MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0

[pndwal]

Ok so what am I missing here. I cleared the storage for gpay, wallet, and play services, then rebooted. Here's what I got...
View attachment 5830633
My enabled modules
View attachment 5830637

Then the denylist...
View attachment 5830635

Then I try to add a card in wallet
View attachment 5830639

What am I missing? Thanks for the help.

Very suspicious USNF fork... Doesn't even credit @kdrag0n!? ... Dev doing their own thing at best...

And you seem to have missed my response to you :

Did you have this passing previously?...

Yes?... No?...

Is ROM stock?...

Yes?... No?...

You don't need Play Store in denylist... Keep Play Protect Service...

... Where did that go? Edit: Actually I mis-remembered this... Don't add this here, but you may need to clear Play Protect Service's data later to restore Play Protect Device is Certified in Play Store...

Other than that, only bank and detection apps + GPay/Wallet are normally added...

Try passing PI deviceIntegrity

Where is Play Integrity check result?... G Pay/Wallet isn't called SafetyNet API anymore since it's depreciated...

with all modules disabled other than one of @Displax's USNF Mod builds,

So why the dubious USNF???

denylist enforced and Zygisk = Yes appearing on Magisk App home screen... PW

Have you checked these?... PW

 

[pndwal]

I can't see Google Play Services in your DenyList. I would say this needs to be added...

DON'T do this ever with denylist enforced... With Shamiko USNF can function with that, but shouldn't be needed as USNF hides root from gms attestation/droidguard service/process itself...

 

[Fishawy]

DON'T do this ever with denylist enforced... With Shamiko USNF can function with that, but shouldn't be needed as USNF hides root from gms attestation/droidguard service/process itself...

Always using Shamiko & "Enforce DenyList" disabled.

Is Shamiko alone enough without adding GMS to DenyList? I didn't know that.

 

[ddrum2000]

Very suspicious USNF fork... Doesn't even credit @kdrag0n!? ... Dev doing their own thing at best...

And you seem to have missed my response to you :

Yes?... No?...

Yes?... No?...

... Where did that go?

Where is Play Integrity check result?... G Pay/Wallet isn't called SafetyNet API anymore since it's depreciated...

So why the dubious USNF???

Have you checked these?... PW

Ok so:

• I saw a post here referring to that module. I was using the original kdrag0n for years prior to changing it today. Which do you recommend moving forward?
• prior to a few days ago and applying the most recent Pixel 6a OTA it worked great
• I'm using the stock Pixel ROM except for rooting to run AdAway. No other additions or changes
• I'm getting differing feedback about the denylist but I will include gpay, wallet, play protect but remove play services from the denylist. Is that correct?
• How should I check the PI?
• Denylist is enforced and zygisk is yes. Magisk app is in the app drawer. I don't have it on the home screen so I'm not quite sure what you are referring to here.

Thanks for the patience and the help.

 

[Nergal di Cuthah]

I'm using the stock Pixel ROM except for rooting to run AdAway. No other additions or changes

Are you using any extra sources in adaway? Just for s**** and giggles try with the default hosts (no blocking) in adaway. Maybe one of the hosts sources is blocking something needed? Shot in the dark but maybe. I seem to have stable integerity with a similar setup (rooted for adaway no extra doodads, p6p) but dont google wallet/pay so I've kept quiet to this point

 

[ddrum2000]

Ok so:

• I saw a post here referring to that module. I was using the original kdrag0n for years prior to changing it today. Which do you recommend moving forward?
• prior to a few days ago and applying the most recent Pixel 6a OTA it worked great
• I'm using the stock Pixel ROM except for rooting to run AdAway. No other additions or changes
• I'm getting differing feedback about the denylist but I will include gpay, wallet, play protect but remove play services from the denylist. Is that correct?
• How should I check the PI?
• Denylist is enforced and zygisk is yes. Magisk app is in the app drawer. I don't have it on the home screen so I'm not quite sure what you are referring to here.

Thanks for the patience and the help.

update: I figured out how to do a PI check. It passes basic but fails device and strong. What are the next steps?

 

[ddrum2000]

Are you using any extra sources in adaway? Just for s**** and giggles try with the default hosts (no blocking) in adaway. Maybe one of the hosts sources is blocking something needed? Shot in the dark but maybe. I seem to have stable integerity with a similar setup (rooted for adaway no extra doodads, p6p) but dont google wallet/pay so I've kept quiet to this point

Also i tired disabling Adaway, it doesn't change anything

 

[pndwal]

Ok so:

• I saw a post here referring to that module. I was using the original kdrag0n for years prior to changing it today. Which do you recommend moving forward?

Any @Displax modded build (since 2.4.0 needs fixing) as I said... Check what else was said about the other fork above... @Displax contributes to official USNF and provided the basic pull request for Play Integrity deviceIntegrity fix in official USNF... That should tell you something...

• prior to a few days ago and applying the most recent Pixel 6a OTA it worked great

You may have been passing PI deviceIntegrity before that... I do with standard USNF, but with A11+ updates especially, many devices need extra prop changes to bypass PI API's hardware based verdict enforcement...

• I'm using the stock Pixel ROM except for rooting to run AdAway. No other additions or changes

• I'm getting differing feedback about the denylist but I will include gpay, wallet, play protect but remove play services from the denylist. Is that correct?

Actually I edited my response above on this; please check again... Generally include Pay/Wallet and bank apps only...

• How should I check the PI?

Play Integrity API Checker... Pass deviceIntegrity, don't try to pass strongIntegrity...

• Denylist is enforced and zygisk is yes.

• Magisk app is in the app drawer. I don't have it on the home screen so I'm not quite sure what you are referring to here.

... I said check/report:

denylist enforced and Zygisk = Yes appearing on Magisk App home screen...

... and you've now confirmed Zygisk = Yes appears on Magisk App home screen.

Thanks for the patience and the help.

Welcome... PW

 

[pndwal]

update: I figured out how to do a PI check. It passes basic but fails device and strong. What are the next steps?

Go through what I suggested... Install a Display USNF build... He has a post with 3 here... Clear Google Play Services and Google Play Protect Service data then reboot... Report PI check results... PW

 

[ddrum2000]

Go through what I suggested... Install a Display USNF build... He has a post with 3 here... Clear Google Play Services and Google Play Protect Service data then reboot... Report PI check results... PW

• I used his 2.4.0 selfbuild unless you are saying I should go back to 2.3.1? This is listed as by kdrag0n in the modules
• denylist = gpay, wallet, play protect
• I'm now failing safetynet CTS profile match
• PI - pass basic, fails device and strong
• I can't add a card in wallet

 

[pndwal]

• I used his 2.4.0 selfbuild unless you are saying I should go back to 2.3.1? This is listed as by kdrag0n in the modules

I can't find 2.4.0 even on his GitHub... He lists v2.3.1-MOD_2.1 as latest!... Or check here:
https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87198517

• denylist = gpay, wallet, play protect

Have you got G Pay and Wallet appearing together?... Did you update G Pay to Wallet from Play Store or other?...

Take Play Protect service out as discussed...

• I'm now failing safetynet CTS profile match
• PI - pass basic, fails device and strong
• I can't add a card in wallet

Try above changes, then we may need to figure out fix for ctsProfileMatch and deviceIntegrity... PW

 

[iwearthebelt]

Not sure if this will help or not but for the last couple of weeks Play Protect has been harassing me about uninstalling an app that I downloaded to play video on my car's infotainment center using android auto. Ever since I updated to the February release yesterday I haven't been able to use tap and pay and also I was failing device integrity. I uninstalled the app I was using (not by choice) and now I'm passing device integrity and can use tap and pay. I haven't rebooted since getting back device integrity and although I'm going to have to I'm pretty sure it should be fine. Just thought I'd provide this information hoping it will help you figure out your issue as well.

 

[iwearthebelt]

BTW, you'll never pass strong integrity with a rooted device, no one can.

 

[pndwal]

Not sure if this will help or not but for the last couple of weeks Play Protect has been harassing me about uninstalling an app that I downloaded to play video on my car's infotainment center using android auto. Ever since I updated to the February release yesterday I haven't been able to use tap and pay and also I was failing device integrity. I uninstalled the app I was using (not by choice) and now I'm passing device integrity and can use tap and pay. I haven't rebooted since getting back device integrity and although I'm going to have to I'm pretty sure it should be fine. Just thought I'd provide this information hoping it will help you figure out your issue as well.

Some modules will break basicIntegrity and/or deviceIntegrity/old ctsProfileMatch... I don't recall apps doing that, but things change... Please say what app. PW

 

[pndwal]

BTW, you'll never pass strong integrity with a rooted device, no one can.

Asus ROG Phone 3 can pass strongIntegrity verdict rooted and unlocked, so some members can!...

There are always exceptions.

Still all good on rooted ROG 3View attachment 5781257

PW

 

[linus207]

So has anything changed in recent days? My pixel 6 pro after the February 2023 update said that it no longer meets MEETS_DEVICE_INTEGRITY and I can't restore it either with version 2.3.1 or 2.4.0.

 

[crypticc]

Hi,

Similar to the chat above I used to pass safetynet and now do not. Google play and YASNTC both reports CTS profile match failure. Wallet etc don't work.

I'm this build of full stock Android... TQ1A.221205.011

I originally had this config:

1. Magisk latest app and root (25206)
2. Running in Zygote,
3. USNF 2.3.1_MOD 2.1
4. Shamiko 0.6 (126)
5. Enforce Deny list disabled (as per Shamiko instruction)
6. Deny list including :

• Google Play Protect,
• Google Play Services (I've tried both with and without this)
• Google wallet
• Banking and media apps

I tried updating to 2.4.0 before reading above suggestions that 2.3.1 might be better but clearing Data for above apps and then rebooting still didn't pass checks.

I've now gone back to 2.3.1_MOD 2.1, clear, reboot, clear, reboot etc. and still not working.
I've tried uninstalling updates to play protect and play store.

Finally I've since found app called com.android.systemui.globalactions.wallet but adding that doesn't do anything.

Any help appreciated,

Thanks,
Chris

 

[shoey63]

Asus ROG Phone 3 can pass strongIntegrity verdict rooted and unlocked, so some members can!...

There are always exceptions.


PW

Not anymore!


Had to go back to original fingerprint to get Yasnac to pass HARDWARE_BACKED attestation by disabling MHPC.

So . . .
- Fingerprint is original
- Bootloader appears locked even though it is unlocked (ROG 3 peculiarity)
- Shamiko is taking care of other sensitive props.
- GMS/GMS unstable is disabled in (hidden) deny list.

Can we conclude Google is picking up on attempts to hide other sensitive props?

 

[seanho12345]

I'm currently on Pixel 7. My CTS profile match and DEVICE_INTEGRITY isn't working anymore. Tried a few time clearing GAPPS with v2.3.1-MOD2.1 installed. Here are my magisk setup.
For some context, I was fiddling around with the magisk mod yesterday after seeing the new integrity api. After installing the mod, DEVICE_INTEGRITY worked but inconsistent. (At this time, I have both the modded USNF and MHPC installed) Seeing that the changes will be offically released in the original USNF. I installed back v2.4.0 USNF. After that the SN and PI api check no longer works, except it worked one time and failing immediately afterwards.
Is there any possibilities that the MHPC somehow have left some old settings on my device? I also update my OS to the latest Feb patch but still no luck.

 

[pndwal]

Not anymore!
View attachment 5830841View attachment 5830843
View attachment 5830881
Had to go back to original fingerprint to get Yasnac to pass HARDWARE_BACKED attestation by disabling MHPC.

Haha! ... But your device / efforts keeps giving valuable clues!...

And I'm betting you'll restore strongIntegrity rooted because Root of trust still returns Device locked: true w/ Verified boot state: Verified...

So . . .
- Fingerprint is original

This should be fine... You never needed the PI hardware-based verdict enforcement bypass that is mismatched fingerprint prop anyway. ... Were you changing it for some particular reason?

- Bootloader appears locked even though it is unlocked (ROG 3 peculiarity.

- Shamiko is taking care of other sensitive props.
- GMS/GMS unstable is disabled in (hidden) deny list.

Can we conclude Google is picking up on attempts to hide other sensitive props?

Maybe... May need more now (and must figure out which)... Or MHPC may have handled sensitive props differently... Nb. MHPC does this by default, without configuring anything... So I'd try restoring MHPC w/o fingerprint changes...

If you only configured fingerprint, you could activate again and revert to stock print... Or if you made many MHPC changes, fully remove the module and reboot before installing and rebooting again w/o configuring anything... 'MagiskHide props' should be active by default to adjust sensitive props as needed...

You could also try disabling Shamiko (enforce denylist, but don't just deactivate Shamiko Zygisk parts this way, disable Shamiko module properly also before rebooting) after trying with MHPC in case Shamiko's sensitive prop adjustment method is the issue or part of it...

Also, sometimes clearing Play Services data is needed to fix some attestations... Do that too...

Please say/remind me of
- ROM (stock?),
- Android version,
- anything in denylist aside from 2 gms processes and banks + G Pay/Wallet?,
- all modules...

May think of other considerations later, but that's all I have for now... PW