[Discussion] Google Pay Magisk Discussion Thread

Search This thread

umibuzu

Senior Member
Aug 15, 2010
51
5
Paris
I had some difficulties with this " not set up " NFC sign. But eventually, after erasing ALL data of pay+service(carreful not the " for AR"+play) , uninstalling pay, running an SD MAID, and reinstall again, I fixed it.
 

rpmccormick

Senior Member
Dec 1, 2008
765
111
OnePlus 7 Pro
Did anyone ever figure out how to use GPay with no screen lock? I was hoping to find a Magisk module to allow this, but no luck so far.

I am not required to keep a pad lock on my wallet, I don't want one on my phone.

Add up all the seconds you have spent unlocking your phone over a decade, and you will find it wastes a lot of your life! I have never lost my phone nor my wallet in my 45 years of life, therefore I refuse to lock my phone.
 

73sydney

Senior Member
Did anyone ever figure out how to use GPay with no screen lock? I was hoping to find a Magisk module to allow this, but no luck so far.

I am not required to keep a pad lock on my wallet, I don't want one on my phone.

Add up all the seconds you have spent unlocking your phone over a decade, and you will find it wastes a lot of your life! I have never lost my phone nor my wallet in my 45 years of life, therefore I refuse to lock my phone.

Its a requirement of all payment apps...

There is no workaround

End of discussion
 

Lord Sithek

Senior Member
Dec 19, 2018
1,170
585
Xiaomi Redmi Note 4
Huawei Watch 2
Did anyone ever figure out how to use GPay with no screen lock? I was hoping to find a Magisk module to allow this, but no luck so far.

I am not required to keep a pad lock on my wallet, I don't want one on my phone.

Add up all the seconds you have spent unlocking your phone over a decade, and you will find it wastes a lot of your life! I have never lost my phone nor my wallet in my 45 years of life, therefore I refuse to lock my phone.
Up to Android 10 there are two Xposed modules which I know:
- LockscreenDisabler for AOSP roms (https://repo.xposed.info/module/com.lr.keyguarddisabler2)
- CustoMIUIzer for MIUI roms (https://forum.xda-developers.com/t/mod-xposed-3-2-1-customiuizer-customize-your-miui-rom.3910732/)

Unfortunately, as far as I know and remember, they both dont work since A11. There are some forks of CustoMIUIzer which work on A11+, but not with all features, and Im afraid this particulare one doesnt
 

rpmccormick

Senior Member
Dec 1, 2008
765
111
OnePlus 7 Pro
Thanks for the replies. Consider it a request. A non-rooted device is a requirement for all payment apps as well, yet people made a workaround for that. I am sure it must be possible to make Google think I have a lock-screen while allowing me to use and even reboot my device without having to enter a code.

How about a module that auto-enters a given pin for me whenever the lock screen is shown? ...it must be possible, not "end of discussion".
 

Lord Sithek

Senior Member
Dec 19, 2018
1,170
585
Xiaomi Redmi Note 4
Huawei Watch 2
Thanks for the replies. Consider it a request. A non-rooted device is a requirement for all payment apps as well, yet people made a workaround for that. I am sure it must be possible to make Google think I have a lock-screen while allowing me to use and even reboot my device without having to enter a code.

How about a module that auto-enters a given pin for me whenever the lock screen is shown? ...it must be possible, not "end of discussion".
Yes, this is definitely possible. You can use Tasker app with AutoInput plugin: https://play.google.com/store/apps/details?id=com.joaomgcd.autoinput&hl=pl&gl=US

You'll find many guides in the web on how to set it up
 

rpmccormick

Senior Member
Dec 1, 2008
765
111
OnePlus 7 Pro
Thanks for the suggestion. Can you confirm it can function on the lock-screen and detect the lock-screen to start auto-inputting? That would be an awesome solution... I will look in to it even if you don't confirm. Totally thanks if it works!

I also dove in to the previous link saying to extend the lock timeout to be like 24 hours instead of 5 seconds. That's not a bad method.

I also thought of maybe making SmartLock think I am always home so it never locks.

Tasker and Auto-Input would be best if it can actually work on the lock-screen. That way it will unlock after a reboot as well.


<rant>
Unless you are in the habit of losing your phone or want to keep certain people from looking at it, I challenge everyone to set the lock-screen to Swipe only for a week. Then go back to having to unlock it however you like, and it is my bet you will soon be frustrated with unlocking as well. My Windows auto logs in. My web and app logins are auto filled. Humans should not be forced to type codes over and over again. We made computers to automate things, why can't authentication be one of them, especially on machines that only one person ever uses.

If I do ever lose my phone, I will notice quickly and remote-wipe through Google (likely before anyone has had time to do anything with it).

It is absolutely ridiculous that I can't use built-in VPN to my home, see my saved passwords, or use PhonePay apps without enabling a lock-screen... especially the passwords one, as any thief could just set a lock code, then see your passwords... what is the point Google???

Hopefully the Tasker method solves this long-time issue of mine, and then I can move on to making my phone allow me to take a gosh-darn screen-shot any F-ing time I ask it to. I get so angry when I have to borrow some ones phone to take a picture of my phone. Ridiculousness! I can still take a screen-shot of any website on my PC (for now... I hope Google and M$ aren't reading this and getting any bad ideas).
</rant>
 
  • Haha
Reactions: 73sydney and pndwal

pndwal

Senior Member
<rant>
Unless you are in the habit of losing your phone or want to keep certain people from looking at it, I challenge everyone to set the lock-screen to Swipe only for a week. Then go back to having to unlock it however you like,
Very simple pattern? ... Mines not much more than a swipe! 😜
and it is my bet you will soon be frustrated with unlocking as well...
It is absolutely ridiculous that I can't use built-in VPN to my home, see my saved passwords, or use PhonePay apps without enabling a lock-screen... especially the passwords one, as any thief could just set a lock code, then see your passwords...
🤔 Oh! ... Please could you explain how this can be done?... I may have a false sense of security!?!... 😟
... I get so angry when I have to borrow some ones phone to take a picture of my phone. Ridiculousness!* I can still take a screen-shot of any website on my PC (for now... I hope Google and M$ aren't reading this and getting any bad ideas).
</rant>
*Nice new scrabble word - just learned it's real! Thanks. PW
 
  • Haha
Reactions: 73sydney

rpmccormick

Senior Member
Dec 1, 2008
765
111
OnePlus 7 Pro
I have used a simple "not much more than a swipe" pattern before. It is very annoying when I get it wrong, especially while driving or something. Having a lock is unsafe. The times I really need to quickly check my phone are always the times I can't swipe the dots good enough for it. Same thing with fingerprint, usually not an issue, but sometimes it is, and always at the worst of times. I have never tried face unlock. Plus all of these require a code after reboot, and if you flash a lot it becomes an annoyance.

Explanation: What I was saying was if you don't have a lock, then Chrome won't let you see saved passwords until you add a lock. I often need to set a code, see the password I need, then unset the code. This is dumb. Anyone who stole my phone could do the same. Why would Google force me to do that every time I need to see a saved password for use on another device? It does nothing to enhance security.
 

rpmccormick

Senior Member
Dec 1, 2008
765
111
OnePlus 7 Pro
Well, I got GPay working with Universal SaftyNet and Zigote. Unfortunately I have needed to enter my 0000 pin many times, due to reboots. I don't understand how y'all just live with that... waste of my life and I want it gone!

PS: No, tasker can't enter 0000 for me after a reboot, even with AutoInput. I pray someone will invent a solution.
 
  • Haha
Reactions: 73sydney

pndwal

Senior Member
I have used a simple "not much more than a swipe" pattern before. It is very annoying when I get it wrong, especially while driving or something. Having a lock is unsafe. The times I really need to quickly check my phone are always the times I can't swipe the dots good enough for it.
Sorry, what's unsafe?? - If you're caught touching the phone while driving where I am, a lock pattern is the least of your worries...

At least do others a favour; pull over, park up, then unlock phone (or don't) and then do phone fiddling... 😮
Explanation: What I was saying was if you don't have a lock, then Chrome won't let you see saved passwords until you add a lock. I often need to set a code, see the password I need, then unset the code. This is dumb. Anyone who stole my phone could do the same. Why would Google force me to do that every time I need to see a saved password for use on another device? It does nothing to enhance security.
Oh! Now I see what your saying...

It does enhance security as it ensures users have lock set to use G Pay, access saved passwords etc, etc, which generally means a thief would have to bypass cryptography to access any data on device, let alone passwords, bank funds etc... Of COURSE it's dumb to just un-set the code... That's not the intention!!!

That's a bit like removing your seatbelt once you reach the open road... de-activating an over-speed warning buzzer.... texting while driving... parachuting with no reserve chute... taking the guard off an angle-grinder... in order to fit a table-saw blade for hand trimming.... or skull penetration... whichever comes first!

Not to put too fine a point on it, you're trying to defeat an effective built-in safety mechanism on an already compromised device!...

... and I do understand that we are all actually 'subverting Google's security model' by using available mods here (only possible because they don't happen to view 'Magisk community' as nefarious but rather as 'white hat' combined with the fact that they know other cryptography and safeguards are still effectively protecting all concerned parties including banks).

I've also modified the 135° guard on my angle grinder by cutting it down to 85° in order to penetrate into a 90° folded-steel corner. (I've thus overcome a restriction that previously limited the effectiveness of this device)... But I wouldn't consider removing the guard entirely to cut the steel... even if it is tempting to cut corners! 😂 PW
 

pndwal

Senior Member
Well, I got GPay working with Universal SaftyNet
Universal SafetyNet Fix
Zygisk?
Unfortunately I have needed to enter my 0000 pin many times, due to reboots. I don't understand how y'all just live with that... waste of my life and I want it gone!
Reboots not needed except for initial USNF setup... Just put G Pay in denylist, check you have Play Protect Device is certified in Play Store (clear Play Store and possibly Play Services data if not to fix), clear G Pay data and open it... PW
 

73sydney

Senior Member
Well, I got GPay working with Universal SaftyNet and Zigote. Unfortunately I have needed to enter my 0000 pin many times, due to reboots. I don't understand how y'all just live with that... waste of my life and I want it gone!

PS: No, tasker can't enter 0000 for me after a reboot, even with AutoInput. I pray someone will invent a solution.

I refer you once more and hopefully only once more to this:


I have larger things in my world to worry about and shake my fist at than entering a blooming lockscreen password, which is there for security

Feel free to let big bad Google know theyre ruining your life in their forums

I bet you yell at kids to get off your lawn and keep their balls too
 
  • Like
Reactions: BostonDan

rpmccormick

Senior Member
Dec 1, 2008
765
111
OnePlus 7 Pro
I want to say thank you to Lord Sithek for trying to help and providing many links to threads about the issue and workarounds... I am not the only one who hates entering a code. Many have done it for Android 7, and some for 8 and 9. It seems 10 and 11 have blocked most workarounds, which is sad.

Also thanks to PW. We have different views, but the discussion is valid and fun. I have taken the guards off of all my saws and have not lost a finger yet. I have also changed hundreds of lights, outlets, and switches and seldom resort to flipping any breakers. I understand the need for security, please also understand some peoples need for instant access when security is not needed.

73sydney... It is not wrong of me to ask and request that a new workaround be developed. Just cause you like entering the same code 1000's of times in your life doesn't mean I have to. I love it when kids play on my lawn. I hate when companies dictate how I get to use my own devices.
 
  • Like
Reactions: Lord Sithek

pndwal

Senior Member
I want to say thank you to Lord Sithek for trying to help and providing many links to threads about the issue and workarounds... I am not the only one who hates entering a code.
👍
Also thanks to PW. We have different views,
Our views might be much the same in fact... But we gotta get real and accommodate the views of other parties...
but the discussion is valid and fun.
Yeah... If you're gonna risk losing digits, at least ensure you have fun doing it!
I have taken the guards off of all my saws
Wow! ... Maximising the fun?
and have not lost a finger yet.
... 'Yet' being the operative word. 😛
I have also changed hundreds of lights, outlets, and switches and seldom resort to flipping any breakers.
Same... But don't do it in the wet, without RCD's, without checking footwear or without cognisance of the path current will take where opposite hand contacts an earth conductor... Or with a supervisor watching...(We may only get to make a mistake once.)
I understand the need for security, please also understand some peoples need for instant access when security is not needed.
Sure... But it's never not needed in the eyes of the app Devs and cyber-crime researchers... so depends from who's perspective...
I love it when kids play on my lawn.
👍
I hate when companies dictate how I get to use my own devices.
But they hate it when you dictate terms for running their code! 🤪 ...They are another party with interests in your device use and code on your device...

Modern law recognises that code as their (intellectual) property, so they legitimately get to dictate how it's used on your device!... Your options are outwit them or refrain from using it...

But don't hate the rules... They actually facilitate this symbiosis... In this sense, banks, Google etc are your benefactors!... And you signed up for their help ... somewhere, sometime! PW
 
Last edited:
  • Like
Reactions: rodken

rpmccormick

Senior Member
Dec 1, 2008
765
111
OnePlus 7 Pro
Sure... But it's never not needed in the eyes of the app Devs and cyber-crime researchers... so depends from who's perspective...
👍
But they hate it when you dictate terms for running their code! 🤪 ...They are another party with interests in your device use and code on your device...

Modern law recognises that code as their (intellectual) property, so they legitimately get to dictate how it's used on your device!... Your options are outwit them or refrain from using it...

What are you talking about bro?

My phone has the option to set a lock screen to None or to Swipe. This is for login to my device, and doesn't need to have anything to do with encryption or anything else (I realize it does, but that is a flaw... it should be a UI setting only).

While your statement may make some sense for purchases, it makes zero sense for connecting to my home VPN or for looking at my stored passwords. As I have said before, my company does not require me to keep my physical credit cards under any sort of lock. Some one is just as likely to be able to steal my wallet and tap-to-pay as they are to steal my phone and tap-to-pay. They have no right to disable advertised functionality because I choose one of the provided options in my settings for login.
 

rpmccormick

Senior Member
Dec 1, 2008
765
111
OnePlus 7 Pro
What if they decided you had to use a super small font to use your bank apps, so someone could not as easily look over your shoulder? Is that their right because they wrote the code? What if they forced you to hold up your drivers license to your camera before you pay? These are just as arbitrary. I am happy to enter a code before paying. I am not happy to be forced to enter a code every time I turn on my phone, about 50+ times each day, in order to ever be able to make a payment. You should not be happy about that either. That is the whole point of this forum and rooting... to do what we want with our UI.
 

pndwal

Senior Member
What are you talking about bro?

My phone has the option to set a lock screen to None or to Swipe. This is for login to my device, and doesn't need to have anything to do with encryption or anything else
That's just timing etc, before password/security kicks in...

... and who mentioned encryption?... I did mention cryptography in earlier post... Of course these have everything to do with password/security, which is what the apps detect is enabled or not...
(I realize it does, but that is a flaw... it should be a UI setting only).
🤔
While your statement may make some sense for purchases, it makes zero sense for connecting to my home VPN or for looking at my stored passwords.
If you don't have it at home, you're hardly going to enable it (or remember to) whenever you go out!... They aren't stupid!
As I have said before, my company does not require me to keep my physical credit cards under any sort of lock.
Nah... They're happy if you leave them on your dash with the car window down for easy/quick access... Good point!
Some one is just as likely to be able to steal my wallet and tap-to-pay as they are to steal my phone and tap-to-pay.
But banks in many places will cover you/reimburse funds in these circumstances... So they naturally want to minimise possible fraud with new methods, and may not reimburse if (cryptographic) lock requirement is bypassed... Or may not offer mobile solutions w/o lock security on any platform... And Android security is already notoriously poor compared to iOS...
They have no right to disable advertised functionality because I choose one of the provided options in my settings for login.
... That's where you'd be wrong! ... and prerequisites are most likely also advised somewhere...

What if they decided you had to use a super small font to use your bank apps, so someone could not as easily look over your shoulder? Is that their right because they wrote the code?
Of course...
What if they forced you to hold up your drivers license to your camera before you pay? These are just as arbitrary. I am happy to enter a code before paying. I am not happy to be forced to enter a code every time I turn on my phone, about 50+ times each day, in order to ever be able to make a payment. You should not be happy about that either.
Doesn't worry me to enter pattern or touch fingerprint sensor, and I do... 😛
That is the whole point of this forum
This one's to use G Pay!
and rooting... to do what we want with our UI.
... within reason...

As I said, you own device, Google/banks own code... All have rights... Users can try their luck...

This has widely veered off into ideology

And i cant believe im saying this..... but can we get back on topic ?
Sorry mate!...

But ideology (not to mention common sense for living in a technologically advanced, fraud-filled age) does enter into G Pay / Magisk use/discussion...

And it's such fun too! ... Like noisykids playing in the park opposite your tenement... 😜

Best regards AM... PW
 
Last edited:

rpmccormick

Senior Member
Dec 1, 2008
765
111
OnePlus 7 Pro
73: I will respect the forum and take my discussion with PW to PM. Just know that your "there is no workaround, end of discussion" was the beginning of this ideological argument.

On Topic: We have used workarounds in the past, and I hope someone will invent a work around in the future, that allows me to use GPay with whatever security settings I wish, be it root (very dangerous due to possible remote execution) or no-password/auto-login (should not be dangerous at all if my phone is physically secure). Please let me know if some kind dev will afford me this basic freedom.
 

Top Liked Posts

  • There are no posts matching your filters.
  • 25
    The app is finally public! (thanks Google for taking a week to approve this 🤦)
    I made it beta testing since I haven't tested it on much devices. If you find any problem, please open an issue here and I'll take a look at them once I return from vacation.


    Source code:

    If you are curious, the possible outcomes I've seen are:
    • 3 ticks (unrooted samsung)
    • tick/tick/x (unrooted redmi note 4 with unlocked bootloader)
    • x/tick/x (my rooted a11 op7t)
    23
    UPDATE 1/8/2022
    This app is officially discontinued in favor of a new app I published on Play Store. Read more here:

    ====================
    ORIGINAL MESSAGE:

    I just made this simple app which tells you if your device passes the new Play Integrity API (which is presumably what Google Pay and Play Store use to detect root now). If you don't trust random apks from the internet feel free not to use this. I'll upload the source code at a later time since it's very junk now (probably on github).
    You can use it to play around and see if you manage to get it to pass without having to mess with Google Pay. There are screenshots of the 2 possible outputs (pass screenshot is from an online emulator).
    Also I didn't test it much since I don't have many devices that can pass. Hope it works fine 🤞

    Hope this helps someone find a solution :)

    EDIT:
    Here is a quote from Google of what exactly "Does not meet device integrity" mean:
    The app is running on a device that has signs of attack (such as API hooking) or system compromise (such as being rooted), or the app is not running on a physical device (such as an emulator that does not pass Google Play integrity checks).
    ...
    If you are having problems with your testing device meeting device integrity, make sure the factory ROM is installed (for example, by resetting the device) and that the bootloader is locked.
    19
    Modification of Universal SafetyNet Fix with Play Integrity API bypass

    13
    Thank you!

    You have a typo in the app name 😗
    "Play Intergrity API Checker"
    That's what happens when you rush to publish an app 😂
    I fixed it but it will take some time for Google to approve this groundbreaking change
    8
    where can i find that? Is this a module or directly from google? Do you have a link?
    Please be aware that this app is not 100% accurate. The api has 2 more readings you can get (which are pretty important) but Google gives them to you only if you upload the app on Play Store. So I made a better app and uploaded it to Play Store. Now I'm just waiting for Google to verify my identity and it will be up. (Oh and by the way the app is 100% open source, I'll link everything once it's up)
  • 61
    The new Google Play services update caused this.

    Temporary workaround:

    1. Disable Google Pay/Find My Device as Device Administrators in Settings > Security & location > Device Administrators.

    2. Search "Google Play services" in the Settings search bar.

    3. Press the three dots and press "Uninstall previous updates".

    4. Download this update - https://www.apkmirror.com/apk/google-inc/google-play-services/google-play-services-14-7-99-release/
    Pick your needed edition (arm or arm64, etc.), download it and install it.

    5. Disable Background data access for Google Play Services and Google Play in their respective App Info pages.

    6. Download Google Pay from the Play Store.

    7. Set up your cards. Enjoy!

    Never EVER update Google Play services manually, until a Magisk update is available that bypasses the upgraded SafetyNet. Note that Google Play services is responsible for adding/verifying the card, not the Google Pay app! Hence why there seems to be an overlay when adding a card/verifying an existing one.

    Tested Google Pay versions:

    2.79.x-2.83.235070858 - working

    Tested Google Play services versions:

    14.7.99, 16.0.86 - working with Magisk 18.1

    14.8.49-16.x- working with Magisk 18.2 Canary
    30
    This thread is inspired by the PoGo Magisk discussion thread. It's meant to keep the clutter of "Google Pay doesn't work" posts out of the main Magisk threads.

    Please use this to discuss issues with Google Pay and possible solutions.


    There's a working solution here:
    https://forum.xda-developers.com/apps/magisk/magisk-google-pay-gms-17-1-22-pie-t3929950
    And a Magisk Module for it here:
    https://forum.xda-developers.com/ap...7-1-22-pie-t3929950/post79643248#post79643248

    For general tips on first getting SafetyNet to pass fully, check here:
    https://www.didgeridoohan.com/magisk/MagiskHide#hn_SafetyNet
    29
    Ok. I tried this and it worked on gms 17.1.22, allowing one to add cards and pay in store. Warning YMMV, but this is the process I did to get this working. One caveat is that Google pay does not register the "recent transactions" on the Google pay app. Another caveat is that I suspect users will have to reverse some step if gms is updated and then reapply, but this still needs to be confirmed

    Without further ado, here is my process:

    1) download a SQL database editor. I used

    https://play.google.com/store/apps/details?id=com.tomminosoftware.sqliteeditor&hl=en_US

    2) download a terminal emulator program. I used terminus but any terminal emulator should work.

    3) make sure Google pay is forced close, if it is open.

    4) open SQL editor. Navigate to /data/data/com.google.android.gms/databases

    5) open dg.db

    6) change any value that lists "attest" in the name (first column) to 0 in the third column. Mine was showing a value of 10 in the third column for each of these values. (Column c for sqlite databse editor I used)

    7) open the terminal emulator.

    8) get root access (su)

    9) cd /data/data/com.google.android.gms/databases

    10) type: chmod 440 dg.db
    This makes dg.db read only (for owner and group, and no access for world.)

    11) reboot

    I suspect when gms is updated, one will have to go back to steps 10 and 11 and chmod 660 dg.db to allow new keys to be written to the database, and then go back and redo all these steps to reset the attestation values back to 0.

    If there is still an error, verify in sqlite database editor that all attest release keys values in dg.db are 0 when dg.db is read only (owner and group).

    Again, YMMV but this worked for me, so I give it back to the community now.

    Edit: recent activities did show up soon afterwards for the payment method.

    Cheers,
    B.D.
    25
    The app is finally public! (thanks Google for taking a week to approve this 🤦)
    I made it beta testing since I haven't tested it on much devices. If you find any problem, please open an issue here and I'll take a look at them once I return from vacation.


    Source code:

    If you are curious, the possible outcomes I've seen are:
    • 3 ticks (unrooted samsung)
    • tick/tick/x (unrooted redmi note 4 with unlocked bootloader)
    • x/tick/x (my rooted a11 op7t)
    23
    UPDATE 1/8/2022
    This app is officially discontinued in favor of a new app I published on Play Store. Read more here:

    ====================
    ORIGINAL MESSAGE:

    I just made this simple app which tells you if your device passes the new Play Integrity API (which is presumably what Google Pay and Play Store use to detect root now). If you don't trust random apks from the internet feel free not to use this. I'll upload the source code at a later time since it's very junk now (probably on github).
    You can use it to play around and see if you manage to get it to pass without having to mess with Google Pay. There are screenshots of the 2 possible outputs (pass screenshot is from an online emulator).
    Also I didn't test it much since I don't have many devices that can pass. Hope it works fine 🤞

    Hope this helps someone find a solution :)

    EDIT:
    Here is a quote from Google of what exactly "Does not meet device integrity" mean:
    The app is running on a device that has signs of attack (such as API hooking) or system compromise (such as being rooted), or the app is not running on a physical device (such as an emulator that does not pass Google Play integrity checks).
    ...
    If you are having problems with your testing device meeting device integrity, make sure the factory ROM is installed (for example, by resetting the device) and that the bootloader is locked.