yashsingh1/xdaforums huggingface dataset:
[Magisk] Anchewei:
I don't find anything related to HMA there, but I do find some threads discussing that, so I will move to that and see how people there tackle this issue.

But still, thanks to those who gave me the suggestions!
[Magisk] pndwal:
Yeah... Waiting for a jury to be convened for that too... Hadn't thought about need to hide root/deny modifications from update engine before...

It occurs to me that if @zgfg's speculation that filesystem checks are performed rather than direct block checks (and I'm way out of my depths here), DenyList may actually be needed in this case, but if update engine actually now looks for root, Shamiko (hidelist mode) may work better for your experiments (but knowing that Google doesn't bother with root checks like banks, I doubt this)... Not sure how you can have both denylist (revert modifications) and proper root hiding (doesn't normally revert modifications), but my guess is that simply enforcing DenyList may work for you while Shamiko may not. PW
[Magisk] V0latyle:
I use a PIxel 5 so I'm more or less out of the scene now that my device is out of date.

It's well known that OTA updates are inconsistent on unlocked/rooted devices, and we don't know why. Sometimes they never come up, as was the case on my Pixel 5. Sometimes they download and install automatically, as was the case for many others. The best thing to do to ensure you're updated is download the OTA package from the Pixel firmware pages and sideload it.
[Magisk] shoey63:
How are you marking the slot good? Will simply rebooting from settings instead of from within Magisk achieve this? Is this all canyie's fix does?

I'm predicting bootloop😵‍💫
[Magisk] hadesflames:
Is it just me or did RCS break recently? I'm not sure if it's something to do with PIF but I've never had issues with RCS working before regardless of whether or not I was passing device integrity.
[Magisk] dcarvil:
I have a Pixel 7a, rooted, no PIF. I'm on the Feb. 5 2024 build. When I check for updates it tells me I am up to date. The Feb update was my first update since getting the phone. I did not receive any notice on the Feb update, just manually sideloaded it.
[Magisk] pershoot:
RCS now uses Play Integrity. It will break if you do not pass DEVICE.
[Magisk] kornball:
Someone here even made a Google support thread calling them out, but it looks like Google has since taken it down: https://support.google.com/messages/thread/261416210
[Magisk] samhhmobil:
Hi all,

JFYI...

Since some weeks my device was not certified (after many months without trouble), due to changes from Google.

Update PIF from 15.8 to 15.9.3 (and today to 15.9.4), and the device is certified again, without any other special fingerprint! GREAT!!!

Thanks to @chiteroman

samhhmobil

PS

Xiaomi Mi 10T lite 5G (gauguin)

LineageOS 20 (Android 13)

Magisk 27
[Magisk] osm0sis:
The bootloop caused it to revert to previous slot, which I'd kept rooted (by doing a Direct Install after the OTA and Install to Inactive were complete), so then I used fastboot to switch back to the updated slot, and flash the new patched init_boot and it booted right up.
[Magisk] hadesflames:
Such absurdity...
[Magisk] rogers11:
This means that you would not get RCS even with a non-rooted custom ROM. I could do without root, but not without a custom ROM. A bad strategy in my opinion.
[Magisk] osm0sis:
They must be concerned about the end-to-end encryption in RCS, but it's definitely a sh*tty move.
[Magisk] hadesflames:
I have wallet working at the moment but RCS still shows device not supported. I've tried clearing all storage for messages play services and carrier services but still shows this... Is it just over for RCS?
[Magisk] Vision:
Yeah, i agree with that, but if Google is smart like he say can find a way for all 🤪
[Magisk] rogers11:
Then RCS will also be switched off for all stock Google mobiles that no longer receive updates after a few years? After all, they are no longer secure by definition.

RCS will never establish itself as an alternative.
[Magisk] osm0sis:
Not really the same thing..
[Magisk] casouzaj:
I run LineageOS 21 on an Xperia 1 II XQ-AT52. I use Kitsune Mask with Zygisk, MagiskHide and SuList enabled. For PI I use the latest PlayIntegrityFork and Shamiko 0.7.5 (newer versions don't like my setup). I pass both basic and device Integrity tests. For me, RCS still shows as connected.
[Magisk] FIERA03:
It's been 3 months since I've posted here...

In "Bloody Thursday", Mortals have hatefully crushed even my prop I thought would work for 5 years😡

But fortunately Zenfone 9 runs GWallet for a while even in BASIC (not sure why). I'll do what I can before this ends.
[Magisk] rogers11:
If a custom ROM is to be as insecure as a rooted moblie, a mobile without the latest patches belongs in the same drawer. We will see.
[Magisk] amexH:
DEVICE INTEGRITY started failing last week as for many others. Nevertheless I wonder being still certified in playstore after a week. I performed several reboots and even installed a new LOS (21) in between.

Can anybody confirm this?

device has lost DEVICE INTEGRITY last week

BASIC INTEGRITY remained

playstore still showing device is certified under Settings->Info

Sry, still learning but reading XDA since 2016 and every page of this thread.

Op8Pro, LOS21, magisk 27.0, osm0sis PlayIntegrityFork v7
[Magisk] osm0sis:
You're talking about potential exploits in a device behind on security patches, versus literal root; not the same, but yeah we'll see.
[Magisk] :
I don't use wallet, but RCS is working with passing DEVICE. Looks like a regional limitation?
[Magisk] rogers11:
Same here.
[Magisk] FIERA03:
Speaking of which, here is a follow-up report on the Japanese government app that I had previously claimed was checking STRONG.

They were definitely looking at STRONG before, but since BigG broke the API once in August, it appears that they are now doing their own checks that do the same thing as STRONG. This was verified by a friend of mine who found a STRONG prop that still works, and that it doesn't work in that condition.

In addition, mynumber-portal performs this check only when it recognizes a FeliCa Chip (≒NFC-F) in the terminal.

Our government has very competent developers…👍
[Magisk] hadesflames:
He's talking about a custom rom which is not the same as root. I would argue an old device missing a year of updates is far less secure than a device with the latest version of lineageos and no other customization (i.e. root etc)
[Magisk] rogers11:
I only do this because Google treats custom ROMs in the same way (potential exploits etc.).
[Magisk] Claus….:
Very impressive, how to get a guy such this on your team. This is very impressive if it is really true and not a joke.
[Magisk] Vision:
Yeah, exactly, if it is true. Genius
[Magisk] V0latyle:
I think you're both forgetting that he's doing this on a device that has a broken keystore; this won't work for the vast majority of us.
[Magisk] HippoMan:
I was even able to go beyond STRONG integrity ...

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/page-450#post-89262699
[Magisk] Vision:
Yeah, i remember @chiteroman say his waiting a device with a broken keystore for test and his Xiaomi Poco X3 Pro is normal
[Magisk] :
Such a guy is the thread starter and maintainer of PIF. He's already on the team. He claimed several times to pass STRONG. Doesn't matter if he has a working GIMP module for magisk 😉 or found a special way, it's no solution for all of us. Because it would be banned right away.
[Magisk] HippoMan:
It's too bad that we users don't know of any way to break our own keystores in a similar manner. Most likely, that's impossible ...

... but hope springs eternal.
[Magisk] Vision:
Yeah, exactly we wish can do it for ourselves this
[Magisk] ipilcher:
What makes you think that any of this is actually about security?
[Magisk] V0latyle:
I suspect it has more to do with conformance than anything
[Magisk] InsaneNutter:
Is their a list of known devices with broken keystores? I guess these could become desirable for people who wish to run custom roms and use apps that annoyingly enforce play integrity.

Then again I guess if how it was achieved was public knowledge Google would easily be able to do something about it, so probably doesn't really help with the end of the road for passing play integrity coming closer.
[Magisk] pershoot:
Ensure you are passing DEVICE (use Play Store -> Settings -> General -> Developer to confirm)

Take a Google backup (this will backup SMS/MMS alongside other items).

Use SMS Backup and Restore to backup your SMS/MMS (for precaution).

Turn on airplane mode / wifi off.

Force stop Carrier Data, clear storage cache / data

Force stop Messages, clear storage cache / data

Turn off airplane mode / wifi on.

Launch messages, select your account, it will start recovering messages.

Wait a few minutes, go to settings -> RCS, Enable RCS, it will attempt to commence setup / verification.

Go here and make sure auto-verification is enabled for your device (you may see multiple entries if you attempted a verification multiple times, prior):

Account settings: Your browser is not supported.

myaccount.google.com

In my case, I unselected the multiple entries I had and enabled one entry that was not enabled.

You can send SMS/MMS, for the interim.

Come back to this in ~6-8 hours, and note RCS status. It should finally say connected. While you are there, enable Automatically resend as text (SMS/MMS).

After recovery, if anything appears off / missing with what was recovered, use SMS Backup and Restore for a secondary recovery to gap-fill.
[Magisk] HippoMan:
Back in the Stone Age, it was sometimes necessary to utilize hardware-based procedures to unlock the bootloaders of certain ancient Android devices.

I wonder whether devices' keystores could also be modified/broken with the help of some sort of hardware.

If so, people who obtain this hardware could make some money by offering keystore-breaking services to modders.
[Magisk] pndwal:
Yeah, fix doesn't seem to actually 'do' anything other than to prompt user to reboot via update engine rather than via Magisk... Any Pixel users (late devices) tried that already?... PW
[Magisk] chiteroman:
I have a Mi A2 Lite which it has the Keymaster bug, it will always sign leaf certificate with verified boot, but I don't have the private key neither the keybox.

My POCO X3 Pro doesn't have this bug, but due I will buy a new phone soon (Google Pixel 🙏) I reprogrammed the TEE with an unbanned keybox, then I modified framework.jar to modify engineGetCertificateChain and modify leaf certificate with custom values.

I have the private key so I can freely modify the certificate chain.
[Magisk] Vision:
I think known devices with broken keystores, must have it in your hand to see if broken TEE, since you bought it
[Magisk] casouzaj:
Momo shows my Xperia 1 II's TEE as broken, ever since I unlocked its bootloader.
[Magisk] Vision:
Thanks you for answer. I appreciate.

You're a dev genius.

I wish me too do this but only info can follow (or learn) and some mods
[Magisk] HippoMan:
Certain third-party app developers (especially but not limited to "banking app" developers) do not want their apps to run on Android devices that they *believe* (rightly or wrongly) to be more easily hackable than standard, locked-bootloader Android devices. Therefore, to accommodate these particular developers, the Googlefrinchians came up with this integrity-checking methodology that developers could choose to utilize or not to utilize. This is definitely related to security.

Also, since Wallet is also a money-related app, the Googlefrinchians themselves are also subjecting its use to this same integrity checking ... and again, this is related to the same kind of security concerns.

As for RCS, it is specifically designed to offer more security than old-fashioned SMS.

Therefore, all these items are indeed related to security concerns.

As to whether or not the these security concerns are well thought out and actually *do* provide increased security is a different question altogether.

Also, don't forget that we modders comprise no more than a minuscule fraction of Android users, and it's unlikely that the Googlefrinchian management are even thinking (either negatively or positively) about our comparatively microscopic modding community when making their corporate decisions.

And as I mentioned earlier, the woes that we modders have to experience are generally just collateral damage as a result of those decisions.
[Magisk] sawdoctor:
And is also extremely likely to get hard bricked trying to do it . Mad scientist rather than genius in my opinion. Definitely kudos to him for doing it but he must have spent a lot of time in bootloop and days surfing the net for keystores
[Magisk] ipilcher:
I phrase it as control (who controls the device), but yeah.
[Magisk] Vision:
I get your point, the big brains maybe know how
[Magisk] chiteroman:
A kernel-based root solution for Android | KernelSU

A kernel-based root solution for Android GKI devices.

kernelsu.org
[Magisk] chiteroman:
You can implement by yourself in the kernel if it's open source or you can use custom kernel.
[Magisk] Nekromantik:
i flashed this on my pixel 7 pro stock a14 and now lost hold for me and call screening on phone app

before module it was there and now its gone.

anyone else have this issue?
[Magisk] osm0sis:
On my Pixel 8 Pro I'm using 9.2 still and don't have any issues with those features.
[Magisk] shadowillusion:
If Pi Fix is installed (property modified), will it able to pass?
[Magisk] chiteroman:
I'm using crDroid which inbuild PI fix so I don't know 🤔
[Magisk] niyas90:
I have a working kernelsu on my device. Do i need zygisk next module to be installed before installing this module.
[Magisk] chiteroman:
Yes, this module requires Zygisk.
[Magisk] chiteroman:
More apps are using new and better security checks, specifically bank apps, which doesn't make sense because the transactions run on secure server like Google Wallet so I don't see the point 😂

Official Magisk and Magisk Delta seems very bad options if you want to bypass these checks, I recommend to use KernelSU. Magisk Alpha is closed source so we cannot trust it 100% but it's another option 🤔

SafetyNet and Play Integrity "fixes" are useless if the applications themselves implement their own security systems.

(Private) TEE exploits are our salvation🙏

Note: if you found a way that TEE signs as locked bootloader with verified chain DO NOT POST IT ONLINE. Google are watching threads like this so be aware guys 👀👀👀
[Magisk] Lord Sithek:
why delta is bad in your opoinion?
[Magisk] chiteroman:
I think that Magisk Alpha has better Zygisk implementation than Delta, but if you don't use Zygisk or it works for your needs it's ok to stay in Delta.
[Magisk] osm0sis:
Just use what meets your needs. I don't have any crazy banking apps, just Google Wallet, so Official Magisk Canary, PI Fix for PI/SN, and Shamiko for hiding root seem to have me covered.

Is PI Fix 9.8 seeming stable again for most? I haven't updated from 9.2 since it was working fine since install.
[Magisk] Unn113:
I was using 9.2, and it was working for me for so long, but updated to 9.8 yesterday and all seems fine. Banking apps, and Gpay works. Using official magisk + shamiko
[Magisk] zgfg:
All the same for me. Magisk Canary, PIF, Shamiko and Wallet works.

Plus five (obviously not that demanding) banking, financial and e-ticket e-govermental apps that I use

However, that I have updated PIF to v9.8 but I disabled (renamed them to bak) system.prop and service.sh

I don't need them and btw, this is a Zygisk module, targeting GMS, hence there is IMO no need for general spoofs for the various 'banking' apps.

Those apps use their own methods to detect this and that, those detections are not part of Play Integrity (as in the name of the module) you can never cover them all, and there is always a chance that general spoofs could affect some functionalities
[Magisk] zandatsu06:
It's only a matter of time to them to detect and patch such things even though we didn't post it online, google devs are smart tho
[Magisk] immortalwon:
When you have billions of dollars at your disposal and the backing of the NSA to spy on humanity, anything is possible.
[Magisk] RMD08:
Sometimes some apps that require Google Play Services cannot be opened or internet access does not work for these apps. then I tried uninstalling the module and it immediately worked normally again. I tried installing the module again and the error had disappeared. but sometimes I experience that again.

I forgot to take the log when the error occurred.
[Magisk] sawdoctor:
Have you or any other devs looked at this is yet and is it worth pursuing?

GitHub - abcz316/SKRoot-linuxKernelRoot: 新一代SKRoot，挑战全网root检测手段，跟面具完全不同思路，摆脱面具被检测的弱点，完美隐藏root功能，全程不需要暂停SELinux，实现真正的SELinux 0%触碰，通用性强，通杀所有内核，不需要内核源码，直接patch内核，兼容安卓APP直接JNI调用，稳定、流畅、不闪退。

新一代SKRoot，挑战全网root检测手段，跟面具完全不同思路，摆脱面具被检测的弱点，完美隐藏root功能，全程不需要暂停SELinux，实现真正的SELinux 0%触碰，通用性强，通杀所有内核，不需要内核源码，直接patch内核，兼容安卓APP直接JNI调用，稳定、流畅、不闪退。 - abcz316/SKRoot-linuxKernelRoot

github.com
[Magisk] MarkLev:
My device [Redmi Note 8 Pro] - Android 9 - xiaomi.eu 11.0.2 - have never passed Device-Integrity, only passed Basic-Integriy

I've tried all version from 8.3 to 9.8. Is there anything I could do now?
[Magisk] raptor22:
Facing the following difficulty: Tried all versions from v9.3 to v9.8, on Pixel 8 Pro with stock A14, unlocked bootloader running Magisk.

Having the module installed will cause Google Play Services to constantly fail, and I am unable to open the Google section in the settings app (no force close error, it just would not open). Uninstalling the module would allow the section to work again straight away. The module works fine, but when it is installed, I can't use anything that has Play Services or related to it.

Would like to check if anyone also on Pixel 8 & Pixel 8 Pro can verify the same behavior?

EDIT: Not module related issue, it was another Magisk module interacting with Play Services misbehaving
[Magisk] HippoMan:
They haven't banana-ed my GIMP-based solution yet.
[Magisk] Claus….:
I run a small start-up, impossible to find dev near this. BUT, yes, I fully agree with you! I really like this thread and many of its contributers!

I really hope we end up winning over corporate/google and a like! Libre!
[Magisk] purgy:
Google Integrity Master Plan
[Magisk] vMAC:
Because that is too much work and requires a computer. I haven't tried to update to March, as of yet, but I have only use OTA via Magisk to update since it was fixed on my p7p, before that it worked from p2XL through P6P without issue.
[Magisk] vMAC:
It has always taken me about a week after the OTA post to get my phone to acknowledge that an update is ready. I've also noticed that it will more readily do it on cell service as opposed to my home WIFI (could be do to my pfBlockerNG implementation). So I'll start the checking for an update in a about a week and report back if it doesn't appear.
[Magisk] Vision:
I'm curious to ask @chiteroman with this method you mention with framework.jar and the other, can this method use it for pass strong to old devices because not have strong and only pass 2/3 like a phone with Android 7.1.1 ?
[Magisk] intel_core_i7:
probably not, it still requires TEE.
[Magisk] intel_core_i7:
I can imagine the app will work if you just nuke the whole FeliCa framework in your ROM or change the device region like those Pixels to remove it, because it's software-based these days, no separate antenna required. If original app doesn't function without NFC-F then whoops.
[Magisk] FIERA03:
More simply, it can be accomplished by simply using HMA to hide apps tied to FeliCa.

However, this method will only allow the card to be read, and will not allow the card information to be imported into the smartphone (although this is super high-risk when it's rooted...).

See here for more details.
[Magisk] intel_core_i7:
Not really a problem since you can make a new card for free if you have Japanese IP Address (and SIM Card?).

I have the AQUOS R6 (SB ver, BL unlock not supported) and I was able add Suica and Edy to G wallet. Now I still can add Suica back to it, but not Edy when I clear GMS storage.

I don't live in Japan.
[Magisk] ImjustSaiyan92:
How? Better question, am I able to on a Nothing phone 2?
[Magisk] ImjustSaiyan92:
Yup

Sorted it searching just this thread alone

By all means pile on to the original post, it's what I deserve

@osm0sis keep fighting the good fight mate
[Magisk] HippoMan:
I did it by using a different utility, instead of PI-Fix or PI-Next.

The utility is called "GIMP", and it produces a much more extensive set of results than those other two.

As for doing this on a Nothing 2 ... just use what works on a Nothing 1 and do it twice.
[Magisk] sethieplayz:
Hello,

I just received my P6Pro after returning it for repair. After rooting and setting up just like I had it before, I can't pass DEVICE on any FP, including ones that I know were at least working a week ago.

Any advice? Thanks

Edit: Using osmosis V7, stable android 14 magisk
[Magisk] Nergal di Cuthah:
Please read posts from 29 February til today, all is explained
[Magisk] sethieplayz:
My apologies, it's been a few weeks since Ive logged on
[Magisk] Nergal di Cuthah:
No apologies needed :) just better to read than rehash. In short google banned 100s if not 1000s of prints, few working ones have been found. Many of us switched to the xiaomi.eu supplied print while we search for a private one that works.
[Magisk] sawdoctor:
Hopefully you've read through now. Unfortunately there's been a massacre and only a few working prints left and most of us are using the same print ATM. The thread does tend to go a little OT so things easily get lost.

If you check osmosis posts and chiteromans posts you'll be able to get pif working again for now
[Magisk] sethieplayz:
Very unfortunate. Seems like I'll be trying to find a suitable smart watch, or just using my card from now on.

Edit: The RCS exclusion really throws a spanner in the works, otherwise failing DEVICE wouldn't mean heaps to me. Such a bummer.
[Magisk] Vision:
Oh yeah right
[Magisk] TexnoViking:
Hi guys! I am running LineageOS 21 with Magisk root + Zygisk + Play Integrity Fix v15.8. I am passing attestation, google pay seems to work, but I cannot setup voice activation for Google Assistant. When I go to Google App -> Settings -> Google Assistant -> Hey Google & Voice Match the message says "Hey Google is not supported on this device".

I have tried messing with Deny List, but I think Play Integrity Fix overrides your choices. At least for Google Play Services, so I decided to leave it alone. Do anyone have this problem / knows how to fix it? Thank you in advance!
[Magisk] osm0sis:
That's a GApps issue. Ask in your GApps thread.
[Magisk] :
Yet. Wait 'til they start banning image editors. One. By. One.

Finally, we'll have to draw ourselves!

View attachment 6077306
[Magisk] mumuli:
Galaxy s3 asked their font back
[Magisk] HippoMan:
Yes, but that was done with an image editor, also.

The following will work until they banana paper, pen, and cameras ...
[Magisk] :
S3? New-fashioned caboodle. Since the battery of my trusty Siemens S10 died, I fired up my LG GD510. Devices, that could actually CALL someone. 😉

Take THAT, Google!
[Magisk] 4sz0m:
So they "ban" thousands of prints, but the one print everyone is using now already survived a week. I don't get it.
[Magisk] HippoMan:
It seems to me that they do the mass-banana-ing work only periodically; maybe once a month or once every few weeks.
[Magisk] osm0sis:
Except for that time they did it every day or two (except for weekends/holidays) for a few weeks.
[Magisk] PatrickJK:
My guess it's for them to get analytics on devices that are spoofing the fingerprint more easily. Yeah, they have the stuff in place to detect mismatched prints and all that, but it may be easier for them to have a small amount of working prints to monitor rather than having to scour through every potential mismatch flagged and sort through a ton of different prints.