yashsingh1/xdaforums huggingface dataset:
[Magisk] wilsonhlacerda:
Wrong thread. Check others under Magisk section, maybe there's already one specific for CMB. Certainly it checks by itself for abnormal environment.

This one here for PIF and as you are already fine on that, it's done.
[Magisk] Cristiano Lira:
Yeah, I had just tought if Play Integrity might be checking some device property like screen size or something and matching with the device's fingerprint. Might be the gpu fingerprint, but still some roms are working fine and others aren't on the same devices.
[Magisk] wilsonhlacerda:
FYI Official LineageOS is compiled as userdebug and it is fine on Play Integrity checks.
[Magisk] Dkpost3:
IntegrityErrorCode | Android Developers

developer.android.com
[Magisk] D_Viper:
hi, i am on crdroid 10.5, uname -r says 4.4.302

Play Integrity Fix 15.9.9

Play Integrity API Checker Says only BASIC
[Magisk] Dkpost3:
15.9.9 not work
[Magisk] samhhmobil:
Why not? For me it works on several different devices.
[Magisk] zgfg:
If using PI Fork, add the following line to eg beginning of custom.pif.json

"verboseLogs": "100",

(if you already have verboseLogs field, just increase the value to 100;

if adding to the end, be careful to add comma to the line before and remove comma here - last field in the JSON must not end with comma)

Kill gms.unstable, test PI and look into the PIF logcat, you will see exactly what DG is checking or not

For PIF (Chiteroman) check to the GitHub what is the field name defining verbose/log level
[Magisk] osm0sis:
chit doesn't have verbose like we do, he just filters some out and always dumps them:

PlayIntegrityFix/app/src/main/cpp/main.cpp at main · chiteroman/PlayIntegrityFix

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com

Though looks like persist might be a bad one to filter out, since as I've always shown in my PIFork release posts there are custom ROM persist props DroidGuard definitely looks at.
[Magisk] wilsonhlacerda:
@joeyhuab and @osm0sis this user case maybe can help understand what is happening with falling custom ROMs: he/she seems to be doing everything correctly but is failing on an UNOFFICIAL LineageOS. And we known that OFFICIAL LineageOS do not fail.

Probably can compare its unofficial source Mi9T ROM with an official source ROM of a device hardware that is very close to it, same LineageOS version/release (LOS19, 2022-07-19). Or, probably easier and better, get in contact with the developer of the unofficial one and ask him/her what changes in LineageOS he/she have done, not the device specific, but on LineageOS platform, main code, maybe baked in spoofs and similars.

Those differences will include what Google is using to flag a "bad" ROM.

I can't do that myself because I'm not an Android dev, just an advanced user, thus I'm certainly I would not realize the important stuff may be hidden there.

@beardedwonder can you please link the unofficial Mi9T ROM thread, source code, developer, Telegram?

Post history:
[Magisk] Lu5ck:
I read that they check kernel name so what about rom name? :rolleyes:
[Magisk] beardedwonder:
I think this is where I got it from:

Release LineageOS 19.1 for Xiaomi Mi 9T (davinci) · arian-ota/ota

📅 Build date: 2022-07-20 🛡️ Security patch: 2022-07-05 💬 Variant: GMS 🗒️ Changelog SHA-256 checksum 68761fe3c0dfb3f3a94eae0c8e66e8c890e2a4cdcb78c1dcf8f1ece68d9d8982

github.com

XDA thread:

[ROM][UNOFFICIAL][davinci][12.1] LineageOS 19.1 [OTA]

LineageOS is a free, community built, aftermarket firmware distribution of Android 10, which is designed to increase performance and reliability over stock Android for your device. LineageOS is based on the Android Open Source Project with extra...

xdaforums.com

EDIT: Given there's a newer version: https://xdaforums.com/t/rom-13-official-lineageos-20-for-mi-9t-redmi-k20.4619645/

I'm wondering whether I should update, although I hate updating as I normally end up with a soft-brick and it takes hours to get everything up and running again :(
[Magisk] osm0sis:
Unofficial is default signed by AOSP test-keys and verity-keys, and I know official Lineage has their own keys. @joeyhuab what is EvoX signed with? If not test/verity, it could be custom ROM key blacklisting now for those ROMs known to circumvent PI! 😯

You could test by doing a build with a new generated private key. But it could also be a whitelist. 😶
[Magisk] wilsonhlacerda:
Yeah, I see there is a much newer LOS21 from same dev. And I understand the hard work of backup/restore everything when updating. And this is a must when updating to a new Android version, starting from a clean setup and only recover data + user apps (never system apps/data to avoid weird bugs). Brick typically will not happen (format /data, the yes/no question in TWRP, besides clean cache before first boot; flash Gapps just after ROM, without a reboot in between).

Apps Swift Backup and/or Neo Backup helps a lot on that.

LOS21 for it from same dev/Github:

Release LineageOS 21.0 for Xiaomi Mi 9T (davinci) · arian-ota/ota

📅 Build date: 2023-11-06 🛡️ Security patch: 2023-10-05 💬 Variant: VANILLA 🗒️ Changelog SHA-256 checksum 03368531e8511bd3390ae12e5fb11f0f0a807b8afc1e6b30d7cc66a0c67b983f

github.com

But I do suggest you to do that: will have a much newer ROM, with newer security patches and what it matters now: may help you pass Play Integrity.

Then let us know if it fails or not. As it is a newer source code can help/let it easier for other devs to do the comparison I suggested above.
[Magisk] wilsonhlacerda:
Do you know how those others are are signed?

Maybe they have that in common, but not the failing ones.
[Magisk] CHV:
crDroid 10.5 with PlayIntegrityFork.

What about "Couldn't determine 'DEVICE_INITIAL_SDK_INT' class name"?

Spoiler content hidden.
[Magisk] osm0sis:
That's all normal. Nothing new in that snippit.
[Magisk] privacyguy123:
deleted
[Magisk] wilsonhlacerda:
As Play Integrity is ok, then this is the wrong thread. Probably there is one under Magisk section to discuss Uber Rider app own detections, check that. If not start a new thread there.
[Magisk] chiteroman:
View attachment 6106187

Because I have more things to do in my life and building a ROM by changing C++ code takes time.

I'm trying to figure out what Google has done too....
[Magisk] osm0sis:
Yeah we all busy man. I wasn't the one making daily PIF releases. 🤣
[Magisk] wilsonhlacerda:
@chiteroman thanks for all your efforts also.

Maybe you can also help/get insights from this post and the ones that follows:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] chiteroman:
core/java/android/os/Build.java - platform/frameworks/base - Git at Google

DEVICE_INITIAL_SDK_INT field is marked as SystemApi, which means that it can't be modified once its value has been set.
[Magisk] sawdoctor:
Everyone working on this is doing it for free in their spare time. I think some users forget that and just post useless posts like " doesn't work" with no useful information at all.

Thanks to everyone working on this to keep our devices functional, really appreciated
[Magisk] chiteroman:
If I'm not wrong, official LOS builds are signed.

Signing Builds | LineageOS Wiki

wiki.lineageos.org
[Magisk] Lobod:
PixelOS signed with test-key is not passing.View attachment 6106194
[Magisk] duzers:
Poco x3 NFC, 4.14.290-ThunderBolt-gbcad1152a7fd

PixelOS_surya-13.0-20230214-1834 (not working, only BASIC)
[Magisk] zgfg:
Use migration migrate.sh list to update to update custom.pif.json to the latest format

Newer version of the migration script is on GitHub
[Magisk] osm0sis:
Format's unrelated to the error, just for everyone's info. chiteroman explained it well above. In a full log you'll see it can only get set the first time. My thought was once is better than not at all. 👍
[Magisk] joeyhuab:
Hiya, our ROM uses the same keys with Lineage since we're using them as base now. The only difference is, we're obviously not signing our builds with their OFFICIAL keys.
[Magisk] osm0sis:
Well exactly. Can you try a different key?
[Magisk] joeyhuab:
Will have builders try and update you soon.
[Magisk] ComradeWave:
Noob here! I'm compiling PixelOS too with a private key, just to see if it may pass.
[Magisk] osm0sis:
NOT banned:

BOOL-X

Bool-X

bool-x

KEWL

KewL

Kewl

kewl

Mokee

VantomKernel

Also still NOT banned:

openela

perf

dirty

Banned:

mokee

Another thing I notice is that now the kernel bans seem to affect SafetyNet verdicts where they used to only be Play Integrity (i.e. failing PI DEVICE but passing SafetyNet), suggesting they've updated SN in DroidGuard to match the latest PI checks.

Full kernel string ban list updated: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89308909
[Magisk] chiteroman:
LineageOS unsigned not passing DEVICE

Will sign the OTA and try again
[Magisk] ComradeWave:
Signed PixelOS with private keys does indeed pass DEVICE!
[Magisk] osm0sis:
I think I reproduced the issue on my OP8T on EvoX. Interestingly, using a print which wasn't banned last week (but now is) gives SN pass with PI BASIC, but switching to the current public sailfish print also fails SN cts. It's like the new remaining print is triggering the new checks. 🤯
[Magisk] osm0sis:
Is Google saying, "here, have 1% of prints, but only if you're on stock or possibly safer private release-keys signed custom ROMs"? 🤔
[Magisk] Vision:
I hope they don't check for a date&time change 😂🤣

Stock A11 have 1/1/2009 02:00:00 (regardless of whether it was launched in 2019)
[Magisk] ComradeWave:
Probably PI has a new check for unsigned roms?
[Magisk] osm0sis:
Seeming more and more likely that unsigned, test-keys or known-"bad" signatures are getting rejected, but the check is only triggered with the remaining available prints. Hopefully others can confirm by custom private signing the other affected ROMs like EvoX and crDroid. Now the question is can we work around that check without rebuilding the ROMs...
[Magisk] albinoman887:
how do i compile my rom with private keys?
[Magisk] ComradeWave:
Signing Builds | LineageOS Wiki

wiki.lineageos.org
[Magisk] ComradeWave:
@osm0sis Sorry for pinging, but is there a way to quickly check if a build is signed (even with private keys)?
[Magisk] ninjakira:
idk if Itll help, but I'm just using a stock rooted moto edge 2021 (berlna), and before anyone tries berlna fingerprint is also banned lol. still using sailfish print tho and still passing both basic and device, I'm also still using v15.9.8 of chits play integrity module with just playcurl updated from yesterday
[Magisk] ComradeWave:
Also, on an unsigned device Key Attestation Demo shows thisView attachment 6106274
[Magisk] DylanAkp:
I can confirm that the new props works on a signed build and not unsigned

I came to the same conclusion when a user reported AOSPA official passing DEVICE while some unofficial builds weren't (and I remembered that AOSPA team sign their builds)

I guess all ROMs will end up signing their builds if we can't bypass it
[Magisk] ComradeWave:
I think it's very unlikely that we find a workaround, since signing an OTA package effectively modifies all APEXs and APKs. Billions must recompile At least it's not too time consuming.
[Magisk] albinoman887:
i dont understand the part about adding the ANDROID_FW_FILE and EDITOR variables. tbh these instructions are incomplete... i build for a a/b device... this only talks about building a "block" type ota.... is there a less verbose, up to date directions?
[Magisk] DARKBOYJYOTI:
I think pixel fingerprint required signed rom. Can you please check with another device (not pixel) fingerprint.
[Magisk] albinoman887:
idk what ur talking about
[Magisk] albinoman887:
this shouldnt be this convluded of instructions ffs los smh
[Magisk] ashish1989:
@osm0sis need to know can I delete Autopif folder after the whole process is completed and I extracted custom.pif.json file from it?
[Magisk] Vgl12258:
Well time to give a try and sign with private keys... Google is back from vacation with a bang o_O
[Magisk] DARKBOYJYOTI:
SN failed because of sailfish fingerprint. I'm using previous clark's (Motorola XT1575 ) fingerprint it pass SN but failed in PI checks because of Google blocked it's fingerprint.
[Magisk] wilsonhlacerda:
So now we know that cops are out there asking for ID, otherwise you go to jail. We just need to carry an ID.

And obviously if you are a bad guy you'll need to pretend you are dead and reborn with a new ID.

Or find an underground way to fake an ID to show cops.
[Magisk] Xorio71:
Would those “private signed” ROMs be LineageOS and GrapheneOS, since they are very well known? Or can it be any ROM as long as they use a private signing key?
[Magisk] mattburga1984:
Worked like a charm on stock rom/kernel

w/ PIF 15.9.9 and no playcurl. Thanks.
[Magisk] DylanAkp:
Anyone can create his own keys

To understand what is it exactly, you can read this :

"The test-keys are publicly known, anybody can sign their own .apk files with the same keys, which may allow them to replace or hijack system apps built into your OS image. For this reason it is critical to sign any publicly released or deployed Android OS image with a special set of release-keys that only you have access to."

in Android Documentation
[Magisk] zgfg:
Of course, why not
[Magisk] Xorio71:
So Google basically cross-references build keys with the public list of test-keys, and if there is a match, DroidGuard gets triggered?
[Magisk] ComradeWave:
You can ignore that part if you did everything correctly (assuming you're not releasing to others what you're building now, since it's less secure), skip to the signing process.
[Magisk] osm0sis:
It's the same with a Nothing print which passes on my Pixel, so it doesn't seem to be about the contents of the print beyond being one of the remaining ones.
[Magisk] albinoman887:
Do I do this AFTER I have compiled the regular unsigned way or is this done in place of mka bacon ?
[Magisk] HippoMan:
https://xdaforums.com/t/discussion-...ding-cat-and-mouse-game.4425939/post-89526462
[Magisk] osm0sis:
I tried removing all traces of evo, lineage, pif and pixelprops from the props, but no change.

OnePlus8T:/ # resetprop --delete persist.sys.pif
OnePlus8T:/ # resetprop --delete persist.sys.pixelprops
OnePlus8T:/ # resetprop --delete persist.sys.pixelprops.games
OnePlus8T:/ # resetprop --delete persist.sys.pixelprops.gphotos
OnePlus8T:/ # resetprop --delete persist.sys.pixelprops.netflix
OnePlus8T:/ # resetprop --delete ro.boot.type
OnePlus8T:/ # resetprop --delete ro.build.flavor
OnePlus8T:/ # resetprop --delete org.evolution.key_type
OnePlus8T:/ # resetprop --delete org.evolution.version.prop
OnePlus8T:/ # resetprop --delete org.evolution.version.display
OnePlus8T:/ # resetprop --delete org.evolution.version
OnePlus8T:/ # resetprop --delete org.evolution.ota.version_code
OnePlus8T:/ # resetprop --delete org.evolution.device
OnePlus8T:/ # resetprop --delete org.evolution.build_version
OnePlus8T:/ # resetprop --delete org.evolution.build_type
OnePlus8T:/ # resetprop --delete org.evolution.build_date_utc
OnePlus8T:/ # resetprop --delete org.evolution.build_date
OnePlus8T:/ # resetprop --delete org.evolution.build_codename
OnePlus8T:/ # resetprop --delete ro.boottime.vendor.lineage_health
OnePlus8T:/ # resetprop --delete init.svc.vendor.lineage_health
OnePlus8T:/ # resetprop --delete init.svc_debug_pid.vendor.lineage_health

Of course we already spoof TAGS and TYPE in our default prints formats, so however they're checking the ROM's signature is outside of both andoid.os.Build class fields, and the ROM's build props. Something more like the kernel string ban.
[Magisk] Nergal di Cuthah:
I'm sure this has been considered and wouldn't work if encrypted but has anyone wiresharked droidguard
[Magisk] osm0sis:
I've previously used stackplz to grab a complete log of com.google.android.gms.unstable with ./stackplz -n com.google.android.gms -s all | grep $(pidof com.google.android.gms.unstable), but it didn't reveal anything useful about the kernel string ban at the time I did it. Could be worth trying again on this new version of DG. The last log I made was ~4mb to comb through. 🙁
[Magisk] Nergal di Cuthah:
Well i looked it up, realized idont speak Chinese came here to complain, realized i had a pixel and google translate and now i know. Do that iphone
[Magisk] Xorio71:
Could you please briefly explain to me the whole thing? I am a bit confused on the requirements to pass device integrity now.
[Magisk] Nergal di Cuthah:
We don't know for sure...but it seems like custom romming is going to change

Edit nothing changed if you're not on an unsigned rom, is how it currently seems
[Magisk] LastDarkWarlord:
Good to know i wasnt crazy when i distributed signed EvoX builds from the very beginning
[Magisk] osm0sis:
Certain ROMs might also have their private keys banned, that part is still unclear since we don't know if crDroid, PixelOS and EvoX were properly private release-keys signing their builds before. Hopefully someone can confirm that one way or the other.
[Magisk] LastDarkWarlord:
if the rom you are compiling is lineage based you can follow this guide: https://wiki.lineageos.org/signing_builds
[Magisk] LastDarkWarlord:
EvoX devs do not sign builds normally
[Magisk] RAZINARES:
Is it working for you?
[Magisk] LastDarkWarlord:
ill be checking with testers just to be sure
[Magisk] Nheo12:
On EvoX works the PI DEVICE, only just with 15.9.9?
[Magisk] Nergal di Cuthah:
I mean...read the posts that exist before you ask. Literally we don't know and some evox builds have been reported working, but some not.
[Magisk] Nergal di Cuthah:
So it has to be signed in a particular semi-undocumented (all I've seen is the lineage instructions linked) manner?
[Magisk] Nheo12:
Sorry, thanks!
[Magisk] Nergal di Cuthah:
@Pig5556 I'm not sure what you're trying to communicate with this post. Your bootloader says locked and it's an entirely different screen from the one you quoted.
[Magisk] joeyhuab:
We used to in Android 13 but not recently. I'll try to make a signed build today and confirm. :)
[Magisk] osm0sis:
Easiest way I've found so far is by checking the contents of otacerts.zip... Even on a release-keys ROM like crDroid, when it's still only using test-keys the zip has the file named as such!

OnePlus7Pro:/ # unzip -l /system/etc/security/otacerts.zip
Archive: /system/etc/security/otacerts.zip
Length Date Time Name
--------- ---------- ----- ----
1675 2008-01-01 00:00 testkey.x509.pem
--------- -------
1675 1 file

Can someone on official PixelOS run that command from a root prompt?

Edit: Before anyone asks, it's not as simple as replacing that file. If it doesn't outright break your ROM, I tried that on an unencrypted device even, on unofficial Lineage, and it doesn't have any effect on the verdicts.
[Magisk] joeyhuab:
How did you sign your builds? Via the Lineage guide as well? I think we need an easier guide eventually lol
[Magisk] albinoman887:
Yeah that "guide" if you can call it that , seems like it was written by a schizophrenic
[Magisk] Nergal di Cuthah:
As a diagnosed schizophrenic (not joking) i agree with this comment
[Magisk] Flr Power:
Scotty, beam me up 🙄
[Magisk] aNGERY:
I'm struggling to pass device integrity on a oneplus 12. I have Play Integrity Fix and play curl installed. I can't pass on this, but my other phone (oneplus 9 Pro) is fine.
[Magisk] Nergal di Cuthah:
Uninstall curl and delete custom pif and update (or reinstall) the latest module. And if further question please read the last 2.5 days of posts in this thread and the pi faq
[Magisk] aNGERY:
I did skim the posts but it seems like the current hot topic is custom roms. Regardless, what you said worked, so thank you for that.

I'm assuming since most of the fingerprints were banned, curl is dead now?
[Magisk] Nergal di Cuthah:
No but the module currently contains latest fingerprint thus redundant. As to my solution, or curl useless or not idk. What i do know is those steps i gave were given in the past 2.5 days and how i knew them.
[Magisk] aNGERY:
Works for me. Thank you for the help
[Magisk] pr3dicament:
I'm going to attempt to sign a rom but I doubt I can do it and get things working. I'm going to try LOS, probably, after trying some other builds for Nameless via 'signing' the roms. I can't get "Device Integrity" to pass so far though, either, unless on a stock rom and locked bootloader. I've had the bootloaders unlocked for years.

It's the exact same device model, same device or at least same device type.. but it fails device integrity no matter what. It used to be fine when using the PlayIntegrityFix. You can't even use the RCS chat features if it doesn't pass that, so it's actually a fairly huge deal. For those that use playcurl.. the current pif.json just has null in the string everywhere, suddenly, and I made sure to try and replace it with sailfish again as i had it saved.. but the "latest' didn't even have sailfish added within it. I honestly don't know what else I'm supposed to do besides just go back to stock completely and not root at all, which feels impossible to me. I've never not rooted.

My guess is that the build has to be signed.. I tried looking at that wiki for signing builds, and even thoiugh I'm well-versed in adb and fastboot,. the instructions are unintelligible, at best. I can confirm that three separate working devices, all using OnePlus (6T and 8T), Device Integrity now FAILS and it were just working <=24 hours ago. playcurl apparently is now pulling "null" for all strings, as well. [EDIT: They updated playcurl to revert back to sailfish which still fails on Nameless.]

This is a mess. People like me are completely SCREWED.
[Magisk] pr3dicament:
It's unintelligible, at best.. at least at the moment. I'm gonna have to try LOS21 too but this isn't helping me. Gonna download a signed nightly and see what happens.
[Magisk] DarkEagle82:
unzip -l /system/etc/security/otacerts.zip <

Archive: /system/etc/security/otacerts.zip

Length Date Time Name

--------- ---------- ----- ----

1675 2008-01-01 00:00 testkey.x509.pem

--------- -------

1675 1 file

Latest PixelOS cepheus
[Magisk] BillGoss:
Fyi, I'm running official Los 21 (240419) on my OnePlus 8T with PIFork and it passes both basic and device integrity.
[Magisk] DeannWinchester:
It Must be a signed build, Bill.
[Magisk] Lobod:
PixelOS is only signed with test-key, even official one.

View attachment 6106386

Last official sweet build from 11.05.24.

Unoffcial test build was exactly the same

Also got info from maintainer that they are not signing with PK(that match what I have checked)

As far as I know changing encryption key requires to clean flash right?

Edit:

For anybody else looking fot this files.

ROM.zip->META-INF\com\android\otacert
[Magisk] ComradeWave:
1) Generate the keys

2) breakfast <codename>

mka target-files-package otatools (but after the first time you can just use brunch)

3) Copy and paste the absolute unit of a command of "Signing process for LineageOS versions 19.1 and above"

4) Generating an install package

The first two steps can be skipped after you ran them for the first time, then you can just do brunch and step 3 and 4

This little guide is useful only if you're building for yourself! If you're building to release the OTA, when you're generating the keys, use a password.

Sorry for the late reply, I was sleeping.
[Magisk] joeyhuab:
Thanks for at least making a concise version that others can understand. I'll try it later!
[Magisk] ComradeWave:
You're welcome :)
[Magisk] 4RCH1 H4CK3R:
Suggestion from personal experiments:-

Just use default fp of your device as the spoofed fingerprint, that'll only stop working if Google decides to take down all specific devices regardless of rooted/ locked bl
[Magisk] ComradeWave:
Would that work? Don't you need an older device's FP?