MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0

Search This thread
By:
Advanced…
kdrag0n

kdrag0n

Senior Member
Feb 19, 2016
696
2,036
kdrag0n.dev
Universal SafetyNet Fix
Magisk module​

Magisk module to work around Google's SafetyNet attestation.

This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS profile attestation, which requires a valid combination of device and model names, build fingerprints, and security patch levels.

If you still have trouble passing SafetyNet with this module, use MagiskHide Props Config to spoof a certified device profile. This is a common issue on old devices, custom ROMs, and stock ROMs without GMS certification (e.g. Chinese ROMs).

Android versions up to 13 Beta 3 are supported, including OEM skins such as Samsung One UI and MIUI.

How does it work?
The way this workaround works is relatively low-level. An in-depth explanation, as well as source code and ROM changes, can be found on GitHub.

Ideally, this workaround should be incorporated in custom ROMs instead of injecting code with a Magisk module. See the ProtonAOSP website for more information.

Downloads
Downloads and changelogs can be found on GitHub. The topmost release is the latest.

Latest release
v2.4.0
Highlights
  • Play Integrity bypass without breaking device checks or causing other issues
  • Disabled use of hardware attestation on Pixel 7 and newer (@anirudhgupta109)
Other changes
  • Updated instructions for newer Android and Magisk versions
  • Better debugging for future development
This version only supports Zygisk (Magisk 24 and newer).

It's taken a while to find a way to bypass Play Integrity that doesn't require spoofing the build fingerprint permanently, but I wanted to make sure this module doesn't cause any unnecessary breakage. Just like the original goal of Universal SafetyNet Fix, this minimizes adverse effects by spoofing dynamically at runtime only when necessary. Enjoy!

If you found this helpful, please consider supporting development with a recurring donation for rewards such as early access to updates, exclusive behind-the-scenes development news, and priority support.
Alternatively, you can also buy me a coffee. All support is appreciated ❤️

Source code
 
Last edited by a moderator:
  • Like
  • Love
Reactions: vinibali, VBrossa, AKA#1 and 321 others
tylerdurden

tylerdurden

Senior Member
Oct 13, 2010
301
643
Hamburg
Tested succesfully on Pixel 4a 5G, but Google Pay says "Your phone doesn't meet security requirements" even though PayPal can be set up.
Magisk Hide is activated.
 
T

thomas140

Senior Member
Jul 3, 2018
652
143
Johor
Xiaomi Poco F1
Xiaomi 13
Safety net fix 1.0.2 worked for miui Eu 12.0.3.0 Android 10 for Poco F1.
Only that the ocbc bank Singapore app still able to detect the root and became unusable.
But I know that this doesn't relate to safetynet fix here because the issue already existed before the CTS false.
 
M

MoL_82

Senior Member
Aug 16, 2019
90
45
Tested on Samsung S9:
- 1.0.2 worked in MM, but Root Checker said 'cannot access GPS'.
- 1.1.0 fails ctsProfile in MM, but Root Checker now can access GPS, also returns ctsProfile fail.
 
  • Like
Reactions: ngodinhhoi
S

shchukax

Member
Jun 12, 2019
6
5
Massive thanks for this. Version 1.1.0 confirmed working on my device:
- Pixel 3, stock room
- Magisk 21.2, magisk manager 8.0.5
- Magisk hide enabled and magisk manager renamed

All banking apps and google pay work correctly, including contactless payments.
 
  • Like
Reactions: RealEthanPlayzDev and powerful111
D

Drahy

Senior Member
Apr 27, 2012
517
88
I tried this on my Samsung Galaxy A6 (official samsung firmware patched with magisk) - and even version 1.1.0 causes bootloop when using zip inside Magisk Manager - Android 10
 
A

Antonio200

Member
Nov 26, 2020
17
0
Good morning. Working on Redmi Note 9 Pro xiaomi.eu 12.0.1 Android 10. No MagiskHide Props Config needed: basicIntegrity passed, ctsProfile passed, evalType BASIC.
Thank you so much
 
Last edited:
P

purgy

Senior Member
Aug 29, 2013
156
40
Sydney
Google Pixel 7a
Works on pixel 3a, last A10 patch, using magisk hide props config to force basic attestation. Was already using mhpc so not sure if it works without it. Fixed my CTS issue though, so thanks!
 
D

dr4go

Senior Member
Dec 17, 2010
473
395
Vienna
@kdrag0n Thank you so much for this awesome masterpiece!

I find it a bit interesting, that I experience a problem which nobody else seems to have reported so far. I'm using a Galaxy S10 (Exynos, G973F), rooted with latest canary Magisk, no EdXposed or whatsoever...

If I enable this module, no bootloop, basic attestation, CTS passes. "Yes", so I thought...

The problem now... My bank app tries to access the keystore and crashes. This does not happen without having this module enabled... I have attached a fully logcat and hope that you have some insights... 🙏🏻

EDIT1: re-attached file, didn't work on the first go.

EDIT2: oh... search for "easybank" or "keystore"

EDIT3: Android 11, One UI 3
 

Attachments

  • logcat_01-14-2021_11-15-06.zip
    70.1 KB · Views: 1,281
Last edited:
B

BenDavid

Member
Sep 29, 2016
27
8
POCO F1 user here. After flashing the module the phone stucks on the Google logo at boot.
The MHPC module didn't solve the problem either.

ROM: Pixel Experience 11 Beta (20201223)/Encrypted
 
  • Like
Reactions: srdrhl146
You must log in or register to reply here.

Similar threads

Chainfire
[Android 2.1+][03.10.2011][v3.2] Chainfire3D [ROOT][OpenGL ES 2.0+]
Replies
3K
Views
3M
rignfool
rignfool
apb_axel
[ZIP] Synapse + Script => Universal Kernel Manager v3.8.1
Replies
3K
Views
767K
D
Dildoman
repey6
[6.0-12.0][Magisk]Dolby Digital Plus[upd.20211005]
Replies
2K
Views
745K
R
Radzią
Chainfire
[2014.05.01][ROOT] Mobile ODIN v4.20
Replies
5K
Views
3M
Zagnutty
Zagnutty
DooMLoRD
[04/Jan][ROOTING/UNROOTING] DooMLoRD's Easy Rooting Toolkit [v4.0](zergRush Exploit)
Replies
927
Views
3M
B
bishoy ashraf

Top Liked Posts

24 Hours 30 Days All time
  • 1
    zgfg
    zgfg
    sakun-ice said:
    Can somebody help me? I can't get past safety net. I have installed the xiaomi.eu rom on my xiaomi 13. I have Magisk 26.1 with Zygisk. I have installed the modules universal safetynet fix 2.4 mod 1.2 and lsposed. I have added to the deny list: google play services, google play and google play framework. I have deleted the data from those apps and from the bank apps. I have also tried to install the Alpha app instead of Magisk and to hide the magisk app from the settings. But nothing works.

    The strange thing is that before installing the xiaomi.eu rom it worked.
    Click to expand...
    Click to collapse
    Xiaomi.eu ROMs can pass Play Integrity (once again, PI is now of interest, SN is deprecated, and if you pass PI you will also pass SN) since they have the spoof built-in

    Cannot guarantee for all Xiaomi.eunROMs

    Hence, have you tried Play Integrity checker prior than you installed Magisk?

    For PI, you should pass Basic and Device Integrity but you cannot pass Strong Integrity (with the unlocked Bootloader)

    ---

    If you switch from Magisk official to Magisk Alpha or Delta, it is not enough (actually, it's then almost as if you did not switch) to install Alpha or Delta app, but after that you also have to install Magisk Alpha or Delta (like through the app, Install, patch and flash the boot img or Direct Install but after reboot you then also have to configure your Magisk Alpha or Delta)
    View
  • 9
    S
    swer45
    New huge update for the Xposed module, also now the repo it's in LSPosed repo so it will appear in LSPosed app. You will want to install it :D

    GitHub - swer45/AttestationSpoofer: Xposed module that spoofs a fake root of trust in local attestations

    Xposed module that spoofs a fake root of trust...
    github.com github.com

    Screenshot_2023-05-11-16-51-55-199_io.github.vvb2060.keyattestation.jpgScreenshot_2023-05-11-16-51-59-407_io.github.vvb2060.keyattestation.jpg

    As you can see, now the module will spoof a locked bootloader with a verified boot state in RootOfTrust. This should work in all devices that have a TEE or StrongBox. If someone crash tag me and I will try to fix it.

    Also I'm working in Magisk module (Zygisk), but it's difficult XD.
    View
    7
    S
    swer45
    DineshValor said:
    Please share, I want to test atleast once your module.
    Click to expand...
    Click to collapse

    GitHub - chiteroman/AttestationSpoofer: Xposed module that spoofs a fake root of trust in local attestations

    Xposed module that spoofs a fake root of trust...
    github.com github.com
    View
    5
    S
    swer45
    Screenshot_2023-05-11-18-19-07-241_com.CIB.Digital.MB.jpg

    With this module you can start the CIB Egypt Mobile Banking which is the only app I know they check if you have an unlocked bootloader. Enjoy 😎😎😎
    View
    5
    S
    swer45
    swer45 said:
    This will """hide""" TEE presence, so apps can't check by hardware if the bootloader is unlocked. It's a LSPosed module, I need to study how can I implement this as Magisk (Zygisk) module.

    Source code: https://github.com/swer45/TEE-Hide

    Download: https://github.com/swer45/TEE-Hide/releases

    This will NOT help you to bypass Strong.
    Click to expand...
    Click to collapse
    I updated the Xposed module with better hooking method to don't affect another apps. This afternoon I will work in Zygisk module, I will try to do it.
    View
    5
    P
    pndwal
    swer45 said:
    That's why I hate Lineage, I don't understand that "rules"...
    Click to expand...
    Click to collapse
    'Hate' is a strong word!...

    Anyway, when the original CyanogenMod bundled all proprietary GApps for one thing, Google issued their infamous "Cease And Desist" order and Steve Kondik thought his baby was dead!...

    However Google were quick to clarify that although custom OS's could not legitimately bundle GApps (Nb. other ROMs still do), users are welcome to 'sideload' the same (as devices themselves are generally certified through CTS while custom ROMs are not)...

    So OpenGapps was formed to offer legitimised seperate packages, Steve continued with CM project, users continued to use vanilla CM (and later LOS) with proprietary Google Apps, and all in the custom mod world was sweet again...

    Of course Google must have realised they nearly shot themselves in the foot with that action, but they scrambled to offer a solution / compromise that wouldn't result in the death of CM or custom ROMs as we know them...

    I think the Lineage team simply see that Google is actually the custom modders benefactor and is (in reality) supportive of them and custom mods/ROMs in general if Devs play by the rules, and LOS is simply willing to do so...

    Also, they are in the best position to get their custom ROM approved/certified in future (see my post above) by being careful 'not to subvert Google's security model' by tampering expected signals... Note that Magisk now follows this same policy, and I think that's not just because John is a Googler now; it's also a sign of his maturity as a responsible dev...

    And ensuring that the main custom mods (ROM, root/overlay framework) comply in no way prevents "those passionate about hiding" from "doing their job"!... Both history and you are proving that.

    Personally I think LOS is great and follows a great tradition! 🙃 PW
    View
  • 324
    kdrag0n
    kdrag0n
    Universal SafetyNet Fix
    Magisk module​

    Magisk module to work around Google's SafetyNet attestation.

    This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS profile attestation, which requires a valid combination of device and model names, build fingerprints, and security patch levels.

    If you still have trouble passing SafetyNet with this module, use MagiskHide Props Config to spoof a certified device profile. This is a common issue on old devices, custom ROMs, and stock ROMs without GMS certification (e.g. Chinese ROMs).

    Android versions up to 13 Beta 3 are supported, including OEM skins such as Samsung One UI and MIUI.

    How does it work?
    The way this workaround works is relatively low-level. An in-depth explanation, as well as source code and ROM changes, can be found on GitHub.

    Ideally, this workaround should be incorporated in custom ROMs instead of injecting code with a Magisk module. See the ProtonAOSP website for more information.

    Downloads
    Downloads and changelogs can be found on GitHub. The topmost release is the latest.

    Latest release
    v2.4.0
    Highlights
    • Play Integrity bypass without breaking device checks or causing other issues
    • Disabled use of hardware attestation on Pixel 7 and newer (@anirudhgupta109)
    Other changes
    • Updated instructions for newer Android and Magisk versions
    • Better debugging for future development
    This version only supports Zygisk (Magisk 24 and newer).

    It's taken a while to find a way to bypass Play Integrity that doesn't require spoofing the build fingerprint permanently, but I wanted to make sure this module doesn't cause any unnecessary breakage. Just like the original goal of Universal SafetyNet Fix, this minimizes adverse effects by spoofing dynamically at runtime only when necessary. Enjoy!

    If you found this helpful, please consider supporting development with a recurring donation for rewards such as early access to updates, exclusive behind-the-scenes development news, and priority support.
    Alternatively, you can also buy me a coffee. All support is appreciated ❤️

    Source code
    View
    222
    Displax
    Displax
    So, here is my modification of USNF with Play Integrity API bypass.

    It changes fingerprint to old 7.1.2 6.0 (LOL) and apply it only for GMS SafetyNet process (by Zygisk injection), so your original prints/security path level does not change. This avoids many side effects/problems with global props changing.

    Updated 3.0:
    No words needed, you understand everything yourself 😜

    Updated 2.1:
    Hide "Enable OEM Unlock" setting

    Updated 2.0:
    Bypassing DEVICE_INTEGRITY for devices that shipped with Android 13+ (Pixel`s 7 )

    Updated:
    Drop fingerprint to lowest possible (6.0) to ensure that no one use same Android version

    Usage:
    1. Delete/disable/reset MagiskHidePropsConfig (if installed).
    2. Just install it over old Universal SafetyNet Fix and reboot device.
    3. You may be needed to wipe GMS data (not cache) if there is no result immediately.

    Many thanks to @1nikolas for integrity checker.

    Source code: https://github.com/Displax/safetynet-fix/tree/integrity
    View
    58
    Displax
    Displax
    So, here is my new modification of USNF with Play Integrity API bypass.

    It is now based on top of original v2.4.0 codebase instead of v2.3.1, with adding new hiding algorithm for current realities and some code refreshing.

    Changelog:

    Version 1.2
    * Fix crash and endless tests loop/failing on Android < 9.0 (bug from original version 2.4.0).
    * Do not unpatch (revert) changes. To prevent possible tests failing after a while on some ROMs (cross conflicts).

    Version 1.1
    * Fix KeyStore hook desynchronization (tests randomly failing problem).


    Usage:
    1. Delete/disable/reset MagiskHidePropsConfig (if installed).
    2. Just install it over old Universal SafetyNet Fix and reboot device.
    3. You may be needed to wipe GMS data (not cache) if there is no result immediately.

    Source code: https://github.com/Displax/safetynet-fix/tree/dev
    View
    33
    Displax
    Displax
    So, created separate thread for my mod. Welcome)

    [MODULE] [MOD] Universal SafetyNet Fix

    Universal SafetyNet Fix [MOD] Magisk module...
    forum.xda-developers.com forum.xda-developers.com
    View
    31
    P
    pndwal
    Folks, the SafetyNet API was depreciated last Month with 'full turndown' slated for June 2024 and the introduction of the new Play Integrity API. It has also become clear that Google apps are simply the first to adopt the long foretold Play Integrity API; all responsible banks are bound to follow suit in short order, and at least before the June 2023 migration deadline.

    This means (assuming fully deployed Hardware Key Attestation doesn't come first 😬) that the need for a 'Universal Play Integrity Fix' has become quite urgent.

    We currently have workarounds involving using older fingerprint props by means of MHPC module (similar to fix needed for uncertified ROMs), but success/mileage varies per device and users of regular bank apps / gamers etc on stock devices will all soon be forced to experiment with MHPC prints also... This is hardly ideal.

    So I've made an issue report/request on USNF GitHub as follows. This information may be insightful to users here also...

    Please let me know here if I have missed anything important, or add any technically relevant details there...

    PLEASE DON'T spam that issue with unimportant details or queries... (The previous issue is already burgeoning w/ OT.) That's what this thread is for... 😛 :

    Please make 'Universal Play Integrity Fix' ... #204

    Fixes to expand 'Universal SafetyNet Fix' to become a 'Universal Play Integrity Fix' are needed.

    The SafetyNet Attestation API is deprecated and has been replaced by the Play Integrity API.
    https://developer.android.com/training/safetynet/deprecation-timeline

    New Play Integrity API is rolling out from June 2022, and evidently Google Play Store and Google Pay/Wallet are already using its verdict.

    June 2023 is the Migration Deadline for app developers. This will also allow their older app versions to continue working with SafetyNet API for a limited time.

    June 2024 is the End of life for SafetyNet API; its attestation will no longer work for any app version, and apps will receive an error.

    The new Integrity API has more strict requirements for passing attestation, and this seems to be enforced in Android 11+ particularly.

    Currently (evidently due to this), device security issues are detected by

    1. Google Pay/Wallet, which may state "You can't pay contactless with this device...(Your phone doesn't meet software standards)" on updating or attempting to add a card despite in-app Contactless setup stating "You're ready to pay contactless with your phone (Your phone meets security requirements)", and
    2. Google Play Store, which may no longer show apps like Netflix w/ Android 11+ (developers can 'exclude devices from their app's distribution based on their device integrity . Device exclusion is based on the latest device integrity verdict that the Play Store app receives from the Play Integrity API') despite in-app settings showing Play Protect 'Device is certified' result.
    I'm guessing that the 'passing' messages based on the old SafetyNet API are likely to realigned soon.

    A workaround that evidently allows Play Integrity API attestation to pass (and solve Wallet / Play Store issues also) has been discovered. It involves spoofing an earlier certified ROM, generally by using MagiskHide Props Config module to change fingerprint prop to one for Android 10 or earlier.

    Undoubtedly other apps will begin to detect broken TEE etc / fail as they migrate or begin integrating the Play Integrity API.

    A 'Universal Play Integrity Fix' will evidently require more understanding / research into how the fingerprint prop is used, and possibly other new behaviours.
    Click to expand...
    Click to collapse

    Here's hoping... 🙃 PW
    View

New posts