Try clearing Play Services data and all modules disabled except USNF... Also, can use older @Displax modded build unless device launched with A13 (Pixel 7 etc)... And you don't need Play Store in denylist... PW
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
- Thread starter kdrag0n
- Start date
Can you please specify what did you clear? I cleared wallet cache and data but didn't help.
People have had failures w/ all USNF builds... Even stock devices were failing G Pay/Wallet device security checks at one point!...
However recent failures w/ 2.4.0 are certainly due to new changes/regressions specific to that build... See posts above...
Nah... Still Passing fine w/ PI deviceIntegrity... PW
Can be a challenge... See my saga above:
https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88049087
PWWhat, w/o PI deviceIntegrity?
Not usually forever... Generally rights itself after some time (a week sometimes) w/o intervention as long as PI deviceIntegrity has not failed again in the meantime. PW
Tried clearing everything in Play Service and Play Market as well as disabling basically everything in Magisk except USNF, still doesnt pass the integrity. However the GWallet started working again.
So definitely Google Play Services? (Not '... for AR' etc?)... So G Wallet working without deviceIntegrity?... Please show YASNAC results also (after disabling all modules except USNF)... PW
As you likely know, there are serious issues w/ official USNF 2.4.0 (w/ new fixes for PI deviceIntegrity)... I'd be using @Displax's first modded USNF fork w/ his own working PI fixes from here:
https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87198517
for this reason... (Read his notes in spoiler)...
At first glance your issue seemed to relate to Xiaomi EU custom ROM integrating SNF per @kdrag0n's recommendation...
Personally I prefer clean ROMs that don't integrate prop spoofing based 'fixes' etc because they often conflict with Magisk modules trying to do the same thing... They may be fine without Magisk (eg you seem to be passing PI deviceIntegrity w/o Magisk w/ your ROMs implementation which likely forks the @Displax commits anyway) but cause unexpected surprises for Magisk users...Also, SNF applied to ROMs per @kdrag0n's notes for his Proton ROMs may play well with Magisk USNF module until the latter is updated; seems users may need to wait for their ROM Devs to update inbuilt SNF to match USNF when that occurs...
But now I see your SELinux is set to permissive!?!? Why?
... Is that an official XiaomiEU custom ROM or unofficial build?... Have you disabled Linux security using a recovery flashable mod or other?... Done any other mods?...... I'd uninstall XPrivacyLUA also, but note banks often detect this even after uninstalling as it doesn't clean up properly... Remove
data/system/xlua folder to prevent this detection...
PWThanks for your reply. The miui Eu is based from the official miui Eu website.As you likely know, there are serious issues w/ official USNF 2.4.0 (w/ new fixes for PI deviceIntegrity)... I'd be using @Displax's first modded USNF fork w/ his own working PI fixes from here:
https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87198517
for this reason... (Read his notes in spoiler)...
At first glance your issue seemed to relate to Xiaomi EU custom ROM integrating SNF per @kdrag0n's recommendation...
Personally I prefer clean ROMs that don't integrate prop spoofing based 'fixes' etc because they often conflict with Magisk modules trying to do the same thing... They may be fine without Magisk (eg you seem to be passing PI deviceIntegrity w/o Magisk w/ your ROMs implementation which likely forks the @Displax commits anyway) but cause unexpected surprises for Magisk users...Also, SNF applied to ROMs per @kdrag0n's notes for his Proton ROMs may play well with Magisk USNF module until the latter is updated; seems users may need to wait for their ROM Devs to update inbuilt SNF to match USNF when that occurs...
But now I see your SELinux is set to permissive!?!? Why?
... I'd uninstall XPrivacyLUA also, but note banks often detect this even after uninstalling as it doesn't clean up properly... Removedata/system/xluafolder to prevent this detection...
Also, I'm using the Displax modded USNF
Yes, I found the issue.
The magisk 25.2 is the problem.
I used the magisk 24.1 and manage to resolve the integrity issue except the strong integrity.
As for the selinux to be permissive, it's because the viper4android doesn't work in enforcing under magisk 25.2.
Now that I have changed back to magisk 24.1, viper4android is now worked with enforcing now, so permissive is not needed anymore.
As for XprivacyLua, manage to delete the folder and get applist detector cleared.
But the banking app still manage to find the root.
I tried to use ice box app to freeze magisk, hide my app and greenify but still the same issue.
Is there any solution to bypass?
Attached is the screenshot of detector after ice box freezes those apps.
Attachments
Last edited:
Yes, I know that... I meant is it official custom XiaomiEU or some unofficial build as I asked... But seems you set permissive SELinux yourself... Doubt you'll pass deviceIntegrity easily with that set...
How is 25.2 a problem?
Permissive has not been needed for Viper4AndroidFX for a long while; you don't need old Magisk... And you still didn't describe what mod was used to switch SELinux... If you made system changes you may still have issues after reverting that...I used the magisk 24.1 and manage to resolve the integrity issue except the strong integrity.
As for the selinux to be permissive, it's because the viper4android doesn't work in enforcing under magisk 25.2.
Now that I have changed back to magisk 24.1, viper4android is now worked with enforcing now, so permissive is not needed anymore.
How would I know?... You haven't even named the app!...
PWMy car won't start... How can I solve?... BTW, it's a green one...
PWClue: Read back a bit before posting... PW
Should i disable Revanced module and Substratum? Doesn't seem to be really necessary.
Sorry to further bother you, but I have read the last 3/4 pages and i I have read only about other users with root, but i have the same problem without root.
I get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY, but still wallet says i don't meet safety requirements.
I also have tried with magisk and USNF 2.3.1 Modded but sometimes I get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY and sometimes I don't, like other users earlier
osm0sis
Senior Recognized Developer / Contributor
Why are you in a root module thread if you don't have root. Of course it won't pass without root.
1. It's official custom xiaomi EU.Yes, I know that... I meant is it official custom XiaomiEU or some unofficial build as I asked... But seems you set permissive SELinux yourself... Doubt you'll pass deviceIntegrity easily with that set...
How is 25.2 a problem?
Permissive has not been needed for Viper4AndroidFX for a long while; you don't need old Magisk... And you still didn't describe what mod was used to switch SELinux... If you made system changes you may still have issues after reverting that...
How would I know?... You haven't even named the app!...
2. Yes, understand that viper4android doesn't need to be permissive but I found that it can't run under enforcing anymore since I upgraded to Magisk 25.1 and then to 25.2.
But I saw you got mentioned that it's not easy to pass device integrity with selinux permissive. So I just tried magisk 25.2 again with selinux enforcing, this time, the Cts profile, Device and Basic integrity become Pass except the strong integrity.
And Viper4android status suddenly becomes normal with selinux enforcing.
Previously, I was using selinuxmodechanger app to change selinux, and now, I don't need it anymore.
Not sure which step fixes this viper4android issue that haunted me for 1year
3. The banking app that still detect root is Ocbc Digital- Mobile Banking app(Singapore version). You can try to download the app via link below and test whether can hide from this banking app.
https://ocbc-digital.nl.aptoide.com/app
Attached are the screenshot of the integrity status and selinux changer app.
Attachments
Last edited:
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
4For those using Canary builds
Please be aware that in 25207+ major refactoring (of selinux rule patching) has broken many modules etc... This is likely the cause of issues with hiding using recent builds as Shamiko is affected... Please see discussion in Magisk Discussion thread...
You could revert to 25206 or wait for fixes hopefully in 25211...
PW3
Ok, so NOT intermittently passing only basicIntegrity verdict...
Sounds like the same issues w/ official 2.4.0... Are you sure you actually have v2.4.0-MOD_1.2 @Displax build?
If so, please say device/ROM... Also, suggest reverting to v2.3.1-MOD_3.0... There may possibly still be issues with 2.4.0 builds... Please report your mileage with that if you do... PW3[MODULE] [MOD] Universal SafetyNet Fix
Universal SafetyNet Fix [MOD] Magisk module...
forum.xda-developers.com
3
With Integrity and CTS do you refer to the deprecated SafetyNet or the 'new' Play Integrity API?so I'm on android 13, pixel 6a. Got Integrity
and CTS match and also Play Store as Certified. Although, still no google pay or banks access. Any hints to get this working or it this fix not fully functional on 13 as of yet?
Thanks!
Also, are you using USNF from this thread or the newer/better safetynet-fix-v2.4.0-MOD_1.2 from the other thread?
Look into the other USNF thread from Displax and find more info in the thread about GPay
Btw, banking apps do not rely only on PI API - they try many other detections od root, hence you might need (things vary from app to app) Shamiko, Hide My Applist or even the Magisk Delta fork
The best would be to search through the Magisk related threads here on XDA, how the other user(s) solved the root detection from your particular banking or similar app -
315Universal SafetyNet Fix
Magisk module
Magisk module to work around Google's SafetyNet attestation.
This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS profile attestation, which requires a valid combination of device and model names, build fingerprints, and security patch levels.
If you still have trouble passing SafetyNet with this module, use MagiskHide Props Config to spoof a certified device profile. This is a common issue on old devices, custom ROMs, and stock ROMs without GMS certification (e.g. Chinese ROMs).
Android versions up to 13 Beta 3 are supported, including OEM skins such as Samsung One UI and MIUI.
How does it work?
The way this workaround works is relatively low-level. An in-depth explanation, as well as source code and ROM changes, can be found on GitHub.
Ideally, this workaround should be incorporated in custom ROMs instead of injecting code with a Magisk module. See the ProtonAOSP website for more information.
Downloads
Downloads and changelogs can be found on GitHub. The topmost release is the latest.
Latest release
v2.4.0
Highlights
- Play Integrity bypass without breaking device checks or causing other issues
- Disabled use of hardware attestation on Pixel 7 and newer (@anirudhgupta109)
- Updated instructions for newer Android and Magisk versions
- Better debugging for future development
It's taken a while to find a way to bypass Play Integrity that doesn't require spoofing the build fingerprint permanently, but I wanted to make sure this module doesn't cause any unnecessary breakage. Just like the original goal of Universal SafetyNet Fix, this minimizes adverse effects by spoofing dynamically at runtime only when necessary. Enjoy!
If you found this helpful, please consider supporting development with a recurring donation for rewards such as early access to updates, exclusive behind-the-scenes development news, and priority support.
Alternatively, you can also buy me a coffee. All support is appreciated
Source code213So, here is my modification of USNF with Play Integrity API bypass.
It changes fingerprint to old7.1.26.0 (LOL) and apply it only for GMS SafetyNet process (by Zygisk injection), so your original prints/security path level does not change. This avoids many side effects/problems with global props changing.
Updated 3.0:
No words needed, you understand everything yourself
Updated 2.1:
Hide "Enable OEM Unlock" setting
Updated 2.0:
Bypassing DEVICE_INTEGRITY for devices that shipped with Android 13+ (Pixel`s 7 )
Updated:
Drop fingerprint to lowest possible (6.0) to ensure that no one use same Android version
Usage:
1. Delete/disable/reset MagiskHidePropsConfig (if installed).
2. Just install it over old Universal SafetyNet Fix and reboot device.
3. You may be needed to wipe GMS data (not cache) if there is no result immediately.
Many thanks to @1nikolas for integrity checker.
Source code: https://github.com/Displax/safetynet-fix/tree/integrity58So, here is my new modification of USNF with Play Integrity API bypass.
It is now based on top of original v2.4.0 codebase instead of v2.3.1, with adding new hiding algorithm for current realities and some code refreshing.
Changelog:
Version 1.2
* Fix crash and endless tests loop/failing on Android < 9.0 (bug from original version 2.4.0).
* Do not unpatch (revert) changes. To prevent possible tests failing after a while on some ROMs (cross conflicts).
Version 1.1
* Fix KeyStore hook desynchronization (tests randomly failing problem).
Usage:
1. Delete/disable/reset MagiskHidePropsConfig (if installed).
2. Just install it over old Universal SafetyNet Fix and reboot device.
3. You may be needed to wipe GMS data (not cache) if there is no result immediately.
Source code: https://github.com/Displax/safetynet-fix/tree/dev31Folks, the SafetyNet API was depreciated last Month with 'full turndown' slated for June 2024 and the introduction of the new Play Integrity API. It has also become clear that Google apps are simply the first to adopt the long foretold Play Integrity API; all responsible banks are bound to follow suit in short order, and at least before the June 2023 migration deadline.
This means (assuming fully deployed Hardware Key Attestation doesn't come first
) that the need for a 'Universal Play Integrity Fix' has become quite urgent.
We currently have workarounds involving using older fingerprint props by means of MHPC module (similar to fix needed for uncertified ROMs), but success/mileage varies per device and users of regular bank apps / gamers etc on stock devices will all soon be forced to experiment with MHPC prints also... This is hardly ideal.
So I've made an issue report/request on USNF GitHub as follows. This information may be insightful to users here also...
Please let me know here if I have missed anything important, or add any technically relevant details there...
PLEASE DON'T spam that issue with unimportant details or queries... (The previous issue is already burgeoning w/ OT.) That's what this thread is for...
:
Here's hoping... PW29So, created separate thread for my mod. Welcome)
[MODULE] [MOD] Universal SafetyNet Fix
Universal SafetyNet Fix [MOD] Magisk module...
forum.xda-developers.com
New posts
-
AOSP Android 11.0 – Kernel 4.14 – Yoshino
- Latest: tonsofquestions
-
