yashsingh1/xdaforums huggingface dataset:
[Magisk] neonblind:
Thank you osm0sis. Its working again. So, does that mean that my lenovo custom pif got banned because of excessive use?
[Magisk] casouzaj:
Microsoft Company Portal, and all the other apps under its umbrella, keep working here. I use Kitsune Mask, with Zygisk, MagiskHide and SuList enabled (i.e. whitelist mode). Regarding PI, I use PlayIntegrityFork V8 (and its autopif.sh script when needed) and Shamiko 0.7.5 (newer versions complain about unsupported environment). Sony Xperia 1 II here, running LineageOS 21.0.
[Magisk] osm0sis:
Means it got banned I guess, not sure about excessive use! Had it been working for you since the Feb. 29 mass ban?
[Magisk] neonblind:
yes, until yesterday. until the latest play service v.24.11 and/or play store v40.2 update. maybe it's just coincidence. are these mass ban server-side related or always related to google play updates?
[Magisk] osm0sis:
First new ban we've heard of since the mass ban, so that's a bit surprising. Especially if it's a one-off. 🤔

No, they're not connected. DroidGuard is part of Play Services, not Play Store, and downloads itself independently in the background at any time. Check out the FAQ.
[Magisk] hsmith1514:
If you're looking for datapoints, I also had a print get burned. My original one went down during the Feb 29 incident, and the custom one I switched to then got burned 5ish days ago.
[Magisk] Toastking:
I have fully uninstalled all Microsoft apps and reinstalled only Teams and company portal. The error persists. All other apps that check for root, banking etc., work without problems. Basic and Device integrity succeed.

I will have to try your toolset then because Magisk(with "hide app")+Shamiko+Original PIF don't seem to be enough anymore.
[Magisk] Vision:
Recently you have install something else ? module ? a app need root to work ?

Edit: I remember had an app and not complain about unlock BL and root but when i install a app which need root to modify i don't remember exactly , then the app start complain about the other app with need root and after i deleted all good again
[Magisk] wfred:
Nah, was just testing the script on the 32 I already had. I knew they were bad, but wanted to see how it worked.
[Magisk] osm0sis:
I've got compacted figured out, but I'm not going to support anything truly stupid like newlines in the middle of a normal json syntax line entry. ;)
[Magisk] zgfg:
Good for your cells👍
[Magisk] HippoMan:
I certainly understand if you consider the following suggestion to not be worth your effort, or if there may be some flaws in my reasoning ...

One possibility to deal with the newline issue might be to replace all newlines with a space or a null string, so that the data ends up on a single line; then to parse it that way.
[Magisk] osm0sis:
Nice solution!
[Magisk] GabbyWC:
I remember reading this post on Reddit weeks ago and now it makes more sense as to why Asus is actively preventing bootloader unlocking for the Zenfone 9. Is your phone still passing strong integrity with its unlocked bootloader?
[Magisk] Captain_Throwback:
Yup.
[Magisk] GabbyWC:
With results which are that rare and interesting, it would probably be safer to crop the time and TestID out of your screenshot. I don't doubt your credibility.
[Magisk] FrogMaster-:
I had the same issue today after updating my FW to the latest security patch on my Google Pixel 6 Pro. However I've managed to get Teams / Intune working again.

My current configuration is:

Root Solution:

Magisk 27 (No special flavors, I'm using the standard original Magisk)

I've added Company Portal and Teams to the Deny List

Enforce Denylist is disabled as I'm using Shamiko

I've hidden the Magisk package, and renamed the Shortcut that's created to "Mgsk"

Modules:

Play Integrity Fork v8

I'm currently passing Device Integrity, which I believe is important for passing Intune's security checks.

Shamiko v1.0.1

Zygisk - LSPosed v1.9.2

LSPosed Apps

HideMyAppList

Honestly I'm very confident that HideMyAppList is optional, but regardless I have it configured.

I've created a Blacklist template which has all my root relevant applications, this is applied to both Teams and Company Portal

I had to completely clear the Storage/Cache for Teams and Company Portal. Then I launched Teams, logged into my company account and it directly communicated with Company Portal. (I never logged into Company Portal directly.)

The first couple of times I did this it failed indicating that my device did not meet standards. After about three attempts of clearing the storage, then testing again it seems to be working consistently. So I suspect there may have been a cached Play Integrity Check.

Since I've seen a lot of discussion about passing this root check and can't find an up to date thread; I've written a tutorial regarding passing Company Portal: How To Bypass Microsoft Intune Root Check
[Magisk] osm0sis:
This should do the trick!

migrate.sh: support compacted json and some CR/LF mangling · osm0sis/PlayIntegrityFork@af7063d

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - migrate.sh: support compacted json and some CR/LF mangling · osm0sis/PlayIntegrityFork@af7063d

github.com

I tested it pretty thoroughly, but let me know if I missed any edge cases. 👍
[Magisk] zgfg:
Perfect, thanks

Successfully tested on this nasty example

{ "SECURITY_PATCH":

"2016-07-01", "DEVICE_INITIAL_SDK_INT": "25", "PRODUCT": "griffin_retcn",
"DEVICE":
"griffin",

// Some comments

"MANUFACTURER": "motorola", "BRAND": "motorola", "FINGERPRINT":
"motorola/griffin_retcn/griffin:6.0.1/MCC24.246-37/42:user/release-keys", "MODEL": "XT1650-05"}
}
[Magisk] maxim.a.petrov:
For some reason, Android 10 passes all checks on any firmware, but Android 9 does not?

View attachment 6083329
[Magisk] Vision:
What exactly you mean Android 10 pass all checks? with Unlocked BL ?

EDIT: in the screenshot as i see, you pass 2/3, that is good, that does it the PIF module
[Magisk] maxim.a.petrov:
I can't do the same thing on firmware based on Android 9. Basic only
[Magisk] Vision:
You have PIF or PIF fork ?

EDIT: Maybe you have something different in Android 9 that cause fail, some another module?
[Magisk] intel_core_i7:
What he probably meant was he couldn't pass STRONG on Android 9 fw, but he could on Android 10, both in locked state.
[Magisk] maxim.a.petrov:
there are no other modules
[Magisk] Vision:
Because he say,

Your 2 devices with A10 and A9 is with unlocked BL?
[Magisk] Vision:
Because he say

If mean with locked BL must follow the guide https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices i think
[Magisk] maxim.a.petrov:
No not strong. I can't get through device-integrity On 9 android
[Magisk] maxim.a.petrov:
О I have one phone but it doesn’t pass on Android 9, only the basic check. and on the tenth Android there are two checks
[Magisk] Vision:
Now, you have a device with A9, with unlocked BL, what root method you have and what PIF ?
[Magisk] maxim.a.petrov:
Pif is the one that is included in the game integrity fix, 15.9.6 magisk kitsune 27001
[Magisk] Vision:
from curious, the Key Attestation Demo what say inside, in your device with A9 ?
[Magisk] maxim.a.petrov:
Now I have the firmware installed with Android 10. I'll install Android 9 after work in the evening and take a look. But it seems to me that everything was displayed normally there. It was everywhere TEE
[Magisk] osm0sis:
That's the opposite of what I've found on my OnePlus 5 the last few days of testing old stock builds; Android 7-9 work and have DEVICE_INTEGRITY pass without anything except the global prop scripts from my module or Shamiko, but on Android 10 the behavior changes and it can pass all of SafetyNet, but only BASIC for Play Integrity and only with gms.unstable on the DenyList. This is without using a PIF json at all.
[Magisk] maxim.a.petrov:
But on the contrary, it works for me on 10, but not on 9. Everywhere miui. Below are screenshots of Android 10 View attachment 6083341View attachment 6083345View attachment 6083346View attachment 6083347
[Magisk] Vision:
In my Xiaomi A10 MIUI before work, with Kitsune Mask latest stable and PIF older version 14 and PIF fork v7

Now, i have A11 MIUI

EDIT: little confused, is the same device with A9 and A10 or 2 different devices?
[Magisk] osm0sis:
I have a hunch that it would pass on 9 if you uninstall PIF and install Shamiko instead.
[Magisk] Vision:
Because this device shipping with older version without hardware attestation and update to A9?
[Magisk] osm0sis:
Yeah, though might depend on what keymaster and launch version were.
[Magisk] Vision:
For that i write before, what say inside in Key Attestation Demo, in device with A9 ?

To see this
[Magisk] maxim.a.petrov:
НI’ve never used Shamiko, what version and how to configure it and what kind of Magisk fork or normal should it be?
[Magisk] osm0sis:
Use latest:

Releases · LSPosed/LSPosed.github.io

Contribute to LSPosed/LSPosed.github.io development by creating an account on GitHub.

github.com

Works great on Magisk official.
[Magisk] maxim.a.petrov:
I'll try it when I return to firmware with Android 9
[Magisk] Vision:
As i understand is the same device, and you're now on A10 and pass and you want to go back to A9 but there not pass?
[Magisk] maxim.a.petrov:
On the contrary, it works for me on a10, but not on a9... I want it to work on a9
[Magisk] Vision:
I understand that, but is the same device or 2 separate devices one with A9 and the other with A10 ?
[Magisk] maxim.a.petrov:
This is one phone
[Magisk] Vision:
Now i get it, and if you're now on A10 and pass, why you want go back to A9 ?
[Magisk] maxim.a.petrov:
Because on the a9, my smartphone is more stable.
[Magisk] maxim.a.petrov:
I had all the checks pass a couple days ago on a9 firmware. But after updating google play to version 40, it stopped passing
[Magisk] badabing2003:
downgrade Google play and see if it passes.
[Magisk] pndwal:
Please say what device... (I can't see where you're mentioned it). 👍 PW
[Magisk] maxim.a.petrov:
Xiaomi mi 8 lite
[Magisk] Vision:
The simple way to see if work, what about Google Play auto update ?
[Magisk] Vision:
@chiteroman @osm0sis in Key Atte. in verified boot key if you have unlocked can see random? because mine only see AAAAAA
[Magisk] osm0sis:
I'm not super familiar with a lot of that side of things, so not sure what's possible there.
[Magisk] Vision:
I ask and the @chiteroman now

because @maxim.a.petrov inside have random number and words with unlocked BL
[Magisk] st4ik:
how can I change my fingerprint?

magisk hide props seems not to be compatible.
[Magisk] Vision:
You mean for PIF module or general ?
[Magisk] Toastking:
Thanks, but it doesn't work. I have your exact same setup apart of 2 things:

- I use the original Play Integrity Fix

- I did not use HideMyAppList, however I have downloaded it and activated it for both apps just to be sure and it still fails, even after complete reinstallalation of Teams and company portal.

I did also update to the latest Android Patch version 1 day before it started failing.
[Magisk] pndwal:
Device ships wilh Android 8.1, Keymaster HAL 3.0 so clearly PIF is needed for DEVICE_INTEGRITY. 👀 PW
[Magisk] pndwal:
In case there's confusion about Keymaster versions needed for hardware-backed attestation or about how the Key Attestation app reports versions, here's another WOT:

Keymaster (0.2) and Keystore were originally introduced in Android 4.0... Keymaster introduced key attestation in Android 7.0 (Keymaster 2.0) and ID attestation in Android 8.0 (Keymaster 3.0)... Key attestation aims to provide a way to strongly determine if an asymmetric key pair is hardware-backed, what the properties of the key are, and what constraints are applied to its usage...ID attestation allows the device to provide proof of its hardware identifiers, such as serial number or IMEI... Key attestation was made mandatory for all new devices that ship with Google Play installed in Android 8.0+ (Keymaster 3.0+), so both Key attestation and ID attestation were mandated. Further, you may see a higher Keymaster version reported for the version of the key attestation feature (attestationVersion), but the version of Keymaster or KeyMint hardware abstraction layer (HAL), (keymasterVersion / keyMintVersion) is the critical one because the keystore daemon loads the available keymaster HAL and believes whatever the HAL says with respect to hardware backing of keys so apps or remote servers can only reliably verify if the keystore keys are known to be in hardware-backed storage if Key and ID attestation are used, hence shipped with Android 8.0+, Keymaster HAL 3.0+.

👀 PW
[Magisk] FrogMaster-:
Take a look at the thread that I posted, I've updated it with some additional information after extracting the source code from Intune Company Portal. From what I was able to decompile of the obfuscated code it is clear that they are checking for specific packages on the device. If you have one of these packages, it may determine that you are rooted regardless.

If you continue to have issues I would try downgrading to a lower version of Intune Company Portal. (Try 5.0.6157.0)

This discussion is pretty OT though, we're not talking about playing integrity at this point so please if you have any additional questions address them in the thread I posted earlier.
[Magisk] Vision:
Oh yeah, say Keymaster version 3.0, now i see it.

Thanks for the info. I appreciate.
[Magisk] Vision:
Excellent info. Thanks

Maybe you know, in Key Atte. in verified boot key if you have unlocked can see random numbers, words? because mine only see AAAAAA
[Magisk] pndwal:
I thought I'd seen that before but no real clue... Mine shows a long alphanumeric string. 🙃 PW
[Magisk] Captain_Throwback:
I went back and tested this again, with MHPC, because I was pretty sure I had skipped the step of actually initializing MHPC on reboot by running the "props" command once.

I had to adjust the busybox path in util_functions to point to the correct folder for APatch, but it turns out that MHPC does set the necessary props for my device to pass Strong as well. But since it required modification, I searched for a simple, alternative solution, which I found here: https://github.com/Magisk-Modules-Alt-Repo/sensitive_props

That module sets what I need without any other intervention. I don't even have ZygiskNext installed anymore, which is nice. Thanks again for the suggestions.
[Magisk] osm0sis:
It has the same issue as old USNF, so watch out for some kind of potential breakage:

sensitive_props/service.sh at master · Magisk-Modules-Alt-Repo/sensitive_props

Reset sensitive properties to safe state, take from MagiskHide code - Magisk-Modules-Alt-Repo/sensitive_props

github.com
[Magisk] Vision:
Yeah the same show in some users a long alphanumeric string, but mine is only a large string with AAAAAAA==
[Magisk] Vision:
For me never work this sensitive props unfortunately, always fail to cts.

I wish this working in my device and not need zygisk enabled and can pass 2/3 with this permanally, because look simple without needed it FP inside
[Magisk] 2faraway2:
Hopefully not OT in this thread:

How do I get basic and device integrity with microG ? microG 0.3.0 crashes regardless using pifix or pifork ..

thanks for leading me in the right direction :)
[Magisk] pndwal:
Bit confused... Doesn't that only kick in with LV A13 devices?... (I do agree it's a pretty unnecessary as it's for mismatch based bypassing of hardware-backed evaluationType enforcement, ie. device spoofing, and if an A13+ device possibly had broken keymaster so as not to require PIF, if Google hadn't disabled hardware-backed evaluationType based on fingerprint/prop set DEVICE_INTEGRITY would fail on locked devices anyway... I don't think such late broken devices will be found anyway as seems OEMs have been warned to shape up and the grace period for allowing BASIC-only passing apparently closed with Android 13.)

So AFAICS, first API adjustment won't have any effect on devices prior to LV A13, and it's doubtful that this @huskydg module has any use with A13+ devices anyway.

And his ver 2 or 1 could be used in case first API change when Andriod version is 13+ causes issues/breakage anyway...

What's more interesting to me than that ver 3 change is the change in ver 2:

• Add sepolicy.rule to block gmscore_app from using keystore

I wonder if that could help for your OP5 on A10... Long shot, but made me curious...

Of course, as with MagiskHide's mechanism to deal with 'blastula pool zygote optimization' in A10, I'm out of my depths understanding how a sepolicy.rule blocks gmscore_app from using keystore or when it's needed, but seems tricks other than resetting sensitive props and hiding root from DroidGuard were performed by MagiskHide and others may be needed/work also.

🙃 PW
[Magisk] pndwal:
What device are you trying to use it for?... Of course it can only work for devices launched with Android 7 and less or newer devices with broken OEM Keymaster or chain of trust implementations... Basically any device not requiring spoofing for HARDWARE_BACKED evaluationType enforcement bypassing including those with key attestation erroneously giving boot state as Verified. 🤠 PW
[Magisk] Vision:
For that fails always 😂🤣

Xiaomi Poco X3 NFC A11 without broken
[Magisk] pndwal:
... So if OEM implementation is all good you simply need PIF or fix integrated in a custom ROM. 😉 PW
[Magisk] Vision:
Yeah all good.

i had try some mod for framework.jar but without success

TEE hacking

Post about hacking TEE on Android devices. I will post here some useful resources: https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices https://github.com/chiteroman/FrameworkPatch And leaked keyboxes...

xdaforums.com
[Magisk] osm0sis:
Yeah, as the highlighted line I linked before shows it only resets to 32 if it's higher, but, as I said, we found with USNF that that caused some major problems on the devices it does get globally reset for, which is why we all stopped doing it globally, and started doing it with Build class field reflection instead.

Initialize DEVICE_INITIAL_SDK_INT · Displax/safetynet-fix@3eb4412

* Move changing ro.product.first_api_level from global namespace to GMS only * Set "walleye" as fake device (Google bug -> STRONG)

github.com

It was later removed again entirely because DEVICE_INITIAL_SDK_INT doesn't behave well for reflection as I've mentioned a few times.

But now we know more about it and how setting it as a prop, but only to GMS via libc getprop hook, works and that lowering it to 25 gets more prints passing.
[Magisk] zgfg:
Finished my testing, 287 passing Device Integrity (4.4%)
[Magisk] Vision:
Because something i missing.

I read for a pif-test.sh by you if i remember right.

What must i do for do the same find passing Device?
[Magisk] badabing2003:
You need to have a bigger pool of props to test :)
[Magisk] Vision:
Oh understand.

Thanks for answer. I appreciate 🙂
[Magisk] neonblind:
After successfully pass device integrity with osm0sis autopif script on every device except one I need your help again :)

This device is an old sony x compact with the last stock android 8.0 rom. it shipped with android 6.

I tried everything, latest magisk, latest delta/kitsune with and without enforce sulist, playintegrity fix and the fork with the pif i know is working on all other devices. shamiko is no option because of android 8.0.

device integrity always failed. i dont know why. kernel shows: 3.10.84-perf-[...]

any ideas?
[Magisk] Vision:
Old device with shipped with android 6 not need all this don't have hardware attestation, only add in denylist or magiskhide the gms unstable

Magisk DenyList com.google.android.gms.unstable

Kitsune Mask MagiskHide com.google.android.unstable

GitHub - Displax/safetynet-fix: SafetyNet & Play Integrity API workarounds for Magisk

SafetyNet & Play Integrity API workarounds for Magisk - Displax/safetynet-fix

github.com

GitHub - Magisk-Modules-Alt-Repo/sensitive_props: Reset sensitive properties to safe state, take from MagiskHide code

Reset sensitive properties to safe state, take from MagiskHide code - Magisk-Modules-Alt-Repo/sensitive_props

github.com
[Magisk] osm0sis:
And install last USNF MOD maybe to have it fix the bootloader props globally.
[Magisk] Vision:
Oh yeah i forgot that, still work the old USNF MOD for older devices.

EDIT: sensitive_props maybe can did this? work without riru or zygisk
[Magisk] osm0sis:
Yeah would work okay for older devices.
[Magisk] forserg:
Can I delete all data in /data/adb through TWRP for clean Magisk configuration?
[Magisk] Hassankarim:
Hii, I was flashed custom ROM, then I flashed official MIUI using Mi flash tool and relocked bootloader, now only basic integrity passing. I tried many times by flashing official MIUI.

Now bootloader is locked.

Please help me

View attachment 6083751
[Magisk] neonblind:
Up until stock Android 7 rom this was the way to go. good old magisk v23 with old magisk hide and gms.unstable, everthing was fine. with android 8.0 rom, i always had to install USNF (mod) or. play integrity fix. and it worked the last time (maybe 2 month ago or. late last year) i checked this phone (magisk 26.1 with integrity fork v4 + custom pif).

okay, tested latest kitsune 27.x MagiskHide com.google.android.unstable + USNF v2.4.0-MOD_2.0 or. sensitive_props. still dont pass device integrity check. :(
[Magisk] Vision:
I think yes you can do this, after reboot the Magisk re-create the files, and if not re-create itself, you can flash again the boot.img patch with Magisk or flash it with TWRP (if you already did it before with TWRP)

EDIT: or you can simple delete all and do a fresh install of Magisk
[Magisk] Vision:
Strange, try the Kitsune Mask latest stable or before this try the v2.4.0-MOD_1.3

And maybe this: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89403936
[Magisk] Vision:
Possible broke TEE.

the Key Attestation Demo what say inside ?
[Magisk] Hassankarim:
What's TEE an key attestation?

Where I have to check it?
[Magisk] Vision:
In Google Play search and download the Key Attestation Demo
[Magisk] Hassankarim:
View attachment 6083793
[Magisk] Vision:
Yeah you broke TEE

TEE hacking

Post about hacking TEE on Android devices. I will post here some useful resources: https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices https://github.com/chiteroman/FrameworkPatch And leaked keyboxes...

xdaforums.com
[Magisk] Hassankarim:
Now what I have to do?
[Magisk] Vision:
Is not easy unfortunately and is risky, this https://xdaforums.com/t/tee-hacking.4662185/#post-89418150

Have all the instructions inside and have and guide for broken TEE
[Magisk] Hassankarim:
Okay I'll try.

BTW thanks
[Magisk] Hassankarim:
I think it's too much difficult for me to do it.

Can service center fix it?
[Magisk] pndwal:
Yeah, of course I know there's the voWiFi issue etc if first API is changed on A13+ LV (first API level 33+) devices, but that device is Android 12 LV (API level 31 or 32) so no problem arrises since the spoof doesn't kick in at all!... No need to "watch out for some kind of potential breakage" on that device.

Further, since this module only works for devices launched with Android 7 and less or newer devices with broken OEM Keymaster or chain of trust implementations, basically any device not requiring spoofing for HARDWARE_BACKED evaluationType enforcement bypassing, it's unlikely that it will ever be used on a 33+ device, but if hypothetically some such edge case were found (and because spoofing for HARDWARE_BACKED evaluationType enforcement bypassing won't be needed anyway), a user with a 33+ device could/should just use v2. PW
[Magisk] Vision:
Yeah, i think, the service can fix it, because have instructions for situations like this
[Magisk] pndwal:
Yes. 👍 PW
[Magisk] Vision:
So simple answer.

Look mine, i don't even know why i had write all this 😂🤣

View attachment 6083825
[Magisk] osm0sis:
That's what most OnePlus devices show, nothing you can do about it because it's their f*ckup. Unless you did something specific to "break it" like that, you shouldn't touch it to avoid risking actually breaking things.