yashsingh1/xdaforums huggingface dataset:
[Magisk] changhuapeng:
Everything looks to be patched correctly from your framework.jar, so you're probably out of luck and can't use Framework Patch.
[Magisk] RubberGooseGuy:
Will this reprogram my tee and make me unable to pass PI?
[Magisk] changhuapeng:
No. It's a magisk module so it's not writing any changes to your system. You can disable or uninstall the module anytime and that will remove any effect this module has on your device.
[Magisk] kodein:
I will try this module but I don't see what is the purpose of the module.?

I can only pass Basic integrity with it, neither device nor strong will pass....
[Magisk] sawdoctor:
As i understand it the module doesn't include any print/key you have to supply your own or use chiteromans. The point of the module is for people who can't use zygisk or zygisk is detected by an app
[Magisk] toolhas4degrees:
Had shamiko. Shamiko didn't work. Will try the script later
[Magisk] Vision:
Understand.

With Kitsune Mask latest, for me working with PIF Fork script-only-mode with gms.unstable to MagiskHide.
[Magisk] toolhas4degrees:
I use alpha kitsume was garbage when I used it before.
[Magisk] toolhas4degrees:
I downloaded fork v9 how do I make it scripts only mode?

Nevermind figured it out
[Magisk] Captain_Throwback:
Come on, at least read the README for the module you downloaded. This is why devs get so frustrated.
[Magisk] toolhas4degrees:
sorry there was a lot for not using it before. won't post for an hour next time

also if "devs" posted all sources ex the arm 8 in the first post.. 1 less qustion

if the "devs posted how to enable scripts only in first post... 1 less question.

but give me crap bc i dont know everything.
[Magisk] pndwal:
Interesting that none of the USNF/PIF modules I've opened contain a readme.md like most(?) other modules. 🤔 PW
[Magisk] Captain_Throwback:
I don't know that most modules include a README. They should be downloaded from Github which is where the README is.
[Magisk] pndwal:
Always used to... I assumed it was part of spec... (Good if people lift from sources like TG... Eg Shamiko had nothing on public GitHub for probably a year, but readme was always embedded.)

Now, Shamiko's can be more up to date than GitHub and sometimes the opposite... And Didge's .MD file in MHPC is really l o n g !

OC, formatting in GitHub is better, but guess file readers also vary. 😉 PW
[Magisk] yjcbn:
@chiteroman once said that STRONG could be met without reprogramming TEE (with a valid keybox), but now it seems that FPG can only work with a working TEE.

The mechanism of PI has been updated?
[Magisk] Vision:
The closer answer is this

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com
[Magisk] Stillhard:
New fork in town...

GitHub - aviraxp/Zygisk-KeystoreInjection: Generate a valid certificate chain from scratch by injecting custom Keystore provider

Generate a valid certificate chain from scratch by injecting custom Keystore provider - aviraxp/Zygisk-KeystoreInjection

github.com

A14+
[Magisk] Vision:
Have you try it ?
[Magisk] jakell888888888:
The same thing requires a key box
[Magisk] Vision:
Good to know.

I thought it is something new and can cut the access to the keystore or something like that and can pass again at least 2/3 without a FP or keybox.
[Magisk] Stillhard:
A14+ :D, mine A11

Correct
[Magisk] casouzaj:
I tested aviraxp's Keystone Provider module (latest CI). I extracted keybox.xml out of chiteroman's PIF v16.3 and copied it to /data/adb. Key Attestation app, which have always shown error messages for me (Sony Xperia 1 II running LineageOS 21' rooted by KerrnelSU), started showing what's in shown in the starched screenshot. No further effects noticed, so far.
[Magisk] Rana260492:
does this work on a15 beta 3 pixel devices has anyone tried ?

Sent from Pixel 7 Pro using ReLabs
[Magisk] Vision:
That's is good.

Because with @chiteroman PIF v16.3 can't show it on key attestation, so this module can hook it.
[Magisk] David B.:
Have you tested the module with an unrevoked keybox?
[Magisk] casouzaj:
As I said, it's from PIF v16.3 zip file. Haven't particularly fetched for one.
[Magisk] David B.:
Oh, yes. Sorry. I can't believe I missed that.

Anyway, I just tested the module with a valid keybox, but could not get it to work properly, so I reverted back to the PlayIntegrityFix that had keybox support. It looks to me like this module is not yet matured yet, so I am not surprised to see that. Here's hoping that the developer sees it through to the end!
[Magisk] osm0sis:
@changhuapeng The FP GO zip only has arm binaries in it and the bin (.7z?) file inside. That's why it won't work on arm64-only devices like Pixel 8 Pro.

Edit: Figured out it's bin.zip.xz - super weird!
[Magisk] Vision:
So if you want try must use a modify version like this

[MODULE] Framework Patcher GO

Framework Patcher GO Based on chiteroman's FrameworkPatch, this module modifies framework.jar directly on the phone, to build a valid system-level certificate chain. This module is compatible with Magisk, KernelSU, and APatch. For more details...

xdaforums.com
[Magisk] changhuapeng:
Thanks for highlighting the issue! That's part of my to-do list but I'm kinda busy recently to do it.

I've also brought this up to the developer of the installer that is the dependency of this module and was silently hoping he'll do it but it seems he's busy too. Guess I'll have to find some time to clear my to-do list. 😅
[Magisk] osm0sis:
Here's an updated arm64 zip template for 1.1.1 for people to use in the meantime. Mostly binaries I already made anyway. 😁

By the way, with a valid keybox and a Pixel beta print it all passes (if you also have my PIFork module in Normal mode but without a json file, for some reason), but while RCS text messages work, weirdly RCS pictures give "Not Sent", and trying to take a picture with the tiny Messages viewfinder instantly crashes. Is this a known issue?
[Magisk] David B.:
I don't suppose that this resolves the performance issues at all, does it?
[Magisk] osm0sis:
No. Still impacted. Presumably (at least partially) because all the boot-framework files are hidden/zeroed by the module. I'm curious if they could just be regenerated using the updated framework.jar during install to fix/improve that, however.
[Magisk] Vision:
Maybe related to this.

Yeah, to fix the performance issues and the problem with when have a app to MagiskHide/DenyList, the app close it when try to open, when dummy the boot-framework.art.

if we can regenerate the boot-framework for the modify framework.jar that would the best, I have try it some modify but not working unfortunately.

A possible solution is this with PathClassLoader or similar.
[Magisk] David B.:
Ah so that's what those boot-framework files are for!
[Magisk] Vision:
Yeah, and besides the performance issues, second problem is when dummy the boot-framework.art, and add to MagiskHide/DenyList a app, the app close itself, when try to open.
[Magisk] David B.:
I'm not sure if I understand what you mean?
[Magisk] Rana260492:
I am also facing unmounting modules when using magisk/ksu/apatch on my pixel 7 pro a14 qpr3. I hope soon developer will figure out a solution to this problem.

Sent from Pixel 7 Pro using ReLabs
[Magisk] osm0sis:
That got me thinking... I disabled Zygisk Assistant, enabled Enforce DenyList and now RCS works fully! 🤘🤠

So that's Magisk Canary 27003, FP GO 1.1.1 arm64 w/ valid keybox and Pixel beta print classes.dex, PIFork v9 in Normal mode but *no* json file, Enforce DenyList enabled with a few apps on it (but not gms of course). Full pass PI and SN.

I'll keep experimenting to see what other combinations work, e.g. hopefully Shamiko 1.1 might not crash anymore with this new setup...

Edit: Tried every other combo and the above is still the best option I could find, since Shamiko 1.1 still crashes everything on the DenyList with PIFork in Normal mode, and we need PIFork in Normal mode with *no* json to fully pass SN in addition to PI. 🤔😕🤷‍♂️

Also interestingly it doesn't seem to matter whether gms is on the Enforced DenyList or not with this setup, (though PIFork will remove it after a reboot anyway, since it's in Normal mode). 🤯
[Magisk] Vision:
I mean this.

Very interesting info.

@osm0sis you have the problem with MagiskHide/DenyList when dummy boot-framework.art ?

This page have useful info

[MODULE] Framework Patcher GO

Framework Patcher GO Based on chiteroman's FrameworkPatch, this module modifies framework.jar directly on the phone, to build a valid system-level certificate chain. This module is compatible with Magisk, KernelSU, and APatch. For more details...

xdaforums.com
[Magisk] Rana260492:
Hi interesting info hope it works out soon

Sent from Pixel 7 Pro using ReLabs
[Magisk] Rana260492:
Hope this hiding solution is worked out soon

Sent from Pixel 7 Pro using ReLabs
[Magisk] osm0sis:
No, things on the DenyList (even with Enforce enabled) seem to be fine as long as Shamiko isn't installed. This happens whether I have the FP GO module installed or not.
[Magisk] Vision:
I had Magisk Latest canary for do test, but I don't remember if try it without shamiko 😂🤣

So something in code in MagiskHide and Shamiko to hide root from apps is broken with the boot-framework.art
[Magisk] osm0sis:
Not for me. It's only Shamiko+PIFork (Normal mode) that crashes here.
[Magisk] Vision:
Have you try this ?

With original Magisk, and frameworkpatch via module and shamiko enable, and add to DenyList the com.google.android.gms/com.google.android.gms.unstable
[Magisk] changhuapeng:
Yeah, that's just how the bin file is originally packed in that installer. 🤷‍♂️

Thanks for updating the zip with your arm64 binaries! In the meantime, will update the FAQ with your updated zip as an alternative!

RCS is not widely used in this part of the world and I don't use it too so that issue's not known to me. Moreover, I haven't seen people testing RCS with FPG yet, not to say having issues on RCS with FPG so you're probably the first to encounter and report this issue.

Previously, some users are saying PIFork Scripts-only mode works for them. Are you also able to get all passes if you used PIFork in Scripts-only mode? Or it is only for PIFork Normal mode? 🤯

Removing all boot-framework files are mentioned by @chiteroman in the tutorial and I think some users like @Vision have verified that their device won't boot until boot-framework files are removed so I'm pretty wary about touching those files.

I may be wrong but my understanding is that it's ART vs JIT problem from systemlessly mounting framework.jar that is causing the impacted performance. I have tried playing around with dex2oat on the updated framework.jar but that doesn't seem to work. chiteroman, himself, used FrameworkPatch by flashing framework.jar into system.img so he doesn't have any performance issues but I don't want to go to that extreme.
[Magisk] Vision:
Yeah.

I had try some modify with ART, but unfortunately not work.

If we can regenerate the boot-framework for the modify framework.jar that would the best. ( one user have the same question here: https://xdaforums.com/t/android-13-decompile-and-recompile-framework-jar.4602085/post-89569341)

One possible solution is this with PathClassLoader or something similar.
[Magisk] badabing2003:
I'm running without boot* files and i haven't had any issues.

Perhaps those only matter for older devices /OSes

I'm on A14
[Magisk] Vision:
Yeah, that is true, before A12+ must delete this files or dummy, but after A12+ no need it because is already dummy by the system have zero byte the boot-framework.art
[Magisk] changhuapeng:
Have you encountered any performance degradation issue with and without removing the boot-framework files?
[Magisk] osm0sis:
Scripts-only mode works for full pass PI, but those users probably didn't notice that they also ended up with full fail SN.

See my follow-up a few posts later where I got it all working as I wanted, here: https://xdaforums.com/t/module-framework-patcher-go.4674536/post-89590423

And just for everyone's reference, here's the full list of potential STRONG combos I've tried on my Pixel 8 Pro and the results:

FP GO = full fail PI, full fail SN
FP GO + Shamiko = full pass PI, full fail SN
FP GO + Zygisk Assistant = only BASIC PI, full fail SN
FP GO + Enforce DenyList enabled = only BASIC PI, full fail SN
FP GO + PIFork (Scripts-only mode) = full fail PI, full fail SN
FP GO + PIFork (Scripts-only mode) + Shamiko = full pass PI, full fail SN
FP GO + PIFork (Scripts-only mode) + Zygisk Assistant = full pass PI, full fail SN
FP GO + PIFork (Scripts-only mode) + Enforce DenyList enabled = full pass PI, full fail SN
FP GO + PIFork (Normal mode, no json) = full pass PI, full pass SN, RCS fully working
FP GO + PIFork (Normal mode, no json) + Shamiko = full pass PI, full pass SN, but all apps on DenyList crash repeatedly
FP GO + PIFork (Normal mode, no json) + Zygisk Assistant = full pass PI, full pass SN, RCS text working but RCS pictures get "Not Sent" and Messages mini viewfinder shutter button crashes
FP GO + PIFork (Normal mode, no json) + Enforce DenyList enabled = full pass PI, full pass SN, RCS fully working

* (.gms.unstable on DenyList for all Shamiko, Zygisk Assistant and Enforce DenyList enabled tests; Enforce DenyList disabled for all Shamiko and Zygisk Assistant tests; otherwise either causes full fail PI without PIFork)

Note I only really bothered to drill down into the RCS issues once I had SN also passing, since that was my first goal.
[Magisk] badabing2003:
I haven't, but don't take my results as heavily reliable, i only have this installed on my test device, mainly to understand, learn and test.

Although i haven't experienced slow downs either with or without those files, it's not my daily driver, so it doesn't have that much mileage.
[Magisk] David B.:
What device are you using?
[Magisk] Vision:
Thanks for all test and this info.

Very useful.

So this is with sailfish FP or have you change it in Android.java ?: FP GO + PIFork (Normal mode, no json) = full pass PI, full pass SN, RCS fully working
[Magisk] osm0sis:
It's all as I fully described in the linked previous follow-up post.
[Magisk] badabing2003:
Pixel 5 A14 stock.
[Magisk] Vision:
Sorry forgot to mention.

I had notice from my first test that they full fail SN.

What happens if full fail SN, but pass 3/3 in PI?
[Magisk] osm0sis:
It means your setup was probably like mine in my tests with those results and you might want to consider trying my final setup, if you've got all the required things of course.

I decided to risk it as well, but testing on my daily of course, and.. so far so good! Performance definitely seems somewhat improved if not back to normal. 🤘🤠

@changhuapeng can you make the boot-framework files cleaning a flash-time Vol up/down choice like the other things?
[Magisk] Vision:
In Kitsune Mask is little different.

Unfortunately now, I have lost the Strong to test this 😢
[Magisk] osm0sis:
I think the only difference is you have to manually add .gms.unstable to HideList because @huskydg hasn't added a CLI for it yet so PIFork can't automatically, and that maybe you wouldn't need to worry about anything else for hiding root since MagiskHide should have you mostly covered.

(Whereas I feel kinda naked now in my test setup without Shamiko or Zygisk Assistant and relying on Enforce DenyList instead 😅).
[Magisk] Vision:
Oh yeah, we had discussion about that again.

I understand that feeling 😂🤣

EDIT: If you have a keybox with Strong, only for test, because I read your opinion about that.

I'm here if you don't want it 😂🤣
[Magisk] Vision:
For users with A11 and below, need

If we can regenerate the boot-framework for the modify framework.jar that would the best (but maybe this is impossible).

So the only possible solution is this with PathClassLoader or something similar.
[Magisk] Rana260492:
This 0B files seem to be the problem for Performance loss/Roothide issues with shamiko/zygisk assistant.

Any Solution.Pixel 7 pro A14 June QPR3 Stock with magisk root.
[Magisk] Vision:
We have discussed about this above.

Until now nothing.
[Magisk] osm0sis:
You can try deleting them and pray it doesn't boot hang/loop your device.

If it doesn't (like on bada's Pixel 5 and my Pixel 8 Pro), then your performance might feel less impacted by the module.
[Magisk] jakell888888888:
@osmosis Do you want to comment on this event? Although I really need keybox

But I guess I'll wait for the developers here to crack this.
[Magisk] Rana260492:
Since pixel filesystem is erofs I tried to make it rw by using huskydg overlayfs as well as zenlua overlayfs however I was not able to delete the file or rename it.

Any other solution for rw ?

Sent from Pixel 7 Pro using ReLabs
[Magisk] Rana260492:
Osmosis how did you delete the files on your pixel 8 pro because it also has erofs file system which is ro only ?

Sent from Pixel 7 Pro using ReLabs
[Magisk] osm0sis:
First of all, not me. Second of all, what? 🤷‍♂️

No, you need to delete the zero-length files from the FP GO module directory, which the module itself made... 😶
[Magisk] jakell888888888:
Of course it's not you, it's someone from somewhere else, telling me that if I want to buy a keybox, I have to pay 5 digits of US dollars. Haha, this thing is unstable and may be banned at any time, and I have to pay 5 digits of US dollars to buy it. I think I'll wait for you to develop a good solution.
[Magisk] David B.:
It's not worth it for any price. You'd be better off buying a second phone to use for non-root apps.
[Magisk] jakell888888888:
If you have a choice, of course this is the best solution, but some programs must run on a rooted phone, and the software also needs to be strong. If this is the case, how to solve it?
[Magisk] trevtdogg:
I find that hard to believe, as it's contradictory. which app? are you sure it's not a mistake?
[Magisk] Usama-CW:
I don't think this will be possible, goolag always have upper hand and can ban any keybox without letting you know.
[Magisk] jakell888888888:
There is a program that can be used without root, but what about the Chinese region lock? You can only use virtual positioning to go to other countries, but the software does not allow virtual positioning. You cannot use the software without virtual positioning. Virtual positioning software without root will be detected. So this is very unexplainable. Of course, some people will say that you can not use this software? (Sorry I chose to use it, then I have to find a way to pass strong)

I won’t mention the name of the software (pogo)
[Magisk] Vision:
@changhuapeng

I think lot of questions and answers is out of topic here.
[Magisk] Rana260492:
Can someone please share aosp keybox.xml please

Thanks in advance.
[Magisk] changhuapeng:
Thanks! Your results can still help us understand the performance issues a little bit better.

This is just implemented in v1.2.0 v1.2.1, I have also added both arm and arm64 binary files to the zip.

Since there isn't too much spam and chatter in this thread, I'm giving those out of topic questions a pass for now.
[Magisk] bggold:
Just tried installing v1.2.0 on my pixel 8 pro and I am getting Error: not supported Installation failed. Any thoughts?

Thanks
[Magisk] changhuapeng:
That looks like the installation script can't detect your device architecture. What root solution (e.g. Magisk, Kitsune, KernelSU, APatch) are you using? And can you also provide the output of adb shell uname -a or uname -a?
[Magisk] bggold:
Magisk v27003

Linux localhost 5.15.137-android14-11-g316696f1d1a4-ab11798290 #1 SMP PREEMPT Fri May 3 09:41:21 UTC 2024 aarch64 Toybox
[Magisk] changhuapeng:
Please try this test zip to see if it's working properly.

Edit: removed test zip
[Magisk] bggold:
That allowed me to install. Thank you
[Magisk] Vision:
@changhuapeng

Because i do lot of test on emulator and works and now not working in latest version.

In previous version can install it on emulator x86_64.

What file inside in the zip must modify to make it works again?

EDIT: I just add the x86_64 in update-binary and now works.
[Magisk] trax7:
Let me see if I understand this properly. I tried with the default config (ksu, Zygisk next, pifork no json, FP 1.2.1 all options enabled) and I only pass BASIC, SN fails. My persist/TEE is okay.

Is this still dependent on an unobtanium non-banned keybox? The fingerprint is clear enough, I suppose, people can find those by themselves (though help is of course appreciated).
[Magisk] osm0sis:
Yup. Keybox is unfortunately a requirement. See my full setup explained here:

[MODULE] Framework Patcher GO

Framework Patcher GO Based on chiteroman's FrameworkPatch, this module modifies framework.jar directly on the phone, to build a valid system-level certificate chain. This module is compatible with Magisk, KernelSU, and APatch. For more details...

xdaforums.com
[Magisk] trax7:
Thanks, I already saw it. My question was geared towards the possible capability of mere mortals to taste strong attestation. So it's not doable as of now.
[Magisk] jakell888888888:
I think so, you can find people around you, or Google it hard, you may get unexpected results! Do not be discouraged. Worth a try!
[Magisk] Rana260492:
Ok so after installing 1.2.1 on my pixel 7 pro following things are observed.

1.The device only passes basic integrity and have to use piffork/pif with valid print to get device integrity.

2.After some time booting up with no modules other than FPGO,things start falling apart some apps like Gmail open but are stuck can't scroll.If I try to install a module using menu on every root manager like magisk/ksu/apatch appears stuck like internal storage does not load will show black screen for hours however storage managers can open storage fine.I first thought it to be a webview problem and tried various updates to webview/trichrome library but issue remains same.

3.Sine the module overlays system framework.jar unmounting it cause all root detection apps to go haywire.

Same issue are observed on my pixel 7 also.

Hope developer resolves these issues soon enough.Many thanks to developer for such a great module.

attached are screenshot of my conversations with lsposed developers regarding hiding issues he provides some tips to compile framework.oat

Maybe it will help developer.

Thanks in advance.
[Magisk] osm0sis:
Pretty sure the reason issues are being reported with FP GO and not the original FP is because people can actually use FP GO. 😉

Shamiko 1.1 DenyList app hangs is a conflict with PIF modules, which seems like a regression on their part. Not sure why it's happening or if any other kinds of modules are affected, but I do know it happens without FP GO installed.

File chooser hanging a weird amount of time in the Magisk app is nothing new, and nothing to do with FP or FP GO.

Chrome and other apps did seem a bit hang-y with FP GO in my earlier testing, but skipping the boot-framework files cleanup has completely resolved that on my Pixel 8 Pro.

Not being able to pass SafetyNet at all without PIFork also installed does suggest there's something important missing in FP or FP GO however.
[Magisk] Rana260492:
I tried with clearing boot framework files as well as without it but it still causes issues with media file picker which I don't know why.

Maybe as suggested by lsposed developers

"Save bandwidth: When umount is turned on

1. If there is an overlay app module (theme module, etc.), there may be problems, which can be fixed by shamiko

2. If the vendor module (driver, etc.) is modified, it may cause problems with the opengl of the chromium browser app. Set prop ro.zygote.disable_gl_preload=1 to solve it

0. If there is a font module, since the font will not be preloaded, the umounted process will crash if it cannot find the font. Shamiko can solve it.

Of course, turning off umount can also solve it. In fact, umount is not recommended unless necessary. The global switch of ksu can be turned off."

But how to add this property on Google pixel as it's file system is erofs and not rw ? Osmosis can you please take a look.