yashsingh1/xdaforums huggingface dataset:
[Magisk] straightcore:
Now all you need is a simple script that checks the fingerprint from curl, automatically blacklists it, e.g. every 5 hours.

I wonder who it actually makes it easier? :ROFLMAO:

Edit:

Anyway, I appreciate his willingness, effort and perseverance, but ... the road does not lead here.
[Magisk] intel_core_i7:
If our guy hadn't released v14.1 then there are many bigger custom ROM projects out there using the same method as chiteroman's one, e.g. Xiaomi.eu, Evolution X. You will still be doomed anyway. Don't blame everything on him, he's just doing what the others do (playing some devil's advocate here, perhaps?)
[Magisk] dmenezes:
Or perhaps when you reinstalled it, it automatically pulled a new print from @chiteroman's URL as @HippoMan just hypothesed?

No problem and thanks for reporting back! Every piece of data is important in trying to understand this.

Let's wait for further reports about non-functioning v14.1, and perhaps from some explanation about its workings from @chiteroman if/when he can afford the time.
[Magisk] sawdoctor:
I think the plan going forward is to collect a pool of fingerprints and then randomise which one gets downloaded to each user. ATM @chiteroman is testing the method of keeping the json stored online. As this method seems to be working the next step is to randomise the json and hopefully keep Google at bay

At least that's the way I've interpreted it from what's been posted. The other option is what @osm0sis is advocating and all though some users are really struggling with it this method does seem the safest long term.
[Magisk] GabbyWC:
Simply going back a few pages will take you to https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89198237 which indicates that only one fingerprint is being used by v14.1 at this time.
[Magisk] xcl1pse:
The real function fingerprint in this module is to spoof your model to other working phone which is bypassing play integrity check since unlock bootloader = failed device integrity and strong integrity with some exception. Some app like Google wallet using this method to prevent rooted device using that app. In a nutshell, using fingerprint from other device, bypassing this limiter since the device using in this module are from old device and google wallet continue to work. You can read more that topic on this thread or search them on google. But there are bad news, using same fingerprint and massing using them leaning google read that more same device testing integrity check and *banned* that fingerprint (based my observation). So people searching other fingerprint to prevent that happen soon or if fingerprint fails, there's one more to using in this module.

Actually this module depends on your usage. My bank only care about magisk and resetprop, so banned the fingerprint doesn't matter to me, but there's also people using this module because google pay, wallet, etc. So this module and working fingerprint more matter to them :)
[Magisk] HippoMan:
Earlier today, @chiteroman blocked all posting to the TG group and deleted all the thousands of messages that had been there. And then, he just posted a handful of messages of his own which explain details of v14.1.

I just now read the following message there explaining in more detail than I had seen before about how v14.1 handles /data/adb/pif.json. It turns out that I was mistaken about this.

Here's what he wrote ...
[Magisk] xcl1pse:
Since chiteroman always back-and-forth releasing new version with circling method, I noticed if I'm using KernelSU I get zygisk companion crash from this module + ZygiskNext latest version. Another ZygiskNext author noticed this also and say this is module fault (PIF)...

I recommended always check log PIF if your doesn't work or flash again this module or check manually the data in /data/adb or clean flash this module

You can try testing build ZygiskNext from this link btw https://github.com/5ec1cff/ZygiskNext/suites/18510582343/artifacts/1074169138
[Magisk] awarexda:
I updated to 14.1 - I just decided to use the already working FP I found by sheer luck. It seems a bit more risky to use the ones that kindly chiteroman is offering since they will be more widely used....

Fingers crossed!
[Magisk] krkhaha:
Which file should be removed?
[Magisk] beeshyams:
I think there's more factors at play here

I am on this print since it appeared on Tg and still passing.. IDK the criteria for failing
[Magisk] dmenezes:
Yeah, I saw it too. But I've downloaded and looked through v14.1 source code and could not find the part where the referenced URL gets downloaded. This could be just my inexperience with this kind of source code, or perhaps something else is going on.

That's why @chiteroman chiming in on this would be really appreciated.
[Magisk] Ryuzawa:
Hi, would like to ask, after installing Play Integrity Fix, i was stuck in a bootloop, then thrown into recovery mode. i used Magisk Manager for Recovery Mode to disable/remove Play Integrity, even uninstalling / reinstalling magisk but was always met with error "E:Error creating fstab"

Can anyone help me? i use Poco F1 with stock MIUI 12.
[Magisk] d4m4s74:
It's right here:

PlayIntegrityFix/app/src/main/cpp/main.cpp at 18a00f1c1f1fad36ee964dbbe15bda4e34301f49 · chiteroman/PlayIntegrityFix

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com

} else {
std::filesystem::remove(JSON_TEMP_FILE);
system("/data/adb/modules/playintegrityfix/curl -o /data/adb/modules/playintegrityfix/temp https://raw.githubusercontent.com/chiteroman/PlayIntegrityFix/main/pif.json");
json = fopen(JSON_TEMP_FILE, "rb");
}
[Magisk] jons99:
Release v14.1 · chiteroman/PlayIntegrityFix@8bba7b8

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com
[Magisk] dmenezes:
Agreed, I even pointed to a few possible factors in a follow-up message:

I think we need to wait for more data, perhaps the Googler responsible for that took a day off, or is just sitting back and enjoying our confusion?

Let's wait and see, but I still think automatically distributing fingerprints is NOT a good idea.
[Magisk] dmenezes:
Thanks, this weirdly escaped my grepping.

And I just did a couple of wgets on that URL and it's indeed returning the same data all the time as expected, so it's going to be a single fingerprint until @chiteroman updates that file or a new version of PIF with different workings comes out.
[Magisk] smartgirl:
I've been around this glorious forum for a long time although I've been always lurking. Like most people here I have found my tiny treasure of FP and I am currently using them, after I have read most of the 252 pages (currently) of the present thread.

My point is: OK I understand some people can't seem bothered to do the same, but I don't really understand why we should burn out our pool of usable prints because of this. I don't sincerely think modding should be for the masses, but only for the people who have the patience to read 250+ pages of a thread to find out how things work.

So, while I would like to express all my deepest gratitude to @chiteroman for his brilliant tool, I'd like to urge him to stop this pointless killing of perfectly usable prints. If there were a way to generate them indefinitely this would make totally sense. But we all know that the pool is limited and this is going to erode a limited pool of prints even more, at a rate of one every 12 hours.

Also I would like to add my consideration which might invalidate completely what I have written above. Is G *really* banning legit fingerprints to win this holy war? Meaning: one day people with perfectly locked and 'legit' phones (although a few years old) won't be able to watch netflix and do transactions using GPay? Personally I don't think this is what's going on. Are we sure we understand the process correctly here?

And I would like to add my 2 cents here. The same FP from an old, unrooted LG V20 works perfectly in that device while it doesn't on my spoofed xiaomi.

We should probably understand why this is happening... Just my two cents.
[Magisk] HippoMan:
Thank you!! I see what it's doing.

Does this code run only at v14.1 installation time, or does it run every time an integrity check is being performed?
[Magisk] badabing2003:
What's your monitor resolution?

The main screen remembers the last size you set to, is it not remembering?

Or are you talking about the Magisk screen?

That does not remember but I can add that.

You also have a don't setting in the app that you can play with and manage the size.
[Magisk] xSnowLeopardx:
If you meet both integrities but GWallet is failing:

- Delete cache + data of GWallet

- Delete cache + data of Play Store

- Delete cache + manage -> delete everything for Google Play Services

- Reboot

- Tell me the results
[Magisk] rodken:
[Off-topic] My response was more in line with making a purchase from a merchant that you a user doesn't normally shop with. Thus, Discover card can have a bit of a temper tantrum and keep declining transactions.
[Magisk] xSnowLeopardx:
My current FP is still working, but if it fails, I will try any from the other 12 I have saved
[Magisk] d4m4s74:
According to logcat on boot and when you manually kill gms.unstable
[Magisk] Lord Sithek:
Yea, I should be more precise, I was talking about Magisk screen. I don't know about other screens, but if there is something to be done about it, I'll be happy :) thanks
[Magisk] intel_core_i7:
Well, I said this on the previous page:
[Magisk] GabbyWC:
The "12 hours" claim has already been shown to be inaccurate. There's no need to repeat it.

This was asked about and answered in a discussion thread on GitHub. Instead of copying-and-pasting the text, I'll attach a screenshot here.
[Magisk] wfred:
Don't bother with yansac. Google no longer uses Safety Net it's all about integrity now
[Magisk] xSnowLeopardx:
Yeah. They should either use one of the three checkers seen in PixelFlasher or just, which is always my favourite, Play Store settings.
[Magisk] Pheinte:
How can I check the current props being used to pass integrity?

I've added a custom.pfi.json but i'm not sure it's being loaded, since this same custom.pfi.json wasn't working with the play integrity module version from before, but it's working now.
[Magisk] geogaddi47:
Is there any risk from deleting pif.json in data/adb? I have Play Integrity Fix 14.1 installed.
[Magisk] xSnowLeopardx:
No.
[Magisk] xSnowLeopardx:
I mean, you can always use PixelFlasher and check what is in there. BTW, it's pif, not pfi.
[Magisk] d4m4s74:
logcat | grep 'PIF' and then testing integrity shows api level and security patch, that might be enough to see which one it is.

Otherwise killall gms and you should see the whole thing in the logs.
[Magisk] smartgirl:
Makes totally sense, thanks for clarifying that. I missed that post, thank you!
[Magisk] carlese:
The only thing I didn't delete was play services, now it seems to be working. Shame I have to configure my cards from scratch every time but it's better than nothing!
[Magisk] xSnowLeopardx:
Yeah, I have 3 cards in there so it's ok, but if you have more it can be annoying.
[Magisk] osm0sis:
It's been answered so many times... The locked, actual devices don't get banned... Whatever Google's doing they're only banning them for spoofing use... It's in the note I added at the top of my how-to even. 🤷‍♂️

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

Speaking of which, I saw some criticism of my use of the word noob... Anyone who knows my work on xda knows I don't use that word derogatorily, if at all, so using it here was meant in a tongue-in-cheek tone, as I'd hoped the emojis would suggest. 🤦‍♂️
[Magisk] immortalwon:
Not necessarily, Google might have changed their pacing into banning fingerprints due to many people using their own footprints right now.

This does not mean they are going to stop, they are probably formulating a new strategy or may even roll out a full strong integrity system soon.
[Magisk] deechte:
Thanks for the explanation. So if one would use a fingerprint for the actual device one's using, and Google would block that, wouldn't that block all genuine devices of that brand and type? So in my case I have a Oneplus 11. I'd find a fingerprint for a Oneplus 11, Google would block that, all Oneplus 11s in the world would be banned from using Wallet?
[Magisk] nil?:
What are you thinking guys about changing the approach? As far as I remember GPay don't disable payments when the device is offline.
[Magisk] sawdoctor:
Any one who's been on xda for than 6 months knows how much you've contributed and still contribute to development so really DO NOT WORRY about offending anyone 👍👍
[Magisk] osm0sis:
It's still pretty early in California, give them time. 😛

Also would be interesting if they only half-banned them sometimes, in like an A-B test, to sow more confusion. 😏
[Magisk] Johavihan:
We'll, shucks! That's the FP I've been using.

Figured I'd better look for another. I manually edited the pif.json for another make/model and it worked the first time!

The strange thing is that I noticed I'd inadvertently left the manufacturer as "asus". I corrected it and rebooted but then couldn't even pass basic integrity. Switched back to "asus" and it passed again with the mismatched manufacturer.
[Magisk] osm0sis:
Yeah, seems some of the fields aren't enforced at all. I noted that back in my initial testing with the first pif.prop build:
[Magisk] rodken:
The new approach from Google to fingerprinting may have evolved due to its widespread adoption. Instead of an outright ban, they might be exploring more nuanced strategies, such as developing a comprehensive privacy framework that balances user privacy with the needs of advertisers and website owners.

Is their ultimate goal is to strike a balance between user privacy and the functionality of the web?

Remains to be seen.

We'll see if they launch a super-strong privacy system utilizing new algoritm(s) by reassessing its strategies and exploring more effective approaches to address the challenges.

Taking this with a huge grain of salt because this whole scenario is very fluid.
[Magisk] xcl1pse:
If Oplus 11 bootloader is still lock, there's nothing to worry about since bootloader isn't trip and root of trust can verified that devices is legit release from OnePlus and the verdict shows it meet strong integrity
[Magisk] rom-g:
Congratulations for your win at the custom fingerprints tombola. ✌️

And... Sorry for your win at the publicly revealed fingerprints lottery. 😿
[Magisk] i5lee8bit:
There may be something to investigate here... I believe I also noticed during testing that one (or more?) of my attempts did this. It was when I was messing about with testing devices from a particular brand - whose manufacturer line was often something other than the actual brand name - that with the wrong manufacturer info I was able to pass BASIC (but no DEVICE). When I corrected the mistake hoping I'd score another lucky working config, suddenly I was getting the [] result (as in 0/3).

I didn't get as lucky to get 2/3 pass on that particular config, but I was weirded out enough by it to remember the whole thing with having the wrong manufacturer tag resulting in one pass. ¯\_(ツ)_/¯

Edit: didn't see @osm0sis post soon after sort of explaining it in a different way. Nevertheless, there's still a good amount to be understood here, and if indeed some people are passing and some not passing under the same configs, maybe it has something to do with resultant mismatches depending upon the current device / fw each user happens to be running.
[Magisk] makeyourself:
I'd hope that if Google had any plans to to enforce Strong Integrity for every device old and new any time soon, then they wouldn't be bothering to go to this much effort to stop the spoofing of old devices in order to merely pass Device Integrity. But we'll see...
[Magisk] maxmax0:
Ehm... no. Those ROMs are usually piggy-backing on the vanilla solutions, and are not planning to feed their users new fingerprints every 12 hours.

Besides, I am not blaming, but stating my opinion.
[Magisk] sawdoctor:
I don't think it will be Google that enforces it as they already have the ability. Individual apps and banks will start to enforce it and we /Google won't be able to stop them
[Magisk] intel_core_i7:
Nope, they are using the same thing, providing an apk or built a mechanism to connect to a github repo when the current fingerprint fails. The 12-hr myth with v14.1 turned out to be an error on someone's phone, Google did not ban the fp (yet)

Too many comments requesting him to takedown the current v14.1 update, so I thought people were going too harsh on him. The fp pool is still going to deplete by other parties.
[Magisk] HippoMan:
When you delete it, v14.1 will then start using its own supplied pif.json.
[Magisk] Bladius:
after deleting the pif.json file from the /data/adb and /data/adb/modules/playintegrityfix folders, the tests are successful again
[Magisk] rodken:
The adoption of Strong Integrity will likely depend on a combination of factors, including the level of threat posed by security vulnerabilities, the willingness of app developers and device manufacturers to adopt the technology, and the support of users.

Again, whether or not Strong Integrity takes off will depend on a bunch of factors, like how big a threat security holes are or how receptive developers and/or manufacturers are to adopt the tech.
[Magisk] HippoMan:
I'm wondering whether he might periodically change that pif.json file on his github server.
[Magisk] osm0sis:
Yeah that's what he said he'd do, when one gets banned. Doesn't make it any less of a terrible idea. 😛

He's in effect directly supplying prints to be banned, and should know better by now.

I think @arda99 hit the nail on the head:

I'm sure there is a steady stream of donations coming in too, which probably slowed down when the average user was forced to hunt for their own prints, and so he'd want to keep that gravy train rolling...
[Magisk] Klappp:
I'm just wondering if I'm doing something wrong or if the device's fingerprint i'm using is indeed already banned.

I chose the Xperia XA1 Plus: https://www.gsmarena.com/sony_xperia_xa1_plus-8840.php

Found the latest system image and extracted the build.props to fill out the pif.json file like so:

{

"PRODUCT": "Xperia XA1 Plus",

"DEVICE": "G34",

"MANUFACTURER": "Sony",

"BRAND": "alps",

"MODEL": "G3421",

"FINGERPRINT": "alps/full_teak/teak:8.0.0/O00623/1526930659:user/test-keys",

"SECURITY_PATCH": "2018-05-05",

"FIRST_API_LEVEL": "24"

}

Still failed the play integrity
[Magisk] G5-User7080:
welp, if it's not banned already its gonne be soon..
[Magisk] Klappp:
Don't really care. I just want to know if I'm doing it right becuase it's not working for me anyway. I'm gonna find another device.
[Magisk] immortalwon:
Puting aside being foolish enough to post the fingerprint here, I suggest playing around with API level and see if u can get it to work.
[Magisk] Klappp:
I DONT CARE!!! thank you for the suggestion tho. I will try it on ANOTHER DEVICE I FIND. THANK YOU
[Magisk] d4m4s74:
Json structure looks good, but it's probably banned. I haven't gotten any sony devices to work so far either, so try some other brands. Only a small percentage actually works.
[Magisk] Lubo99:
{Mod edit: Post content due to absolutely inappropriate language removed. Oswald Boelcke, Senior Moderator}
[Magisk] rom-g:
I'm afraid that a fingerprint ending in "/test-keys" might not really be a good candidate (But maybe I'm wrong).
[Magisk] LucasBS1:
I read Lubo's comment before it was questionably removed.

Agree completely with his words
[Magisk] Oswald Boelcke:
@Lubo99 While I understand your anger and am generally content with your general statement, I've removed the content of the post as the language you've used is absolutely not acceptable on this platform for all ages. We take it very serious that appropriate language is used in our Forums.

You're a long-time and well recognised member on XDA, and I'm convinced it's not necessary to point you to rule no. 2 of the XDA Forum Rules regarding member conduct.

Please feel free to edit your thread again and to communicate your message but please watch your language. Thanks a lot for your understanding.

Regards

Oswald Boelcke

Senior Moderator
[Magisk] maxmax0:
Simply not true. Xiaomi.eu, which you cited as an example, even completely removed the "fix" from their stable, and only update the fingerprints as part of their weekly release.
[Magisk] badabing2003:
No changes

You can see the history here

But then again he has the tendency to wipe the git history and delete things.
[Magisk] intel_core_i7:
You have been living under the rock. They have been implementing this method on stable release for a few days. Have a look:

MIUI 14 - MIUI 14 STABLE RELEASE

The apk refered to above does the same thing. Hmm. Does it work on MIUI 14 too?

xiaomi.eu

View attachment 6040227
[Magisk] niko26:
So genuine hardware manufacturers have to find their own workaround the GPay issues? Wow!
[Magisk] V0latyle:
People still seem to be confused about this...

Google does not enforce anything, they can't force app developers to use DEVICE or STRONG labels, that is up to the developer

Google does require BASIC and DEVICE for Wallet/GPay but does not require STRONG and most likely never will

The Play Integrity API is a Google product, but all it does is provide an easy to use interface for developers to determine device security state

We don't know which apps, if any, require STRONG but it seems the overwhelming majority of security sensitive apps use third party solutions for root detection and enforcement of device policy; the only thing any of those apps have to do with Google is that they're approved to be marketed on the Play Store, but that's where it ends - many third party apps don't even use Play Integrity

So, bottom line, Google is continually tinkering with Play Integrity because they hope most app developers will use it (revenue stream) but the reality is in the Android ecosystem, everyone is doing their own thing

When we were still on SafetyNet, developers had the option of choosing BASIC or HARDWARE_BACKED attestation type beginning with Android 8 / API 26, and that was 6 years ago; STRONG is basically the same thing, it just means hardware security backs the attestaiton of basic and device integrity

The reason why even Google doesn't require STRONG is that all devices that launched before Android 8 are not capable of it, and with older versions of Android still having an extremely high market share, doing this would mean they'd be essentially preventing a huge portion of their user base from using their payment apps
[Magisk] Lubo99:
frankly I sometimes really dont understand moderators actions. innapropriate lanuguage?? since when is truth inapropriate language?!. I really hoped untill it was removed that someone from google and bank managers will read this!!!
[Magisk] intel_core_i7:
Xiaomi.eu is not affiliated with xiaomi. It's an unofficial custom miui project.
[Magisk] lm089:
Thank you very much for a nice and comprehensive post (y)
[Magisk] niko26:
Ah, thx for the clarification :)
[Magisk] Imperator_Dei:
Hi! I'm new to this thread and tried some fingerprints with pixel flasher, one of the fingerprints worked for half an hour before being nerfed but that's the game I guess, anyway.

My question is : is it possible to still be able to use google pay/wallet without root? I can't manage to get my banking app to work with root and I still need to use google wallet.

I was thinking about setting up the right fingerprints then removing root, but the best thing would be to be able to use my banking app ("Ma Banque" from Credit Agricole, french bank) with root. Has anyone already figured out something about this?

Sorry if this issue has already been addressed already, I only read a few ones out of the 255 pages of this thread