MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0

Search This thread

pndwal

Senior Member
Hi, doesnt work for me :
View attachment 5378539
OnePlus 9 Pro, OOS 11.2.8.8 BA
As OP says, passing basic attestation (ie. basicIntegrity) is out of scope for this fix; you need to be passing that first.

Some ideas:

If ROM is an unofficial customised distribution or uncertified stock ROM (eg China variant), you likely need to spoof a certified fingerprint in addition to this module. Using MagiskHide Props Config module is the best solution currently for that.

If you are running EDXposed, as noted many times here now, this is now breaking SafetyNet. Disable / uninstall / use LSPosed (passes presently).

Disable all other modules and reboot to eliminate other modules breaking basicIntegrity. PW
 
  • Like
Reactions: Kainey

Kainey

Member
Jan 11, 2016
25
8
As OP says, passing basic attestation (ie. basicIntegrity) is out of scope for this fix; you need to be passing that first.

Some ideas:

If ROM is an unofficial customised distribution or uncertified stock ROM (eg China variant), you likely need to spoof a certified fingerprint in addition to this module. Using MagiskHide Props Config module is the best solution currently for that.

If you are running EDXposed, as noted many times here now, this is now breaking SafetyNet. Disable / uninstall / use LSPosed (passes presently).

Disable all other modules and reboot to eliminate other modules breaking basicIntegrity. PW
Thank you it was indeed EDXposed, it's now perfectly fine with LSPosed ! Sorry I'm a beginner, my 7 Pro passed after rooting but it was long time ago.
 
  • Like
Reactions: pndwal

SmolChild

New member
Aug 7, 2021
1
1
Hi, I need some help with this.

I have a Google Pixel 2xl with Android 8 and I'm using the ver. 23 of Magisk. When I try to install the SafetyNet Fix 1.2.0 module, my phone is stuck in a bootloop. Can someone guide me on how to fix this issue?
 
  • Like
Reactions: t0m0

pndwal

Senior Member
Hi, I need some help with this.

I have a Google Pixel 2xl with Android 8 and I'm using the ver. 23 of Magisk. When I try to install the SafetyNet Fix 1.2.0 module, my phone is stuck in a bootloop. Can someone guide me on how to fix this issue?
Just boot to Safe Mode (in case of incompatable module / bootloop).

For Pixel (from phone off):
1. Press your phone's power button.
2. When the animation starts, press and hold your phone's volume down button. Keep holding it until the animation ends and your phone starts in safe mode.
3. You'll see "Safe mode" at the bottom of your screen.
https://support.google.com/pixelphone/answer/2852139

On next boot to system, modules and MagiskHide will be disabled. Compatible modules can be enabled again later, others removed.

... Not sure what your issue really is however. Android 8 / Pixel should be compatible with this...

What other modules are installed?...

And, just curious, why are you still on Android 8 with Android 11 available (stock) for your phone? 🤔

🤠 PW
 
Last edited:

Qudus77

New member
Aug 13, 2020
1
0
30
Everyone having issues passing basic attestation after installing the module, please try the attached versions.

There have been quite a few reports of fingerprint unlocking in apps breaking on One UI. This is not something that is planned to be fixed, because One UI is a heavy OEM skin that is not officially supported. It's surprising that it works on One UI to begin with.
Thanks very much!! Finally it works after flashed this module v1.1 test1

Redmi Note 8 with rom Corvus 9.5
MHCP activated, and Safety Checks passed.
 

Attachments

  • Screenshot_20210808-051756_Magisk.png
    Screenshot_20210808-051756_Magisk.png
    215 KB · Views: 114
  • Screenshot_20210808-051720_Magisk.png
    Screenshot_20210808-051720_Magisk.png
    58.3 KB · Views: 111

foormea

Member
Dec 3, 2020
12
0
Hi, I have set up Magisk hide for Google Play Services and Google Pay, I have installed the props module and enabled the fingerprint for my phone, and I have installed this Universal SafetyNet Fix module.
I'm still having issues with Google Pay: I cannot enable contactless, GPay says that "Your phone doesn't meet security requirements". All other requirements (NFC on, GPay set as default, card is there, screen lock is there).
Is there anything I can do to enable contactless?
Thank you.

edit: seems like clearing cache/data for Google Play Services fixed it
 
Last edited:
Pixel 3, Android 11, screen lock protected by password, Magisk and Universal SafetyNet Fix 1.2 installed, SafetyNet passes.

After reboot Android doesn't "load" all applications (some icons are empty on desktop and in the application list), apps don't start, reboot menu appears - but does nothing.

But,

when I enable airplane mode before entering password after reboot, everything works fine.

Looks like some internet request breaks Android boot sequence when Universal SafetyNet Fix is installed.

Did you ever figure out a fix for this? I'm having lockups an a Pixel 3, recently updated to Android 11 (aug 5 21 build) with Magisk 23, and the same thing when SafetyNet Fix 1.1.1 was installed. Was able to get the module disabled by turning off wifi/data ASAP upon booting.

It looks like this issue describes the same problem, and a potential fix was to install a different kernel: https://github.com/kdrag0n/safetynet-fix/issues/60

It's been a long time since I used a different kernel though, so I need to read up on the process/compatibility of EXKM since I don't think I can boot to TWRP anymore on Android 11?
 
Did you ever figure out a fix for this? I'm having lockups an a Pixel 3, recently updated to Android 11 (aug 5 21 build) with Magisk 23, and the same thing when SafetyNet Fix 1.1.1 was installed. Was able to get the module disabled by turning off wifi/data ASAP upon booting.

It looks like this issue describes the same problem, and a potential fix was to install a different kernel: https://github.com/kdrag0n/safetynet-fix/issues/60

It's been a long time since I used a different kernel though, so I need to read up on the process/compatibility of EXKM since I don't think I can boot to TWRP anymore on Android 11?
To answer my own question, after buying EX File Manager, and downloading and saving the Kirisakura kernel (
https://xdaforums.com/t/kernel-05-0...for-pixel-3-xl-aka-bluecross.3864563/page-154 ) to my Pixel 3 on Android 11, I was able to install the kernel, reboot, then install USNF 1.2.0 from storage and reboot and so far so good (Magiskhide enabled and app hidden, no freezes/crashes at boot, SN passes, Play certified, able to re-add back a payment card in GPay).
 
  • Like
Reactions: pndwal

RushdB

Senior Member
Jul 25, 2007
66
0
Hey guys... I really need to get my phone back to pass safety net.
It's an old Moto Z2 Force, running latest lineage os.
Installed Magisk (apk first, booted into recovery and installed zip file).
Then I've installed MagiskHide Props and Universal Safety net Fix.
My CTS still fail. Any hint?
Do I have to do anything besides just install these modules, I mean, config anything?
 

Attachments

  • Screenshot_20210809-215926_Magisk.png
    Screenshot_20210809-215926_Magisk.png
    220 KB · Views: 56
  • Screenshot_20210809-215934_Magisk.png
    Screenshot_20210809-215934_Magisk.png
    97 KB · Views: 55

pndwal

Senior Member
Hey guys... I really need to get my phone back to pass safety net.
It's an old Moto Z2 Force, running latest lineage os.
Installed Magisk (apk first, booted into recovery and installed zip file).
Then I've installed MagiskHide Props and Universal Safety net Fix.
My CTS still fail. Any hint?
Do I have to do anything besides just install these modules, I mean, config anything?
Yup; (you need MHPC module if rom uses uncertified fingerprint. Some unofficial LOS spoof certified fingerprint out of the box. Official never die, due to policy.)

MHPC does nothing if props required are not configured (hence name)! 😜

Check it's docs, install a terminal emulator, type 'props', wait for menu, select change fingerprint option only, select close / same print for your device and reboot...

Thread here:
https://xdaforums.com/t/module-magiskhide-props-config-safetynet-prop-edits-and-more-v5-4-0.3789228/

🙂 PW
 

pndwal

Senior Member
To answer my own question, after buying EX File Manager, and downloading and saving the Kirisakura kernel (
https://xdaforums.com/t/kernel-05-0...for-pixel-3-xl-aka-bluecross.3864563/page-154 ) to my Pixel 3 on Android 11, I was able to install the kernel, reboot, then install USNF 1.2.0 from storage and reboot and so far so good (Magiskhide enabled and app hidden, no freezes/crashes at boot, SN passes, Play certified, able to re-add back a payment card in GPay).
Didn't see if anyone tried test module, "Shim the keystore service instead of replacing it" for this issue:
Scenarios and issues to test
32-bit ARM devices
Heavy OEM skins
Samsung One UI
MIUI
Broken biometric authentication in apps
Unstable system (i.e. rebooting and/or crashing)
From OP.

Download:
https://github.com/kdrag0n/safetynet-fix/pull/13#issuecomment-767863635 PW
 
Didn't see if anyone tried test module, "Shim the keystore service instead of replacing it" for this issue:

From OP.

Download:
https://github.com/kdrag0n/safetynet-fix/pull/13#issuecomment-767863635 PW
Thanks, didn't find that post in my searching. In reading the list of symptoms it is supposed to fix, I don't think I would have suspected the pixel 3 stock rom to qualify with the one ui and heavily skinned roms. Everything is working on 1.2.0 with custom kernel so I don't think I want to mess with it right now but will remember this if something changes!
 

pndwal

Senior Member
Thanks, didn't find that post in my searching. In reading the list of symptoms it is supposed to fix, I don't think I would have suspected the pixel 3 stock rom to qualify with the one ui and heavily skinned roms. Everything is working on 1.2.0 with custom kernel so I don't think I want to mess with it right now but will remember this if something changes!
Yup, understand.

I'm not sure if "Unstable system (i.e. rebooting and/or crashing)" fix will work for this scenario either, but could help others if instability on Pixels is related to replacing Keystore with pure AOSP version, which seems most likely. PW
 
Last edited:
  • Like
Reactions: Nateg900t

Esufrae

New member
Aug 10, 2021
2
0
United Kingdom
Olá pessoal, eu uso um app de delivery e tenho um grande problema com algum gps falso que uso gerado no sistema. mas com S8 ou S9 Android 09 não tenho esse problema.
então agora estou usando um Samsung G960F Android 10, UI 2.1. magisk instalado.
Já baixei edxposed, hide mock location, busybox, adereços config e riru 5.4.4.
esta mensagem só aparece quando ligo o GPS.
vale uma boa doação, para quem me ajuda a desvendar esse mistério.
20210811_202002.jpg
 

zgfg

Senior Member
Oct 10, 2016
10,757
9,376
Redmi K20 / Xiaomi Mi 9T
Xiaomi Mi 11
Olá pessoal, eu uso um app de delivery e tenho um grande problema com algum gps falso que uso gerado no sistema. mas com S8 ou S9 Android 09 não tenho esse problema.
então agora estou usando um Samsung G960F Android 10, UI 2.1. magisk instalado.
Já baixei edxposed, hide mock location, busybox, adereços config e riru 5.4.4.
esta mensagem só aparece quando ligo o GPS.
vale uma boa doação, para quem me ajuda a desvendar esse mistério.View attachment 5383543
Please, this is English forum
 
  • Like
Reactions: Wolfcity

Rockel

Senior Member
Nov 4, 2013
119
28
40
Tilburg
Huawei MediaPad T5
Moto G8 Plus
You have to download the module's zip file from Github and install in Magisk, Modules, Install from storage and reboot

And read the OP post
Thanks! Don't know how it was possible missing this. Seems i was looking in a wrong part. Didn't understood annything of it. But now I've found the zip. Thanks!

Edit:
And this helped to fix my ctsProfile fail. (y)
Screenshot_20210812-122457.jpg
 
Last edited:
  • Like
Reactions: zgfg

Philnicolls89

Senior Member
Install riru and riru unshare modules.
Use Magisk hide and magisk rename.
Then install 3C toolbox.
Go to app which is detecting magisk, click manage and disable the ¨detect magisk¨ service..usually the lastone in the list.. Voila
What is 3C toolbox, I have one particular app that is kicking my ass with detecting root. I'm willing to give anything a go at this point. I've already already tried unshare and momo hider.
 
What is 3C toolbox, I have one particular app that is kicking my ass with detecting root. I'm willing to give anything a go at this point. I've already already tried unshare and momo hider.
Google it. Attached is the screenshot.
 

Attachments

  • Screenshot_20210816-155012_3C All-in-One Toolbox.jpg
    Screenshot_20210816-155012_3C All-in-One Toolbox.jpg
    387.6 KB · Views: 81

Top Liked Posts

  • There are no posts matching your filters.
  • 337
    Universal SafetyNet Fix
    Magisk module​

    Magisk module to work around Google's SafetyNet attestation.

    This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS profile attestation, which requires a valid combination of device and model names, build fingerprints, and security patch levels.

    If you still have trouble passing SafetyNet with this module, use MagiskHide Props Config to spoof a certified device profile. This is a common issue on old devices, custom ROMs, and stock ROMs without GMS certification (e.g. Chinese ROMs).

    Android versions up to 13 Beta 3 are supported, including OEM skins such as Samsung One UI and MIUI.

    How does it work?
    The way this workaround works is relatively low-level. An in-depth explanation, as well as source code and ROM changes, can be found on GitHub.

    Ideally, this workaround should be incorporated in custom ROMs instead of injecting code with a Magisk module. See the ProtonAOSP website for more information.

    Downloads
    Downloads and changelogs can be found on GitHub. The topmost release is the latest.

    Latest release
    v2.4.0

    Highlights
    • Play Integrity bypass without breaking device checks or causing other issues
    • Disabled use of hardware attestation on Pixel 7 and newer (@anirudhgupta109)
    Other changes
    • Updated instructions for newer Android and Magisk versions
    • Better debugging for future development
    This version only supports Zygisk (Magisk 24 and newer).

    It's taken a while to find a way to bypass Play Integrity that doesn't require spoofing the build fingerprint permanently, but I wanted to make sure this module doesn't cause any unnecessary breakage. Just like the original goal of Universal SafetyNet Fix, this minimizes adverse effects by spoofing dynamically at runtime only when necessary. Enjoy!

    If you found this helpful, please consider supporting development with a recurring donation for rewards such as early access to updates, exclusive behind-the-scenes development news, and priority support.
    Alternatively, you can also buy me a coffee. All support is appreciated ❤️

    Source code
    223
    So, here is my modification of USNF with Play Integrity API bypass.

    It changes fingerprint to old 7.1.2 6.0 (LOL) and apply it only for GMS SafetyNet process (by Zygisk injection), so your original prints/security path level does not change. This avoids many side effects/problems with global props changing.

    Updated 3.0:
    No words needed, you understand everything yourself 😜

    Updated 2.1:
    Hide "Enable OEM Unlock" setting

    Updated 2.0:
    Bypassing DEVICE_INTEGRITY for devices that shipped with Android 13+ (Pixel`s 7 )

    Updated:
    Drop fingerprint to lowest possible (6.0) to ensure that no one use same Android version

    Usage:
    1. Delete/disable/reset MagiskHidePropsConfig (if installed).
    2. Just install it over old Universal SafetyNet Fix and reboot device.
    3. You may be needed to wipe GMS data (not cache) if there is no result immediately.

    Many thanks to @1nikolas for integrity checker.

    Source code: https://github.com/Displax/safetynet-fix/tree/integrity
    58
    So, here is my new modification of USNF with Play Integrity API bypass.

    It is now based on top of original v2.4.0 codebase instead of v2.3.1, with adding new hiding algorithm for current realities and some code refreshing.

    Changelog:

    Version 1.2
    * Fix crash and endless tests loop/failing on Android < 9.0 (bug from original version 2.4.0).
    * Do not unpatch (revert) changes. To prevent possible tests failing after a while on some ROMs (cross conflicts).

    Version 1.1
    * Fix KeyStore hook desynchronization (tests randomly failing problem).


    Usage:
    1. Delete/disable/reset MagiskHidePropsConfig (if installed).
    2. Just install it over old Universal SafetyNet Fix and reboot device.
    3. You may be needed to wipe GMS data (not cache) if there is no result immediately.

    Source code: https://github.com/Displax/safetynet-fix/tree/dev
    33
    So, created separate thread for my mod. Welcome)

    32
    Folks, the SafetyNet API was depreciated last Month with 'full turndown' slated for June 2024 and the introduction of the new Play Integrity API. It has also become clear that Google apps are simply the first to adopt the long foretold Play Integrity API; all responsible banks are bound to follow suit in short order, and at least before the June 2023 migration deadline.

    This means (assuming fully deployed Hardware Key Attestation doesn't come first 😬) that the need for a 'Universal Play Integrity Fix' has become quite urgent.

    We currently have workarounds involving using older fingerprint props by means of MHPC module (similar to fix needed for uncertified ROMs), but success/mileage varies per device and users of regular bank apps / gamers etc on stock devices will all soon be forced to experiment with MHPC prints also... This is hardly ideal.

    So I've made an issue report/request on USNF GitHub as follows. This information may be insightful to users here also...

    Please let me know here if I have missed anything important, or add any technically relevant details there...

    PLEASE DON'T spam that issue with unimportant details or queries... (The previous issue is already burgeoning w/ OT.) That's what this thread is for... 😛 :

    Please make 'Universal Play Integrity Fix' ... #204

    Fixes to expand 'Universal SafetyNet Fix' to become a 'Universal Play Integrity Fix' are needed.

    The SafetyNet Attestation API is deprecated and has been replaced by the Play Integrity API.
    https://developer.android.com/training/safetynet/deprecation-timeline

    New Play Integrity API is rolling out from June 2022, and evidently Google Play Store and Google Pay/Wallet are already using its verdict.

    June 2023 is the Migration Deadline for app developers. This will also allow their older app versions to continue working with SafetyNet API for a limited time.

    June 2024 is the End of life for SafetyNet API; its attestation will no longer work for any app version, and apps will receive an error.

    The new Integrity API has more strict requirements for passing attestation, and this seems to be enforced in Android 11+ particularly.

    Currently (evidently due to this), device security issues are detected by

    1. Google Pay/Wallet, which may state "You can't pay contactless with this device...(Your phone doesn't meet software standards)" on updating or attempting to add a card despite in-app Contactless setup stating "You're ready to pay contactless with your phone (Your phone meets security requirements)", and
    2. Google Play Store, which may no longer show apps like Netflix w/ Android 11+ (developers can 'exclude devices from their app's distribution based on their device integrity . Device exclusion is based on the latest device integrity verdict that the Play Store app receives from the Play Integrity API') despite in-app settings showing Play Protect 'Device is certified' result.
    I'm guessing that the 'passing' messages based on the old SafetyNet API are likely to realigned soon.

    A workaround that evidently allows Play Integrity API attestation to pass (and solve Wallet / Play Store issues also) has been discovered. It involves spoofing an earlier certified ROM, generally by using MagiskHide Props Config module to change fingerprint prop to one for Android 10 or earlier.

    Undoubtedly other apps will begin to detect broken TEE etc / fail as they migrate or begin integrating the Play Integrity API.

    A 'Universal Play Integrity Fix' will evidently require more understanding / research into how the fingerprint prop is used, and possibly other new behaviours.

    Here's hoping... 🙃 PW