yashsingh1/xdaforums huggingface dataset:
[Magisk] pndwal:
👍

Yes, crossed my mind too... I would have assumed calling app still only needs GMS access, but maybe it does need vending access too... Can't see why it would unless integrity API is actually now split across various Google Play apps, and I still wouldn't assume that it does need it... Please clarify, Is that error message from TB Checker itself (ie. is it just checking for P Store independently)?... But I assume it's actually part of PI response (and occurs in raw JSON)?... (If not, other apps may still just access GMS.)... A screenshot of JSON would be interesting too. 👍

I noticed that the replacement flow diagrams are more vague about the 'integrity API', not indicating it's in Google Play Services (GMS) any longer... Also, there's the addition of 'standard' (low latency) API requests and 'classic' requests have changed. In both types the calling app now receives the signed and encrypted verdict back from the Play Integrity API, passes it to the app's backend, then the backend sends the verdict to a Google Play server which decrypts and verifies the verdict before returning attestation results to the app's backend... Previously the Play Integrity API handed an encrypted verdict directly to a Google Play server for decryption and signing, then the results were sent back to the Play Integrity API before being passing the attestation to the app which in turn passed it to it's back end for verification and decisions...

You may be right about GMS internally calling Play Store for appIntegrity Play_Recognised but this is doubtful since that check of only affirms that the calling app and certificate match the versions distributed by Google Play so will only poll Google's database and documentation doesn't indicate that P Store is accessed... The documents do indicate that the newer (still beta) environmentDetails field polls Play Store for the appsDetected check (for all apps installed) however... Further, if unevaluated (blank), "The version of the Google Play Store on the device is outdated" is a given reason.

Yeah, it's interesting that TB may need all Google Play components present... I wonder if it also needs access to the separate Google Play Protect Service app in late Pixel devices (for new environmentDetails field playProtectVerdict). 🤔

Yeah... But please confirm that that error message is in PI verdict raw JSON... 👍 PW
[Magisk] zgfg:
Here you have screenshots - first, for TBChecker, HMA Whitelist enabled, System apps not excluded

- excluded (whitelisted) only Google Play Services

- it shows incorrect error that Play Services 13.0 are required (not about missing Play Store)

Did the same but having Play Store whitelisted.and Play Services not - resulted with the same error

Did similar experiments but with PI Checker, Simple PI Checker and Integrity API.

With only Play Services withelisted they (correctly) complain about Store missing

Yasnac, when Play Store is not whitelisted, wrongly complains just like TBChecker, that Play Services are missing

There are no options to look for Raw JSON - error is returned before calling to gms

PS: When testing, always close TBChecker/SPIC, make changes in HMA and close HMA, then retest with TBC/SPIC

Also, the other checkers above do not have options for Root Check, XPosed Check (as in TBChecker). Hence no point in using HMA for them - I did it just to compare SN/PI results with TBChecker when HMA hides Playstore from them
[Magisk] flobo09:
Lost RCS again as of this morning.

My key from last October still worked until May 2nd where TB checker told me i was no longer passing device but somehow Google Pay & RCS kept working until today.

It happened on both my Pixel 6 & my galaxy s23 around the same hour:

Still worked about 2 hours ago, it's dead now on both devices.

I wonder if it somehow checks if the key is valid only once a month on the 1st ? Would explain it.

EDIT : at least you have a clear "error" now, better than the endless trying to connect

View attachment 6109007

Switching to chiteroman latest key works of course, my good old key got a good run.
[Magisk] markdewet:
OK, I seem to either be not communicating properly or upsetting/confusing/just pissing a lot of members here off. So, to put it a simply as possible:

1 I have read elsewhere that enabling developer mode in SOME instances can also cause SOME apps not to work.

2: Evidently I have discovered/uncovered some previously unknown function it TWRP, namely the terminal application, in "Advanced" settings of TWRP.

3: In any event, it seems bottom line is that I have a test key which obviously is not passing some test.

So at the risk of further upsetting someone, I am going to ask, is there ANY way of changing that test key to one that is acceptable to apps, which in my case is Google Wallet?
[Magisk] generalculprit:
This is way offtopic, but you might want to look for Swift Backup. Titanium Backup is outdated.
[Magisk] avgogi:
Thanks will check it out
[Magisk] shoey63:
You need to get the developer of the rom to sign it with release keys or compile it yourself with such keys (no mean feat).

Or change to a different rom with the required signing.

And yes, twrp terminal is an effective and powerful emulator, but is a rarity on most modern devices, hence the recommendations to just install one.
[Magisk] markdewet:
Ah Ok, thank you, sir, and I am going to LOL here, as compiling a ROM is as you say, no mean feat. WAY out of my league!!

Regarding changing to a different ROM, it seems that trying to fined a ROM for the S8+ that is correctly signed is almost impossible, especially one that is at A13 or A14.

RE TWRP terminal, yes, I find TWRP in general to be very useful, it is something I HAVE looked at extensively and thus starting to understand how to use it (and still learning all its features), so that is why I kept asking about it.
[Magisk] generalculprit:
IIRC your rom is discontinued, so you can't ask the maintainer to sign it with valid keys. You would have to compile the rom yourself and sign it with private keys.
[Magisk] markdewet:
Yes,seems it is discontinued, I have tried to contact the developer, to no avail. Trouble is finding a custom ROM that is signed correctly for S8+ is as said difficult currently and compiling a ROM is WAY above my capabilities
[Magisk] generalculprit:
Then you might consider upgrading your device. To my joy the s20 FE is now officially supported by LineageOS. But this is also OT. 🥴

<vanishing>
[Magisk] markdewet:
LOL, would love to upgrade my device, however, I am a pensioner and even 2nd hand phones in South Africa are horrendously expensive, especially Samsung and yes apologies, this is also OT, but had to respond.
[Magisk] Wolfcity:
Jfi: adb via wireless is available on A11.
[Magisk] Vision:
Oh yeah, sorry my bad, A11+

View attachment 6109054
[Magisk] zgfg:
And now a test with a real app, Mobile Pay (in another thread somebody claimed that it detects 'root' - however, no problem for me)

Also, if I use HMA to hide either (or both) Google Play Services and Google Play Store from Mobile Pay, then it pops up that Google Play Services are missing - screenshot

Both must be bot be hidden from Movile Pay (and then with DenyList, Zygisk Next and Assistant, PIF and HMA it opens fine for me - I just stopped when it asks for my IDs)

Hence Mobile Pay does use Play Integrity, Device Integrity is ok (Strong not needed) and for Play Integrity it must access both Play Store and Play Services - like in the experiments with YASNAC, PIC, SPIC, Integrity API and TB Checker
[Magisk] GeTex:
Thankyou for catching one of my problems! My rom has release key props and testkey signing.
[Magisk] intel_core_i7:
Except for LG's stock LGUX, good luck finding it. That's why I never liked LG phones although the hardware is near excellent
[Magisk] SXMAX:
Hello, I read everything starting from page 750 but still don’t understand how to get «MEETS_DEVICE_INTEGRITY», I have modules installed playintegrityfix 15.9.9 and playcurl 10.6 but still it only gives me «MEETS_BASIC_INTEGRITY», is it possible to get it somehow «MEETS_DEVICE_INTEGRITY»?
[Magisk] majorfigjam:
You have given no information that is useful.

What device, what rom? If not stock, what kernel? Is it signed with a test key?

Have you deleted all legacy pif files?

Without that information, we can't help.
[Magisk] sawdoctor:
Try removing play curl and just use play integrity fix (latest version)
[Magisk] zgfg:
Remove playcurl, reinstall PIF and reboot

If you were reading the pages, PIF 15.9 comes with the built-in prints, so why do you need Playcurl.

They all give you the same prints, but the pif json may have a wrong format or something - so stick with the built-in prints in PIF 15.9

Less is better/simpler
[Magisk] harvas81:
Hello, community. I have a Samsung A320FL with this rom https://github.com/debie-A320FL/OTA/releases.

Last 10 days I cannot pass DEVICE integrity, due to testkeys. So no Google wallet for me. I have read the last pages of this thread. Of course I rooted my phone.

How can I contact the developer of this ROM? In github, there is no direct "contact developer" option. So how can I contact him in order to recompile this ROM? I think that only this guy can resolve my problem.
[Magisk] zgfg:
Usually you will need an account on GitHub and then you submit the Issue

Or, look if there is a Telegram channel or something
[Magisk] intel_core_i7:
After a day of work, for many using newer Android versions (not all), bootloader spoofer is required to work (although YMMV, for many the root detector is still tripped when it was installed, one or 2 don't need it - those don't need it are using custom ROMs with local hardware attestation spoofing hard baked into the ROM). @huskydg also said the app does indeed make a local check for bootloader unlocking status.

This is probably the first app in the Android world which checks for that while having support for Android 5-7.
[Magisk] zgfg:
For me VNeID crashes with Bootloader spoofer.

Without BL Spoofer it pops up something (screenshot)

Similarly, Complete Control app (Playstore) - with BL Spoofer it crashes, without BL Spoofer it pops up about 'root'

Sorry for OT
[Magisk] intel_core_i7:
VNeID is asking you to turn off USB Debugging, probably means Bootloader spoofer worked since bootloader unlocked detection will throw a different message. Using IAmNotADeveloper will help.

Thanks for testing, appreciate it.
[Magisk] markdewet:
Hi all, OK, so I have only one hopefully final question and that is:

It does not matter what modules you install into Magisk, if the ROM is signed using test keys then NONE of these Magisk modules will work or assist in any way, correct?
[Magisk] MrSteelX:
Yes
[Magisk] markdewet:
Thank you. Will have to see what is next for me, then.
[Magisk] beardedwonder:
I finally got a print!! Although a return of 1 print from 348 props isn't great.
[Magisk] HippoMan:
One out of 348 is around the best we can hope for by now, and sadly, finding a usable FP is likely to get even more difficult as time goes on.
[Magisk] michalrobeck:
Interestingly the Chase UK (banking app) has the same behaviour. Gets stuck on white screen with logo if bootloader spoofer is not present. If it is present it'll crash.

Sent from Redmi K20 Pro using ReLabs
[Magisk] manjaroid:
Discouraging numbers but great effort.

Too bad dead fingerprints aren't like losing lottery tickets, where if we collect enough of them we get a free donut or something.
[Magisk] angrypizza:
I have latest integrity fix and shamiko,

deny list for play service, pay store, wallet. (framework will auto uncheck itself if exit and return to magisk. play protect doesn't show up in deny list)

it says this device can't be set up to tap and play cuz it might be rooted when trying to add the same card the previously worked.

running crdroid android 11 on s7.

what I'am missing
[Magisk] samhhmobil:
As very often is written here before:

Many apps are not only looking for root traces (which you can hide with Shamiko) and/or device integrity (which you can reach with latest PIF), but many different apps are using many other different tests:

- Some are looking for the existence of 99-magisk.sh in addon.d,

- some other are looking for TWRP- folder,

- some other are looking for apps on your device, which are known to need root (for example TitaniumBackup, but many others too),

- some other are looking for traces of CustomRom in build.prop,

- some other are looking for ... ... ...

- some other are... ... you tell us.

So we cannot know, what YOU in your special configuration are missing.

samhhmobil
[Magisk] majorfigjam:
Do you even have device integrity?

Is your crdroid properly signed?
[Magisk] crypticc:
Mine works without shutting like this. I don't use lsposed
[Magisk] michalrobeck:
Oh that's really interesting, what's your setup?

I'm on EvolutionX Android 14, running Kernel SU and then to hide everything running:

Zygisk Next

Zygisk - LSPosed

Shamiko

HideMyAppList (through LSPosed)

Bootloader Spoofer (through LSPosed)

There's an XDA thread to do with the (I think) American app where they have to use original boot.img to setup the app and then they can use it 🤷
[Magisk] ThePioTug:
Hi, i've been trying to sign a build, however the ota_from_target_files just doesnt exist, ive tried to run it as a python script on its own but no success, does anyone have an idea how can i do it?

ive tried to run it after building and it doesnt work

View attachment 6109522

EDIT: oh and also i suppose if you want to sign a GSI rom the steps to sign a build are similar?

EDIT2: so i got to this point of signing and i dont know why doesnt it want to rewrite build.props

View attachment 6109533
[Magisk] Sage:
Thank you
[Magisk] crypticc:
I have very basic setup

Pixel 6 pro

Stock

What I found needed...

Magisk (alpha) **

PIF

Zygisk next **

Shamiko **

Renamed Magisk to something (not "settings" which is detected)

Sorry, just remembered I also use Icebox to deactivate all the root apps when not in use, including the renamed magisk

Edit: in last week I've installed Zygisk assistant too, but I've not tried out the app that I was hoping that would help with yet. The app we're discussing didn't need it though

** actually I found Magisk Kitsune incl MagiskHide / unmount and enabling whitelist mode worked also. But I've been using Zygisk next and Shamiko for the last month because I some other apps didn't like in-built zygisk needed for PIF and MagiskHide/unmount didn't seem to cover it.
[Magisk] zgfg:
Bootloader Spoofer spoofs for Momo (but also causes Momo to detect Magisk and Zygisk that it doesn't without Bootloader Spoofer)

IAmNotDeveloper hides ADB/USB debugging for Ruru (but does not hide for Momo)

Nevertheless, both Bootloader Spoofer and IAmNoDeveloper do not help me anything for VNeaID, Complete Cobtrol and Chase UK - all three crash on start (DenyList, Zygisk, Zygisk Assistant, HMA)

TG, I don't need any of those apps, and I have no 'root' detection problems with those that I need

(I also tested yesterday and didn't have problems with MobilePay, Dannish nor Finnish)
[Magisk] michalrobeck:
I know you can stop Momo from detecting the bootloader spoofer by turning off "logger buffer size" in developer options.

I couldn't turn it off but that's because I had to disable "Enable watchdog logs" in lsposed.

After that it worked okay, there's a GitHub thread about it here: https://github.com/chiteroman/BootloaderSpoofer/issues/7

Sent from Redmi K20 Pro using ReLabs
[Magisk] intel_core_i7:
The ones who successfully bypass vneid used kitsune magisk and the new lsposed mod. I would say the custom root detection found in Vietnamese banking/govt apps are just nasty. They don't use PI for some reason though.

Anyway, thanks for testing. I have enough people showing me their findings in other communities.
[Magisk] michalrobeck:
Running stock on the pixel might be the main difference then.

I have a feeling Chase UK is checking if there's a custom ROM installed and failing/crashing/not launching based on that.

Any module out there to easily spoof something like that?

Sent from Redmi K20 Pro using ReLabs
[Magisk] Bio69:
Thanks, how to do for pads Strong Integrity? Regards 😉
[Magisk] Bio69:
Thanks 👍

I try Zygisk Assist and it work like Shamiko... Problem not resolved. Regards 😉
[Magisk] Nergal di Cuthah:
https://xdaforums.com/t/pif-faq.4653307//unread
[Magisk] majorfigjam:
Revert to stock and lock your bootloader is the only truly safe way to do that.

You could try TEE hacking, but you'd likely brick your device.
[Magisk] westruk:
Latest alpha + shamiko, but vneid still detecting root
[Magisk] pndwal:
Yeah, interesting results... Main thing it indicates to me is that apps requesting integrity verdicts are polling basic device info incl. Google Play components and version no.s before the integrity check so they don't even make the call if prerequisites aren't met.

Looks like that occurs possibly to prevent wasting an App's daily call quota when an app may make repeated calls that can't succeed, and the generated error messages are implemented by the calling app (not an official indicator from Google) also, so may be more or less accurate... Guessing TB dev may have implemented (copied code) a similar error dialogue to YASNAC which may explain why these only state Play Services are missing when, in fact, it's a Play Store issue...

Still think you'd probably see something similar if Play Protect Service were hidden in HMA on late Pixel devices also. (My guess is that all Google Play components may now need to be accessible for a successful integrity evaluation. Nb. They are of course all part of GMS suite, some just separate from GMS app).

So if a dummy ('placeholder') Play Store (vending) package is installed (as in the case of microG FakeStore, microG Companion etc), the apps would likely be satisfied enough to perform integrity checks and S/N ones may even succeed, however PI would fail with Unevaluated messages in JSON due to missing data for the new environmentDetails field's appAccessRiskVerdict (which renders device 'not trustworthy enough' for other PI verdict evaluations).

Just conjecture: I guess late Pixels with microG would need both 'FakeStore' and 'FakeProtect' apps to bypass calling app's device detection errors and initiate integrity checks... These would still show Unevaluated in PI raw JSON for the reason given above, and even if a real vending (Store) app were installed JSON would still likely show Unevaluated idue to missing signals for another new environmentDetails field verdict, ie.playProtectVerdict, which requires a working discrete Play Protect app on those devices.

🤠 PW
[Magisk] pndwal:
Just for your understanding, the test keys are not actually unacceptable to Wallet. Wallet is only checking for MEETS_DEVICE_INTEGRITY in PI API...

Since those keys are now unacceptable to Google Play Services (GMS), specifically to it's DroidGuard/attestation process, however, Wallet (and any other apps requiring PI MEETS_DEVICE_INTEGRITY) is affected. 🤠 PW
[Magisk] beeshyams:
But the Play Protect needn't be enabled. On my Pixel 6a, I disabled it but pass 2/3
[Magisk] shubell:
I just noticed that RCS works for me with only basic integrity
[Magisk] zgfg:
Thanks. I have upgraded my Zygisk-LSPOsed and I can set now Logger Buffer Size to Off in Developer Options.

And Momo now no more reports Zygote injection when I apply Bootloader Spoofer to Momo

However, Momo still reports Zygisk Found when Bootloader Spoofer is applied (BL Spoofer successfully hides unlocked BL to Momo) -

where Momo does not report that Zygisk Found if BL Spoofer is not applied

I already have Zygisk Assistant, if time permits I will test today with Zygisk Next instead of the built-in Zygisk (Magisk Canary)

---

Btw, VNeID doesn't just crash but it reports on Unsecure device/ransomware (I've translated by Lens)

Screenshots attached
[Magisk] trevtdogg:
seems like a lot of the discussion here is getting way off topic.

instead of "how do I get device integrity?" it's becoming more like "why does this app not work?"

can we please keep this thread to device integrity related issues only?

it's already a long and fast moving thread, but general chat just makes it even harder to use constructively especially for those not checking/reading regularly.
[Magisk] pndwal:
Correct.

But I said for late Pixels (in which stock setup has the separate Google Play Protect Service app) with microG and a 'FakeProtect' (placeholder/dummy) app (to bypass calling app's device detection errors and allow initiation of integrity checks. 😜 In your case playProtectVerdict evaluation labels are still received, so Play Protect is working as expected as opposed to UNEVALUATED, which, like an empty (blank) appAccessRiskVerdict, can mean "The device [itself] is not trustworthy enough" and affect evaluation of other/unrelated fields/verdicts...

Further, whether you have working Play Protect Service app or it's still integrated in Play Services on 6a, with Play Protect simply disabled, apps will see the POSSIBLE_RISK label and may actually decide to restrict all/some functions on the basis that a NO_ISSUES condition isn't met for environmentDetails, playProtectVerdict despite having MEETS_DEVICE_INTEGRITY for deviceIntegrity, deviceRecognitionVerdict.

... Other labels for playProtectVerdict that similarly don't indicate that "The device is not trustworthy enough" include NO_ISSUES, NO_DATA, MEDIUM_RISK and HIGH_RISK.

🤠 PW
[Magisk] michalrobeck:
Are you running a custom ROM?

I did decompile the Chase UK bank app and it looks like they're using a 3rd party service for root and security checks called zimperium
[Magisk] michalrobeck:
Works fine for me only difference is I use lsposed_mod by mywalkb and shamiko. Had to restart device after changing logging.

Screenshot attached.
[Magisk] westruk:
Crdroid
[Magisk] pndwal:
And you use ZygiskNext... Many apps/security engines have now refactored for native bridge injection detection but not for ptrace+fuse... That's detectable too (even with Shamiko) but detection protocols may be slower arriving. 😜 PW
[Magisk] markdewet:
OK, so just a small update from my side, as per my question and the answer here: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89540938 I managed to get hold of the developer/maintainer of LineageOS 21.0 and he advised me that a properly signed update will be out soon, so holding thumbs. Will report back if and when things start working again.
[Magisk] intel_core_i7:
Bootloader spoofer is also required and it developer mode has to be off/hidden.

This app literally has no definite way of passing, but it isn't impossible like the French app or Niantic games demanding strong that someone brought up here. Some has to use module A, some has to use module B, some has to use all of them, some not at all. I think the testing for the vneid app should stop here, since there's already a complaint about this. Thanks for devoting your time into this.
[Magisk] intel_core_i7:
Weird. So you have successfully passed it?
[Magisk] westruk:
Yep
[Magisk] osm0sis:
Ah, but if you clear Play Store data will it still eventually show Certified with the separate Play Protect app disabled? That'd be the only thing affected I think.
[Magisk] sawdoctor:
Just read this, losing telegram would be a big problem for most of us

In the latest Telegram Android, the Telegram server may request the client to do a Play Integrity check at any time with error code INTEGRITY_CHECK_CLASSIC_X, then the client will perform a Play Integrity check and resend the request with the invokeWithGooglePlayIntegrity method.

TLDR: Telegram can check whether you are using genuine Telegram app on a "genuine" Android device at any time while you are using the app.
[Magisk] intel_core_i7:
Are you using any kind of AOSP based custom rom? Then it's probably because of built in local hardware attestation spoofing, e.g. EvoX by @joeyhuab has this

Keystore: Spoof locked bootloader on local attestations · Evolution-X/frameworks_base@cab1b0f

based from: https://github.com/chiteroman/BootloaderSpoofer Squashed: From: minaripenguin <minaripenguin@users.noreply.github.com> Date: Tue, 5 Dec 2023 19:56:07 +0800 Subject: ...

github.com