MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0

[Sasy969]

Why are you in a root module thread if you don't have root. Of course it won't pass without root.

I have the same problem also with root.
Btw i have always used my phone without root without any problems.
I attach some screenshots of my current setup. As i said before sometimes I get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY and sometimes don't

 

[pndwal]

Should i disable Revanced module and Substratum? Doesn't seem to be really necessary.

I already said "all modules disabled except USNF"... You can put stuff back after fixing issue (then you'll know if any break integrity verdicts), but test w/ essential mods only...

...And I asked you:

... So G Wallet working without deviceIntegrity?... Please show YASNAC results also (after disabling all modules except USNF)... PW

because it's not clear what "still doesnt pass the integrity" means... Do you mean deviceIntegrity or strongIntegrity here???... If not passing deviceIntegrity (and I suspect you are now), please show YASNAC results also (after disabling all modules except USNF) as I requested... PW

 

[pndwal]

Sorry to further bother you, but I have read the last 3/4 pages and i I have read only about other users with root, but i have the same problem without root.
I get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY, but still wallet says i don't meet safety requirements.
I also have tried with magisk and USNF 2.3.1 Modded but sometimes I get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY and sometimes I don't, like other users earlier

You still haven't given any details about your setup...

I'm guessing you're running a custom rom however, one that integrates SNF, and it's likely that you've taken an update recently and that the ROM dev may have already integrated USNF 2.4.0 changes for SNF with that update... If so inbuilt SNF solution may be conflicting with your downgraded USNF builds...

I'm not a fan of integrating SNF or other prop spoofs etc in ROMs as users must wait for ROM Devs for fixes and I've seen too many issues/conflicts with Magisk modules...

Ordinarily one of @Displax's modded USNF builds alone should have sorted you out for now...

Please say if I'm in the ballpark with you configuration, and give us some details!... PW

 

[DartGerion]

M

I already said "all modules disabled except USNF"... You can put stuff back after fixing issue (then you'll know if any break integrity verdicts), but test w/ essential mods only...

...And I asked you:

because it's not clear what "still doesnt pass the integrity" means... Do you mean deviceIntegrity or strongIntegrity here???... If not passing deviceIntegrity (and I suspect you are now), please show YASNAC results also (after disabling all modules except USNF) as I requested... PW

Bro, calm down a notch. I'm asking about the necessity of disabling the modules just to clarify the situation, no need to get irritated. Should i just toggle the switch off or also reboot after toggling off?
The YASNAC screenshot is on the attachments. I'm not passing any Integrity, as the json log stats that integrity is UNEVALUATED.

 

[pndwal]

So definitely Google Play Services? (Not '... for AR' etc?)... So G Wallet working without deviceIntegrity?... Please show YASNAC results also (after disabling all modules except USNF)... PW

Should i disable Revanced module and Substratum? Doesn't seem to be really necessary.

I already said "all modules disabled except USNF"... You can put stuff back after fixing issue (then you'll know if any break integrity verdicts), but test w/ essential mods only...

...And I asked you:

because it's not clear what "still doesnt pass the integrity" means... Do you mean deviceIntegrity or strongIntegrity here???... If not passing deviceIntegrity (and I suspect you are now), please show YASNAC results also (after disabling all modules except USNF) as I requested... PW

Bro, calm down a notch. I'm asking about the necessity of disabling the modules just to clarify the situation, no need to get irritated. Should i just toggle the switch off or also reboot after toggling off?...

What makes you think I'm irritated/not calm?...

But I'm not going to help if when I ask for details/confirmation, you totally ignore the question(s) and just ask more of your own...

...Two way street... PW

 

[DartGerion]

What makes you think I'm irritated/not calm?...

But I'm not going to help if when I ask for details/confirmation, you totally ignore the question(s) and just ask more of your own...

...Two way street... PW

You are absolutely right, it should be a two way street. With YASNAC screenshot, i totally overlooked it while reading, my apologies.
I'm not accusing you of anything, just the tone seems a bit irritated, but it's also understandable, seeing how many messages there recently are of people having a lot of problems with integrity and Gwallet.
I'm invested as much, as i could be, to solving this issue and to help others, who might face similar problems and i kindly ask for your help in this matter.

 

[Sasy969]

You still haven't given any details about your setup...

I'm guessing you're running a custom rom however, one that integrates SNF, and it's likely that you've taken an update recently and that the ROM dev may have already integrated USNF 2.4.0 changes for SNF with that update... If so inbuilt SNF solution may be conflicting with your downgraded USNF builds...

I'm not a fan of integrating SNF or other prop spoofs etc in ROMs as users must wait for ROM Devs for fixes and I've seen too many issues/conflicts with Magisk modules...

Ordinarily one of @Displax's modded USNF builds alone should have sorted you out for now...

Please say if I'm in the ballpark with you configuration, and give us some details!... PW

Thanks for your replay. In my first post i have said that i am on the latest Evox, i have asked in the telegram group of the Rom and they said that the ROM doesn't have any kind of USNF integration that could cause some conflicts.
Also in the first post of the page i have attached some screenshots of my actual configuration:
Custom ROM : Evox
Magisk installed
USNF module: 2.3.1 modded by Displax.
No other module are installed.
Since this morning i fail all the integrity check as in the screenshot.
EDIT: Tried to install USNF 2.4.0 and i get the first two check

 

[pndwal]

Thanks for your replay. In my first post i have said that i am on the latest Evox,

Ah yes... So EvolutionX ROM...

i have asked in the telegram group of the Rom and they said that the ROM doesn't have any kind of USNF integration that could cause some conflicts.

Well how can you pass integrity verdicts at all?... Unless device launched w/ A7 or earlier...

Anyway, seems your info is flawed... This indicates official EvolutionX official does integrate spoofing for S/N and PI:
https://t.me/EvolutionX/647435

This generally means they pull code from @Displax's USNF pull requests, his own forks and/or @kdrag0n's implemented code for custom Proton ROMs etc...

Also in the first post of the page i have attached some screenshots of my actual configuration:
Custom ROM : Evox
Magisk installed
USNF module: 2.3.1 modded by Displax.
No other module are installed.
Since this morning i fail all the integrity check as in the screenshot.

But we don't know what device AFAICS... Is it very old???

And have you tried simply adding com.google.android.gms.unstable (and may possibly need com.google.android.gms also) to denylist w/ Magisk installed and NO Magisk modules at all?... Please give that a go and say if verdicts are any more consistent/stable...

PW

 

[Sasy969]

Ah yes... So EvolutionX ROM...

Well how can you pass integrity verdicts at all?... Unless device launched w/ A7 or earlier...

Anyway, seems your info is flawed... This indicates official EvolutionX official does integrate spoofing for S/N and PI:
https://t.me/EvolutionX/647435

This generally means they pull code from @Displax's USNF pull requests, his own forks and/or @kdrag0n's implemented code for custom Proton ROMs etc...

But we don't know what device AFAICS... Is it very old???

And have you tried simply adding com.google.android.gms.unstable (and may possibly need com.google.android.gms also) to denylist w/ Magisk installed and NO Magisk modules at all?... Please give that a go and say if verdicts are any more consistent/stable...

PW

I'm so sorry about the wrong information I have given to you, but It was what i was said in the chat group.
My device is pretty recent (One Plus 9), I have just tried following you suggestions and I have eliminated USNF module.
com.google.android.gms.unstable and com.google.android.gms were already added to the denylist.
At least for now my device get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY.
I will try again during the day, for now I thank you for your help and apologize for my poor knowledge.

 

[pndwal]

You are absolutely right, it should be a two way street. With YASNAC screenshot, i totally overlooked it while reading, my apologies.
I'm not accusing you of anything, just the tone seems a bit irritated, but it's also understandable, seeing how many messages there recently are of people having a lot of problems with integrity and Gwallet.
I'm invested as much, as i could be, to solving this issue and to help others, who might face similar problems and i kindly ask for your help in this matter.

All good/all right then...

So no problem with main USNF fallback / prop spoofing since I believe you don't even need these on OnePlus 7TPro... You can check in Momo to confirm... It'll say TEE is broken if you don't need these fixes (actually it's not, but Devs mean keymaster implementation, part of which is processed in TEE, is broken)

... I'm asking about the necessity of disabling the modules just to clarify the situation... Should i just toggle the switch off or also reboot after toggling off?

Yup, need to reboot... Magisk = magic mask ie. a system overlay applied systemlessly (modules comprise part of that) loaded at boottime, so modules aren't disabled till reboot...

The YASNAC screenshot is on the attachments. I'm not passing any Integrity, as the json log stats that integrity is UNEVALUATED.

Your deviceIntegrity has been evaluated properly (returning blank value) but appIntegrity and accountDetails haven't been evaluated since failing deviceIntegrity invalidates these...

Anyway, it seems something is now breaking PI's more sensitive basicIntegrity verdict... Again, please report check w/ all modules disabled except USNF... This user also had passing S/N but failing PI basicIntegrity due to modules on OnePlus 7 device w/ stock ROM:
https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87891641

Also, please check your selinux status is enforcing regardless of results disabling modules... (Are you a viper4android user?)... PW

 

[Sasy969]

I will try again during the day

I have tried again and now i fail all three integrity check as can been seen in the screenshot below.
Current setup
OP9
Magisk installed
Custom ROM Evox
No USNF module installed
com.google.android.gms.unstable and com.google.android.gms added to the denylist

 

[memocatcher]

A few days ago I randomly got the message from Wallet that my device doesnt meet the security requirements to use Wallet. Before that, everything was fine with USF 2.4.0 installed. I checked the Play Integrity status and it now only shows a green check for basic integrity and device integrity, but not for strong integrity.
Is it supposed to be like that? Or does strong integrity normally works as well with USF installed?

 

[rxmp]

A few days ago I randomly got the message from Wallet that my device doesnt meet the security requirements to use Wallet. Before that, everything was fine with USF 2.4.0 installed. I checked the Play Integrity status and it now only shows a green check for basic integrity and device integrity, but not for strong integrity.
Is it supposed to be like that? Or does strong integrity normally works as well with USF installed?

Same situation. Does anyone know how to fix this? Every module is up to date.

 

[pndwal]

... So I just tried magisk 25.2 again with selinux enforcing, this time, the Cts profile, Device and Basic integrity become Pass except the strong integrity.

All good for you now then re deviceIntegrity then... Expected results...

And Viper4android status suddenly becomes normal with selinux enforcing.
Previously, I was using selinuxmodechanger app to change selinux, and now, I don't need it anymore.

Is it Viper4AndroidFX?... I think you only have issues with Neon driver only when installing/changing to legacy mode... If you didn't reinstall V4A you shouldn't have the issue...

Not sure which step fixes this viper4android issue that haunted me for 1year

You just need to reset Neon driver when selecting legacy mode... When you reinstall in future or have driver = abnormal, just set legacy mode, disable the module, reboot, re-enable module and reboot again... driver should have reset and status should now be Normal...

The banking app that still detect root is Ocbc Digital- Mobile Banking app(Singapore version). You can try to download the app via link below and test whether can hide from this banking app.
https://ocbc-digital.nl.aptoide.com/app

I wasn't able to hide root/modified environment from this app with my setup... Sorry... PW

 

[pndwal]

A few days ago I randomly got the message from Wallet that my device doesnt meet the security requirements to use Wallet. Before that, everything was fine with USF 2.4.0 installed. I checked the Play Integrity status and it now only shows a green check for basic integrity and device integrity, but not for strong integrity.
Is it supposed to be like that? Or does strong integrity normally works as well with USF installed?

Same situation. Does anyone know how to fix this? Every module is up to date.

Folks, please read back a bit before posting here to save unnecessary repetition... PW

 

[pndwal]

I'm so sorry about the wrong information I have given to you, but It was what i was said in the chat group.
My device is pretty recent (One Plus 9), I have just tried following you suggestions and I have eliminated USNF module.
com.google.android.gms.unstable and com.google.android.gms were already added to the denylist.

That's interesting... Did you add, or does ROM add?... And if you remove them, are the added again with reboot?

I ask because USNF removes these at boot if manually added as they'll cause conflicts w/ USNF if denylist is enforced... (There's no conflict if proper hiding using Shamiko etc is employed however.)

If they're added at boot by ROM, this may be the source of the conflict w/ USNF module... Simply allowing that to happen but using Shamiko (denylist NOT enforced) may possibly fix issue with USNF installed...

At least for now my device get MEETS _DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY.
I will try again during the day, for now I thank you for your help and apologize for my poor knowledge.

We're all learning here... Please report your mileage... PW

 

[DartGerion]

All good/all right then...

So no problem with main USNF fallback / prop spoofing since I believe you don't even need these on OnePlus 7TPro... You can check in Momo to confirm... It'll say TEE is broken if you don't need these fixes (actually it's not, but Devs mean keymaster implementation, part of which is processed in TEE, is broken)

Yup, need to reboot... Magisk = magic mask ie. a system overlay applied systemlessly (modules comprise part of that) loaded at boottime, so modules aren't disabled till reboot...

Your deviceIntegrity has been evaluated properly (returning blank value) but appIntegrity and accountDetails haven't been evaluated since failing deviceIntegrity invalidates these...

Anyway, it seems something is now breaking PI's more sensitive basicIntegrity verdict... Again, please report check w/ all modules disabled except USNF... This user also had passing S/N but failing PI basicIntegrity due to modules on OnePlus 7 device w/ stock ROM:
https://xdaforums.com/t/magisk-module-universal-safetynet-fix-2-4-0.4217823/post-87891641

Also, please check your selinux status is enforcing regardless of results disabling modules... (Are you a viper4android user?)... PW

Hey.
So with all modules (including USNF) the safetynet and PI Integrity shows "Not passed" (Duh).
The MOMO shows just that it found the SU folder and detected Magisk.
When everything excluding the @Displax modded USNF is turned off (and also Play Services data cleared) the results are on the screenshots below. Note: Deny list is enforced and only Google Wallet and some banking apps are added, nothing more.
YASNAC passes with flying colours. The device integrity in 2 apps fail to be checked and return UNEVALUATED results. Json is also attached.
What's baffling is that even now, the Google Wallet worked (I checked it now in the supermarket terminal).

 

[thomas140]

All good for you now then re deviceIntegrity then... Expected results...

Is it Viper4AndroidFX?... I think you only have issues with Neon driver only when installing/changing to legacy mode... If you didn't reinstall V4A you shouldn't have the issue...

You just need to reset Neon driver when selecting legacy mode... When you reinstall in future or have driver = abnormal, just set legacy mode, disable the module, reboot, re-enable module and reboot again... driver should have reset and status should now be Normal...

I wasn't able to hide root/modified environment from this app with my setup... Sorry... PW

Never mind then.
Anyway, thanks for your explanation, at least some issues have been resolved..

 

[ipdev]

I have tried again and now i fail all three integrity check as can been seen in the screenshot below.
Current setup
OP9
Magisk installed
Custom ROM Evox
No USNF module installed
com.google.android.gms.unstable and com.google.android.gms added to the denylist

Adding gms processes to the denylist will do nothing unless you are enforcing the denylist or using another module that sources the denylist.

If your rom incudes integrity (SafteyNet) fix(s). Try enforcing the denylist in Magisk and see what happens.

Note:
Make sure to clear cache/data of PI checker before testing again.
Might also have to clear cache/data of PlayStore/PlayServices and let them update again.

SafetyNet (com.google.android.gms.unstable) is required.
Main GMS (com.google.android.gms) is only required if Magisk is not in /sbin.
It can/will cause problems if GMS is added when not required.

Cheers.

 

[ipdev]

Try clearing Play Services data and all modules disabled except USNF... Also, can use older @Displax modded build unless device launched with A13 (Pixel 7 etc)... And you don't need Play Store in denylist... PW

You can still use Displax's mod version on devices released with Android 13.

You just need to edit the service script after installing the module.
Add the fallback to the service script and then reboot.

if [[ "$(getprop ro.product.first_api_level)" -ge 33 ]]; then
  resetprop ro.product.first_api_level 32
fi

USNF - [Github] - commit

Cheers.