yashsingh1/xdaforums huggingface dataset:
[Magisk] Vision:
Yeah unfortunately

Look this maybe you interesting.

TEE hacking

Post about hacking TEE on Android devices. I will post here some useful resources: https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices https://github.com/chiteroman/FrameworkPatch And leaked keyboxes...

xdaforums.com
[Magisk] osm0sis:
I've said many times it only worked Android 7-9 on my OnePlus 5, and stopped working with Android 10. Running version matters. Stop confusing people.
[Magisk] zgfg:
Like save a print before injecting and revert a minute after. Ever print that was injected. Native code knows which prints it injects
[Magisk] Vision:
About script-only-mode, very useful with the frameworkpatch method via module on A11.

Read this https://xdaforums.com/t/module-framework-patcher-go.4674536/page-10

EDIT: About add it in Denylist the GMS.unstable, in Kitsune Mask can't add it auto, because I think say add to Denylist and not in MagiskHide.
[Magisk] pndwal:
You know you wrote:

... That's what the user was referring to, and I had already pointed out nicely why that's misleading and confusing for your benefit:

... I simply told the member here what is actually relevant...

So sorry, but your statement is confusing/misleading. Mine may have overlooked your finding that the mode breaks with A10 on OnePlus 5 but is otherwise entirely accurate.

Your Op5 launched with 7.1.1 so of course it can work; it only has Keymaster Hal v2!... If it had launched with 8+ it COULD NOT work with ANY ROM (incl. A8, 9) unless OEM Keymaster implementation is broken (which is actually likely in the case of OnePlus, but unlikely for most brands).

I missed/forgot that it fails with A10 on your OP5, and that may well go for other devices too, so I've edited my statement as indicated... It could be that there are new suspicious props set w/ A10 I guess, or something other to do with conversion from legacy ramdisk to 2SI boot type etc(?)...

However the main criteria for ability to get ctsProfileMatch or DEVICE_INTEGRITY with scripts-only mode (ie. w/o Zygisk based fallback to basic and targeted spoofs for HARDWARE_BACKED evaluationType enforcement bypassing) is whether or not device has an effective Keymaster 3+ implementation (which won't have changed without some very special retrofit for TEE OS which I don't think has ever occurred), so as I said, "Launch version is key; running version isn't." 👍 PW
[Magisk] pndwal:
I've lost touch with Kitsune's unique configuration, but the unstable (DroidGuard) process should be added in denylist for hiding purposes even if list is simply hijacked for hidelist mode modules like Shamiko... These with also provide better root trace hiding than DenyList as they're actually designed for hiding root...

Similarly, whatever device is used in Kitsune for hiding root should be configured for the GSM unstable (DroidGuard) process whether it works in denylist or (preferred) hidelist mode. But you may have to correct settings manually if the correct list isn't recognised automatically of course. 🙂 PW
[Magisk] Vision:
Yeah, the Kitsune Mask have Magiskhide and not Denylist, and with script-only-mode by @osm0sis and frameworkpatch method via module on A11, we have the desired results.

Just when install the script-only-mode the GMS.unstable not add it auto in Kitsune Mask.
[Magisk] osm0sis:
Yeah, but, anyone Android <10 on a stock or stock-like ROM *can* try it and it *may* work, and I don't need to include a convoluted wall of text for people to wade through when it's easier for them just to try and find out. 🙄
[Magisk] pndwal:
Well since message service is clearly obtaining DroidGuard attestation data for the purpose of allowing RCS, thats effectively what the post is about and what official USNF and 3 iterations of @Displax USNF-mod fork did do as implemented in the "Dynamically patch build fingerprint in GMS process" commit. It would "unpatch" props/fields for spoofing seconds after an attestation call caused PIF to spoof fake props/fields in the GMS DroidGuard process...

Unfortunately @Displax had already disabled that function before @chiteroman forked his v2.4.0-MOD_2.0 USNF build for PIF... 🙃 PW
[Magisk] pndwal:
Sure, but they could equally *try* A10+ as long as device was launched pre A8, and that *will* have better odds than any device launched w/ A8+ unless having "broken TEE"!

But why let them bother testing those that can't work when you can just say:

"Script-only mode is just for devices launched with A7 or earlier + others with "broken TEE" (ie. bad OEM Keymaster) like many OnePlus devices. We've also noticed that It doesn't currently work with A10+ on at least some devices."

... Hardly more convoluted that what you wrote, accurate and no longer misleading/confusing. 🤷 PW
[Magisk] Vision:
Kitsune Mask and with script-only-mode by @osm0sis and frameworkpatch method via module on A11, we have the desired results.

Just add GMS.unstable to MagiskHide.

Read this: https://xdaforums.com/t/module-framework-patcher-go.4674536/page-10
[Magisk] trevtdogg:
but the framework is spoofing a print for droid guard (eg. sailfish), and script only mode pif is just facilitating this working.

when they mention script only mode for older phones, they mean with no spoofing of prints needed at all, as in no sailfish needed.
[Magisk] trevtdogg:
it really seems to me like you are very impatient at trying to get things fixed, rather than trying to understand everything.

the quickest fix is to just go back to stock rom, unroot and lock bootloader.

if you just want RCS working, I believe an easier method is to try a bunch of previously publicly used prints that have been burnt already. I haven't tested this myself (because I don't use rcs) but I've seen others say that some old prints that now only pass basic integrity and fail device integrity still work for RCS.

the easiest way to do this is to try a bunch of older versions of chit's pif modules as most came with a built in fingerprint. hopefully one of them should work just for basic and RCS only.

if you want device integrity and RCS, then you'll need to do the hard work of hunting for an elusive still working private print. I have not done this, most people have not done this. It is not easy, it is not simple. you will need to try and find a source for build.prop files from hundreds of different roms, and test them.

this used to be a lot easier when there were thousands of working prints available. I was able to do it a few times back then. now that there are so few left working, it's a real needle in a haystack scenario and to be honest it's not worth my time. I have since bought a cheap second hand watch that works for NFC payments as a back up. some others have done similar, some have reverted back to stock and lock bootloader, some are just riding the wave of public prints as long as it lasts.

there is no simple answer, there is no magic easy solution that people are hiding from you. things are changing every few weeks, and have been for many months now, because google has decided to somewhat crack down on this.

complaining that people aren't giving you the right answers feels very entitled of you. it sounds like you want spoonfed answers. that's a big turn off. no-one here is getting paid, so why will they put effort in when you just give attitude back?
[Magisk] Vision:
Yeah exactly, FrameworkPatch don't need any PIF module, but for strange reason in many users not working itself and need script-only-mode or shamiko etc, and add GMS.unstable, to spoof sensitive props and done.
[Magisk] wfred:
I had a 7T that I bought new and traded in for my 11. Would have kept it except the battery wouldn't hold a charge.

Never had any drm issues, but I also ran stock Oxygen OS.

Anyway, there are posts several pages back (15-20?) with people describing how they were able to get RCS working by sacrificing Pay. Apparently, with the current setup, you can have one or the other.

Good luck

Edit: you may have to go back to OOS if you want RCS
[Magisk] aygul12345:
I ran uname -r, it prompted something out. What can I do with that?
[Magisk] Nergal di Cuthah:
What do you mean "prompted something out" be clear
[Magisk] aygul12345:
I put it in the console and there is some text being prompt out. But what can I do with it?
[Magisk] Nergal di Cuthah:
What does the text being prompted out say (you didn't answer my question you just repeated "prompt out")
[Magisk] okij:
Prompt it out there and prompt it in here. 🙃

Copy + paste.

Ctrl-C + Ctrl-V.
[Magisk] aygul12345:
4.19.110-perf+

What does this mean?
[Magisk] GeTex:
Its means you should probably read the first post
[Magisk] Nergal di Cuthah:
It means that, as far as I know, your kernel is not on banned kernel list

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] aygul12345:
How can I test if my rom is being signed? Is there a apk?
[Magisk] aygul12345:
Check.
[Magisk] Captain_Throwback:
Literally the first thing in the OP.
[Magisk] HippoMan:
Read the "BEFORE YOU START" section at the top of the OP ("OP" == original post of this thread). For that matter, the entire OP should be read if you want to understand the issues about Play Integrity that are discussed here.
[Magisk] aygul12345:
I mean is there a .apk to see if the rom is being signed yes or no. Instead of using a code with termux.
[Magisk] Nergal di Cuthah:
No, must use some terminal app. Basic rooting info even i can do it.
[Magisk] AlexS2412:
is the public sailfish print banned for rcs or not? i keep seeing conflicting information
[Magisk] BarackMitzvah:
I believe so
[Magisk] casouzaj:
For me (Xperia 1 II running LineageOS 21), the Sailfish FP is still working. I still pass the device integrity test.
[Magisk] pndwal:
So messages definitely send with RCS on that? 🤔 PW
[Magisk] casouzaj:
For some contacts, Messages shows 'RCS with...', but, media contents fail to be sent.
[Magisk] pndwal:
So actually failing (silently) as for everyone spoofing sailfish I guess. 🙃 PW

I can do it too, and I'm not even schizophrenic!... Thanks mate. 😜
[Magisk] lpedia:
A similar story here. Pixel 5 with official LOS 21, Magisk 27.0, PIF 15.9.9, no custom FP. Play Store reports device is certified, Google Wallet (and other apps that notice root/ bootloader status) work when included in DenyList.

So the Sailfish FP is still getting device integrity for me, too.

RCS is another story, of course. It connects successfully if Messages is in the Denylist and its component com.android.apps.google.rcs is explicitly included (it isn't, by default), but refuses to communicate via RCS. For RCS groups it explicitly says this device can't particpate because end to end encryption is not available.

This is consistent with what @pndwal has been saying about needing dynamic patching of build fingerprints.

So ... Google requires e2e encryption for RCS communication, but Sailfish doesn't meet RCS's encryption standard, so RCS cannot work with this FP ... and wouldn't work with any other device whose FP works for PIF, either.
[Magisk] shoey63:
I have 2 relatively modern devices with non-Sailfish prints that both pass DEVICE_INTEGRITY with PIF.

One print is A11 (PIF Fork9.0) and the other A5.1.1 (PIF 15.9.9 with the private print in /data/adb overwriting Sailfish)

I can RCS message between the two, including sending attachments.

Both are running Magisk Alpha with Shamiko, and no Google services in deny list (disabled to allow Shamiko to run)
[Magisk] pndwal:
Thanks for pinpointing the specific issue... Hope it is simply the E2EE requirements...

It's interesting that this seems to be the reason for the checks since the goal in this phase of RCS evolution seems to be to achieve cross platform compatibility for iOS take-up slated for September/iOS18, and while Apple has agreed to implement RCS alongside their iMessage protocol (Nb. iMessage isn't being replaced; RCS messages will simply be sent with the green bubbles already used for SMS/MMS), Apple will only support the baseline RCS Universal Standard which means it either has to work initially with no end-to-end encryption (E2EE) since E2EE is a proprietary Google extension to RCS (which is what was predicted to occur), or (my speculation) GSMA adoption of Google's E2EE extension as part of their Universal Standard will need to occur first.

Just maybe, Google could well be working with Apple and the GSM Association for a pre-iOS18 adoption of E2EE so cross platform messages never need to be left unencrypted... Guess we'll know in only a couple of months now.

(More details here:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89551548 )

👍 PW
[Magisk] coconutxyz:
Another noob question but RCS only affects the messaging part right?
[Magisk] pndwal:
Yeah, thanks... Didn't seem like Google to be detecting root independently of their PI API, although some RCS users seem to indicate it might...

What is your A5.1.1 device?... I knew @canyie reverted min A6 spec for her test builds... Good to know it works for old OS in alpha... Or did you just mean device launched with 5.1.1?

👍 PW
[Magisk] pndwal:
RCS = Rich Communication Services messaging, the emerging new GSMA (Groupe Speciale Mobile Association) standard. 👀 PW
[Magisk] coconutxyz:
Thanks, will it affect stuff like WhatsApp etc?
[Magisk] pndwal:
Sorry, I edited the post above as my memory was falling...

Quick Google search:

Google's Android messaging system RCS vs WhatsApp: A Comparison

🤠 PW
[Magisk] coconutxyz:
Thanks a lot, I guess I don't need that since no one here uses sms
[Magisk] shoey63:
That's the print.

ie. A11 print on Pixel and A5.1.1 print on ROG phone. (Above post edited)
[Magisk] pr3dicament:
I was trying to be thorough, basically, but I'm not really using that as any excuse. I've done some testing and so far no luck. Regarding relocking the boot loader, definitely not able to do that with this phone and still get updates. It's not all just RCS. I do need root as well, but there's no point in going in to *why* as that's not really relevant. RCS is just one of many things. Everything else you're right about. There's something I'm going disclose. I'm a bit neurotic--sometimes I get stuck on things and I simply got frustrated and along the way I eventually got *too impatient*. That's my fault. I'm working on that. You're absolutely right though and I don't disagree.

Please note that I wasn't purposefully trying to be that way, but when I go over what I was posting, including the cross-posting, I can see why. I definitely wasn't *trying* to give attitude, as eluded to above, but the point is that it came across that way, so I am definitely sorry about that. Even I don't like how it looks. Trust me, I'm very embarrassed as I type this but I'm just owning it. Take care everyone. Good luck to all of you and thank you to the developers, testers, and anyone else contributing in this fight with Google.
[Magisk] pndwal:
Just this.

Many will disagree, but I'm sure that any fight we have with Google can only be won because the Giant is letting us win... They don't have too, and I (and others) have pointed out specific ways they could easily have shut down this cat-and-mouse game, fight, war, whatever you might call it, years ago to the detriment of modders and with no collateral damage to locked/stock system GPay users, bank customers etc including those with non-DroidGuard-spec-hardware-key-compliant devices...

In that sense, it's hardly a fight!... Why do you think we've been able to keep prevailing for years with the odds stacked against us?... Especially and even since March 2020?...

... Because the combatants don't want to kill each other... Respect each other... Really... 😉

Don't think we'll win forever though; it's just a reprieve... Cos this thing is bigger than Google... 🤠 PW
[Magisk] GeTex:
Sailfish indeed meets the encryption standard, My stock locked Sailfish running Oreo OPM5 has fully functional RCS with E2EE. My daily pixel running 10 unlocked and rooted doesn't have working RCS with public print but works fine with a private print.

I actually am rocking 2 stock Nexus 6P's running 8.1 with fully functional RCS with E2EE as well. They are even older then Sailfish.

When ANY of my prints are banned I get E2EE errors because it won't generate a keypair. RCS with E2EE WAS Working with this fingerprint but was lost after google disabled RCS on that specific fingerprint.

If a device doesn't support E2EE it still allows RCS, I've got over a dozen contacts with RCS support but no E2EE, it simply downgrades the conversation to unencrypted and probably won't support any google specific components.

Am I misreading you because I have a private print with working Device, RCS and E2EE. If I am sorry I'm tired waiting on a flight right now.

I have a small idea how this nonsense is working and have been developing a workaround but its unreliable, no E2EE, buggy and also hilariously I have 4 devices registered simultaneously to the same RCS number and its doing funny things to my RCS chats.
[Magisk] pr3dicament:
Well, yeah.. I just meant I'm appreciative of those that go through all of this hell all of the time, that was.. mostly my point there. I know it's a behemeth so to speak.. I just appreciate all of those that contribute and I'd like them to know that. That's all.
[Magisk] Riffer:
Magisk/Zygote with 15.9.9 installed.

The check tools give me a fail with every first, and a success with every second check. It's like a flipflop switch.

Am I doing something wrong?
[Magisk] HippoMan:
I also don't believe that the Googlefrinchians are out to get us modders. But neither do I believe that they are giving us a reprieve ... at least not consciously.

We modders make up something like one tenth of one percent of Android users, and I seriously doubt that Googlefrinchian management and shareholders pay any greater percentage of their attention to us when formulating their policies.

We are like tiny, unnoticed insects that just happen to get squashed under their boots as they march towards their goals.

This seems quite clear regarding their RCS policies. Regarding Play Integrity, it's hard for me to believe that any Googlefrinchian policymakers are saying anything like, "Let's make a point to allow the modders to have 70 working fingerprints" out of a universe of many thousands. Furthermore, I doubt that the slowness in banana-ing FP's is due to anything more than corporate carelessness and inertia. And again, I doubt that the management even think about us modders at all.

Yes, I'm sure that there are some individual Googlefrinchian employees in addition to TJW who do think about us modders and sympathize with us. However, I doubt that they are able to have more than a microscopic level of influence on corporate policies.

In the end, even we one-tenth-of-one-percenters are likely to be annihilated, but not because of any Googlefrinchian management's attention being paid to us. They have other fish to fry that have nothing directly to do with us. We're just sufferers of collateral damage.
[Magisk] beeshyams:
Fully agree with you

Just to add - Google like any corporate aims to make $$$ and more of it. They have to please their clients and stakeholders in the process, implement polices that seem to be aimed at us but not really, just collateral.

They let us play around (easiest to stop would be to freeze bootloader unlock), and if our playground shrinks because of their corporate policies, so be it, they see it, understand it, ignore it and of course, march on with their aims. Assuming that they are cutting us to size & we are fighting against it, is to overestimate our importance, bordering on arrogance.

IMO, it's upto to each one of us to decide how long you are going to use the play ground. For me, no more play ground with next phone. I simply lack the energy and will. Being in the sixties, I feel my free time can be better used.

Sorry.. Bit of a rant
[Magisk] sawdoctor:
Same here, don't know why it shows RCS available with some but not others. They did still send for a few days after the ban but then started falling (on the ones that still shows available) . Maybe a cache issue
[Magisk] sawdoctor:
Yes we might be tiny but we also have some really talented developers who actually contribute to the AOSP and have helped (sometimes inadvertently) Google fix vulnerabilities.
[Magisk] lpedia:
For me, PIF is still working for Play Integrity with its default FP, so Wallet etc are working.

Messages is also working without any complaints. But it won't send / receive RCS chats. It can enable RCS (shows "connected" for my number), and even shows "RCS chat with ..." for some contacts, but won't send or receive RCS chat messages or participate in RCS groups. Details on group chats says there is no E2EE, so this device can't participate in the group. Any message I send to the group simply disappears, and I don't receive messages sent to the group by other people. When people who have RCS try to RCS to me, they see "waiting for <contact name> to come online" (unless they have configure auto fallback to SMS), and that never happens.

It doesn't seem like a blocked-FP problem.

Not for me, it doesn't. I cannot send / receive unencrypted RCS messages.

I agree that it should fall back to unencrypted - after all, the RCS standard doesn't include encryption - but mine doesn't do it and there's no option to enable it.

It looks like Google's enforcing E2EE for all RCS communications if it's providing the RCS service. My RCS service

is

from Google, because my telecomms provider outsourced RCS services to Google in 2020 after having provided their own for several years. The other Australian telcos have also outsourced RCS to Google.
[Magisk] Vision:
With every new version, Google close something 😂🤣

Android 14 blocks modification of system certificates, even as root

Update: This post sparked a lot of excellent discussion and debate on workarounds, and there are now multple working solutions to allow…

httptoolkit.com
[Magisk] GeTex:
Its indeed a Fingerprint ban. When google blocks a fingerprint, it will not allow generating a keypair either for encryption(this is done as some kind of Handshake but since you are blocked it won't even allow generation of the key for the handshake). RCS doesn't rely on Device integrity. With the sailfish print you will NOT get RCS working with or without E2EE. However 2 weeks ago it was working for everyone here with RCS and E2EE. I changed back to a private print and immediately got RCS and E2EE. You aren't unable to send messages because of E2EE, you are unable to send it because the sailfish print is specifically blocked from sending it. RCS falls back to no encryption when one endpoint doesn't support it. You specifically can't fallback because the public print is banned which prevents any RCS, E2EE or not. All of your behavior you described is 100% what happens when they ban a print. Its not the print "doesn't support it" because it very much did until it was banned.

It was banned June 3rd to be specific from RCS. Prior to that you could send messages with RCS and with E2EE. multiple others that same day at the same time as me complained they lost RCS, but had it working prior as well. You can look some pages back.

Also google is NOT enforcing E2EE as I have contacts without E2EE support that use googles RCS and it sends and receives just fine. All US carriers went to googles RCS this/last few year(s) as well.
[Magisk] Vision:
Is there is a list with apps&games require Strong integrity? 🤔
[Magisk] osm0sis:
May 29 was when the first reports started rolling in here. Mar 29 was the last RCS ban test. Feb 29 was the PI mass fingerprint ban. They seem to like 29s. 🤷‍♂️
[Magisk] HippoMan:
Yes, I agree that among the 0.1 percent of Android users who are modders there are some individuals who have made very useful AOSP contributions. Nonetheless, I don't believe that the Googlefrinchian management are giving any specific thought to us 0.1-percenters when formulating policies which happen to lead to Play-Integrity results that affect Android usability for modders.