osm0sis
Senior Recognized Developer / Contributor
Must be an A/B test, since my device is still doing fine with MOD 2.1.
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
- Thread starter kdrag0n
- Start date
TotallyAnxious
Senior Member
Well crap, this is the first I'd seen of Play Integrity, and I fail all 3 of those checks. I guess I need to start digging into what's happening there. Very strange that this just randomly popped up. Anyway thanks for the help.
I've written a pretty comprehensive article here that should help clarify things.
Just read through and then skipped to the end. Seems like something may have changed over the course of the past couple days given that people are seeing it break randomly. Hopefully a better understanding of how to pass the checks more reliably is gained in the near future, because it sounds like right now there's no definite way to fix it in the same way we worked around safetynet.
All these USF mods drain my battery badly. They create a wakelock. Noticed it before in pixel 6 and tab s7.
I had the same issue, it will disappear after the first time you opened the wallet. It shouldn't show that message again.
I'm not sure how i got both because this was not previously the case. I'm in the USA.
You're correct - Wallet only gives the one pop-up, but it still seems to be detecting an issue with Play Integrity, which is unsurprising because I currently am failing all 3 of the Play Integrity checks.
Have you checked your Play Integrity? And have you checked in the Wallet menus to see if it still shows the message I mentioned?
Well, as @pndwal pointed out, Google appears to still be tinkering with the inner workings of the Play Integrity API, as he described here. Up until this point, PI only seemed to evaluate the profile/fingerprint of the device, and accept basic vs hardware-backed attestation as is. Now, it seems that they're attempting to verify whether the fingerprint/profile of the device matches what's actually running - so for example, my Pixel 5 running Android 11, 12, or 13 is a valid CTS profile, but 10 or prior is not.
In other words, PI doesn't appear to simply accept whether basic vs hardware backed attestation is used, but rather is determining which should be used based on the environment - that is, any compatible platform running Android 8+ should be using hardware backed attestation.
@Displax would you mind explaining what all changed in Mod 3.0?
Sorry to bug you but this mention of both wallet and Gpay really confusing me.
When I look in apps Inc system I only see wallet (and only if I've actively installed from Google play). If I search Gpay it brings back the wallet (again only if actively installed)
The wallet shortcut still works in the menu but I presume it's using a hidden APK that I can't block it clear.
That's UK phone pxl6pro
Edit:. Actually then installing wallet again (I think Magisk still had the flag set from previous install) and I've now been able to add a card.
This is still with the mod 3 that I updated to earlier that was previously failing.
I still don't understand the references to Gpay on UK phones but for now at least I'm up and running again.
P.s. this is what I get in pi check
Last edited:
Some of this is definitely over my head, so just in case it helps give context to someone who knows a lot more than me, I guess I'll give a couple additional details about my setup. I'm on a Pixel 2 XL running the latest Android 10 factory image, taken directly from Google.
I also have a sneaking suspicion that I may have screwed something up with my attempts to install the root version of ReVanced Extended. Those attempts included uninstalling Vanced (which was installed overtop of the system YouTube app,) reattaching YouTube to the Play Store (had been disconnected using TeMeFi,) then updating YouTube with the target version from apk mirror, patching it, then installing the patched version over top, and finally detaching using TeMeFi again. TeMeFi seems sorta intrusive, so it could be that, or it could be screwing with a system app that's causing me to fail Play Integrity checking.
Gpay ---> https://play.google.com/store/apps/details?id=com.google.android.apps.nbu.paisa.user
Google Wallet ---> https://play.google.com/store/apps/details?id=com.google.android.apps.walletnfcrel
Mod 2.1 failed to help as of yesterday (maybe before then, I hadn't checked in at least a week) on p7p with JANUARY 2023 update.
Installed mod 3.0 on JANUARY 2023 update and all is well.
Thanks!
There actually seem to be 3 separate components.
Pixel firmware has some sort of built in GPay/Wallet functionality. There's also the standalone GPay app, as well as the standalone Wallet app. I have both on my Pixel 5, but if I uninstall both of them, I still have Wallet in my Quick Settings.
Try this:
- Remove any previous versions of Universal SafetyNet Fix and MagiskHide Props Config from Magisk.
- Reboot device.
- Go into Magisk DenyList, and enable DenyList on all components of Play Store, Wallet, and GPay. Clear data for all 3 apps.
- Download and install USNF 2.3.1 MOD 3.0
- Reboot again
- Check Play Integrity status, use Play Integrity API Checker
Shouldn't be hard to pass BASIC and DEVICE integrity. See my previous post
I don't think this would actually cause it, but it's possible.
As above mine currently working.
full stock Android... TQ1A.221205.011
I originally had this config:
- Magisk latest app and root (25206)
- Running in Zygote,
- USNF Displax 2.3.1_MOD 3 (previously 2.1)
- Shamiko 0.6 (126)
- Enforce Deny list disabled (as per Shamiko instruction)
Deny list including :
- Google Play Protect,
- Google Play Services (I've tried both with and without this)
- Google wallet
In addition I've added following into deny list as mentioned by others on this thread
- Global actions Wallet API
- Android setup that includes the lifeboat API mentioned by others
- Device policy (also mentioned lifeboat so did this too)
- Betterbug (mentioned by others here)
- Hardware info, because why not?
- Security hub
- Settings service ( includes lifeboat as mentioned)
Banking and media apps
I've probably put more than u need in the deny list but something in that second list is, once mod3 installed, what finally also allowed me to add a card. Might be coincidental though as been clearing rebooting adding clearing etc all day
Last edited:
Thank you, this solved all my problems with the apps in my work profile!So, here is my modification of USNF with Play Integrity API bypass.
It changes fingerprint to old7.1.26.0 (LOL) and apply it only for GMS SafetyNet process (by Zygisk injection), so your original prints/security path level does not change. This avoids many side effects/problems with global props changing.
Updated 3.0:
No words needed, you understand everything yourself
Updated 2.1:
Hide "Enable OEM Unlock" setting
Updated 2.0:
Bypassing DEVICE_INTEGRITY for devices that shipped with Android 13+ (Pixel`s 7 )
Updated:
Drop fingerprint to lowest possible (6.0) to ensure that no one use same Android version
Usage:
1. Delete/disable/reset MagiskHidePropsConfig (if installed).
2. Just install it over old Universal SafetyNet Fix and reboot device.
3. You may be needed to wipe GMS data (not cache) if there is no result immediately.
Many thanks to @1nikolas for integrity checker.
Source code: https://github.com/Displax/safetynet-fix/tree/integrity
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
9New huge update for the Xposed module, also now the repo it's in LSPosed repo so it will appear in LSPosed app. You will want to install it
GitHub - swer45/AttestationSpoofer: Xposed module that spoofs a fake root of trust in local attestations
Xposed module that spoofs a fake root of trust...
github.com
As you can see, now the module will spoof a locked bootloader with a verified boot state in RootOfTrust. This should work in all devices that have a TEE or StrongBox. If someone crash tag me and I will try to fix it.
Also I'm working in Magisk module (Zygisk), but it's difficult XD.5
With this module you can start the CIB Egypt Mobile Banking which is the only app I know they check if you have an unlocked bootloader. Enjoy
5
'Hate' is a strong word!...
Anyway, when the original CyanogenMod bundled all proprietary GApps for one thing, Google issued their infamous "Cease And Desist" order and Steve Kondik thought his baby was dead!...
However Google were quick to clarify that although custom OS's could not legitimately bundle GApps (Nb. other ROMs still do), users are welcome to 'sideload' the same (as devices themselves are generally certified through CTS while custom ROMs are not)...
So OpenGapps was formed to offer legitimised seperate packages, Steve continued with CM project, users continued to use vanilla CM (and later LOS) with proprietary Google Apps, and all in the custom mod world was sweet again...
Of course Google must have realised they nearly shot themselves in the foot with that action, but they scrambled to offer a solution / compromise that wouldn't result in the death of CM or custom ROMs as we know them...
I think the Lineage team simply see that Google is actually the custom modders benefactor and is (in reality) supportive of them and custom mods/ROMs in general if Devs play by the rules, and LOS is simply willing to do so...
Also, they are in the best position to get their custom ROM approved/certified in future (see my post above) by being careful 'not to subvert Google's security model' by tampering expected signals... Note that Magisk now follows this same policy, and I think that's not just because John is a Googler now; it's also a sign of his maturity as a responsible dev...
And ensuring that the main custom mods (ROM, root/overlay framework) comply in no way prevents "those passionate about hiding" from "doing their job"!... Both history and you are proving that.
Personally I think LOS is great and follows a great tradition!
PW4
I found the way to move a file into process data dir so now I will inject an apk file with Pine and see if I can hook that Java methods.
Safetynet-fix copy a classes.dex as byte array and send it through Zygisk socket to GMS process, I can't do that because DexClassLoader require a path to the file, so I need the apk is in target directory. After all operations the module will be detached from process (dlclose) and the apk should do the work.4
The application I made before called "TEE Fvcker" was something quick for the user who asked me to try it. I do not recommend using it because the hook I used is quite insecure and can break the functionality of other applications. Besides the name is censored by the forum. -
324Universal SafetyNet Fix
Magisk module
Magisk module to work around Google's SafetyNet attestation.
This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS profile attestation, which requires a valid combination of device and model names, build fingerprints, and security patch levels.
If you still have trouble passing SafetyNet with this module, use MagiskHide Props Config to spoof a certified device profile. This is a common issue on old devices, custom ROMs, and stock ROMs without GMS certification (e.g. Chinese ROMs).
Android versions up to 13 Beta 3 are supported, including OEM skins such as Samsung One UI and MIUI.
How does it work?
The way this workaround works is relatively low-level. An in-depth explanation, as well as source code and ROM changes, can be found on GitHub.
Ideally, this workaround should be incorporated in custom ROMs instead of injecting code with a Magisk module. See the ProtonAOSP website for more information.
Downloads
Downloads and changelogs can be found on GitHub. The topmost release is the latest.
Latest release
v2.4.0
Highlights
- Play Integrity bypass without breaking device checks or causing other issues
- Disabled use of hardware attestation on Pixel 7 and newer (@anirudhgupta109)
- Updated instructions for newer Android and Magisk versions
- Better debugging for future development
It's taken a while to find a way to bypass Play Integrity that doesn't require spoofing the build fingerprint permanently, but I wanted to make sure this module doesn't cause any unnecessary breakage. Just like the original goal of Universal SafetyNet Fix, this minimizes adverse effects by spoofing dynamically at runtime only when necessary. Enjoy!
If you found this helpful, please consider supporting development with a recurring donation for rewards such as early access to updates, exclusive behind-the-scenes development news, and priority support.
Alternatively, you can also buy me a coffee. All support is appreciated
Source code222So, here is my modification of USNF with Play Integrity API bypass.
It changes fingerprint to old7.1.26.0 (LOL) and apply it only for GMS SafetyNet process (by Zygisk injection), so your original prints/security path level does not change. This avoids many side effects/problems with global props changing.
Updated 3.0:
No words needed, you understand everything yourself
Updated 2.1:
Hide "Enable OEM Unlock" setting
Updated 2.0:
Bypassing DEVICE_INTEGRITY for devices that shipped with Android 13+ (Pixel`s 7 )
Updated:
Drop fingerprint to lowest possible (6.0) to ensure that no one use same Android version
Usage:
1. Delete/disable/reset MagiskHidePropsConfig (if installed).
2. Just install it over old Universal SafetyNet Fix and reboot device.
3. You may be needed to wipe GMS data (not cache) if there is no result immediately.
Many thanks to @1nikolas for integrity checker.
Source code: https://github.com/Displax/safetynet-fix/tree/integrity58So, here is my new modification of USNF with Play Integrity API bypass.
It is now based on top of original v2.4.0 codebase instead of v2.3.1, with adding new hiding algorithm for current realities and some code refreshing.
Changelog:
Version 1.2
* Fix crash and endless tests loop/failing on Android < 9.0 (bug from original version 2.4.0).
* Do not unpatch (revert) changes. To prevent possible tests failing after a while on some ROMs (cross conflicts).
Version 1.1
* Fix KeyStore hook desynchronization (tests randomly failing problem).
Usage:
1. Delete/disable/reset MagiskHidePropsConfig (if installed).
2. Just install it over old Universal SafetyNet Fix and reboot device.
3. You may be needed to wipe GMS data (not cache) if there is no result immediately.
Source code: https://github.com/Displax/safetynet-fix/tree/dev33So, created separate thread for my mod. Welcome)
[MODULE] [MOD] Universal SafetyNet Fix
Universal SafetyNet Fix [MOD] Magisk module...
forum.xda-developers.com
31Folks, the SafetyNet API was depreciated last Month with 'full turndown' slated for June 2024 and the introduction of the new Play Integrity API. It has also become clear that Google apps are simply the first to adopt the long foretold Play Integrity API; all responsible banks are bound to follow suit in short order, and at least before the June 2023 migration deadline.
This means (assuming fully deployed Hardware Key Attestation doesn't come first
) that the need for a 'Universal Play Integrity Fix' has become quite urgent.
We currently have workarounds involving using older fingerprint props by means of MHPC module (similar to fix needed for uncertified ROMs), but success/mileage varies per device and users of regular bank apps / gamers etc on stock devices will all soon be forced to experiment with MHPC prints also... This is hardly ideal.
So I've made an issue report/request on USNF GitHub as follows. This information may be insightful to users here also...
Please let me know here if I have missed anything important, or add any technically relevant details there...
PLEASE DON'T spam that issue with unimportant details or queries... (The previous issue is already burgeoning w/ OT.) That's what this thread is for...
:
Here's hoping... PW
