[Magisk] osm0sis:
Completely uninstall the module, reboot, then install it again, or clean install my fork instead. It's a bunch of false positives from poor development choices, no such issues on my fork.
[Magisk] pndwal:
WAIT!.. Don't rebuild TEE etc....

Most likely ROM you flashed was one that notoriously messed up /persist partition... If you did backup of partitions (may need /persist from your device as contains unique numbers) you can restore, or if device has intact persist.bak... Otherwise, contact the XDA endorsed member with service for Xiaomi Authorised Account (EDL flashing etc)... He'll know much more than me.

Pasting relevant info and links (from help I gave another user) below:

Hope it helps. 🤠 PW
[Magisk] Hassankarim:
Yes
[Magisk] Hassankarim:
Thanks.

I think I have persist and efs backup of stock ROM.
[Magisk] Hassankarim:
After flashing custom everything was good, and i certified custom ROM using play integrity fix.

after flashing MIUI i found a message "Find my device is corrupted" something, so i unlocked BL then flashed extracted persist using fastboot. And i didn't checked CTS etc after flashing these, yesterday I checked it.

Let me restore persist backup. Maybe it'll fix.
[Magisk] Hassankarim:
I don't have persist backup, only efs.
[Magisk] ugene1980:
View attachment 6083913

Check out my weirdo TEE, error code 74

Device is ZTE's Redmagic 8 pro, bootloader unlocked + KernelSU, PIForkv8, ZygiskNext, Shamiko, LSposed: (devopts hide, HMA, DisableFlag Secure, HideMockLocation)

Passing 2/3 with xiaomi print

Wonder if this is the same situation as oneplus devices' broken tee when unlocked or is it permanently lost keys

Have not tried relocking to see if keys come back (as I dont want to re-setup phone after wipe all over again)

Not really bothering with it as only one app fails with it... national ID login zzzz
[Magisk] pndwal:
But that often occurs if registered Google account before spoofing device as I understand it since Google's servers apparently take device identifiers from PI API backend (or GMS sees/uses DroidGuard data, which is essentially the same thing) at least for some devices...

So you messed with/persist yourself!... Shouldn't have done that, especially with no backup!

Anyway, good chance you didn't flash or corrupt /persistbak and that is exists, being an Xiaomi device... Suggest you locate it and use the @Yuki1001 method I linked above to identify blocks belonging to /persistbak and replace /persist blocks with data from these. All best. PW
[Magisk] pndwal:
Could be, especially if you haven't done any TEE mods yourself, but this would be a first for me, and quite alarming being an Android 13 launch-version device... Please turn off all spoofing modules (I'm unfamiliar with some you have loaded) and run Key Attestation app again... You may get more accurate details if you update to 1.6.0 (Play Store is behind GitHub) and check Show all option...

If broken like many OnePlus devices, device should fall back to basic-only attestation without forcing this and Google should have exempted this device from HARDWARE_BACKED evaluationType enforcement based on it's native print/prop set so that it can pass DEVICE_INTEGRITY locked. This means you shouldn't need PIF to have DEVICE_INTEGRITY unlocked either; a solution for sensitive props like @huskydg's sensitive_props module (I'd try v2 to avoid issues with v3's shipping level spoof on Android 13+) as well as hiding root from DroidGuard/attestation process and possibly main GMS process (ie. Google Play Services com.google.android.gms.unstable and com.google.android.gms processes) if this is the case.

Of course, I haven't seen that condition in A13+ devices before so all the above is supposition and untested AFAIK... 🙃 PW
[Magisk] ugene1980:
You are right, I have not done any TEE mods, yup A13 launch device

Have turned off all modules in KSU and run attestation demo 1.6.0 , attached the results below (same error 74)

View attachment 6083935

In this current state (all KSU modules unloaded, BL unlocked), I get only BASIC passing, i.e. only 1/3 passing

Tested: (KSU modules unloaded, BL unlocked) running husky's sensitive props v2 - only BASIC passing

Tested: (KSU modules unloaded, BL unlocked) running husky's sensitive props v3 - only BASIC passing

Very curious to relock and see if TEE works but so so turned-off with having to redo my whole setup and backing-up + restoring apps

Though before BL unlocking, TEE demo runs fine and passing 3/3
[Magisk] osm0sis:
Just for your knowledge, I'm pretty sure the OnePlus 9 Pro still has the "unsupported" message, but shows HARDWARE_BACKED evaluationType until you use a print.

I'll double check tomorrow to be sure, but that's what I remember, and it was my last daily driver and is still my primary PIFork testing device.
[Magisk] pndwal:
That's interesting, thanks... So it doesn't pass when locked/stock? 🤔... Actually, I do recall hearing that some devices can pass STRONG when locked but TEE 'breaks' when unlocked (?)...

Of course OP9pro is a slightly different ballgame, launched with Android 11... ZTE Nubia Redmagic 8 pro launched with Android 13. PW
[Magisk] pndwal:
Could be like OP9pro mentioned above then... Watch for @osm0sis's confirmation...

When you tested with Sensitive Props module, had you added the two GMS processes in in DenyList?... No good if root isn't hidden from DroidGuard/attestation process at least (since PIF isn't running to hide root), and may need root hidden from both (used to be the case with A11+)... Also, try alternatively with Shamiko and with Shamiko and with Shamiko and Sensitive Props both... PW
[Magisk] mumuli:
I follow...

My backup phones 9pro and 9, say both TEE broken, both are A14 now. Only "mods" are magisk root, adaway, integretyfix. OP12 just work fine, with same mods, modules
[Magisk] Vision:
This is good, because the service center can fix it, because it wasn't broken in the first place when you buy it
[Magisk] Vision:
What happens? all the users have broken TEE 🤯
[Magisk] Vision:
If anyone know what is this inside in the TEE_A505F_XXV_ASC8.zip

TEE hacking

Post about hacking TEE on Android devices. I will post here some useful resources: https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices https://github.com/chiteroman/FrameworkPatch And leaked keyboxes...

xdaforums.com
[Magisk] osm0sis:
OnePlus happened 😄
[Magisk] neonblind:
Hm, does not work. I will reflash stock 8 rom and check device integrity after every step. Maybe the way how to get root on this and other sony devices from that era is the culprint now.

[ROOT][Kernel][TWRP] repack of the stock kernel with dm-verity and SONY RIC off

Changelog: V5.23 Fix for Android 6 (Freeze on boot logo) Installation of kcal kernel module for supported kernels. Get the app from https://xdaforums.com/android/software-hacking/dev-kcal-advanced-color-control-t3032080 V5.22 Bug in the vendor...

xdaforums.com
[Magisk] osm0sis:
Yep!

And this is on Lineage 20 with Shamiko.

I won't be relocking to check if it does STRONG, but I'm sure it'll pass DEVICE locked like all the other broken OnePlus devices.
[Magisk] Vision:
Yeah, old method, but still works in older devices.

Have you try the 2 zip file i post ?
[Magisk] mumuli:
View attachment 6084158View attachment 6084159

Edit. 1.6.0 version says Unable to attest keys.

But yeah
[Magisk] osm0sis:
Not sure what your point is, unless you're on locked stock OOS?

Edit: Oh, maybe just the Key Attestation Demo 1.5.0 vs. 1.6.0 message difference, gotcha. 👍
[Magisk] mumuli:
Just weird, thats all. Is there reason why unlock op9pro is broken but op12 not.
[Magisk] osm0sis:
Maybe OnePlus finally got their sh*t together? In that respect anyway... 😛
[Magisk] XRed_CubeX:
Good evening, I would like to ask you a question that might seem obvious but I'm afraid that somehow I can no longer go back, I already have the bootloader unlocked and I would like to reinstall the stock rom and relock the bootloader, if I relock it, I will go back to passing the play integrity basic, device and strong?
[Magisk] Vision:
In most case, yeah this happens, i have test it in my device
[Magisk] XRed_CubeX:
Ok thanks, I think I'll go back to stock, I no longer have the time to keep up with the finicky Google that doesn't allow me to have freedom on my own device.
[Magisk] Vision:
Yeah understand, but be careful, read instructions for flash the stock ROM and not broke TEE, because some users make mistake and broke it, you can read it above and 3-4 pages before
[Magisk] XRed_CubeX:
In the past I reinstalled it but I didn't check play integrity, however I know how to do it, what do you mean by breaking TEE? That is, damage persists?
[Magisk] Vision:
Yeah exactly this with persist partition
[Magisk] XRed_CubeX:
I remember having made a backup before each modding operation so I should be fine, in any case I also have persistbak
[Magisk] Vision:
That is good, always we must have a backup
[Magisk] XRed_CubeX:
Yes, haha, I have done damage in the past with IMEI or something else and I learned which partitions are important to backup, thank goodness I had done the damage with old mediateks that I would never use again
[Magisk] Vision:
Yeah understand, unfortunately first we make mistakes and then we learn
[Magisk] Eula13:
I wonder if we can somehow achieve meets_virtual_integrity using pif? I know it's for emulator(google play games for pc only?), just curious
[Magisk] Vision:
If you mean spoof the emulator like is real device with PIF can't, but i think if you google it can find guide how do this
[Magisk] pndwal:
Generally, just ensure all partitions are returned to stock and all will be fine...

Yeah, issues with integrity verdicts after locking only occur if you've intentionally messed with TEE or you (or some ROMs) have messed with /persist (or /vendor, other?) partition... For some reason Xiaomi Poco devices are overrepresented for messed up /persist after just flashing ROMs. 👀 PW
[Magisk] Vision:
Yeah, i think after flash a custom ROM and after want go back to stock, users who have broke TEE the common is the custom ROM.

Because i have flash several times the stock ROM in my devices with A10, A11, A12 and back like go for 12 to 10 and now to 11 without problems until now, i follow exactly the instructions with Mi flash and i choose flash all and lock and that's it.

I have Poco 😂🤣
[Magisk] pndwal:
Yeah, on Poco it's sometimes custom ROMs but sometimes simply that users downgraded by 2 android versions at once!!, eg A13-->A11 even if upgraded afterwards... Just downgrading again via A12 fixed issue for some.

For Poco users with this issue, (eg. due to downgrading directly from A13 to A11 or similar), see:

https://xdaforums.com/t/could-someone-send-a-dump-of-persist-partition.4535719/post-88227239

and

https://xdaforums.com/t/could-someone-send-a-dump-of-persist-partition.4535719/post-87927853

and if not working, maybe this:

https://xdaforums.com/t/could-someone-send-a-dump-of-persist-partition.4535719/post-88232743

and few posts after...

👀 PW
[Magisk] XRed_CubeX:
I have the same problem :/

P.S: Poco X3 Pro
[Magisk] XRed_CubeX:
P.S: But for now Google Wallet and banking apps don't notice any root or custom rom and I'm on stock rom with locked bootloader that only pass basic
[Magisk] pndwal:
So see my last post above. 🙃 PW
[Magisk] osm0sis:
If anyone with an older device wants to test out PIFork's new "scripts-only" mode, it's live in CI #202. 🤘

Bring back USNF's scripts-only mode for older Android, but better · osm0sis/PlayIntegrityFork@36ce25f

- do scripts-only mode automatically on Android < 8.0 since it doesn't support Zygisk and generally doesn't need a PIF module to pass at all - clean up all unused files in scripts-only m...

github.com

Build: https://github.com/osm0sis/PlayIntegrityFork/actions/runs/8424763751

Edit

: Avoid this build for clean installs for now, since in that case it'll always do scripts-only by mistake. I'll change the manual forced scripts-only mode trigger to fix that for the next CI build, probably tomorrow.
[Magisk] Captain_Throwback:
I'm kind of already doing this, but in my case I'm using APatch but have ZygiskNext disabled. And of course I have no custom.pif.json in the module folder. Is it worth it for me to switch to scripts-only mode instead, or is the effect the same?
[Magisk] osm0sis:
Not sure how KSU/APatch+ZygiskNext handles things, but with Magisk any Zygisk module gets automatically disabled if Zygisk is disabled/unsupported, so scripts-only mode allows it to function in that scenario for devices that might not need Zygisk at all to pass (or for any other things).

Your call if you want to try scripts-only the official way. See the commit message for a way to force enable scripts-only on any device. 👍
[Magisk] Captain_Throwback:
In APatch the module stays enabled and the scripts still run, just the Zygisk stuff gets skipped. So I think I can just leave it as-is and the effect is the same.

But it's good to have this mode available if I ever need it in the future (y)
[Magisk] rom4ster:
Banks have been using websites for years, and with PROPER 2FA rarely have an issue. This is a bid for control, nothing else.
[Magisk] pndwal:
So why quote that 2 months later after mods have cleansed responses to this kind of stuff here several times, appeals have been made to be on topic and even links to appropriate thread's for such a discussion have been given? 🙄 PW
[Magisk] majorfigjam:
If by "PROPER 2FA" you mean a dedicated device such as an RSA token, you'd be right about bank websites rarely having an issue.

But if you mean 2FA through an app on a rooted device, then if device integrity can be spoofed (this is after all the PIF thread), then that 2FA may not be "PROPER" at all. What if someone spoofed your 2FA on their device?

In any event, I suggest you take your discussion about motives to the dedicated thread.

The *real* motives for Google's recent Play Integrity restrictions.

Many of us Android modders have been suffering as a result of Google's "improved" (ha ha!) play integrity restrictions that have appeared in recent months. Given that Google hasn't yet blocked all spoofed fingerprints, there is a lot of...

xdaforums.com
[Magisk] Vision:
Very useful info. I appreciate as always.

Excellent guide
[Magisk] rom4ster:
Common methods include Text, Email, and Authenticator

New sim card tech, especially esims make it unlikely to crack text outright and most ways that do work, will do so rooted or not.

Email is through a browser anyways.

An authenticator app is unlikely to get spoofed as well because they rely on good network communication.

But anyways, I have a big issue.

I am not passing basic integrity

{

"accountDetails": {

"appLicensingVerdict": "UNEVALUATED"

},

"appIntegrity": {

"appRecognitionVerdict": "UNEVALUATED",

"certificateSha256Digest": []

},

"deviceIntegrity": {

"deviceRecognitionVerdict": []

},

"requestDetails": {

"nonce": "azJrczNLZkh4ck8wT0tsdjFLYzhrdFE5RDNZM0xwZHNONEhoTFdzd0djNmxwODBHY2k\u003d",

"requestPackageName": "com.henrikherzig.playintegritychecker",

"timestampMillis": 1711436183381

}

}

I believe something is not right here but i dont know what.
[Magisk] Vision:
Interesting 🤔
[Magisk] majorfigjam:
I assume you read the faq post, so you at least understand what you're trying to do.

But unless you supply more information, such as device, android version , custom kernel, pif version, root method, other modules etc no one is going to be able to help you further.

You might though try checking integrity through playstore, just in case play integrity checker has maxed out for today.
[Magisk] ashish1989:
I am on android 7, can not use this module

Can not install it on android 8 < error is coming
[Magisk] zgfg:
For the matter of fact, my bank had recently stopped supporting the dedicated token device and now for 2FA I MUST use their app on my (rooted) phone

Eg, for all on-line Web shopping, etc, to authorize the payments.

Even if I use their banking Web 'app' on the PC, I can authenticate now only by their mobile app from my phone

I really don't understand why some ppl here (not you) insist on these posts from their narrow perspectives that banking apps can be avoided by using only the Web, etc. They can, but it applies only tor some, not all

Those days are gone, in the States and EU everybody will have to have mobile IDs or Driver license in a couple of years (already introducing in some states in the US). Similar apps are already in use in some EU, far East and Arabian countries

'Root detection' is not a Google's plot, subversion or whatever. It's a MUST have by design/architecture /specifications for those apps

Not to mention once again that 3DSv2 Credit Cards authentication on the mobile phones, also, by the specs, requires the safe aka 'not-rooted' mobile devices

For, all of them, Google's Play Integrity is just an universal/practical method to detect 'root'. Global specifications or particularly the laws (eg, for those mobile ID apps) usually do not prescribe particular 'root detection' method, it's left for the detailed/low level design/specs (LLD) and the certification process for those apps, how would they distinguish the safe vs unsafe ('rooted') mobile devices

But that's like trying to argue with the Flat Earth believers, no matter what kind of proof you present, they will ignore and continue with the pseudoscience conspiracies
[Magisk] majorfigjam:
Agree with all of that, but OT for this thread.
[Magisk] zgfg:
Not really, it's about the need/applications for PIF module (as in the thread title), but anyway
[Magisk] zgfg:
Btw, switch added to my pif-test.sh automation script to call migrate.sh for pre-processing json files - although I'd be happier :-) if I could call the migration script like:

sh migrate.sh -i <input_JSON> -o <output_JSON>

Now all config switches are on top and easy for tuning:

DIR_DEPTH="4" # Increase for crawling deeper than to sub-sub-sub-sub-folders

#MIGRATE_JSON="1" # Enable to pre-process JSON files by migrate.sh script from Osm0sis, migration script must be in the PI Fork module

#TEST_YASNAC="1" # Set undefined or empty to skip testing SN with YASNAC, or else script will first test SN with YASNAC (to speed-up filtering of JSON files)
YASNAC_Y_COORD="1250" # Try with lower y if it fails to automatically kick "Run SafetyNet Check" button in YASNAC
YASNAC_WAIT_VERDICT="8" # SafetyNet verdict usually returns in 3-4seconds, but if you decrease and verdict arrives later, script will miss to read

#TEST_PI="TEST_PICHECK" # Default, for testing PI with Play Integrity API Checker
TEST_PI="TEST_SPIC" # For testing PI with Simple Play Integrity Checker
#TEST_PI="TEST_TBCHECKER" # For testing PI with TB-Checker

X_COORD="500" # Should fit for all YASNAC, SPIC, TB-Checker and PI API Checker
PI_WAIT_VERDICT="10" # Play Integrity verdict usually returns in 5-6 seconds, but if you decrease and verdict arrives later, script will miss to read

SPIC_Y_COORD="1000" # Try with lower y if script fails to automatically kick "Make Play Integrity test" button in SPIC
TBCHECKER_Y_COORD="1900" # Try with lower y if it fails to automatically kick "Check Play Integrity" button in TB-Checker
PICHECK_Y_COORD="1600" # Try with lower y if it fails to automatically kick "Check" button in PI API Checker

#CUSTOM_JSON="/data/adb/pif.json" # For Chiteroman PI Fix module
CUSTOM_JSON="/data/adb/modules/playintegrityfix/custom.pif.json" # For Osm0sis PI Fork module
[Magisk] Vision:
What error exactly ?

Do it manually if other not works
[Magisk] Vision:
Why no Zygisk device spoofing possible ? because and older device like Android 7.1.1 can have Zygisk

Is not necessary in specific part because not have hardware attention and no need for DroidGuard ? and global do the job right?
[Magisk] ashish1989:
It can not install below android 8, the error is I am getting on my android 7. Regarding installing manually, I think I am not capable of doing it.

What to do for my device as it is on A7? I am still trying to figure out.
[Magisk] Vision:
Is simple with your file manager download the https://github.com/osm0sis/PlayIntegrityFork/actions/runs/8424763751

after extract it and copy&paste (except the META-INF and customize.sh) to /data/adb/modules/playintegrityfix/
[Magisk] ashish1989:
But there is no such folder as it only works when previously the module is already installed
[Magisk] Vision:
You create the folder in /data/adb/modules and extract it and copy&paste (except the META-INF and customize.sh) to /data/adb/modules/playintegrityfix/

Must look like this inside

View attachment 6084436
[Magisk] shadowillusion:
MIUI 14 on Android 13, Pi Fix v11 fails Device Integrity (pass Basic Integrity).

On the positive side, it passed Bank App and did not trigger latest v15 NativeTest with "Modified Properties(1)" warning.

To pass Device Integrity, looks like the following props need to be spoofed in MIUI for gms / DroidGuard:

ro.boot.verifiedbootstate orange >> green

ro.boot.vbmeta.device_state unlocked >> locked

ro.boot.flash.locked 0 >> 1
[Magisk] zgfg:
Yeah, true

I have tested now each of those props, eg (in Terminal emulator):

su -c getprop ro.boot.vbmeta.device_state

and all three have the required values for me - and I pass both Device and Basic Integrity

However, when I redefine any of them, like:

su -c resetprop -n ro.boot.vbmeta.device_state orange

then Device Integrity fails. When I set it back:

su -c resetprop -n ro.boot.vbmeta.device_state green

then Device Integrity passes again. The same for the other two

You can redefine them for yourself by putting resetprop -n commands to service.sh (or reuse the service.sh from an older version of the module)

But definitely, it would be the best if module would target their changed only for gms

EDIT:

Sorry, I have tested now on the phone with the latest PIF installed and there is no problem - although reset the props, Basic and Device Integrity still passes, meaning that the module spoofs properly for PI/SN