Related
This module hides bootloader unlock from the entire system, including GMS, meaning that stock ROMs can pass custom verification, as well as custom ROMs with magisk enabled. Module code is here. The actual code of this module (see post-fs-data.sh) can be used to pass safetynet on stock ROMs, even without magisk, provided your /system is unmodified! :angel::highfive:
The module is tested on my Honor 9 Lite, unlocked, lineageos 15.1, MM 5.6.3, Magisk 16.0
Download: Magisk Downloads page
WARNING: phhusson ROMs, as well as official Google gsi's without a fingerprint patch cannot pass safetynet without V2 or higher, or magiskhide props config
Debugging:
Please open a root shell and run
Code:
safetypatch
and select option 1 to debug.
If, in /proc/cmdline, androidboot.verifiedbootstate is green, this module is functioning correctly and some other aspect of your system is detected by safetynet.
Note: Pie ROMs might need ianmacd magisk builds to pass any kind of safetynet. In my experience you need this module and ianmacd magisk.
hackintosh5 said:
This module hides bootloader unlock from the entire system, including GMS, meaning that stock ROMs can pass custom verification, as well as custom ROMs with magisk enabled. Module code is here. The actual code of this module (see post-fs-data.sh) can be used to pass safetynet on stock ROMs, even without magisk, provided your /system is unmodified! :angel::highfive:
The module is tested on my Honor 9 Lite, unlocked, lineageos 15.1, MM 5.6.3, Magisk 16.0
Download: https://github.com/penn5/SafetyPatch/releases/tag/v1
Click to expand...
Click to collapse
Hello, thanks for your work, but i don't understand how this module, by this shell:
Code:
mount -o bind /data/local/tmp/cmdline /proc/cmdline
sed 's/ORANGE/GREEN/' /proc/cmdline > /data/local/tmp/cmdline
is supposed to fix the SN ?
Also i don't think that it could help to fix the SN if Xposed is installed ? Tell me if i'm wrong..
Rom said:
Hello, thanks for your work, but i don't understand how this module, by this shell:
is supposed to fix the SN ?
Also i don't think that it could help to fix the SN if Xposed is installed ? Tell me if i'm wrong..
Click to expand...
Click to collapse
This is not for SN, but to fix safetynet fail. Use HCU to fix SN.
Sent from my kminiltexx using XDA Labs
Doesn't Magisk itself already hides the unlocked BL state?
Sent from my Xiaomi Redmi Note 5 using XDA Labs
VincentJoshuaET said:
Doesn't Magisk itself already hides the unlocked BL state?
Click to expand...
Click to collapse
No. Magisk hides itself
Sent from my kminiltexx using XDA Labs
hackintosh5 said:
No. Magisk hides itself
Sent from my kminiltexx using XDA Labs
Click to expand...
Click to collapse
Wrong...
MagiskHide does hide a few system properties, among others an unlocked bootloader.
https://github.com/topjohnwu/Magisk...2cebb240c4/native/jni/magiskhide/hide_utils.c
If you have an additional method for hiding an unlock bootloader, that would make a great addition to MagiskHide. You could open a pull request for it to be included in a future release.
Didgeridoohan said:
Wrong...
MagiskHide does hide a few system properties, among others an unlocked bootloader.
https://github.com/topjohnwu/Magisk...2cebb240c4/native/jni/magiskhide/hide_utils.c
If you have an additional method for hiding an unlock bootloader, that would make a great addition to MagiskHide. You could open a pull request for it to be included in a future release.
Click to expand...
Click to collapse
Correct...
MagiskHide doesn't hide anything in the cmdline. If you're going to disclaim my module, at least do your research. Even in the README, I tell the commands that the module uses.
Yes, that's a good idea. I will submit a PR, thanks for the idea!
Sent from my kminiltexx using XDA Labs
hackintosh5 said:
If you're going to disclaim my module, at least do your research.
Click to expand...
Click to collapse
Calm down... There was no disclaiming of your module in my post. Just your statement that Magisk does not hide an unlocked bootloader. It does...
But of course, there are many different Android devices and there are many different ways of doing things, and they don't work the same universally. Which is why I suggested you make a PR of the method you have. :good:
I'm using a pixel xl on dp3 and this doesn't help to pass basic integrity. Both basic and cts are still failing
bkkzak said:
I'm using a pixel xl on dp3 and this doesn't help to pass basic integrity. Both basic and cts are still failing
Click to expand...
Click to collapse
Official ROMs not designed for production use will intentionally force the system to fail safetynet. This will be detected and so fail
Sent from my kminiltexx using XDA Labs
hackintosh5 said:
This module hides bootloader unlock from the entire system, including GMS, meaning that stock ROMs can pass custom verification, as well as custom ROMs with magisk enabled. Module code is here. The actual code of this module (see post-fs-data.sh) can be used to pass safetynet on stock ROMs, even without magisk, provided your /system is unmodified! :angel::highfive:
The module is tested on my Honor 9 Lite, unlocked, lineageos 15.1, MM 5.6.3, Magisk 16.0
Download: https://github.com/penn5/SafetyPatch/releases/tag/v1
WARNING: phhusson ROMs cannot pass safetynet.
Click to expand...
Click to collapse
Excuse me, how do I install the module?
Twixy13 said:
Excuse me, how do I install the module?
Click to expand...
Click to collapse
Magisk Manager -> Modules -> + -> Find the zip.
Sent from my kminiltexx using XDA Labs
Do i need a custom kernel for this to work?
It's not working on my stock honor 8. I even tried it with magiskhide props config with a honor 9 and galaxy 6 fingerprint and play store is still uncertified which means safetynet fails
JimZiii said:
play store is still uncertified which means safetynet fails
Click to expand...
Click to collapse
The two are related, yes, but one doesn't exclude the other (you can pass SafetyNet and still be uncertified).
Check SafetyNet with the Magisk Manager or a separate app. If it passes, clear data for the Play Store and reboot. That should be it...
Didgeridoohan said:
The two are related, yes, but one doesn't exclude the other (you can pass SafetyNet and still be uncertified).
Check SafetyNet with the Magisk Manager or a separate app. If it passes, clear data for the Play Store and reboot. That should be it...
Click to expand...
Click to collapse
Ok, for some reason I still can't pass. I've checked it with magisk and a separate app. Even after I factory reset my phone, flashed new firmware and the first thing I installed was magisk to try the safetynet and still I couldn't pass. First I thought it might be something in the new firmware so I tried a bunch of older firmwares which all had the same result.
JimZiii said:
Ok, for some reason I still can't pass. I've checked it with magisk and a separate app. Even after I factory reset my phone, flashed new firmware and the first thing I installed was magisk to try the safetynet and still I couldn't pass. First I thought it might be something in the new firmware so I tried a bunch of older firmwares which all had the same result.
Click to expand...
Click to collapse
This is getting slightly OT for this thread (but that's up to @hackintosh5, of course). Take a look here (start with the Basics and then move on to the SafetyNet chapter) and if you still need help after that, I think you'd better move it to the General support thread:
https://www.didgeridoohan.com/magisk/MagiskHide
And don't forget this part:
https://www.didgeridoohan.com/magisk/MagiskHideHelp
Didgeridoohan said:
This is getting slightly OT for this thread (but that's up to @hackintosh5, of course). Take a look here (start with the Basics and then move on to the SafetyNet chapter) and if you still need help after that, I think you'd better move it to the General support thread:
https://www.didgeridoohan.com/magisk/MagiskHide
And don't forget this part:
https://www.didgeridoohan.com/magisk/MagiskHideHelp
Click to expand...
Click to collapse
Ok, I think I found the problem, magiskhide don't seem to be working. I get logs so logging must be on and namespace is working because there's no error on proc_monitor or anywhere else in the magisk logs. But if I hide a root checker our another app using root they still get root.
Do you have any ideas?
JimZiii said:
Ok, I think I found the problem, magiskhide don't seem to be working. I get logs so logging must be on and namespace is working because there's no error on proc_monitor or anywhere else in the magisk logs. But if I hide a root checker our another app using root they still get root.
Do you have any ideas?
Click to expand...
Click to collapse
Is magisk hide actually turned on?
Sent from my kminiltexx using XDA Labs
hackintosh5 said:
Is magisk hide actually turned on?
Sent from my kminiltexx using XDA Labs
Click to expand...
Click to collapse
yes its on, i've added specific apps to try if they still got root and there's no difference when i check the box in magisk hide for apps
JimZiii said:
yes its on, i've added specific apps to try if they still got root and there's no difference when i check the box in magisk hide for apps
Click to expand...
Click to collapse
Apps can still detect root, even if you pass safetynet. Run the magisk inbuilt checker
Sent from my kminiltexx using XDA Labs
I got a problem. My Google Pay app doesn't work. I got magisk v18 with 2 modules: "universal safetynet fix v3-beta1 (magisk v17 fix)" and google face unlock. When I check the status it shows the two "ctsprofile" and "basicintegrity" as true both. In magisk hide, I selected "Google Pay" and "NFC service" apps, but also without their selection it isn't still recognized by a pos. Now, I'm really sure my payment card works, my bro one with a phone unrooted works fine.
How should I do for make pos recognize my LG H815 rooted Gpay?
Sorry my bad english
p.s. I haven't any xposed or similar installed.
On my OP6 with OOS 9.0.3, CTS returns false without any additional modules and Google Pay and other apps detect root and refuse to work. That happened with the update from 17.2 to 18.0
Unfortunately, I got no helping hint in the main support thread or in the other thread here reporting on failing banking apps.
Later... after downgrading to Magisk 17.2, MagiskHide is working again... an issue is open on Github on that.
Yeah but gpay still not working in my phone, also with magisk 17.2
theicecave said:
Yeah but gpay still not working in my phone, also with magisk 17.2
Click to expand...
Click to collapse
I'll try that when I'm next time in a shop here... but as Safetynet works, GPay should too...
akxak said:
I'll try that when I'm next time in a shop here... but as Safetynet works, GPay should too...
Click to expand...
Click to collapse
And that's the paradox. Lemme know.
Just was at a shop and paid successfully with Google Pay. 17.2 rocks.
Idk why mine is not recognized by pos. And for sure I can say that my NFC works, I use it with my headsets. It's a problem with my phone, it's rooted, and that's it. Gpay cannot be used with root, although it accepted my card payment card after I protected my ctsprofile etc. I lost hope
My OP6 is unlocked and rooted with Magisk. Back on 17.2 SafetyNet checks succeed again and I just could pay... with Magisk 18 though it failed.
What phone and how did you root?
akxak said:
My OP6 is unlocked and rooted with Magisk. Back on 17.2 SafetyNet checks succeed again and I just could pay... with Magisk 18 though it failed.
What phone and how did you root?
Click to expand...
Click to collapse
Which module do you use to protect safetynet, ctsprofile etc?
Just asking.. 'cause, as I told, also with magisk 17.2 it doesn't work.
No module, just plain Magisk and MagiskHide on Google Pay.
akxak said:
No module, just plain Magisk and MagiskHide on Google Pay.
Click to expand...
Click to collapse
No module? I need necessary to use "universal safetynet fix" to activating all 4 green checks on main page of magisk. Without it, last 2 (inside safetynet fix) are red: ctsprofile:false and basicintegrity:false.
And magisk hide with or not selecting gpay doesn't change anything.
However I'm considering the main problem is my rom, resurrection remix.
On OOS I have only two arrows...
ctsProfile and basicIntegrity
But I am on a stock rom
Yeah sorry my bad, I mean just these two.
I'm considering to flash my stock rom again. But it was Android 6. I should set nova launcher and lots of changes to modernize it : D
Also my bro used a stock one to let gpay work. Modded all ones seems not working.
I'm on Android 9 Pie... Nova is great, I use it myself.. with starting on the Oneplus, I stuck to the stock OS and had gold experiences... on the OP6 even mire as I can update it and keep it rooted from within the OS not needing TWRP anymore... allowing an easy upgrade process.
Just flashed up the stock rom of my H815. I installed magisk 17.2 (it's an android nougat). I activated MagiskHide only for Google Pay; now safety net says ctsProfile: false and basicIntegrity: true. I watched this thread and just at beginning of section Safetynet fix - changing device fingerprint seems to be my problem. But my phone hasn't fingerprint (rofl). So after installing modules MagiskHide Props Config and Busybox by osm0sis cts is still false. Watched this because seems the only well built guide about; this problem is splitted anywhere. No more ideas.
theicecave said:
Just flashed up the stock rom of my H815. I installed magisk 17.2 (it's an android nougat). I activated MagiskHide only for Google Pay; now safety net says ctsProfile: false and basicIntegrity: true. I watched this thread and just at beginning of section Safetynet fix - changing device fingerprint seems to be my problem. But my phone hasn't fingerprint (rofl). So after installing modules MagiskHide Props Config and Busybox by osm0sis cts is still false. Watched this because seems the only well built guide about; this problem is splitted anywhere. No more ideas.
Click to expand...
Click to collapse
If I understand you correctly, I think you've misunderstood... It's not about a fingerprint scanner, it's the device fingerprint property that needs to change. You'll have to run the props script and select a certified fingerprint from the list (the module is not a flash and forget module). But if you're on a stock ROM I would expect the CTS check to pass, so there might be something else going on. Anyway, try changing the device fingerprint and see if anything changes.
Didgeridoohan said:
If I understand you correctly, I think you've misunderstood... It's not about a fingerprint scanner, it's the device fingerprint property that needs to change. You'll have to run the props script and select a certified fingerprint from the list (the module is not a flash and forget module). But if you're on a stock ROM I would expect the CTS check to pass, so there might be something else going on. Anyway, try changing the device fingerprint and see if anything changes.
Click to expand...
Click to collapse
Idk how to do this and where is this list. He just attached a .zip on his thread.
Or maybe I do not understand english enough. Very probably.
theicecave said:
Idk how to do this and where is this list. He just attached a .zip on his thread.
Or maybe I do not understand english enough. Very probably.
Click to expand...
Click to collapse
If you're talking about the thread you linked, the "he" is me...
Take a look in the module documentation, most things should be covered there. But basically, what you need is a Terminal emulator where you just type 'props' and press enter. After that you can just follow the ui to do the rest.
Didgeridoohan said:
If you're talking about the thread you linked, the "he" is me...
Take a look in the module documentation, most things should be covered there. But basically, what you need is a Terminal emulator where you just type 'props' and press enter. After that you can just follow the ui to do the rest.
Click to expand...
Click to collapse
Solved following this. In effect, not so different on what were you talking about in your guide. At the moment both ctsprofile and basicintegrity are true, I just need to try Google Pay in a pos.
I know other folks had issues with earlier updates, but this is the first time I've seen this. I skipped the last few updates. Does the Magisk patch method no longer work for rooting the Pixel 4 XL? Or is there some way to fix this?
The "hardware off" module from Displax might help you.
Sent from my Google Pixel 4 XL using XDA Labs
It's hardware based so nothing you can do about it
Patching your boot image with Magisk still works. With the recent implementation of hardware attestation, apps can now recognize if your bootloader is unlocked and safetynet checks result in ctsProfile failing. Magisk Hide still works and you can still hide root from most apps but cannot hide that your bootloader is unlocked unless you use either the hardwareoff mod or the Magisk Props mod.
Lughnasadh said:
Patching your boot image with Magisk still works. With the recent implementation of hardware attestation, apps can now recognize if your bootloader is unlocked and safetynet checks result in ctsProfile failing. Magisk Hide still works and you can still hide root from most apps but cannot hide that your bootloader is unlocked unless you use either the hardwareoff mod or the Magisk Props mod.
Click to expand...
Click to collapse
I tried MagiskHide Props Config but that didn't work - unless I need to do more than just replace the fingerprint. Replacing the fingerprint did not fix the problem. It's likely the Pixel 4 XL uses hardware backed key attestation to check the bootloader state, which I think means MagiskHide Props Config won't solve the problem.
I did find and install the hardwareoff mod and that fixed the problem. Thanks everyone who mentioned that. It was not available for download in Magisk but I found it buried deep in a 4000+ post thread on XDA.
https://forum.xda-developers.com/ap...systemless-t3432382/post83028387#post83028387
fuarkgl3 said:
It's hardware based so nothing you can do about it
Click to expand...
Click to collapse
Eventually you will be right, once Google makes hardware backed key attestation permanent. But for now the hardwareoff mod works.
No work for me
Basic integrity and CTS profile remains false.
madmartian said:
I tried MagiskHide Props Config but that didn't work - unless I need to do more than just replace the fingerprint.
Click to expand...
Click to collapse
Just for clarification: you would also have had to use the "Force BASIC attestation" option. It basically does the same thing as the hardware off mod, so you're good to go already...
So I have the same problem basic integrity but the cts profile fails. Iam in the January update.
I've done anything to fix it but 0 for me. And the problem is that it just happened from nowhere it was everything ok I was passing the safety net and in a moment the gpay made me a warning about contactless payments and the problem started.
Escribis said:
So I have the same problem basic integrity but the cts profile fails. Iam in the January update.
I've done anything to fix it but 0 for me. And the problem is that it just happened from nowhere it was everything ok I was passing the safety net and in a moment the gpay made me a warning about contactless payments and the problem started.
Click to expand...
Click to collapse
Go over to the Magisk thread. It's discussed there in detail and there has been a Magisk Mod released to fix it..
Lughnasadh said:
Go over to the Magisk thread. It's discussed there in detail and there has been a Magisk Mod released to fix it..
Click to expand...
Click to collapse
Can you give me the link my friend?
Lughnasadh said:
Go over to the Magisk thread. It's discussed there in detail and there has been a Magisk Mod released to fix it..
Click to expand...
Click to collapse
Found it, thank you very much sir.
Can you share the link please?
I also woke up to Google Pay warning, an update, than lost Magisk. I've re-installed it but now failing safetynet. Been attempting to fix it for 2 hours now
mushtafa said:
Can you share the link please?
I also woke up to Google Pay warning, an update, than lost Magisk. I've re-installed it but now failing safetynet. Been attempting to fix it for 2 hours now
Click to expand...
Click to collapse
Magisk General Support / Discussion
This is the place for general support and discussion regarding "Public Releases", which includes both stable and beta releases. All information, including troubleshoot guides and notes, are in the Announcement Thread
forum.xda-developers.com
Found the link. It works, just need to setup Google Pay again https://github.com/kdrag0n/safetynet-fix
Hey guys!
I recently flashed my Galaxy Note9 (SM-N960F, One UI 2.5) with TWRP and Magisk, all being the latest version. However my phone would just reboot randomly and I could barely find a pattern. I could only infer that the reboot is system level since most of the time I was launching a system-level app like Bixby, Torch, or just simply swipe down the notification panel. If related, 19:30 seems to be the time my phone would definitely reboot recently.
By ''partly goes back to a previous state' I mean some of my apps would be replaced to their factory version. Like I used YouTube Vanced, and after this one reboot it went back to its factory version. And Gboard was exiled of all its permissions once. My Edge Panel was reset after one boot. Some of the adb tweaks were reset.
I'm half sure this is a kernel problem, and the only modifications I did to my kernel were Magisk and Universal DM-Verity. I don't know if it's a DM-Verity problem.
I tried to disable my root permission for apps but it didn't help. Also Googled how to catch system logs but none of these worked.
If you're experiencing the same problem or have an idea of how to solve this issue please feel free to leave a comment!
Maspon said:
Hey guys!
I recently flashed my Galaxy Note9 (SM-N960F, One UI 2.5) with TWRP and Magisk, all being the latest version. However my phone would just reboot randomly and I could barely find a pattern. I could only infer that the reboot is system level since most of the time I was launching a system-level app like Bixby, Torch, or just simply swipe down the notification panel. If related, 19:30 seems to be the time my phone would definitely reboot recently.
By ''partly goes back to a previous state' I mean some of my apps would be replaced to their factory version. Like I used YouTube Vanced, and after this one reboot it went back to its factory version. And Gboard was exiled of all its permissions once. My Edge Panel was reset after one boot. Some of the adb tweaks were reset.
I'm half sure this is a kernel problem, and the only modifications I did to my kernel were Magisk and Universal DM-Verity. I don't know if it's a DM-Verity problem or I just disabled too many system apps (Galaxy Themes, Bixby Service, Galaxy Friends and stuff).
I tried to disable my root permission for apps but it didn't help. Also Googled how to catch system logs but none of these worked.
Whether you're experiencing the same problem or have an idea of how to solve this issue please feel free to leave a comment!
Click to expand...
Click to collapse
Happened to me as well few months ago.
I suspect it is related to safetynetfix or hideprop. I used safetynetfix for samsung, and update latest hideprop, now i never experienced the random reboot.
xfakexbloodx said:
Happened to me as well few months ago.
I suspect it is related to safetynetfix or hideprop. I used safetynetfix for samsung, and update latest hideprop, now i never experienced the random reboot.
Click to expand...
Click to collapse
Thanks for the reply! I just flashed Universal SafetyNet Fix. Now my phone is stuck in bootloop. It would just reboot infinitely. May I possibly get the SafetyNet Fix you're using?
Maspon said:
Thanks for the reply! I just flashed Universal SafetyNet Fix. Now my phone is stuck in bootloop. It would just reboot infinitely. May I possibly get the SafetyNet Fix you're using?
Click to expand...
Click to collapse
Based on this post
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Try to read each page, some people say it works, some people say it doesn't. I've tried and updating my magiskhide prop and it works.
xfakexbloodx said:
Based on this post
MAGISK MODULE ❯ Universal SafetyNet Fix 2.4.0
Universal SafetyNet Fix Magisk module Magisk module to work around Google's SafetyNet attestation. This module works around hardware attestation and recent updates to SafetyNet CTS profile checks. You must already be able to pass basic CTS...
forum.xda-developers.com
Try to read each page, some people say it works, some people say it doesn't. I've tried and updating my magiskhide prop and it works.
Click to expand...
Click to collapse
Thanks a lot! My phone now boots normaly and it's a Success on SafetyNet. Hope no more random reboots afterwards.
I'm particularly curious what variant of DM-Verity did you use? I googled for DM-Verity for Samsung this morning and did get a Samsung-only patch. I'm not sure if DM-Verity patch could contribute to these reboots.
Maspon said:
Thanks a lot! My phone now boots normaly and it's a Success on SafetyNet. Hope no more random reboots afterwards.
I'm particularly curious what variant of DM-Verity did you use? I googled for DM-Verity for Samsung this morning and did get a Samsung-only patch. I'm not sure if DM-Verity patch could contribute to these reboots.
Click to expand...
Click to collapse
Sorry no idea about that. I'm using alexis rom though..
xfakexbloodx said:
Sorry no idea about that. I'm using alexis rom though..
Click to expand...
Click to collapse
Sadly my phone still rebooted this morning. I caught the last kernel message and I hope it will help
So I'm trying to get Android 12 working with root and SafetyNet passing. I found that all the guides to be wrong or outdated. Problem with the latest Magisk canary is that it does not support MagiskHide. Problem with the latest stable Magisk (v23) is that it doesn't support Android 12. Here are the combinations I've tried:
Canary Magisk APK, Canary Magisk boot image, with Universal SafetyNet Fix v2.2.1 (Zygisk)
Result: No way to test if safety net passes within Magisk, but it doesn't seem to work.
Canary Magisk APK, Stable Magisk v23 boot image, with Universal SafetyNet Fix v2.1.3 (Riru)
Result: Does not work. MagiskHide automatically turns off after every reboot, probably because the canary boot image does not support it.
Stable Magisk v23 APK, Stable Magisk v23 boot image
Result: Device fails to boot. fast food indicates in an invalid signature. presumably happening because stable magisk v23 does not support Android 12.
Based on these test results these are my assumptions:
1. There is no way to run Magisk 23 on Android 12, and this article and its screenshot are fake:
https://www.droidwin.com/how-to-roo...k-on-android-12/#STEP_6_Boot_to_Fastboot_Mode
and this also does not work: https://krispitech.com/how-to-pass-safetynet-on-rooted-android-12/
OR
It was possible and Android 12 September 5th patch level but somehow not the latest December build?
There is no advantage to running mismatched Magisk APK and boot image versions
Both the Zygisk and Riru versions of the SafetyNet Fix do not work on the latest Android 12 builds.
The new DenyList system does nothing in allowing a SafetyNet bypass.
The ONLY working method That can possibly bypass safety net on Android 12 is using either of these 2 Magisk forks:
Custom Magisk by TheHitMan7 (Can’t find download link)
Alpha Magisk by vvb2060 (Can’t find download link)
Are these assumptions correct? Can someone please correct my misunderstandings?
You need Universal Safetynet Fix v2.2.0 or v2.2.1 which was just released 10 days ago.
To be honest, I haven't tried v2.2.1 yet, but I would imagine it will work. I'm on v2.2.0 right now.
Get it from here: https://github.com/kdrag0n/safetynet-fix
I have been using Magisk Canary 23016, USNF 2.2.0, and MagiskHide Props Config 6.1.2 on my Pixel 5 running the December Android 12 release. SafetyNet passes, GPay works.
I have DenyList blocking both GPay and Google Play Store..
Either you have something configured wrong, or you're having a unique issue. Others have been able to pass SafetyNet using a similar configuration.
No, Magisk Stable does not currently support Android 12. You MUST use Canary 23016; none of the previous builds properly handle the vbmeta flags in the boot image header.
I'm using the latest magisk canary, USNF 2.2.1 and no magisk hide props and am passing. I have Zygisk enabled, but that's about it. Install was flawless. Followed V0latyle's thread on going from A11 to A12 when the canary update dropped.
Thank you everyone, I got it working the way you said! I was super close.
-----------------------------------
V0latyle said:
I have been using Magisk Canary 23016, USNF 2.2.0, and MagiskHide Props Config 6.1.2 on my Pixel 5 running the December Android 12 release. SafetyNet passes, GPay works.
I have DenyList blocking both GPay and Google Play Store..
Either you have something configured wrong, or you're having a unique issue. Others have been able to pass SafetyNet using a similar configuration.
No, Magisk Stable does not currently support Android 12. You MUST use Canary 23016; none of the previous builds properly handle the vbmeta flags in the boot image header.
Click to expand...
Click to collapse
I only blocked play services with deny list and it worked.
One of the guides told me to flash stock vbmeta (idk what this is), and this bricked it until I re-flashed the ROM. But I guess that's not needed anymore.
flyoffacliff said:
Thank you everyone, I got it working the way you said! I was super close.
-----------------------------------
I only blocked play services with deny list and it worked.
One of the guides told me to flash stock vbmeta (idk what this is), and this bricked it until I re-flashed the ROM. But I guess that's not needed anymore.
Click to expand...
Click to collapse
Which guide?
V0latyle said:
Which guide?
Click to expand...
Click to collapse
How to Root Pixel Devices via Magisk on Android 12
In this comprehensive tutorial, we will show you detailed steps to root your Pixel device via Magisk running Android 12.
www.droidwin.com
On step 7. It says it's not necessary for some reason on newer devices but pixel 5 and older still require it. What does flashing this file actually do? Like what's the file made of?
flyoffacliff said:
How to Root Pixel Devices via Magisk on Android 12
In this comprehensive tutorial, we will show you detailed steps to root your Pixel device via Magisk running Android 12.
www.droidwin.com
On step 7. It says it's not necessary for some reason on newer devices but pixel 5 and older still require it. What does flashing this file actually do? Like what's the file made of?
Click to expand...
Click to collapse
Nothing needs to be done with vbmeta as long as you're using Magisk 23016.
I'll try to explain what it is and what it does as simply as I can but there isn't really a simple explanation...
Some components of Android system security, such as Verified Boot, incorporate a means by which the data being loaded from critical partitions is checked in real time as it is loaded. This is called "device-mapper verity". The raw data itself is read at the block device level and used to create a hash; this hash is then compared to a reference hash to determine the data has not been modified. The partition that contains this reference hash is vbmeta.
When the Android 12 beta was first released, Magisk had not yet been updated to properly handle Android 12 boot image headers. Verified Boot is disabled for the most part when the bootloader is unlocked; however some elements still remain to ensure you're booting a proper device boot image. Magisk did not preserve necessary information in the boot headers, so the device wouldn't boot; we would get a message in bootloader stating failed to load/verify boot images
We figured out a workaround for this: disable dm-verity and vbmeta verification altogether. This was done by flashing the vbmeta partition with those two options:
Code:
flash vbmeta vbmeta.img --disable-verity --disable-verification
The problem with this is it has some sort of safety interlock that prevents system from loading if verity/verification are disabled and /data isn't clean. So, rooting required wiping data. You probably discovered this during your "brick": you got a screen reading Cannot load Android system. Your data may be corrupt.
We also discovered that the vbmeta workaround had to be performed every time vbmeta was flashed - meaning no OTA updates, because if vbmeta was flashed without the disable options, we wouldn't be able to boot a patched boot image, and even if we re-disabled verity/verification, the device still wouldn't boot unless data was clean. The only way to update AND reroot AND keep data was to ensure that verity and verification were disabled every time the device was updated.
Fortunately, Magisk 23016 fixed all of this. We don't have to mess with vbmeta anymore. Magisk properly preserves the flags in the boot header, meaning that AVB recognizes it as a legitimate boot image, and the device is happy.
has anyone able to pass safety CTSprofile ?
Basic integrity is pass but CTSprofile Check isnt passed...
anybody able to pass in A12 (OnePlus Nord)
tried all effort but dint work, even Universal SafetyNet Fix v2.2.1 (Zygisk) isnt working..
its makes Basic Integrity Fail after Flash ( Universal SafetyNet Fix v2.2.1 (Zygisk).
I roll back to A11 then sadly....
shhahidxda said:
has anyone able to pass safety CTSprofile ?
Basic integrity is pass but CTSprofile Check isnt passed...
anybody able to pass in A12 (OnePlus Nord)
tried all effort but dint work, even Universal SafetyNet Fix v2.2.1 (Zygisk) isnt working..
its makes Basic Integrity Fail after Flash ( Universal SafetyNet Fix v2.2.1 (Zygisk).
I roll back to A11 then sadly....
Click to expand...
Click to collapse
You're doing something wrong. Don't overlook anything. I'm on Android 12.1 and pass safety net, Google pay works, Netflix works.
Have you configured the deny list in magisk?? If not do that then. I'd start fresh, don't connect to anything on first start. Hide everything about those Google apps. Then add your accounts etc etc. This is what worked for me no problem
thatsupnow said:
You're doing something wrong. Don't overlook anything. I'm on Android 12.1 and pass safety net, Google pay works, Netflix works.
Have you configured the deny list in magisk?? If not do that then. I'd start fresh, don't connect to anything on first start. Hide everything about those Google apps. Then add your accounts etc etc. This is what worked for me no problem
Click to expand...
Click to collapse
I would like to know, how you are able to pass? I mean It is passed using Universal safetynet fix by Kdragon?
or without fix?
as you mention in your screenshot that you have put all google services in denylist,
I've already done that..
anything else ? you done it? can you show screenshot of your safetynet pass??
shhahidxda said:
I would like to know, how you are able to pass? I mean It is passed using Universal safetynet fix by Kdragon?
or without fix?
as you mention in your screenshot that you have put all google services in denylist,
I've already done that..
anything else ? you done it? can you show screenshot of your safetynet pass??
Click to expand...
Click to collapse
I'm using the latest safetynet fix v2.2.1 Kdragon
thatsupnow said:
I'm using the latest safetynet fix v2.2.1 Kdragon
Click to expand...
Click to collapse
Yes, you are able to pass both .. but i am having issue with OnePlus Nord A12..
On A11 i was able to pass without Universal fix..
but as I applied OTA of A12...
I lose safetynet pass.
let me know do you have any workaround?
I've applied Universal fix by Kdragon.. but before flashing Universal fix of Zygisk I was able to pass Basic Integrity but as soon as I flash Kdragon Universal fix of Zygisk both CTS profile & Basic Integrity gets failed... !!!!
I am still looking for solution to fix this issue..!! if you have any work around.. let me know.. I will do my best.. may be i need to modify device fingerprints with Security patch.? what you say?
shhahidxda said:
Yes, you are able to pass both .. but i am having issue with OnePlus Nord A12..
On A11 i was able to pass without Universal
I've applied Universal fix by Kdragon.. but before flashing Universal fix of Zygisk I was able to pass Basic Integrity but as soon as I flash Kdragon Universal fix of Zygisk both CTS profile & Basic Integrity gets failed... !!!!
Click to expand...
Click to collapse
shhahidxda said:
Yes, you are able to pass both .. but i am having issue with OnePlus Nord A12..
On A11 i was able to pass without Universal fix..
but as I applied OTA of A12...
I lose safetynet pass.
let me know do you have any workaround?
I've applied Universal fix by Kdragon.. but before flashing Universal fix of Zygisk I was able to pass Basic Integrity but as soon as I flash Kdragon Universal fix of Zygisk both CTS profile & Basic Integrity gets failed... !!!!
I am still looking for solution to fix this issue..!! if you have any work around.. let me know.. I will do my best.. may be i need to modify device fingerprints with Security patch.? what you say?
Click to expand...
Click to collapse
You do realise that your posting on the pixel 5 forum right?? I'd maybe go checkout what they are doing on the OnePlus side of the tracks
thatsupnow said:
You do realise that your posting on the pixel 5 forum right?? I'd maybe go checkout what they are doing on the OnePlus side of the tracks
Click to expand...
Click to collapse
Yes, I knew i am posting in Pixel 5 and this topic isnt mention on Oneplus section..
I am looking for a solution of this issue.. but nobody has mention it till now.
Android 12.1 + Magisk 25.1 + Zygisk + Google Play services on enforced Denylist > Works charmingly
Note 1: Enforce Denylist for all the Google Play services modules on Magisk.
Note 2: After reboot, clear data of Google Play services and Play Store to make a fresh start.
pseudokawaii said:
Android 12.1 + Magisk 25.1 + Zygisk + Google Play services on enforced Denylist > Works charmingly
Note 1: Enforce Denylist for all the Google Play services modules on Magisk.
Note 2: After reboot, clear data of Google Play services and Play Store to make a fresh start.
Click to expand...
Click to collapse
I have the same running on a Galaxy S10, but every time I put Google Play Services on the enforce Denylist and reboot it no longer shows there. I'm trying to be able to use my banking app, it worked charmingly on magisk 24 but not anymore. Any advice?
El3ssar said:
I have the same running on a Galaxy S10, but every time I put Google Play Services on the enforce Denylist and reboot it no longer shows there. I'm trying to be able to use my banking app, it worked charmingly on magisk 24 but not anymore. Any advice?
Click to expand...
Click to collapse
What do you mean by "it no longer shows there"? Does the Google Play services disappear after putting on denylist? Did you enable the "Enforce Denylist" option? Did you do a retest of SafetyNet after reboot?
El3ssar said:
I have the same running on a Galaxy S10, but every time I put Google Play Services on the enforce Denylist and reboot it no longer shows there. I'm trying to be able to use my banking app, it worked charmingly on magisk 24 but not anymore. Any advice?
Click to expand...
Click to collapse
Yea and it won't stick I've tried that too. You don't need to add Google Play services to the deny list anyway
thatsupnow said:
Yea and it won't stick I've tried that too. You don't need to add Google Play services to the deny list anyway
Click to expand...
Click to collapse
If you're using Universal Safetynet Fix, Play Services is blocked out of the box. I had the same thing happen in one of the newer releases and thought it was an issue. It isn't. Play Services is blocked even though it doesn't show it.