yashsingh1/xdaforums huggingface dataset:
[Magisk] HippoMan:
Not only is this FP workaround a losing battle due the FP's eventually all getting banana-ed, but also, the Googlefrinchian Telephone Sanitizers are probability going to start enforcing Strong Integrity in the not too distant future, and at that point, contactless payments will simply be impossible from modded devices.

This reminds me of the joke I've posted before:

A guy goes to the doctor.

Doctor: "So, what seems to be the problem?"

Guy: "Well, doc, whenever I move my arm like this, it really hurts." He demonstrates by moving his arm.

Doctor: "Then don't move your arm like that."

The variation of the joke which applies here is this:

Guy: "Well, doc, whenever I try to make contactless payments with my modded Android device, it doesn't work."

Doctor: "Then don't try to make contactless payments with your modded Android device."

In the not too distant future, our only contactless payment options will be these:

(1) Get a second, non-modded device for making contactless payments.

(2) Only use bank cards to make contactless payments, and don't even try doing so via a mobile device.

(3) Stop using a modded Android device altogether.

I, for one, opted for alternative #2 years ago, long before the Googlefrinchian Telephone Sanitizers' recent changes in integrity checking.

Sadly, we all will just need to get used to having only these three alternatives ... the sooner, the better.
[Magisk] thomaskmaagaard:
I'll be looking at Android watches. I assume this will still work for payment even if linked to a rooted phone.
[Magisk] laolaxyz:
or use your watch... (my Fitbit did work when wallet wasn't working)
[Magisk] david2089:
I don't think the problem is the FP, I think DEV v1 stopped working. this version added BUILD_ID and VNDK_VERSION to the pif file, which made everything work, I've forced play services to recheck integrity few hours ago and got "DroidGuard detected!" in the logs
[Magisk] rfgamaral:
I'm honestly tired of this cat and mouse game, and since I've got a Pixel, I haven't modded as much, nor I use root as much, so I'm thinking of going with the 3rd option myself. If only I didn't need to reset the phone and set it up from scratch to do that, I would have done it by now.
[Magisk] HippoMan:
I'm thinking of investigating something like that, as well: get a cheap, used smartwatch and only use it for telling time and making contactless payments.
[Magisk] xSnowLeopardx:
Why not tell at 5 that 14.0 still exists? I am still using that one, with my first ever FP, all working well.
[Magisk] sezuan:
Is it possible to tell what 'few hours' usually mean? Google Play says: BASIC_INTEGRITY and DEVICE_INTEGRITY, but Google Wallet refused to work.
[Magisk] Fishawy:
This is meant for newer releases. Starting from 14.2, custom fingerprint support is removed as per the Github notes.

I had to wait 24 hours before, but I've seen reports of less time. Hopefully it doesn't take that long with you.
[Magisk] thomaskmaagaard:
Try clearing data for wallet and google services, reboot and setup wallet again. If you pass basic and device then it should work. Otherwise, waiting ~24 hours should cause wallet to recheck and work again.
[Magisk] sezuan:
Thanks. I'll try to wait first. I was just wondering, because until 14.2 it just started to work after updating the module.
[Magisk] Lord Sithek:
Yea, they work. I've rooted my TWP3U before but in the end I came to the conclusion that root isn't much of an advantage there so I relocked bootloader. And no issue with payments whatsoever, even when my connected rooted phone failed Play Integrity
[Magisk] xSnowLeopardx:
Yeah, I always clear data, since my 3 cards are set up within minutes. Can't wait for random x hours to go by instead.
[Magisk] xSnowLeopardx:
Ah, well then... I'm gonna stay in this 14.0 boat until a kraken takes me down! (Felt a bit PotC there.)
[Magisk] mike.s:
I don't see what difference that makes. The FP will be the same for all devices of the same make/model/version. If an image of the firmware on your phone is available on the web, so too is the fingerprint. It's not like your phone is a one-off with a proper fingerprint, unless you work for a phone manufacturer and have some sort of prototype.
[Magisk] Fishawy:
Only reason for me to wait is how stupid our transport pass card system is set up (doesn't transfer or even read from a physical card), so I end up losing money if I add a new one.
[Magisk] zgfg:
Whenever you think of a group where every frustrated noob can be accepted and where everybody can then get working JSON(s) or in a structured config form.or in an excel table or whatever, or even as an URL to grab one at a time randomly from a pool:

How would you verifiy that the noob, with no eg history on XDA or anything is not a G boot, tester from G side or just somebody who will forward or publish further, or even sell

You may put a big sticky notification Do not distribute - how many noobs have read the post #1 before they asked

Hence forget all those published working configs, no difference if they were on the PIF GitHub, in the PIF module or published here in this thread, they will be burned/banana-ed soon from the G side
[Magisk] zgfg:
Per my experience, Wallet may have a cache of 6 or 12 hours

Ad said, spoof was banana-ed before noon, and I was still paying by Wallet late afternoon

But Google can update the Wallet or change something on the Server side and it can become much shorter

Also an IMPORTANT notice: I just used Wallet to put the phone close to NFC terminal and to pay

I didn't go to open Waller manually, I didn't test can I still add cards etc - in that case Wallet will probably ignore previously cashed results and will immediately request a new PI Attestation, hence in that case forget the cached grace period
[Magisk] chichino84:
Definitely not related.

Installed that Wallet update - along with a Play Store one too - yesterday and everything still fine here.

v14.0 custom FP
[Magisk] xSnowLeopardx:
^ same boat.
[Magisk] osm0sis:
Yep, mike's got it right. There's a common misperception that it's a unique fingerprint on each physical device. That's why I emphasize that it's a ROM *build* fingerprint in my guide.
[Magisk] thomaskmaagaard:
Yeah, I'd still hoped that a less common phone like Asus, with whatever build installed, would be too obscure to be FP farmed already.
[Magisk] mike.s:
Well, the fingerprint included with 14.1 was from an Asus, so there's probably lots of searching going on with those.
[Magisk] rodken:
Don't be discouraged from performing the duties on your device granted that you are meticulous and pay close attention to any defects within the lines of codes.
[Magisk] thomaskmaagaard:
What are the chances it's the same build😂😂😂
[Magisk] mike.s:
Based on your results, 100%.
[Magisk] michasssxdd:
Version 14.2 and I keep getting a message that the phone does not meet security requirements. How to fix it?View attachment 6040889
[Magisk] Depressed T.Bear:
I don't think it's that simple. Even a locked bootloader (custom rom + magisk) is unfortunately not making any difference in the current situation. 🤷🏼‍♂️
[Magisk] sawdoctor:
Also as many people have said there are fingerprints working from device's that shouldn't be working too
[Magisk] zgfg:
How do you install a custom ROM and Magisk with the locked Bootloader?!

Fastboot does not allow flashing custom ROM, custom Recovery, patched boot.img or so with the locked BL

Rephrasing:

Even if you flash in EDL mode a custom ROM or boot.img patched by Magisk, locked BL should not let you boot to

Unless an obscure/historical phone...
[Magisk] RichyRicho:
I get less points 🙈
[Magisk] RichyRicho:
So here's a strange one.

Using 14.2, everything passes and wallet doesn't throw an error.

Try to pay, it declines, pay with the same card physically, it goes through.
[Magisk] intel_core_i7:
Well you have pixels with avbroot
[Magisk] shailantani:
Hi first off, this guide was extremely helpful!

Just one doubt (sorry its a super dumb one)

In the last set of instruction, we have to select donor build.prop file right? Could you help me in explaining what the "donor build.prop file" is and how I can get it?

Thanks a lot!

Edit: Just found it on this thread, my bad :)
[Magisk] fbirraque:
I didn't updated to the latest Xiaomi.eu build that has in house fix through APK. Still using the No Play Integrity Stable REBUILD v2 from them.

But after a few days using the Play Integrity Fix by @chiteroman (PI 14.1-resetprop) I noticed that after a few hours without reboot my device the banks apps can detect the root Do you notice some behavior like that in your device? Or any input why could it be happen?
[Magisk] ipilcher:
I wish it were just banks. Or banks and Netflix.

All I want to do is log in to the frippin' American Airlines app and my chosen Reddit client (Now for Reddit).
[Magisk] badabing2003:
First bullet point in what you quoted
[Magisk] V0latyle:
Build.prop is the file in ROMs that contains a lot of the properties and values about that ROM. It is the file from which we get our custom fingerprint, and is therefore a "donor".

The way this fix works is that we are spoofing (faking) properties visible to Play Integrity to make it think it's running on an older device that cannot provide hardware backed attestation. Since most of us are running on newer devices that CAN provide hardware backed attestation, we are using firmware from older devices to "donate" the print we want to spoof.

Make sense?
[Magisk] V0latyle:
Locked bootloader should also prevent modified images from loading so firmware would have to be pure bone stock otherwise phone would be a brick

unless as you put it, this is one of those devices that doesn't follow "the rules"
[Magisk] ipilcher:
Not just Wallet. Every app that checks PI.
[Magisk] intel_core_i7:
That being pretty much any pixel device
[Magisk] V0latyle:
You're joking, right?

Pixel devices are basically the Android prototype.
[Magisk] mike.s:
Guessing you missed the reference to avbroot.
[Magisk] ipilcher:
Searching for "build.props dumps" isn't turning up anything useful. (I've tried both Google and DuckDuckGo.) So I'm working from the well known ROM dumps site.

I've been trying to follow osm0sis's guide, so I've been trying to choose phone models (using information from GSMArena) that seems like they're from the proper period, were released with the proper Android version, etc.

AFAIK, there isn't really any automated way to troll through the various repos on the ROM dumps site. (The repos are far too large to be cloning all of them.) So I have to figure out where the various build.prop files are in my selected repo, download them, look for the required properties (which aren't always there and seem to have more than one possible name). The variability in file locations and property names kind of kills automation for that part of the process.

I have automated the process of copying the JSON file to the correct locations and killing the GMS process, but I haven't figured out a way to automate the PI check. (Any idea how PixelFlasher does it.)

Given the number of manual steps in the process, trying to be somewhat intelligent about which ROMs to check seems reasonable.
[Magisk] intel_core_i7:
avbroot exists, and you have calyx and grapheneos running with that self-signed bootloader status, I thought you must have known this before...

Or did I get your words wrong, since I don't fully get it
[Magisk] Yahoo1:
Using the latest Wallet 23.46.585681855 with custom FP and all is good and working. Thanks @chiteroman and also @badabing2003 and @osm0sis for making this possible. Great work
[Magisk] Lord Sithek:
Basically it uses one of the three Play Integrity checker apps, which must be installed on your device
[Magisk] manjaroid:
Pretty much my experience too, particularly API levels. Figuring Google probably places dump sites in the bottom half of an infinite scroll, I tried DDG and found a source fairly quickly.
[Magisk] maxmax0:
Different use cases have different security requirements. Nothing bizarre about this.
[Magisk] sezuan:
Although Google Wallet says under 'Setup wireless payment' (or how it's called in english) that the device doesn't meet the security requirements, I could pay wireless.
[Magisk] Umgak:
Custom root of trust causes yellow boot state, which is still detectable especially with hardware attestation. avbroot isn't a magic bullet.

Updated. ro.product.name, ro.build.product, and ro.product.device are all the same value on the device I've been dumping from, lol.
[Magisk] V0latyle:
I've heard of this but am not familiar with it, I'm reading now

This ability is provided for in AOSP:

User-settable root of trust

This is the mechanism that GrapheneOS and CalyxOS use when locking the bootloader. They install a custom root of trust with a key that's been used to sign the firmware images, so Android Verified Boot operates as intended.

I honestly don't know enough about the workings of Android to say whether such a configuration would be able to provide hardware backed attestation. I don't see why it couldn't, so long as the device profile is CTS approved. But others including @pndwal and @osm0sis can weigh in on this. I assume it has something to do with Google knowing OEM keys.

Ok, so it looks like AVBroot signs rooted images with a key and installs that key as the custom root of trust. As @Umgak mentioned, the bootloader will report that it is locked with a custom key and not the OEM key: LOCKED devices with custom root of trust

According to this, the verfied boot state is stored inside TEE:

You'd basically have to hack the bootloader.
[Magisk] maxmax0:
Exactly this. AVBroot makes the user more secure by preventing certain attack vectors unlocked devices have. It does not give any reassurances to the apps about the environment they are running in, which is why it is completely useless for bypassing integrity checks by wallet etc.

Prerequisite to the green checkmarks are a locked bootloader and a boot image signed by vendor private keys, not keys the user rolled himself.
[Magisk] xSnowLeopardx:
That's very interesting, given how that sentence has jump-started me with this process.
[Magisk] SOCOM-HERO:
pixel 8 is on sale now and you could copy your files over before resetting/trading in your current phone. thought of this myself if this saga continues the way it appears to be going. for now I have a working print.
[Magisk] wadams1:
is there a way i can pull a fingerprint from an old Motorola device?

i have a couple of phones I used to use for wireless android auto host that are just sitting in a drawer. If i can use them, is there a guide on how to extract the fingerprint and import it into my pixel 5?
[Magisk] ipilcher:
Well ... it does turn up a few links to the ROM dump site that I'm already using. Is that what you're thinking of?
[Magisk] V0latyle:
True, and the problem with locking bootloader on self signed rooted hardware is sstated in avbroot documentation; with root access you can potentially modify the images installed to the device, meaning they will no longer match the keys they were signed with, therefore the device won't boot. If OEM Unlocking was ever disabled, this results in a hard brick because you can't unlock the bootloader to fix it.
[Magisk] BROKEN1981:
That's all that dev uses. That's why I don't bother with Asus prints. Now I kinda think you picked the same print he's giving everyone lol
[Magisk] rfgamaral:
That's assuming I want/need a new phone, which I don't.
[Magisk] thomaskmaagaard:
I was gonna check that but v14.1 was removed from the github so I can't compare.
[Magisk] SOCOM-HERO:
same boat here, I have a P7, which with the A14 upgrade completely changed the battery performance for the better so I'd rather keep it another year. I don't really use tap to pay much, but am worried they'll deploy either strong integrity or force app devs to use their method for things like banking apps in the near future. is that what this announcement is about?
[Magisk] V0latyle:
Yep, enable USB debugging and use getprop in ADB shell to look for the various properties
[Magisk] jabennett:
And Asus starts with "A," with lots of people likely going down an alphabetical list. Maybe we should be looking at ZTE phones... 😆
[Magisk] V0latyle:
It is possible that previously used prints may be reused by changing the API level...

Regardless, AFAIK everyone who started using custom prints when PIF first had custom json ability are still passing

I wish @chiteroman would pay attention to this and stop using bundled prints with his module and instead force everyone to use custom prints

The only alternative for this would be to have the module randomly pick a print for each instance so that we don't have hundreds or thousands of people all using the same print
[Magisk] __init__:
I don't have time for all this can google just make my phone work please
[Magisk] sawdoctor:
Unfortunately his telegram group is a total joke with fingerprints shared wily nilly
[Magisk] thomaskmaagaard:
I don't even think this is feasible. The prints would need to be tested, limiting the amount of prints that can realistically be bundled. With a limited FP count it would still be obvious too Google which prints they should ban. And a list prints would need to be in a database, somewhere, which would make it searchable.

No matter how you look at it, a bundle of prints, somewhere, will just be a target and will help google eliminate prints faster. Just look at how Telegram groups are churning through prints.
[Magisk] V0latyle:
And that is precisely the problem. Ready made "flash and go" modules result in print bans. You need to find your own print. If you're not willing to do this, either deal with the consequences or go back to stock and lock your bootloader.

Yeah...I mean if everyone is using different ones it's probably OK but still that's not exactly secure lol
[Magisk] V0latyle:
Right. However I'm not sure they would go this far. It would really help to know exactly how they're detetecting prints in common use. That being said, Google does like to tap into the young coder/hacker/developer scene for talent so I wouldn't be surprised if there's more than a couple enterprising individuals over there who have started making a name for themselves by actively working to defeat prints in known use....In other words, since they attract a lot of young tech heads, I'm sure a few of them may be XDA members, or at the very least are trolling this site, Reddit, and the TG channel checking for prints
[Magisk] xSnowLeopardx:
Can "Google" make your phone work? That's a really interesting sentence.
[Magisk] __init__:
Sure they can, they made it stop working didn't they?
[Magisk] jnss98b:
Where you're going wrong is running a PI attestation lol. 14.2 will be cut down to MEETS_BASIC_INTEGRITY again tomorrow I can promise you that.
[Magisk] ELAD098:
What do you do when the bank's applications no longer work? does It was working before and now it detects that the device has been rooted

I did the hiding magisk and it didn't help
[Magisk] V0latyle:
No....You did, by unlocking your bootloader and rooting. Play Integrity is working as intended.
[Magisk] thomaskmaagaard:
This is simply guaranteed.
[Magisk] mike.s:
Google was the one who unlocked and rooted your phone? That's so much easier than having to do it yourself.
[Magisk] amk316:
next step

buy an iphone
[Magisk] V0latyle:
That may not be the answer you want, but it is what it is. Play Integrity is only suppoed to give "correct" responses on locked unmodified devices. Unlocking and modding (root, custom firmware, etc) comes with the risk that things may not work as intended. We all knew that when we unlocked our phones. Play Integrity is one such risk. There is a way to get it to work, as described, but it has become clear that the ready-made solutions end up getting banned sooner.

I generally don't encourage people to join Telegram channels but as others have mentioned there's a lot of prints being traded there.

Ultimately, the reason why we are dealing with this is not because Google broke anything or did something wrong; they are improving their own proprietary product, and we have to be smarter in order to defeat it. So, you have to accept that you aren't going to pass 2/3 Play Integrity verdicts without being willing to find your own print and use it. If you aren't willing to do this, your only options are to either accept it, or fix it by going back to stock.
[Magisk] V0latyle:
Right. Buy Apple-proprietary hardware that will only run Apple proprietary OS and can only install Apple approved apps from the official Apple store. Why anyone would give up the freedom of Android for the walled garden of Apple is beyond me.

You can argue that Google is trying to create their own walled ecosystem, but that argument ONLY applies to Google Mobile Services, not Android on the whole. Google is one of the only companies who has remained committed to providing unlockable devices through the Nexus and Pixel line. I hate defending them because I think Google is wrong in many other areas including privacy and censorship but I'm tired of the dishonesty and misattributed malice being thrown around in here.

Regardless of what Google does with GMS and Play Integrity, the AOSP program remains free, open, and developer friendly.
[Magisk] __init__:
All I know is my phone worked a month ago, it doesn't work now, and it's because of something Google changed. Couldn't care less what PI is "supposed" to do since Google and I seem to fundamentally disagree on what computers are "supposed" to do.

I have a Pixel 4a that I'm not using. Will using the fingerprint from that work, or is it too new?
[Magisk] krkhaha:
Great job bro but there is no point in using play wallet wit root at this moment. Many times I had situations at shop Google wallet was stop working. Today is okay and tomorrow again will be problem.
[Magisk] V0latyle:
Well...again...your phone isn't doing anything "wrong" besides the fact that you intentionally disabled some security features, and Google Mobile Services/Play Integrity isn't doing anything "wrong" because it's (correctly) reporting that your device is unlocked and modified. Google doesn't force apps to use certain verdicts nor does it force phones to be locked. Not very many apps use Play Integrity as it is.

From what we've been seeing, the prints have to be from phones that were launched before Android 9, but have been upgraded to at least Android 8 during their lifetime. The 4a was launched with Android 10, so it should be too new.

However...

@shoey63 managed to get a much newer print working from a newer Pixel device, you could ask him.
[Magisk] shajman:
So it's finally fixed :rolleyes:

And think I might know what the issue was.

So last night I wasn't aware that G had blocked the 14.1 Fingerprints. I was in a store and tapped my card to pay. Got the security msg and wallet wouldn't work.

I then, while in the store, proceeded to update to 14.2. Rebooted. Checked that both Basic and Device passed (via Playstore) and proceeded to tap my phone again.

This time the payment went thru, but the merchant was asked not to authorize. And then I got two msgs from my bank. One deduction and the other a refund. And a message from wallet saying the transaction had failed.

Which is when I proceeded to check my 'Tap to Pay Setup' screen which showed the msg I had shared earlier.

Earlier today, that security error was still showing on the Tap to Pay Setup screen. But I decided to try paying via my phone anway. Lo and behold, it worked 🤦‍♂️

And a little while after that, the security message was no longer there either.

So I think it had something to do with using Tap to Pay so soon after the first security error last night. At least that's what I think.

Thanks for going out of your way to try and help 🙏
[Magisk] xSnowLeopardx:
I'm glad it's good again now. Let's keep it that way ;)
[Magisk] jabennett:
"But my hacked dishwasher suddenly stopped washing my clothes!" {shakes fist at manufacturer} 😤
[Magisk] xSnowLeopardx:
hacked dishwasher LMAO

That's one hell of a parable.
[Magisk] jabennett:
To be fair, it's more like, "My dishwasher stopped washing dishes after I took it apart and rewired it to also make coffee. Now I can't even do dishes! Stupid manufacturer, I should've just bought a refrigerator." 😭