yashsingh1/xdaforums huggingface dataset:
[Magisk] Imnoa:
Next in line to be banned: NVIDIA Shield for Android TV.

I appreciate your efforts providing fingerprints but I think we have reached a point where people will have to find their own FP.

Say there are 100 working fingerprints left, if 90% of the people use the same print which is also specified in your repo google will notice and ban it.

It's better if people find their own print, so that the used fingerprints are more evenly distributed, the used prints are not in some public repo and the chance of them being banned is reduced.

It's not an endless resource so we will have to be careful not to get them banned one by one. There have been great instructions on how to find, test and spoof a fingerprint.

If people really need to pass integrity and keep their device rooted they will be able to find one, you just gotta put some effort into it.
[Magisk] dosbuddy:
New double speed burn:

xiaomi.eu (Module_2023.12.11) and @chiteroman (PIF 14.3) are using the same fingerprint!
[Magisk] zgfg:
One more banana-fp (burned out by G) on XiaomiEU side today
[Magisk] sawdoctor:
Tbh that's a good thing better 1 fingerprint burnt than 2
[Magisk] Imnoa:
It depends on the rate you're burning them, my guess is this one won't even last a day.
[Magisk] Fishawy:
I'm sorry, but I have to ask.

Are you worried at all about the day when all fingerprints are permanently banned because of this (and Xiaomi)? Are you going to continue releasing then burning then releasing until they're all gone?

No disrespect, we just need to understand your plan on this so we at least have a clear idea of what to expect.
[Magisk] zgfg:
In the Playstore and all other apps you must see your orriginal, device details

PIF spoofs only for DroidGuard and that is not visible in Playstore, actually not visible anywhere but in the logcat.
[Magisk] mossywell:
Ah right. Didn't know that. Thanks for the explanation.
[Magisk] Compass Linux:
Thanks for the offer, but if I start using working PIF's directly my PIF training will decay. 😅

But I'll leave here a fingerprint for the Google Bunnies to test:

Compass.
[Magisk] Imnoa:
Agree, but I also know for a fact that if chiteroman stops providing prints someone else will fork the repo and keep providing prints.

It's better to instruct people how to find and test a print (Yesterdays Pixelflasher release is great for that, you just point it to a build.prop and it will create a pif.json, put it in the right folder in your phone and test it)
[Magisk] Imnoa:
I was gonna ask you to remove it until I checked the print lol
[Magisk] msi68:
People there are enough wise to find their own custom fingerprint, thanks for DEV-v1 release. As we have seen here custom fingerprint is the only working solution.
[Magisk] Fishawy:
I've had my custom print weeks ago, and people have been sharing the how-to knowledge on this thread (to which I contributed to) since this whole thing started.

I'm asking what his plans are, to see how we - as individuals who worked hard for this thing - can try and secure ourselves more.
[Magisk] zgfg:
Btw, another question - are you on the latest Xiaomi.eu Stable, and what device

Does everything work fine for you with the XiaomiEUInject disabled?

Didi you additionally need to uninstall XiaomiEUInject updates, disable/uninstall XiaomiEUInject by use of pm?

Thanks
[Magisk] edd080:
@osm0sis & @badabing2003 Thank you so so much for your tutorials using Osm0sis fork and badabing's PFlasher I have found a working fp.

Again thank you so much for your great help 👍
[Magisk] beeshyams:
Thanks! I pass strong integrity too with this! Legend😂
[Magisk] woody4165:
Is there any guide on how to find fingerprint with DEV release?

Thanks
[Magisk] Imnoa:
I agree with you, I also harvested about two dozen prints for myself now, I provided a few users who really tried to find one but just had bad luck with one but the rest I'm guarding with my life lol.
[Magisk] Imnoa:
🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

If you found a few: Use Pixelflasher to convert, place and test them. It works like a charm
[Magisk] Emmes:
my routine was 28 -> 24
[Magisk] zgfg:
Process for finding dumps, taking from props and testing is always the same

About the new fields:

VNDK_VERSION take from ro.vndk.version

BUILD_ID take from ro.build.id (but it can be also compared to/extracted from fingerprint)
[Magisk] Mother_Teresa:
I think I finally managed to create a custom pif, by grace of @osm0sis and @chiteroman (dev2 release).

No idea if this will last of course but for now I feel like an advanced tweaker!

Thanks! :cool:

What is somewhat unclear still. Will the cat-mouse of releasing a fix and have its fingerprint banned, continue 'till we are all doomed or is there eventually no way to have them ban everything, or so?

[edit; typos]
[Magisk] Lord Sithek:
Who knows. We expect someday all fingerprints will be banana-ed one by one or, which is more probable, Google will find a way to ban all of them at once with a single mouse click
[Magisk] chiteroman:
Yeah, tell that to the custom rom developers...
[Magisk] EasyDeath:
if google can ban them all with 1 click, then sooner or later we need to find another way to pass play integrity

I can search as many build.prop you want and try to create my custom pif.json but remember, if i found online a build.prop, then google can also find it, and other people too.

Maybe a more user friendly guide on how to create pif.json will help and slow down the FP's bans, but i'm 100% sure we need to find a better alternative
[Magisk] badabing2003:
Good point, I see that you started using their prints, which is good, because you're not burning other prints.
[Magisk] sawdoctor:
Serious question and I'm not trying to pick an argument. Have you spoken with any of the custom ROM developers and tried to agree anything? If you can agree a maximum number of prints to use /how often/ use the same print etc?

I appreciate you are getting the brunt of people's frustrations when it's not only you updating. I think unfortunately you are getting it because you provided a way for people to use thier own prints but a large number of users haven't even tried
[Magisk] Mother_Teresa:
What I don't get. You only have that many ROM releases, as in way less as individal users that could make use of them.

Will blocking such FP's, for for example no-longer-supported devices, deny a whole group of legitemate users? (as in not rooted nerds like us)
[Magisk] mossywell:
No, I'm on 12.5.4.0. I have tried more recent ones many times (maybe 10) and each time, for one reason or another, I find myself coming back to the rock solid 12.5.4.

Re disabling / uninstalling XiaomiEUInject, no - it just worked without doing that.

EDIT: I did check system/product/app/XiaomiEUInject and don't see it so (I think) that means 14.3 is working as expected?
[Magisk] HippoMan:
Cat-and-mouse game continues.
[Magisk] Tamsta_T:
wallet on the rooted phone (unless one is using custom fingerprint) is pretty useless today - every time one is going to use their phone to pay for goods or services has to have physical card or cash in their pocket, because google's wallet might fail any moment. So why use phone, if there is a card sitting in the pocket?..
[Magisk] zgfg:
Google does not need to mine build.props

They have list of all certified ROMs, their fingerprints and other prints based on what they recognize devices and their certified ROMs and respond with verdicts on PI requests

If they would not have, you will have to wait on a PI verdict for days, until some clerk in G finds somewhere on Internet the build.prop for your device and compare what you're sending with what was in the corresponding build.prop

For them, regarding our spoofing and 'banning' it on their site , it is only about how to 100% safe recognize are you sending the real or spoofed data - they must make sure that when they 'ban', that it was not a user with that genuine phone model and ROM/fingerprint
[Magisk] HippoMan:
I figured out a way to get my wallet to *never* be crippled by the Googlefrinchians ...
[Magisk] EuK_V:
Maybe XDA staff could help with this and try to speak with custom rom developers?

At least even try to come to an agreement?
[Magisk] osm0sis:
Mondays do seem like ban-day, and things last the weekend generally, which is why I still think it likely we're looking at someone's office hours here.
[Magisk] Mother_Teresa:
And obviously also knows these topics/fora ;)
[Magisk] osm0sis:
Or at least knows how to star a repo on GitHub. 😛
[Magisk] ipilcher:
Not really. I looked at the list of prints that I've checked, and I had to check more than 40 before I found a working print. (I then found 5 more working prints out of the next 30 that I checked.)

I.e. I don't think that your experience is all that unusual.
[Magisk] ipilcher:
14.2 (and later) non-DEV versions have a fingerprint built in to their code. 14.1 was the only version that downloaded the fingerprint separately.
[Magisk] EasyDeath:
Hmm, if let's say, i use the FP of my motorola device i own, and google will ban the FP, what will happen to that motorola?

Also, if i got the FP from the ROM i downloaded, isn't that FP identical for all those devices using that rom?

As far as i read on google, FP isn't unique per device, am i wrong?

I tried to generate some custom pif.json on my own using the instructions and script provided: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/page-177#post-89189572

I downloaded some random ROMs, generated the pif.json and no luck, so came back to 14.3

Maybe tomorrow i will try to generate the pif with some unknown phone models.
[Magisk] EasyDeath:
Lol, i gave up after 5, will try more tomorrow

How do you check the prints in an easy way?

Paste the json to the device -> reboot phone every time -> and then check integrity in dev options of play store?

Or is there a faster method?
[Magisk] Iridule:
the print is not being changed unless the module is updated. the current one used by module can always be found here... I am starting to agree with using custom fps...updating the module with many users on one print is a doomed task. I am thinking it is all automated, when google sees so many users on one print it is auto banned, by some AI or something.

PlayIntegrityFix/app/src/main/java/es/chiteroman/playintegrityfix/EntryPoint.java at main · chiteroman/PlayIntegrityFix

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com
[Magisk] Imnoa:
Use pixelflasher.

You connect your phone to your PC, enable USB debugging, Launch Pixelflasher and go to the Magisk tab.

Then you just point Pixelflasher to a build.prop and Pixelflasher will create a pif.json, put it in the correct folder on your phone, reboot some services on your phone and start a safetynet check.

It only takes seconds and it works like a charm
[Magisk] titomax82:
Where's the dev versione link?
[Magisk] swour:
It has been mentioned that banning a certain fingerprint will not result on the actual device using the same fingerprint to fail device integrity.

If that is indeed true, why not attempt to more closely match the real device?

Succeeding with that should be slightly more future proof, if another ban would hit unmodified devices in the wild.
[Magisk] Imnoa:
Release DEV v2 · chiteroman/PlayIntegrityFix

Improve code logic. Fix crash issues. Remove xiaomi.eu apps for spoofing.

github.com
[Magisk] zgfg:
Inspect the module and you will see no wget command (for downloading)

Only the hardcoded spoofs (he changes and releases new version of the module when the old spoofs are 'banned'), and support for reading custom spoofs (in the module builds that support custom JSON input)
[Magisk] desertcat:
No Google services in the DenyList. Just a few apps that don't like to work correctly without adding them to the list.
[Magisk] Tamsta_T:
📳🔥 PixelFlasher, a GUI tool for flashing / updating / rooting / managing Pixel phones.

DESCRIPTION As the name suggests this is an application to flash (update) Pixel™ phones (possibly all Google™ made phones/tablets, YMMV.) PixelFlasher at its core is a UI layer (with bells and whistles) on top of adb / fastboot commands, hence...

xdaforums.com
[Magisk] HippoMan:
Thank you! But actually, it was quite a while ago that I posted the question about this that you answered. Since then, I came up with another way to do it. PixelFlasher is still a great tool for this and other things, but in case you just want a quick shell script, you can do this ...

#!/system/bin/sh
# -*- sh -*-

su=/system/bin/su
cp=/system/bin/cp
killall=/system/bin/killall
gsf_prog=com.google.android.gms.unstable

### Use the first pif_dest when using osm0sis' PlayIntegrityFork;
### otherwise, use the second pif_dest. If using osm0sis' program,
### the JSON file must be custom.pif.json; otherwise, it must be
### pif.json.
#pif_dest=/data/adb/modules/playintegrityfix/custom.pif.json
pif_dest=/data/adb/pif.json

[[ $# -lt 1 ]] && {
echo "missing json.pif file"
exit 1
}

json_pif_path="${1}"
shift

json_pif_file=/sdcard/$(basename ${json_pif_path})

adb push ${json_pif_path} ${json_pif_file}

adb shell ${su} -c ${cp} ${json_pif_file} ${pif_dest}

adb shell ${su} -c ${killall} ${gsf_prog} 2>/dev/null

echo "### ${json_pif_file} installed."

exit 0

Also, this script can be easily modified to run directly on the Android device. Just get rid of "adb shell" on the commands that use it, and just use json_pif_file to be a json.pif (or custom.json.pif) that's resident on the Android device.
[Magisk] beeshyams:
Pixel flasher the most efficient
[Magisk] HippoMan:
Yes, PF will do that.

Or if you want to do a quick test directly from your device, go to Terminal Emulator and run the following instead of rebooting:

su -c killall com.google.android.gms.unstable

Then, check the the PlayStore integrity options.
[Magisk] Iridule:
I was curous and found an old tracphone with android 8.1 on the device it is play certified and passes device integrity, yet i tried to use getprops and think I got them correct but maybe they are not? anyway to format the output from adb getprops to make sure?
[Magisk] Wolfcity:
Hey, you've got a similar hardware based wallet! 😉

It maybe nice to use the mobile device to pay but is it really so important?

I have an app from my bank that is working well with my main card but most of the time I use these plastic cards. Sometimes I also use that stuff called "money*...don't know if someone remembers it.....

Anyway, there are several things connected to google play services, so I collected a handful of fingerprints and thanks to @osm0sis and others it wasn't that hard.
[Magisk] Dark Warlock:
How to use BootloaderSpoofer? What to choose in lsposed?
[Magisk] Umgak:
The version that he was showing off isn't the same as the one on the github - it's Zygisk based, not XPosed based.
[Magisk] xSnowLeopardx:
I am home and can answer you properly now!

I have 12 out of 20 props with either A9 or A10.

I did not have a FIRST_API for 11 out of 12 props and they did work...

For one prop, with A9, it has an API_LEVEL of 28 which I did not touch.
[Magisk] osm0sis:
That means it's falling back to your device's FIRST_API, so you should definitely figure out what values you need to have to pass with each. :)(y)
[Magisk] HippoMan:
Oh yes, "money"! I vaguely remember something like that ... something about "the root of all evil". Is that somehow related to why the gods at banks keep trying to remind us that it's evil to use a device with root?
[Magisk] Dark Warlock:
I mean today new 2.0 version https://github.com/chiteroman/BootloaderSpoofer
[Magisk] SuperMaximus:
Is BootloaderSpoofer (LSPosed) a working alternative to PlayIntegrity Fix?
[Magisk] Compass Linux:
I'll just leave this here for those hunting fingerprints: https://github.com/juleast/GeneratePIF

Happy hunting! 🎯

Wait, so after updating /data/adb/pif.json I don't have to reboot or clear data/cache from GMS?

That command will suffice?

Compass.
[Magisk] Tamsta_T:
No reboot, check integrity straight way.
[Magisk] EasyDeath:
i don't know if you are joking or not

even McDonald app requires device integrity

any banking app, just to see your bank account balance requires device integrity

netflix, disney, etc

and let pass some time, even basic apps like browser/social/messaging and others will require device integrity

So the freedom of android will end, and you will be able to use the apps only on locked devices
[Magisk] BrimoFan123:
What a relief... my 4 fingerprints that I found after few hours of "mining" are not included in https dumps. tadatadatada repository web page.
[Magisk] HippoMan:
That command indeed alleviates the need for rebooting.

I'm not sure about how necessary clearing cache or data might be. However, if you want to do either of those things from Terminal Emulator, I believe that you you can do this ...

To clear data: su -c pm clear com.google.android.gms.unstable

To clear cache: su -c pm clear --cache-only com.google.android.gms.unstable

(Note: I'm pretty sure that "com.google.android.gms.unstable" is the package name of the GMS process whose cache and data you might want to clear. But if that is incorrect, just replace that with the correct package name.)
[Magisk] simpleatom7:
Idk how I omitted the word "banned" .... These custom fingerprints getting banned every hour/day now?
[Magisk] HippoMan:
Yes, and then, bye-bye Android!
[Magisk] Compass Linux:
Google Play Services is actually com.google.android.gms (unstable is missing) in my case (A11 CarbonROM).

I'll do some testing later on.

Thanks!

Compass.
[Magisk] Tamsta_T:
Not needed either. Saves time for looking for next firmware :)
[Magisk] HippoMan:
I'm not sure about the ".unstable" part. People have been posting a package name ending with ".unstable" for this purpose, but the presence or absence of ".unstable" might indeed be device-specific or ROM-specific ... ???

The package name with ".unstable" works for me.
[Magisk] Compass Linux:
Found this using Google: http://com.android.google gms should be added to default Magisk Hide list

Still digesting what's written there.

Compass.
[Magisk] majorfigjam:
So no, on the evidence on this forum, no individual's custom print has stopped working, unless they happen to have been using one that Chiteroman has used lately.
[Magisk] majorfigjam:
Four years after it was written, and many versions of Magisk ago? Before zygisk?
[Magisk] Compass Linux:
Yes, not directly relevant to this thread in this age.

It was mostly to try to understand why com.google.android.gms(.unstable).

Compass.
[Magisk] awarexda:
It's all a matter of available pf's. If we expect that strong integrity is the way forward then the possibility of running out of pf's is low and the very few people that will have working ones will be not enough "fuel" for mods like chiteroman to care to create new modules. It's a very delicate situation but not simply black or white.
[Magisk] Wolfcity:
I'm joking. As I wrote, there are several things connected to google play services and I'm not on the hunt just for fun.

But I get the feeling that almost everyone here has 20+ credit cards and that it's impossible to pay your 6-pack without Google wallet.😉

No bad feelings, I'm aware what may/may not come from big G but some users should stay relaxed. There is still "money" and for things coming up I hope for the XDA community.

There were several points in the past everyone thought that's the end of android.
[Magisk] xSnowLeopardx:
Let's see if this message I have sent to someone in PMs will help someone in here:

Tips:

1) Look for dumps instead of roms. Roms do work but it is more time consuming.

2) Look for dumps this way:

- android dumps version 8

- android dumps github

Note: version 8 is not necessary per se, since A7 - A10 do work, but Oreo has helped me the most in the beginning

3) Use PixelFlasher. You can use the latest version. This will help you with trying dumps and instead of rebooting, it will kill gms and then you can check immediately if the prop is working.

4) If a prop does not have a FIRST_API line, don't worry, I don't have this line in a lot of my props.

-> Great tip by @osm0sis:

"But DO try to find FIRST_API and ALWAYS fill it in (and play around with the value) even if you can't find one, since falling back to device value will lead to a lot of inconsistency for users across devices.

For example if I never filled it in on my Pixel 8 Pro it would simply never ever pass because my device value of 34 would be used."
[Magisk] HippoMan:
This is very useful information, and I'm sure it will help a number of people who have been confused as to how to proceed.
[Magisk] stanley321:
Ladies and gentlement, our weekly FP lottery winner!

PlayIntegrityFix/app/src/main/java/es/chiteroman/playintegrityfix/EntryPoint.java at main · chiteroman/PlayIntegrityFix

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com

I just hope I don't win and my FP will keep working without having to dig around for new FP again. 🙏
[Magisk] osm0sis:
But DO try to find FIRST_API and ALWAYS fill it in (and play around with the value) even if you can't find one, since falling back to device value will lead to a lot of inconsistency for users for what passes across devices.

For example if I never filled it in on my Pixel 8 Pro it would simply never ever pass because my device value of 34 would be used.
[Magisk] xSnowLeopardx:
Thanks for the information! I added your tip to my original message and will definitely play around with the level in my future FP searched (I am addicted and cannot stop with my 20 found LOL).
[Magisk] Tamsta_T:
Is there any pattern for what values in what cases (eg. A8 first api might be x - y, A9 q - w etc.) to play with?
[Magisk] V0latyle:
Android API Levels

A quick reference table of Android versions with SDK & API levels, version codes, codenames, cumulative usage, and more.

apilevels.com

8.0 - API 26

The "sweet spot" should be anything from 5.0/21 to 8.1/27, as long as the device was updated to at least Android 8.0 during its lifetime
[Magisk] osm0sis:
My guide (no longer linked in the OP, I see 😯😛) already has suggestions. In a nutshell: Try the actual one first. Try actual +1/-1. If it's over 32 try 32. If it's over 25 try 25.
[Magisk] Wolfcity:
Maybe you'll find a place for your extremely helpful guide (Odds and ends OP? GitHub?)

Sad to see that it's in that OP here no more.
[Magisk] Iridule:
I am curious as to why this isn't working. I have an old oreo tracphone and it passes device integrity on the device itself. Yet when I try to spoof it to my other rooted phone I get "no integrity' unless I change "release-keys to, dev/test-keys" then I will get Meets Basic though No matter what I can't get it to pass device on another phone....I am confused.

Just for fun if anyone wants to help...here is what I got from adb getprop.

Spoiler content hidden.

then I formated it myself , I am sure it is correct?

{
"PRODUCT": "cv1_lao_com",
"DEVICE": "cv1",
"MANUFACTURER": "LGE",
"BRAND": "lge",
"MODEL": "LML211BL",
"FINGERPRINT": "lge/cv1_lao_com/cv1:8.1.0/OPM1.171019.019/8937810200801:user/release-keys",
"SECURITY_PATCH": "2020-08-01",
"FIRST_API_LEVEL": "25",
"BUILD_ID": "OPM1.171019.019",
"VNDK_VERSION": ""
}
[Magisk] real_milux:
Are you aware that, by posting this, you are risking that Google will entirely ban this fp? Also for your real device?
[Magisk] fbirraque:
I already made 4 working custom pif.json files in the previous format (without VNDK_VERSION and BUILD_ID) that works flawlessly with Fork v3

But I couldn't found the VNDK_VERSION to update in the new format (Dev-2) and swap the value to null doesn't works.

"VNDK_VERSION": "ro.vndk.version" => null

How to handle it?
[Magisk] Fishawy:
Wow.

Link it to your signature man.