[MODULE] Play Integrity Fix [SafetyNet fix updated fork]

[chiteroman]

PLAY INTEGRITY FIX​

A Magisk (and Zygisk) module that works as an alternative to safetynet-fix.

Which module is better? Which one should I use?
The answer is the one that works best for your device, the best thing to do is to try Displax first and if it works well for you, then stick with that one.
However, some devices THAT HAVE BEEN RELEASED with Android 13 or higher have problems using the Displax module because the "ro.product.first_api_level" property is altered in all namespaces (except this version), which causes instability in the system, like Wi-Fi calling not working.

NOTE: Don't use kdrag0n module, it's outdated and doesn't work.

Spoiler: Boring tecnical details

All devices THAT HAVE BEEN RELEASED with Android 13 or higher will force a hardware attestation (HARDWARE_BACKED), so unless you manage to hack the TEE (and the StrongBox if there is one) of your device (good luck ) you will never be able to get the DEVICE verdict.

Google checks the integrity of your device by collecting data from the process "com.google.android.gms.unstable", this calls DroidGuard which we could say is Google's anticheat for Android. The point is that Google checks through a native library (.so) the property "ro.product.first_api_level", if this property is higher than 32 or doesn't exist (empty string) it will force a hardware attestation.
What my module does is to force the value of this property to 25, thus forcing a simple (BASIC) attestation. In addition, my module includes some changes in the implementation of the Zygisk library and the Java code that is injected, which makes it (in theory) work on more devices.

Download the latest version:

Release v8.6 · chiteroman/PlayIntegrityFix

Remove a lot of useless code in final shared libraries Improved Java code Allow MagiskHidePropsConfig to be installed (needed for few devices, check #3 issue on GitHub) Disable safetynet-fix instea...

github.com

 

[Lord Sithek]

A module fork of @Displax one: https://forum.xda-developers.com/t/module-mod-universal-safetynet-fix.4553699/

With this module you will fix Play Integrity veredicts including Strong one (until Google fixes it).

Remember to remove any other modules like safetynet-fix which may affect the functionality of this module.


To read logs use this command:
adb shell "logcat | grep 'SNFix'"

Check your first_api_level prop:
adb shell getprop ro.product.first_api_level


If your device fail Device/Basic make sure you have Shamiko module installed. If you found any bug @ me and send logs.


TODO:
- Spoof hardware bootloader (local) attestations in deny list .

Thanks for your great efforts, as well as @Displax, @kdrag0n and others who contributed 🫶

 

[jons99]

A module fork of @Displax one: https://forum.xda-developers.com/t/module-mod-universal-safetynet-fix.4553699/

With this module you will fix Play Integrity veredicts including Strong one (until Google fixes it).

Remember to remove any other modules like safetynet-fix which may affect the functionality of this module.


To read logs use this command:
adb shell "logcat | grep 'SNFix'"

Check your first_api_level prop:
adb shell getprop ro.product.first_api_level


If your device fail Device/Basic make sure you have Shamiko module installed. If you found any bug @ me and send logs.


TODO:
- Spoof hardware bootloader (local) attestations in deny list .

is this a modification to the displax mod of kdrag0ns module?
what's the difference?

 

[chiteroman]

is this a modification to the displax mod of kdrag0ns module?
what's the difference?

You can pass Strong and your system (should) be stable and don't crash nothing.

 

[jons99]

You can pass Strong and your system (should) be stable and don't crash nothing.

thank you all green on asus zenfone 9 a13

 

[shoey63]

Almost perfect on ROG phone 3

 

[47here]

Almost perfect on ROG phone 3
View attachment 5959413



View attachment 5959411View attachment 5959417

My bootloader still show unlock what you do to hide it?

 

[shoey63]

My bootloader still show unlock what you do to hide it?

Nothing.
It's a flaw in Rog 3.

Edit:
And yes, my bootloader is really unlocked and
I'm rooted

 

[casouzaj]

Thank you, @swer45! I uninstalled @Displax's Test4 module and installed yours. Likewise, my Xperia XZ2, running LineageOS 20.0, passes all three PI tests with your new module.

 

[m0han]

Poco X3 Karna, AICP A12.1, Magisk Delta Canary, Riru. All good on TB Checker.

 

[m0han]

Anyone have success on OnePlus 11 5G?

Spoiler

I'd check if I could get the device rooted nice and proper. I could use some help. Anyone?

 

[Spartacus500]

Samsung Galaxy S7 edge Custom Pie 9.0 Rom NFE
Meets Strong integrity

 

[V0latyle]

What are the differences between this and Displax module? I assume the Strong fix works the same way - spoof Pixel 2 shipped with Android 13?

 

[chiteroman]

What are the differences between this and Displax module? I assume the Strong fix works the same way - spoof Pixel 2 shipped with Android 13?

This one only spoof first api level in GMS process, so it won't affect system. Also I cleaned source code.

 

[chiteroman]

I tried to spoof a fake root of trust and it worked! But only works in Key Attestation Demo because it's a very simple app, when I want to try it with a real app like CIB it crashes and in Momo it gives an error of "Service not responding". Also sometimes the system crashes and it's very easy to detect.

Solution? Use my Xposed module (easy to detect) or modify framework.jar and implement hook by yourself (better).

So this module won't have that option.

 

[vindicatorr]

Same triple fails as I got with Displax ...

07-21 19:20:37.264  3689  3689 I SNFix/Zygisk: Dex size in memory: 9000
07-21 19:20:37.305  3689  3689 I SNFix/Zygisk: __system_property_read_callback handle: 0x79b3f2e3a4
07-21 19:20:37.305  3689  3689 I SNFix/Zygisk: Get system class loader
07-21 19:20:37.305  3689  3689 I SNFix/Zygisk: Create InMemoryDexClassLoader
07-21 19:20:37.306  3689  3689 I SNFix/Zygisk: Load class
07-21 19:20:37.307  3689  3689 I SNFix/Zygisk: Call init
07-21 19:20:37.311  3689  3689 D SNFix/Java: [null] Entry point: Initializing SafetyNet patches
07-21 19:20:37.311  3689  3689 D SNFix/Java: [null] Initializing SecurityBridge
07-21 19:20:37.312  3689  3689 D SNFix/Java: [null] Real provider=AndroidKeyStore version 1.0, keystore=java.security.KeyStore@e6c07a, spi=android.security.keystore2.AndroidKeyStoreSpi@941502b
07-21 19:20:37.314  3689  3689 D SNFix/Java: [null] Init proxy provider - wrapping AndroidKeyStore version 1.0
07-21 19:20:37.314  3689  3689 D SNFix/Java: [null] Removing real provider
07-21 19:20:37.314  3689  3689 D SNFix/Java: [null] Inserting provider AndroidKeyStore version 1.0
07-21 19:20:37.315  3689  3689 D SNFix/Java: [null] Security hooks installed
07-21 19:20:37.315  3689  3689 D SNFix/Java: [null] Patch DEVICE_INITIAL_SDK_INT prop. Set it to: 26
07-21 19:20:37.315  3689  3689 I SNFix/Zygisk: Cleaning...
07-21 19:20:37.426  3689  3689 D SNFix/Java: [com.google.android.gms.unstable] Provider: get service - type=CertificateFactory algorithm=X.509
07-21 19:20:37.489  3689  3689 D SNFix/Java: [com.google.android.gms.unstable] Provider: get service - type=KeyStore algorithm=BKS
07-21 19:20:37.489  3689  3689 D SNFix/Java: [com.google.android.gms.unstable] Patch PRODUCT prop. Set it to: walleye
07-21 19:20:37.489  3689  3689 D SNFix/Java: [com.google.android.gms.unstable] Patch DEVICE prop. Set it to: walleye
07-21 19:20:37.489  3689  3689 D SNFix/Java: [com.google.android.gms.unstable] Patch MODEL prop. Set it to: Pixel 2
07-21 19:20:37.489  3689  3689 D SNFix/Java: [com.google.android.gms.unstable] Patch FINGERPRINT prop. Set it to: google/walleye/walleye:8.1.0/OPM1.171019.011/4448085:user/release-keys
07-21 19:20:37.818  3689  3743 D SNFix/Java: [com.google.android.gms.unstable] Provider: get service - type=KeyStore algorithm=AndroidKeyStore
...
07-21 19:20:37.818  3689  3743 D SNFix/Java: [com.google.android.gms.unstable] Init proxy KeyStore SPI
07-21 19:20:37.819  3689  3743 D SNFix/Java: [com.google.android.gms.unstable] Provider: get service - type=KeyPairGenerator algorithm=EC
07-21 19:20:37.819  3689  3743 D SNFix/Java: [com.google.android.gms.unstable] Provider: get service - type=KeyPairGenerator algorithm=EC
07-21 19:20:37.939  3689  3743 D SNFix/Java: [com.google.android.gms.unstable] Provider: get service - type=KeyStore algorithm=AndroidKeyStore
...
07-21 19:21:57.518  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Provider: get service - type=KeyStore algorithm=AndroidKeyStore
07-21 19:21:57.518  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Patch PRODUCT prop. Set it to: walleye
07-21 19:21:57.518  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Patch DEVICE prop. Set it to: walleye
07-21 19:21:57.518  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Patch MODEL prop. Set it to: Pixel 2
07-21 19:21:57.518  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Patch FINGERPRINT prop. Set it to: google/walleye/walleye:8.1.0/OPM1.171019.011/4448085:user/release-keys
07-21 19:21:57.518  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Init proxy KeyStore SPI
07-21 19:21:57.521  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Provider: get service - type=KeyPairGenerator algorithm=EC
07-21 19:21:57.552  3689  4388 I SNFix/Zygisk: Hacking first_api_level, original value: 31
07-21 19:21:57.806  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Provider: get service - type=KeyStore algorithm=AndroidKeyStore
07-21 19:21:57.806  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Patch PRODUCT prop. Set it to: walleye
07-21 19:21:57.806  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Patch DEVICE prop. Set it to: walleye
07-21 19:21:57.806  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Patch MODEL prop. Set it to: Pixel 2
07-21 19:21:57.806  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Patch FINGERPRINT prop. Set it to: google/walleye/walleye:8.1.0/OPM1.171019.011/4448085:user/release-keys
07-21 19:21:57.806  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Init proxy KeyStore SPI
07-21 19:21:57.812  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Proxy key store: get certificate chain
07-21 19:21:57.812  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Stack trace element: dalvik.system.VMStack.getThreadStackTrace(Native Method)
07-21 19:21:57.812  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Stack trace element: java.lang.Thread.getStackTrace(Thread.java:1841)
07-21 19:21:57.812  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Stack trace element: b.a.engineGetCertificateChain(SourceFile:1)
07-21 19:21:57.812  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Stack trace element: java.security.KeyStoreSpi.engineGetEntry(KeyStoreSpi.java:513)
07-21 19:21:57.812  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Stack trace element: java.security.KeyStore.getEntry(KeyStore.java:1581)
07-21 19:21:57.812  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Stack trace element: com.google.ccc.abuse.droidguard.DroidGuard.initNative(Native Method)
07-21 19:21:57.812  3689  5502 D SNFix/Java: [com.google.android.gms.unstable] Blocking call
07-21 19:21:57.884  3689  5502 I SNFix/Zygisk: Hacking first_api_level, original value: 31
07-21 19:21:58.350  3689  5681 I SNFix/Zygisk: Hacking first_api_level, original value: 31
07-21 19:21:59.003  3689  3743 I SNFix/Zygisk: Hacking first_api_level, original value: 31

"$ getprop | grep -i walleye" results in nothing.
"Patch <*> prop", however "[ro.product.build.fingerprint]: [google/gsi_gms_arm64/gsi_arm64:13/T3B3.230413.003/9957835:user/release-keys]".

 

[acwcanada]

Displax's 2.4.0 pass device and basic, and his "Strong" passes all 3. I got "Red" on all 3 with yours, install Shamiko doesn't make any difference. My Pixel 6 Pro is on A14 Beta 4, have no idea if this is the reason.

 

[immortalwon]

A module fork of @Displax one: https://forum.xda-developers.com/t/module-mod-universal-safetynet-fix.4553699/

With this module you will fix Play Integrity veredicts including Strong one (until Google fixes it).

Remember to remove any other modules like safetynet-fix which may affect the functionality of this module.


To read logs use this command:
adb shell "logcat | grep 'SNFix'"

Check your first_api_level prop:
adb shell getprop ro.product.first_api_level


If your device fail Device/Basic make sure you have Shamiko module installed. If you found any bug @ me and send logs.

App to check Play Integrity: https://play.google.com/store/apps/details?id=gr.nikolasspyr.integritycheck

Works on one plus pro 9 and passes all play integrity checks even strong. Nice work but I don't give it long b4 being patched. A device with broken T.E.E keymaster sure is hilarious passing play integrity

 

[chiteroman]

Same triple fails as I got with Displax

Which modules are you using ?

 

[chiteroman]

Displax's 2.4.0 pass device and basic, and his "Strong" passes all 3. I got "Red" on all 3 with yours, install Shamiko doesn't make any difference. My Pixel 6 Pro is on A14 Beta 4, have no idea if this is the reason.

Try again with the new update, remember to install Shamiko and have enforce deny list disabled