[INFO] Play Integrity API - replacement for SafetyNet

[chiteroman]

I was thinking about testing kernelsu, how did u get the right kernel?

I'm using this: https://de8ug.blogspot.com/2023/05/d8g-kernel-v14-real-of-gamer-poco-x3-pro.html but KernelSU it's a bit outdated. I will try to compile myself the original kernel.
The good point of D8G is that I can use Permissive SELinux and pass Play Integrity (thanks to @huskydg).
Only install kernel, don't use any "plugins" this kernel includes.

 

[V0latyle]

@pndwal and others, any knowledge of the "under the hood" link between Play Integrity responses and Play Protect certification?

Did some experimenting on my Pixel 5, stock rooted TQ2A.230505, with USNF MOD 1.2:

• Disabled UNSF module, rebooted, confirmed Play Integrity reports fail of both BASIC and DEVICE labels. Play Store still reports "Device is certified", even though Play Integrity check in store dev options shows no labels
• Cleared Play Store cache. Still reports "Device is certified"
• Cleared all Play Store data. Certification simply disappears, it does not explicitly say "Device is uncertified"
• Enabled USNF module, rebooted. Confirmed pass of both BASIC and DEVICE labels. Play Store does not report certified.
• Cleared Play Store data. Now reports "Device is certified"

 

[rodken]

@pndwal and others, any knowledge of the "under the hood" link between Play Integrity responses and Play Protect certification?

Did some experimenting on my Pixel 5, stock rooted TQ2A.230505, with USNF MOD 1.2:

• Disabled UNSF module, rebooted, confirmed Play Integrity reports fail of both BASIC and DEVICE labels. Play Store still reports "Device is certified", even though Play Integrity check in store dev options shows no labels
• Cleared Play Store cache. Still reports "Device is certified"
• Cleared all Play Store data. Certification simply disappears, it does not explicitly say "Device is uncertified"
• Enabled USNF module, rebooted. Confirmed pass of both BASIC and DEVICE labels. Play Store does not report certified.
• Cleared Play Store data. Now reports "Device is certified"

Ironic.
-- I went through the same experimental regime a few months ago on my OnePlus 8 and was able to hit pay dirt.

 

[zgfg]

@pndwal and others, any knowledge of the "under the hood" link between Play Integrity responses and Play Protect certification?

Did some experimenting on my Pixel 5, stock rooted TQ2A.230505, with USNF MOD 1.2:

• Disabled UNSF module, rebooted, confirmed Play Integrity reports fail of both BASIC and DEVICE labels. Play Store still reports "Device is certified", even though Play Integrity check in store dev options shows no labels
• Cleared Play Store cache. Still reports "Device is certified"
• Cleared all Play Store data. Certification simply disappears, it does not explicitly say "Device is uncertified"
• Enabled USNF module, rebooted. Confirmed pass of both BASIC and DEVICE labels. Play Store does not report certified.
• Cleared Play Store data. Now reports "Device is certified"

Device is certified takes some time

Long ago (before PI) it's been discussed about. IDK how it works now

Eg, once (like two years ago), after deleting Data for PlayStore app, I needed couple of hours to get it showing Device is certified - until then, it was neither Certified nor Not certified, but SN was passing with no problem

 

[V0latyle]

Ironic.
-- I went through the same experimental regime a few months ago on my OnePlus 8 and was able to hit pay dirt.

What do you mean?

Device is certified takes some time

Long ago (before PI) it's been discussed about. IDK how it works now

Eg, once (like two years ago), after deleting Data for PlayStore app, I needed couple of hours to get it showing Device is certified - until then, it was neither Certified nor Not certified, but SN was passing with no problem

In this case it was immediate. Clearing data then relaunching Play Store updates the certification status. Interesting that it doesn't seem to explicitly indicate whether a device is not certified, only if it is

 

[Lughnasadh]

It once took close to a day for it to show up as either certified or not certified for me after clearing Play Store data. That was a while ago. Once it does show up , it has always indicated either "Device is certified" or "Device is not certified".

 

[V0latyle]

It once took close to a day for it to show up as either certified or not certified for me after clearing Play Store data. That was a while ago. Once it does show up , it has always indicated either "Device is certified" or "Device is not certified".

Interesting, did you have dev options enabled in Play Store?

I only got "Device is certified", I never got the "not certified" message

Also, were you clearing all Play Store data or just cache?

 

[Lughnasadh]

Interesting, did you have dev options enabled in Play Store?

I only got "Device is certified", I never got the "not certified" message

Also, were you clearing all Play Store data or just cache?

Currently, I do have dev options enabled in Play Store and it shows "Device is not certified". It has also shown this without dev options enabled. Cleared both Play Store data and cache. I don't ever remember it being different than this.

 

[V0latyle]

Currently, I do have dev options enabled in Play Store and it shows "Device is not certified". It has also shown this without dev options enabled. Cleared both Play Store data and cache. I don't ever remember it being different than this.

Interesting. I should have taken screenshots.

I assume you're failing DEVICE_INTEGRITY?

 

[Lughnasadh]

Interesting. I should have taken screenshots.

I assume you're failing DEVICE_INTEGRITY?

Yeah, I'm failing all three. Not trying to pass though as I don't need to.

 

[rodken]

What do you mean?

I was disabling/enabling a great number of modules to get a feel for how GPay would behave out on the field with or without 'device certification' in-play.

 

[pndwal]

@pndwal and others, any knowledge of the "under the hood" link between Play Integrity responses and Play Protect certification?

Did some experimenting on my Pixel 5, stock rooted TQ2A.230505, with USNF MOD 1.2:

• Disabled UNSF module, rebooted, confirmed Play Integrity reports fail of both BASIC and DEVICE labels. Play Store still reports "Device is certified", even though Play Integrity check in store dev options shows no labels

Seems Play Protect only checks periodically.

• Cleared Play Store cache. Still reports "Device is certified"

Not enough to force Play Store refresh.

• Cleared all Play Store data. Certification simply disappears, it does not explicitly say "Device is uncertified"

Forced Play Store refresh but any cached Play Protect measurements are too old... Play Store is waiting for a periodical Play Protect attestation check.

You should get an instant result by clearing Play Services data where Play Protect is still included, or by additionally clearing Google Play Protect Service app in late systems. (I still don't have this w/ A11 stock MIUI.)

• Enabled USNF module, rebooted. Confirmed pass of both BASIC and DEVICE labels. Play Store does not report certified.

Reboot most likely refreshes Play Protect cached measurements (triggers new attestation check), or USNF may may cause this with a Play Services refresh.

• Cleared Play Store data. Now reports "Device is certified"

Forced Play Store refresh and cached Play Protect measurements are fresh enough to be accepted.

---------​

Play Store does take some time to catch up with gms attestation without intervention like G Pay/Wallet does (up to a week?), but clearing data seems to make it poll Play Protect service immediately... The Play Protect service was embedded in Google Play Services till recently but in late systems it's seperated out to new Google Play Protect Service app.

For me results have generally been instant, but I've also generally cleared Play Services data at the same time to refresh it's cached measurements (incl. Play Protect service); Play Store apparently waits for Play Protect to periodically refresh attestation results if its cached results are too old. Nb. if on a late system with seperate Google Play Protect Service app you'll also need to clear its data to get refreshed results.

For a long while after June 2022 (PI rollout) Play Protect service was still polling S/N ctsProfileMatch only... That's why many wondered why bank apps failed despite Play Protect returning 'Device is Certified' or wouldn't show in Store. (S/N ctsProfileMatch was passing with older USNF but many devices needed the later added fingerprint prop based mismatch in addition to bypass new fingerprint prop based hardware-backed verdict enforcement and pass PI deviceIntegrity... Devices launched with A13+ also need shipping level prop mismatch.) I'd say Google may have simply been waiting for some critical mass of bank apps to move Play Protect device certification result to PI deviceIntegrity. I'm not sure, but Play Integrity may have migrated also by now. Nb. Playstore correctly excludes apps based on several different criteria so displayed Play Protect device certification result is only one of several device compliance measurements that are actually known by Play Store.

PW

 

[chiteroman]

@pndwal and others, any knowledge of the "under the hood" link between Play Integrity responses and Play Protect certification?

Did some experimenting on my Pixel 5, stock rooted TQ2A.230505, with USNF MOD 1.2:

• Disabled UNSF module, rebooted, confirmed Play Integrity reports fail of both BASIC and DEVICE labels. Play Store still reports "Device is certified", even though Play Integrity check in store dev options shows no labels
• Cleared Play Store cache. Still reports "Device is certified"
• Cleared all Play Store data. Certification simply disappears, it does not explicitly say "Device is uncertified"
• Enabled USNF module, rebooted. Confirmed pass of both BASIC and DEVICE labels. Play Store does not report certified.
• Cleared Play Store data. Now reports "Device is certified"

Device is certified = passing MEETS_DEVICE_INTEGRITY (and MEETS_BASIC_INTEGRITY).

To reset it, clear GSF and GMS data.

 

[IlyasPro]

do you guys know how to pass cts profile match please in couple months my device was and still unable to use banking apps because google play certification is not certified

 

[pndwal]

do you guys know how to pass cts profile match please in couple months my device was and still unable to use banking apps because google play certification is not certified
View attachment 5923551View attachment 5923553 View attachment 5923555View attachment 5923557

Do you have Universal SafetyNet Fix module, modded fork/build by @Displax ? PW

 

[V0latyle]

do you guys know how to pass cts profile match please in couple months my device was and still unable to use banking apps because google play certification is not certified
View attachment 5923551View attachment 5923553 View attachment 5923555View attachment 5923557

What modules are you using?

Edit: Ninja'd by @pndwal

 

[IlyasPro]

Do you have Universal SafetyNet Fix module, modded fork/build by @Displax ? PW

yeah actually

 

[pndwal]

@IlyasPro

Disable all other than USNF and reboot to see if pass deviceIntegrity...

Please say device / ROM, and if you have any other mods, eg flashed from TWRP... PW

 

[IlyasPro]

I don't know how to thanks you you are a life saver so there is a module cause this entire issue, It looks like strong integrity is still failing but it doesnt matter finally I got to login to my account again thanks you so much

 

[pndwal]

I don't know how to thanks you you are a live saver so there is a module cause this entire issue, It looks like strong integrity is still failing but it doesnt matter finally I got to login to my account again thanks you so much
View attachment 5923595View attachment 5923599

Please say which mod... May help others... I suspect it may be have been MHPC configuration(?)

Nb. There's no need to alter fingerprint prop globally w/ MHPC if using current USNF builds as that's now an integrated function...

FYI, you won't ever pass strongIntegrity unless your device has defective implementation of components relaying chain of trust data from hardware keys...

Happily for us, no banks are known to use PI strongIntegrity (equivalent to old S/N API returning ctsProfileMatch pass w/ evaluationType: HARDWARE_BACKED, BASIC) yet...

PW