yashsingh1/xdaforums huggingface dataset:
[Magisk] Umgak:
The secret ingredient is lying. Specifically lying and saying we are not unlocked, and are from a device generation that does not support Trusted Execution Environment (commonly referred to as TEE), which would leak our bootloader state at a hardware level, which cannot be spoofed or intercepted with current methods.

The ROM isn't what's locked, it's the bootloader, which checks the integrity of the images and ensures they are not modified. And, to my knowledge, manufacturers are not allowed to be certified without a bootloader that is locked by default.

Short answer: no.

Long answer: The client makes a request to the server to get a token (a big long unique number) that has a limit on how long it can be used. This request contains Play Integrity data, which includes the hash of the requesting app, so we can't make any patches to the app itself. The server returns its verdict and, if successful, the token we requested. This seems to get you a few hours with Wallet, after which you have to get a new token.

If we attempt to "just have it go to the bank," it actually still goes through a Google server, and Google will ask why we don't have a token and deny the request.

There are a bunch of common questions in the PIF FAQ if you (or anyone else) has further questions.

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com
[Magisk] HippoMan:
This is equivalent to the Googlefrinchians starting to require Strong integrity in order for their Wallet and GPay apps to function. Nothing is stopping them, and they indeed could decide to do this some day.

This doesn't *seem* to be imminent, however.

But we can only guess about the plans and motives and schedules of these Telephone Sanitizers.
[Magisk] immortalwon:
One last question guys, which was probably answered already: is there a way to remove "doesn't meet security requirements" in google wallet without clearing the storage of the app, thereby requiring us to re-add credit card?
[Magisk] Umgak:
As I mentioned above, it checks and gets its token, and then keeps it for a few hours. Sometimes this takes as long as 48 hours to release, other times it can be pretty quick. So, your options are to re-add things or to wait. Pros and cons to each, up to you.
[Magisk] osm0sis:
Oh, well that's the equivalent of putting Play Services on an Enforced DenyList, so of course that'll break it. I wonder if there's a similar CLI for disabling?
[Magisk] immortalwon:
Yes but the weird thing is, it's been like that for months and now it just suddenly doesn't work?
[Magisk] osm0sis:
New KSU app (and therefore ksud) update? Maybe it was broken and they fixed it. Or maybe some weirdness with Zygisk Next. What was the default?
[Magisk] Umgak:
I don't see anything for changing mount settings in ksud source. Seems to be all through manager.
[Magisk] oslohes123:
Hi, I was trying to install a build.prop I've attatched it below and I notiecd that I got

Traceback (most recent call last):
File "pif_manager.py", line 1051, in process_props
AttributeError: 'PifManager' object has no attribute 'first_api'

And I do notice that this build.prop does contain a

ro.product.first_api_level = 23 which I thought would satisfy that requirement

I changed that to 25 and now it works for some reason?

But then it gives a similar error to do with keep_unkown

Traceback (most recent call last):
File "pif_manager.py", line 1051, in process_props
AttributeError: 'PifManager' object has no attribute 'keep_unknown'
[Magisk] Matthew3955:
Good day. Your module helped me to use Google Pay, but after a while root rights are always revealed. What shall I do?
[Magisk] Matthew3955:
How
[Magisk] pndwal:
Just like this:

View attachment 6067469

😜 PW
[Magisk] purgy:
Photoshop.

Also make sure that magisk manager is excluded from battery optimisation for your other issue
[Magisk] frank93:
are you trying to "install" the build.prop itself as fingerprint (instead of converting it to the PIF/json-format that’s needed)?
[Magisk] oslohes123:
Ah my wording is wrong

I am using pf tool to convert build.prop into a pif
[Magisk] frank93:
well then -- other than seeing it’s from an old/"banned" fingerprint (the OG asus thing), so i’ll guess it won’t "work" as a fingerprint anyway, i sadly can’t help you with the techdetails (have no clue about those specific errors).
[Magisk] oslohes123:
Are all Asus banned?

I may have missed a post

I don't know if xda forums has a way to search I just this page
[Magisk] purgy:
No, not all are banned, and some previously banned ones may be working again by now.
[Magisk] geekborg:
Hi,

I've just tested the module.

I used to use safetynetfix-by-displax and it always worked. Safetynet worked in BASIC mode in Yasnac but the playintegrity check application displayed "error getting token from Google".

Then I replaced safetynetfix with this module (version 15.7.2) and not only does playintegritycheck still display the same error, but now Yasnac can't get the BASIC attestation.

So I uninstalled this module and went back to displax's safetynet.

My device:

Xiaomi Mi 10T lite (gauguin)

Android 12 e/OS 1.19 (murena)
[Magisk] osm0sis:
You need to start by reading the FAQ

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com
[Magisk] badabing2003:
Please create a support file from PF, you don't have to do anything else, just launch, create support file and submit that in PF thread (see my sig). I can process the attached build.txt without any errors.
[Magisk] V0latyle:
:rolleyes:

Pages · chiteroman/PlayIntegrityFix Wiki

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com
[Magisk] :
Safetynet is obsolete. Concerning your error, see for instance:

Error getting token from Google. · Issue #63 · chiteroman/PlayIntegrityFix

The error message is below. (Not very sure abt if I have to open issue in PFI or the checker) Thanks for your effort! Device: Redmi Note 12 Turbo Android Version: 13 PIF version: V13.0 Play integri...

github.com

But you could have googled that yourself?
[Magisk] oslohes123:
Sure thing Ill do it when I'm next at computer
[Magisk] Wolfcity:
Did some further testing on my second device (Moto G5+). Just to make sure that the issue is not related to the kernel I changed from Lineage 18.1 to Arrow 11, same thing.

So I played around with the fingerprints,still using @osm0sis PIF fork v7 and found out that all prints that I mined manually (around 20) that are working on my main device (Xiaomi Mi 9T running Xiaomi.eu 12.5.2) doesn't work on the Moto G5+ but the latest one from chiteromans build 15.7.2 (cat) worked after migrating the format for PIF fork v7.

Maybe it's not a clever question but why don't 20 fingerprints work on one device and not on the other?
[Magisk] Captain_Throwback:
Did you check the FAQ?
[Magisk] Wolfcity:
I did.

But I will do again if I missed something.

Just to make it clear: I'm not new to this and the print chit is using should (?) work for almost all devices? What's the difference to the bunch I mined myself?

But ok,I will have a deeper look.....

Edit: If you're pointing me to this:

Yes, I've read and understood that.

To be more clear:

It's just the sheer number of prints that made me curious. To be exact:

I'm taking about 26 prints working on my Xiaomi device (and some others too) but not one of them is working on the Motorola.

But ok,it's an old device.
[Magisk] oslohes123:
Here is the support zip

note I did run the process build props once to generate this as I had restarted my computer since building last.

I don't know if you persist this info between restarts but here it is:
[Magisk] geekborg:
I forgot to mention that I don't use the gapps but only the MICROG integrated into e/OS.

Finally the basic attestation works, but I still get the error message :View attachment 6067712
[Magisk] samhhmobil:
If you don't have Gapps, and no Google Play Services, you CANNOT pass "Play"(!)-Integrity. Of course, not! And... you don't need it, because you have no Google Play Environment.

samhhmobil

(even with "gauguin")
[Magisk] zgfg:
PIFoS v1.0
[Magisk] oslohes123:
I've fixed the issue, it was because I hadn't given superuser access via magisk to [SharedUID] shell and I noticed that my device was not showing up as rooted in PF.

I've now enabled that restarted PF and noticed that it's now showing up as rooted, and I built the prop file and it's now building correctly as I'd expect

It's a bit weird though I wasn't expecting that to solve this but it did so hey I guess it works.
[Magisk] oslohes123:
Does this mean that if I have a lineageos kernal no fingerprint will ever give me device security?
[Magisk] pndwal:
For a long time (2 years?) S/N and Play integrity functions were broken in microG, but it got fixed and still works as far as I know with correct configuration... I don't know about micro/G + /e/OS combination requirements however...

MicroG was working by enabling zygisk in Magisk and configuring denylist to hide root from microG Services Core, also enabling Device Registration and Google SafetyNet in microG settings. A working USNF/PIF solution (like @Displax's special USNF build for microG) was previously needed by many users also; I don't know about PIF compatibility... @chiteroman may say...

🤠 PW
[Magisk] geekborg:
i think i need it because I have a gov app (from France) that won't work.
[Magisk] zgfg:
DroidGuard checks kernel name independently of the spoofed props/prints
[Magisk] oslohes123:
Oooh I see, is there a way I can spoof this?
[Magisk] zgfg:
consider the second phone with stock
[Magisk] badabing2003:
Thanks, I'll fix it so that even if you're not rooted, it will at least allow you to process the props and generate json.

Yep, you need to patch your kernel string or ask the ROM / Kernel authors to change / not include their vanity names.
[Magisk] zgfg:
Read the thread on PC or enable Desktop Site in mobile browser and check for instructions among the few Top Liked Posts
[Magisk] badabing2003:
The requirements form one device to another are not the same.

Another reason why some prints won't work on other devices is if the print does not include FIRST_API_LEVEL / DEVICE_INITIAL_SDK_INT / *api_level it will pick the device's, and on the working device it could be a good value (example 25 or lower) but on the not-working device it could be not a good value.

Try to explicitly set it to 25 and see if it fails.

I'm not saying that this is the case for you, but this is one other reason why a prints (trimmed down) won't work on all devices.

Check the keys that the working print has, and make sure you add the corresponding keys/ values to the non-working ones.
[Magisk] dcarvil:
It depends - I still pass with my Pixel 3 running Lineage. "uname -a" does not contain any banned strings for me.
[Magisk] Umgak:
If your kernel's name contains one of the banned strings in osm0sis' post, it will never pass. Not all LineageOS builds contain such strings - I'm on LineageOS 21 for lemonadep and it contains no banned strings.

At present, there is no simple way to spoof this - you will have to actually change the name of the kernel in order to resolve it. You can often hex edit your boot.img to change the kernel name (may need to unpack with magiskboot first), or flash a custom kernel that is not on the ban list. There are also a couple scripts that were floating around earlier to automatically do this on-device.

The list of banned unames we have is not comprehensive, I'm sure there are more banned kernels out there that we haven't found yet.
[Magisk] oslohes123:
Ok Thanks for the reply I've recently flashed a new os and the name its got is

nexus-munch which doesn't seem to be on the list

I'm going to try tommorrow to find a working pif hopefully this isn't banned as well :(
[Magisk] TheRomRooster:
My first private PIF just got banned. For research purposes

{
"PRODUCT": "ether",
"DEVICE": "ether",
"MANUFACTURER": "Nextbit",
"BRAND": "Nextbit",
"MODEL": "Robin",
"FINGERPRINT": "Nextbit/ether/ether:6.0.1/MMB29M/00WW_1_350:user/release-keys",
"FIRST_API_LEVEL": "23"
}

Was on latest osmosis fork (PIF was updated to the new format but i already deleted that one and only found this old backup of it)
[Magisk] remoh:
You can stay with lineageos and change the kernel name:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] _mysiak_:
I just couldn't pay in a shop as I lost device integrity spoof. I am using a different "private" PIF as well, so maybe something else is at play here..?

Edit: found a couple of working PIFs with the help of PixelFlasher and random PIF script
[Magisk] dedalos91:
after 2 months the wallet was working with version 14.8 thanks to a pif. from a friend today it stopped working (I upgraded magisk to version 27 yesterday, don't know if it's related). now I updated the module to the latest version but the wallet is not working, what should I do? hello sorry I have to read here 2 months (I deleted the data from google services). please help, how does the last module work? can it work again?
[Magisk] dedalos91:
I can't do bootloader lock etc now nor can I read much because I'm busy with serious health issues
[Magisk] majorfigjam:
Interesting. Looks like a new level of validation is in play.

Seeing your dead print is Marshmallow I retested my previously working M prints from a brand that someone decided should not be named.

They all now failed device integrity, which suggests that those prints are being targeted.

Looks like Nougat and Oreo are still OK.
[Magisk] dedalos91:
i don't know if i did it right but it works for now, i completely uninstalled the module, completely deleted my custom pif, disallowed and hidden in magisk settings google services (I knew it wasn't necessary but I did it anyway), installed the latest version 15.7.2 of the module and deleted all the their data and it worked and accepted my card, I hope it stays
[Magisk] Broswell:
Hi, can't bypass with MicroG and LineageOS 19.1 (GSI)
[Magisk] bigknowz:
Thanks for the update!
[Magisk] Bladius:
it doesn't work. After entering the command su -c logcat | grep -i snfix and clicking and confirming, nothing happens.
[Magisk] zgfg:
After you start the command, you have to run Play Integrity Checker, YASNAC, and/or other apps (options in TB Checker, S-Check or other apps that call PI/SafetyNet

And ofc, PIF module must be installed, enabled (after the installation of any module phone had to be rebooted(

That's also the way to check if some banking apps (among other checks) test PI

Btw, test first just

su -c logcat

to make sure that logcat is properly running
[Magisk] more_than_hater:
Oneplus 9 pro

Rom: Aospa android 13

Magisk Alpha 26302 + shamiko 0.7.3 (184)

Zygisk enabled

Enforce denylist disabled

Denylist apps selected: Google Wallet and Play Store

A 2 days ago everything was fine, were using Displax 2.4.0 mod 1.3 module.

Yesturday, upon opening wallet app, it started to give popup message that the phone doesn't meet security requirements.

Tried to install PlayIntegrityFix 9.3, sadly still the same results.

Any useful advice?

Logs in attachment

/upd

Forgot to reboot after clearing data of Play Services and Wallet.

Cleaned data again, rebooted and everything is fine.

p.s. don't forget to reboot, it's good for your health and phone.
[Magisk] chiteroman:
Try the prerelease version: https://github.com/chiteroman/PlayIntegrityFix/releases/tag/v9.4

But it's very odd... I don't know why any version didn't work in your device. Maybe Zygisk problem?
[Magisk] dominicsyyy:
installed v9.3 and my BDO Online app (banking app) keeps crashing. reverted back to v9.2, BDO Online app is now working
[Magisk] osm0sis:
Try the 9.4 pre-release?
[Magisk] Bladius:
After running LP it fails immediately
[Magisk] zgfg:
9.4 good for me
[Magisk] chiteroman:
v9.5 released to fix few problems, also I changed to Dobby so the final lib has less size and works in x86 and x86_64 devices (emulators)

Also I removed LTO (https://en.wikipedia.org/wiki/Interprocedural_optimization) because I think that's the problem why in some devices it works and in others it crash GMS processes.

Changelog:

- Added libcxx (official from topjohnwu) -> https://github.com/topjohnwu/libcxx

- Revert shadowhook, Dobby is back!

- x86 and x86_64 libs added.

- Reduced size of zygisk libs.

- New props added.
[Magisk] mcreuter83:
Works fine with Samsung A52s
[Magisk] Kiwi_in_oz:
Thanks a lot. This worked on my Samsung S23 S911B without any issues.

Much appreciated.
[Magisk] dominicsyyy:
tried v9.5, still the same, BDO online app keeps crashing upon opening. i tried to disable shamiko and its now working.

v9.2 + Shamiko (enabled) = not crashing

v9.5 + Shamiko (enabled)= crashing

v9.5 + Shamiko (disabled)= not crashing
[Magisk] FluffyPants:
Thank you chiteroman, it work
[Magisk] zgfg:
v9.5 works for me too
[Magisk] chiteroman:
Seems like linking Dobby lib triggers detection in few apps, I will release a new update with shadowhook again, what a headache 😂
[Magisk] chiteroman:
v9.6 released to fix an important issue.

Changelog:

- FIX DETECTION ISSUES IN FEW APPS (Dobby cause this, so Shadowhook is used again).

- Removed libcxx and use system STL.

- Removed LTO.

- Due Dobby problems and using Shadowhook, x86 and x86_64 libs removed :(

- Added props from original kdrag0n safetynet-fix.

If some apps (like games or banks) doesn't work try to use HuskyDG sensitive_props module.

This module has global spoof of ro.product.first_api_level so be aware of possible bugs if your device has been released with Android 13+

Also you can use Magisk Alpha (vvb2060 project) + private Shamiko build from "secret" chinese Telegram group.
[Magisk] osm0sis:
Uh-oh, why are we back to global spoofing?
[Magisk] magaedy:
Still root detected by some banking apps, Your bulid v9.3 was very good , All updates after that build make root detectable
[Magisk] TheRomRooster:
Currently on a Marshmellow PIF again but it's not from a phone, maybe that's the reason
[Magisk] luciorasta:
Today, after about 2 months, my FP ended up blacklisted.

Using @TheFreeman193 's script and @osm0sis V7 fork, on the second try I found a new one that worked. I just want to thank all the developers for the incredible work that allows us to keep our devices usable.

THANK YOU!!!

I followed the instructions in this post:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] Matthew3955:
Where you get this module? I can't find this in github
[Magisk] sawdoctor:
At a guess inside module prop on either chiteroman or osmosis pif modules.
[Magisk] Claus….:
Some of my prints got banned. Who has the most seldom finger print? (that has worked since November 2023) Anyone?
[Magisk] V0latyle:
It's a joke. There is no Strong fix

Use PIFS to find another print.
[Magisk] Claus….:
Yes, I am interested whether anyone still has prints alive from November 2023?
[Magisk] osm0sis:
My first (November 19 - earliest possible date really) is still good, yeah.
[Magisk] xSnowLeopardx:
Not November, but early December for me.
[Magisk] zgfg:
Look better to the screenshot, it says Dark Web 🫥
[Magisk] Claus….:
From when? November? Which manufacturer?
[Magisk] osm0sis:
See above again. Google. 😉
[Magisk] Matthew3955:
Where or how I can get pif.json
[Magisk] osm0sis:
Start by reading the FAQ.

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com

Then follow the links to resources at the bottom.
[Magisk] majorfigjam:
Around 3 December for my preferred print, based on an old device I had in a drawer. Some of my backups with Marshmallow sources have failed today, but others from N and O still passing.
[Magisk] beeshyams:
My Marshmallow is working except api level is blank and I am on V3 of @osm0sis fork
[Magisk] osm0sis:
Either a new wave of bans, or the rollout of the previous wave (that coincided with the kernel ban which confused many people) is more wide now.

Here's what I said last time:

But either way, seems their "raising the floor" continues.
[Magisk] trevtdogg:
my print from mid december stopped working today.

I also happened to just update magisk only a few minutes prior, so I'm not sure if that was relevant or not.

native api of the print I was using was 25.
[Magisk] zgfg:
Just retested two FPs, one A 5.0.1, the other A 6.0.1 (both by Manufacturer ... whose name was last Thursday removed from a couple of posts) and they both still pass Device Integrity for me

However, I use PIFoS from Dark Web 🫥
[Magisk] m0han:
A quick search didn't fetch valid results. Share here if it's not forbidden.
[Magisk] tom1807:
You should talk with the developer, it doesn't pass ludicrous integrity 🤣

Cheers

Tom
[Magisk] CZ.Kostra:
It will probably drive a few people crazy. o_O
[Magisk] tom1807:
Did you miss this part?

Cheers

Tom
[Magisk] V0latyle:
I prefer Plaid Integrity myself
[Magisk] trevtdogg:
successfully found a new working print, so the updated magisk probably had nothing to do with it.

new print has native api of 29 which works, so hopefully that will be a bit safer for a while.
[Magisk] osm0sis:
No reason to be afraid to update, v5+ will migrate your old file to the newer futureproof format. 🙂
[Magisk] sawdoctor:
Hence why I said he'd edited module prop from either of the PIF mods to change it
[Magisk] beeshyams:
Thanks. I happened to delete all the props files from which I got my prints, so was scared of updating. If it can update without those files, I'd be glad to.

Please educate
[Magisk] trevtdogg:
just update pi fork, it will automatically redo your custom.pif.json and save a backup of the original version.
[Magisk] Wolfcity:
Additional info:

If you have more prints than the one which is installed (that will get the custom.pif.json format automatically as @trevtdogg said) you can use the migrate.sh script which is included in the module to format your other prints (with a file explorer like Mixplorer that can execute scripts) to the custom format. Just put your pif.json together with migrate.sh in a folder and execute the script. You can do that with a terminal emulator too.
[Magisk] beardedwonder:
I seem to have lost 14 self-mined prints in one go, across 5 manufacturers :(

Print had been working since early December.

PIF Fork v7

uname -r = 4.14.288-perf-g749f21a0823e
[Magisk] Wolfcity:
Have you tried to downgrade DEVICE_INITIAL_SDK_INT and api_level?

I had a couple that were on 25 and up, working again with 24 and down. Mostly Nougat props
[Magisk] Gilg@mesh:
so my Lenovo pif I found back in November don't work, got a random one from TheFreeMan193 using Pixelflasher, do they get banned quick too? thinking if I need to start searching for another one.
[Magisk] problemathic:
hi. can someone help me. installed the module and enabled zygisk but on every reboot the play services keeps untick on denylist. thank you
[Magisk] m0han:
I didn't, but @zgfg was keeping on about it, wasn't he? So I was kinda curious.
[Magisk] osm0sis:
That's by design. Putting it on an enforced DenyList wouldn't allow the module to work.
[Magisk] problemathic:
fixed. im on a custom rom. after reading here learned that if roms included integrity fix then no need pif. enabled on denylist and on reboot wont disappear/untick. thanks bro