force stop play store, clear cache, make sure you are logged into to your gmail account and re-open play store
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
- Thread starter kdrag0n
- Start date
Damn something is off with your firmware then lol. I never have this issue. If I was you, I would format all data and downgrade my firmware unless you like OOS 13.1.
Make a full backup of everything and format all data using twrp. Make sure to flash the new firmware immediately after format. Which device are you currently using? I actually don't have too much time right now I G2G, but hopefully you figure it out.
Thank you so much for spending that time trying to help me. I really appreciate it. I'll try and mess around. (One more thing I noticed is that for some reason, in my local updater app, it shows I have F24 as my firmware while it showed 13.1 EXO001 before. I did fool around but forgot what I did and usually, those things I did often and shouldn't make any major change). Thanks again!
Did you try my suggestion?:None works so far.
Also, remove everything Google from denylist (only exception would be G Pay/Wallet)... Zygisk-USNF hides root from gms itself; Nb. zy-USNF can work with gms processes in denylist only if it's disabled, including w/ Shamiko but that is still double-hiding and not recommended... Enforced Denylist necessarily breaks zy-USNF as it prevents the basic function, ie. running code in gms Droidguard/attestation process to register fake keystore...Disable all modules except USNF and try... Clear Google Play Services data too... If no dice, try older @Displax v2.3.1-MOD_3.0... 2.4.0 changes (part time spoofing etc) still cause issues on some devices and modded 2.3.1 works better for many...PW
Also, please confirm ROM is fully stock, selinux is enforcing and you have run no other mods (eg from TWRP)...
If all above is correct and no dice, I'd try dirty flashing current ROM (will fix any corruption unless in /data); Use fastboot type full ROM as these are often more complete than recovery type...
PW
This helped me out - my issue was having Enforce DenyList turned on in Magisk. My device attestation is busted, Universal Safety-Net Fix (USNF) modded by Displax worked. Magisk settings: Zygisk, Configure DenyList (NOT ENFORCE DENYLIST!) add GPay to DenyList, add Google Wallet to DenyList. Install USNF in Magisk, reboot. Force stop Play Store, clear cache. Clear GPay cache and data. Setup GPay.Did you try my suggestion?:
Also, remove everything Google from denylist (only exception would be G Pay/Wallet)... Zygisk-USNF hides root from gms itself; Nb. zy-USNF can work with gms processes in denylist only if it's disabled, including w/ Shamiko but that is still double-hiding and not recommended... Enforced Denylist necessarily breaks zy-USNF as it prevents the basic function, ie. running code in gms Droidguard/attestation process to register fake keystore...
Also, please confirm ROM is fully stock, selinux is enforcing and you have run no other mods (eg from TWRP)...
If all above is correct and no dice, I'd try dirty flashing current ROM (will fix any corruption unless in /data); Use fastboot type full ROM as these are often more complete than recovery type...
Last edited:
Official USNF Magisk module (here) is still largely broken...
Use this fork:
https://forum.xda-developers.com/t/module-mod-universal-safetynet-fix.4553699/post-88149053
Check have Play Integrity deviceIntegrity using Play Integrity API Checker or similar... Nb. SafetyNet API is deprecated.
PW
Last edited:
Not sure why enforced denylist is an issue then... Generally works fine for G Pay/Wallet (without Shamiko)... Of course gms in denylist breaks this... PW
i use this but not passOfficial USNF Magisk module (here) is still largely broken...
Use this fork:
https://forum.xda-developers.com/t/module-mod-universal-safetynet-fix.4553699/post-88149053
Check have Play Integrity deviceIntegrity using Play Integrity API Checker or similar... Nb. SafetyNet API is deprecated.
and also show
basic integrity fail
and cts profile fail
without module only show cts profile fail
what happen i do
Does Zygisk show enabled on the Magisk app, main screen, top?
Make sure you have no SELinux Permissive
Also no Riru modules and no XLua (you must manually clean remaining sh... files after removing XLua)
Or, if you prefer Riru, search on TG for alternative solutions instead of the Zygisk USNF here
... Further, please say device / ROM...
Have you tried with nothing Google in denylist except G Pay/Wallet, and all modules disabled except @Displax modded USNF after clearing Google Play Services data?
Especially, try it with MagiskHide Props Config module disabled or removed despite what @kdrag0n says.
PW
Last edited:
voetbalremco
Inactive Recognized Developer
Official USNF Magisk module (here) is still largely broken...
Use this fork:
https://forum.xda-developers.com/t/module-mod-universal-safetynet-fix.4553699/post-88149053
Check have Play Integrity deviceIntegrity using Play Integrity API Checker or similar... Nb. SafetyNet API is deprecated.
On MIUI it's the other way around, Displax his mod breaks safetynet while the original module still works.
Please give details... I have Redmi Note 8T, stock MIUI... PW
Maybe if you have Xiaomi.eu
In that case you pass Play Integrity (that's relevant, not the deprecated SN, but you will also pass SN) without a need for USNF (although your Bootloader is unlocked) - but only if you don't have Magisk
With Magisk, you then also need USNF, but you can try instead SafetyNet Sensitive Props (eg, I use instead of USNF) - screenshot
That's bcs some versions of Xiaomi.eu already have USNF implemented to the ROM.
Otherwise, users would not be able to use Wallet, since they had to unlock BL to be able to flash the custom ROM Xiaomi.eu
However, that's specific to Xiaomi.eu - with the official MIUI and unlock BL, you can not pass PI/SN without Magisk and USNF
Attachments
Last edited:
voetbalremco
Inactive Recognized Developer
Yup, @Displax mentioned issues with (some?) XiaomiEU custom ROMs (specifically) not playing nicely w/ USNF...
I guess you also have root hidden from Google Play Services attestation/Droidguard process com.google.android.gms.unstable and likely main gms process com.google.android.gms (added in denylist)...
Out of interest, do you still need the main gms process added to pass now, assuming your tmpfs mount path has become debug_ramdisk?
Also, I assume this won't work without a sensitive props solution even though the ROM itself will adjust some... Can you say S/N and PI checker results with only root hidden from gms (ie. Sensitive Props module disabled)?
And does MHPC module active (with nothing configured) also allow S/N / PI deviceIntegrity to pass (as alternative to SafetyNet Sensitive Props module)?
PW
Xiaomi.eu, MIUI 13/A12 (since Nov 2022)Yup, @Displax mentioned issues with (some?) XiaomiEU custom ROMs (specifically) not playing nicely w/ USNF...
I guess you also have root hidden from Google Play Services attestation/Droidguard process com.google.android.gms.unstable and likely main gms process com.google.android.gms (added in denylist)...
Out of interest, do you still need the main gms process added to pass now, assuming your tmpfs mount path has become debug_ramdisk?
Also, I assume this won't work without a sensitive props solution even though the ROM itself will adjust some... Can you say S/N and PI checker results with only root hidden from gms (ie. Sensitive Props module disabled)?
And does MHPC module active (with nothing configured) also allow S/N / PI deviceIntegrity to pass (as alternative to SafetyNet Sensitive Props module)?
Magisk Delta latest 25210 with SuList
Its been long ago since I installed Sensitive Props module (at that time I really needed but seems that Husky had later implemented something directly to Delta)
Now I tested with Sensitive Props disabled and even uninstalled (and of course, with rebooting) and I can still pass PI, SN and all checkers I have (except Momo as usually) - I know that I really needed Sensitive Props for Ruru or SCheck but no more now
Hence I removed Sensitive Props
Second, since I don't have DenyList and by SuList everything except the root apps are implicitly in MagiskHide, I performed the mirrored test:
- I checked GMS unstable in SuList and after that SN and PI fail
Similar threads
Top Liked Posts
-
There are no posts matching your filters.
-
3
For you either @Displax Mod 1.3 or latest 2.0 should be fine, but 2.0 was experimental, does use a different (Pixel 2) fingerprint prop and it's Shipping level prop setting breaks the fix for devices launched with A13 like Pixel 7... The props set by either of these affecting your device are set to target GMS properly however...
@chiteroman's newer PIF module (based on USNF but renamed) presumably sets shipping level for LV A13 devices to target GMS so should be better for Pixel 7 and other A13 launch version devices... @Displax Mod 1.3 sets it correctly to 32 but globally which breaks WiFi calling and possibly other features...
Others reading this; Note that the official module (this thread) has been largely broken for some time...
PW3
EDIT: Rolling back Intune Company portal to 5.0.5926 allows me to prevent corporate apps from detecting ROOT.2
No... Unless Momo is giving false positive, really TEE is not broken anyway... I mentioned to you:
So OEM's messed up and AVB chain of trust fixes generally don't even come with OEM updates...
In such cases broken keystore etc will hopefully cause an exception that triggers on-device fallback to basic-only attestation and Google allows this verdict by not enforcing hardware backed evaluationType verdicts at server end, but generally devices affected will never pass strongIntegrity (unless a retrofit fix is applied by OEM.
In other cases, like Asus ROG Phone 3 that used to pass strongIntegrity erroneously with bootloader unlocked, Google simply revokes keys for strongIntegrity verdict (blacklists device) as soon as the flawed OEM implementations are discovered..
PW2
First of all, if you are still on the old KDragon's USNF module - better please read just like two or three last pages and you will see that you had to move to the USNF fork from Displax or Play Integrity midule - they have their own threads with downloads
If it won't help, then which Magisk version you have, which modules, and if you have LSPosed, which LSPosed modules you have installed- some modules may collide (like MHCP, XPrivacyLua, Lucky patcher and so)
If you have custom ROM and if that ROM runs SELinux in Permissive mode - you're in troubles again
Etc - just the question "not passing CTS" cannot be decisively answered
Btw, SafetyNet is deprecated and you should download from Playstore and test Play Integrity API (Checker).
There, you need to pass Device and Basic Integrity - don't ask or expect to pass Strong Integrity (for that, phone must run stock/official firmware with the locked Bootloader)1
Very weird, but this happened:
I restarted my phone and it went into bootloop but was saved by Magisk bootloop protector. Checked YASNAC and both passed... wtf. Google Wallet detects root so I'll need to still fix that but what the f is happening... -
333Universal SafetyNet Fix
Magisk module
Magisk module to work around Google's SafetyNet attestation.
This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS profile attestation, which requires a valid combination of device and model names, build fingerprints, and security patch levels.
If you still have trouble passing SafetyNet with this module, use MagiskHide Props Config to spoof a certified device profile. This is a common issue on old devices, custom ROMs, and stock ROMs without GMS certification (e.g. Chinese ROMs).
Android versions up to 13 Beta 3 are supported, including OEM skins such as Samsung One UI and MIUI.
How does it work?
The way this workaround works is relatively low-level. An in-depth explanation, as well as source code and ROM changes, can be found on GitHub.
Ideally, this workaround should be incorporated in custom ROMs instead of injecting code with a Magisk module. See the ProtonAOSP website for more information.
Downloads
Downloads and changelogs can be found on GitHub. The topmost release is the latest.
Latest release
v2.4.0
Highlights
- Play Integrity bypass without breaking device checks or causing other issues
- Disabled use of hardware attestation on Pixel 7 and newer (@anirudhgupta109)
- Updated instructions for newer Android and Magisk versions
- Better debugging for future development
It's taken a while to find a way to bypass Play Integrity that doesn't require spoofing the build fingerprint permanently, but I wanted to make sure this module doesn't cause any unnecessary breakage. Just like the original goal of Universal SafetyNet Fix, this minimizes adverse effects by spoofing dynamically at runtime only when necessary. Enjoy!
If you found this helpful, please consider supporting development with a recurring donation for rewards such as early access to updates, exclusive behind-the-scenes development news, and priority support.
Alternatively, you can also buy me a coffee. All support is appreciated
Source code223So, here is my modification of USNF with Play Integrity API bypass.
It changes fingerprint to old7.1.26.0 (LOL) and apply it only for GMS SafetyNet process (by Zygisk injection), so your original prints/security path level does not change. This avoids many side effects/problems with global props changing.
Updated 3.0:
No words needed, you understand everything yourself
Updated 2.1:
Hide "Enable OEM Unlock" setting
Updated 2.0:
Bypassing DEVICE_INTEGRITY for devices that shipped with Android 13+ (Pixel`s 7 )
Updated:
Drop fingerprint to lowest possible (6.0) to ensure that no one use same Android version
Usage:
1. Delete/disable/reset MagiskHidePropsConfig (if installed).
2. Just install it over old Universal SafetyNet Fix and reboot device.
3. You may be needed to wipe GMS data (not cache) if there is no result immediately.
Many thanks to @1nikolas for integrity checker.
Source code: https://github.com/Displax/safetynet-fix/tree/integrity58So, here is my new modification of USNF with Play Integrity API bypass.
It is now based on top of original v2.4.0 codebase instead of v2.3.1, with adding new hiding algorithm for current realities and some code refreshing.
Changelog:
Version 1.2
* Fix crash and endless tests loop/failing on Android < 9.0 (bug from original version 2.4.0).
* Do not unpatch (revert) changes. To prevent possible tests failing after a while on some ROMs (cross conflicts).
Version 1.1
* Fix KeyStore hook desynchronization (tests randomly failing problem).
Usage:
1. Delete/disable/reset MagiskHidePropsConfig (if installed).
2. Just install it over old Universal SafetyNet Fix and reboot device.
3. You may be needed to wipe GMS data (not cache) if there is no result immediately.
Source code: https://github.com/Displax/safetynet-fix/tree/dev33So, created separate thread for my mod. Welcome)
[MODULE] [MOD] Universal SafetyNet Fix
Universal SafetyNet Fix [MOD] Magisk module...
forum.xda-developers.com
31Folks, the SafetyNet API was depreciated last Month with 'full turndown' slated for June 2024 and the introduction of the new Play Integrity API. It has also become clear that Google apps are simply the first to adopt the long foretold Play Integrity API; all responsible banks are bound to follow suit in short order, and at least before the June 2023 migration deadline.
This means (assuming fully deployed Hardware Key Attestation doesn't come first) that the need for a 'Universal Play Integrity Fix' has become quite urgent.
We currently have workarounds involving using older fingerprint props by means of MHPC module (similar to fix needed for uncertified ROMs), but success/mileage varies per device and users of regular bank apps / gamers etc on stock devices will all soon be forced to experiment with MHPC prints also... This is hardly ideal.
So I've made an issue report/request on USNF GitHub as follows. This information may be insightful to users here also...
Please let me know here if I have missed anything important, or add any technically relevant details there...
PLEASE DON'T spam that issue with unimportant details or queries... (The previous issue is already burgeoning w/ OT.) That's what this thread is for...
:
Here's hoping...
PW
