yashsingh1/xdaforums huggingface dataset:
[Magisk] eac5:
Logging is only set up if there's errors, so at least the fields might be setting correctly. Whether that's enough, who knows, I think not. Too bad the data sent to Google's servers is DG's garbage and not plain, otherwise we could have inspected network traffic to check.
[Magisk] changhuapeng:
I did a quick hack and add logging to chiteroman's FrameworkPatch. The codes are modified by shamelessly lifting them off from osm0sis's PiFork. Keybox and fingerprint remain the same and I did only a brief check to make sure the logs are showing.

Now running adb shell logcat | grep "PIF" should at least shows in logcat if the fingerprint fields are being set correctly or not.

Modified source available here: https://github.com/changhuapeng/FrameworkPatch/tree/logging

Edit: classes.dex reuploaded.
[Magisk] Vision:
Same bootloop.

@changhuapeng I think the uploaded file is broken.

Is only byte and not KB.
[Magisk] changhuapeng:
Thanks for the feedback! Looks like something is wrong with my upload from mobile. Will reupload soon.
[Magisk] changhuapeng:
@badabing2003 @Vision I've reuploaded the classes.dex file.
[Magisk] Vision:
@changhuapeng

The classes.dex working, as I see all working normal.

All the fingerprint fields are being set correctly.

Like in the photo, and all other fields is right.

So if all fields is correct, something else cause the problem and can't pass.

EDIT: The only missing is the: DEVICE_INITIAL_SDK_INT

But this missing from the begin inside in Android.java
[Magisk] chiteroman:
You can't modify that field because is marked as SystemApi:

core/java/android/os/Build.java - platform/frameworks/base - Git at Google
[Magisk] casouzaj:
Well, I switched to APatch (from KSU), and, right afterwards, installed the module again using the latest classes.dex. It, once again, installed without errors, and this time, my 'media picker' frequent crashing issue has gone. Nevertheless, Key Attestation app doesn't find anything.
[Magisk] badabing2003:
Can't we have a similar behavior as in PIF?

Otherwise that means that we can't use any prints that require the initial_sdk to be set to 25, which kind of limits the pool of functional prints.
[Magisk] tinbilly:
The installation was successful, but my device failed to boot even after clearing dalvik cache. Do I need to remove Bootloader Spoofer prior to installing this module? My system is crdroid 9.7 (a13) + KernelSU on a moto g8 power. Much appreciated any advise/suggestion!
[Magisk] taka2902:
Works great on HyperOS, says bootloader is locked. However the system is super laggy and almost every app is unable to start (they crash right away), i tried clearing cache but didnt work. Sad that this module does what i wanted but cant use it on my device.
[Magisk] Jaye1989:
This is the only module I seem unable to install on Magisk.

I am getting "Error: Could not define 'unzip' binary"

All other modules install without any issues. I've removed every module and tried reinstalling magisk with the same error. Any advice on what I could possibly be doing wrong?
[Magisk] Vision:
Yeah, first try to disabled all other modules, reboot and check again.
[Magisk] chiteroman:
PIF spoofs that prop in native code (C++)
[Magisk] changhuapeng:
I doubt removing BootloaderSpoofer will help at all but you could still try if you want.
[Magisk] changhuapeng:
Likewise, we don't have that hook in native code to log the DroidGuard stuff and find out what system properties DG is checking and getting.
[Magisk] badabing2003:
Do I smell a blend of FrameworkPatch + PIF + FrameworkPatcherGo to be the next generation of PIF?

Or is that a wishful thinking? :)
[Magisk] changhuapeng:
I have received a few issue reports from users facing error like yours when the installation script failed to load dependencies. Most of the users encountering these issues are like you, on Magisk 2700x. As of now, I am unable to reproduce such errors and do not have a fix for these issues yet. I do have a vague idea of the cause and am working on a solution.
[Magisk] badabing2003:
For what it's worth, I had a nightmare of a time trying to recover from the bootloop that I experienced when I used the classes.dex with logging (the first buggy version)

Typically it is very easy for me to recover from such bootloops without having to wipe, I usually help out others with such issues.

I was on Magisk 27, each time I would flash the stock, I would be able to boot back to the system, but obviously with the module causing bootloop I had to disable module loading, key combinations didn't help, and even the Special Magisk that gives root but does not load modules didn't help.

I'm stubborn at times, I could have wiped the phone and be done with it, but this was pissing me off and I wanted to win the battle :)

After many attempts and various tests, as soon as I installed Special Magisk 26.4, it worked.

Something funky about 27.x
[Magisk] casouzaj:
Again, I had to uninstall the module. I use the latest APatch for root, and the revised classes.dex. It installed correctly, but I noticed my 1 II (running LOS21) running slower, like other users above reported.
[Magisk] Vision:
This at least for me on A11 with Kitsune Mask, cause by dummy the boot-framewort.art for some reason, and if you have enable the PIF module.
[Magisk] casouzaj:
If I disable PlayIntegrityFork (CI #228), my phone doesn't pass device integrity test.
[Magisk] Captain_Throwback:
I'm seeing this same issue on one of my devices. Even without using a custom.pif.json, I pass Device Integrity only with PIFork enabled, along with FPG. If I try to use Scripts-only mode or use only FPG, I get no Integrity. It's very odd.

NOTE: This is a device where I reprogrammed TEE with the AOSP sw cert, if that's relevant (I had broken TEE due to persist modifications).
[Magisk] Vision:
But the purpose of this frameworkpatch method is for pass, if you have this and PIF module enable, they clash with each other for some reason.

EDIT: I have write about that here: https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89532797
[Magisk] changhuapeng:
According to the screenshot @casouzaj uploaded, he seems to have a broken TEE too. Just out of curiosity, which PIFork version are you, @Captain_Throwback on?
[Magisk] casouzaj:
CI #228.
[Magisk] Captain_Throwback:
Same version as @casouzaj
[Magisk] changhuapeng:
When you have the time, can you try to see if these combinations pass device integrity on your TEE reprogrammed device:

FPG + PIFork enabled + Zygisk disabled

FPG + PIFork scripts-only mode

Just trying to narrow down my hunch that maybe the various fixes that osm0sis included in his PIF scripts, help to pass device integrity.
[Magisk] Captain_Throwback:
I already said that Scripts-only mode didn't work in my original message, and the module won't load at all with Zygisk disabled.
[Magisk] changhuapeng:
My bad, I misunderstood what you said.
[Magisk] eac5:
After more tests on Pixel 7, stock A14, with valid keybox:

FWP alone = BASIC

FWP + PIF-Fork scripts-only-mode = BASIC

FWP + PIF-Fork full = DEVICE

I also made a version of FWP with the DG props injection part removed, and tried that standalone and with PIF-Fork full. Same results. The two methods don't conflict with each other, that's something.

KeyAttestation spoofs correctly in all cases. In other words, at the moment this is basically LSPosed-less BootloaderSpoofer, only good for local attestation.

A combination of PIF and FWP should most likely get us in the direction of better results, though what and how to port over from one to the other remains the big question. I've some ideas, might play around with them once more free time is available. In my version of BootloaderSpoofer there's also spoofing for device props like brand, model, patch levels and so on, won't hurt to add that to FWP and see what happens.

Misc. observations: building the FWP apk as unsigned guarantees a bootloop on my end. Signed works no problem, no idea why. Magisk Alpha has functionality to painlessly escape a bootloop by automatically entering safe mode if device fails to boot twice in a row, saved me lots of hassle several times, I recommend using it if doing extensive testing.
[Magisk] Captain_Throwback:
To confirm, are you using a custom.pif.json with PIFork, or running it without one?
[Magisk] eac5:
In most tests, yes, with a custom print, whatever the current one is from Xiaomi. Though there were one or two instances where I forgot to restore the print after reflashing module, so it used the bogus example one, in which case PI returned BASIC. Scripts-only also runs without a print.
[Magisk] Captain_Throwback:
If you have to use a print, then patching the framework hasn't really worked.

What I'm trying to understand is why just enabling Zygisk without a print gets Device Integrity to pass. I also just noticed that I don't have any indication of device certification in Play Store anymore - it seems to be missing, which is new (it was there yesterday).
[Magisk] eac5:
Framework patching worked, for spoofing local attestation, not remote, that was exactly the conclusion of my post.

Though I wonder, why do we need props spoofing inside FWP, if all that does is tell DG our device doesn't support hardware attestation, seems counter-intuitive.

How do you mean only enabling Zygisk without a print passes DEVICE?

Certification field is still there for me.
[Magisk] Captain_Throwback:
Because that's not all it does. Maybe you didn't notice, but the Android.java in FrameworkPatch includes the current XEU print, because part of the patch is that it also spoofs those props, so PIF shouldn't be necessary if it's working correctly. That's how it behaves on my 2 newer devices, so that PIF isn't needed, and DEVICE Integrity passes.

Thus my conclusion that the Patch isn't fully working, since you shouldn't need PIF at all.

EDIT: I just noticed you said you rebuilt FWP without the DG spoofing part included. Now it at least makes sense why you would still need PIF. Maybe I should go that route, although I guess the only advantage is for the bootloader to appear locked?

I mean that if I use PIFork, and don't include a custom.pif.json (which means it's not actually spoofing any prints), then I somehow pass Device integrity. It's almost as if just having the module attempt to look for the props to spoof somehow gets the FrameworkPatch spoofing to activate.
[Magisk] Captain_Throwback:
Hopefully these pictures will help.

This is the only setup where Device Integrity works (I haven't tried using a print with PIFork, as that would basically nullify the need for FPG).

P.S. I cleared Play Store data and got Device Certification back. I'll check it again tomorrow to see if it disappears again.
[Magisk] casouzaj:
As suggested by some members above, I tried to remove PIFork. As I expected, I don't pass device this way. Reinstalled it. Keeping FWPG for the time being, but my phone is, for sure, slower.
[Magisk] Vision:
@Captain_Throwback

As I see you have Kitsune Mask latest canary.

I have latest stable, you have this problem?

I try this say @changhuapeng but not work
[Magisk] Captain_Throwback:
I'm not using MagiskHide, so I have no idea. That doesn't really seem related to this modification.
[Magisk] Vision:
Yeah, I read it.

Understand, my device have this 2 problems.
[Magisk] Vision:
Thanks for info.

No related, only with dummy boot.framework.art, just ask because you have Kitsune Mask.

Now i must found why happens this.

Do you have this?
[Magisk] eac5:
After a good deal more tests under various scenarios and inspecting logs my current best guess is still that RKP is the issue on my device, or at least part of it. With no way to fake the DEVICE_INITIAL_SDK_INT from inside FWP, the keymaster does not meet the condition to fall back to the "factory" key (keybox) and continues to use the remotely provisioned certs which of course show the original root of trust with unlocked bootloader.

I added some logging to the spoof function and also applied it to the PlayStore, and was able to see the modified props in PlayStore's integrity checker, so it seems reasonable that DG is also receiving the data correctly, but, due to gross mismatch of expected parameters, it only awards BASIC.

Modifying other key attestation data besides RoT such as attestationIdProduct and so on does not seem necessary, at this time anyway.

There's several places in my decompiled framework that are related to IRemoteProvisioning, editing those to cause some exception looks like the next thing to try.
[Magisk] casouzaj:
Now, this is getting interesting. I had to switch back to KerrnelSU (from APatch), because MS Intune Company Portal and all the apps under its umbrella began to point out that my phone was rooted. Now, with KerrnelSU, the 'media picker' frequent crashing is back. I mean, with KerrnelSU > media picker crashes, whereas with APatch, there is not such issue. Had to uninstall FWPG again.
[Magisk] sampei:
@yhs0331

I also facing same issue ( mine is more worst...not even detected kernelsu's integrated busybox ).

So what I did is install busybox module and bash module. Then resolved issue.

I attached bash module here.
[Magisk] yhs0331:
use ur bash mod and got another error
[Magisk] Vision:
IMPORTANT.

Magisk latest stable.

With this module and shamiko enable, just add to DenyList the com.google.android.gms/com.google.android.gms.unstable

And you have the desire results.

Anyone else can confirm that?

EDIT: Kitsune Mask latest canary.

With this module and https://github.com/Magisk-Modules-Alt-Repo/sensitive_props enable (and without zygisk).

add to MagiskHide the com.google.android.gms/com.google.android.gms.unstable

And you have the desire results.
[Motorola Edge 40 Pro  / Moto X40 (China)] kevin2025:
hi guys,

i noticed the motorola edge 50 ultra firmwares available on lollinet servers under the ctwo codename

https://mirrors.lolinet.com/firmware/lenomola/ctwo/official/

has anybody converted a x50 ultra to retail software and if the process is the same way as flashing the moto x40? I just can't find any section listed for the moto x50 ultra/ Motorola edge 50 ultra atm so hopefully this is an ok spot to ask
[General Topics] ktdt00:
Headwolf Hpad5 with MTK6789 (G99)

This is a really general rooting guide. It's got the steps and a couple pointers but assumes you will either already know, or be able to find the details. I used Windows but I'm sure you could modify for Linux. Not for novices. Not responsible for anything you do to your device.

1) Enable Developer Options and ADB USB

2) Enable OEM Unlock

3) Boot device to bootloader (adb reboot bootloader)

4) Unlock the bootloader (fastboot flashing unlock)

5) Reboot to system

6) Install magisk apk

7) Setup mtkclient and drivers - https://github.com/bkerler/mtkclient

8) Get the DA (DA_BR.bin) from another MTK6789 firmware (I used Teclast T50 Pro (A6D4) EEA)

9) Put the DA in the mtkclient folder and rename it to "MTK_DA_V6.bin" (not sure you have to do this but I did)

10) Retrieve the boot and vbmeta images from the device using:

10.a) mtk r boot_b,vbmeta_b boot.img,vbmeta.img --loader=MTK_DA_V6.bin (use the correct slot _a or _b)

11) Reboot to system

12) Now that you have the boot.img you can follow Magisk install/root instructions - https://topjohnwu.github.io/Magisk/install.html

12.a) Not sure you have to patch vbmeta but I did. If you do it will make you factory reset the device following a bootloader fail.

13) If you reset, go back through Android setup and reinstall magisk apk.

14) Open magisk and let it complete the installation and reboot.

Credits:

bkerler - mtkclient

topjohnwu - magisk

kousuke555555 - helped me find the right DA

anyone else who has had a hand in the XDA development community - helped me learn
[General Topics] that0ne:
Hi, I'm looking for F5 root options for a nab. Any advices?
[Samsung Gear S] salimth:
Hi guys, my Samsung watch Gear S3 Classic SM-R770 Tizen 2.3.2.3 , problem is daylight ,my time is one hour fast and I can not change it , there is't any set for that. Ho can I fix it ??? If move Tizen to 3

Is it possible solving??!!
[P3300, MDA Compact III ROM Development] rachid202446:
hello

i use the achilles_ROM_ver_3_YouTube the acivesync is enable but i can't update my weather programm

can any body help me

tanks
[P3300, MDA Compact III ROM Development] kerni:
disconnect the cable to close active sync mode and update it over gprs or 3g connection
[P3300, MDA Compact III ROM Development] jcschrijver:
Tell us a bit more

Hi, I have the same ROM and for me it is not a problem to update the Weather program. Maybe it is comes in handy to explain your method to of connecting (to PC, WiFi)

For me; I update it all through WiFi with success (Weather, email, QuickGPS). I haven't tried it yet with active sync.

Regards
[P3300, MDA Compact III ROM Development] dutchcow:
I'm sure he could've guessed that answer. But I doubt thats what he wants, like me he might have a very high fee to connect over GRPS and 3G is not an option as its not a even feature of the P3300.

I also have problems syncing and connecting to the internet via activesync sometimes, the best course of action for me was to disconnect the phone form the PC, kill activesync on the phone and reconnect to the PC, if that doesnt work try a soft reset on the phone and try again.
[P3300, MDA Compact III ROM Development] jcschrijver:
7 minute solution when active sync not works

Mostly the problem occurs when connecting to 2 different PC's.

What works for me ( I usually sync with 2 pc's; Work & @Home) when connecting with active sync not succesfull;

- I back up all my information with PIMbackup [1-2 minutes]

- Remove a partnership (or both) on my Artemis (Backup, because removing a partnership deletes appointments, contacts, call logs, tasks, etc.) [< 1 minute]

- Reconnect through active sync and setup a new partnership, in general is the problem-not-be-able-to-sync solved [3-4 minutes]

I hope this will work for you

Regards
[Samsung Galaxy Tab S9 series] boomboxistheway:
Hi guys I bought a Galaxy Tab S9 FE 2nd hand just as new, after a couple of weeks I got the message popup from Samsung saying "this device is linked to incomplete trade in and will be locked in 72h"

I basically got screwed, more than a week later it still hasn't been locked yet.

would I get solve this problem and have it fully functional without it getting locked if I root it and reflash the firmware?

I'm aware it'll lose Knox fuse, but quite frankly I'd take it over ending up with a paperweight.

only issue is on developer options there is no OEM unlock, can it still be done? it's not that is greyed out, its completely missing from the dev menu.

lastly, if there's any way to flash it, would I still get the same issue on rooted device? I would imagine that this is detected by Serial Number (it's WIFI only model)

any help would be much appreciated
[Samsung Galaxy Tab S9 series] Zxalilh:
More than 96 hours have passed than when it should have been locked, and you still don't have any problems? Not trying to offend you, I'm just confused by what you're trying to say.
[Samsung Galaxy Tab S9 series] boomboxistheway:
Correct, it seems like many other people who have same issue, are saying the device did not get locked after the 72h. the notification that it will be locked is still popping up, interrupting any app in use.

I ofc did not update Android at all just to not risk it getting actually locked.
[Samsung Galaxy Tab S9 series] AHE_XDA:
A few points:

Your tablet is enrolled in Knox; a mobile device management solution.

It can be removed, with or without root, but I need you to explore those options yourself as XDA won't condone my solutions.

The easiest way is to go back to the seller and request assistance. If they are not able or unwilling, see second paragraph.
[Samsung Galaxy Tab S9 series] Smash100:
Hi, do you have an update on this issue

Hi, do you have a an update on this issue? Does it still work? Does it still show the notification?
[Samsung Galaxy Tab S9 series] boomboxistheway:
It did not get locked down, even after factory reset (including hard reset) I can access the device, but the notification will always show up, I can dismiss it when is full screen but it can't be dismissed from notifications stack. Also the full screen notification will periodically pop up and interrupt whatever you were doing.
[Samsung Galaxy Tab S9 series] Smash100:
Okay thats good to know, have you risked doing a Software update?
[Samsung Galaxy Tab S9 series] boomboxistheway:
yes I updated to latest available, still not locked.
[Samsung Galaxy Tab S9 series] Smash100:
How often would you say the notification comes up? Because I've changed a few settings and it hasn't appeared for a while now
[Samsung Galaxy Tab S9 series] boomboxistheway:
not sure mate I am not really using it, but it would come every now and then enough to be annoying to use the device as it would interrupt whatever you're doing.

what setting did you change? the notification is the Knox btw so nothing can be done to it via settings menu
[Samsung Galaxy Tab S9 series] vgchat:
Have you tried flashing a different rom on it?
[Samsung Galaxy Tab S9 series] boomboxistheway:
No, the bootloader is locked and the KnoxGuard is Active
[Android Q&A, Help & Troubleshooting] anmac1789@gmail.com:
hello, I want to know how does samsung camera app work how does it assign timestamps and take pictures ? is there a way to "see" inside the samsung camera api ?
[OPPO Reno8 (Reno 8)] rajilbul74:
Please help
[Samsung Galaxy Tab S6 Lite Questions & Answers] l_ornoir:
Hi today i was trying to edit some files in the system and well i can't get the root partition to be Read write and i saw that u need to also have SELinux permissive in order to do so...

If anyone has any idea im all ears

(Btw im using the P613 sooo there isnt any useful recoveries beside LineageOS recovery being super limited)
[Samsung Galaxy Tab S6 Lite Questions & Answers] Renate:
No, I don't know Samsung or the S6 or whether it's all in the super partition.

My $0.02: I don't think you should make anything R/W that is currently RO.

It's better to patch it offline somehow.

Making permissive is easy, but it's a bad idea.

(I can patch a kernel for permissive without even disassembling it.)

Permissive will let all your apps from sketchy sources do things you don't want.

It's better to recompile sepolicy for specific uses and patch it offline somehow.

Or consider Magisk if that will fit your use case.

Not very helpful, eh?
[Samsung Galaxy Tab S6 Lite Questions & Answers] fede2782:
Use Magisk or KernelSU to edit the system partitions.

Never use permessive if you do not want to have a lot of security issues
[Samsung Galaxy Tab S6 Lite Questions & Answers] l_ornoir:
Well even with magisk it doesnt work
[Samsung Galaxy Tab S6 Lite Questions & Answers] Renate:
Well, you're going to have to get more specific with what you want to do, what you tried and how it failed.
[Samsung Galaxy Tab S6 Lite Questions & Answers] l_ornoir:
Well basically i was following a tutorial to get some exclusive things on my device and i stumbled on a way to get Smart Manager cn

So what i did is i downloaded the app folder (and not the apk) and i tried placing it in system/priv-app

Doing so would fail bc the filesystem was Read only even tho it was apparently on Read write
[Samsung Galaxy Tab S6 Lite Questions & Answers] fede2782:
Do this via a magisk or kernelsu module. Kernelsu is even easier. Just create a system directory where you put in full path the file you want to replace and configure a module.prop file using the official guide. Remember that if there are any .prof file you must delete them via the customize.sh file entries and the zip. All is well documented
[Google Pixel 8 Pro] Jaymie1989:
I'm trying to allow an app to have phone and SMS permission but the options to allow are greyed out. When I did click on them it tells me the app access is denied.

I can't find anything on Google to help me allow these permissions.
[Google Pixel 8 Pro] nutzfreelance:
what app?

you might have to make the app the default for phone and sms, but i dont think so.

google play protect might have decided its an unsafe app.

google likes to make your choices for you.