[MODULE] [MOD] Universal SafetyNet Fix

[kevinco1]

Hello...
does this work for Magisk Delta (25206) ?
Thank You

Yes, it's always worked with Delta

 

[volcram]

Ups ! My fault !!! CaixaBank working now; I forgot to add it to the exclusion list after erasing its data...

If this lasts, it's a WIN !!! THANKS...

What version of CBS is working for you? I can't get CBS 1.30.0 to work. Thanks

 

[cognitivedissonance]

Patches to Android (Lucky Patcher Module), Pixelify, Pixelify uninstaller services, Shamiko, substratum, Systemless Hosts, Universal SafetyNet Fix, VIPER4Android FX repackagedhoch43, YouTube-latest ReVanced Extended, Zygisk - Enhanced mode for Storage Isolation, Zygisk - LSPosed, Zygisk - Sui.
Yes.
Yes, using The SELinux Switch (there is a chance that it probably doesn't work because of my kernel but searching around, it doesn't seems to exist a custom kernel to my device so).
No.

Still the same.


Google Wallet, Play Store, Play Integrity API Checker, yes.

Made everything you said (besides LineageOS, Gapps and flashing Magisk with TWRP using the zip file), cleaning the app data using App Manager and still the same.

FYI, the most likely culprit is LP, and the modded play store. Once I ditched those, I was able to pass the first two integrity checks. To be fair, I haven't tried reinstalling LP now that I'm passing, so you could still give that a go.

 

[HoshiHikirai]

Is working on all aosp roms based after flash this, but not when use original module, but miui doesn't have this problem (not miui: mean safety check fails 1 of 2)

Idk why the original module safety check fails in all aosp roms (even with safety passed out of the box) but not in miui, but before that, i doesn't have any problem with original module, maybe its Google?

 

[HoshiHikirai]

Anyway this mod version is amazing , working even on miui (doesn't have any problem)

 

[david003]

For what it's worth, I've tried several times, but I'm unable to get it to work successfully with xiaomi.eu 14.0.1.0, installing magisk 25.2 and safetynetfix 2.4.0 mod 1.2. With Zygisk enabled, with or without enforcing.

YASNAC fails basic integrity and CTS profile match, and Integrity Checker fails device_integrity and basic_integrity.

 

[Tomek0000]

david003​

If you did all ok, lets go back to magisk and check app list in it. It is possible the google play services is not checked. If you do it , and restart phone, or only start magisk again, it can be unchecked again (and CTS will fail as result). It is not fixable.
I replaced magisk to delta version and use SuList instead .

 

[nickleby]

For what it's worth, I've tried several times, but I'm unable to get it to work successfully with xiaomi.eu 14.0.1.0, installing magisk 25.2 and safetynetfix 2.4.0 mod 1.2. With Zygisk enabled, with or without enforcing.

YASNAC fails basic integrity and CTS profile match, and Integrity Checker fails device_integrity and basic_integrity.

For me, safetynetfix is not enough, I have to use hideprops also and select a new fingerprint (that match the current Android version) to pass CTS profile.

 

[pndwal]

For what it's worth, I've tried several times, but I'm unable to get it to work successfully with xiaomi.eu 14.0.1.0, installing magisk 25.2 and safetynetfix 2.4.0 mod 1.2. With Zygisk enabled, with or without enforcing.

YASNAC fails basic integrity and CTS profile match, and Integrity Checker fails device_integrity and basic_integrity.

Later USNF builds fro @Displax actually play better with custom ROMs that already integrate SNF (from @kdrag0n Proton project) or fixes from @Displax, but there can still be conflicts with custom ROMs that do this (eg XiaomiEU) and may also spoof additional prop values etc...

If the ROM's embedded SNF/spoofing is up to date and capable of passing PI deviceIntegrity w/o Magisk, when you install Magisk you should NOT install any USNF module... You only need to hide root from droidguard/attestation (com.google.android.gms.unstable) gms (Play Services) process by adding this in denylist (and main com.google.android.gms process for most A11+ devices)...

Otherwise you may need to upgrade ROM or wait for maintainer to update the integrated attestation... PW

 

[pndwal]

david003
If you did all ok, lets go back to magisk and check app list in it. It is possible the google play services is not checked. If you do it , and restart phone, or only start magisk again, it can be unchecked again (and CTS will fail as result). It is not fixable.
I replaced magisk to delta version and use SuList instead .

USNF hides attestation/droidguard (com.google.android.gms.unstable) gms (Play Services) process itself since Denylist breaks USNF's key functions, especially the injection of code in gms to register a fake keystore and cause the fallback to basic attestation... That's why if you add this to denylist it will kill USNF (deviceIntegrity will be failing) if Denylist is enforced until next boot when USNF will actually remove it from denylist for you!...

With Zygisk based USNF, simply don't add any gms (Google Play Services) processes to Denylist... PW

 

[david003]

Later USNF builds fro @Displax actually play better with custom ROMs that already integrate SNF (from @kdrag0n Proton project) or fixes from @Displax, but there can still be conflicts with custom ROMs that do this (eg XiaomiEU) and may also spoof additional prop values etc...

If the ROM's embedded SNF/spoofing is up to date and capable of passing PI deviceIntegrity w/o Magisk, when you install Magisk you should NOT install any USNF module... You only need to hide root from droidguard/attestation (com.google.android.gms.unstable) gms (Play Services) process by adding this in denylist (and main com.google.android.gms process for most A11+ devices)...

Otherwise you may need to upgrade ROM or wait for maintainer to update the integrated attestation... PW

Thanks. I tried this, reinstalling magisk without the USNF module and adding com.google.android.gms to the DenyList. It still failed, though. Hopefully things will get sorted out eventually. Until then I've been temporarily installing magisk to run backups and then uninstalling it.

 

[pndwal]

Thanks. I tried this, reinstalling magisk without the USNF module and adding com.google.android.gms to the DenyList. It still failed, though. Hopefully things will get sorted out eventually. Until then I've been temporarily installing magisk to run backups and then uninstalling it.

Did you mean just com.google.android.gms process? Should be that + com.google.android.gms.unstable for most A11+ installations...And did you check S/N and PI results without Magisk?; That would indicate if inbuilt fixes are working... PW

 

[david003]

Did you mean just com.google.android.gms process? Should be that + com.google.android.gms.unstable for most A11+ installations...And did you check S/N and PI results without Magisk?; That would indicate if inbuilt fixes are working... PW

I had added all of Google Play Services to the denylist, that includes com.google.android.gms and com.google.android.gms.unstable, and a lot of others. I tried again, and added just those 2 to the deny list, and it appears to have worked.

The integrity checks pass, both with unrooted xiaomi.eu, and with magisk with those 2 added to the deny list, without the USNF module.

My banking app still fails, though (it works with unrooted xiaomi.eu). But that's another issue. I suspect it's trying to check something else I haven't figured out, yet.

Thank you!

 

[pndwal]

I had added all of Google Play Services to the denylist, that includes com.google.android.gms and com.google.android.gms.unstable, and a lot of others. I tried again, and added just those 2 to the deny list, and it appears to have worked.

You shouldn't deny most Google stuff... You may have unexpected issues... Only we only need those two gms services added... If you hide Chrome components for example, you may break webview for other apps depending on Android version...

The integrity checks pass, both with unrooted xiaomi.eu, and with magisk with those 2 added to the deny list, without the USNF module.

Good to know XiaomiEU has current SNF...

My banking app still fails, though (it works with unrooted xiaomi.eu). But that's another issue. I suspect it's trying to check something else I haven't figured out, yet.

Certainly is... An no surprise...

Can you say app?

Thank you!

Welcome... PW

 

[david003]

You shouldn't deny most Google stuff... You may have unexpected issues... Only we only need those two gms services added... If you hide Chrome components for example, you may break webview for other apps depending on Android version...

Good to know XiaomiEU has current SNF...

Certainly is... An no surprise...

Can you say app?

Welcome... PW

The banking app is BDO.

 

[pndwal]

The banking app is BDO.

Easy one:

My device:
Xiaomi RN8T stock A11 MIUI,
Magisk Canary 25209,
Magisk App hidden in stub,
Latest Shamiko public release (for proper root hiding),
LSPosed Hide My AppList module configured to hide all apps associated with root,*
OEM unlocking disabled,*
USB debugging disabled,*
Developer options disabled.*

* = confirmed not needed for your app.

I suspect just using proper root hiding (Shamiko or other) should get you going... And maybe you haven't taken Hide the Magisk app option in Magisk app?... PW

 

[david003]

Easy one:
View attachment 5874301
My device:
Xiaomi RN8T stock A11 MIUI,
Magisk Canary 25209,
Magisk App hidden in stub,
Latest Shamiko public release (for proper root hiding),
LSPosed Hide My AppList module configured to hide all apps associated with root,*
OEM unlocking disabled,*
USB debugging disabled,*
Developer options disabled.*

* = confirmed not needed for your app.

I suspect just using proper root hiding (Shamiko or other) should get you going... And maybe you haven't taken Hide the Magisk app option in Magisk app?... PW

Thank you for trying all that. I'm still not able to get it to work. Magisk was hidden already. I added Shamiko, but it still failed. I also added LSPosed and Hide My AppList, but it still failed even with those.

 

[pndwal]

Thank you for trying all that. I'm still not able to get it to work. Magisk was hidden already. I added Shamiko, but it still failed. I also added LSPosed and Hide My AppList, but it still failed even with those.

Just checked and this app works for me w/o Shamiko hiding (ie with Denylist enforced)...

Please give device details; ROM, any custom recovery, any unusual mods...

Try with all modules other than USNF disabled (reboot and check still have PI deviceIntegrity)... And are you clearing app data before each test? App in denylist of course(?)...

Please show Momo and Ruru detector results... PW

 

[blksith0]

OEM unlocking disabled,*

But what about custom ROMs?

 

[pndwal]

But what about custom ROMs?

You can disable this in LineageOS... I think you can in most ROMs, but apparently it doesn't show in some...

Wasn't needed for the app mentioned anyway... You can leave as is if it's not detected... PW