yashsingh1/xdaforums huggingface dataset:
[Magisk] yukkio:
Hi, just installed last rebuild is Xiaomi EU and I was able to add new cards to the wallet. I will test it next time I have to pay.

Just a question, I'm using a kernel with kernelsu and zygisknext module. I don't see any deny list in the kernelsu app, is it normal?

Thanks to the dev for this.
[Magisk] xSnowLeopardx:
If some of you are still having issues with the best set ups and doing everything what was needed:

Step 1

-> please don't forget to clear data (manage -> clear everything) within GPS

"Step 2"

-> don't touch GSF

Step 3

-> after doing step 1, don't forget to clear cache + data of GWallet + Google Play (if you haven't already before step 1)

Step 4

-> reboot

I kept forgetting and maybe kept being scared of touching GPS, because I did GPS + GFS a lot before, to try and fix this all, but then understood that my notifications got butchered due to GFS.

Touching GFS (to my understanding) is not needed. I did steps 1 + 3 + 4 and got it all working.

(just a reminder for those who keep forgetting to do step 1).
[Magisk] gerard_f:
So this module is closed source now? What's the benefit of this? If google wants to know the fingerprint used in this module, will easily can do it, right? We are making a request to the Play integrity servers...

Unfortunately, I'll stop using this. I will not run closed source modules that has root access.
[Magisk] Phonerix:
Does anyone know how to deal with greyed wallet tile in quicksettings? Expect this, everything works well with v13
[Magisk] chiteroman:
Yep...

Maybe when I finish the module with custom spoof, I will upload source code again.
[Magisk] chiteroman:
KernelSU by default unmount everything. You must select apps which you want to have root access. Never select GMS or enjoy failing BASIC.
[Magisk] gerard_f:
Thank you @chiteroman I will appreciate that 👏
[Magisk] yukkio:
I can't select anything since I don't see any list like zygisk options within magisk manager :) that the reason of my question.
[Magisk] pndwal:
Read back a few pages here? 😉

This:

PW
[Magisk] pndwal:
As I said:

... I don't want to cover all possibilities... Please post the screenshot and we'll go from there... 👍 PW
[Magisk] Vision:
Anything you desire, is for good reason. If open source code again, if we knowledge can add our fingerprint with new pif.prop and if google block it again, we change it again, anyone with fingerprint our choose and not everyone have the same device and send same device in play integrity server
[Magisk] Alex_Lema:
Hi, I installed the module and then cleaned Play Services, Play Store and Wallet. Followed by a reboot, obviously. :)

The SafetyNet check passed and the Play Integrity check said that it meets basic integrity and device integrity.

Even with that, it was still saying that Netflix was not allowed in my device.

Then I tried to add all cards in Wallet, and I could add them all (did not test paying with them, though).

After that, strangely, I verified the Play Store, and it allowed me to update Netflix.

So I think that all is well. Thanks.
[Magisk] xSnowLeopardx:
If you check before paying if you have all things checked in GWallet -> Set up contactless payments, you can be assured that paying will work.

It did not work for me months ago (was very awkward) since I did not check before paying. I did not really think Google would be so annoying. So check, all checks? Then you're good to go.
[Magisk] aharonshor:
I can confirm that I have many devices

I tested FIP 13 and it worked on all Android 13 devices

But devices with Android 12 and below it didn't work out yet.

A test on Google Play with developer mode registered as having passed successfully and the same with YASNAC,

But in Google Wallet it still says it is not supported even after deleting data in the 3 apps.

EDIT:

It turns out that there was a mistake and we deleted the GMS cache instead of the Google Wallet cache,

And it happened because a long press on Google Wallet and switching app info goes to gms,

So in the end we did it with the adb command:

pm clear com.google.android.apps.walletnfcrel

And it worked great.
[Magisk] suckerp:
Maybe somebody here can help me out.

After the changes by Google I updated PIF to version 13. But both SafetyNet and Play Integrity Check still fail completely. Even Basic and Devuce Integrity checks fail.

The phone ia a OnePlus 7T with the latest official Android 12 Security Update December 2022. I use the latest Magisk Delta 26301with Zygisk enabled and unmount by default disabled. Addons are PFI13 and the latest Zygisk LSPosed. I also disabled the SafetyNet sensitive props addon but still no luck.

The JSON Raw response says UNEVALUATED, whatever that means. The result from the dev options integrity check from Google Play is empty. Not sure what to make of it. I cleaned the cache and data of both the Play Services and Google Play but nothing changes after the restart.

Any idea what's causing my issues?
[Magisk] andynx1:
According to the following message, it doesn't currently work on android 12.

Post in thread '🔧 [MODULE] Play Integrity Fix (SafetyNet fix)' https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89171366
[Magisk] suckerp:
Thanks. But the post states, that he passes the Basic checks.

I fail all checks.

But I think I figured the culprit. When I deactivate Zygisk LSPosed then I pass the Basic checks. And I can also add a payment method to Google Wallet.

So Zygisk LSPosed needs an upgrade I guess.
[Magisk] DanGLES3:
You sure you aren't hooking any Lsposed modules into Play services?
[Magisk] xSnowLeopardx:
v1.9.2 (7035) is working fine here.

Please, also look at my previous post in here to make sure you're deleting the cache and data of the correct things.
[Magisk] Nergal di Cuthah:
Probably a module and not lsposed itself, though lsposed seems to be involved in many of the fails.
[Magisk] dilligaf56:
Looking good here. Stock rooted, A14 231105 update. Magisk 26401, Zygisk, PIF 13.0. Passes 2/3 using above (I don't use Integrity Checker any more); everything seems to be working currently (last used GPay yesterday). Keeping fingers crossed. Thanks for all the good work!!
[Magisk] V0latyle:
Understandable, but having the code open source means Google can monitor and immediately patch the fixes. We don't know whether or not they're actively doing so, but in the past couple months they've definitely been tinkering with things, which is why this module needs to continually evolve.

Therefore, you have a choice:

If you don't want to use this module but want to use Wallet/tap to pay, flash back to stock and relock your bootloader. Obviously this means wiping data and losing root.

If you want to retain root and use Wallet/tap to pay, you're going to have to trust @chiteroman and use this module anyway.

Without this module there is no way to pass 2/3 Play Integrity on an unlocked and modified device.
[Magisk] Yeedatoy:
Kernelsu basically is a deny list. You have to selectively add the apps that you want to be granted root access or use the modules
[Magisk] Yeedatoy:
Also it doesn't use Zygisk unless you download the independent Zygisk module for ksu

Edit. Nevermind, I see you have
[Magisk] ErdbeerbaerLP:
Unsure if I did anything wrong..

I was able to use wallet a few days ago, but now it broke yet again. Also I tried to update and clear the data of wallet, play and GFS again, rebooting, but still no luck.

Using Xiaomi mi 10t Pro with latest Lineage OS.

Anything I can try to fix this?

(At best without resetting play services cuz this requires me to factory reset my watch so I can connect it again, but if that's last idea I will still do that)
[Magisk] Nergal di Cuthah:
Are you on pif 13?
[Magisk] ErdbeerbaerLP:
yeah
[Magisk] Nergal di Cuthah:
Lsposed? And lsposed modules?

other magisk modules?

Passing pi?
[Magisk] ErdbeerbaerLP:
No Lsposed (or similar).

Magisk modules: Zygisk - Sui, PIF, ADB&Fastboot

Playstore tells me that my device is ceritifed, so yeah. Play Integrity API Checker: DEVICE & BASIC Integrity passed, STRONG integrity failed
[Magisk] Nergal di Cuthah:
Only other advice i can think is that if you wait a few days pay will check again and work (that's if you're hard set on not deleting data)
[Magisk] Yeedatoy:
Don't feel too bad. I just figured out yesterday...4 magisk versions later that to patch a boot image with magisk, you can click install and just click on an entire rom.zip, and it will do everything for you instead of having to manually extract the damn boot image or payload bin yourself. I guess that's what changelogs are for... lol.
[Magisk] ozzy1212:
I just want to chime in with another success story here.

mi 11 ultra running eu weekly + magisk + pif13.0

play store certified device and google pay working

thank you so much for your work on this chiteroman!
[Magisk] bentree:
Usually for me it's only about a 12-24 hour wait and then Pay works again. I know it's not always the most convenient solution but it's the easiest way for me.
[Magisk] rejuanad99:
We got same device mate. Mine is not rooted though.
[Magisk] xSnowLeopardx:
Weird how I have never had a step of "waiting x hours".
[Magisk] halcy0n9001:
Sure, as requested.

View attachment 6034840

View attachment 6034841

Then the next screen is the one provided in the original post.
[Magisk] Nergal di Cuthah:
I mean it says contact bank, maybe your card needs special permission from bank to enter it. I'm not sure this is a root block
[Magisk] tdog0101:
I've been using PlayIntegrityFix for about a week now - originally on v12 with the required Magisk with Zygisk. My phone is a (rooted) Pixel 3a (sargo), running PixelBuilds' A13 Trinity Alpha ROM. After Google made a change about four days ago, my V12 PlayIntegrityFix stopped working -- but when v13 came out (and I cleared all the caches), my phone immediately passed both Basic and Device Integrity again. However starting yesterday, even when I continue to pass Basic & Device Integrity on the Play Store's own integrity checker (see screenshot attached), my phone is rejected at all the stores I went to yesterday and today. The chip reader messages were variations of "App not accepted".
[Magisk] niko26:
Have you tried the "new" v13?
[Magisk] tdog0101:
Yes, thanks -- I'm running the "Update v13"released three days ago.
[Magisk] chiteroman:
New update with an important new feature that will make everyone's work easier. Now in the 'pif.props' file you will be able to edit the device to spoof, you will only have to edit it and kill the unstable process to reload it.

Also, source code is published again.

Release v13.1 · chiteroman/PlayIntegrityFix

v13.1 For normal users: Custom props! You can edit them in file 'pif.prop' For devs: Source code published again. Drop support for emulators (x86 and x86_64). Use ShadowHook instead Dobby. Updat...

github.com

🤗
[Magisk] niko26:
Thx... So is this an ID number? Or do I enter a clear text value as the device?
[Magisk] osm0sis:
Hell yeah! Amazing job!

If I can make one suggestion. It would be great if the format of pif.prop could use the actual prop names, that way it's in keeping with normal Android .prop files, plus that way you can have the module spoof any props added to the file as well, so in the future more can be added or removed without needing a module rebuild. 🤘

i.e. instead of:

PRODUCT=
DEVICE=
MANUFACTURER=
BRAND=
MODEL=
FINGERPRINT=

It could be the corresponding normal prop names like ro.build.fingerprint, ro.build.product, or whatever they draw from. That way people would know where to pull the info from on a target spoofed device ROM too.

Edit: I understand now from looking into it that these seem to be the actual field names that DroidGuard service are checking in the source, so they're called that in the prop to match.
[Magisk] chiteroman:
That's exactly what I've done XD: https://github.com/chiteroman/PlayI...iteroman/playintegrityfix/EntryPoint.java#L63
[Magisk] tdog0101:
So reading through your Git changelog, is this 13.1 update expected to resolve the issues of devices continuing to pass the Play Store's (dev) play integrity check -- yet still failing chip reading acceptance at stores and banks? Or is it more a technical change via new libs, hooks and access to pif.prop?
[Magisk] pndwal:
But again, not what I asked for:

... screen like this:

View attachment 6034881

😬 PW
[Magisk] xantrk:
What are the nuances of this to get a working fingerprint?

PRODUCT=raven

DEVICE=raven

MANUFACTURER=Google

BRAND=google

MODEL=Pixel 6 Pro

FINGERPRINT=google/raven/raven:14/UP1A.231005.007.A1/10762838:user/release-keys

this one fails CTS Profile match for me for example.
[Magisk] chiteroman:
That props won't work because the device needs a hardware attestation.
[Magisk] osm0sis:
Raven's definitely too new.

But yeah, I'm not sure what the criteria actually are so it would be good if someone who knows could outline them so we can start generating a bunch of possible configurations. 😁🤘
[Magisk] osm0sis:
Ooh! Cool! But what's the deal with it being FINGERPRINT and PRODUCT instead of ro.build.fingerprint, ro.build.product, etc.? It's that a fixable thing?

Edit: I understand now from looking into it that these seem to be the actual field names that DroidGuard service are checking in the source, so they're called that in the prop to match.
[Magisk] pndwal:
You need both a print that is working (certified) and mismatched... I've put plenty about this in these threads if you sea prch my posts w/ "mismatch" etc as search term... 👍 PW
[Magisk] halcy0n9001:
🤦‍♂️ Sorry, here you go

View attachment 6034885
[Magisk] halcy0n9001:
This is how it failed previously when I was using USF, and then started working again with PIF 1.2 until a few days ago.

If I contact the bank they say nothing is wrong with the card and try again 😂
[Magisk] pndwal:
Actually fingerprints from Keymaster 3+ devices will work as long as required mismatch (ie with what prints Google enforced HARDWARE_BACKED evaluationType for) is achieved... Eg many Android 10 prints work.

The idea that print should predate Keymaster 3 is good for universal use but not needed for individual devices...

😜 PW
[Magisk] fbirraque:
Thanks for the v13.1 release too.

Already updating in my Stable MIUI.eu latest REBUILD.

EDITED: Confirmed that Google Wallet (NFC Payments) worked flawlessly with v13.1 - 20, Nov
[Magisk] osm0sis:
I've just reviewed your old posts, and it's still not completely clear what is needed to cause the required "mismatch" and what devices we should be looking to target for spoofed ROM values.

What I've gathered so far is:

- the device must not support hardware attestation (edit: or not?)

- if the device fingerprint is from an Android 11 or newer ROM then the security patch field must be used and have the corresponding patch date for the fingerprint's build date

Let's just lay out the criteria in a simple list for people (i.e. oldest Android version that would work, newest Android version that would work, etc.), and then let the games begin! 😛
[Magisk] pndwal:
So App is good to go... Try again in case Wallet cached device integrity verdict has only just refreshed itself (can take days unless you clear the data)...

If still not working, seems you do have an issue with bank or card... Some banks keep results for your device and you may need to wait for some set period of time or ask for them to reset... 🙃 PW
[Magisk] Chris_Kaos79:
Very good Idea. That will help a lot.
[Magisk] halcy0n9001:
Hmmm okay, thanks for your replies and patience :)
[Magisk] xantrk:
Thanks so much explanations everyone.

One more question if I may, can anyone confirm they can still use their passkeys (particularly with on-device encryption)? I'm wondering if it will be a continious issue due to Device Missmatch in Google activity, or caused by me wiping GSF.

Passkeys don't work · Issue #62 · chiteroman/PlayIntegrityFix

After flashing the module, passkeys do not work. For example, when accessing Uber you get the error "Error to get credentials" and in other apps and pages there is also an error.

github.com
[Magisk] 12elotro:
One question, I have PIF 13 installed and payments with Wallet have worked. Is it necessary/desirable to update to PF 13.1?
[Magisk] pndwal:
Nah... Not necessary...

Well if after the March 2018 date @Didgeridoohan disclosed AFAIK... Of course these are post Keymaster 3 too!

Print must simply not match any Google marks for enforced HARDWARE_BACKED evaluationType and be CTS/VTS compliant so trial and error is needed...

Many working combinations were found when Google added fingerprint to existing model prop requirements for some (not all) devices, and are larger posted in Didge's G Pay discussion thread... Many just needed A10 etc prints...

Fun for you lot, but I've got a brain the size of a small planet and only limited irony circuits to keep me amused...

Don't talk to me about life... 🤖 Marvin.
[Magisk] osm0sis:
Okay, so long story short seems like nobody knows the complete criteria, we'll all just need to do trial and error with whatever we can find and keep track somehow, then maybe we can nail down some more definitive patterns. 🤞🤠
[Magisk] osm0sis:
@chiteroman This other line seems like a definite flaw, unfortunately:

PlayIntegrityFix/app/src/main/java/es/chiteroman/playintegrityfix/EntryPoint.java at bd55606e2178e94c89e93edc64267b52b50ab03f · chiteroman/PlayIntegrityFix

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com

Play Integrity can easily add a check for a file in its own cache in a heartbeat and fail based on that.

You should be able to make it read the prop file directly from /data/adb/modules/playintegrityfix/pif.prop instead, even if only at module load time at least. Everything in /data/adb is protected which is why all root solutions use it.
[Magisk] mac796:
So could I dig out my old Pixel 1 and 2 devices and try the values off of those?
[Magisk] osm0sis:
Downloading the ROM images, or even just using the build.prop (/system and /product) of an old device should be enough to pull the necessary info from.

Knowing the old Asus list of props will likely be useful to know what other fields might be needed to spoof some devices:

PPU: Another day, another cat and mouse chase · Evolution-X/frameworks_base@bc67db6

The Evolution of Android! Contribute to Evolution-X/frameworks_base development by creating an account on GitHub.

github.com
[Magisk] Fishawy:
The endless dilemma of "if it's not broken don't fix it" vs "the latest has to be better".

Perhaps it's not 'necessary', but for me it was desirable, that's why I went ahead and updated.
[Magisk] HippoMan:
I don't doubt that the Googlefrinchians who are reading this thread very much appreciate that this kind of detailed information is being publicly listed here. What's the use of closed source if we're openly posting this info?

Yes, I understand that they can't just block on this information alone, given that there are non-modded devices in the world with these same fingerprints. But if the Googlefrinchians know which fingerprints are being used here, they could then perhaps implement extra logic to perform deeper checking whenever one of these known fingerprints shows up.
[Magisk] mac796:
Yea maybe quit giving them new ideas 😀
[Magisk] xcl1pse:
Whoops, pass 2/3 test with another props lmao

Backup in case current props fail 🤣
[Magisk] pndwal:
Mmm... I was aware of issues deriving from Google servers identifying some devices using the GMS Droidguard attestation whether using calls to PI API or other... Either way, prop indicators from GMS will now differ if you registered before using a USNF build (incl forks), or even if different versions were active at the time...

I believe it's the spoofed fingerprint prop value that's the issue (eg when USNF/PIF uses , but model prop (USNF and forks generally still only append a space chr to real value AFAIK) may be polled for some purposes too. I know the servers do see model value when globally set for many (all?) devices...

Guessing you'll be good for encrypted data if you try again with PIF disabled...

Not sure what you can access on your device ATM... If you can't disable Magisk or modules easily, could just flash back unpatched boot image to boot without spoofs and try...

Hope it helps, 🙂 PW
[Magisk] pndwal:
🤔 ... But it's open source again mate... PW
[Magisk] pndwal:
Yeah, can't know which devices Google blacklists for BASIC-only evaluationType DEVICE_INTEGRITY (by fingerprint prop based 'enforcement' of HARDWARE_BACKED evaluationType) which is the crux of the matter, without experimenting... (We can't know which devices are blacklisted for BASIC-only evaluationType DEVICE_INTEGRITY by model prop based 'enforcement' of HARDWARE_BACKED evaluationType either.)

We have some clues... AFAIK, they only began using recent (A11+, some A10+) prints for blacklisting, but may have back-added older ones since...

And yes, you'll need to match Security patch level value too (if newer than March 2018), so if wanting to use "modern" prints, eg verified in @Didgeridoohan's MHPC module, you'd also need to change Security level prop date value which old MHPC did invisibly in the background...

There may be a way for someone like you to extract the corresponding Security level prop date values from MHPC which would be valuable (again)... Didge may have put them in a file somewhere too... I've no time to search ATM... 🙃 PW
[Magisk] HipKat:
Pixelflasher, not sure what device you have but for the Pixels, it's a 1 button process
[Magisk] HippoMan:
Oh, I missed that. OK, so let's just open all the doors wide! LOL!
[Magisk] knasiotis:
Manifesting a mi 11ultra prop 🙏🙏🙏🙏
[Magisk] knasiotis:
Found a build.props file for the CN rom of MI 11ultra how do I test it? (how do I edit that file, how do I find it? How to set it)

Edit found it in adb folder, now to find how to edit it...

edit2: i did it, but now it doesn't pass device integrity...curiouss... (forgot to clear cache, i'm retrying)
[Magisk] pndwal:
Hope this gets fixed... Good spotting...

I note that other modules like Shamiko (for whitelist mode) provide for user editable files in own /data/adb/modules/ directory for good reason...

👍 PW
[Magisk] osm0sis:
@chiteroman, how do I specify the security patch?

:/ $ su
:/ # logcat | grep PIF

11-20 00:27:25.933 6516 6595 D PIF/Java: Couldn't find 'SECURITY_PATCH' field name.
11-20 00:27:25.937 6516 6595 D PIF/Java: Couldn't find 'SECURITY_PATCH' field name.
11-20 00:27:26.016 6516 6595 D PIF/Java: Couldn't find 'SECURITY_PATCH' field name.
11-20 00:27:26.017 6516 6595 D PIF/Java: DroidGuard detected!

And what's the full list of accepted fields?

Edit: Also, interestingly, the only things necessary to pass from the current shipped pif.prop are PRODUCT *or* DEVICE, and FINGERPRINT, all others can be removed. 🤯

(Which is good since technically the others are wrong and should be LGE and google ... 😝)

Edit 2: And I can replicate it with a few different older devices' values. 😏
[Magisk] knasiotis:
is it ok to just place the build.prop find contents i found to pif.prop?

edit: also I noticed that some dumps hide some lines, is this to protect the leaker? my bad i am just noob, some values are a username right?
[Magisk] RMD08:
how to do this? just reboot the device?
[Magisk] chenw191:
My problem was solved after I upgraded to Android 14.
[Magisk] gerard_f:
Yes, ofc it's only my opinion and a personal choice ;)

But I'm not sure that closing the source will avoid google patching this module. They know what's happening in their servers, so I think they can patch it too if they want.
[Magisk] gerard_f:
That said, I see the source is up again, so thank you so much for your amazing contribution and work @chiteroman 🙌

Working perfectly here 💪
[Magisk] aharonshor:
We may be able to use this site to get all the details to put in the file

firmware.mobi

desktop.firmware.mobi
[Magisk] simpleatom7:
BPI banking app not working 👀
[Magisk] zandatsu06:
I don't have a BPI account account but I tried to install it, it shows no error for me in KSU
[Magisk] iruiz2:
Sorry but... Where is pif.prop located exactly?