yashsingh1/xdaforums huggingface dataset:
[Magisk] chiteroman:
The module is intended to be used in ROMs that do not and will not have the default "fix", for example, stock ROMs and custom ROMs such as LineageOS.

Why do you want to install my module in a custom ROM that already fulfills the purpose of my module? This can lead to errors in the long run...
[Magisk] pershoot:
@denzel09 You can certainly do some further testing against Magisk while you are on it, as others have advised (turning off modules, upgrade to LSPosed mod (LSposed (non-mod) on GH latest release I came to know does not work properly on latest A14), etc.).
[Magisk] denzel09:
I just completely disabled all magisk modules and lsposed and rebooted but nothing is changed about RCS. Still not available. So i don't know if problem is really magisk or lsposed or other. Btw here are 4 am and i need to sleep, in the next days i will replace magisk with apatch hoping in good ;)
[Magisk] Nergal di Cuthah:
May not be enough may have to uninstall as the thing being detected may still be there upon disable
[Magisk] David B.:
Does it have to be at least 30 or is 30 a hard requirement? Would you mind checking for me to see if 31 would work?
[Magisk] HarmitR:
installing the module causes the goolge play service to stop working, removing it fixes the issue. Any suggestions?
[Magisk] osm0sis:
Log the crash with logcat.
[Magisk] pndwal:
Me neither... People keep missing the point and saying I said stuff I never did, or just being one-eyed about it... To me the point of modding discussion is to think outside the box, help others to do so and not to believe we have a monopoly on solutions either. 🤷

Might be a bit unweildy... 😉

I just gave gave this response about the general criteria however:

You can check in Key Attestation app from vv and Rikka if TEE (Keymaster implementation)is broken... Also, get a clue by disabling PIF and checking S/N evaluationType in YASNAC. Nb. That shows if serverside HARDWARE_BACKED evaluationType is enforced based on props/fields sent from DroidGuard, not what attestation types (measurements) DroidGuard is sending from your device, and only for S/N... Unfortunately, the PI API raw JSON doesn't return an evaluation type verdict, but if you get BASIC-only for S/N with PIF disabled, chances are high that the PI API backend is not enforcing hardware backed evaluations for your device props either...

Like you said, some may not meet DEVICE_INTEGRITY w/o targeted spoofs immediately, but there's no reason they won't with "a few tweaks"... 🙃 PW
[Magisk] HarmitR:
here's the log, just to be clear I am a noob at this so this maybe not be the best log
[Magisk] pndwal:
Official LineageOS (21) will be the most 'stock like' custom ROM available!... If that's not a 'stock like' custom ROM, nothing is!!

Users might only need a fix to align security patch date with built fingerprint (like MHPC) for device-print use.

So something has been missed... Why shouldn't others try?...

We know the device prop/field set seen by Zygisk is not enforcing HARDWARE verdicts (ie. 'unbanned' print spoofing isn't needed) as NO spoofing whatsoever is needed for DEVICE_INTEGRITY other than APatche's whitelist mode hiding!

For those with OP8T or OP8T-like devices who are interested in thinking outside the box, you could try with GMS core (just to be sure) and GMS DroidGuard (unstable) processes in denylist and Shamiko in whitelist mode... Or Shamiko + Zygisk Assistant... Or a combination of these and PIFork... Or with Kitsune Magisk even... Or try to find something else to make this work with A10+...

At least you folks will be able to get RCS and DEVICE_INTEGRITY and keep MagiskSU without ever needing to do print mining initially or when Google imposes more 'bans' if someone publishes a working combination... 🙃 PW
[Magisk] osm0sis:
Using PIF or PIFork? Try the other one and please report if it resolves anything. You also haven't given any useful information like your ROM, root, modules, etc.
[Magisk] pndwal:
Do you use a font module by any chance? 🤠 PW
[Magisk] HarmitR:
I am using thus one

GitHub - chiteroman/PlayIntegrityFix: Fix Play Integrity (and SafetyNet) verdicts.

Fix Play Integrity (and SafetyNet) verdicts. Contribute to chiteroman/PlayIntegrityFix development by creating an account on GitHub.

github.com

On lineages 21

Magisk 27 with root

And here's my modules list
[Magisk] HarmitR:
Yes.
[Magisk] pndwal:
Try removing that.

If issue is fixed, put play services core process in denylist and install Shamiko (keep DenyList un-enforced) if you want to keep font module... Or try other/later font modules... 🤠 PW
[Magisk] markoppp:
Could you please direct me where I can learn more about keybox?

I just know that it is XML file with keys. But where is comes from, where I can get one, where it is stored on devices.. I dont know.

Please share some wisdom with me?
[Magisk] pndwal:
Probably some devices across the board... Some Xiaomi devices too. 🤠 PW
[Magisk] pndwal:
• https://xdaforums.com/t/tee-hacking.4662185/

• https://xdaforums.com/t/module-framework-patcher-go.4674536/

Nb. A "triple digit amount of valid keyboxes" won't help you achieve STRONG unless one happens valid and leaked from an OEM so that attestation certificates are signed by the Google Hardware Attestation Root certificate...

Most available valid keyboxes are only 'sw' generally, meaning they produce an attestation certificate signed with a key hardcoded in Android source code that isn't a secret and the keybox supports only a software implementation of attestation, not hardware... 👀 PW
[Magisk] Mitezuss:
yeah, maybe reeplacing will break the OS

But can be spoofed only to google? (service) just asking...
[Magisk] pndwal:
Actually, should be 33+ AFAIK... That's the level (Android 13) at which Google began enforcing a HARDWARE_BACKED evaluationType without exceptions, ie Google enforces hardware backed verdicts for all devices launched with Android 13+. (And USNF/PIF needed to adjust any DEVICE_INITIAL_SDK_INIT ('shipping level') of 33+ downward to allow any unlocked A13+ LV devices to meet DEVICE_INTEGRITY). 👀 PW
[Magisk] osm0sis:
How? You can't "spoof" a file..
[Magisk] Vision:
Maybe he meant via Magisk module or something like that ? :unsure:
[Magisk] osm0sis:
That's not a spoof plus we already discussed replacing the file would more than likely break a ROM. 🤷‍♂️
[Magisk] Vision:
Yeah, more than that, Google broke and this 😂🤣

Android 14 blocks modification of system certificates, even as root

Update: This post sparked a lot of excellent discussion and debate on workarounds, and there are now multple working solutions to allow…

httptoolkit.com
[Magisk] markoppp:
Thank you! 🙇‍♂️
[Magisk] osm0sis:
Right.. But.. https://github.com/vvb2060/zygisk_cacerts

That's still different from what we're talking about however.
[Magisk] Vision:
Thanks for info. I appreciate.

Good to know.
[Magisk] pndwal:
Why thank you Scott... You're a scholar and a gentleman.

There's plenty of nonsense proffered in these threads. I do make every effort not to add to it.

Spoiler content hidden.

There's pobody nerfect.

💭 PW
[Magisk] aliantonio:
Didn't have much time over the weekend to test this. Will try installing this today. In apatch, how do I install this via KPM? I see 3 options: embed, install, or load. Not sure how to get this one working.
[Magisk] pershoot:
APatch docs (KPModule Usage Guide).

<edit> Please also see @Captain_Throwback's note (https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89578196).
[Magisk] Captain_Throwback:
KPMs are not the same thing as a module zip. This would be installed in the "APModule" section of APatch, not the KPModule section (where kpms go).

If you're referring to the Cherish Peekaboo module, you would first Load it to make sure it works on your device (i.e. doesn't fail to load or cause the device to freeze or reboot), and if everything is good, you can then choose to Embed it, so it gets loaded automatically when booted.
[Magisk] aliantonio:
Are you sure? The zip file contains a .kpm and I was able to embed it using the directions linked by @pershoot. I'm still waiting to see if RCS breaks however.

Edit: just saw your edit. Yes I was referring to cherish peekaboo module.
[Magisk] pershoot:
All ok, thus far, w./ Apatch + Cherish peekaboo + Zygisk Next + LSPosed mod?
[Magisk] aliantonio:
RCS lasted about 30 minutes, then eventually broke :/
[Magisk] pershoot:
Could you please see if you can liaise with bmax121 / tomyan112 GarfieldHan (https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89578773), when you get some time?
[Magisk] generalculprit:
Maybe this can help you:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] passionicon:
What is cherish peekaboo. Been seeing that a lot lately but can't find on github
[Magisk] pershoot:
Hiding Apatch.
[Magisk] ecera:
After a few days of lurking here reading back a good 20-30 pages, I was finally able to generate a working print for RCS and Device. Prior to that was using the print provided in the module which passed device, but RCS wasn't working. I had a collection of a good 7 working prints before and all of them were banned. Thanks to those providing tips and hints to get this to work. Device: Oneplus Open, Magisk Alpha.
[Magisk] Aarif goku:
Ok got my strong integrity with keybox on my vivo v15 which has working TEE but still it seems not able to pass strong and basic with its own device props or other device props I have only sailfish is giving me strong integrity so gotta find more similar prints out there any suggestions on what are the valid prints look like or how to narrow down is appreciated.

I maybe dumb about this but still asking.

Why can't we emulate a virtual TEE?

On broken TEE devices?

Devices with working TEE just need valid strong keyboxes and private fp to sort their life. For broken TEE can't they have an extra module or something to emulate a virtual TEE even if it just to show environment is broken for that time and combining with strongboxes it can probably pass strong integrity?

I want to have my Moto device working rather than my old almost broken Vivo.
[Magisk] David B.:
Ohh yes. That tracks with what was needed for spoofing hardware attestation during last week's mistake. I just forgot about it.
[Magisk] Vision:
About virtual TEE

View attachment 6116865
[Magisk] denzel09:
What is magisk alpha?
[Magisk] Aarif goku:
Ooh nice can I know the channel name?

Smali is not my Tea hope it gets into patcherGo soon for ease of layman like us.

Thanks for the info! It's an interesting development.
[Magisk] Captain_Throwback:
That's because it's not on Github. It's floating around the Telegram group, so you'll have to search a bit for it.
[Magisk] Vision:
Just search playintegrityfix on TG
[Magisk] Vision:
You can found it and here

[DEV] APatch - an alternative root solution to KernelSU and Magisk

The patching of Android kernel and Android system. A new Kernel-based root solution for Android devices. APM: Magisk module like support KPM: Kernel Patch Module support. (Allow you to inject any code into the kernel, Kernel function...

xdaforums.com
[Magisk] ecera:
It's a Magisk fork. I've had more success in the past while using magiskhide, denylist with this version. So I've stuck with it.
[Magisk] markoppp:
Could you please provide a link to that channel?
[Magisk] HippoMan:
That's easy for you to say! :):)

But seriously, I and I'm sure quite a few others find your posts informative, and I have learned a number of things.

To those of you who are not interested in learning and discussing this much detail and who might be overwhelmed by it, then my suggestion is simply to bypass these kinds of detailed posts here and just focus on the messages which address your specific questions or comments.

UPDATE: and also, it would be very helpful if those of you who are new here would please (!!) read all of the OP and the other posts that it references and please (!!) utilize the thread's search utility *before* posting any questions here.
[Magisk] Vision:
I can't, because violates the rule of XDA.
[Magisk] samhhmobil:
Search in XDA for the thread named:

"[Discussion] Magisk Alpha (Public Released) fork - @vvb2060"
[Magisk] fbirraque:
How know if the keybox.xml is OEM leaked or just SW signed?
[Magisk] Vision:
Interesting.

I learn that by write the keybox in keybox.java inside in the frameworkpatch method and compile, and after from the device I check the key attestation what show me.

If exist a easy way, I want to know.
[Magisk] fbirraque:
Yeah, me too.

I already found four keybox searching and another one that suppose to be OEM was gave to me. But even done all mentioned steps I couldn't reach Strong... in fact when APatch rooted, PI Fix 16.3 + private fingerprint + keybox (OEM) I can get max basic or even none certified.

- Poco F3, MIUI14 (by xiaomi.eu), Android 13

Am I missing some step?
[Magisk] wfred:
I also took

FAQ's are “WAY over my head.... when I get an answer like that provided by @CZ.Kostra, short, to the point and provides the exact information I request”

to mean

“I'm not going to bother educating myself, trying to understand the whys & hows, or searching the thread to see if my question has already been answered. I don't want to take advantage of en expert to learn how to diagnose and fix my problem on my own, I just want someone else to tell me how.”

I've followed this thread since the very beginning, and read the FAQ's, and at least skimmed all 18,000 posts. Most of what is being discussed these days doesn't pertain to me and most of what I've learned will never be of practical use, but it might be in the future.
[Magisk] badabing2003:
Next release of PF (currently testing) will tell you.
[Magisk] Vision:
That is good 👍
[Magisk] osm0sis:
Who developed it? 🤔
[Magisk] TotallyAnxious:
That's the fun part. Skynet is starting to hack our devices for us!
[Magisk] pndwal:
Guess you simply check if keybox is signed with the Android 8+ Google Hardware Attestation Root certificate, ie that it contains this root public key:

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAr7bHgiuxpwHsK7Qui8xU
FmOr75gvMsd/dTEDDJdSSxtf6An7xyqpRR90PL2abxM1dEqlXnf2tqw1Ne4Xwl5j
lRfdnJLmN0pTy/4lj4/7tv0Sk3iiKkypnEUtR6WfMgH0QZfKHM1+di+y9TFRtv6y
//0rb+T+W8a9nsNL/ggjnar86461qO0rOs2cXjp3kOG1FEJ5MVmFmBGtnrKpa73X
pXyTqRxB/M0n1n/W9nGqC4FSYa04T6N5RIZGBN2z2MT5IKGbFlbC8UrW0DxW7AYI
mQQcHtGl/m00QLVWutHQoVJYnFPlXTcHYvASLu+RhhsbDmxMgJJ0mcDpvsC4PjvB
+TxywElgS70vE0XmLD+OJtvsBslHZvPBKCOdT0MS+tgSOIfga+z1Z1g7+DVagf7q
uvmag8jfPioyKvxnK/EgsTUVi2ghzq8wm27ud/mIM7AY2qEORR8Go3TVB4HzWQgp
Zrt3i5MIlCaY504LzSRiigHCzAPlHws+W0rB5N+er5/2pJKnfBSDiCiFAVtCLOZ7
gLiMm0jhO2B6tUXHI/+MRPjy02i59lINMRRev56GKtcd9qO/0kUJWdZTdA2XoS82
ixPvZtXQpUpuL12ab+9EaDK8Z4RHJYYfCT3Q5vNAXaiWQ+8PTWm2QgBR/bkwSWc+
NpUFgNPN9PvQi8WEg5UmAGMCAwEAAQ==
-----END PUBLIC KEY-----

Otherwise it will just be software signed...

To work it must also be current, ie none of the certificates in the chain have been revoked, so official certificate revocation status list published at: https://android.googleapis.com/attestation/status should of course be checked also.

🤠 PW
[Magisk] Captain_Throwback:
One of the APatch devs - GarfieldHan
[Magisk] V0latyle:
You can't. PIF spoofs the device fingerprint for only GMS. TB Checker sees your stock fingerprint because the print is not spoofed for any other apps/processes than GMS. It's a bit of a mismatch - TB Checker will show your actual fingerprint, but when it calls Play Integrity for a verdict, Droidguard only sees the spoofed print.
[Magisk] Vision:
Your private FP have sdk 30+ ?
[Magisk] Vision:
Thanks for info.

Very useful.
[Magisk] mwzdalne:
can someone pm a rcs fingerprint because literrally every single android i own is rooted and/or custom rommed, so i dont have any device to get it from 😐

Sent from SM-S711B using ReLabs
[Magisk] fbirraque:
Really thanks!

Now I know that my five keybox.xml are SW signed only. So rolling back to my previous root (cat & mouse) solution.

🤷
[Magisk] majorfigjam:
Why not just follow the clues from previous posts , and make your own from a downloaded factory image?

Follow the example of @ecera in 18021.

All you need is 7zip and Pixelflasher.

Edit: and maybe a bit of patience in following instructions closely.
[Magisk] chiteroman:
1. Bought keybox to some random guy (>100$)

2. Keybox shows as "valid" in python script

3. Certificates aren't signed by Google private keys...

Friendly reminder: do NOT buy keyboxes, 99% it's a scam.
[Magisk] fbirraque:
23 by default when working (PI Fix or Fork)

But swapped to 30 and 34 when tested it with keybox (SW)
[Magisk] Vision:
Yeah, if keybox is Strong, with PIF v16.3, change sdk to 30+, then pass 3/3.
[Magisk] Aarif goku:
Seems to have issue with EU ROMs if it's miui found few people suffering the same issue.

If you revert back to lastest pif without keybox or private prints are you getting device integrity?
[Magisk] Aarif goku:
View attachment 6116944Any hope for these kind of devices in near future? I tired framework patch trying to follow as much possible but still unable to achieve it.

something like Virtual TEE for broken devices.
[Magisk] passionicon:
My condolences
[Magisk] pershoot:
Could you please remove:

Cherish peekaboo

LSPosed mod

Then, try Zloader LSPosed (latest is 0.1.3).

Please join the Telegram channels (below) and read around surrounding it, prior to implementation / testing against your own device / environment / configuration:

https://t.me/apatch_discuss (General APatch discussion)

https://t.me/mufanc_chan (Zloader LSPosed origin)
[Magisk] mwzdalne:
I have a samsung not pixel

also im a noob in this topic so if anyone is willing to help pls pm

Sent from SM-S711B using ReLabs
[Magisk] pershoot:
You can start here:

Download firmware updates for your Samsung mobile phone and tablet

Firmware for Samsung Galaxy mobile phone & tablet ✔ Find any update, ever released by Samsung. ✔ Free downloads & high-speed options available. ✔ For all versions and all devices. ✔ Including instructions

www.sammobile.com

[Q] How to extract build.prop from system.img

I have the stock rom for the Galaxy S6 Cricket variant... I am having trouble in getting the build.prop from the system.img. I have tired many methods from other threads but none seem to work. Any suggestions or working ways to extract the...

xdaforums.com

[TOOLS][ZIPS][SCRIPTS] osm0sis' Odds and Ends [Multiple Devices/Platforms]

osm0sis' Odds and Ends -- Misc./Batch Tools, Flashable Zips, Scripts, etc. General Information In a nutshell, I just wanted a single thread to gather links to some of my other, larger projects, but also serve as a spot I could put some smaller...

xdaforums.com

PIF FAQ

PIF FAQ Abbreviations DG = DroidGuard (SafetyNet/Play Integrity) GMS = Google Mobile Services (Google Play Services) PIF = Play Integrity Fix Frequently Asked Questions Q: What is a fingerprint and where does it come from? A: A fingerprint...

xdaforums.com
[Magisk] badabing2003:
Update Release:

June 24, 2024 v6.9.8.0 change log:

Improve Check keybox.xml to report if the certificate is software signed, also report about all included certificates.

Added settings option Keep temporary support files in case one needs to inspect the support files.

Add Github action to build on MacOS 12, MacOS 11 runner has been deprecated.

Update Pixel beta links from A14 to A15.

Minor bug fixes and improvements.
[Magisk] fbirraque:
Super! 👍
[Magisk] majorfigjam:
Everyone was a noob once, but if you read the helpful hints in Page 1 Post 1, and read the linked Osm0sis guides, then you will quickly pick up the essentials.

And, for what it's worth, the fact that you have a Samsung not a Pixel is not relevant - the Sailfish print you are likely using comes from a Pixel.
[Magisk] passionicon:
Trying to use checkbox now. I load the keybox but i get no feedback. Am i doing something wrong?
[Magisk] Captain_Throwback:
You can't use ZLoader without some version of LSPosed installed. It's not a standalone LSPosed implementation.

Also, ZLoader only seems to work with 5.10 kernels, so if the user is using any other kernel version, even trying ZLoader is likely an exercise in futility.
[Magisk] pershoot:
@aliantonio Please take note of @Captain_Throwback's notation(s) here.
[Magisk] pndwal:
Yeah... Be careful! 😁

Like I said, keybox can be valid, but for SW only... You only part-quoted me... I said:

And

An attestation certificate signed with a key hardcoded in Android source code is not the same as signed by the Google Hardware Attestation Root certificate... Many available/sold are from A7 and earlier... OEMs use Google Hardware Attestation Root certificate (Google private keys with root public key exposed for checking) signed keyboxes forA8+ (STRONG keyboxes). 🤠 PW
[Magisk] badabing2003:
How are you doing it?

Menu | Dev Tools | Check keybox.xml ?

You select the keybox file and you get no output?

View attachment 6116972
[Magisk] passionicon:
yea literally no output or nothing at all
[Magisk] badabing2003:
Can you confirm that your keybox.xml has the following parts? and follows similar format?

View attachment 6116974

And you're looking at the console for the output (not a popup window)

View attachment 6116975
[Magisk] pershoot:
@aliantonio @Captain_Throwback I did swift try this and unfortunately, Zygisk-LSPosed (mod-7295) panel couldn't open (it sits at a white screen after the small popup box from init.) and Pixel Xpert's features aren't activated (was enabled prrior). ZLoader-LSPosed is active and Zygisk LSPosed (mod) is disabled, but in place. I am on a 5.10 kernel. I did also try to re-install LSPosed (mod) - Zygisk, to observe, post ZLoader module enable, to no avail.

@aliantonio I've reverted back to my previous config. for now, but left the ZLoader module in-tact (disabled), for potential future testing.
[Magisk] aliantonio:
Good to know. I am also on a 5.10 kernel but judging from your testing, it doesn't seem like I'll have much luck. I still may give it a try and will let you know if I do.
[Magisk] Captain_Throwback:
The path I've found to getting it working for me is to have Zygisk Next and LSPosed installed and enabled, and then install ZLoader. On reboot, LSPosed should be loaded, and the LSPosed module should be disabled and only ZLoader and Zygisk Next should be enabled. Then I reboot again, without touching anything to confirm that LSPosed still loads. Then I disable Zygisk Next and reboot. LSPosed *should* still be working, and then I can safely remove Zygisk Next and reboot and LSPosed should still be working.
[Magisk] pershoot:
Did you encounter any issues during testing with Zygisk Next still enabled and LSPosed ZLoader continuing to function, for those scenarios where Zygisk modules still want to be used and active, in addition?
[Magisk] Captain_Throwback:
If Zygisk modules will still be used, then there's no need for ZLoader.
[Magisk] pershoot:
Yea.

@aliantonio

For completeness, I did try disabling Zygisk Next, to no avail.

Since you do not require Contactless / Wallet (your current setup doesn't include PIF to spoof), your only recourse currently is to omit LSPosed from your setup and perhaps watch the space as it is everchanging, hehe. RCS should continue to function, for the interim, with your own device's print (passing BASIC).

I've kept the file(s) around but cleansed my modules space, for potential future testing.
[Magisk] fbirraque:
Did not understand what you said. But playing with a (SW signed) keybox will mess up the certification and some troubleshooting will be mandatory. When reverting to the default keybox, Play Integrity Fix gets BASIC as max certified.
[Magisk] Aarif goku:
Just Xiaomi EU ROMs (Miui/Hyperos) are having trouble passing device integrity and even basic integrity in some cases.
[Magisk] tvall:
offer rescinded. i found one

Spoiler content hidden.
[Magisk] mwzdalne:
oh.

Sent from SM-S711B using ReLabs
[Magisk] mwzdalne:
ok, i will try

Sent from SM-S711B using ReLabs
[Magisk] Vision:
I just tried it.

All work good.

Thank you for this amazing program 🙏