Passing SafetyNet with Magisk's Zygisk + DenyList.

[CarbonGTR]

So, as of Magisk 24 we will no longer have Magisk Hide natively bundled with Magisk. Unless of course you use a fork of Magisk from another developer.
With Magisk Hide sunset, how do you pass SafetyNet without it?

Prequisites -

• Nokia 6.1 | Nokia 6.1 Plus | Nokia 6.2 | Nokia 7 Plus | Nokia 7.1 | Nokia 7.2
• Magisk 24
• Magisk HideProps Module
• Termux - Google Play | F-Droid
• YASNAC - To check SafetyNet Certification

Here's how -

1. Update to the latest magisk-canary(Read all the precautions before hand though).
2. Open the Magisk .apk and update it.
3. Open Magisk > Settings > Enable Zygisk & Enable Enforce DenyList.
4. Now tap on Configure DenyList (Tip: Tap on the 3 button menu and enable 'show system apps')
5. Now turn off your internet connections and enable Airplane Mode. Double check and ensure that Wifi is turned off after enabling Airplane Mode. Do not turn it on until later.
6. Configure DenyList for Google Play Store and Google Play Services and all the other apps you need root hidden from.
7. With Airplane Mode still disabled, go into the phone's settings > Apps > Clear data of all the apps you configured in the DenyList.
8. Install the MagiskHide Props Module and reboot.
9. Open Termux and grant root permissions by typing in

   su

10. Now type in

    props

11. Enter the 4th submenu
12. Configure so that the

    ro.boot.verifiedbootstate & ro.boot.flashlocked

    says active like in the screenshot.
    
13. Now Reboot
14. After boot, connect to the internet, let the phone sit idle for 5 - 10 minutes and check SafetyNet Status. You should be passing both Basic Integrity and CtsProfile and Google Play certification.

And that's pretty much it.

 

[CarbonGTR]

Reserved.

 

[mGforCe]

Thanks @CarbonGTR. Is there any known kernel with these 3 commits?

 

[CarbonGTR]

Thanks @CarbonGTR. Is there any known kernel with these 3 commits?

Yep, there's Enigma Kernel, which I maintain.

 

[mGforCe]

Yep, there's Enigma Kernel, which I maintain.

Thanks Thanuj

Since there is no thread for this kernel, checking here - will it work on Stock Pie rom?

 

[CarbonGTR]

Thanks Anuj

Since there is no thread for this kernel, checking here - will it work on Stock Pie rom?

Actually there is a thread in the 'Cross development section'
And yes, Android 9 is compatible

Edit - I've found a way to pass SafetyNet without a custom kernel.
Edit 2 - My name's Thanuj, not Anuj

 

[mGforCe]

Actually there is a thread in the 'Cross development section'
And yes, Android 9 is compatible

Edit - I've found a way to pass SafetyNet without a custom kernel.
Edit 2 - My name's Thanuj, not Anuj

Thanks Thanuj

Ok, I got the thread. Was checking in our device only.

But for me, somehow, while bootloader unlock is fine, TWRP/LOS recovery all are disaster. So moved to Stock Pie

 

[ardwivedi16]

Thank you very much for your guide! It works like a charm on every rom I tried