yashsingh1/xdaforums huggingface dataset:
[Magisk] mwzdalne:
Maybe there will be a public print with rcs, i dont want to do the print port thing, i just want quick and easy rcs access even if it takes time to get a public print
[Magisk] Vision:
Thanks you @chiteroman for the v16.3 and all your hard work.

We can have a little peace 🕊️ (I hope) now.
[Magisk] oops140:
hi, a quick question, is the concept of having integrity the same between ported rom and other custom rom? any differences?
[Magisk] Nergal di Cuthah:
Quick and easy gets banned faster than finding a private one
[Magisk] pr3dicament:
My soul is fulfilled.
[Magisk] 306bobby:
This is accurate. I believe on older Pixels just adding GMS to denylist will get you back to basic only as well
[Magisk] pr3dicament:
@osm0sis how would I donate to you?
[Magisk] 306bobby:
Not sure. but this might help some looking for private prints. Not sure if RCS works with it tho
[Magisk] Aman Dewett:
Hi, can anyone help me with this confusion, I am using Magisk with enabled "Enforced DenyList" for a banking app to hide root, the app also checks for unlock bootloader, for which I installed LSPosed module Bootloader spoofer. Now, bootloader spoofer don't work because that app is in magisk denylist and if I remove it from deny list, it detects the root. :(

Any workaround?
[Magisk] pr3dicament:
Bootloader spoofer doesn't work.
[Magisk] sawdoctor:
Try turning off deny list and using shamiko or zygisk assistant (or both together) instead. I use HMA , bootloader spoofer, zygisk assistant and shamiko in different combinations and most apps work
[Magisk] Aman Dewett:
Tried that too, its detecting "zygote is injected"
[Magisk] osm0sis:
Either GitHub Sponsors or PayPal! So very appreciated! 😁❤️

Sponsor @osm0sis on GitHub Sponsors

Android flashable zips, scripts, bins & automation. Creator of AnyKernel3 & Android Image Kitchen, facilitating the custom kernel/modding communities. Check my Sponsors page for a more comprehensiv...

github.com

Pay Christopher Renshaw using PayPal.Me

Go to paypal.me/osm0sis and type in the amount. Since it’s PayPal, it's easy and secure. Don’t have a PayPal account? No worries.

www.paypal.me
[Magisk] BillGoss:
Nope! I don't use the deny list in either Magisk or APatch. I like it simple! 😄

I would have said if I had done anything different.
[Magisk] pr3dicament:
Gotcha. Keep an eye out, something's coming your way via paypal.
[Magisk] rrusek:
-- deleted --
[Magisk] pr3dicament:
You'll be pleased. osm0sis. You are quite talented. Also, great guide you wrote back in late 2023.. Passing the two greens and working on getting STRONG with like a bootloader spoofer (I'm doubting it) but root as well since this print i got finally works.. so glad. For now, anyway.
[Magisk] pndwal:
Did a little digging into APatch to understand why you didn't need to hide root from GMS core (in Magisk, may be needed with A11+) and DroidGuard (unstable) processes, nor a solution to adjust (spoof) sensitive props, and it makes perfect sense now.

APatch borrows implementation largely from KernelSU... KSU docs mention that it's Root Access Control 'only permits apps with root access to access or see `su`, and that all other apps are not aware of SU access support'. Details:

As I mentioned, for a similar configuration to work with Magisk (w/ no PIF module), you'd need at least GMS DroidGuard (unstable) processes and possibly core process added in denylist (if A11+) as well as a solution for sensitive props adjustment like Shamiko or PIFork scripts-only mode... Should then have DEVICE_INTEGRITY and RCS (contactless working, 'Device is certified') w/o PIF or spoofing print set in Magisk on OP8T. 🤠 PW
[Magisk] BillGoss:
And that's why I use PIFork when on Magisk.
[Magisk] majorfigjam:
And that's why I said yesterday:

He needs root, he uses Osm0sis fork, he has device integrity, what he needs is a private print to make RCS work - for as long as Google allows.

And as Pr3dicament is apparently in a happier place right now, that is obviously what he got!
[Magisk] fbirraque:
Shamiko and Zygisk Assistant together?
[Magisk] pndwal:
So tried that in scripts-only mode? (I'm interested to know if we can get it woking with A10+ for non-HKA DroidGuard devices; may just need to manually select GMS core process in denylist or something more)... PW
[Magisk] BillGoss:
Sorry, but I don't understand what you mean by "scripts-only mode".
[Magisk] pndwal:
So you don't like alternatives to spoofing prints even when the device print can work?...

This has many advantages; as @kdrag0n* predicted, full-time spoofing would break stuff, and has been proved right with RCS... Other stuff (like find my device) is also affected... who knows what else print spoofing may break.

Since we no longer have dynamic spoofing, at least users of devices that don't require spoofing at all can have RCS working through any Google changes to print bans-for-the-purpose just by sticking with their native device print...

Many here are clear sorta fed up with wondering when their prints will be banned...

(*He introduced dynamic/runtime only spoofing but @Displax practically disabled it before his USNF fork was re-forked for PIF.)

🙃 PW
[Magisk] majorfigjam:
TL~DR
[Magisk] osm0sis:
You keep beating this dead horse. You realize dynamic spoofing wouldn't fix RCS right? The info is clearly pulled through DroidGuard, so any call to DroidGuard would trigger the dynamic spoof and Messages would still only see the spoofed print info and be able to ban RCS use based on it... 🤦‍♂️

And that's all beside the point. Displax had to revert dynamic spoofing because it broke more than it fixed. 😑
[Magisk] pndwal:
Since devices like yours don't need main Zygisk based PIF functions (fake keystore trigger for basic attestation or spoofing 'unbanned' prints to work, @osm0sis made scripts-only mode (Zygisk functions bypassed and automatically adds GMS DroidGuard (unstable) process in denylist)... May have issues with A10+, and may need to add GMS Core process in denylist manually with A11+ 🤠 PW
[Magisk] pndwal:
There's no proof it's not the issue; never been tested, but clearly @kdrag0n stalled updating 2.3.1 for many months because he was obviously aware that calls other than device integrity attestation calls could conceivably be made, causing issues, eg "I feel like setting a fingerprint that doesn't match the system in so many ways is bound to cause an issue somewhere."

@Displax actually fixed several issues with it, but gave up since it still affected 'some' devices...

And you've missed my point... Just saying that we've got issues with spoofed prints (whether or not reverting dynamic spoofing is the real cause) and I'm NOT pushing that 'dead horse' anyway; I know it's off the table for now at least, and I'm sorry if mentioning the possible connection it has with RCS issues irks you.

I was simply encouraging use of a scripts-only mode where it's viable... You should know the advantages, after all you added this for your PIFork. 🤷 PW
[Magisk] BillGoss:
I run Los 21 on my OnePlus 8T and need to do nothing other than install the PIFork (with the right print) - nothing added in the deny list. Ditto for my Pixel 8 Pro on A14 stock.

Like I said (though I didn't actually) "Simples!" (Nod to the meerkat).
[Magisk] kholdstayr:
Probably dumb question, but when you try to generate a pif from a build.prop, does it matter what generator you use for the PIF? I know that for osmosis pif that there is a gen_pif_custom.sh, but I'm guessing that the PIF you get from that is still going to be valid for chito's pif module, assuming you name the file correctly?
[Magisk] HippoMan:
Yes. And it will then get quickly banana-ed for everyone else who is using it, as well.
[Magisk] osm0sis:
RCS being banned only for the mass-used public print (sailfish), and being able to fix RCS on-the-fly by switching to a private print proves the check is going through DroidGuard and not from Find My Device (as Find My Device will remain unchanged as whatever you originally signed in with), or anywhere else. We spoof prints to only DroidGuard via the .gms.unstable process. Ipso facto.

Great question, actually. Yes, chit recently made his defaults match the fields section of my defaults, so now any prints already generated by my script will automatically work cross-fork! (The properties section entries included which mine supports will just get ignored on chit's). Simply name it correctly and place it at the correct path per your preferred module's instructions. 🙂🎉
[Magisk] pndwal:
Still, I actually wish I had OP8T just to try getting DEVICE w/o spoofing print set (and discover what mag be needed for passing w/ A10+)... Then scripts-only mode would be the bestest, simplest fix for any device not needing forced fallback to basic attestation or bypass for HARDWARE_BACKED evaluationType enforcement...

Guess you can simply find another print if/when yours is banned, or just move back to APatch SU.

🤔... Checked UD... Maybe I shouldn't have... PW
[Magisk] kostastnt:
I searched but didn't found anyone else having the same problem.

I own a OnePlus 12, was rooted with magisk and after the update of play integrity fix, I lost root.

Should I root again or try something else?
[Magisk] majorfigjam:
Just reloading both the rooted boot image and the apk should quickly sort it out.

I've had occasions after adb sideloading updates to my Pixel, then re-enabling modules, when the magisk app decided that root had been lost. Reloading fixed it for me.
[Magisk] beeshyams:
Yes, it happened to me too (twice, on sideloading OTA) and the same fix worked @kostastnt
[Magisk] sawdoctor:
They can both work together yes
[Magisk] pr3dicament:
I don't bohter with the deny list either. I use zygisk detach. I cant put the play store in there. i think gms unstable and gms core are both google services.
[Magisk] pndwal:
I never said it was from Find my device. 🤷... That's just another issue associated with Spoofing prints, whether or not 'dynamic' spoofing would or wouldn't have solved that or RCS issue...

I already said I'm not pushing for restoring 'dynamic' at this time, and I also said all along that it's clearly coming from DroidGuard and that if it's a cached server end result from a device integrity call hooked by PIF, you'd be quite right; dynamic spoofing won't help...

But are you sure other calls can't be made to DroidGuard, eg from other apps?... That's what @kdrag0n was apparently concerned with, and in that scenario dynamic spoofing with proper 'beginning and end hooks' in PIF would work... (Four+ months after @Displax submitted his "two rabbits" fingerprint spoofing Play Integrity Api bypass @kdrag0n was still saying:

So while you think that "any call to DroidGuard would trigger the dynamic spoof and [calling app] would still only see the spoofed print", he obviously thought otherwise, ie that 'some device-specific features' need access to the proper device print set data via DroidGuard and that a way for these to get real device data was

both possible and needed

... (We both know that DroidGuard is a seperate app from GMS and that there may be other ways to call for attestation data than even using the GMS unstable process.) No others Devs 'took a shot at it' so a month later @kdrag0n published his own solution:

... I learned most of what I know about the Android device integrity attestation SafetyNet/DroidGuard mechanism (which is now a sub-part of Play Integrity) through @kdrag0ns clear and specific documentation, and I know he understood this well at a time when the best of his fellow modding Devs as well as the rest of us were only making stabs in the dark. And I've spent a lot of time here debunking the technical device integrity myths and clap trap that comes up in XDA threads and passing on or citing his correct descriptions over a few years; There was simply no other detail like his on the subject...

That's why I'm very reticent to believe he was always wrong on this, no matter how broken his one-and-only USNF iteration with 'dynamic' runtime spoofing was... (With little thanks and all the criticism for his delaying, then his early-access release etc etc it's small wonder he just gave up and let it go.)

Anyway, I'm only responding to this again since I've not yet seen why 'device checks' for non integrity API purposes wouldn't work the way @kdrag0n suggested (incidentally, @Displax agreed a method "scoped to Play Integrity code by identifying methods it calls" should be persued:

Again to be fair, I wasn't pushing this anymore (for lack of interested Devs)... I simply said:

People are really best to avoid spoofing 'unbanned' prints if they never even needed 'em. 🤷 PW
[Magisk] majorfigjam:
Yet again, too long, mostly rehashed history, that I barely read but anyway ...

"People are really best to avoid spoofing 'unbanned' prints if they never even needed 'em"

Well the simple fact is that for the (vast?) majority, if you root your phone, you lose Device Integrity. Without Device Integrity, you can't have wallet and many other apps. Without root, you can't so easily block Google's ads, etc etc.

Given no developer has so far matched up to your goal or aspiration, followed up kdragon or Displax suggestion, and built the golden grail - in public at least - we all are where we are now . No amount of hand wringing on your part will change the public "lack of interested Devs." I'm sure Chiteroman and Osm0sis would have gone down that track if they thought it worthwhile.

And where we are now is that for the majority of us, to make things work, we NEED to spoof a print. Some of us apparently know where to find the elusive, and sometimes surprising RCS working prints. At least one person has publicly named a print that may have worked, or may not now. Others rely on the public Sailfish.

And we ALL know in our hearts that one day, Google will close this loophole and we may have to give up root for good.
[Magisk] markdewet:
I have a question, please. I notice quite a few mentions of "GMS Droidguard" in theses posts and was wondering, where does one find this item? I assume GMS is Google Management Services, but I have no such item listed on my phone that I can see, even when I enable system apps in the apps settings.

Thank you.
[Magisk] CZ.Kostra:
GMS: Google Play services (com.google.android.gms)

DroidGuard: Part of Google Play services (com.google.android.gms.unstable)
[Magisk] markdewet:
AH!! Thank you, kind sir, something new learnt. Much appreciated.

This, however, brings me to my next question, I assume the above two items MUST be in the Magisk denylist for things like Google Wallet to work, correct? Or does it differ depending on users specific environment?
[Magisk] CZ.Kostra:
If you use "normal mode" that means spoofing fingerprint with PIFix or PIFork, then it MUST NOT be in DenyList. But there are exceptions.
[Magisk] markdewet:
AH!! Again, thank you, so the exceptions would basically depend on testing on a specific device, at the end of the day. Gotcha. Well, in my case, on my previous ROM, they WERE in the deny list and Wallet worked, so I will stick with what works for me. I can only test Wallet tomorrow in any case, so will find out then.
[Magisk] CZ.Kostra:
I personally don't have any Google apps in DenyList. Google Wallet works and I don't use RCS.
[Magisk] pndwal:
Again, not pushing that at all; Wish people here could read... Just said he was probably right that full-time spoofing can cause problems such as we've seen with RCS...

Yes, "the majority of us, to make things work, NEED to spoof a print"... Never said different... But I was making plain what's the better fix for OnePlus 8T specifically, not for the majority. That device has NO DroidGuard compatible HKA as soon as you unlock!!!... It's not like the 'vast majority' have... Doesn't take much compression...

You're just stating the obvious, but for OP8T no such print spoofing is needed and the proof has been given here... I just encouraged members with OP8T to try with Magisk as there's no known reason the 'scripts only' spoofs can't be made to work if nothing more can work with APatch...

Not forcing anyone, but don't know why you want to discourage understanding about what different devices require for this... Like you want people to think they need a one-size-fits all solution when they patently don't. Any modder needs to be informed (for to many reasons to list here). 🫡 PW
[Magisk] Vision:
So appear I need the RCS, for some important conversation 😂🤣

If anyone have a extra FP, and can shared with me via PM. I appreciate (of course I keep it private).
[Magisk] ScottIsMyName:
This is XDA where people like to push the boundaries of what is possible. Why are you so eager to stamp that out? It is clear that the rooting system is broken for a large number of people and this is one possible path to get it working again, even if not all devs agree.

If you're not interested in "mostly rehashed history" simply ignore it and move on. I for one at least appreciate all of the summaries and history provided by @pndwal and hope that one day it will help us in taking the next step.
[Magisk] pndwal:
Usually not with PIF.

GMS DroidGuard (Play Services, unstable) process (used to be known as the SafetyNet process by TJW and others who reversed and documented Google code) always needed root hidden as it's the interface for the seperate DroidGuard virtual machine app(s) (the.apk) responsible for detecting root traces and other indicators of a modified runtime environment... MagiskHide did that pre-24.0, and when Magisk was no longer installed in sbin (basically for A11+ ROMs), TJW made made MagiskHide add GMS core process to the hidelist also...

Since 24.0, users began adding these processes manually to denylist until moving from old riru-USNF to Zygisk-USNF, at which time USNF began integrating root hiding for these processes itself (because DenyList hiding breaks USNF/PIF as it denies/reverts modifications in processes in the list)... PIF does the hiding internally too...

Exceptions include when using Shamiko (uses proper hidelist mode that doesn't break PIF), GMS processes can be added in denylist eg. to allow Shamiko fix for Font Modules (if installed these can conflict with USNF/PIF hiding and cause UI issues) to work on Play Services.

Also, the DroidGuard process and possibly GMS core should be added manually in denylist when using

no PIF

for devices lacking hardware key attestation for DroidGuard, or PIFork in scripts-only mode to hide root and achieve DEVICE_INTEGRITY for such devices if not added automatically. 🤠 PW
[Magisk] osm0sis:
Please read the FAQ (#7 and #8) and then my README for these answers.

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com
[Magisk] markdewet:
@osm0sis Thank you, I do appreciate your feedback, however, I am not going to lie, most of your FAQ and readme go WAY over my head. I apologise if that sounds like I am dumb (perhaps I am, who knows), so when I get an answer like that provided by @CZ.Kostra, short, to the point and provides the exact information I request, it makes things so much easier to understand. I do hope you can appreciate that.
[Magisk] trevtdogg:
I'm not sure why your take away message here seems to get lost so often by those who are critical of your posts.

it would be good at some point if there could be a maintained list of phones that do not need to spoof a fingerprint (phones for which script only mode, possibly plus a few tweaks, achieves device integrity).

someone earlier claimed that many Motorola phones may be in the same boat, with temporary broken tee when bootloader is unlocked.

I use a moto edge 20 fusion, and for all I know maybe this applies to me as well? maybe I could have avoided all of this private fingerprint hunting and updating.

so I think this is a useful concept, assuming it's actually true that some phones with broken tee can achieve device integrity without a donor fingerprint.
[Magisk] generalculprit:
Cannot be be that important if you don't take the RCS solutions offered here, AFAICS. Apatch, that other print, mining your own.

Finding my own is above my capabilities (ok, I could somehow generate that other print, but I don't need one anyway atm), but I would never beg for one. 🤔
[Magisk] Vision:
To change my root method is not a solution.

But like Magisk sooner or later, Google can broke and the APatch.

I take a break (good for mental health) from search FP.

Who say beg ?!

And help each other and shared a extra FP is good.
[Magisk] Tilde88:
Shouldn't my fingerprint be good if I'm on a stock ROM? I have magisk setup with all the configure denylist. Using no PIF or PIFork, I pass basic, but no device. RCS works. Using PIF without DG and gms in deny, pass device and basic, but obviously the FP fails RCS. Shouldn't my stock FP and stock kernel (magisk-patched) be good?
[Magisk] generalculprit:
Then RCS cannot be that important. 🤷‍♂️
[Magisk] Vision:
I get your point 🙏
[Magisk] pershoot:
It is working as (currently) intended. You have RCS with your own device's FP and an unlocked bootloader, which renders contactless / wallet inoperable. Once you spoof, the situation changes (i.e. you need to get DEVICE for wallet / contactless and the FP being spoofed must not be blacklisted by RCS and you may also need to change up your privilege escalation method (i.e. magisk, apatch, ksu, etc.) if RCS / related detects this at a (deeper) level).
[Magisk] snuk0:
I just installed TB Checker and it shows me my default fingerprint, even though I have integrity fix installed, it doesn't pull another pif.json, how to fix it?
[Magisk] osm0sis:
I feel like I need to reiterate the main caveat of Scripts-only mode where @pndwal is apparently hellbent on getting everyone to try it... He seems to be forgetting that lots of ROMs might not be stock-like enough to work, and only mentions in passing that even on stock OnePlus OOS I couldn't get it to work with Android >9 (and I tried many things to try and figure out why), so it almost certainly won't work on any normal device's custom ROM newer than that. 🙄

Anyone interested please review the README and expanded Details for Scripts-only mode:

PlayIntegrityFork/README.md at main · osm0sis/PlayIntegrityFork

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - osm0sis/PlayIntegrityFork

github.com
[Magisk] osm0sis:
FAQ #9:

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com

I don't appreciate that actually. I always make an effort to have my documentation be understandable and approachable even though someone might not know all the technical terms their first time through, and I'm always careful not to overwhelm with a wall of text, usually at the cost of some technical details I believe are less important to the bigger picture. That's how teaching and learning work.

So you refuse to read the documentation people have written, and prefer to have information conversationally given to you in tiny pieces. I'm sorry, but that's the definition of spoon feeding. You won't ever understand anything unless you try.

Read something, Google the terms you don't know, continue reading, try things out, read more. That's how I know everything that I know now.
[Magisk] generalculprit:
He's a minimalist and you're generalist. You both do a terrific job. Please! stop fighting about it. We're all on the same side here. 🫣
[Magisk] osm0sis:
Minimalist? Maximalist of minutia I think you mean. 😛

I just feel like if less time was spent on writing walls of text that even I have trouble digesting, and that energy was redirected to learning how to code and testing ideas out then we'd all be a lot better off.
[Magisk] generalculprit:
😄 And it's really good to have one around. I learned a lot. 👍
[Magisk] Mitezuss:
@osm0sis

is it possible implement a spoof for the signed state/type of the Rom? (giving some key.pk8..)