yashsingh1/xdaforums huggingface dataset:
[Magisk] HippoMan:
Oh, well, at least busybox offers a stanardized wget, but for scripts running on the desktop host, it might not be quite so standard.

Also, I didn't realize that curl is *not* a standarized busybox offering.

So ... I guess wget, after all.
[Magisk] fbirraque:
Already confirmed that the strange behavior when Play Integrity (Basic & Device) certified and NFC Payments (Wallet) stopped works is related with the current "Clark" PIF by XiaomiEU on Poco F3 (alioth), MIUI14.0.8.0 Stable, A13.

After move to a private PIF everything are working flawlessly again- screenshot

Note: Previous post
[Magisk] SOCOM-HERO:
I had to roll back to 15.9.7 using playcurl after updating to 15.9.8 and did not pass Basic integrity. Reverted back and it passes. Any idea why?
[Magisk] Jackychans:
Hello,

I know that Google just banned griffin and new fingerprint(Clark) has been choosen. However, how about I use large number of devices (running PIF with latest fingerprint) to spam google services ? It wont be the case for other apps because we already known PIF only spoof for GMS only, the other apps still can see real device fingerprint

Would it block latest fingerprint (Clark) because of large occurrences? if yes, any resolution to avoid Google detects this repetitive fingerprints occured ?
[Magisk] HippoMan:
Many fingerprints have already been banana-ed by the Googlefrinchians for this very reason.

It's a bit of a mystery as to why that Griffin fingerprint survived for so long, despite its widespread, publicly discussed, ongoing use.

Perhaps someone associated with Xiaomi has an "in" with the Googlefrinchians ... ???

Time will tell whether the Clark fingerprint wiil have the same level of survivability as the Griffin.
[Magisk] majorfigjam:
We don't know how to stop Google detecting high use of fingerprints. However, it can't be too hard for them to notice that thousands of 9 year old Moto X Clarks have suddenly reappeared on their network, replacing lots of Moto Z Griffins, often from countries where they were never sold originally. Griffins had replaced varioous Android TV model fingerprints as the mass print of choice. Sooner or later, they will likely ban Clark too.

Experience since last November suggests that "private" - as opposed to mass used prints (currently Moto X Clark) - last longer. In February, Google banned 95% of working prints. Then Griffin recently died, but my ****** prints survived the last cull. So the better (temporary) solution would be for everyone to have a private print , but there are now not so many of these left.

Work is no doubt ongoing to develop another way to get round Play Integrity checking, eg keybox spoofing, but no one has yet published a working method. Assuredly, if they do, Google will move to block that loophole.

As to your suggestion of spamming Google services, I doubt you would make a difference given the number of devices already using the Clark print is likely already quite high. As I said, it won't be hard for Google to notice the sudden appearance of so many Moto Xs.
[Magisk] CZ.Kostra:
I'm inclined to think that if a lot of different devices with different ROMs are using the same fingerprint, then PIG has perfect group to test. That's why he let 'Griffin' live so long. (?)
[Magisk] zgfg:
Yup, however it's not so easy to fish a private FP

Regarding G, they can easily fish all PI attestation requests coming with PIC or SPIC packet names in requests, the same day and day after they banned Griffin, and they would know for Clark

Nevertheless, they are present here (in person or AI) and also on Xiaomi.eu, and they can immediately spot when the new XEU module is released to the SourceForgeNet - download, unpack and extract FP from the xml file
[Magisk] majorfigjam:
I agree with all of that. I am very lucky that I had prints that survived past 29 February, and also past the latest cull.

If Google really wanted to stop this today, they would do so. They have - or can easily acquire - all of the information they need to identify devices where the print doesn't match the device ID.

I guess the real question is why they haven't done it already.
[Magisk] sawdoctor:
The Pig/Google/whoever can easily find all the fingerprints that are left , they have far more resources than us. They could easily ban them all or block the loophole that allows us to use them.

The bigger question is why they haven't, perhaps they just want us to be quiet rather than get rid of us. If they can keep the number of rooted users low and quiet then perhaps the banks will leave Google alone.

We are all only guessing why they haven't killed all the prints and why they let some last longer than others
[Magisk] zgfg:
To be integrated to the spoofing mechanism :)

Now, the script for automated testing (everything on the phone, no PC/ADB/USB) is extended with TEST_PI="TEST_IAPI" option to test custom.pif.json files also with this Integrity API application:

https://xdaforums.com/t/tools-zips-...tiple-devices-platforms.2239421/post-89482876
[Magisk] osm0sis:
PlayIntegrityFix/module/pif.json at main · chiteroman/PlayIntegrityFix

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com

Oh yeah, I forgot to mention before, but this addition is completely functionless because Play Integrity/DroidGuard doesn't check ro.secureboot.lockstate, which is Xiaomi-specific... 😄🙄

DroidGuard doesn't ever even look at the *.fingerprint props either. 🤷‍♂️

My fork only includes things in the json props that actually currently get looked-at. Latest list here: https://xdaforums.com/t/tools-zips-...ices-platforms.2239421/page-187#post-89390466
[Magisk] Tamsta_T:
Did your "active" (one that was used at a ban time) custom print survive? So far, I'm under impression that survived only those prints that were not in use at that time. If that's a case, custom prints are as good as public print,because that would mean that google has a way to ban all fake prints in real time...
[Magisk] JME HILLS:
Thanks for the comment. Had the same issue. Followed your lead and "hay presto" 15.9.7 works
[Magisk] zgfg:
From time to time G bans those prints that are heavily used.

To be heavily used, they somehow have to be easily available to the masses

Like being built-in to the PIF module, published on some GitHub places, built-in to Xiaomi.eu injector, etc

Just like everybody here and on the other forums, they read where to find them and what they are

Also, by banning them they affect most cheaters with a minimal effort

Low fruit for users (no need to mine) and low fruit to G to ban them

If you (and five your friends) use private prints, they go under the radar. Seems they are not worth of G trying to catch and ban them.

In the big corporations every move must be justified, directed or allowed, and it's not worth to waste time on 'nothing'.

Specially it's not allowed to play with the risks on your own hand, like going to ban the prints that maybe five cheaters missuse, if that could potentially affect thousands of regular users (of those phones, who don't have unlocked BL, etc).

Behind the Production servers they have Staging servers where things have to be precisely planned, tested and verified before changes will be deployed to Production. It's not anybody's private game

Hence it's not about black/white - used or not used at all, but mainly how much used

However, we have seen that they also ban some prints that were not used. Somebody has tested and found N prints, he used only one of them as his private prints, but after some time, by retesting he finds that a portion of those N prints have been banned

But they have not been published anywhere, he didn't share them with others, etc. Seems like certain cleansing on the G side, from time to time
[Magisk] SOCOM-HERO:
No idea why, but have been using that Play Integrity 15.9.7 version and PlayCurl 10.3, which got updated to 10.4 a few days ago and thought why not update to 15.9.8 as well but then it stopped working. Reverted the PIF back and it fixed it. I could drop back to PlayCurl 10.3 as well but no need for now. The FPDownloader APK was killed in favor of a manual user defined timer to do a lookup for FPs, I set mine to 12 hours. Still passing today.
[Magisk] Tamsta_T:
Maybe, but if that would be a case, few (or, at least, very few) active prints would survive google's genocide; so that's my question: does anybody know someone, who's custom print survived?
[Magisk] majorfigjam:
Yes, the current active one survived the latest ban that affected Griffin. It's on various family members' different phones.

The previous active one had worked from November to end February, when it and 95% of the unused ones were also banned.
[Magisk] zgfg:
Of course, I know myself, and few others who similarly posted here
[Magisk] wilsonhlacerda:
Probably you haven't followed the instructions that appears when updating PIF:

If exists an /data/adb/pif.json , then delete it.

And as you were using Playcurl probably you have it.

Delete this file. Optionally uninstall/disable Playcurl module. Update PIF module to newest version. Reboot.
[Magisk] wilsonhlacerda:
Check what I wrote just above.
[Magisk] SOCOM-HERO:
Confirmed, it has been a while since I've taken an update and didn't follow the message on installer.

I rolled back to playcurl 10.2 and PIF 15.9.7 and everything works for integrity. If I upgrade either, it breaks and I don't pass device. What should I do?
[Magisk] wilsonhlacerda:
Confirmed, followed, what I wrote and it works? Or even doing that it does not work? I didn't get.
[Magisk] SOCOM-HERO:
I updated to latest version of both, disabled PlayCurl and it worked.

I tried reinstalling latest PlayCurl v10.4 module with 15.9.8 and it didn't work again. Even after I uninstalled v10.4 same/latest version and deleted the pif.json file, so I had to roll back all the way to PlayCurl v10.2 and PIF 15.9.7. Works again. I'll just keep the old versions so long as they work if that's the case.

So it seems PlayCurl is bunk now or I'm not understanding how v10.4 works. I liked that module for ease of use and not having to manually check integrity all the time.
[Magisk] zgfg:
Please analyze which prints it installs

If it installs the banned Griffin prints or not ab up-to-date json format it will not work

PIF 15.9 8 was released after the Griffin was banned, with the 'new' Clark prints built-in

NO MODULE, method, script as of now would install any really 'private'/different prints, all will install either the (wrong, 'old') banned Griffin or the 'new' (also from Xiaomi.eu) Clark prints - the same Clark that is built-in to the latest PIF (Chiteroman)

So why would you then need an additional module to get the prints?
[Magisk] SOCOM-HERO:
I'll update to 15.9.8 again and remove playcurl for good. I had a collection of private prints, all banned. Got sick of the "game" so went the easy mode route. I deserve this fate I guess. Google stays winning more and more.

I found a useful guide on the play integrity fix next tg channel, got me up and running on the play integrity fork thanks to @osm0sis and back to stable magisk vs. using canary builds. All appears to be running smoothly.
[Magisk] CZ.Kostra:
Check this out: FP XEU Checker. It was created for this reason.
[Magisk] Flr Power:
No FP working at this time. Clark and so on... Ok false alarm, working after a reboot...
[Magisk] Stаr:
Did clark get blocked? It's suddenly not passing on my devices today.
[Magisk] RAZINARES:
Broke again. Not even playcurl works this time
[Magisk] 4sz0m:
Clark seems dead indeed
[Magisk] pndwal:
So Clark is dead... Long live Lex Luthor? (kidding folks) 😜 PW
[Magisk] kornball:
Sheesh only lasted a week. Ugh.
[Magisk] JustinCretible:
Goodnight sweet prince, we barely met and it's already time to say goodbye.
[Magisk] HippoMan:
If Clark is really dead, then I guess that the Googlefrinchians have now joined forces with Lex Luther.

:)
[Magisk] Claus….:
Yeah, seems it is banned :( Will try to reboot.
[Magisk] SchmilK:
I wonder if this extra security crap is related to gearing up satellite sms capabilities.
[Magisk] generalculprit:
If xiaomi.eu has at least as many working prints as some users here, we can play this game for several years at this rate.

Painful, but time enough until STRONG is inevitable.

Hopefully some other solution can be found by then.
[Magisk] Stаr:
Unless they do another mass block like they did in March, which if the previous one is anything to go by, those quick blocks are just the calm before the storm (as if they're testing the blocking method before applying it in large scale leaving only about 5% working, except this time it'd be 5% of the already scarce surviving 5%).
[Magisk] osm0sis:
Right but then why didn't they just do that in the first place? My private print from the beginning of March is still good. Hunting for your own is still probably the smart route.
[Magisk] Claus….:
I guess your fp is working fine?
[Magisk] Stаr:
I edited the message, I think they first test their new "filter" on the popular ones and when they're confident its good they apply in large scale. Which kinda explains why they took so long to act on griffin right after the previous block wave, they didn't have a new filter yet. Idk just speculating, we don't know what goes in G's mind 😁.
[Magisk] wilsonhlacerda:
Probably 5 years if they ban every week. Or 1 year if everyday. Or 3 months if every other hour..... Or sooner if we / Xiaomi.eu just give up.

We do need to find another approach, alternative to PIF.

Or at least what they are using to differentiate an actual/physical device from a faked one/fingerprint only (other props? spoof other G apps?), so can improve PIF that they cannot ban fingerprint without also baning actual devices (they will not do that meanwhile).
[Magisk] generalculprit:
They could block all devices using spoofed fingerprints if they really wanted. The question is why they simply don't instead of blocking print after print.
[Magisk] Eclipse1991:
View attachment 6105432
[Magisk] Stаr:
I think they're just very careful when applying those things at large scale, just in case it causes false positives or something. You kinda have to be when your user base is so large even 0.1% of false positives would affect millions of users. So its safer to do one by one until they're confident its good and then apply at scale.
[Magisk] osm0sis:
They almost certainly let everyone be on griffin so that they could test out attestation-based RCS banning. Who knows what they're up to now, maybe back to banning business as usual.
[Magisk] osm0sis:
Uhhh, uh-oh. I find that surprising considering they had ones we didn't, and we still had ~300 as of last week. Though they may all bear retesting now...
[Magisk] zgfg:
It's not just Clark but many

Private prints I use still ok but I shortly retested 9 of those that were good last week when Griffin was banned and they are all gone now. Have to test more
[Magisk] Vision:
Because with this way, revolution will break out 👀🤫
[Magisk] BunnyPig1:
Oh boy... I guess they had a large number of the remaining FP's so this is really bad news for the short term game we're playing. Looks like the end is near after all.
[Magisk] zgfg:
Retest now and you will see that '300' are decimated today
[Magisk] osm0sis:
I'm sure you're on it. 😋

Check the PM by the way, and make yourself a burner GitHub account for now for the org. We've got another pile to check through if you're interested.
[Magisk] wilsonhlacerda:
The private ones that you were using during last days/today, not in stock, have not been banned, right?

If so, than G is not capable/can not risk of real-time detection and baning yet. They are doing some kind of search and batch ban just like we do to find them.

On current scenario this sounds good.
[Magisk] freeza:
Major oof
[Magisk] SOCOM-HERO:
so we're SOL for now? great. just great.
[Magisk] BunnyPig1:
If Xiaomi.eu's fps has been banned I think google can tell anyway. I don't think they have publicly shown their batch, so this means that google knew about the fps even if barely anyone used them.

The vast majority of people has been using the same fp, I highly doubt more than 15 users has been using the same private fps that's been banned now. Just my thought.
[Magisk] BarackMitzvah:
I'm over this - is there a way to just circumvent the process altogether? Having RCS break all the time is ridiculous
[Magisk] bombadier:
Relock your bootloader
[Magisk] zgfg:
Telling you (?) again it's not real-time, but it's not good. Numbers are scarry now (mortality RATE since the last week)

And for those (so many killed), I can be sure nobody of you used - make your own conclusions
[Magisk] BarackMitzvah:
While you're right, I'm just getting frustrated... needing to give up admin permissions on my phone to use it is insane, and the fact that this is the direction everything is going in bums me out
[Magisk] generalculprit:
I can understand your frustration, but as far as I can see only RCS and walllet are affected? Apps like netflix or games are still installable. At least this would be OK by me, keeping root for adaway, file explorers, backup solutions and terminal emulators.

Edit: you could still get a locked smart watch for paying...
[Magisk] SOCOM-HERO:
I'm considering it, getting a new phone so I don't have to wipe my existing and do a kind of manual transfer/mirror to non-root environment using things like microg and a browser based ad blocker. I'd lose out on other mods though but the root game has become such a massive pain in the you know what over the last 2 years I can't believe it. Been doing this since 2012 casually.
[Magisk] AlexS2412:
i have some old devices, how do i just pull my own fp?
[Magisk] 19blacktiger77:
Same for me, i used the debit card today , i installed the thing of this thread, Google Wallet worked with 2 buy and now is red. But Wallet works, it seems!
[Magisk] BarackMitzvah:
I honestly didn't really even notice much until RCS got thrown into the mix

RCS is such a big deal for folks in the US, and I know we can all download other apps but getting everyone you know to do it kind of defeats the purpose + convenience of simple high quality nessaging
[Magisk] bombadier:
Its banking apps that I am frustrated with and the main reason I havent rooted my tablet as no matter what I have tried I cannot get the Halifax app to work on my phone, google wallet is nice but I still carry a wallet so not a big deal if it breaks. I don't really use RCS messages either but I feel your pain with the whole palaver that is root in '24
[Magisk] BarackMitzvah:
Yep + and honestly I can play devil's advocate and justify blocking banking apps (even though I disagree with all of it), but RCS just seems like someone at Google deciding to be a twat and punish folks who want to be able to actually control their device

Tbh it's frustrating enough that I'd be willing to ditch Pixel altogether
[Magisk] manjaroid:
I agree. For me and my Pixels, Wallet is a luxury, RCS is meh, BFD if I can't have them. Reasons for root vary but I do it mostly for pest control and that matters more than any bell or whistle. If push comes to shove and Google crackdowns get uglier, my ultimate contingency is giving them what they want: a hardened OS with locked bootloader.
[Magisk] generalculprit:
Did you consider "donating" working prints to public, one at a time, as xiaomi.eu did?

Don't get me wrong, I can survive without DEVICE, at least at the actual circumstances, but "having it all" is sure nice.
[Magisk] g33gz:
Let me know if you figure that out, I have a couple older devices and it would be good to use those fp's
[Magisk] mackdacre:
If this is permanent, I'm throwing this phone in the trash and getting an iPhone. If I'm going to be straitjacketed, it might as well be with sh*t that actually works.
[Magisk] sawdoctor:
It's not that straightforward, 99.9999% of fingerprints from any device you own or don't own won't work as they are banned/incompatible with the spoofing method
[Magisk] BarackMitzvah:
I've had this exact same thought
[Magisk] zgfg:
To do or not...

One at a time could extend the life for a month, maybe two (if G does not accelerate) and then what.

It's really bad now
[Magisk] RMS-Stefan:
I paid with my phone(zenfone 7 rooted) 4h ago and I didn't have a problem. The wallet app says that my phone meets the security requirements but in TB Checker it sais only basic integrity is passed. On the other hand my friends phone(also rooted + pixel based rom) it didn't work when he tried to pay ~3 h ago and his wallet app says he doesn't meet the security requirements. It seems strange that on my phone works even though it doesn't meet device integrity. any thoughts?
[Magisk] esatch:
Yes.

Just wait a little more, then you'll be done too...
[Magisk] Lobod:
GMS checks integrity once or twice a day.
[Magisk] osm0sis:
That's not how it works. Read the FAQ please.

It's under consideration.. 😉
[Magisk] Captain_Throwback:
If it is decided to share a print at a time (and I certainly understand if it's decided against), there must be a more covert way to distribute it.

Perhaps there can be some rules around the usage, so that the fingerprint doesn't just get posted in plain text in an easily accessible public repo that makes it simple to identify. Yes, I understand that Google will immediately be able to tell if a bunch of the same old device starts getting checked for Play Integrity over the next several days, but we should at least make them work for it, right?
[Magisk] osm0sis:
That's why I always advocated against it being on chiteroman's or daboynb's GitHub repos in plain text. At least have it only in the release zips or something.. 🤷‍♂️
[Magisk] sawdoctor:
Would you be able to at least let us know how many are left approx? Unfortunately the few i did manage to find after the last mass banning have now been culled too 😞
[Magisk] osm0sis:
zgfg's in the middle of testing currently. We'll keep y'all posted.
[Magisk] SchmilK:
I got RCS back by generating my own pif.json for chiteroman's PIF module.
[Magisk] Eula13:
graphene os doesnt pass play integrity (device) right?
[Magisk] BunnyPig1:
I would advocate for leaving the remaining working FP's to developers and people with knowledge. Letting them have something to work with so we're not all stranded in the end.

I don't know how much use a working print has (if it's even relevant at this point) but having a testing ground for potential workarounds.

I know it might be hard letting RCS, banking apps etc. go but in the end if there is a way to "beat the system", it would be better to just wait, let people to their thing and we all live happily ever after rather than going down in flames with no options just to pass DEVICE for 2 more weeks and then we're all done.
[Magisk] Captain_Throwback:
This would not make my wife very happy...
[Magisk] BunnyPig1:
I know, but sooner or later if we all just throw the FP's away we'll have no option at all. Your wife will be frustrated either way. But to sacrifice a little now might lead to something better in the future for all of us.

Disclaimer: Just a random person's random thought! I have no ability to help so my words have no meaning. Just sharing my ideas.
[Magisk] IBq536XJaWThZsjwwwApTUiV:
Might be playcurl, make sure that is uninstalled
[Magisk] Lobod:
You forgot that Google can fix that exploit all at once and we will be left with nothing on spot. They are just playing with us.

So better is to use what we have til we have it.

Google mostly bans FPs weekly.

If there is almost 300 FPs then 1/week will get us ~6 years of GPay.
[Magisk] BunnyPig1:
Absolutely, but we've been spoiled with the Griffin print as well.

I believe they have the solution for everything. Keeping this game alive is just a benefit for us. Like you say, they could just flip a switch and we're all done. Why do we have a "chance"?

Google has pretty much told us "be smart about the situation", in my eyes that means that we can't continue like we do. They are willing to offer us a chance to find a new better solution so they can tell all banks, governments or whatever is pushing them with this, that they have have done a massive job banning "unsecure devices" to keep them happy.