yashsingh1/xdaforums huggingface dataset:
[Magisk] osm0sis:
You can't have all of those at the same time, it's a bug in chit's PIF. Even if you were on a ROM that has some of them you generally can't uninstall/disable them yourself, hence the scripts being devised by @zgfg in the first place.

This is just the latest big regression from big rewrites and/or experimental changes without much consideration for the end user/result. There are a lot of those lately: https://github.com/chiteroman/PlayIntegrityFix/issues?q=is:issue+is:closed

Feel free to try my fork, where things are rock solid, conflicting ROM app replacement/hiding has been further refined by me and is working very well.

Probably completely uninstall chit's and reboot first to fix this mess however. 🫤
[Magisk] Captain_Throwback:
I was able to (briefly) get my hands on my wife's ZF8, and I installed Key Attestation Demo app, and Bootloader shows as unlocked. That means that it doesn't have the bug, so no Strong possible there.

Interestingly, the bug seems to be specific to the newer ASUS devices that have a recovery partition, versus the ones that use recovery-as-boot. Not sure if that's just a coincidence, or something else.

If I can find someone with a ROG 6 to test, I'm willing to bet that device has the same bug.
[Magisk] markfm:
Concerning the 15.9.6 false positive module warnings (MHPC and various other spoofer modules) on installation, today I did an in-place reinstall, then fully removed the module followed by an install - neither got the false positive warnings (which I did see yesterday, on an initial in-place upgrade from 15.9.4).

I wonder if some kind of variable initialization was accidentally removed, so it's a coin toss on whether a given person will get those false positives (which may not show on a reinstall).

(I sent chiteroman an IM on this.)
[Magisk] Vision:
The strange is, the Netflix app and others like games if not pass 2/3, not show it in Google Play in real phone, but in 1 emulator i test, i show the Netflix and other apps and download normal the Netflix but after open it say not compatible but unlike real phone not even show, if not pass the check, and of course i test the emulator error getting token without modules, and i download and 1 game i know not show it if not pass and play normal not close in emulator, how happens this?
[Magisk] osm0sis:
Makes sense. Probably because in the previous few versions he tried using the built-in Magisk/KernelSU/APatch automatic replacement functions on the full list, which probably made it blanket create all those files in the module directory, and therefore false-positives on any updates/dirty installs. ;)
[Magisk] hanschke:
I use the total commander and saw all files installed on my phone and delete them and flash it again. if it is a bug if will wait for the fix.
[Magisk] zgfg:
Referring to what?

What 'installed' files, deleted how and by what, and seeing them where, and expecting the 'bug' to be fixed where (Totalk commander, Magisk, PI Fix or PI Fork, etc)?
[Magisk] Vision:
I think says for the latest PIF and with total commander delete manually the files inside in /data/adb/ ? to fix the problems with PIF leftovers from previous version after update 🤔
[Magisk] BlueCrystal:
Uber Driver does seem to require STRONG Integrity. Some time around the beginning of November they began forbidding drivers from going online because the device couldn’t be “authenticated”. I poked around the app in jadx and while I’m by no means a pro at interpreting the result, my best interpretation is that they query Play Integrity attestation, SafetyNet attestation, and a couple other things related to the source of the app, send it up to ubers servers (i think), and from there they decide whether or not to let you go online. See here: https://pastebin.com/raw/reHc1XXH

While thats only a guess, my phone only passes 2/3 and I can’t go online and its the same with my friends primary phone, but when he uses a phone thats completely stock (locked bootloader, never rooted, etc) he can go online normally.
[Magisk] Vision:
I think this is interesting happens in emulator, for me at least, because this i want, to see the apps&games which need pass 2/3 in Google play even without need PIF or if say device is not certified
[Magisk] markfm:
Perfect, got it.

It looks like the script gets passed the path (the $1 assignment at line 18), then the guts of the script start at line 203 find "$path", where it will then look down Dir_Depth for candidate directories with .json files to be tested, lines 204 - 207.
[Magisk] xSnowLeopardx:
As always, I try to read everything but am kinda lost with what the current topic is about. Lol.

I am still happy with the 2/3 from Chitero @ v15.9.1
[Magisk] FrogMaster-:
A lot of people are discussing pulling build.prop files to generate valid fingerprints for use with PIF. As well as automating testing of PIF Json files.

Personally, I would like to have some of my own prints to avoid potentially being unable to pass device until Xiaomi has shared a new one.
[Magisk] xSnowLeopardx:
Thanks for the update, mate. I still miss my 20 prints getting banana'd, lol.
[Magisk] ashir734734:
You can use uber simply by hooking it to xprivacy lua module and tick use tracking , read identifiers and get applications . and if it still won't work also hook it with bootloader spoofer, that's how i got it working and it's still working 😃
[Magisk] Vision:
This mean with this method, somehow this can spoof or skip the Strong and the uber work
[Magisk] ashir734734:
My guess is it's skipping strong integrity check
[Magisk] pndwal:
@FredMontteiro seems to have dropped off XDA; his method (using Lua, Faker etc) posted in .txt file here:

https://xdaforums.com/t/need-help-uber-driver-app-not-go-online.4614295/post-88933879

but I just pinged another user who had it working on Pixels in September:

... Another report here from Feb 2024 (no Zygisk):

https://xdaforums.com/t/uber-driver-app-detecting-root-how-can-i-bypass-this.4652962/post-89322946

And now, just above:

... There's a lot of supposition about apps (like Uber Driver) using STRING_INTEGRITY verdict AFAICS...

👀 PW
[Magisk] BlueCrystal:
Just tried what you suggested including using BootloaderSpoofer and it doesn't work here. For fun I tried with both XPL 1.35 and XPL-EX 1.4.1, but it didn't make a difference. Perhaps they're only enforcing it by region (unless you're in the US too)?

Edit: Also @pndwal, I tested the process in the text document write up that was in the post you linked back in November, and I ended up trying it again now but its the same deal as last time, no good. Though the process listed was from prior to when it was rolled out here, so maybe they tightened up on the detection between then and now, or the methodology changed. Alternatively, it could at least be due to whatever checks they use (if they aren't actually using the PlayIntegrity checks) picking up on XPL and Busybox per Ruru, however ditching XPL is non-negotiable for me.
[Magisk] Vision:
Probably, because the bootloader spoofer, @chiteroman say only Spoof locked bootloader on local attestations, and the uber i think is server basic, or I'm wrong, because never had used before the uber
[Magisk] osm0sis:
I just got one today as well! 🤯

Though it's unclear if that's because of the extra stuff I added to the Shamiko DenyList or not.

Now.. to see if the new Magisk post-OTA Inactive slot stuff works.. 🤔
[Magisk] pndwal:
Please can you confirm you do mean Uber

Driver

app, not regular Uber? 👍 PW
[Magisk] kaidelorenzo:
I've searched around for a while and can't find any great information. What would be the general approach for integrating play integrity fix like functionality into a custom rom build? Initially for myself but maybe for others in the future. I'm mostly interested in passing 2/3 without needing to root my phone.

Would it be just setting the right device properties? My phone a Oneplus 5 (cheeseburger) actually fits in the category of devices that are ABV 1.0 but upgraded to android 8 so I think it's ok to present "spoofed" original values to all apps.
[Magisk] pndwal:
This phone launched with Android 7 so you don't need PIF spoofs. 😉

To pass PI DEVICE_INTEGRITY a ROM should simply use valid stock OP5 fingerprint and matching security patch dates, and set any 'sensitive' props to non-suspicious values...

With root, you can use any custom ROM and simply hide root from the GMS DroidGuard/attestation (Google Play Services, com.google.android.gms.unstable) process using Shamiko which will also set sensitive (old 'MagiskHide' and more) props properly.

🤠 PW
[Magisk] osm0sis:
With further examination, I think my previous theory about rooted users only receiving Full OTAs might be correct!

I didn't need to unroot with the Magisk app before updating this time, so it obviously was a Full OTA, and then Install To Inactive worked perfectly as described.

Also probably means my Shamiko'd DenyList hiding of things probably didn't make any difference or I would have gotten an Incremental OTA.

So maybe they'll only bother with Full OTAs for QPRs or something, explaining the big gaps with no updates we were seeing.

Also *checks thread page number* 🤘:devilish:
[Magisk] ashir734734:
yes I'm talking about uber driver app 😉
[Magisk] ashir734734:
I'll record

here i have attached a video for you i mistakenly said to tick read identifiers also which you should not else you won't be able to go online
[Magisk] Nergal di Cuthah:
Starting to think pig switched course and now wants us all on a single print for manageablity. X print since 29 feb still no ban.
[Magisk] osm0sis:
Maybe they're still on March break. They've taken extended holidays before. 😉
[Magisk] Nergal di Cuthah:
They break for U.S. college basketball
[Magisk] GabbyWC:
I think that 👹 and 🔥 could also be relevant emojis for this page number. Sorry, moderators, for the off-topic reply. I'll see myself out for now. 👋🏻
[Magisk] ArchVisions:
Hello! Just wanted to ask, how would I successfully flash the PIF along with MinMicroG? Every time I install PIF, MicroG gets overwritten.
[Magisk] jrotaetxe:
Another anchovy in the bait ball...
[Magisk] hutber:
my key attesttantion broken i use this latest module, play store certified and all of app i'm using work normal.

do i need to fix key attestantion? the keybox.xml thing

if i fix it, are there any benefit?

i have no plan to lock the bootloader?

my device poco f3nrom stock global no plan to use custom rom
[Magisk] HippoMan:
There's now a new thread for discussing the Googlefrinchians' motives and methodologies:

https://xdaforums.com/t/the-real-motives-for-googles-recent-play-integrity-restrictions.4662793/
[Magisk] FrogMaster-:
I've developed a more efficient method to remove the Moto Footer/Header during the sparsechunk conversion. Sharing my method to remove the Headers/Footers as it's quite a bit faster using ddresuce over dd.

GitHub - FroggMaster/CleanMotoImg: Removes Motorola's Header/Footer from system.img files.

Removes Motorola's Header/Footer from system.img files. - GitHub - FroggMaster/CleanMotoImg: Removes Motorola's Header/Footer from system.img files.

github.com

#!/bin/bash
# Perform Sparsechunk Conversion
echo "Calling simg2img to perform sparsechunk conversion to RAW IMG file"
simg2img system.img_sparsechunk.* system.img.raw

# Use DDRescue to remove the Moto header by skipping the first 131072 bytes
echo Removing the Moto Header from the system.img.raw skipping the first 131072 bytes
ddrescue -b 512k -i 131072 -o 0 system.img.raw system.img
echo "Removing Raw Image"
rm -rf system.img.raw
echo "Removing Moto Footer"
# Use DDRescue to remove the Moto header by removing the last 4096 bytes
ddrescue -s "$(($(stat -c "%s" system.img) - 4096))" system.img system_cleaned.img
# Old Method using HEAD
#head -c $(( 4*1024*-1 )) system.img > system_cleaned.img
echo "Removing Moto Image"
mv -f system_cleaned.img system.img
echo "Removing sparse chunks"
rm -rf *sparsechunk.*
echo "system.img is ready"
[Magisk] Vision:
You pass 2/3 ? if you pass you're good (i think)

if you want to lock BL and have broken TEE, then you need the keybox.xml thing.

Because if lock with broken TEE, even and lock can't pass even the basic
[Magisk] zgfg:
N > 55, still counting, near nowhere till the end😃
[Magisk] pndwal:
Generally devices with broken keymaster implementations will have BASIC and DEVICE when locked/stock as exceptions (errors) will cause fallback to BASIC-only attestation (and even if that doesn't occur naturally, OEMs could just push an update that forces the fallback)... TEE certificate chain or other must be fixed to restore MEETS_STRONG_INTEGRITY AFAIK however. 🤠 PW
[Magisk] Vision:
Oh yeah, i think i confused, because i read if not pass even basic without Magisk something wrong in your ROM
[Magisk] pndwal:
Mmm, but ROM doesn't change TEE...

Re. failing BASIC, yeah, could be ROM or just some mod that isn't hidden; root, disabled selinux and various other basic security compromises can/will break that. 🤠 PW
[Magisk] Vision:
Yeah exactly this.

Thank for info. I appreciate
[Magisk] majorfigjam:
...

Thanks! I too finally got round to rechecking all my old jsons of prints, using your script. Less than 5% success rate, but better than nothing, and once again off the 'public' print.

Maybe page 666 was a good omen this time?
[Magisk] Fishawy:
Apologies if this was asked before, but I would like to retest my fingerprints stock. Where should this script be placed and how do I test it?
[Magisk] majorfigjam:
Create a pif folder in internal memory on the phone (I created & used /data/adb/user),

Copy the script into the 'user' folder

Copy a test json into it, as you'll need to check that the script kicks the right button in TB Checker (see about 2 pages back #13283 for what you need to change if it misses, and other useful help from the author)

Mark the script as executable, and run it - any terminal, root explorer etc should work

if it correctly selects Integrity Checking in TB Checker, you can run for real

Copy a folder tree of jsons into it your 'user' folder, and run the script

Sit and wait.

Check the log for any successes

.
[Magisk] Iridule:
Any luck finding other prints anyone?
[Magisk] Nergal di Cuthah:
Literally within a page people said they'd found a small number of working prints.
[Magisk] Fishawy:
Thanks, I just did that, but as per the log they're all coming back as 'inconclusive', which is found on the script, but I'm not sure what I'm doing wrong.
[Magisk] majorfigjam:
So on your test run, did the script kick the Play Integrity check? Are there any other errors on the log file?

You'll need to watch the responses as it runs at first, to identify it's working as intended.
[Magisk] Fishawy:
I'll do some more reading and try again. Thanks for your help.
[Magisk] majorfigjam:
If it doesn't hit the right button, it won't run the right test. You may have to adjust the coordinates on the screen. I had to adjust slightly upwards on my Pixel.
[Magisk] Jackychans:
Hello,

I'm developing lineageOs in the way it can pass DEVICE_INTEGRITY natively without installing magisk (and PIF).

However, now I can pass only BASIC verdict, while falling DEVICE_INTEGRITY (and failed CTS check from safetynet as well).

I spoof using stock rom fingerprint collected.

I think there gotta be some other properties.

Do you have any advise so I can research about this?

These properties has been applied to my own custom lineage
[Magisk] Jackychans:
Hey Tom, can you share how to test fingerprints ?

I collected 10-20 fingerprints now but dont know quick way to verify if it is able to pass DEVICE_INTERGRITY
[Magisk] majorfigjam:
Read back the last two pages, you'll find lots of detail and a script that will check them for you. Or do it the manual way, by renaming and adding each print to your module's chosen folder in turn, then running TB Checker. EDIT: If doing this manually, you'll need to stop and clear cache of Play Services between checks.

But don't be surprised if none of your 10-20 work. Less than 5% of previously workng prints are now working, after the mass cull on 29 February.
[Magisk] zgfg:
I have updated the script,it now correctly checks if API Level is already 25 in the corner case, for the compacted JSON files (whole JSON file in one line), and with better logging to pif.txt

Got 81 private till this morning from about 1600+ tested during the last two days
[Magisk] Hikari no Tenshi:
Had 4000+ jaysons created from prop files of *tadi*.

After mass ban started to test them. Tested about 3000 jaysons but all failed. Tired waiting for rest and separated all to two groups: Android 1-8, Android 9-14 (never had luck with prints from Android 9 and above).

Tested 600+ jaysons from Android 1-8 group and all failed.

Downloaded 200+ stock ROMs for different phones.

From this 200+ jaysons only one passed 2/3.

Currently have 867 jaysons from devices with Android 4-8 and only two working prints among them (one is public moto print).
[Magisk] zgfg:
Look into the phone when it executes and check does it correctly kick Run Play Integrity Check from TB-Checker

Maybe your screen resolurion is different and you need to adjust

TBCHECKER_Y_COORD

Open the script and look into the constants on top.

TB-Checker results Basic and Device Pass/Fail must fit to the dcreen, otherwise the script will not 'read' them

Or switch from TB-Checker to SPIC by commenting/uncommenting the lines 145/146

Start testing with only one or two JSON files, inspect how it goes, what happens, adjust things - before going for mass-testing

I usually put 100-200 JSON files, it takes an hour or two to finish. Then I nspect and save results, use the phone for other things, and then give it another chunk to test

Tonighr I gave it three subfolders with about 200 JSON files each, two were finished with 21 passing Device Integrity and 5 Inconclusive (when retested later I got 3 more Device)

Third folder was just started but the phone went asleep (seems that it was testing for about 4 hours till then), when I unlocked the screen it continued

PS: Script is tuned for testing with PI Fork and already migrated JSON files Otherwise, open and edit the script, you will need to comment/uncomment several lines trouougt the script (I left them but one will need to tweak the script by himself)

Updated:

File on MEGA

mega.nz
[Magisk] zgfg:
Please find and read FAQ post.

With the stock prints and unlocked Bootloader you will almost never pass Device Integrity (unless you have several years old phone whose prints are not banned by Google)
[Magisk] Zedhai:
okay I installed the module and rebooted but I can't pass the attestation (neither safety net nor play integrity). Could you please help?
[Magisk] zgfg:
Please always read the FAQ post first.

Eg, PI Fork module comes with no built-in prints, you must provide the JSON, etc
[Magisk] HippoMan:
At the magic 5% number. Coincidence?
[Magisk] pndwal:
For what device? 🤔 PW
[Magisk] zgfg:
Depending on the source of the JSON files (prints)
[Magisk] Jackychans:
Thanks for replying

for now, Im using S9 starlte
[Magisk] Jackychans:
I read F&Q many times already, can you advise specific ?

By the way, maybe you're right that unlocked bootloader + stock fingerprint would never pass DEVICE_INTEGRITY. But how about I spoofed bootloader status as locked , which might makes the phone like the real one, could it work ???
[Magisk] zgfg:
You didn't really spoof Bootloader for DroidGuard

And not maybe but for sure, if your phone has TEE and a proper key-store, DroidGuard has to force Play Integrity checking on TEE (hardware-backed) and Strong will fail, and Device (software backed) attesting will not be executed, hence PI will show at best Basic Integrity

That's why you need prints that will trick DroidGuard to think it cannot attest on TEE, and only then you can pass Device Integrity with the additional spoofing

All that has been hundredth times discussed here, with the Play Integrity technical documentation, and everything

Btw, by your 'theory' everybody will spoof with his own stock prints and there will be no case here about mining the prints, 'banning' them from G side, then panic here, releasing new PIF version with the new hardcoded prints etc

And it's BAD idea to hardcode some prints that will pass Device Integrity today into the custom ROM. When G will 'ban' that prints (it does from time to time, at their best they did it even every few days), you will have to release new version of your ROM with the new prints

That's why the PIF module and similar injectors (apps) the other devs include to their custom ROMs - when G bans one prints, they only release new version of the module/injector app with the new, working prints, users just install that module/app and continue using the ROM

Please read, read, read, here. Read also PIF Readme on the Github to understand more about the injectors

Good luck
[Magisk] trevtdogg:
this whole 600+ page thread is all about trying to get device integrity with an unlocked bootloader.

it is just not that simple.

the only known ways are:

* use a PIF module with a working json - using a donor build.prop from a ROM that hasn't been banana-ed yet. (either privately finding your own, or by using the "public" print that the xiaomi eu custom rom team found and are using)

* be lucky enough to have a phone with accidentally working TEE even with unlocked bootloader

* via TEE hacking, as per this thread: https://xdaforums.com/t/tee-hacking.4662185/
[Magisk] V0latyle:
They're probably the same ones TraderJack already tested...
[Magisk] Vision:
It would be nice if we could do reverse engineering on a phone with a broken TEE, maybe there is an error somewhere in the ROM code and it doesn't communicate properly with the TEE and as a result always working even with unlocked bootloader.

Edit: Sorry my bad, is not in the ROM, because if it is when a update or fresh install a ROM this will fix the problem with broken TEE is 100% in the TEE chip
[Magisk] mumuli:
Is there dummy way test if TEE is broken or not? Any apk?
[Magisk] pndwal:
Key Attestation app from vv and Rikka. 🤠 PW
[Magisk] Vision:
Yeah, in Google Play, Key Attestation Demo
[Magisk] pndwal:
The prints don't "trick DroidGuard to think it can not attest on TEE", but are needed to "pass Device Integrity".

DroidGuard will attest using hardware key based signals regardless of print/prop/field set if a valid key attestation call is made... What tricks DroidGuard is the fake keystore-triggered exception (error) to spoof a non-hardware key compatible device and cause it to provide BASIC-only ('userspace' based) attestations... That's the on-device spoof...

The print/prop/field set is the spoof to trick Google to think device is not on their list of devices identified for HARDWARE_BACKED evaluationType enforcement and thus allow a BASIC-only attestation DroidGuard may provide to pass... That's the server-end spoof... (DroidGuard does collect and process the print/prop/field set along with many other signals/measurements and is responsible for passing them via GMS to Google servers, but server based algorithms determine enforcements, verdict passes etc.) 🙃 PW
[Magisk] osm0sis:
It could be argued that setting the first API/initial SDK to 25 for the newer prints is effectively "tricking" it to a BASIC fallback as well. So you're both pretty much right.

You can experiment to see what I'm talking about by using a print that requires lowering to 25 but try it with the original value first while checking with YASNAC.
[Magisk] vMAC:
So can you help me understand the difference between full OTA and incremental OTA? I understand the difference between full and incremental, but don't get it in terms of OTAs. Typically every month google releases an update OTA is that full or incremental? Why would they do a full vs a incremental?
[Magisk] Vision:
If this could happens with only a module and somehow only we must have a keybox.xml and add it in the folder module, like the PIF have now and read the pif.json, and after happens the miracle pass 3/3 😂🤣