MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0

[iwearthebelt]

Some modules will break basicIntegrity and/or deviceIntegrity/old ctsProfileMatch... I don't recall apps doing that, but things change... Please say what app. PW

 

[iwearthebelt]

The app is called Screen2Auto

 

[iwearthebelt]

Asus ROG Phone 3 can pass strongIntegrity verdict rooted and unlocked, so some members can!...

There are always exceptions.


PW

Did not know that you can pass strong integrity with a unlocked bootloader. Last I heard, once you unlock the bootloader, strong integrity cannot be passed.

 

[pndwal]

Did not know that you can pass strong integrity with a unlocked bootloader. Last I heard, once you unlock the bootloader, strong integrity cannot be passed.

Generally that's correct.

... Unless the AVB root/chain of trust is messed up by the OEM!... Nb. ROG phone 3 always returns
- Verified boot state: Verified and
- Device locked: true ...

And this is not just broken keymaster implementation like on so many OnePlus devices ... Seems keymaster is fine so hardware-backed Device locked = true checks out!.. PW

 

[pndwal]

Folks, looks to me like Google is upping the anti for late-ish devices/OS's by somehow preventing ctsProfileMatch from passing with mismatched fingerprints now...Of course PI deviceIntegrity depends on this and thus fails also...

On the other hand, Google still seem to be flipping switches / experimenting, and there are a number of reports that even users of stock phones are having similar failures (Play Protect: Device not certified, G Pay/Wallet suddenly not meeting Security requirements etc) popping up recently on Reddit etc...

Seems for those modders affected, ctsProfileMatch still passes when matching fingerprint prop is used, but w/o the mismatch PI deviceIntegrity doesn't pass any longer...

The strategy for Google now seems to be to come up with ways to enforce hardware-backed verdicts on a per device basis that can't easily be bypassed...

I'm hoping someone will discover a new way to bypass PI API hardware-backed verdict enforcement for devices Google identifies as hardware-ready using fingerprint prop...

May need the best minds on this, and it may get difficult while the Google plays games we aren't expecting... but it wouldn't be the first time!...

Who wants to play&?

PW

 

[Nekromantik]

I not tried paying using my phone yet but on Pixel 7 Pro Stock Feb ROM using Magisk 25.02 with Disaplex USNF MOD 2 and unmount denylist I can add cards to Wallet without error I normally get to say device is not supported.
However I fail CTS check.

 

[zetsumeikuro]

Same, I fail CTF check and MEETS_DEVICE_INTEGRITY and MEETS_STRONG_INTEGRITY and can still add cards and just paid with Google Wallet. Google doing Google things.

 

[LeoPeink]

Pixel 7 here:

I not tried paying using my phone yet but on Pixel 7 Pro Stock Feb ROM using Magisk 25.02 with Disaplex USNF MOD 2 and unmount denylist I can add cards to Wallet without error I normally get to say device is not supported.
However I fail CTS check.

Pixel 7 user here, root with Magisk. No hideprops (device not spoofed), only Universal SafetyNet 2.4.0 and DenyList on Play Store, and i cant get the certified on play protect. Wallet is giving me the "unable to pay contactless on this device".

 

[Nekromantik]

Pixel 7 here:

Pixel 7 user here, root with Magisk. No hideprops (device not spoofed), only Universal SafetyNet 2.4.0 and DenyList on Play Store, and i cant get the certified on play protect. Wallet is giving me the "unable to pay contactless on this device".

I use Denylist Unmount module and dont enforce denylist and also hide the magisk app.

 

[LeoPeink]

I use Denylist Unmount module and dont enforce denylist and also hide the magisk app.

Could you please provide details? I pass basic integrity check, but not CTS. I can pass CTS as for this tutorial, but in minutes the denylist for Play Services unchecks itself and i'm back to failing CTS check.

 

[rubnduardo]

Pixel 7 here:

Pixel 7 user here, root with Magisk. No hideprops (device not spoofed), only Universal SafetyNet 2.4.0 and DenyList on Play Store, and i cant get the certified on play protect. Wallet is giving me the "unable to pay contactless on this device".

I had been using contactless gpay with no issue till yesterday, did not even used denylist. I updated the module, still didn't work. I added gpay to denylist and voilà, it worked. CTS is not passed but it doesn't mean anything to me, not yet. Remember restarting after doing any changes.

 

[Sasy969]

Same, I fail CTF check and MEETS_DEVICE_INTEGRITY and MEETS_STRONG_INTEGRITY and can still add cards and just paid with Google Wallet. Google doing Google things.

Same, I only get MEETS_BASIC_INTEGRITY, but I cannot add cards or pay with Wallet, because my device doesn't meet the safety requirements

 

[LeoPeink]

I had been using contactless gpay with no issue till yesterday, did not even used denylist. I updated the module, still didn't work. I added gpay to denylist and voilà, it worked. CTS is not passed but it doesn't mean anything to me, not yet. Remember restarting after doing any changes.

Google Wallet (and Play Store) are not fooled by the Universal Safety Fix for me. It does not matter if i pass or not integrity tests, they just know

 

[rubnduardo]

Google Wallet (and Play Store) are not fooled by the Universal Safety Fix for me. It does not matter if i pass or not integrity tests, they just know

Must be device specific. I'm on p3xl.

 

[Nekromantik]

Could you please provide details? I pass basic integrity check, but not CTS. I can pass CTS as for this tutorial, but in minutes the denylist for Play Services unchecks itself and i'm back to failing CTS check.

I do not pass CTS check either but I can add cards to Wallet without issue. Its not related for me.

 

[seanho12345]

Same, I only get MEETS_BASIC_INTEGRITY, but I cannot add cards or pay with Wallet, because my device doesn't meet the safety requirements

Same for me on pixel 7 right now. With USNF 2.3.1-mod2.1 installed.

 

[Sasy969]

Same for me on pixel 7 right now. With USNF 2.3.1-mod2.1 installed.

Yep, it appears to be a common problem due to something Google made

 

[ddrum2000]

Ok so I

I can't find 2.4.0 even on his GitHub... He lists v2.3.1-MOD_2.1 as latest!... Or check here:
https://forum.xda-developers.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87198517


Have you got G Pay and Wallet appearing together?... Did you update G Pay to Wallet from Play Store or other?...

Take Play Protect service out as discussed...

Try above changes, then we may need to figure out fix for ctsProfileMatch and deviceIntegrity..

Ok so here's what I did:

1. Changed to 2.3.1 mod 2.1
2. Reboot
3. Uninstalled/uninstall updates and clear storage for: gpay, wallet, play services, play protect, and play store
4. Remove all of the above from the denylist
5. Reboot
6. reinstall/update: gpay, wallet, play services
7. Run gpay and wallet to get them to "integrate" . Wallet app did not disappear like it had previously
8. Have not added any of these back to denylist
9. Fails cts, passes basic, fails device and Strong

Am I now at the point that I'm having the same issue as everyone else?

 

[5riram]

I'm using safetynet fix 2.4.0 by anirudhgupta109 on my Pixel 7 on rooted Android 13. I've been on version 2.3.1 for months starting November and Google Wallet worked fine until today. I don't know what changed but I tried a lot of the suggestions on this thread (like using 2.3.1 mod 2.1, configuring the denyList etc) but nothing worked.

Is there a current fix to get google wallet/gpay working?

 

[iwearthebelt]

I'm using safetynet fix 2.4.0 by anirudhgupta109 on my Pixel 7 on rooted Android 13. I've been on version 2.3.1 for months starting November and Google Wallet worked fine until today. I don't know what changed but I tried a lot of the suggestions on this thread (like using 2.3.1 mod 2.1, configuring the denyList etc) but nothing worked.

Is there a current fix to get google wallet/gpay working?

View attachment 5831159

No new fix as of yet. I'm having the same issue as you. It started after updating to the February release on my Pixel 6 Pro. There were also a few Google app updates that may have contributed to it as well. I know there are some developers working on it already but who knows how long it will be before they figure something out. Guess I'll be using my debit card instead of tap and pay for a while.