MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0

[fkofilee]

Wow, yes... We have a major problem Huston...

I Hadn't noticed this till two days ago... Google Wallet was working for contactless payments at lunch, but for coffee afterwards it failed with 'device doesn't meet security requirements'... (FWIW, I may have rebooted phone during lunch...)

Checked and deviceIntegrity was good, but immediately after a reboot got failed verdict and minutes later all is good again...

FYI Google Pay/Wallet somehow monitors device security even while app is closed (likely Google gets telemetry if lockscreen pattern/password is removed, deviceIntegrity is lost, etc), and contactless fails on next use... This occurs after bad device integrity verdicts, or if a user disables lockscreen pin or pattern... even if this is restored before opening Google Pay/Wallet, bank cards may have already been removed... So even brief loss of deviceIntegrity at startup is catastrophic for G Pay / Wallet!

To avoid intermittent Play Integrity failures I've reverted to @Displax modded USNF also; all seems good and can't reproduce failed verdict...

To fix G Wallet however, despite knowing it would likely just come right in about a week, I tried the immediate fix as it's worked for me in the past:

...Bit of a saga begins...​

Uninstalled wallet, cleared Google Pay and Google Play Services data, rebooted, installed wallet again only to get the familiar "Google Pay is Currently Updating..." Screen that never goes away! .... No problem... I covered a fix for this in "Current fixes needed for Google Pay / Wallet" linked here:
Post in thread '[Discussion] Google Pay Magisk Discussion Thread' https://forum.xda-developers.com/t/...agisk-discussion-thread.3906703/post-87481637

... Tried both clearing data and rebooting as well as uninstalling/reinstalling and nothing worked this time!... Still stuck on updating screen!

Finally resolved after removing all Play Store and Play Services updates, clearing their caches only, uninstalling Google Pay (even latest version doesn't show as 'Wallet' until online 'App is updating...' completes), rebooting, re-installing Google 'Wallet' --> Finally G Pay opens and updates to Wallet successfully!... No more security issue for contactless payments since reverted to @Displax modded USNF...

...End of Saga...​

But this part-time spoofing based on new hooks is only for fingerprint prop mismatch (for some devices on Google's list for HKA based verdict enforcement in PI API) AFAIK ... My device (Xiaomi RedMi Note 8T w/ stock MIUI A10) like many A8, 9 & 10 devices, actually needs none of the three prop based bypasses we now have to pass either S/N or PI deviceIntegrity; I do need the principal broken keystore based fallback to Basic attestation to pass these however...

Because of this, I think the issue is something other than temporary fingerprint prop spoofing... Could it be that the fake keystore is registered so late that I can run Play Integrity API Checker before it breaks HKA?...

Anyone else had G Pay/Wallet failing after installing USNF 2.4.0?...

PW

Yes sir. Same here - Uninstalled GW, wiped Google Store and Play Services. Disabled 2.4.0, pulled the modded version from @Displax and installed then rebooted. Downloaded GW - Added cards and all good. For now...

 

[Displax]

You just need to edit the service script after installing the module.

No need to edit, this change already present in my MOD

 

[rafal.polska.b]

I wasn't able to add bank card to the Wallet.
Using Magisk Alpha which is hidden,
Google Play Services and Google Play Store added to DenyList,
Shamiko and Universal SafetyNet Fix 2.4.0 are installed,
Play Integrity API Checker says Device and Basic Integrity pass,
YASNAC says Basic integrity and CTS profile match both pass
I have clear data for Google Play Services, Google Play Store and for Wallet, phone rebooted but still getting: "Couldn't finish setup to pay in stores. This phone can't be used to pay in stores"

Then I have uninstalled USNF 2.4.0, reboot, installed safetynet-fix-v2.3.1-MOD_2.1.zip and finally bank card added to the Wallet.

 

[pndwal]

Hey.
So with all modules (including USNF) the safetynet and PI Integrity shows "Not passed" (Duh).
The MOMO shows just that it found the SU folder and detected Magisk.
When everything excluding the @Displax modded USNF is turned off (and also Play Services data cleared) the results are on the screenshots below. Note: Deny list is enforced and only Google Wallet and some banking apps are added, nothing more.
YASNAC passes with flying colours. The device integrity in 2 apps fail to be checked and return UNEVALUATED results. Json is also attached.
What's baffling is that even now, the Google Wallet worked (I checked it now in the supermarket terminal).

Yes, I missed something in JSON... While Unevaluated results DO NOT apply to deviceIntegrity as I mentioned already (These are for appIntegrity - appRecognitionVerdict and accountDetails - appLicensingVerdict ... These are different signals from deviceIntegrity within the new Play integrity verdict), I'm no longer sure deviceIntegrity is actually supplying a proper response since while documentation says "device_recognition_verdict can have one of the following labels:
MEETS_DEVICE_INTEGRITY
No labels (a blank value)
MEETS_BASIC_INTEGRITY
MEETS_STRONG_INTEGRITY
MEETS_VIRTUAL_INTEGRITY"
the value"deviceRecognitionVerdict": generally appears before labels, and that is missing altogether...
https://developer.android.com/google/play/integrity/verdict#device-integrity-field

Of course a blank value is really No label as seen above, so
"deviceIntegrity": {},
may still be a properly evaluated response... I'm just not sure...

I'm still leaning towards the latter being the case, but I'm equally confused by working Wallet/contactless payments...

do JSON results change now modules are removed w/ a flush of Play Services data?

Nb. If deviceIntegrity correctly = blank/no label, this is what is indicated:

No labels (a blank value)

The app is running on a device that has signs of attack (such as API hooking) or system compromise (such as being rooted), or the app is not running on a physical device (such as an emulator that does not pass Google Play integrity checks).

and it is clearly a more sensitive detection than old basicIntegrity for S/N... and this is why I mentioned:

Anyway, it seems something is now breaking PI's more sensitive basicIntegrity verdict... Again, please report check w/ all modules disabled except USNF... This user also had passing S/N but failing PI basicIntegrity due to modules on OnePlus 7 device w/ stock ROM:
https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87891641

Also, please check your selinux status is enforcing regardless of results disabling modules... (Are you a viper4android user?)... PW

Apart from permissive SELinux, you may break system partition/digest checks if you have ever run ANY system mods (even changing simple file permissions), eg twrp flashable mods etc, and even if you have fully reverted these, on current ROM... If you suspect this, flashing system again should fix...PW

 

[pndwal]

I wasn't able to add bank card to the Wallet.
Using Magisk Alpha which is hidden,
Google Play Services and Google Play Store added to DenyList,
Shamiko and Universal SafetyNet Fix 2.4.0 are installed,
Play Integrity API Checker says Device and Basic Integrity pass,
YASNAC says Basic integrity and CTS profile match both pass
I have clear data for Google Play Services, Google Play Store and for Wallet, phone rebooted but still getting: "Couldn't finish setup to pay in stores. This phone can't be used to pay in stores"

Then I have uninstalled USNF 2.4.0, reboot, installed safetynet-fix-v2.3.1-MOD_2.1.zip and finally bank card added to the Wallet.

Thanks for your experience/confirmation per recent discussion here!... My initial experience here:
https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-88049087

PW

 

[pndwal]

I have tried again and now i fail all three integrity check as can been seen in the screenshot below.
Current setup
OP9
Magisk installed
Custom ROM Evox
No USNF module installed
com.google.android.gms.unstable and com.google.android.gms added to the denylist

Ah, ... And that I suggested you add these slipped my mind when I responded:

That's interesting... Did you add, or does ROM add?... And if you remove them, are the added again with reboot?

I ask because USNF removes these at boot if manually added as they'll cause conflicts w/ USNF if denylist is enforced... (There's no conflict if proper hiding using Shamiko etc is employed however.)

If they're added at boot by ROM, this may be the source of the conflict w/ USNF module... Simply allowing that to happen but using Shamiko (denylist NOT enforced) may possibly fix issue with USNF installed...

so please disregard that unless ROM is also pre-rooted as of course ROM won't/can't usually do that... It doesn't need to hide root from gms attestation/droidguard as superuser permission doesn't exist... Could still be an issue in case of pre-rooted ROM however....

Seems something is breaking PI deviceIntegrity spasmodically for you however... Please see my post to member above for clues...

Adding gms processes to the denylist will do nothing unless you are enforcing the denylist or using another module that sources the denylist.

Yup, but member was passing like that:

... I have just tried following you suggestions and I have eliminated USNF module.
com.google.android.gms.unstable and com.google.android.gms were already added to the denylist.
At least for now my device get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY.
I will try again during the day, for now I thank you for your help and apologize for my poor knowledge.

but when trying again later on same day it failed... I assume no configuration was charged...

If your rom incudes integrity (SafteyNet) fix(s).

It does...

Try enforcing the denylist in Magisk and see what happens.

Member did...

Note:
Make sure to clear cache/data of PI checker before testing again.

I've never had this or most other checkers cache results... I may be wrong however...

Might also have to clear cache/data of PlayStore/PlayServices and let them update again.

Good points...

SafetyNet (com.google.android.gms.unstable) is required.
Main GMS (com.google.android.gms) is only required if Magisk is not in /sbin.
It can/will cause problems if GMS is added when not required.

I only suggested doing this, which has worked at least initially, w/ Magisk installed but NO USNF module...

This alone is generally needed for ROMs integrating SNF w/ Magisk installed since SNF is achieving needed fallback and enforcement bypasses as well as altering sensitive prop values, but not generally hiding root from gms attestation/droidguard process etc... I assume a pre-rooted ROM would need to do that itself also however if integrating SNF...

PW

 

[thomas140]

All good for you now then re deviceIntegrity then... Expected results...

Is it Viper4AndroidFX?... I think you only have issues with Neon driver only when installing/changing to legacy mode... If you didn't reinstall V4A you shouldn't have the issue...

You just need to reset Neon driver when selecting legacy mode... When you reinstall in future or have driver = abnormal, just set legacy mode, disable the module, reboot, re-enable module and reboot again... driver should have reset and status should now be Normal...

I wasn't able to hide root/modified environment from this app with my setup... Sorry... PW

Hi again,
Just to update something here.
1. I manage to access the banking app with rooted poco f1 after so long.
I installed the Shamiko module and turned off the enforce denylist. Voila, all banking app issue resolved!!!

2. I found that there is an app become forced closed if I root. When dirty flash back the same rom and become unroot, the app can be opened as per normal.

Do you face such kind of issue before?
Btw, the app is called TNG ewallet. It is a Malaysia app used by many Malaysian people here.

 

[pndwal]

Hi again,
Just to update something here.
1. I manage to access the banking app with rooted poco f1 after so long.
I installed the Shamiko module and turned off the enforce dentist. Voila, all banking app issue resolved!!!

2. I found that there is an app become forced closed if I root. When dirty flash back the same rom and become unroot, the app can be opened as per normal.

Do you face such kind of issue before?
Btw, the app is called TNG ewallet. It is a Malaysia app used by many Malaysian people here.

1) Interesting...

The banking app that still detect root is Ocbc Digital- Mobile Banking app(Singapore version). You can try to download the app via link below...
https://ocbc-digital.nl.aptoide.com/app

I wasn't able to hide root on RN8T w/ Shamiko for this, however
2) Have no issues opening TNG eWallet using LSPosed and HMA module... See here:
https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87873291

PW

 

[DartGerion]

Yes, I missed something in JSON... While Unevaluated results DO NOT apply to deviceIntegrity as I mentioned already (These are for appIntegrity - appRecognitionVerdict and accountDetails - appLicensingVerdict ... These are different signals from deviceIntegrity within the new Play integrity verdict), I'm no longer sure deviceIntegrity is actually supplying a proper response since while documentation says "device_recognition_verdict can have one of the following labels:
MEETS_DEVICE_INTEGRITY
No labels (a blank value)
MEETS_BASIC_INTEGRITY
MEETS_STRONG_INTEGRITY
MEETS_VIRTUAL_INTEGRITY"
the value"deviceRecognitionVerdict": generally appears before labels, and that is missing altogether...
https://developer.android.com/google/play/integrity/verdict#device-integrity-field

Of course a blank value is really No label as seen above, so
"deviceIntegrity": {},
may still be a properly evaluated response... I'm just not sure...

I'm still leaning towards the latter being the case, but I'm equally confused by working Wallet/contactless payments...

do JSON results change now modules are removed w/ a flush of Play Services data?

Nb. If deviceIntegrity correctly = blank/no label, this is what is indicated:


and it is clearly a more sensitive detection than old basicIntegrity for S/N... and this is why I mentioned:


Apart from permissive SELinux, you may break system partition/digest checks if you have ever run ANY system mods (even changing simple file permissions), eg twrp flashable mods etc, and even if you have fully reverted these, on current ROM... If you suspect this, flashing system again should fix...PW

Hey
Thank you for the reply. With all modules removed the JSON is same, only with "nonce" value changed.
I haven't installed the TWRP (No twrp for my phone), however i've used a Magisk module that tweaks some stock kernel issues. I've already deleted the module, but apparently the traces are what causing this issue.
I think i need to look into flashing the stock ROM, and trying again with Magisk and modded USNF.

 

[thomas140]

1) Interesting...

I wasn't able to hide root on RN8T w/ Shamiko for this, however
2) Have no issues opening TNG eWallet using LSPosed and HMA module... See here:
https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87873291

PW

Under LSPosed, I have HMA and Greenify.

In HMA, I added Greenify, HMA & hidden magisk app named WWE . But TNG app still forced closed. (Can refer to screenshot)
Wonder where did I do wrong though.

As for the root, that's what I did:
Under Magisk
- turn off enforce denylist
- Shamiko 0.6
- the modded usnf you recommended.
- zygisk lsposed 1.8.6

You may refer my screenshot to check where is the missing one. I can access to banking app even though the applist detector showed as attached.

 

[pndwal]

Under LSPosed, I have HMA and Greenify.

In HMA, I added Greenify, HMA & hidden magisk app named WWE . But TNG app still forced closed. (Can refer to screenshot)
Wonder where did I do wrong though.

As for the root, that's what I did:
Under Magisk
- turn off enforce denylist
- Shamiko 0.6
- the modded usnf you recommended.
- zygisk lsposed 1.8.6

You may refer my screenshot to check where is the missing one. I can access to banking app even though the applist detector showed as attached.

Detector should look like this:

Greenify, HMA & hidden magisk app (named WWE) should be in a template used, in turn, for bank apps since you need to hide all these (especially Magisk) from banks!

You don't need them in App Manage list since there's no need to hide other apps from them... PW

 

[thomas140]

Detector should look like this:
View attachment 5823555

Greenify, HMA & hidden magisk app (named WWE) should be in a template used, in turn, for bank apps since you need to hide all these (especially Magisk) from banks!

You don't need them in App Manage list since there's no need to hide other apps from them... PW

Well, I manage to use banking software with the applist detector incomplete result as shown in my screenshot earlier.

I tried your suggestion. Put magisk, hma, greenify in the blacklist template to be invisible, put TNG app into app manage.
Apparently, the issue still persists.
Also, I have put the application detector in the app manage as well. The result is thay it can't find all these 3 app, meaning that the hma module is working

 

[pndwal]

Hey
Thank you for the reply. With all modules removed the JSON is same, only with "nonce" value changed.
I haven't installed the TWRP (No twrp for my phone), however i've used a Magisk module that tweaks some stock kernel issues. I've already deleted the module, but apparently the traces are what causing this issue.
I think i need to look into flashing the stock ROM, and trying again with Magisk and modded USNF.

If you suspect any system changes (as opposed to systemless) changes/mods have been applied, even dirty flashing ROM may fix the issue... PW

 

[Bxperiaz3]

My pixel 7 pro is rooted since October. Always used this module without issue and then yesterday it blocked contact less Google pay, I used magisk to hide extra play services parts and cleared the play store cache. Was ok for a few taps and now I have the same issue again. Is there something else I can try?

 

[Nergal di Cuthah]

My pixel 7 pro is rooted since October. Always used this module without issue and then yesterday it blocked contact less Google pay, I used magisk to hide extra play services parts and cleared the play store cache. Was ok for a few taps and now I have the same issue again. Is there something else I can try?

Which version are you using, official or mod?

 

[Bxperiaz3]

Which version are you using, official or mod?

Of this module? Official. 2.4.0

 

[Nergal di Cuthah]

Of this module? Official. 2.4.0

Read above some, 2.4.0 is randomly dropping protection for some.

 

[xabier-bo]

It's not my intention to double post, but maybe it's more relevant here what I wrote in other thread

Couple of weeks ago I found strange "card rejected" messages while paying with gwallet. But immediately, after the first failing attempt it was accepted.

Then I read the posts here sharing new problems, while everything had been working fine until now.

So I checked the gwallet app (I never look at it), and discovered it was complaining with the "old" message: this device doesn't meet...

I wiped apps caché (google play and gwallet), rebooted, got a first complaint of not meeting requirements, but closing and reopening the app made it disappear.

So, I decided a more "conclusive" approach. I went to the supermarket and payed with the gwallet without any problem.

So, this is my situation: I've had to downgrade nothing, I've kept USFN v2.4.0 by kdrag0n, and I'm paying with gwallet.

Hope it's helpful for your "diagnosis"

 

[pndwal]

It's not my intention to double post, but maybe it's more relevant here what I wrote in other thread

Couple of weeks ago I found strange "card rejected" messages while paying with gwallet. But immediately, after the first failing attempt it was accepted.

Then I read the posts here sharing new problems, while everything had been working fine until now.

So I checked the gwallet app (I never look at it), and discovered it was complaining with the "old" message: this device doesn't meet...

I wiped apps caché (google play and gwallet), rebooted, got a first complaint of not meeting requirements, but closing and reopening the app made it disappear.

So, I decided a more "conclusive" approach. I went to the supermarket and payed with the gwallet without any problem.

So, this is my situation: I've had to downgrade nothing, I've kept USFN v2.4.0 by kdrag0n, and I'm paying with gwallet.

Hope it's helpful for your "diagnosis"

The failures with 2.4.0 may be random, often occuring with a reboot...

Google monitors device security for G Pay/Wallet full time, so whether PI deviceIntegrity fails momentarily or user removes lockscreen pattern/password and immediately restores it, Pay/Wallet will likely lock out contactless payment use even while Pay/Wallet is not in use and either require resetting (clearing data for Pay/Wallet and/or Play Services) or will be restored after some time...

We need a fix for detections in official solution, but @Displax modded USNF builds are not failing this way and are working fine for most users ATM. PW

 

[bangrod]

Yes sir. Same here - Uninstalled GW, wiped Google Store and Play Services. Disabled 2.4.0, pulled the modded version from @Displax and installed then rebooted. Downloaded GW - Added cards and all good. For now...

Does the modded version work with Magisk v23 do you know?