yashsingh1/xdaforums huggingface dataset:
[Magisk] osm0sis:
I use Magisk and don't use LSPosed, so maybe you should try not using KSU. Take a look at what? Not my project. 😄
[Magisk] Rana260492:
btw I am using apatch now not ksu

Sent from Pixel 7 Pro using ReLabs
[Magisk] Rana260492:
Take a look means how where to add ro.zygote property in system/build prop or vendor/build prop 😅😅😅😅

Let's hope you make a FPGO FORK like PIFFORK where all issues are gone. 😀😀😀😀😀

Sent from Pixel 7 Pro using ReLabs
[Magisk] Rana260492:
Also how to add in erofs file system

Sent from Pixel 7 Pro using ReLabs
[Magisk] osm0sis:
APatch's overlay modules are pretty much the same as KSU... The filesystem type doesn't matter since you're not touching the real system... You can set a prop anytime you want with setprop or resetprop...
[Magisk] Vision:
Users have problems, this in not fault of this module, why keep say this cause the problem? Is not true.

And the important file is the boot-framework.art, with only this dummy without the .oat and .vdex my device open.
[Magisk] Vision:
Yeah.

I think something with spoof sensitive props are missing.

You know better from all of us, for the performance issues and with MagiskHide/DenyList, one possible solution is this with PathClassLoader or something similar, and with that we no need anymore to delete or dummy the boot-framework files.
[Magisk] Rana260492:
Hi vision the module is great but could you explain boot-framework.art dummy only without .oat and .vdex files the device runs without lag ?

How to make this dummy file or the module makes it itself and extra .oat and .vdex files that i should delete ?

Please explain. Thanks in advance
[Magisk] Vision:
With the new update, we can choose if we want to create dummy boot-framework files, just no or delete the other 2 .oat and .vdex from the module folder.

And just create a empty file boot-framework.art and copy it to the module folder inside in the arm/arm64 folder.
[Magisk] Rana260492:
So select no in the last step where it asks to clean files than manually delete above files and creat one file named boot-framework.art
[Magisk] Vision:
Yeah, but you can choose and yes, and manually go to module folder and delete the other 2 .oat and .vdex and after reboot.
[Magisk] trax7:
I have a KSU setup and also had issues yesterday with Media Picker force closing after FP GO was installed. Removed FP GO, issues are gone.

Edit: havent tried removing the umount tick, that could indeed help.
[Magisk] casouzaj:
I had this nasty media picker crashing issue when Zygisk (in my case, Next) enabled. After I deactivated it, the issue was gone. I'm using PlayIntegrityFork V9 in scripts-only-mode (which doesn't require Zygisk).
[Magisk] changhuapeng:
Thanks for your observations and feedback!

I don't have a Pixel phone to test but many users with Pixel phones on stock ROM have to use PIFork in one way or another, be it in Scripts-only mode or Normal mode, to pass device integrity. I'm guessing it's a system properties thing since PIF/PIFork has some resetprop implementation for certain sensitive properties.

Also unlike the internal storage issue that you've encountered, some other users with similar issues managed to get it working properly by switching root solution, for example like from Magisk to KernelSU. The underlying factor to this problem is likely the overlaying of system framework so it's unsolvable, at least at this point in time.

The things mentioned in the conversation with the LSPosed developers are what I've already tested, known and explained in the FAQ. It's because framework.jar is used in an overlay that's causing all the system optimisation to not work. Like what they've said and what I've tried, dex2oat do not work too. Nonetheless, I still have to thank you for the conversation screenshots because they confirm my understanding and provide information for everyone in this thread.

The only thing in that conversation that I've to disagree is that wiping dalvik cache may still help to a certain extent. I've personally witnessed app crashes to stop right after dalvik cache was wiped but there's not the perfect solution since it don't work for everybody.

As far as I know, it's just the limit from overlaying system framework files and there is really no way to fix the impacted performance issue in this module. But if you're adventurous enough, you can "RW'ing patched jar in" like what one of the LSPosed developers did, because that has always been the widely used method when modifying system framework. I'm just not gonna provide any support for that.

I'll bring back support with x86 binaries in the next version.

Nah, this module does have some inherent issues and is not compatible for everyone. I'll say part of the problems are with what FrameworkPatch itself is but some of the problems are brought about by overlaying framework and can be avoided if the patched framework.jar is RW into system instead.

Thanks! I remember an similar issue from you and was about to quote your comment for him.
[Magisk] Vision:
Thank you.

I say not module cause the problem, because and with manually way, I see the same problems as users mentioned.

I had make lot of test the last 2 months, in my device but and on emulators to see all the problems exist and all parameters.
[Magisk] osm0sis:
The props from PIFork or Shamiko do seem to get FP GO fully passing Play Integrity, so definitely something missing in FP GO there, but it's not anything prop related for SafetyNet, since FP GO + PIFork Scripts-only mode still fully fails SafetyNet.

Which means it's something in the PIFork Zygisk part from running it in Normal mode, and something that happens even without a json present. 🤔
[Magisk] Vision:
Oh understand.

Thanks for info.

You know better from all of us, for the performance issues and with MagiskHide/DenyList, one possible solution is this with PathClassLoader or something similar, and with that we no need anymore to delete or dummy the boot-framework files.
[Magisk] osm0sis:
Isn't that exactly what chiteroman tried in PIF 16.3? PI was updated to detect it and won't pass Strong that way anymore.
[Magisk] Vision:
Really? I had the PIF 16.3 and pass, if change after, I don't notice.

Because he had say me do it with PathClassLoader, but I don't know how.

Add only the lines in the framework and the final classes.dex to system/framework and load it via PathClassLoader.

Because with only add the lines to framework.jar the device open normal, only with the final classes.dex go to bootloop without dummy the boot-framework.art

EDIT: Maybe works with PathClassLoader or similar and have more success.
[Magisk] David B.:
I was still able to use it with Strong even after PI was supposedly updated to detect it.

I have since lost it, but that's because my keybox was banned.
[Magisk] osm0sis:
Using PIF 16.3?
[Magisk] David B.:
Yup!
[Magisk] osm0sis:
Guess chit's changelog may have been mistaken then! 🤯

Release v16.4 · chiteroman/PlayIntegrityFix

Misc improvements in code Remove keybox.xml parsing due DroidGuard detections (better use FrameworkPatch) Add BOARD and HARDWARE fields in json

github.com
[Magisk] David B.:
I saw that and assumed that what he meant by it was that DroidGuard was detecting it but perhaps not causing Strong to fail, although, that interpretation has never made any sense to me.
[Magisk] Vision:
Yeah me to, that's what i was saying before.

[MODULE] Framework Patcher GO

Framework Patcher GO Based on chiteroman's FrameworkPatch, this module modifies framework.jar directly on the phone, to build a valid system-level certificate chain. This module is compatible with Magisk, KernelSU, and APatch. For more details...

xdaforums.com
[Magisk] Vision:
Some news.
[Magisk] osm0sis:
Not really news since all my tests which achieved Strong were using latest Magisk Canary. 😛
[Magisk] Vision:
Of course including yours.

Thank you for the test, all other user test only APatch and Ksu.

I mean about this you say before.

EDIT: I assume the test in the Magisk is the same as Kitsune Mask.

I use Kitsune Mask, with this I do all the test.
[Magisk] boteomap2:
i'm using stock ROM and i don't have system RW, I notice that after flashing module successfully, boot-framework.* are still in framework folder, those aren't deleted. How can I delete it?
[Magisk] changhuapeng:
If you have selected "yes" to the optional choice on clearing boot-framework files during the module installation, then the module does that for you automatically.
[Magisk] boteomap2:
i selected yes, but after reboot i still see those file in system/framework folder
[Magisk] changhuapeng:
You're probably using Magisk-variant rooting solution. On Magisk system, the module replaces those files in /system/framework with a similarly named zero-byte file (dummy file that does nothing) from the /data/adb/modules/FrameworkPatcherGo/system/framework directory. The file size of those files in /system/framework should be zero byte if they are replaced properly.
[Magisk] Xennet:
@changhuapeng

@chiteroman

Like i mentioned in an other way a few weeks back...any plan to incorporate only fingerprint patching in framework patcher go and keeping patching keybox optional...so that we can avoid using zygisk to pass integrity...and also almost only a few here have a valid keybox...
[Magisk] Vision:
Just keep the default keybox and change the device info in the Android.java
[Magisk] BlackWater$:
Hi I have flashed the module and still my tee broken 💔 and this error code
[Magisk] Xennet:
The problem is whether i download and use the default classes.dex or i use my private classes.dex like u said with my fingerprint and default keybox i just pass only BASIC integrity with the framework patcher module...i use @osm0sis script only mode too..but still only basic integrity....any ideas
[Magisk] Vision:
What device? Root method? And other modules?

With your fingerprint, you mean a private FP or your device FP?
[Magisk] Xennet:
Xiaomi...stock rom..

Tested with both kernelsu and apatch...no other modules except osmosis script only mode...

Both with my private fingerprint and default classes.dex....not with my device fingerprint

I am curious that even with the default classes.dex i have only basic integrity
[Magisk] Vision:
Have you add in MagiskHide/DenyList the gms.unstable?
[Magisk] Xennet:
I have no zygisk installed in kernelsu /apatch...

I am not using magisk...

Out of ideas how to add/remove gms.unstable to denylist...

??
[Magisk] Vision:
No need zygisk.

I don't know how to add it to kernelsu/apatch.
[Magisk] Xennet:
Does shamiko do the job in kernelsu
[Magisk] Vision:
Yeah.

You can try shamiko with zygisk.

Read and this: https://xdaforums.com/t/module-framework-patcher-go.4674536/post-89591211
[Magisk] badabing2003:
Try magisk instead of ksu or apatch
[Magisk] Xennet:
Which magisk...latest official magisk 27... Or alpha?
[Magisk] badabing2003:
Canary 27003 is good
[Magisk] fbirraque:
Does it possible with latest Kitsune (27001) when SUList enforced (no denylist)?
[Magisk] pndwal:
Do we still need dummy zero files since Magic Mount was property refactored for overlayfs in 26+ with Refactor magic mount to support overlayfs and Always mount tmpfs for dirs, and especially since more recently fixes like Make tmpfs mount of magic mount atomic and Remove unnecessary mirror for magic mount?...

Proper file removal/detection magic was proposed in this PR:

Support systemlessly deleting files or folders

Comment:

But that was closed in July last year and Metagisk test branch deleted, so maybe was never done... 🤔 PW
[Magisk] osm0sis:
Except perhaps the most important feature: https://github.com/topjohnwu/Magisk/pull/6736
[Magisk] pndwal:
Yup... But of course that's exactly the same original PR mentioned!... So did we ever get it with any of the later changes/refactoring (that weren't abandoned/were made)? 🤔 PW
[Magisk] Vision:
@pndwal @osm0sis

Kitsune Mask latest Canary say this, is similar?

Kitsune Mask latest Stable.

EDIT: This is useful?

GitHub - HuskyDG/magic_overlayfs: Make system partition become read-write (it is also possible without Magisk)

Make system partition become read-write (it is also possible without Magisk) - HuskyDG/magic_overlayfs

github.com
[Magisk] osm0sis:
Nada. Not in mainline Magisk.
[Magisk] K2bigboss15:
My device keeps rebooting when i use your module frameworkpatcherGo i don't understand my device is already system read-write
[Magisk] Vision:
So, if you do this only because you want automatically, grab the modify framework.jar after create by this module, and push the framework.jar directly to system/framework and delete the FrameworkPatchGo module and after reboot.
[Magisk] b0l5:
anyone try on OnePlus devices?
[Magisk] K2bigboss15:
I already did this when the first version is released and it's work for me but when i saw some new version release i try to restore my old framework.jar but it keeps rebooting even it is the old stock one, then i have no solution i clean flash rom and make it full system rw again and try the latest one is not working because it keeps rebooting that's why i didn't move it to system/framework because it is not working in magisk module.
[Magisk] Vision:
Understand.

If you have system rw, no need a Magisk module.
[Magisk] K2bigboss15:
But i don't know how to compile framework.jar i only using magisk because it is compiling it and if it's work i copy the compile framework.jar to system/framework
[Magisk] Vision:
Yeah this exactly I write you before.

After FrameworkPatchGo compile your framework.jar, copy&paste from module folder to system/framework, and before reboot delete the FrameworkPatchGo.
[Magisk] Usama-CW:
Let me add salt to wounds ':3
[Magisk] Vision:
Via module or ?
[Magisk] Usama-CW:
He didn't mentioned, I think it's detectable as module, not sure about system r/w method ¯\_(ツ)_/¯
[Magisk] Vision:
For that I ask.

Something similar has been mentioned (I think) by @chiteroman
[Magisk] chiteroman:
Overlay -> can be easily detected

System r/w -> impossible to detect, it is no different from any system file.

BUT,

Overlay -> very easy method, just flash a module.

System r/w -> you need to extract system from super, modify it, if it's an erofs image you need to create a new one, repack super, flash in bootloader, vbmeta MUST be disabled, a lot of devices (like mine) requires full data wipe when disabling vbmeta...

Which is better?

In my opinion, overlay, may be easier to detect but it saves you headaches xd.
[Magisk] Vision:
Yeah exactly.

Thanks for info. I appreciate as always.

For the System r/w, must be sure 100% how it will work and be an expert (like you).

For that, lot of users not do it 😂🤣
[Magisk] K2bigboss15:
I did but the latest version framework.jar compile is not working for me i put it on system/framework from module folder frameworkGopatcher sad not working i stuck on boot animation I don't understand my system is full read-write
[Magisk] chiteroman:
If your system is rw why are you using FrameworkPatcherGo ?
[Magisk] Vision:
If you're on A11 and below, also need to delete (take a backup first) the boot-framework.art from system/framework/arm and arm64
[Magisk] K2bigboss15:
For compiling framework.jar because i don't know how manually compile it , that's why i use frameworkpatcherGo because it compiling framework.jar after that i copy it on system/framework
[Magisk] K2bigboss15:
Im using miui 14 android 12 cn official
[Magisk] Vision:
Maybe need all the above say @chiteroman, about system r/w
[Magisk] K2bigboss15:
Maybe it depends on rom because i still remember when the first released of frameworkpatcherGo it is work for me perfectly on miui 14 a12 xiaomi eu rom even if i copy the compile framework.jar on module folder on system/framework it is more working for me
[Magisk] Vision:
So, download the old version of FrameworkPatcherGo again.
[Magisk] K2bigboss15:
I did but keeps rebooting same on the latest that's why i said it depends on rom
[Magisk] Vision:
Yeah.

Understand.
[Magisk] chiteroman:
If anyone wants my module template that I'm using:

(I'm using KernelSU)
[Magisk] osm0sis:
Ah, I see you added the latest Shamiko script to help pass STRONG Play Integrity. 👍

But any idea why SafetyNet is still fully failing? Seems like something missing in FP.
[Magisk] chiteroman:
What? For me both pass
[Magisk] osm0sis:
Do you have any kind of PIF module on your device still? In my testing SafetyNet only passed with a PIF module present, but only without a json, interestingly. 🤔

[MODULE] Framework Patcher GO

Framework Patcher GO Based on chiteroman's FrameworkPatch, this module modifies framework.jar directly on the phone, to build a valid system-level certificate chain. This module is compatible with Magisk, KernelSU, and APatch. For more details...

xdaforums.com
[Magisk] chiteroman:
I tried with FrameworkPatch only and both pass.

What's your setup? That is weird, why are you failing basic integrity of SN ? 🤔

Never happened to me 🥲
[Magisk] Vision:
I don't remember good if SN failed when I had Strong.

Unfortunately, can't test now, because no more Strong 😢

Maybe it's related to Magisk ?
[Magisk] chiteroman:
I told a lot of times that DroidGuard can detect a patched boot image (only Magisk) but for some reason they don't use that check in old fingerprints neither in new fp from beta roms.

@osm0sis should try KernelSU LKM or APatch.

Also, he's using original device fp? Or custom fingerprint?
[Magisk] Vision:
Yeah.

You have told about this here and TG.

I'm thinking seriously, to change from Kitsune Mask to KernelSU, but unfortunately my kernel is old and not supported and I am not able right now to complile it and all this.

EDIT: For now the KernelSU/APatch method sound promising, but like Magisk sooner or later, Google can broke and the KernelSU/APatch.
[Magisk] Rana260492:
With the latest update 1.2.2 i am facing a new issue that device does not enter deep sleep.The issue exists on both my Pixel 7 and Pixel 7 pro
[Magisk] osm0sis:
Latest FP commit on Pixel 8 Pro with Pixel beta print in FP, running in Magisk with FP GO 1.1.1. That gives full pass PI but full fail SN. Then I install a PIF module but without a json, reboot and it all passes. Perhaps it's Magisk, but then why does whatever a PIF module does *without any json* get it working? 🤷‍♂️
[Magisk] pndwal:
Do you have HARDWARE_BACKED evaluationType both before and after adding PIF?

... It seemed earlier passing verdicts were occurring with device producing basic attestations (ie. basic measurements were being accepted as valid HARDWARE_BACKED evaluations), but maybe fallback to basic attestations is only actually needed for S/N pass (with Magisk). 🤔 PW
[Magisk] osm0sis:
You have access to my original screenshots and results any time you want in our PM, remember... 😉

...but I guess for everyone else's benefit:

Followed by my later full pass everywhere after I installed PIFork in Normal mode but with no json file at all:

🤔🤷‍♂️
[Magisk] pndwal:
Yeah, mind's not on it as much as usual on account of being in QLD and busy with family/kids, sorry...

Did recall it was full mode PIF... Anyway, confirms what I thought...

HARDWARE_BACKED evaluationType with or without PIF, but a major difference between having PIF active and not is that with, device would be sending only basic ('s/w') attestations whereas without, P8P should be sending HKAs, at least as far as DroidGuard is aware...

As I've mentioned before, it baffles me that the servers seem to accept the basic attestation measurements for passing supposedly HARDWARE_BACKED evaluations at all... I would only have expected any 'strongly attested' verdicts (incl. ctsProfileMatch w/ HARDWARE_BACKED evaluationType for this purpose) to pass without PIF... But if I recall correctly, @shoey63 had STRONG passing even with USNF installed on his ROG Phone 3 way back too...

Further, since we can evidently get STRONG with basic attestation, I'm now not at all sure we couldn't get it on a device like OnePlus 8T (w/ broken keymaster), especially if spoofing say late Pixel beta print, although I believe Framework Patcher isn't supposed to work for STRONG on such devices... Would be interesting to know what results can be achieved with just FP or FPGo on OP8T though.

Maybe these observations are useful, and someone may be able to un-baffle me too... 🙃 PW
[Magisk] shoey63:
Yup, in fact required. Had to spoof an older android version to get STRONG. No longer the case anymore though. Impossible to get strong anymore on ROG 3, even with a valid leaked keybox😑
[Magisk] pndwal:
But I thought you said you still could only with an old ROM no? 🙃 PW
[Magisk] shoey63:
That lasted about a month before it also got shut down 👎

Edit: I should be able to replicate it if I find another stock ROG 3 rom whose fingerprint passes DEVICE but there is an absolute dearth of stock R3 roms to download and test😔
[Magisk] osm0sis:
I think OnePlus remains entirely out of the question since they don't have a normally working TEE so any certificate chain provided can't ever work. But all the keybox/certificate stuff is well outside my wheelhouse so I'll defer to @chiteroman or @changhuapeng.
[Magisk] pndwal:
I'm not saying I'm at all sure about this either, but the point is that you've just demonstrated that we can have fully passing verdicts with DEAD hardware key attestation (broken intentionally by PIF) and fallback to basic attestation which is then successfully evaluated as HARDWARE_BACKED... So clearly working TEE don't enter into it!; It's already stone dead! ... And YET the spoofed certificate chain apparently gives Polly a new lease on life!

Re. STRONG, we all thought this parrot was no more... He had ceased to be! 'E'd expired and gone to meet 'is maker... A stiff, bereft of life, 'e rests in peace! If we hadn't nailed 'im to the perch 'e'd be pushing up the daisies!... Mate, this bird wouldn't "voom" if you put four million volts through it!

... And YET 'e was clearly only restin'!... Or Maybe just stunned... Cos 'e nuzzled up to those bars, bent 'em apart with i's beak, and VOOM! Feeweeweewee!... Remarkable bird, the Norwegian Blue, idn'it, ay?

Now, what about that slug?

😜 PW
[Magisk] osm0sis:
I haven't demonstrated that... In fact I'm trying to pick chit's brain about it because it doesn't really make sense; the Zygisk component providing whatever "secret sauce" should generally bail out when there's no json: https://github.com/osm0sis/PlayIntegrityFork/blob/main/app/src/main/cpp/main.cpp#L142

So I'm not sure what it could still be doing to have the effect seen in my testing.
[Magisk] jakell888888888:
Sorry to bother you all again. I've been following this topic. I see there is a way to pass strong because the language is not very familiar and the translation is confusing. My question is whether it is possible to force transfer without keybox? I only need to pass this verification because my software does not require other verifications besides passing strong.
[Magisk] osm0sis:
Not sure what you mean by transfer. If you mean Strong, then the keybox is what achieves that.
[Magisk] jakell888888888:
What I mean is through strong, but according to chiteroman's speech, it can be through strong. Of course, I don't understand some of the technologies he mentioned very well. I am trying hard to find a keybox that can be used. I have found 4 engineers to help me. If I find something that works I'll share it with someone who can contribute.
[Magisk] pndwal:
Oh... So did you check if same or different results if using JSON with quote marks but otherwise empty?... Sorry if you already said... 👍 PW
[Magisk] BlackWater$:
I have realme gt Master edition with unlocked bootloader , me flashed framework patch module and play fork and can't pass strong integrity 😔 any one know how to fix TEE or what to do in my situation

Is My TEE broken what's this error 1003 mean any one has idea 💡
[Magisk] pndwal:
Yes, we've seen that a complete ROM can be signed with the same valid OEM keys and bootloader locked again even with root...

This is

far

more fraught (risky)

than simply understanding how to spoof a valid certificate chain systemlessly by using the valid keybox to add certificates to classes.dex in Android Studio and this module to compile and spoof framework.jar using Magisk however. 😬 🤠 PW
[Magisk] BlackWater$:
so can I lock my bootloader and TEE work again, or what you mean and what is my error code 1003 mean