yashsingh1/xdaforums huggingface dataset:
[Magisk] zgfg:
Ok, maybe. I know that Chiteroman had it and/or it always worked for me that way with his versions that supported custom pif .son or (way back) pif.prop files

Since my phone has 1st API level 31, and since most JSON files (fingerprints) requires the lower, the value must be lowered

Of course, I also prefer your code now where properties must be defined and then they work or not based on how they are defined, not by guessing what would happen if omitted or defined as ""in the JSON fike
[Magisk] simplepinoi177:
Again, total noob here...

But it seems that I should input in the OP that many (and even chiteroman's PIF) are defaulting to Level "23" as a go-to point -- rather than going down incrementally one by one....

Although I think i read somewhere oms0sis you said to try and keep near to the original fingerprint FIRST_API for some reason or other...
[Magisk] osm0sis:
I said, if your print's >32 start by lowering it to 32, then if that doesn't work try 25.

If you're <32 and >25 then maybe try reducing or raising it by 1, then if that doesn't work try it at 25.

Those are the 2 clear thresholds in the testing that I've seen. Any print <25 should be fine at its actual value.
[Magisk] trevtdogg:
thought i would offer a less complicated (but also less automated) way for noobs to go about finding, testing, and using fingerprints.

my method to success was:

* start with a dummy placeholder 'pif.json' file (eg. one that you know has already been banana-ed by google and won't work anymore) so you have all the required fields and formatting correct.

* find a 'build.prop' file online and open it in a text editor, or even just find the text contents of the 'build.prop' file online.

* use @osm0sis 's guide to find the needed values of all the fields from this new 'build.prop' file (using ctrl-f or similar).

* open the dummy 'pif.json' file in a text editor, and copy paste the new values over the dummy values.

* save this file as 'custom.pif.json' and put it in the correct directory as per @osm0sis 's guide and use his PI-fork module.

* reboot, then check if you pass both basic and device.

if it doesn't pass, first try to change the API (also listed in some build.props as 'SDK') level to a lower value as per the advice from others here.

if it still doesn't pass, try another build.prop from a different device.

i was targeting any build.prop that had an original API / SDK value of 27 or lower in order to more likely pass in my opinion, and found success on my 5th try.

hope this helps others, just please don't use the one i found! ;)
[Magisk] simplepinoi177:
Just thought you'd like to know that I included your/this post to the OP ;)

Thanks for it!
[Magisk] zgfg:
From the list of online JSONs for a particular Chinese vendor (it's not Xiaomi, Huawei, OnePlus or Meizu) only 5 pass with the given FIRST_API_LEVEL

With the lowered API, 25 passed
[Magisk] simplepinoi177:
fascinating...and seems to go with what many are saying (in terms of changing them). From what you recall, what were the original FIRST_API_LEVEL? I'm curious what's the average range where the other 20 needed to go straight to the lowered...

but I am envious of you and @xSnowLeopardx in how many you guys have found (with you and your 25 passing!)....i struggled even to find one!

and @Iridule as well! Look at this guy bragging ;)
[Magisk] trevtdogg:
out of interest, the 20 that failed with the given API - did they fail both basic and device, or just device?
[Magisk] zgfg:
I didn't pay attention - using my pif-test.sh script but for few I compared, they passed Basic with the original API
[Magisk] simplepinoi177:
@switchem, Yes.

The way PIF (and Displax's MOD, which much of it is based on) never needed the requisite services in the DenyList...it took care of that kind of thing under the hood.

As such, in my experience, I didn't have anything special outside my own personal list of apps on the DenyList.

You do not need to manually clear anything.

You can simply build prop, edit json, run the integrity check and move on (unless you want to adjust an API level [if it is above 33] or reboot the device yourself in case PF didn't restart the gms process properly)
[Magisk] Wolfcity:
Thanks for the hint with YASNAC, very helpful to make a preselection before pushing another PI checker run.

Hopefully, YASNAC will stay for a while.
[Magisk] simplepinoi177:
With Google doing "Full turndown" on SafetyNet "End of January 2025", I wonder if they'll keep it after that....but more than a year is certainly "for a while"....
[Magisk] simplepinoi177:
even the guide here? If you have any suggestions, would like something to be simpler, or any improvements, please don't hesitate and feel free to inform me and I'll do my best to incorporate it here...

there's been success where there are fingerprints where they only achieve BASIC, but lowering FIRST_API_LEVEL to 25 or even 00 caused the same fingerprint to succeed!

also, my working fingerprint would sometimes only pass 1, but since i know it works from an hour ago, i would have to reboot, and find the pif.json was blank in PF, and once i pasted the values back and save and continued, it worked! might do well with a double-check....
[Magisk] miimaa:
Thank you! I haven't changed the API LEVEL at all. Yesterday I tried 123 different dumps without success.
[Magisk] sawdoctor:
I don't get it, they can understand how to unlock a bootloader and patch a boot img but can't follow this guide?

No disrespect to anyone but if your guide is too complicated for them should they really be rooting? Asking for a bricked device
[Magisk] simplepinoi177:
I appreciate the compliment...

i did work very hard to make it as direct & clear (if not concise) as I possibly could; so that anyone (most prominently a "noob" like me) might be able to follow....

But I believe in each and every one of them and it could easily be not that it's "too complicated for them" and that this is over their head (so "should they really be rooting?"), but that they feel that way and feel that they're not up to the task -- most likely because they haven't properly looked at my guide (to see that it's broken down as much as possible) and/or see the Great Wall of (China) Text size and get turned off.
[Magisk] Slim2none4u:
So PIF can brick a phone now? Just stop.
[Magisk] sawdoctor:
Flashing any zip on a rooted phone can brick your device, you are giving root privalgies to a complete stranger. The very least anyone should do flashing anything on a rooted device is read the release notes. If chiteroman or any other Dev so wished they could brick your phone

Edit

Chiteroman even had to modify his PIF because Google borked shadowhook on A14 beta, only Dobby works now so yes it could brick your device
[Magisk] zgfg:
Where did you read that ?!?!?!?!

Module makes no permanent changes on the phone, it's all systemless.

Disable the module (or uninstall) and reboot, and you will be exactly as before installing the module

And nobody here ever bricked the phone with PIF

Besides, source code is available, so inspect (and build yourself if you don't believe that the released built zip was really made from the published source-code)

However, no guarantee (user must take care of his custom ROM) how the module may interfere if your custom ROM comes with some built-in PI spoofing mechanism (like Xiaomi.eu)
[Magisk] Slim2none4u:
sawdoctor is spreading the rumor in the post before mine. A little fear mongoring?​
[Magisk] Wolfcity:
Ok, where's my popcorn?🤣

It get's interesting like in the other thread.

But seriously: @simplepinoi177 is really trying to make this topic as easy as it could be. I'll understand that getting started is a bit problematic but we have:

- A really good tutorial by @osm0sis

- A script by the same person

- A gui based software by @badabing2003

- This very (noob friendly!) thread

So I'm asking myself too why is it so difficult to search for a FP (the most visited site has been mentioned a lot of times)?

I'm no coder/developer or anything but it took me one day to mine my actual print working since then and a few more for the worst case.

I know all this has been said a couple of times but I don't get it too.

Users unlock/root/modificate their brand-new and expensive devices (a lot of Pixel 8 users here) but aren't able to find this build.prop entries?

It's strange.

End of message.
[Magisk] sawdoctor:
No rumours at all just good advice. Read the release notes before you flash anything simple as that
[Magisk] trevtdogg:
@sawdoctor clearly meant if this guide is too complicated then maybe they shouldn't be rooting their device, since for people who are that uncertain with these types of methods it's very easy to accidentally brick a device during attempted rooting. I mean there are threads about it all over XDA...
[Magisk] zgfg:
Danger is in the rooting itself, not in installing the module

Mining for the spoofs requires taking a time to read, learn, etc

Hence all together, not for the Average Joe user. Specially not for those who are lazy to invest their time and concentration in searching, reading, learning, systemizing and finally to do the things carefully

But it doesn't mean that the module itself will brick the phone. Careless users will brick their phones, usually not even by being able to describe what they did and how they tried to 'fix' (but actually making things worse) when asking for help

Or really those developers who work and live with their phones on the age like developing their custom ROMs, and so
[Magisk] sawdoctor:
Might point was to read before you flash. Too many people are used to flashing blindly and that can be dangerous
[Magisk] zgfg:
Actually, before unlocking BL - to save their time and effort

But I used to see totally stupid and ignorant questions, showing that the user didn't do (and didn't want to do) any homework and research, but in the same post complaining why for his eg Xiaomi, he has to wait 172 hours (exact 7 days) for the green light to unlock BL on his brand new Xiaomi phone

Then wait for 7-8 days and the same user will cry for help once he flashed the ROM for another (Xiaomi has a lot of similarly named devices) and so.

Showing again the same pattern of laziness to read carefully and to pay attention to the details

Those users don't even post/reply/follow-up ito the existing threads but open right away the new Question thread. You see a new Member, posted only 3 or 4 times so far but he 'knows' that the stock ROM is sh... and that he must right-away flash that and that custom ROM - he was instructed about on some TG channel, with more cats and dogs jumping around then the total number of posted words
[Magisk] sawdoctor:
Best one I've seen today was someone who patched play store with the well known (banned on xda) patching app. And now they are expecting PIF to make their device certified. When told the only option was to restore stock playstore thier answer was "i don't want too"
[Magisk] Utini:
I have access to several Android phones running stock android.

I could extract their props/fingerprint and be safe for a long time I guess.

But will those phones become uneusable once the fingerprint spoofing gets dedected on my rooted phone?
[Magisk] simplepinoi177:
No....

Basically, what the other experts are postulating is that there is an extra "check" that Google does on their end that confirms whether the fingerprint matches the device it's being sent from. Otherwise, with the devices chiteroman & the xiaomi.eu custom ROM devs were using, all the users on them would be female-dogging Google on why they weren't passing anything any longer -- now that PIF and xiaomi custom ROMs were burning through 2 or 3 fingerprints a week....

I would say you have a higher possibility of staying "safe for a long[er] time" -- especially considering if they are not well-known or popular brands/device models -- but be that as it may, be aware that you are still "spoofing" their device fingerprint on another device; which shows an inconsistency. So if Google decides to be more proactive with its checks and/or it becomes too apparent (like a Samsung S23 Ultra showing an Acer TV or something like that), "safe" might be relative...
[Magisk] Utini:
Thanks for explaining. So the goal would be to get my hands on the same device model that is habe rooted and extract the fingerprint.

E.g. extract the fingerprint from my P8P before I sent it back for warranty to get a new P8P that I would root?
[Magisk] simplepinoi177:
It doesn't have to have root or anything (just as long as you can get access to the build.prop file or find a ROM dump of it out in the internet), and it doesn't have to be the same device model either.

You could extract a fingerprint from the P8P, but as shown in Section 2 (that covers the section of that part of osm0sis' guidelines), any device that has a higher FIRST_API_LEVEL than 32 (which the P8P most certainly does) usually requires a higher integrity check which causes DEVICE_INTEGRITY to fail (as I understand it; which is why we aim for lower than 32 so we can "trick" Google's check with a more basic and less strenuous integrity check). You could always try and manually lower it to 32 or lower (all the way to 00), but the P8P being a Google device and popular enough, I wouldn't bet on that particular fingerprint passing.

It still would be worth checking those other "Android devices" you have "access to"....

Hopefully I made this clearer....sorry I tend to complicate things...
[Magisk] zgfg:
Not really. If your device requires Hardware backed,/TEE based attestation, it will not fall to Device Integrity, but will try Strong and will fail (since you cannot spoof the Strong)

Whoever gave that advice to you, it's of limited use. Statistically, only few percent of FPs are valid for this spoofing. So why would that single one FP you would try, be that statistically rare good one

Instead - and that's the right approach, google for the collections of build.props (or the already made PIF JSON files - there are many collections available on the Net) download and test 20-30 of them and there will be a real chance that you find a 'good" one (specially if you make always two tests, with the proper FIRST_API_LEVEL and then also (if the first did not pass) with the value lowered to 25
[Magisk] simplepinoi177:
I don't understand this "impossible to use *it* as a wallet"....use the "file [into root/adb]" or the fingerprint? You don't put it "as a wallet"...Does this just mean that Wallet doesn't work? Because, yes, Wallet won't work unless you get MEETS_DEVICE_INTEGRITY; and in some cases (if you set up the app before failing), you can launch the app, but when you Tap to Pay or add a card, it fails...

I'm sorry if there is a bit of a language barrier and I'm sympathetic to that, so if I'm taking it too literally, my apologies....

but just so you know, all potential fingerprints work, whether on a Pixel 6 or any other Android smartphone -- it is not device dependent; there aren't fingerprints that work any better or worse on a specific device (Pixel 6) or otherwise..

@TheRomRooster @Iridule @ArzZenic
[Magisk] chuppito:
Yes there is a language barrier, sorry. I fail all 3 tests. However, I deleted the wallet, playstore and play service data, I can no longer use the wallet since the 3 tests failed.
[Magisk] simplepinoi177:
Yeah...something's going wrong....you shouldn't be failing ALL 3 tests....normally should at least be passing BASIC...any unlocked bootloader or rooted device isn't going to pass STRONG anyways...

I suggest you delete the pif.json(s) in all the /adb folders, uninstall the module, reboot, test and confirm you pass at least BASIC, then install the module, and pass at least BASIC (with the default build.prop) before going forward testing other fingerprints.

But there are fingerprints that will fail all 3 and/or the fields are wrongly inputted (which shouldn't be since PF should format and input it properly) and/or I found that I would fail in a lot of respects when BUILD_ID & VNDK_VERSION or "INCREMENTAL", "TYPE", "TAGS", "SECURITY_PATCH", "DEVICE_INITIAL_SDK_INT"

was included, but when I didn't include them, it would pass....
[Magisk] sawdoctor:
Have you put wallet or any Google apps in deny list? Or have you added wallet to bootloader spoofer? Those will give you 3 fails. Also some fingerprints can give 3 fails, if they do try another fingerprint (xaiomi fingerprints can sometimes give 3 fails)
[Magisk] Tirofog:
It's just the wallet should be added:
[Magisk] sawdoctor:
No the wallet shouldn't be added, no Google apps should be added that's why I was asking
[Magisk] zulu88:
Sorry. Remove.
[Magisk] pndwal:
You are correct that Google Pay/Wallet doesn't appear to search for root so it's not necessary to add to denylist, but it won't hurt if you do...

It can be treated like bank apps etc that may look for root, unlike other Google apps... If you hide root from some of those you may have unexpected issues like broken Webview etc. PW
[Magisk] chuppito:
hello, I was able to follow the help. I deleted the modules, deleted the pif, restart, delete applications data, restart still the same problem
[Magisk] chuppito:
I had a module in lsposed that I deleted, we are starting to get closer to the goal
[Magisk] simplepinoi177:
after the "restart still...", I wanted to confirm that you reinstalled the module...?

I've seen a number of reports where PIF 14.8 is causing a bunch of issues. So either downgrading the version to 14.6 or lower or installing the beta "test" version (I'm unsure how to obtain this; I know it's obtained through the Github -- maybe commits) resolved it for many of them.

Either way, you should be passing at least BASIC with your actual device fingerprint -- then you can apply a custom fingerprint because, due to a possible number of reasons, you can fail all 3 with a custom fingerprint; but it'd be best to know if it's your set up or your fingerprint first and foremost...

I started a reply, got caught up with Christmas Eve stuff, and continued with the reply and didn't see your update.

Yes, closer! That's good. Now you can continue testing "donor build.prop" fingerprints and if it fails all 3, you know it's the fingerprint and not your set up...
[Magisk] chuppito:
What does donor build.prop mean?

Should I look for fingerprints that come from different brands and models?
[Magisk] sawdoctor:
Its all in the op under finding a donor prop. Your best bet to find a working fingerprint is to look for build props on devices running android 8.1 . Google android firmware dumps and you'll find all the firmwares on gitlab. Just pick a few devices running android 8 and try them. It's not as complicated as it seems just spend 20 mins digesting the guidelines and you'll realise it's actually easier than rooting your device
[Magisk] chuppito:
I learn very quickly, in fact a long time ago I managed to grant root on a device that did not accept it while looking for how to create it, since magisk made the work easier. If I understand correctly, I am looking for an original 8 ROM, extract the build.prop and test on myself? If not, is there a tutorial? thank you for everything
[Magisk] simplepinoi177:
"donor build.prop" is based off of a term badabing2003 was using in his walkthrough/guide. "donor" or donation -- as in that your native actual device fingerprint won't work and Google will detect & deny it; so we are all sort-of borrowing a device fingerprint that we find ourselves instead, to sort of represent our device instead. Hence we're finding and using it as a donor as if it is donating its fingerprint for you to use.

As stated in Section 2, different brands & models are promising; especially compared to your own device which is most likely a well-known/popular device which is too new and/or where Google and/or other users will recognize & use (more likely to be blocked/burned).
[Magisk] chuppito:
After hours of research and around 50 build.prop
[Magisk] chuppito:
Thank you very much for your help without you ! wallet would not work
[Magisk] simplepinoi177:
I'm so very happy my guide and this thread helped you (and at least one person) get there!

Merry Christmas & Happy Holidays!
[Magisk] p0tchy:
I'm just here to share my experience. Using the new button "Get TheFreeman193 Random Pif" from Pixel Flasher and manually changing "FIRST_API_LEVEL" to "32" worked great with lots of different fingerprints. I am very grateful to this community for all the information shared on this subject and how streamlined the experience is now in getting this to work.
[Magisk] simplepinoi177:
Wonderful! Thank you so much for sharing the info! I'm sure I/we will benefit from it! @badabing2003 really helped out and made it as streamlined as one could hope for!
[Magisk] simplepinoi177:
@CZ.Kostra , from this comment, I just wanted to confirm -- for it being an A12 FP -- did you have to lower the FIRST_API_LEVEL, like I assume you had to and all the literature on the subject supposes you would need to?
[Magisk] CZ.Kostra:
Yes. I reduced DEVICE_INITIAL_SDK_INT from 30 to 25.

Decrement will force the rating type from HARDWARE to BASIC. I use the Yasnac app for type checking.
[Magisk] Alpha_Geek1:
What does this fingerprint actually *mean*? Does it have to match to something? If so, what? From reading so far, the take away I have is you just 'choose' a device to spoof. I have all OnePlus 7 Pros. Can I choose to use the fingerprint of an HTC One M7? Can I just 'make something up' like a fingerprint for a phone called the HurricaneVortex99? No. I can't make something up... but I need to understand how to think about this. Why doesn't any of the fingerprints I have tried so far work? What is it (google) looking for? What are the attributes of a working fingerprint?

Assuming my wife's totally stock, bootloader locked, never rooted OnePlus 7 Pro passes Play Integrity, why does it not work to do adb shell getprop and use the values from her device for my pif.json? This is literally the first thing I tried. I actualy don't know if her device passes. Once I put these values in, Safety Net no longer passed CTS. What is the pif.json fingerprint actually doing? It seems it's not just a simple spoof as in "What's your name? <lying>I'm Bob!" If I could understand how to think about this, I might be able to come up with something that is more likely to owrk.
[Magisk] badabing2003:
Even the latest phones if they are totally stock and bootloader locked pass, not just device integrity, but strong integrity.

If your wife's phone passes while rooted and bootloader unlocked, then it would be a good donor print for your phone.

Then getting the properties from your wife's phone would work on yours.

If you read the guides, you'd see that there are certain criteria that the donor print would have to meet to make it work (assuming that it is not already banned)