yashsingh1/xdaforums huggingface dataset:
[Magisk] xXHenlolXx:
Hello.

I'm having problems accessing my account since the last update. I can pass Play Integrity and im using hma, but it still doesn't work. In momo it says that I have unlocked bootloader, but idk if that is the problem.

This is the app:

BB: conta, cartão, Pix e mais - Apps on Google Play

Open a 100% digital account in the app and get full access to financial services!

play.google.com

I would be very grateful if someone could also test if the app works for them so I can find what is causing the problem.

Thanks in advance
[Magisk] Vision:
Same :ROFLMAO: I'm dizzy from lot search. Why before Christmas 🎄 FP died ?
[Magisk] simplepinoi177:
hey @chiteroman , I know this thread has been about the topic of fingerprints as of late, but thought I should/could give you a heads up on something different happening in the module...
[Magisk] dmenezes:
Thanks for letting us know.

Mine was self-mined on Dec 2nd (so, 18 days and counting) and it's still working.

But yours is the nightmare scenario for all of us who spent the time and effort to get our own fingerprints: that our efforts will eventually be laid to waste because of developers like Xiaomi.EU and @chiteroman eventually distributing them massively to the people that can't bother finding their own.

The way things are going, that's just a matter of time. :-|
[Magisk] osm0sis:
What?!
[Magisk] chiteroman:
Attestation runs on GMS processes, 99% of the code in unstable one. Spoofing in Play Store is completly useless...

Also, about Transient error, I released this beta build on Telegram channel: (removed due crashes)

@thatsupnow Try the beta build and check again. Also, set FIRST_API_LEVEL to "21" if you don't know what value it is.

Seems like there are fps with force hardware attestation even with lower api level values (< 33).

I recommend setting to 21 because it's the lowest supported by Google Play Services: https://apilevels.com/
[Magisk] Legoman6:
Anyone looking for a working PIF fingerprint could look here: https://github.com/TheFreeman193/PIFS

When I ran the script the first fingerprint that was randomly selected for me worked.
[Magisk] xSnowLeopardx:
Found mine 18 days ago -> still working. Very happy about it + happy about not sharing it.
[Magisk] simplepinoi177:
If you are paranoid like I am at suddenly & unexpectedly finding out that I can no longer Tap to Pay, check out the below thread for a tool that checks...! I can't say for sure whether it works or not (until my custom fingerprint gets burned), but it seems promising since I constantly see a toast message of it checking every time I unlock the screen...

GPay Checker: monitor of Google Pay availability

Google Play Protect now triggers onto app (that's honor for me), but here nothing criminal. You can safely skip warning. There is non-zero theoretical possibility, that using this app increases risk of banning your personal fingerprint. There...

xdaforums.com

I have a comprehensive but fairly rudimentary guide below if you want to check it out and/or have any questions or want to seek help there...

How to search & find your own fingerprints [noob friendly]: A Comprehensive Guide w/ tips & Discussion for Complete Noobs (from one)

It seems Google has banned more than 95% of custom fingerprints, so this thread/guide has kind been laid to the wayside. But it's still a great resource to understanding the foundations of fingerprints and all that... This is for any/all utterly...

xdaforums.com
[Magisk] BrimoFan123:
2075 json files.

Now G can lock them instantly, without having to run their scripts used to determine which fps are spoofed.

Someone from G should post here a big thanks for the list of those json files.

We urgently need the answer for the question what are the criteria to distinguish PI attestation between real, not rooted device and spoofed one.
[Magisk] droidman1992:
Thanks to @chiteroman for your efforts, however, I'm done here. What is happening with these fingerprints is ridiculous and not fit for use. I'm retiring my OnePlus 7 Pro on custom firmware and am upgrading to the OnePlus 12 with 24 GB of RAM as soon as it's available. I need a working phone, not a toy that breaks on me every two days, and **** you Google, you are lucky there is no good competition or I would be switching.
[Magisk] DivintyQQ:
Or, maybe, hypothetically speaking, you could just try to find your own fingerprint. I know, wild idea.
[Magisk] Depressed T.Bear:
24 of my jsons are in this list. Dang. At least 5 aren't...
[Magisk] TheFreeman193:
This is not a collection of tested fingerprints/device profiles. It's also only 5% of the individual build.prop files/android.os.build class definitions that my automation scripts collected from public web sources. If Google was going to blanket lock a bunch of profiles to hardware attestation, they could easily do so with or without this collection.

Sorry! If you found any of those from public, open-access repos my automation scripts probably found them too. Keeping 95% of collected profiles private was a decision in case Google do actually decide to step up their offensive instead of just banning over-used profiles like at the moment.
[Magisk] sawdoctor:
Just looked my back up device/print is in the list but the one I'm using isn't so fingers crossed 🤞
[Magisk] sawdoctor:
Tbh there's also another repo/website with ready made (Untested) json files as well so don't worry. Your damned if you try and help people your damned if you don't, just unfortunate. Hopefully someone more clever than me will come up with a new way of bypassing droidguard
[Magisk] majorfigjam:
That list just proves that there are a very large number of potentially usable prints. I don't see any of "mine" in there, but I only did a quick scan of the types I know I used. So far, so good.

But it's also true that if one person can do this, then google with its vast resources can do the same and more. They likely already have. Let's face it, they already have the details of every one of the 40k+ Playstore approved devices, which gives them a good start.

So, either they haven't yet found a reliable way to avoid locking out the remaining valid devices with genuine prints, while still blocking "borrowed" ones (unlikely), or for now they only want to crack down on blatant misuse.

For those who want to go through the trauma of being blocked, then waiting to be handed a new temporary fix, that's their choice. There are hundreds of prints to be burned before the supply runs out, or the suppliers get tired of the chore of updating their release scripts.

For those with a custom print, you may get burned from time to time, but it's far less likely to happen.
[Magisk] TheFreeman193:
Very true. I expected I would make some people unhappy publishing that collection but clearly the process of assembling a device profile is still too convoluted for the majority of PIF users, hence why the default values get blocked every couple of days. If the entire user base were to spread out over even the small number of profiles I published, the likelihood of getting lost in the noise from real devices would be much, much higher.
[Magisk] sawdoctor:
I don't think it's that difficult to find a print i just think some users presume it's difficult because they don't understand the terminology and obviously some are used to being spoonfed.

When i first tried i found it a little overwhelming but then i realised hang on all i have to do is download a buildprop and press 2 buttons on pixelflasher, why did I think this was hard?
[Magisk] TheFreeman193:
This is very much on-point. Google don't need to scrape public profile databases, and if they did they could easily get unique values for 30,000+ devices from the two biggest sources alone.

It is known that some devices cannot pass hardware attestation even in stock configurations due to flawed implementations of the chain-of-trust. I suspect they are averse to breaking those until there aren't many users left.

For everything else, I think you're right in that their focus is on obvious over-use of certain device profiles right now.
[Magisk] ldeveraux:
Can we get it in the OP?
[Magisk] wfred:
It shouldn't be.

If you are competent enough to follow the instructions on how to root your phone, install Magisk, and use modules you should be able to follow the instructions on how to find & build a working json.

Especially since the how-to's are pretty thorough and the process is mostly automated now.
[Magisk] Iridule:
Someone more knowledge than I with reverse engennering may find this useful...

"

The Fingerprint Android library combines the abovementioned techniques to provide two stable and unique identifiers.

The first identifier provided is the DeviceID, which relies on GSF ID and ANDROID ID. They are stable, but it is possible to spoof them with the Xposed framework (as mentioned above).

For instances where you want to mitigate the risk of users spoofing their DeviceID, the library also generates a Device Fingerprint. Our fingerprinting process collects over 50 platform signals and calculates a unique hash for each user. You can easily see the collected signals and the resulting Device Fingerprint in our playground app....Our Android Fingerprint library provides a stable Device Fingerprint generated using all available platform signals. Using the library allows developers to consistently get a reliable device ID regardless of accessibility and stability changes over time."

https://fingerprint.com/blog/device-fingerprinting-android/
[Magisk] Depressed T.Bear:
All good! :) No need to say sorry.

The prints I found can easily be found by anyone else.
[Magisk] TheFreeman193:
This is a different definition of fingerprint, I'm afraid. This appears to be related to uniquely identifying devices without needing persistent storage like a tracking cookie. Fingerprint in the context of this module is the build fingerprint for an Android build. It is only unique to that configuration and anyone with the same build has the same build fingerprint.
[Magisk] purgy:
My personal print has apparently been axed, I haven't checked for a while, so not sure exactly when :/

Using v4 fork by @osm0sis, but I doubt that's relevant
[Magisk] Tamsta_T:
acer?
[Magisk] EasyDeath:
my custom FP is still working, 10 days

Still, i found the system dump online, so soon or later it will be banned

we need to figure out a better approach

PS: my old nexus 6, with ancient magisk passes play integrity without any custom PIF/module, just updated play store to did integrity test.
[Magisk] purgy:
No 😔

Id been keeping a bit of an eye on the prints used in default pif, and it wasn't used there.

Edit- although I didn't find my exact device on that list of pifs posted before, there were other models by the same manufacturer there, and I didn't look that thoroughly.

Edit the second- the current 1st API value is 25, what's the lowest I can go with that? 23?

Edit the third: ofc that would have been too easy
[Magisk] BunnyPig1:
Just made an attempt at finding fingerprints for the first time. Using PixelFlasher and osmosis fork I found 5 working prints. It'll hopefully be enough for a while.

One thing I noticed was that changing FIRST_API_LEVEL to 00 made a huge difference. I noticed this 30+ prints in to try and I managed to get the last 3 working within 6-7 attempts.

My question is now, is there a way to simply edit the file on the go? Like, I could have a text file on the phone containing all my prints and I can just swap it on the go.

Or maybe I can just keep all 5 prints as .json files and just delete the old one, replace it with a working one and then just reboot my device, it should work right?
[Magisk] xSnowLeopardx:
This is what I would do:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

But I haven't had the opportunity (?) to do this. My current FP is working for 18 days.

And yes, replace and reboot, or kill gms via terminal I think (never did that myself).
[Magisk] BunnyPig1:
When you say you keep an updated .zip file on your device, is it simply just containing the fingerprint or do you have seperate versions of PIF with the .json file already attached? That would be handy.
[Magisk] majorfigjam:
Yes. You can even save the jsons in the same data/adb folder, and then just rename when you need to.

If I'm testting a new one, I just go to airplane mode, stop and clear cache of play store and play services, then come out of airplane mode.

That said, my original print from early December is still alive and well, but it's not on any published list I've seen.
[Magisk] xSnowLeopardx:
Doesn't really matter though, right? Either you copy the text inside your new .json and edit, paste it into your existing one, or

You just copy, paste and replace with the .jsons. important thing is that you have the fingerprint nearby.
[Magisk] BunnyPig1:
I haven't checked if my FPs has been published, doesn't really matter since I don't use anything using DEVICE_INTEGRITY at the moment, I just wanted to see how hard it would be and now when I have them I can just keep them to see if I can survive the apocalypse haha

But thanks for the advice, I did like you said, just kept them as json in the same folder just randomly named to keep track of which is which.

Yeah that's true. I keep them as json files inside the modules folder and have them named so I can keep track of them. Like I said to majorfigjam, I don't really care for the DEVICE_INTEGRITY since nothing I use needs it. But it's nice to have backups now if I ever need them!
[Magisk] purgy:
Got myself another print, just had to edit 1st API level slightly.

Guess I actually do need to find a spare or 2, but :effort:

What exactly caused my old one to fail confuses me though, I didn't see anyone even mention the brand of device I was using fps from either in this thread or on the telegram. I didn't share it, or even test it through a 3rd party app, just dev options in the play store, and that only every few days.

Am I the only one to have a private (non asus / acer) fp get the chop?

Or did it even get the chop in the traditional sense? It was still passing basic.
[Magisk] Fishawy:
Are you saying that changing FIRST_API_LEVEL to 00 for all prints works without question? The ones I have vary from 23 to 28. Sorry if I missed something, but an elaboration would be really appreciated.

This is exactly what I do. Have the pif.json files saved (with manufacturer name and an index number if I have more than one from the same manufacturer). You can simply edit the pif.json file as a text using Mixplorer.
[Magisk] BunnyPig1:
Not all prints worked by setting FIRST_API_LEVEL to 00. Just that it made work on previous non-working FPs.

I was probably a little unclear, let me elaborate:

Let's say I tried 37 FPs in total and found 2 that worked (when I had tested 30) with the original FIRST_API_LEVEL the build.prop provided.

But after the first 30 tested FPs, I started to try and set FIRST_API_LEVEL to 00 for the ones who failed (for the remaining 7 I tried).

If the FIRST_API_LEVEL provided by the build.prop failed I just swapped it to 00 and it made me find 3 FPs passing DEVICE_INTEGRITY in 7 tries.

Hopefully this cleared up some missleading information I gave.

I have a similar setup. Hopefully I won't need to change anything but at this point I will still continue to avoid apps using DEVICE_INTEGRITY for as long as I can haha

Don't want to risk not being able to pay in front of a huge line because of Wallet being a PITA
[Magisk] Fishawy:
Amazing, thanks for that. I also just saw chiteroman's post recommending to set FIRST_API_LEVEL to 21. I'll keep that in mind as well as yours (00).

This gives me a little bit more hope, to know that not all failed prints are doomed and some of them might actually work with different value of FIRST_API_LEVEL. I'll sure test that when I look for more.
[Magisk] HippoMan:
I'm looking for an app that will always totally crash right away if DEVICE integrity is not active, and which will launch successfully if DEVICE integrity is indeed active.

For more details, see this message:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89218824

Any thoughts or ideas?
[Magisk] dosbuddy:
koeln.kvb.ticket.vrseezy

View attachment 6046337thats all i have...

app is: koeln.kvb.ticket.vrseezy

sorry , no crash
[Magisk] xcl1pse:
The problem is that if an app required device integrity, it need to check verdicts via google, so need internet connection and need to interact inside the app. Like this one

12-21 08:39:46.975 5407 5551 I Finsky : [182] lhg.b(282): requestIntegrityToken() finished for com.mcdonalds.mobileapp.

I dont know if theres an app that immediately crash or close if the phone not passing device integrity
[Magisk] HippoMan:
That's not a problem for how I intend to use that proposed Tasker program. I only expect this to be able to work if there's an internet connection.
[Magisk] majorfigjam:
Not really. Read back a page or 2.

It's a fraction of the available prints, and google already knows the print of every device authorised to use playstore. They only crack down on mass use of single prints from multiple improbable devices. How many 360 Android cameras can there be?

It also makes things easier for those who can't or won't use their own custom print, at minimal inconvenience to others.

Breathe easy.
[Magisk] beeshyams:
Yep. You're right. Deleted my post
[Magisk] igormm:
Was using a banking app on a rooted lineageos rom for years without hiding it. A few months ago another app that I use began complaining about root and I followed a guide to hide it and pass safety net. This week I lost the play integrity and the baking app crashes every time I try to open it, but on an unmodified device it opens as it should. I followed another guide (more recent) that made me get: MEETS_BASIC_INTEGRITY, MEETS_DEVICE_INTEGRITY only, but it still doesn't work, same problem and app as follows:

Didn't have time to see logs though
[Magisk] xcl1pse:
Did you refer that app is this one?

View attachment 6046345
[Magisk] igormm:
Yes
[Magisk] xcl1pse:
Well no crash or close for me with only pass basic...
[Magisk] HippoMan:
Thank you! I'll check
[Magisk] Iridule:
@BunnyPig1 I noticed the 00 trick a while back as well. You can also use any number from single 0-9 as well as 00- the API that the prop started with. It seems to be if API can be changed to work it can be lowered to anything, though I'm not sure what if any side effects this would have other than getting device to pass integrity...
[Magisk] osm0sis:
The lowest accepted number doesn't really matter.. it's more the highest that matters. I think you'll find the threshold is at 25, as we've been saying.
[Magisk] igormm:
Wow, there might be somthing wrong about what I did, because I tested it on another phone that is also rooted and got the same result
[Magisk] Fishawy:
Is the app in your DenyList? I made that mistake before.
[Magisk] igormm:
Yes, it is and also in the HideMyApplist xposed module, though, I've tried removing it from both just now and it also didn't work
[Magisk] purgy:
Not 100% accurate, as my unshared fp was banned over the past few days. It was perhaps an unlikely phone for me to have, but it wasn't a fridge or anything ridiculous.
[Magisk] Fishawy:
Yea I thought I should ask. Perhaps take a backup of what you have now and start fresh with the app?

Sorry if I can't be of more assistance.

Could be just bad luck if your private one was used as a generic one by chiteroman or Xiaomi.eu devs and got banned due to a sudden spike of thousands of users (Acer?).
[Magisk] Iridule:
I've got many prints that if you go from 25 up they won't work at all they will only work if you start to lower the number and if it can be lowered it can be lowered to any number. I've also got prints that start at 30 also seem fine, seems to be hit or miss
[Magisk] trevtdogg:
i'm sure there are other modding communities in different countries that may be using similar solutions and providing them publicly to share (i'm primarily thinking of communities that don't speak english).

if so, we might not be as aware of which prints they are using and burning too.
[Magisk] osm0sis:
No, what's the number where they start to pass when lowered? That's the threshold I'm referring to. Generally it's 25.
[Magisk] purgy:
Nah it was a pretty unknown brand, and it wasn't used in pif or anything.
[Magisk] purgy:
That is true, and I didn't consider that.

Here's hoping I have better luck this time around
[Magisk] BROKEN1981:
Did Chit start using Acer? Why can't Chit and the EU guys just stop this already? If a noob like me can get a print, what's everyone else excuse?
[Magisk] Fishawy:
I recall the very first generic ones were Asus and Acer if I'm not mistaken. Plus, as confirmed above, there are other forums and communities that we know nothing about. 4PDA for example could be using completely different prints.

Unfortunately there's nothing we can do about this. Even if our appeals to chiteroman become beneficial, others will simply continue doing what they're doing.

Every man for himself I guess.
[Magisk] majorfigjam:
It's public knowledge that the latest "shared" print is a nutmeg Acer Holo360 camera device.
[Magisk] majorfigjam:
Why do they need to stop? It's helping a lot of people, apparently.

And, it's not harming you in any way, with the chance of them picking "your" print being apparently slightly less than the chance of google blocking it first.
[Magisk] BROKEN1981:
They aren't helping anyone. All they are doing is helping Google burn the prints for everyone else. If they wanted to help the community, they would stop making plug and play prints and force people to learn how to get them for themselves.

Teach a man how to fish or however that saying goes
[Magisk] Iridule:
I found where the API can be changed it's one lower than the prop gives... I found that over 90% of the time if it can go one lower it can go to 0. Does this API level affect anything on the system like Available apps or something?
[Magisk] pndwal:
Are you meaning devices where no bad Keymaster etc causes an exception that triggers a fallback to basic-only attestations so even DEVICE_INTEGRITY fails?... Or those that do fall back to basic?... Or are your meaning STRONG_INTEGRITY which must necessarily use hardware (key) attestations?...

Please can you expand on how these might be further 'broken' by Google prop tweaks?... Ta, PW
[Magisk] majorfigjam:
I believe the phrase you're looking for is "I'm alright Jack."
[Magisk] osm0sis:
Changing it only affects DroidGuard, so shouldn't have any other effects that we know of... but 🤷‍♂️
[Magisk] salamdiab:
hi

may ask somthing

i realy dont know what is wrong

i have pixel 8 rooted with unhide rooted and play ingerty 14.6

at 14.3 all of all work fine

now the wallet not work

whats all about ??

updated ver and nothning work??

thanks
[Magisk] simplepinoi177:
Are you passing MEETS_DEVICE_INTEGRITY?

If you are, then you probably have to clear data on Google Play Service/GMS (this will remove all cards from Wallet, with which you'll have to re-add them).

If you are not passing MEETS_DEVICE_INTEGRITY, then that is the reason why Wallet won't work. Some people are saying 14.6 is working for them, some people are saying it's not -- you might be in the group of the latter. Either uninstall and re-install the module (which isn't guaranteed for it to suddenly work) or you'll have to find your own custom "fingerprint" to implement...
[Magisk] salamdiab:
thanks for yor help

about " MEETS_DEVICE_INTEGRITY" no not pass.. just the basic

and what is that mean " find your own custom "fingerprint" to implement.."
[Magisk] simplepinoi177:
no problem...happy to!

yeah...but unfortunately, then as I said...
[Magisk] majorfigjam:
Sorry, but you will need to do some reading, and experience some pain.

Find the Osmosis post with 150 likes called How to create and use a custom.pif.json!, which if you reading on a phone will be down the page a bit. Then go find your print.

There was a helpful link a few pages back to a lot of prints.