yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
🤔 8.7 references the Protobuf data which is the basic vehicle for the integrity attestation and means for Google to determine device integrity/tampering... Not really additional telemetry as I understand it; it only 'packages' the signals collected...

And decisions/algorithms based on the data is are taken/performed entirely at the back end anyway... Presumably Google does account for a 'sudden influx of weird values' etc, they'd simply be adjusting serverside algorithms to based on signals from many different devices, but my point is that the basic mechanism doesn't appear to have changed substantially. 🙃 PW
[Magisk] sawdoctor:
I'm just saying thats the closet thing there is too root with a locked bootloader. Not saying it should be used or will fix everything
[Magisk] ezdiy:
That's what telemetry means.

What the backend does with telemetry has changed. The game can be still played, provided what droidguard sees becomes more accurate (hence why you need recorded trace and replay it for calls droidguard makes). Resulting in telemetry matching closer to real device.

Until nougat support is sunset for good that is. Considering that marshmellow APIs got turned off this year, we can expect nougat sunset in a year or two.
[Magisk] pndwal:
Thing is I don't think it matters how you replay attestations... Person-in-the-middle* (PITM) attacks are also covered.

The first few lines I linked for you mentioned "Your app's server-side backend generates and sends a unique value to the client-side logic, aka "app"... App creates a

nonce

from the unique value also

containing device, app, and account details

... It then calls the Play Integrity API, passing in the nonce..."

The nonce/unique data from the calling app and it's back end accompanies the attestation data / protobuf message being built from go to woe so verification (including of host device, account etc) can be performed at any stage... 1) The requested hash allows Devs to "

verify

both the device and app integrity signals

to ensure that the results

of the high-value action

were created by your untampered app on an untampered device

", and 2) The included 'unique values' protect against replay attacks...

Am I missing something? PW
[Magisk] pndwal:
Sure... Meant what I said, 'additional', ie the 'sudden influx' stuff you mentioned... Of course I understand that basic measurements are always undergoing minor changes however. 😉

Fully agree back end algorithms have changed as I said... But you seemed to be speaking about DroidGuard measurements...

Really that won't matter either... A 'critical mass' of customers using devices launched with Nougat (7, Keymaster 2) but perhaps running official Red Velvet Cake (11) will need to be reduced sufficiently before banks will be willing to accept the 'colateral damage' to their customer base and throw the STRONG switch (so they may wait till RVC support is sunsetted?)... And I don't believe Google will preempt that decision either. PW
[Magisk] freeza:
RCS is now working after unrooting but still bootloader unlocked with my OnePlus 12.

EDIT: Rooted back with apatch (no magisk or kernelsu) and no modules, no pif, no custom fingerprint, no shamiko, no modules at all just root = RCS working.

Also uninstalled all updates to google messages and am using the one that came with my phone from march 12 2024.
[Magisk] pndwal:
Yeah, it is root w/ locked bootloader!

Still, I said "what for?" since It just won't help much in the context of the discussion and I don't want to see members try "extremely risky" installations (especially desperate newbies) without knowing that "unlocked bootloader" detection is really a misnomer... Most apps are interested in properly detecting non-verified boot state (orange, unlocked or yellow, locked), and that's what's attested to by AVB. 🙃

🙂 PW
[Magisk] pndwal:
Well it's on the device (the.apk iterations) and some in our discussion group have removed iterations of it to see when it gets rebuilt/replaced), so it can technically be removed... GMS will normally just have it 'dynamically' reinstalled however... Removing Play Services entirely would surely do the trick however. 😂 PW
[Magisk] pndwal:
Yup, and some solutions use a module (don't need to modify the app at all!... @corndoghh recently made such a module to bypass the root check screen in Starling Bank app... (Just needs updating for 3 June app update ATM). 👀 PW
[Magisk] mwzdalne:
yeah i know it's funny, but it may be possible 🤣
[Magisk] mwzdalne:
i had the same idea (y)
[Magisk] mwzdalne:
SO IT'S JUST A APK?!
[Magisk] pndwal:
It's a special apk embedding a virtual machine whose bitecode is dynamically loaded from Google servers with every attestation call, and there are usually several iterations of it loaded at once at a location like this: /data/data/com.google.android.gms/app_dg_cache/1FEFB755F7DFAAFB69E71C4B872D96A200EC65BF/the.apk

🤠 PW
[Magisk] mwzdalne:
oh. ok.
[Magisk] anastasiszn:
OP6T and Lineage 19.1

zygisk enable

Modules:

Play Integrity Fix​

Shamiko

pass everything but root detect of bank apps and not open. Any idea?

Same works on A11 STOCK Oxygen rom but lineage not.
[Magisk] pndwal:
Moved a response here: https://xdaforums.com/t/magisk-general-support-discussion.3432382/post-89553390

🙃 PW
[Magisk] mwzdalne:
maybe make a patch for play services?

Sent from SM-S711B using ReLabs
[Magisk] pndwal:
The issue is that if we simply block DroidGuard (even by removing and preventing GMS from reinstalling which may be quite doable) and it's attestations, the app would never receive a MEETS_DEVICE_INTEGRITY verdict (just an unevaluated or errored out response) and would still block functionality or won't run at all. 🙃 PW
[Magisk] Magik_Malfici:
After looking at a few things in the developer options, I noticed that not only is OEM Unlock unchecked, but also Mi Status is locked (so my phone is recognized as if I've never made any changes to it).

However, I have root access and was able to change my ROM to an official MIUI 14 Android 12 (no Chinese copies, no weird stuff, in short, no crap).

So I deduce that the problem doesn't come from unlocking the bootloader or anything like that, but rather from traces of a poorly hidden root or something else related to it.
[Magisk] osm0sis:
Is it back for anyone else on the public print?
[Magisk] bombadier:
Not working with the public print in the UK so think its the same as last time that pif (public print) is breaking RCS.
[Magisk] sawdoctor:
Tried this morning and no luck. If he's no modules just root then he's not spoofing the public print, probably why he's passing.

I did have rcs working for a few chats for a few days but then lost them all eventually
[Magisk] osm0sis:
Thanks. Last time it was only for Easter long weekend (Mar 29 to Apr 1), whereas this time we're approaching 2 weeks (May 29 onward), but I figured if it'll end it might also similarly end on a Monday. Time will tell I guess.
[Magisk] bombadier:
Wonder if Google has refined their technique after the last time and this time they have it dialled in, havent heard of any unrooted phones being affected although there was some chatter that services were down with one of the US carriers round about the time it broke for everyone on the public print
[Magisk] 306bobby:
Can confirm, clear storage and uninstall updates, then reinstall updates to Messages

RCS works again!

Edit: reupdating the messages app breaks RCS again. Seems you need an older version

Edit 2: It works for about an hour, then stops again XD. Weird behavior fs
[Magisk] osm0sis:
There also seems to be a server-side switch affecting phenotype involved. That's why clearing Messages data works for awhile but then the RCS failure comes back.
[Magisk] wugga3:
Huh great ... Just great!
[Magisk] 306bobby:
Hey, I PM'ed you a question if you get the chance to view it!
[Magisk] osm0sis:
Wrong person? I don't have one from you that I can see.. :confused:
[Magisk] osm0sis:
Before anyone asks, I already looked through things with this phenotype modding app during the last RCS test ban:

[MOD][ROOT] GAppsMod (ex GoogleDialerMod)

Introduction GAppsMod (ex GoogleDialerMod) is an Android application able to unlock hidden features (e.g., available only in some countries or on certain devices) in Google applications (such as Phone Messages by Google). Root is required. The...

xdaforums.com

...But nothing obvious jumped out as the correct option to turn off the new check. If someone wanted to try something crazy like bisect all the phenotypes to find the right one, they probably could, but I'm not volunteering for that one. :p
[Magisk] 306bobby:
Tuesday at 12:18 lol, I sent you one last week sorry
[Magisk] osm0sis:
Send again? I honestly don't have it in my list for whatever reason. Make sure it's osm0sis not osmosis.
[Magisk] generalculprit:
So just like last time RCS got banned, IIRC.
[Magisk] freeza:
RCS still works. Started adding modules back via apatch
[Magisk] mac796:
I uninstalled updates a few days ago rcs still working for me
[Magisk] sawdoctor:
What happens if you add either of the pif modules?
[Magisk] freeza:
Good question but i don't want to find out lol. Wallet not working for me doesn't matter since I use a galaxy watch for payments. But play store does show not certified.
[Magisk] LLStarks:
I turned off my integrity modules. Back to basic but both RCS and wallet/tap are still working.
[Magisk] immortalwon:
Cached result, will change within 24 hours, if not already.
[Magisk] 306bobby:
If they'd allow RCS without PI I'd no longer care lol
[Magisk] badabing2003:
I wonder what would be the reasoning to allow RCS without PI but not with PI.

It doesn't add up.

People who are report RCS working without PI, are you rooted?
[Magisk] hackthis02:
Now that it's official, I hope we can get this sorted out.

View attachment 6112067
[Magisk] flobo09:
For my part, i see lots of great people working on that both from this side and on the other side trying to bypass strong.

I'm disabling RCS for now. I still believe the great hive mind of the community can find a solution but if they can't, i'll probably move to a 2 device solution in a few months.

If that's the only way I would be great if we could "somehow" stream banking apps & so from the locked to the rooted device.
[Magisk] zfk110:
Hi, I'm using Magisk 27.0 with the Safetynet fix module, but I'm still failing the CTS profile on it. I didn't install anything else. It's G900V S5 running on Android 13. I tried on Android 11 and it was doing the same thing.
[Magisk] HippoMan:
I'm just guessing that there are two different groups, one responsible for RCS, and other for general device integrity, and that they aren't always communicating with each other. I work within an IT organization of a large company, and I notice things like this occasionally happening.
[Magisk] Magik_Malfici:
Check quote please :)
[Magisk] sawdoctor:
Eithe

Either that or Google just likes screwing with us and they all sit there watching this thread laughing at us
[Magisk] GoodyOG:
You have to install a signed rom. Ask the developer.
[Magisk] Nergal di Cuthah:
Get rid of playcurl and delete any pif.json fingerprint's built into the latest module
[Magisk] osm0sis:
The PI team would have to build out the PI backend/internal API to allow the RCS/Messages team to check the contents of the attestation print in addition to the overall result though, so it is really weird that they don't match and have in effect created levels of restrictions within otherwise passing prints. 🤷‍♂️

It suggests that this is still just a short-term test on the RCS side, or alternately, that RCS security is more of a real priority than Wallet security within Google, and could also potentially be another instance of them knowingly letting us get away with some things where they can. 🤔
[Magisk] freeza:
Yeah still rooted.

That's what i was doing with messages on a non-rooted phone but it uses the web interface which sucks. Tablets however use the full messages app to allow all the same features when paired to a phone.
[Magisk] badabing2003:
I always suspected that would be the case, because this mass banning accelerated with RCS picking traction.

However this move goes against it.

Even if what @HippoMan says is true (ie two different groups not syncing) still It adds no benefit to allow RCS with PI failing, what is actually being protected by doing so?

As @freeza says, he's still rooted, so RCS is being allowed with root detected and PI failing, what benefit do they get by banning Sailfish?

Update:

Unless they are gathering RCS device stats through DG and don't want to have incorrect device data in their stats.
[Magisk] zfk110:
With PlayIntegrityFix_v15.9.9.zip, I fail the Safetynet check. With PlayIntegrityFix_v15.9.8.zip, I pass the Safetynet check, but with both modules, I'm still failing the Device Integrity check. I removed the Curl zip and deleted the pif.json file too.
[Magisk] osm0sis:
It's normal for an old banned print to completely pass SafetyNet but not PI DEVICE (15.9.8 contains clark and 15.9.9 contains sailfish).

You may want to double check your kernel release string with uname -r and your ROM signing keys with unzip -l /system/etc/security/otacerts.zip as well.

You might also have a conflict with your ROM if it's got a built-in PI spoof injector app/overlay. My PIFork handles those where chit's PIF does not.
[Magisk] zfk110:
This is what I got. TY
[Magisk] badabing2003:
Your ROM is signed with testkey, the result is expected.
[Magisk] immortalwon:
Useful commands on this post, thanks!
[Magisk] D€INOS:
Seeing the news that Apple is going to support RCS, I think it's safe to assume that this have something to do with it. Something both Apple and Google probably agree on, keep the OS as locked down as possible without outrage. Dont make it impossbile to root, but bad enough that 99.99999% of users dont do it.
[Magisk] Nergal di Cuthah:
[Discussion] Magisk - The root-hiding and mod-hiding cat-and-mouse game

We know that Google supports root per se, while at the same time, they are engaged in ongoing efforts to keep enhancing rooting-detection and modding-detection capabilities in order to make it easier for app developers to know when to cripple...

xdaforums.com
[Magisk] zfk110:
So, how can I fix it? Or do I need to inform the developer of that ROM to fix it? Thank you.
[Magisk] badabing2003:
It's been discussed in this thread.

You either have to get your ROM author to sign and release signed ROM, or you have to build the ROM from source and sign it yourself, or go for another ROM that is already signed.

All the details are in this thread.
[Magisk] ThatOneGuyOverThere:
Unrooting did not fix it for me even with uninstalling updates and clearing app and carrier services data. Was temporarily working but stopped after a minute.
[Magisk] HippoMan:
That could happen if the two teams are not communicating properly.

This kind of thing can sometimes occur even in very careful, highly structured, well-managed, security-oriented companies.

In any case, whatever the reason might actually be for this seeming disconnect between RCS handling and integrity handling, it is what it is, and we have to continue to deal with it.
[Magisk] Nergal di Cuthah:
Was bootloader unlocked?

Bootloader unlock+no root=no basic or device pass (all red)
[Magisk] ThatOneGuyOverThere:
Yeah I figured I'd try it since I saw success doing that was reported.
[Magisk] David B.:
So, does this mean that technically, PIF could be modified to not spoof the fingerprint for when Messages runs the check (let it fail on purpose), but for all other apps, let it continue spoofing?

This sounds like a foolish temporary solution, but maybe it would work? I'm not familiar enough with DroidGuard to know if this is possible.
[Magisk] badabing2003:
I don't think so, PIF spoofs DG not other apps.

If RCS is checking prints through DG, then it will get the spoofed print.
[Magisk] David B.:
Oh yes, I know that, but is the package name of the requesting app included? If so, perhaps that could be used to figure out what to spoof?
[Magisk] Nergal di Cuthah:
Please keep cat & mouse discussion in its thread and only discuss the module and its uses here

[Discussion] Magisk - The root-hiding and mod-hiding cat-and-mouse game

We know that Google supports root per se, while at the same time, they are engaged in ongoing efforts to keep enhancing rooting-detection and modding-detection capabilities in order to make it easier for app developers to know when to cripple...

xdaforums.com

Fixed by awesome moderator THANKS
[Magisk] hochoch:
Just wondering if someone can confirm this for me: if I disable PIF I will lose wallet? But RCS will work again (rooted pixel 7)? Are there any other downsides to disabling PIF other than wallet? Thanks!
[Magisk] David B.:
Any apps that you use that use the Play Integrity API will stop working.
[Magisk] aliantonio:
You're rooted with unlocked bootloader and RCS is working for you? I'm guessing you're still faiing device and basic too since you don't have PIF installed?
[Magisk] freeza:
Yeah. I haven't checked but Play Store status is not certified. I am hesitant to do anything that would break RCS. Although netflix still shows up in the play store to download lol
[Magisk] s1dest3pnate:
Did your RCS start working simply by uninstalling (or never installing) PIF? In other words, have you figured out a recipe to get RCS working (even if other things are broken like play store certification, wallet, etc)?
[Magisk] freeza:
There was an update for the OnePlus 12 North American variant. I reverted boot.img,init_boot, recovery, vbmeta, and dtbo to install it. I booted back up into a non-rooted system. Loaded up messages and noticed not only was rcs connected, but it was also showing rcs in the text box so i sent a test and to my surprise it worked. I then patched the boot image with apatch from the update and patched init with magisk. When I rebooted RCS was still working but once I started restoring all of my modules it broke RCS again and not even removing all of the modules brought it back. So I flashed back the stock boot images again and RCS came back. I then decided to just patch boot image with apatch and no magisk. I rebooted after installing each module to see if it would break and to my surprise it didn't
[Magisk] osm0sis:
Does getprop ro.boot.vbmeta.digest change with either of those patching methods vs. the untouched stock images?
[Magisk] JEANRIVERA:
is your wallet also working on your current setup? can you list the modules you are currently using? I also own a OnePlus 12, I am very interested
[Magisk] mwzdalne:
so if i disable pif, than rcs will work???

Sent from SM-S711B using ReLabs
[Magisk] CZ.Kostra:
Test instead of asking and publish result.
[Magisk] pndwal:
It occurs to me that Google may simply cache last DroidGuard results on server, especially since RCS doesn't appear to use PI verdicts... (But maybe separate PI calls are actually triggered for device registration, RCS etc with the block occurring serverside since prop/field results aren't returned to device with verdict payload 😬.)...

If it is simply caching the last result, since we still seem to have 'dynamic runtime spoofing' (when PI/SN calls are made, since USNF 2.4.0), perhaps just modding PIF to do a second call would do the trick... First, the dynamic prop/field spoofing immediately on app call detected in the stack, next, have PIF make it's own 'fake' call with stock prop/field set immediately afterward just to reset server side caches to proper device values after each targeted spoof...

I'm sorta semi-confident this will work... Worth a shot?... 🤠 PW
[Magisk] Iridule:
Guess the sailfish fp is gone :(
[Magisk] beeshyams:
Not for me, just checked after seeing your post. Pixel 6a, Android 14
[Magisk] esatch:
Not here.
[Magisk] pndwal:
So seems you didn't put PIF back (since don't care about Pay/Wallet)?... Please confirm. 👍 PW
[Magisk] Claus….:
Fine here.
[Magisk] Iridule:
Odd no longer works for me.
[Magisk] osm0sis:
No, that doesn't really make any sense... Fields are spoofed for the entire DG process from the moment of its creation and prop calls are already spoofed globally for those that can and at each check for anything else.
[Magisk] pndwal:
Sorry, but not sure what you mean by "from the moment of its creation"?... I'm not discussing the globally spoofed props BTW; just the runtime-only spoofed ones as I said. PW
[Magisk] osm0sis:
Exactly what I said and what it shows in the verboseLogs 100: After DG process starts the fields get reflected with the spoofed values just the once, and never need to be changed again (on a stock ROM anyway), then each time an attestation occurs any props that are being checked get spoofed in real time, every time (except for the safe global ones that stay set from the boot scripts).
[Magisk] Aregtheeditor:
May a pif update fix this issue in the future?
[Magisk] aliantonio:
Since you know you can get RCS back by patching boot and no magisk, would you be willing to install PIF module to see if you can use wallet and RCS? I also totally understand your hesitation not to mess with things too much but seems like you'd just be in the same boat as you were before and you'd be able to revert back to the apatch method.
[Magisk] Aregtheeditor:
I am using samsung and I don't want to change firmware and stuff stock rom rooted with pif and shamiko
[Magisk] Iridule:
Anyone else lost integrity? Sailfish not working for me still I tried to clear dg cache and restarted but still only pass basic.
[Magisk] bombadier:
Just checked and its still working and am still passing basic and device, in the UK if that is relevant.
[Magisk] Iridule:
Not sure if I messed something up but I cleared DG then I got no integrity so I restarted and updated the fp and now it won't pass.
[Magisk] badabing2003:
If you cleared DG, try running SN and then testing PI again
[Magisk] Iridule:
Not sure what happened, had to reflash PIF module. Works now.
[Magisk] s1dest3pnate:
This worked for me too! There was an update for my Xperia 5 IV US variant. I uninstalled the PIF magisk module, rebooted, installed the OTA as I usually do (by using newflasher tool for Sony devices), rebooted, enabled RCS and bam got the RCS Message box and confirmed was able to send. Then I rooted by using apatch (never heard of it before, looked into it and followed steps to install) and RCS still working.

I could kiss you ;)
[Magisk] s1dest3pnate:
I was so excited to see if RCS would work using freeza's steps that I unfortunately didn't check this. My apologies.
[Magisk] aliantonio:
Would you be willing to install PIF to see if wallet works for you?
[Magisk] ThatOneGuyOverThere:
Got rcs working with apatch and now have basic integrity. Tried to install pif to get device integrity but didn't work and stuck on basic. But in the end rcs is working so I don't mind.
[Magisk] generalculprit:
If it works, that would mean that Messages is detecting Magisk but not Apatch, or did I miss something?
[Magisk] David B.:
I use KernelSU and I also don't have functioning RCS.
[Magisk] s1dest3pnate:
Installed ZygiskNext and PIF 15.9.9 and I'm passing device integrity now. RCS still working and Wallet appears to be working (I don't use Wallet but the app opens up and doesn't say anything about not being able to run on my device).
[Magisk] ThatOneGuyOverThere:
Could pif be made to work with apatch? Also side note is there a way to have a popup to accept or deny when an app asks for root with apatch I looked and wasn't able to find anything?
[Magisk] ThatOneGuyOverThere:
Forgot to install zygisknext now I have basic integrity and rcs working with apatch.
[Magisk] Aregtheeditor:
so I have a samsung A24 stock ROM rooted should I also use zygisknext?(I don't want to tamper with my OS again)
[Magisk] markdewet:
Hi all, So just a bit of info from my side, I have an SM-G955F with RisingOS (A13 but with test-keys), Magisk 27.0, PIF from Osm0sis and Shamiko 1.0.1 300 and Zigisk enabled and RCS and Google Wallet are working for me so far, including NFC payments. Not sure what I have different on my device, but happy to try to find out so if anyone wants to know more, please just ask.