yashsingh1/xdaforums huggingface dataset:
[Magisk] awarexda:
Yes, it reminds me of old good times with rooting done with cf-root which actually became 100% obsolete. Nostalgia
[Magisk] zandatsu06:
Gonna love reading on this thread 🤣, btw v13 works for me i forgot to feedback when you dropped it yesterday

Device: Poco F3 MIUI14 Global Android 13 rooted using KSU
[Magisk] Vision:
And now we waiting for the module with this fix pass 3 or something else?
[Magisk] NMaverick:
Thanks it worked (Previously I only cleared the cache).
[Magisk] ghedo75:
View attachment 6034131do I have to set the apps to be hidden like this to make the Google NFC wallet work?
[Magisk] me_droid:
Thanks, removed everything Google (also wallet per TraderJack) and for the moment everything play related is working. Device also play protect certified whereas yesterday it was not. Should mention this is on version 14.
[Magisk] chiteroman:
Nothing here Google, just a random meme :P
[Magisk] Vision:
Good work. And now we waiting for the module with this fix pass 3 or something else?
[Magisk] Flr Power:
Be careful, they might see this as a threat 🥳
[Magisk] immortalwon:
That won't happen. Google can easily blacklist a key in a day if the public is using a method to bypass strong integrity.
[Magisk] Vision:
And now what we waiting? All this discussion? With simple words only the @chiteroman pass all 3, unfortunately the most others not have the knowledge to make this like chiteroman did it managed to pass all 3.
[Magisk] Flr Power:
I don't think we need to pass the strong integrity right now...
[Magisk] Vision:
Maybe, just ask, because i read in future updates all apps need strong to work
[Magisk] awarexda:
Wallet? What is this? :eek:
[Magisk] Lughnasadh:
I'm in my 60's and I still find this method very convenient 😅. Cash and card. Go to bank or do it online. I'm happy not passing anything and I don't even try 🙃
[Magisk] xSnowLeopardx:
Bought some good food and drinks today with GWallet hehe.

Felt so relieved when I saw no error message during the payment LOL.
[Magisk] Vision:
Xiaomi Poco X3 NFC Android 10, latest v13 pass 2/3. All good
[Magisk] HippoMan:
I totally agree. See this discussion and other related discussion in its thread (and we probably should limit such discussion to that thread instead of these technical threds) ...

https://xdaforums.com/t/discussion-...ding-cat-and-mouse-game.4425939/post-88853767
[Magisk] MikeZh:
News from xiaomi.eu:

Amen! Our requests have finally been taken into account!
[Magisk] maxmax0:
Is there any way to disable the Google services updates which keep breaking wallet? Block some domains, freeze files etc? Disabling updates in play did not work...
[Magisk] zgfg:
Which request?! You asked them that?

If so, than big SARCASTIC THANKS for that your requests

This module does not work with Xiaomi.eu 14 Stable and most of devices that have Xiaomi.eu Stable 14

are no more on the Beta/Weekly list

Hence for devices that are stuck with Xiaomi.eu Stable there is now no other way than to go back to official ROM
[Magisk] HippoMan:
That can be done with apps, but I don't believe it's possible with these service updates.
[Magisk] chiteroman:
If they remove their weird fix, the module will work. The problem isn't the ROM, is that weird fix they included.
[Magisk] maxmax0:
I wonder what exactly is updating here... It's not the base OS, it's not the wallet app... Play store updates all disabled....

Blacklisting Google CDN domains in DNS should work, if we can get the domain right...
[Magisk] Lobod:
Propabbly they are droping it so modulle will work in stable.
[Magisk] miss:
metroView attachment 6034209
[Magisk] DanGLES3:
Too many people are testing through the Play Integrity checker app and are thus exhausting the its free daily quota of requests, it's better to test through the Play Store itself

Go to Play Store settings, tap the version name 7 times, go back, go to general options, developer options, Play Integrity
[Magisk] voetbalremco:
If you read there's no need to go back to stable.

New rebuilds will be compatible with Play Integrity fix like other custom roms.

Their fix was ahead of others at the time. Google catched up and fixed it.
[Magisk] zgfg:
They will not update their Stable ROMs anymore for EOL devices, hence they will not drop anything from them and therefore they will not make it possible to use this module for Xiaomi.eu Stable 14:devices

And that's exact the problem that I pointed to (for those who obviously do not understand the matter)
[Magisk] zgfg:
Only for Devices that are on the Xiaomi Beta list. Not for Devices that do no more receive Beta. Those Devices will stay on the current Xiaomi.eu Stable 14, not passing Device Integrity and not being compatible with PIF module - hence unusable for PI, Wallet, GPay

They will receive further Xiaomi.eu Stable update only if/when Xiaomi releases new official ROMs for then - only then Xiaomi.eu will release new ROMs for then (and even then it is questionable would those new ROM versions be suitable for the PIF module)
[Magisk] zgfg:
OMG. Read what you quote. That addresses only those devices that are on the Beta list

Go to Xiaomi.eu, open Stable 14:thread and count how many devices are on the list there

Go to the Beta lust -!there are only maybe 1/5 of those devices there

So all devices that are on Stable 14 list AND NOT on the Beta lust are out of hope.

Seems you are not aware of that and you don't care for those devices and users, but only for your device that is on the Beta list
[Magisk] kacskrz:
Let me repeat it again, because looks like you didn't understand it.

Beta users will have the existing fix, non-compatible with Play Integrity Fix but being updated constantly as more new ways will come there.

Stable users will have a rebuild which removes the existing fix, allowing to flash Play Integrity Fix.

Regards,

Orjon / kacskrz, Xiaomi.eu team.
[Magisk] simplepinoi177:
@nadeemakhtar1994, As per Forum Rule 6 (quoted below), LP is considered an app that "....cracks....or other means of avoiding payment...".

...because, as stated on Rule 6, "...nor do we permit members to request, post, promote or describe ways in which warez, cracks, serial codes or other means of avoiding payment, can be obtained or used."

I hope this explains the matter sufficiently.

simplepinoi177 FSM

XDA Developers Forum Rules said​

6. Do not post or request warez.​

​

If a piece of software requires you to pay to use it, then pay for it. We do not accept warez nor do we permit members to request, post, promote or describe ways in which warez, cracks, serial codes or other means of avoiding payment, can be obtained or used. This is a site of developers, i.e. the sort of people who create such software. When you cheat a software developer, you cheat us as a community.​
[Magisk] makeyourself:
If I'm not mistaken Google's fixes are being done server-side. So blacklisting domains on your side isn't going to help. Unless you could block the attestation server I guess and that worked, but you probably can't (without blocking other communications you need e.g. for Google Pay to work).
[Magisk] Joly0:
Hey guys, i had this module installed, cleared caches of wallet, play store and gsf and cleared data of gsf but even then after a reboot my device is not certified/validated and no integrity check succedes. Any idea why and what i can do? Got an Oneplus 8 here with magisk delta
[Magisk] bakaekze:
Device certification is a whole different issue and has nothing to do with this thread
[Magisk] Nergal di Cuthah:
Did you have v13 of the module. What other modules lsposed etc, but the above comment that ninjad me is more correct
[Magisk] DougMG:
Incorrect. This thread is 100% about passing device certification.
[Magisk] Joly0:
Nvm guys, i got it working. Disabled all other modules through aam, rebooted and got only basic integrity passed and cts failed. Removed gms from denylist, rebooted and got both passed. So looks like one of my modules doesnt play nice with this. I´ll test
[Magisk] Nergal di Cuthah:
It sounds like you're only testing safetynet (maybe with YASNAC) you should be testing play integrity. Enable developers options in playstore (not in your phone's settings but playstore) and check integrity from there
[Magisk] Joly0:
Yes, did that and worked. As i said, but had to disable some modules and remove gms from denylist in magisk
[Magisk] knasiotis:
so eu rom users should be expecting a new rebuild or was that already integrated to the stable rebuild you provided a few days ago?
[Magisk] intel_core_i7:
After reading those very interesting deleted replies, seems like the way to pass STRONG with unlocked bootloader these days is to spoof your device to another with broken TEE, right? 👀
[Magisk] Nergal di Cuthah:
Spy spy lol
[Magisk] V0latyle:
They weren't deleted, just moved.

Unless I'm missing something here.

I realized you're talking about posts that might have divulged how the strong verdict was accomplished.

We generally don't delete posts unless they are spam, wildly off topic, or otherwise offer no benefit whatsoever to the discussion at hand. Personally I try to leave anything that I consider to be helpful, so even if someone's being a jackass and flaming someone else, I'll edit the post for language so as to preserve the original content.

We did move a number of posts out of this thread because the discussion was taking away from the intent of this thread, which is for releases and support of @chiteroman's module. Technical discussion of the inner workings of Play Integrity can go here, while general discussion/gripes/moans/complaints/debate about root detection can go here.
[Magisk] Nergal di Cuthah:
I think they meant the redacted developer posts which were quoted and those never redacted. The, as you said, divulging posts
[Magisk] 130ryokohama:
update on my situation.

phone was able pay via google wallet despite saying it was not meeting sec reqs

PIF v13 with no other modules. but now it's passed by itself.
[Magisk] TraderJack:
So I must have missed something. You crossed out that first sentence, does that mean you did delete posts discussing how to achieve strong integrity or any posts at all that didn't meet the spam criteria you outlined?

Last I read anything about strong integrity in this thread was @chiteroman showing he had strong integrity on his results stating that his device did not have an unlocked bootloader. I'm assuming that was the truth.

So can someone fill me in on what was being discussed on this topic and if I can't be filled in due to the fact that posts on the topic are going to be removed, can we know why?

Maybe someone got confused and I'm misreading the whole situation here, but I feel I stepped a way for a day and missed something big :)
[Magisk] kacskrz:
There will be a new rebuild for stables.
[Magisk] V0latyle:
Nope, the post I was replying to was referring to something other than what I was thinking of. We haven't censored anything in this thread.

The staff didn't take any action. In this case it was a sort of collective "oh crap Google is listening" and the people involved removed the relevant information from their own posts. Since this is indeed a cat and mouse game as @HippoMan put it, I don't think anyone wants to let on to how a particular exploit works, because if Google is indeed reading this thread (and they most likely are), they'll immediately know what to patch.

Maybe...probably...thar be dragons afoot
[Magisk] maxmax0:
Hey Google, if you are reading this, from a legal point of view, you've clearly demonstrated your best effort to prevent modified devices from paying with wallet. Well done!

But now, please go work on A15, solve some sudokus, take a walk around the campus etc... but please leave us alone and let us enjoy our devices for some time 😄
[Magisk] :
Hey Google please don't patch anything (and there's nothing to patch 😄) we will take youtube premium subscriptions we promise 😀
[Magisk] ghedo75:
How do I fix the problem with the Google NFC wallet payment? Is there a guide that works 100%? Which apps in Magisk should I select to exclude them? Thank you very much.
[Magisk] awarexda:
I see another need here: we need an app that will check PI every minute (how?) and give a notification when the device integrity "dies" sooner than later...
[Magisk] pndwal:
Like others I missed the details, but generally, if we're talking about broken Keymaster implementations etc that allow STRONG_INTEGRITY on a device (like ROG Phone 3, already patched), they cannot be used for other devices as the pass comes from faulty trustchain data or its on-device handling... In short, we cannot inject the bad low level OEM code incl. Keymaster components or keys/keystore in TEE OS, into another device or simply spoof it...

Concealing such flawed OEM implementations from Google will only allow owners of the particular device model to retain STRONG_INTEGRITY for longer...

Nb. The Pixel 2 /walleye 'bug' was very different... Is wasn't bad Google implementation on the device that allowed STRONG_INTEGRITY to pass... It was their server-end fake STRONG_INTEGRITY pass for Pixel 2s identified by both fingerprint and shipping level props despite no HARDWARE_BACKED evaluationType data needing to be present that allowed other device users to exploit this simply by spoofing the props!...

That's not to say Pixel 2 on device trustchain/data handling wasn't flawed, but as I've said before, the obvious explanation is that Google was embarrassed that early stock Pixel 2's (nb. this device spanned 3 shipping level API/SDK tiers!) could not pass SafetyNet ctsProfileMatch, so they arranged for a server end spoof to conceal this fact/'fix' the issue presumably on the first tier devices only and allow bank apps etc requiring SafetyNet to work on the P2...

They probably never expected to be found out, but it seems that while a shipping API level of 26 allowed the fake pass and 27+ were blocked, they only blocked this up to 32 (sadly for them), so by trying the walleye fingerprint prop in combination with a shipping API level of 33+, Xiaomi.eu(?) Devs simply uncovered the flawed attestation as it worked to pass STRONG_INTEGRITY on test devices... Of course they realised it could easily be exploited for other devices too... And most here know the rest...

Clearly seems to be a case where Google messed up their on-device keymaster/AVB trustchain implementation just like OnePlus (notoriously) and other OEMs did, but were also prepared/willing to slant the playing field to save dollars/face... Sorry Google! 😜

... Sorry modders too, but it's extremely unlikely that another exploit that can be applied to multiple devices for PI STRONG_INTEGRITY on AVB Unverified or SelfSigned devices will be discovered... unless Google have simply forgotten some other device(s) where SafetyNet pass etc was faked originally...

🙃 PW
[Magisk] HippoMan:
Maybe we need to promise to disable all of our ad blockers, as well, given that supporting advertisers is their primary business.
[Magisk] pndwal:
Might be pretty difficult in view of un-negotiated call quota cap for apps... Great idea though! 👍 PW
[Magisk] pndwal:
I put something about such a request and benefits back here:

... Looks like @kacskrz/ other Xiaomi.eu Devs/team members have been watching and will deliver!

This will end the USNF/PIF module Dev and user frustrations with Xiaomi.eu custom ROMs and inbuilt PI spoofs AFAICS, and is a great call!... Thanks Guys! 😋 PW
[Magisk] MikeZh:
To clarify, I've asked that this fix could be disabled.

Although the removing of the fix suits me, the idea to release stable versions with and beta versions without the fix should be a solution for everyone. Tnx xiaomi.eu.
[Magisk] pndwal:
Well Play Protect device certification requires/is linked to Play Integrity APIs DEVICE_INTEGRITY verdict now and you won't pass without it... It did take Google some time to migrate this dependence from S/N to PI API however...

Nb Play Protect in Play Store is only a UI it seems... The cache is actually part of Play Services (GMS) in many devices, so both Play Store and Play Services data may need to be refreshed or cleared to restore device certification... In later devices it has been moved to a dedicated Google Play Protect Service app which PI verdicts are still cached in Google Play Services, so users may need to clear data in all 3 Google apps...

👀 PW
[Magisk] pndwal:
Nah... It's only server end Play Integrity API support/algorithms that change; there's usually no need for Google to update GMS components on your device although they can update both normal userspace apps and Droidguard VM resources also if they wish (and you can't prevent the VM packet updates AFAIK)... Nothing you can do on your device to prevent PI API changes affecting you in advance...

I put basic workings of USNF and forks incl. PIF here:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89167147

Take a look at that and my post above it. 😛 PW
[Magisk] Dehumanizer77:
FYI I only had to clear the Google Play Services data to get wallet NFC working again. However all cards have been removed from the wallet app anyway, so I had to add them again.
[Magisk] pndwal:
Sure, but I wasn't speaking of getting G Pay/Wallet working, only about relationship between Play Protect Device certification status and PI DEVICE_INTEGRITY verdict...

AFAIK it's possible to have working G Pay/Wallet with Play Protect 'Device is not certified' status as long as PI DEVICE_INTEGRITY is achieved, but this may have already shown 'Device is certified' for you or clearing Google Play Services data may have fixes it also... Others will need to clear Google Play Protect Service data where it exists... PW
[Magisk] fedeoliv89:
I have a Xiaomi 9T/K20 Pro running a Pixel Extended mod. I met both device and basic integrity with v12.3 of the module.

Today I got Googled again but v13 fixed the problem. Thanks!
[Magisk] krisuvagya:
Working on pixel 7a Nov 23 patch
[Magisk] Vision:
@chiteroman With simple words and for better understanding, seems like the way to pass STRONG with unlocked bootloader is to spoof your device to another with broken TEE, right? So anyone for himself if has the knowledge just must find fingerprint with broken TEE and just add it in this module and pass and 3 or is more complicated?
[Magisk] osm0sis:
There are probably a limited number of devices that Google has mistakenly allowed to have Strong.
[Magisk] Lubo99:
if device integrity is pass wallet will always work. once its gone like yesterday for me wallet kept yelling device does not meet security requirements. once thanks to chiteroman fix version 13 was intalled device integrity was again pass I was able to pay for my pizza delivery by phone. edit lol this should be reaction to another guy not you lol
[Magisk] Vision:
Yeah understand, that is logical, if anyone found one or by mistake the only have to do is to add it in the module and that it and pass and 3 ?
[Magisk] chiteroman:
No, you need a device with bad Keymaster implementation, so always will sign the certificate with Google private key and verified boot.
[Magisk] Lovely_Ribbon:
This is what I was afraid of. Does anyone know a way to get Wallet working again without this step? Or alternatively, does anyone know a way to clear the Play Services data without breaking the connection to the Pixel Watch? The Pixel Watch has to be factory reset every time this happens to re-sync with the phone which is a huge pain.

Honestly, if I can't figure that out. I think I'll just leave Wallet on my phone broken since I can just use the watch to pay. Luckily my Play store still shows certified even though Wallet caught on before I updated. Maybe I should check for updates to the Play Integrity Fix before every time I want to use NFC payment on the phone 🤷‍♀️
[Magisk] osm0sis:
You can just wait, Wallet will start working again in a few days.
[Magisk] Vision:
Now is clarified, thanks. Must have specific device not just Magisk and module with random phone
[Magisk] xSnowLeopardx:
I am confused. Whom are you talking to? Since it's working right now - for me, at least.
[Magisk] mmbaknnba:
Sorry, but is this the same method with AVBRoot? Honestly, I'm very curious about AVBRoot as I have the supported device & already patch the OTA but haven't test it yet. 😅
[Magisk] Yeedatoy:
Yeah, v13 fixed everything for me as well
[Magisk] Yeedatoy:
There's usually no need to clear anything. For example, when you put wallet on the deny list you just need to force close it and maybe clear cache and it should immediately allow full access instead of giving the incompatible device message. There's been times I had to do this on the fly while in a checkout line
[Magisk] xSnowLeopardx:
For me, clearing data (manage -> clear everything rather) from GPS did the trick.

It has never been that Wallet broke, I did what you described, and it started working again - unfortunately.
[Magisk] pndwal:
I don't think there are/were any...

The unprecedented (especially at that time) use of shipping level prop (now used for enforcement purposes) to cause servers to override failing results (read supply a fake ctsProfileMatch pass regardless of bad measurements or BASIC-only attestations) indicates strongly that this was intentional!

...I'd say however that there were likely a limited number of devices (or only the one) where Google intentionally spoofed STRONG_INTEGRITY, and that, withstanding the unlikely event that they've simply forgotten some, any other devices where Google falsified SafetyNet passes with HARDWARE_BACKED evaluationType labels would now have had their server-end spoofs reverted along with the Pixel 2, if only because this will have been hugely embarrassing... 😬 PW
[Magisk] Lovely_Ribbon:
I have tried this, and I tried it again just now to make sure I was doing everything right. Unfortunately, tap to pay setup still shows "Phone doesn't meet security requirements." I'll wait a few days as the previous poster indicated since I don't urgently need to use tap to pay on my phone.
[Magisk] Flewoutthecuckoonut:
So for xiaomi.eu user, they need to flash the stable rom? (considering the devs decided to remove the fix from the stable rom)
[Magisk] TheFreeman193:
@Yeedatoy @Lovely_Ribbon I usually manage to restore wallet functionality without clearing GMS/GPS data. My strategy after a module patch is reboot -> check basic/device integrity verdicts in Play Store come back -> reboot -> clear wallet cache (not data) -> open wallet (I usually still get an incompatible notification at this point, don't worry!) -> force close wallet -> clear wallet cache -> reboot. It sometimes takes a couple of attempts force-closing, clearing cache, and rebooting as if the notification has been queued inside the app, but always had it working again on the same day on a Oneplus 5/lineage 20.
[Magisk] Lovely_Ribbon:
I tried the force close -> clear cache -> reboot (my Play Store is already certified), but it's still showing doesn't meet security requirements in tap to pay setup. You don't always get the notification whenever you force close the app and re-open it even if you clear the cache and/or data. You have to check the settings -> tap to pay setup where it shows that the device doesn't meet security requirements. If you try to tap to pay while it shows that, then you will get the notification that you can't.

From my highly uneducated guess, it seems that the data is stored in the Google Play Services data, and hopefully it re-checks periodically. Maybe it varies based on the phone because I am using a Pixel 8 Pro.
[Magisk] HippoMan:
@chiteroman is a savior for giving us this module!

But even this excellent work is likely to not last forever as the Googlefrinchians continue to improve their "integrity" checking.

I think that we modders need to start thinking about how to separate the use of a payment device from the use of a modded phone.

Any ideas?

Perhaps it's best to discuss this in a different thread:

https://xdaforums.com/t/discussion-magisk-the-root-hiding-and-mod-hiding-cat-and-mouse-game.4425939/
[Magisk] gravityz3r0:
Sorry if this has been obvious, but does Magisk require root access? Or is this doable without root? Can't find this information on first page.