yashsingh1/xdaforums huggingface dataset:
[Magisk] zgfg:
Well, you're good with PIF - it spoofs for Device Integrity, please point in future in the first place that you pass Device (not the weaker Basic)

For your banking apps you should start with DenyList, try with Hide My Apps - separate thread on XDA with a link to the good guide on GitHub with general instructions about hiding. It's somewhat outdated, for the more complicated apps you may need Zygisk Assistant instead of Shamiko, even Kitsune or Magisk Alpha instead of Magisk Stable or Canary (upgrade first to the latest Canary if not yet), , or even Apatch instead of Magisk

Lot of trial and error options, better if you can find somebody who already addressed the particular apps😒
[Magisk] osm0sis:
Huh, looks like it would allow me to uninstall it. Maybe it only got installed because I restored my accounts and apps from my backup as part of the device setup. 😯🤔
[Magisk] zgfg:
My point was that it was no more correct to insist (nowadays) that PI Device Integrity equals to the SN CTS Basic Profile, over the last year PI Device Integrity became pickier

As mentioned in my previous comment, SN that should be turned off by the end of the year, is no more worth for improvements parallel to PI - today SN and PI are SEPARATE APIs, if they would want SN Basic CTS Profile to still attests like PI Device Integrity, they would have to keep up with DroidGuard development for SN as well as with the SN back-office side

But they can monitor how many apps on Playstore that previously used SN had upgraded to PI and they can compare the number of SN attests against the number of PI attests - if the first had rapidly decreased (as we can expect) then keeping up with SN is not worth anymore, better for G to relocate developers to something more relevant
[Magisk] generalculprit:
You could now uninstall them to see if you still have RCS with your private print. 😉
[Magisk] D€INOS:
NOT rooted, using Oneplus 8T with lineage-21.0-20240607-nightly-kebab-signed only passes BASIC.

perf vanity string , that should not be banned. Maybe userdebug isnt passing DEVICE??

View attachment 6112770View attachment 6112771View attachment 6112773
[Magisk] Thebear j koss:
Check if kernel is banned.
[Magisk] D€INOS:
according to Osm0sis posts perf is not banned.

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89308909

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89526197
[Magisk] osm0sis:
Is that official? unzip -l /system/etc/security/otacerts.zip ? getprop | grep userdebug ?
[Magisk] pndwal:
Yeah, checked and you're correct that @kdrag0n seemed to abandon the largely broken 2.4.0 base... Later, @Displax did adopt it for his 2.4.0-MOD_1.0 build fixing some issues official 2.4.0 had ("It is now based on top of original v2.4.0 codebase instead of v2.3.1, with adding new hiding algorithm for current realities and some code refreshing") and further fixes came in 2.4.0-MOD_1.1 (Fix KeyStore desynchronization... tests randomly failing problem) before he abandoned the runtime only (dynamic) patching with 2.4.0-MOD_1.2 (Do not unpatch changes... To prevent possible tests failing after a while on some ROMs (cross conflicts)...

Sadly, @kdrag0n didn't ever fix issues with dynamic patching although he worked long at it to publish one build, @Displax just reverted 'unpatch' and @chiteroman forked the later 2.4.0-MOD_2.0 so we do have full-time spoofing at present...

However, 2.4.0-MOD_1.2 did work fine for most devices/users at the time, so to rephrase with corrections:

I still think that this could work (well)...

You're right, they are currently... But they don't have to be...

@kdrag0n worked on his properly scoped start + end hook spoofing method precisely because "Dynamic patching avoids problems with device detection and functionality that can be caused by permanently spoofing another device" and he "feel(s) like setting a fingerprint that doesn't match the system in so many ways is bound to cause an issue somewhere"... Now the mechanism has been abandoned but we have RCS issues for precisely the reason he predicted it seems...

If RCS is obtaining the device info from G backend cached attestation call data, my trick above may work... If it's getting DroidGuard data locally (eg via GSM core), then simply restoring @kdragon dynamic runtime patch/unpatch (with @Displax fixes) may be enough...

Hope that makes more sense... Time to think outside the box?... 😜 PW
[Magisk] casouzaj:
As far as I'm aware, official LineageOS 21, unrooted, doesn't pass device integrity test.
[Magisk] Captain_Throwback:
Of course you're only passing Basic if you're not rooted. Your bootloader is unlocked, and you need root to hide that, last time I checked.
[Magisk] D€INOS:
yeah its official

https://download.lineageos.org/devices/kebab/builds

getprop | grep userdebug

returns userdebug

otacerts.zip contains the releasekeys (releasekey.x509.pem)
[Magisk] D€INOS:
Okay, I thought unlocked bootloader was fine for passing device.

And locked bl for passing strong

🥴
[Magisk] pndwal:
I never suggested (or insisted) that... Context is everything...

Of course I know all that... (I put the original dates/links for turndown etc here on XDA.)... And you're correct, they won't update S/N much since decided to depreciate... Just sufficiently for whatever 'essential' security enhancements the want old app versions to get before turndown date... After that users are forced to update apps and it's all over rover for S/N... But deviceIntegrity verdict lives on (in its new incarnation)...

Don't think they even need those stats. There's no question of "keeping up with SN anymore". It's a foregone conclusion... (They could probably obtain better / more useful stats from Play Console data anyway)... 👍 PW
[Magisk] samhhmobil:
This behaviour is exactly as expected.

Lineage says on its Wiki-Page, that you don't have Device Integrity after installing LOS(-21).

See the section "Known quirks" in https://wiki.lineageos.org/devices/kebab/

If you want pass Device Integrity now, you need to root your phone (Magisk or KSU or Apatch), and you have to install then the PIF-Module.

samhhmobil
[Magisk] KAPABLE-K:
I just did APatch on my P8 and P7 RCS was working then I installed zygisknext and it broke so I uninstalled that module and RCS is working now so I just have PIF and its working.
[Magisk] zgfg:
Do you use PIF (without additional prints) or Fork (with Sailfish prints)?

Without, you have unlocked device, hence not ready for Device Integrity
[Magisk] pndwal:
Some custom ROMs integrate spoofs to pass DEVICE_INTEGRITY (without root), but official LineageOS never will... At least it's a clean, signed ROM... Assuming no vanity string is correct, should be a doddle to pass with Magisk and PIF for the moment. 🤠 PW
[Magisk] zgfg:
The FAQ post rules (your built-in prints most likely require Strong attesting and Strong fails due to unlocked BL and PI doesn't waste time to test Device Integrity; but Device Integrity would also fail without spoofing)

Memo: No Device Integrity on unlocked device without spoofing Device, FP and other prints😁
[Magisk] samhhmobil:
You did NOT read the LineageOS-Wiki (for your device).

samhhmobil

PS

But of course you have the option of root and PIF-Module for your LOS-Device... it works (in the past and today)!
[Magisk] D€INOS:
thxs for the heads-up

yeah did realize un bl was a criteria for device int.

Yeah I agree, LOS is as we know, clean and well built

Not ALL of it, who does that 😜
[Magisk] LoveScarGuitar:
What I don't understand is that this post is saying that my rom cannot be signed (testkey) otherwise rcs won't work.

I've had this same rom and root/magisk since before the RCS chat issues became a huge problem. I had working RCS and NFC/banking up until recently. So, are we sure this whole testkey thing is the actual problem area for some?
[Magisk] s1dest3pnate:
I uninstalled PIF and ZygiskNext and I concur - it is working again.

Does PIF work without ZygiskNext though? Are you still passing device integrity?
[Magisk] pndwal:
Yup... It's just a new Google/DroidGuard check for deviceIntegrity... Of course legitimately custom ROMs should only pass BASIC_INTEGRITY anyway, so they're only hardening checks for an illegitimate label, and there's still wriggle room (for the mouse to get away from the cat)... 😜 PW
[Magisk] KAPABLE-K:
I left PIF installed my P8 was passing device integrity before I switched to APatch (RCS was not working though) the P7 was not and after the switch to APatch they both remain the same for now P8 passes device and P7 does not I will leave it for 24hrs and see if anything changes and let you know.
[Magisk] aliantonio:
What other modules do you have installed? I'd say give it a few hours to see if it sticks. I've tried several different combinations and they all seem to break RCS after some time. The only one that's kept RCS working the longest so far has been apatch with no modules installed.
[Magisk] KAPABLE-K:
PIF and YouTube revanced
[Magisk] GN-z11:
Modifying in terms of apps means decompilation of framework, disabling signature verification and recompiling it with test-keys.
[Magisk] dmitrydahmer:
Hi everyone

I'm on android 10 stock latest rom of Google pixel 2016 and using play integrity fix by chiteroman with the latest sailfish json (sailfish is literally my phone's codename)

Everything used to be fine until today it stopped passing device integrity

I did cleared GMS many times, reinstalled integrity module as well as tried next integrity module, also tried to turn off most of the modules like Vipe4android, YAKT and other stuff but nothing actually helped

and now it says device is not certified on play market

I'm using kitsune magisk and denylist is enabled

ROM is stock so it's 100% signed with release keys I checked
[Magisk] Nergal di Cuthah:
Not a coincidence, the fingerprint is of a pixel sailfish (your device).

What's in your deny list
[Magisk] dmitrydahmer:
i'ts enforced SUlist so only apps i give root are on it

(root explorer, settings and system UI)
[Magisk] Nergal di Cuthah:
Huh? I didn't think deny list worked like that. My understaning and experience with an enforced deny list is those apps listed a temp unroot is used (you know to *DENY*what on the *LIST*).

Anyway take system gms type apps it breaks device integrity

Custom Kernel?
[Magisk] barzbug:
any custom rom for that phone ?
[Magisk] esatch:
OT

I'm still on stock miui but I've seen some on telegram.

Search for sapphiren rom/redmi note 13 updates or similiar.

OT end.
[Magisk] dmitrydahmer:
No custom kernel, I used to run lineage custom unofficial ROM but eventually given up on it because it was signed with the test keys

I was aware of the situation with custom roms kernels etc and their integrity vulnerability

so I decided to go Stock on everything, leaving root and unlocked bootloader of course

For about 2 weeks everything worked fine including yesterday when I made 2-3 payments
[Magisk] barzbug:
can you help me to find that roms u talkin about
[Magisk] zgfg:
It IS the way how SuList enforced works - btw, wasn't that renamed to "Unmount modules by default"

It means whitelist mode - all are by default denied, except those explicitly whitelisted by the list

Opposite to how the DenyList in Magisk works, in the blacklist mode - all are allowed, except those explicittly denied.

Although, Zygisk in Magisk can be also put to the whitelist mode by use of a special file

+ Unmount modules in Kitsune is actually a descendant to the old Magisk Hide, not like the weaker DenyList. Hence he uses like Magisk Hide but in the opposite, whitelist mode

=> Banking apps, GMS, etc are all 'denied' as long as not in the list.

However, AdAway must be enlisted, otherwise it cannot see the mounted /etc/hosts file. Etc
[Magisk] woodpe:
Kitsune doesn't have a Denylist but a SUlist with processes which can invoke root access.
[Magisk] Nergal di Cuthah:
Thanks didn't know that about kitsune.

So should the opposite of my advice help (putting gms et all to sulist)?
[Magisk] dmitrydahmer:
No app ( except for root explorer) has access to root on my phone

and magisk is hidden
[Magisk] ThatOneGuyOverThere:
I've been good with rcs for over a day now with apatch + riru. Wonder if there is a way to get pif working without zygisk or with riru cuz it seems like that and magisk are the main problems.
[Magisk] Eula13:
is it impossible to spoof rom being signed by release keys instead of test keys?
[Magisk] HippoMan:
Unless I'm misunderstanding something, SuList is part of kitsune, and it's the opposite of a denylist. It's a whitelist for rootable apps that are put into that list and a denylist for pretty much everything else.
[Magisk] Iridule:
My ROM is signed with debug keys and all is working.
[Magisk] dmitrydahmer:
dude.... I can't belieive but I made it passing device integrity by ... deleting PIF.json completely

I mean it

I left the module only

interstingly I've managed to add payment cards but in the wallet it still says device doesn't meet security req.

but at least it passes device integrity ?? I was able now to make a transaction with Gpay online so I guess it works?
[Magisk] zgfg:
Really?

PIF (unlike PI Fork) comes with the Sailfish prints built-in - with your owm (improper) PIF.json you can just make it not woirking

Faq post, etc
[Magisk] dmitrydahmer:
so the sailfish print is not only in the PIF file but in the whole module?
[Magisk] zgfg:
It installs its pif.json with Sailfish into the module's folder but will use your pif.json from /data/adb IF you have it there

#define PIF_JSON "/data/adb/pif.json"

#define PIF_JSON_DEFAULT "/data/adb/modules/playintegrityfix/pif.json"

Source code:

https://github.com/chiteroman/PlayIntegrityFix/blob/main/app/src/main/cpp/main.cpp
[Magisk] AlexS2412:
so i discovered pixel 6 passes rcs test with completely failing integrity, also if you only fail device. the device check seems to be whats wrong if spoofed incorrectly it isnt really passing. @osm0sis @chiteroman

EDIT: turns out shamiko is what makes you fail, shamiko no longer works. shamiko will make rcs fail even if you pass integrity. how petty of google.
[Magisk] freeza:
Just made a payment with google wallet at the grocery store. Same setup as before: no pif, only apatch, lsposed, zygisk next, and a bunch of other modules.
[Magisk] AlexS2412:
yes this is because you probably dont use shamiko. as of now just installing shamiko makes only rcs fail. God knows why.
[Magisk] osm0sis:
But, again, all this weird RCS stuff is only with the public sailfish print (or no print at all?), my private print works fine and I have Shamiko installed as well. 🤷‍♂️
[Magisk] pndwal:
Think it's specific to APatch per conversation... As said yesterday:

RCS breaks if any modules are installed it seems... I don't know much about APatch though. 🤠 PW
[Magisk] Thebear j koss:
I don't use shamiko and rcs fails. Stock rooted May android 14 pixel 6 pro with play integrity fix 15.9.9 as expected.
[Magisk] AlexS2412:
i have many and get rcs. for me shamiko made rcs fail.
[Magisk] pndwal:
Using APatch? 🙂 PW
[Magisk] AlexS2412:
it started failing agin with magisk. will have to use apatch and give up zygisk next. google sucks.
[Magisk] dmitrydahmer:
yeah but there's no other pifs in data/adb as well
[Magisk] esatch:
sorry it was a long time ago, no idea apart searching using the words I suggested before.
[Magisk] zgfg:
Neither in data/adb/modules/playintegrityfix/pif.json ?

And Device Integrity still works after rebooting or after

su -c killall com.google.android.gms.unstable

?

Have you checked logcat PIF logs to see does it spoof, which prints and how
[Magisk] 에어 론 리:
I made ROM (not the first btw) with saving original sign.
[Magisk] dmitrydahmer:
nope, no PIF files there

I tried to put a custom fingerprint from my old phone but it didn't work, after removing it to my surprise it started passing, even though I haven't managed to replace it with another pif

I rebooted once more (with no PIF) to check if it's a lag or something and it still worked

Then I managed to add cards and other stuff so idn

where can I search for log file?
[Magisk] pershoot:
I had Shamiko running for quite a while on public print(s); no issues with RCS and DG / Wallet, while the in use print being spoofed was not banned for RCS and DG / Wallet purposes.

I just now converted to using Zygisk Assistant (I've been meaning to) from Shamiko; same current status while on the currently avail. in use public print (RCS inoperable and passing DEVICE verdict without issue (PIF Fork)).
[Magisk] AlexS2412:
so weirdly i think just disabling root temporarily makes you pass, and you have a window before the cache is updated on google server side then you just fail again. i pass for about an hour or so and then consistently fail again after having reflashed unmodified stock kernel and boot.... wtf google.
[Magisk] AlexS2412:
are you just spoofing strong? i know there's private stuff...
[Magisk] Isa Daud:
Sorry if I miss a lot of updates.

Is there a way or tool/apps to find out which ROM I'm using is signed or not?

Sorry if you think this question is stupid.
[Magisk] bombadier:
You will want to run this command from a root command line

unzip -l /system/etc/security/otacerts.zip

You can read more here or here or here
[Magisk] Isa Daud:
Sorry, this is not the module I meant. But I just found this apk. Hopefully it functions as I intended.
[Magisk] Isa Daud:
Thanks mate.. quite helpful with just use termux.
[Magisk] pershoot:
I linked you directly to a post detailing how you could check.
[Magisk] Isa Daud:
Wi

Will it make rom to be signed if i only replace unsigned otacert with signed otacert.zip.

Sorry, its dump question.
[Magisk] pershoot:
The ROM needs to be re-built, from source, using private / release keys.
[Magisk] Isa Daud:
Thanks, If so, I will delete the unsigned ROM collection that I have downloaded. I don't have the ability to rebuild roms. Thanks for answering my dump question.
[Magisk] McFlypants:
My LineageOS build is signed, but i don't pass CTS profile match (just basic integrity).

I use lsposed (zygisk).

When i use this module, i pass CTS.

But there seems to be an incompatibility with another module: the rom maintainer made an extra module for a modification of the lockscreen which works, when PIF is disabled. When PIF is enabled, the other module can't work. It is signed by the rom maintainer keys to work with the rom.

Is there any chance to make both work? I guess my problem is that PIF changes the keys of the device so the signed module can't work anymore?!
[Magisk] ros_han:
samsung s7edge, lineage OS 20, nikkgapps 13. rooted with magisk

my rom crashed today morning, did a clean flash and installed it again.

but now i'm unable to pass - google's - device is not certified

yasnac - both tests are passsed but with chiteroman 15.9.8 PIF, as soon i flash 15.9.9 - CTS fail occurs.

only - Basic_device_integrity is met as of now, rest 2 fail.

everything seemed fine till 2 days ago, all checks were passed.

magiskhipepropsconf, zygisk, systemless hosts and PIF 15.9.8 is flashes as modules as of now in magisk.

any suggestions on what i should do, spent hours on clearing data of google playstore, play services, even GSF. but to no avail.

thank you in advance!
[Magisk] osm0sis:
First uninstall MHPC, as it's likely conflicting, then update your PIF module to actually have a working print (15.9.8's is banned for DEVICE_INTEGRITY), and go from there.
[Magisk] ros_han:
thanks for your reply, i tried this, redid my magisk setup, still the same story
[Magisk] s1dest3pnate:
RCS still working approximately 24 hrs later with apatch and no modules.
[Magisk] zgfg:
I suggested you to look into the logcat - imo, btw, it is important that every user can check for himself to see was it spoofed and how (instead of wasting time on ping-pong questions and answers, specially to save time for people who try to help them).

That is the only way you will see what is really going on

Check to the FAQ post
[Magisk] generalculprit:
There doesn't seem to be an official Los20 for s7 edge, so your Rom is probably signed with test keys.
[Magisk] ros_han:
i see, what do you recommend i do now?
[Magisk] kholdstayr:
I'm not familiar with apatch, but I want to understand the status of it. Is it this:

- gives full root

- passes device integrity

- RCS works?
[Magisk] generalculprit:
You can first check if it is really signed with test keys. @pershoot and @bombadier answered to this just before your first post.

Your options were just mentioned a few posts earlier.
[Magisk] aliantonio:
I'm still testing different modules with apatch but it seems busybox breaks RCS 100% of the time.
[Magisk] zgfg:
Click to the Search icon top-right on the page and search for the dedicated thread about Apatch on XDA

Or better, google for:

XDA Apatch

Then read the OP.post(s) and ask further questions there.

It's out-of-topic to repeat the Apatch Q/A, etc here

Btw, that XDA [Dev] Apatch thread has only two pages so far, hence not a big deal to read everything😁

And/or google for

GitHub Apatch

to further read the Readme there

https://xdaforums.com/t/dev-apatch-an-alternative-root-solution-to-kernelsu-and-magisk.4655727/

https://github.com/bmax121/APatch

----

Apatch is only the replacement for Magisk..It gives you the root, but you will have to install and use Apatch modules like with Magisk

But users have reported good results with hiding - probably bcs it is new and not widely used, and 'banking' apps have not catch-up yet

I don't use, check the other posts here (I've seen them) about the PI and RCS experience with Apatch
[Magisk] kholdstayr:
I apologize, I keep seeing it mentioned here so I tried to ask. Thanks.
[Magisk] osm0sis:
Then it kinda sounds like APatch is actually kinda bad at hiding its modifications/root... 🤔

Again, no PI or RCS problems here on my stock Pixel 8 Pro with latest Magisk Canary, latest Shamiko, latest PIFork and a private print with my many modules.
[Magisk] aliantonio:
Are you running LSPosed v1.9.2 (7024)? I can't get it to run with apatch, it just crashes on startup.
[Magisk] Xennet:
@chiteroman @osm0sis

Is there any way to port this zygisk dependent integrity module to lsposed module...coz now lsposed can be loaded without zygisk by way of https://t.me/mufanc_chan so that zygisk can be taken out of equation...zygisk is the main loophole via which applications detect root..many only use zygisk to get lsposed and integrity fix to run...if lsposed can be used without zygisk and if integrity module can be used through lsposed zygisk is not needed...

Just a thought...
[Magisk] sawdoctor:
There is an xposed mod already for pif you'd only need to edit the fingerprint it uses to get it to work.
[Magisk] zgfg:
NP. Just look there, it's interesting alternative
[Magisk] Captain_Throwback:
You have a link for this?
[Magisk] sawdoctor:
I can't remember which one i used last or which was the original because there were so many forks. This fork does have a debug apk in the repo

GitHub - rushiranpise/io.github.tehcneko.disablehardwareattestation: Play Integrity bypass

Play Integrity bypass. Contribute to rushiranpise/io.github.tehcneko.disablehardwareattestation development by creating an account on GitHub.

github.com

The original dev tehcniko looks like he took his repo down but I've attached the app that used to work
[Magisk] Captain_Throwback:
Hm, it says that Shamiko is required, which would mean that Zygisk is also required.
[Magisk] Xennet:
This is not a solution...its not what is intended..it needs shamiko and hence zygisk as @Captain_Throwback told...need a perfect lsposed apk that can handle integrity check without needing zygisk
[Magisk] AlexS2412:
can you show the steps you took to achieve this? i would like to get rcs to work without just using apatch with no modules (as that seems to be the only thing that works on my setup even if i fail integrity.)
[Magisk] zgfg:
See the magic words in his post: private prints
[Magisk] sawdoctor:
No it's not a solution but it gives you something to fork and a starting point.

Does osmosis scripts only pif need zygisk?
[Magisk] Captain_Throwback:
No, Scripts-only mode doesn't use Zygisk. But it also doesn't spoof any prints in that mode, so not sure how it helps.