[Discussion] Google Pay Magisk Discussion Thread

[qetuol]

My Gwallet also stopped to work a few days ago despite [see attached picture].
I did not modify anything in system,it just stopped to work with "Your device doesn't meet security requirements". Any idea? Is it now gone for good?

 

[bizkit_120]

Same issue here , everything works fine 3 days ago,didn't update anything nor security patch update. Yesterday when I try to make a payment it tell me on the payment screen phone doesn't meet security standard. Back home Tried safety net 2.4.0 worked about an hour when i retry integrity api checker first one failed,mean time try add card to wallets failed too..

Downgrade to 2.3.1 straight way integrity checker failed.

Have to say goodbye to wallets for some time.. Will see you again..

OnePlus 9 oos13

.

 

[rodken]

Yup...

Clearly new 2.4.0 is failing intermittently for many, and Google Pay/Wallet users particularly are getting failures w/ 'Device doesn't meet Security requirements' message as Google monitors device security even when Pay/Wallet is not invoked.

Not to 'toot my own horn' - I might be one of the lucky few that doesn't have any issues with GPay while running 2.4.0 on the OnePlus 8 OOS 11 while passing Basic and Device Integrity.

 

[pndwal]

Not to 'toot my own horn' - I might be one of the lucky few that doesn't have any issues with GPay while running 2.4.0 on the OnePlus 8 OOS 11 while passing Basic and Device Integrity.

OnePlus 8?... Doesn't Momo show 'Tee broken'?... (It's actually not, but Devs mean keymaster implementation is broken)...

If so (IIRC), you don't even need main USNF functions!; neither fake keystore registration to trip fallback to Basic attestation nor prop changes to bypass hardware attestation based verdict enforcement as your broken keymaster already trips fallback to basic and Google don't enforce hardware attestation based verdict enforcement using your devices expected prop values as they know which OnePlus devices (and others) are broken...

It seems that the recent failure relates to USNF's key fake keystore registration function/timing...

You most likely only need root hiding for gms attestation (droidguard) process (com.google.android.gms.unstable) and resetting of some sensitive props to pass S/N or PI deviceIntegrity... USNF also performs these functions since we no longer have MagiskHide doing this...

PW

 

[bizkit_120]

Same issue here , everything works fine 3 days ago,didn't update anything nor security patch update. Yesterday when I try to make a payment it tell me on the payment screen phone doesn't meet security standard. Back home Tried safety net 2.4.0 worked about an hour when i retry integrity api checker first one failed,mean time try add card to wallets failed too..

Downgrade to 2.3.1 straight way integrity checker failed.

Have to say goodbye to wallets for some time.. Will see you again..

OnePlus 9 oos13

.View attachment 5821021View attachment 5821023

Update: Finally it works... don't know how long it can lasting...

 

[casouzaj]

For me, too. Couple of days ago, Wallet complained that my device didn`t match security standards. Then, downgraded to USNF-MOD-2.1, rebooted, and Wallet is back to work! Xperia XZ2 running LineageOS 20.0. Magisk Delta Canary. Zygisk, Magiskhide and SuList are enabled.

 

[bizkit_120]

For me, too. Couple of days ago, Wallet complained that my device didn`t match security standards. Then, downgraded to USNF-MOD-2.1, rebooted, and Wallet is back to work! Xperia XZ2 running LineageOS 20.0. Magisk Delta Canary. Zygisk, Magiskhide and SuList are enabled.

You will also need to make sure wipe out Google service cache just in case if any funky residue may back to you some time later..

 

[pndwal]

Update: Finally it works... don't know how long it can lasting...

Did you move to @Displax forked/modded USNF?... Should last with that... Until official 2.4.0 gets fixed... PW

 

[shoey63]

@pndwal
Which is the best @Displax fork?
There's a couple of 2.31's and a 2.40

Edit. Obviously not required for my Rog 3, but I am going to try This method on my pixel 6 to achieve locked bootloader and rooted with Magisk to try and pass "Strong Integrity"

 

[pndwal]

@pndwal
Which is the best @Displax fork?
There's a couple of 2.31's and a 2.40

Ah, all 3 published ones are 3.31 based... Read spoiler notes here:
https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87198517

You can use any... Last 2 needed for P7 and any device launched with A13... Final build has Hide "Enable OEM Unlock" setting... Jury's out on that; I think @kdrag0n didn't want to include it...

Edit. Obviously not required for my Rog 3, but I am going to try This method on my pixel 6 to achieve locked bootloader and rooted with Magisk to try and pass "Strong Integrity"

Doubt you'll achieve that; Hardware will still attest to custom keys/signing used / custom root of trust set, ie. Yellow state... That's still technically a Verified Boot issue category... You'll need verified Green state to pass strongIntegrity... PW

 

[bizkit_120]

Did you move to @Displax forked/modded USNF?... Should last with that... Until official 2.4.0 gets fixed... PW

I tried 2.4, 2.3. none of them work, eventually found out this 2.3.1 mod which works perfectly fine . I was keep run integrity api checker today morning.. so far so good .. first 2 pass, Strong I haven't seen it ever show me green check mark since I rooted my phone...not sure anyone ever seen Strong pass..

Did you move to @Displax forked/modded USNF?... Should last with that... Until official 2.4.0 gets fixed... PW

 

[j0110]

Getting stuck on this screen right after Google Wallet being installed...
Any ideas ?

 

[centaurium]

Just downgrade play services to version 22.50.55 and add play services to the update locker lsposed module and no more wallet issue.

 

[j0110]

I'm using MicroG. Should I downgrade Play Store to 22.50.55 ?

 

[cmstlist]

Installed Displax' usnf 2.3.1-MOD_2.1 (from GitHub) and seeing the same issue.

Edit: cleared Wallet cache and it's not complaining now... So maybe it did work.
Will test payments later

Just wanted to report on Pixel 6a this seems to have worked?

I removed 2.4.0, added the above mod, then before any reboots I did a force-close + cache clear on Play Store, Wallet and Play Services. Did not wipe data of any. Then reboot. On first open of Wallet app it still complained. But then after quitting and reopening the app, no further complaints.

EDIT: Yes it worked. The error appeared when I tried to make a payment at a cafe this morning. After doing the above I went grocery shopping and was able to pay again.

 

[xabier-bo]

Did you move to @Displax forked/modded USNF?... Should last with that... Until official 2.4.0 gets fixed... PW

Couple of weeks ago I found strange "card rejected" messages while paying with gwallet. But immediately, after the first failing attempt it was accepted.

Then I read the posts here sharing new problems, while everything had been working fine until now.

So I checked the gwallet app (I never look at it), and discovered it was complaining with the "old" message: this device doesn't meet...

I wiped apps caché (google play and gwallet), rebooted, got a first complaint of not meeting requirements, but closing and reopening the app made it disappear.

So, I decided a more "conclusive" approach. I went to the supermarket and payed with the gwallet without any problem.

So, this is my situation: I've had to downgrade nothing, I've kept USFN v2.4.0 by kdrag0n, and I'm paying with gwallet.

Hope it's helpful for your "diagnosis"

 

[pndwal]

Couple of weeks ago I found strange "card rejected" messages while paying with gwallet. But immediately, after the first failing attempt it was accepted.

Then I read the posts here sharing new problems, while everything had been working fine until now.

So I checked the gwallet app (I never look at it), and discovered it was complaining with the "old" message: this device doesn't meet...

I wiped apps caché (google play and gwallet), rebooted, got a first complaint of not meeting requirements, but closing and reopening the app made it disappear.

So, I decided a more "conclusive" approach. I went to the supermarket and payed with the gwallet without any problem.

So, this is my situation: I've had to downgrade nothing, I've kept USFN v2.4.0 by kdrag0n, and I'm paying with gwallet.

Hope it's helpful for your "diagnosis"

The failures with 2.4.0 may be random, often occuring with a reboot...

Google monitors device security for G Pay/Wallet full time, so whether PI deviceIntegrity fails momentarily or user removes lockscreen pattern/password and immediately restores it, Pay/Wallet will likely lock out contactless payment use even while Pay/Wallet is not in use and either require resetting (clearing data for Pay/Wallet and/or Play Services) or will be restored after some time...

We need a fix for detections in official solution, but @Displax modded USNF builds are not failing this way and are working fine for most users ATM. PW

 

[xabier-bo]

So the situation is clear enough.
Thanks, PW!

PS. ATM but also payment terminals

 

[Garbonzo17]

Continued...

And this really sums up the whole need for
"magisk: Remove Play Services from DenyList …
The Zygisk module will never load if GMS is in the DenyList..."

I did envisage issues with multiple hiding solutions operating on one process as covered above, but these haven't been demonstrated anywhere...

However while denylist does hide by virtue of 'Magisk getting out of the way', it actually prevents Magisk modifications from affecting selected processes at all, unlike. hiding solutions, so any Zygisk based injection of code into a forked zygote process that loads and runs a new app's code cannot occur for instance.

Since USNF's key function works this way it must fail when gms droidguard process is in (enforced) denylist:

I believe that the various targeted prop changes needed to trigger hardware based verdict enforcement bypasses in S/N and PI also use Zygisk, so these functions will fail also...

I have to agree that it's the nature of denylist that necessitates the removal of at least the gms droidguard process from denylist (although I still think merely instructing users is to do this manually where needed is all that is needed and would actually cause less confusion)...

Anyway, thanks for helping me properly connect modification denial with the reason for magisk: Remove Play Services from DenyList commit.





I didn't mean to suggest that Shamiko users were dumb enough to enforce denylist... USNF would remove gms processes on next boot anyway...

Shamiko should really note somewhere that hijacked denylist really = hidelist, if only to create an excuse to fall about laughing at the confused gringo-user posts suddenly appearing in LSP TG threads everywhere...




View attachment 5782451

PW

Ok, these 2 posts cleared up ALOT of my confusion about how this works! (I think)
I had my OP9 w/oos13 working fine up until a couple of days ago, and was going bonkers trying to walk back whatever had happened... I think what I did was enabled enforcing the list so I could add kroger so I could use their shopping app, but left gps on the list??? I have removed that, gone to the USNF/displax v2.1 and not only have google wallet and kroger in the deny list. I gather there may be still overlooking something simple or doing something out of sequence... still passing basic integrity and CTS match, same as before, have cleared storage+cache for wallet, gps (and kroger for good measure) and now still having no luck with getting wallet/pay to work. I am trying some other things but if anyone can be precise with anything I am not grokking it would be much appreciated! TIA!

 

[pndwal]

Ok, these 2 posts cleared up ALOT of my confusion about how this works! (I think)
I had my OP9 w/oos13 working fine up until a couple of days ago, and was going bonkers trying to walk back whatever had happened... I think what I did was enabled enforcing the list so I could add kroger so I could use their shopping app, but left gps on the list??? I have removed that, gone to the USNF/displax v2.1 and not only have google wallet and kroger in the deny list. I gather there may be still overlooking something simple or doing something out of sequence... still passing basic integrity and CTS match, same as before, have cleared storage+cache for wallet, gps (and kroger for good measure) and now still having no luck with getting wallet/pay to work. I am trying some other things but if anyone can be precise with anything I am not grokking it would be much appreciated! TIA!

USNF has issues as you'll see here... So

Folks:

Clearly new 2.4.0 is failing intermittently for many, and Google Pay/Wallet users particularly are getting failures w/ 'Device doesn't meet Security requirements' message as Google monitors device security even when Pay/Wallet is not invoked... I recommend using @Displax's USNF modded fork at least until official USNF is updated... (I gave what clues I have in post above). PW

... Don't put gms (Play Services) in denylist for ANY USNF builds. (Only needed for custom ROMs integrating @kdrag0n's SNF or their own solutions for S/N / PI)...

Please be specific what you mean by

... and now still having no luck with getting wallet/pay to work...

... Are you getting the "Google Pay is Currently Updating..." Screen that never goes away? Other?... PW