[Google Pixel 8 Pro] roirraW "edor" ehT:
Play Integrity / SafetyNet

​

Play Integrity / SafetyNet

:​

You do not need more than one of these:

@chiteroman's [MODULE] Play Integrity Fix (SafetyNet fix)

@osm0sis PlayIntegrityFork (fork of @chiteroman's)

I had been also using the following up until June 12, 2024, when @chiteroman said the above quote.

I haven't actually used the second one by osm0sis, so I don't know for sure, but I use the first one by chiteroman, combined with:

daboynb's PlayIntegrityNEXT (actually just playcurl) - you can use it to (your choice) automatically or manually update the Play Integrity fingerprints used.

Also for reference, @simplepinoi177's thread How to search & find your own fingerprints [noob friendly]: A Comprehensive Guide w/ tips & Discussion for Complete Noobs (from one)

Launch the Magisk app.

Go to Magisk's Settings (Gear in top right).

Click Hide the Magisk app.

When you hide it, you'll have the optional opportunity to change the Magisk app's name to whatever you wish. It doesn't have to be complex to fool apps that check for Magisk.

Important

: When you have the Magisk app hidden or renamed, you can accidentally install a new copy of Magisk. This situation won't work at all - neither copy of Magisk will work with two installed. This is one reason why I don't completely hide Magisk, so I can tell it's installed because I have it renamed as something easily recognizable.

Back to the Magisk app's Settings...

Click Systemless hosts. This adds a Magisk Module to Magisk, which you can verify in a later step.

Toggle Zygisk on.

Toggle Enforce DenyList on.

Click Configure DenyList.

Add every app that you want to explicitly deny root and the existence of root.

You can click the 3-dot menu and choose the options to display system and/or OS apps, if necessary.

Note that for many apps, it is not enough to click the single checkmark to the right of the app name in this list. For many but not all apps, you should click on the app name and you'll see it expand to two or more entries, each with its own toggles. In this expanded state, you can now check the single top checkbox beside the main app name and it'll toggle all individual sub-entries.

Some apps add new entries to this list from time to time, so if you find that an app used to work for you when rooted and doesn't now, check this list again and look for the entries that aren't fully checked. There will be an incomplete horizontal line above the apps that don't have all of their sub-entries toggled.

You can use the Search button at the top of this list to find specific apps quickly.

The most common apps you should definitely fully check in this list are:

IMPORTANT - There are some things, such as Google Play Services which it's fine to add to the DenyList, but it's perfectly normal when used in combination with the Universal SafetyNet Fix (USNF) that it is back to being unchecked the next time you visit the DenyList. Since USNF takes care of Google Play Services, you don't even have to add it to the DenyList in the first place.​

Google Play Store

Google Services Framework

Google Play Protect Service

Wallet

GPay

Any banking apps.

Any streaming apps that use DRM.

Any 2FA apps, especially those for work.

Some of those Google apps might not need denying, but it doesn't hurt to deny them.

Any time you toggle more entries in this list, it may be necessary to reboot the phone for it to take effect.

From the main screen in the Magisk app, go to Modules at the bottom.

Confirm that the Systemless hosts Magisk Module is added to this list, and enabled.

Install the appropriate Magisk Module: Universal SafetyNet Fix referenced above these numbered instructions.

Reboot.

The Play Integrity pop-up that appears should say:

[MEETS_BASIC_INTEGRITY, MEETS_DEVICE_INTEGRITY]

Sometimes, clearing app cache and/or data for apps like the Google Play Store, GPay, Wallet and others (and then rebooting) after these steps may help pass SafetyNet as well.

See @V0latyle's explanation (and further linked post) for why we can't achieve STRONG_INTEGRITY with an unlocked bootloader.

See @V0latyle's [DISCUSSION] Play Integrity API regarding why SafetyNet, per se, is actually defunct and replaced with Play Integrity - and New Official Universal SafetyNet Fix released by @kdrag0n v2.4.0 referenced in the steps above takes care of the latter.

Optional steps when updating - flashing custom kernels

:

IF you forget to disable Verity and Verification

:

My own words: