MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0

[antonioxerez]

You could sideload a zip, yes. Should work the same way as sideloading in TWRP.

Thanks a lot, it finally worked with Magisk alpha so, because it has worked this way, I tried to uninstall magisk alpha and normal magisk and reinstalling normal magisk and it is working as well without any module installed ... so I do not know what happened in the first place... could be that it just needed to make the initial bank app start without rooting and, after this first start, root the device and apply "denylist" in Magisk...
Thanks all of you for your support

 

[swer45]

mmmm, I think root permissions is not the issue because I have granted root permissions to alpha Magisk.
Anyway, about flashing a zip from my recovery I think is not possible... I have LineageOS recovery, not TWRP. The only option I have is "sideload files". I think this is not the same or will it work the sameway if I rename the apk to zip and sideload it through recovery?
Thanks for answering

The real question is why are you using LineageOS recovery, do you have that ROM? I don't recommend LOS because it doesn't "hack" to bypass detections, use this module to hide LOS: https://github.com/Magisk-Modules-Alt-Repo/sensitive_props/releases/latest

 

[antonioxerez]

I The real question is why are you using LineageOS recovery, do you have that ROM? I don't recommend LOS because it doesn't "hack" to bypass detections, use this module to hide LOS: https://github.com/Magisk-Modules-Alt-Repo/sensitive_props/releases/latest

sorry, I thought I had LineageOS recovery but it seems I have "PixelOS recovery" (that could be is the same, because the interface is exactly the same than LOS recovery...)
P.S. I tried that module as well with no success... anyway, I finally have bank app working

 

[Essentrix]

To install Magisk Alpha you need to download apk and install it, gives it root permissions and install directly from the app. After the reboot you can uninstall older Magisk app.
Or you can completly uninstall Magisk and install Magisk Alpha using TWRP.

Hi,
I can pass safelynet on YASNAC but not Play integrity API checker.
Most bank apps work except one.
Currently using Magisk 26.1, hidden, no enforce list, Shamiko, USNF 2 4.0 mod 1.2.
Noticed you mentioned Magisk alpha. How is this different to Magisk 26.1 and can I go back to 26.1 afterwards if it makes no difference?
I'm using rooted stock 13, no TWRP.

 

[Nergal di Cuthah]

How is this different to Magisk 26.1

Alpha is a cutting edge fork of magisk that tries things before john wu maybe adds. It is not made by wu, but developed by prolific contributors of magisk.

 

[swer45]

How is this different to Magisk 26.1 and can I go back to 26.1 afterwards if it makes no difference?

It's closed source and use an undetected Zygisk, you can reinstall original Magisk if you don't like Alpha. Also there are 2 Magisk "alpha", the official (called Magisk Canary) and the vvb2060, the good one is the vvb2060 Magisk. You can download it from his Telegram: https://t.me/s/magiskalpha

 

[Mowca]

Hello
I haven't been able to pay over the phone for a few days.
Yasnac fails "cts profile match" test.
How to solve this problem?
Samsung s10e.
Lineageos 18.1
Magik 23.0
modules:
MagiskHide Props Config v6.1.2
Universal safetynet Fix v2.4.0 by kdrag0n

 

[Essentrix]

It's closed source and use an undetected Zygisk, you can reinstall original Magisk if you don't like Alpha. Also there are 2 Magisk "alpha", the official (called Magisk Canary) and the vvb2060, the good one is the vvb2060 Magisk. You can download it from his Telegram: https://t.me/s/magiskalpha

Thanks for the feedback. Do you think its likely to improve my chances of passing safetynet with play integrity API checker?

 

[swer45]

Thanks for the feedback. Do you think its likely to improve my chances of passing safetynet with play integrity API checker?

Magisk Alpha is only required for some apps that detect official Magisk zygote injection. You should pass Play Integrity (device and basic) with official Magisk.
Send screenshot of PI result.

 

[pndwal]

Hi,
I can pass safelynet on YASNAC but not Play integrity API checker.
Most bank apps work except one.
Currently using Magisk 26.1, hidden, no enforce list, Shamiko, USNF 2 4.0 mod 1.2.
Noticed you mentioned Magisk alpha. How is this different to Magisk 26.1 and can I go back to 26.1 afterwards if it makes no difference?
I'm using rooted stock 13, no TWRP.

Alpha works because after disabling Zygisk (which you need to do ATM) you have MagiskHide (old style) restored...

You need to hide root from Starling but you cannot use Denylist or Shamiko as both require Zygisk, and even with native bridge loaded Zygisk (already implemented in Alpha, but still not fully hidable as is evident by Starling detections) injection/hooking is detected by memory scanning (or other means?)...

Thanks a lot, it finally worked with Magisk alpha so, because it has worked this way, I tried to uninstall magisk alpha and normal magisk and reinstalling normal magisk and it is working as well without any module installed ... so I do not know what happened in the first place... could be that it just needed to make the initial bank app start without rooting and, after this first start, root the device and apply "denylist" in Magisk...
Thanks all of you for your support

Some have reported that Starling app gives you a week's grace from when it detects root until it fails to open... Just a guess on my part, but you may need a non-Zygisk hide solution again when/if that occurs.

PW

 

[Essentrix]

Magisk Alpha is only required for some apps that detect official Magisk zygote injection. You should pass Play Integrity (device and basic) with official Magisk.
Send screenshot of PI result.

Here's my results for both

 

[pndwal]

Hello
I haven't been able to pay over the phone for a few days.
Yasnac fails "cts profile match" test.
How to solve this problem?
Samsung s10e.
Lineageos 18.1
Magik 23.0
modules:
MagiskHide Props Config v6.1.2
Universal safetynet Fix v2.4.0 by kdrag0n

Disable MHPC... Say if LOS is official or unofficial... ensure you have no mods like selinux switched to permissive flashed from custom recovery... Test with all Magisk modules disabled also, except latest @kdragon USNF... PW

 

[Essentrix]

Alpha works because after disabling Zygisk (which you need to do ATM) you have MagiskHide (old style) restored...

You need to hide root from Starling but you cannot use Denylist or Shamiko as both require Zygisk, and even with native bridge loaded Zygisk (already implemented in Alpha, but still not fully hidable as is evident by Starling detections) injection/hooking is detected by memory scanning (or other means?)...

Some have reported that Starling app gives you a week's grace from when it detects root until it fails to open... Just a guess on my part, but you may need a non-Zygisk hide solution again when/if that occurs.

PW

Thanks for the detailed feedback. As you'll see in my feedback to another post, I have mixed results with the current setup.
Not sure of the best way forward.
Still appreciate access to you guys; you're quite an amazing wealth of knowledge!

 

[pndwal]

Thanks for the detailed feedback. As you'll see in my feedback to another post, I have mixed results with the current setup.
Not sure of the best way forward.
Still appreciate access to you guys; you're quite an amazing wealth of knowledge!

Here's my results for both

Please see my reply above to @Mowca...

Please say device, Rom, what mods/modules you have etc...

One thing to note (often causing issues like yours), - passing ctsProfileMatch with basic attestation has been superseded by deviceIntegrity, but requirements have also been heightened, eg you can no longer run without security enhanced linux, ie. with permissive selinux, so ensure you use current modules for mods like Viper4Android that don't alter system security, and that any custom ROM is properly set to enforce selinux. ROMs should only be released to public with selinux working... Permissive disables many requirements for development/testing purposes only; if a rom relies on permissive selinux it's half baked and insecure.

Thanks for the feedback. Do you think its likely to improve my chances of passing safetynet with play integrity API checker?

No.

PW

 

[swer45]

Here's my results for both

WTF, I never seen that. If you pass Safetynet, you must pass basic Play Integrity... Maybe SELinux problems? It's interesting.

 

[pndwal]

It's closed source and use an undetected Zygisk,

Native bridge loading should make Zygisk properly hidable just like N/B-Riru, and it works for many apps that previously detected Zygisk already. My tests and info. here:
https://forum.xda-developers.com/t/discussion-magisk-the-age-of-zygisk.4393877/post-88467665
and in following post...

However it seems that Starling is still able to detect Zygisk, so looks like either more work needs doing on core Zygisk loading etc, or Shamiko (LSP Zygisk companion hiding app) needs further improvement before Zygisk is truly undetectable... This seems to be the crux of the issue with Starling Bank...

you can reinstall original Magisk if you don't like Alpha. Also there are 2 Magisk "alpha", the official (called Magisk Canary) and the vvb2060, the good one is the vvb2060 Magisk.

I think John avoids calling Canary Magisk 'Alpha' partly due to the existence of vvb2060 Alpha fork, and to prevent confusion.

You can download it from his Telegram: https://t.me/s/magiskalpha

... Her telegram. PW

 

[Essentrix]

Please see my reply above to @Mowca...

Please say device, Rom, what mods/modules you have etc...

One thing to note (often causing issues like yours), - passing ctsProfileMatch with basic attestation has been superseded by deviceIntegrity, but requirements have also been heightened, eg you can no longer run without security enhanced linux, ie. with permissive selinux, so ensure you use current modules for mods like Viper4Android that don't alter system security, and that any custom ROM is properly set to enforce selinux. ROMs should only be released to public with selinux working... Permissive disables many requirements for development/testing purposes only; if a rom relies on permissive selinux it's half baked and insecure.

No.

PW

A52s 5G rooted stock
Magisk 26.1 no TWRP
Shamiko, systemless hosts,
USNF 2.4 mod 1.2
V4AFX 2.7.2.1 repackaged
Zygisk LSPosed
Corepatch
All latest versions

 

[pndwal]

A52s 5G rooted stock
Magisk 26.1 no TWRP
Shamiko, systemless hosts,
USNF 2.4 mod 1.2
V4AFX 2.7.2.1 repackaged
Zygisk LSPosed
Corepatch
All latest versions

What's corepatch? PW

 

[Essentrix]

WTF, I never seen that. If you pass Safetynet, you must pass basic Play Integrity... Maybe SELinux problems? It's interesting.

Wow, I'm surprised it's something you guys haven't seen before.
Looked a little weird to me.
Still my most important bank apps work so not a big deal. Google wallet picks up root but don't really need it.
Thanks for being such a great resource. Open if you have any further thoughts.

What's corepatch? PW

A LSPosed module

 

[pndwal]

Wow, I'm surprised it's something you guys haven't seen before.

I've seen it. Cause was permissive selinux; we can pass SafetyNet (basicIntegrity and ctsProfileMatch) with that but not PI basicIntegrity... This additional requirement would probably have come to S/N except that it's superseded by PI, so this API got the stricter basicIntegrity requirement...

I don't yet know of other reasons (enhanced requirements) however, but it's likely there are others.

Looked a little weird to me.
Still my most important bank apps work so not a big deal. Google wallet picks up root but don't really need it.
Thanks for being such a great resource. Open if you have any further thoughts.

A LSPosed module

Try this: disable all Magisk modules, reboot, clear Google Play Services data, enable only latest @Displax USNF, reboot and check again...

Also, check selinux (in terminal emulator type getenforce with su) and in Play integrity API Checker click <> at top and screenshot raw JSON response... PW