Database Develop

[Guide] Pass Safetynet on a rooted 7.0 AOSP based ROM - Updated 11-01-2016

Update (11/09) - This method no longer works with the november security updates from Google as it causes suhide to break.
Here are the steps to follow
If you are already rooted, fully unroot. I do this by doing the following.
1) In the SuperUser app, go to settings and choose to do a full unroot. Choose "No" when it prompts you to restore your stock boot.img
2) Let the system reboot normally.
3) Reboot to recovery
4) If you have Magisk installed, flash the Magisk uninstaller Link
5) If you have suhide installed, flash rm-suhide 0.51 Link
6) Flash your ROM's boot.img extracted from your ROM (simply dirty flashing should also work), or install a custom kernel of your choice
At this point you should have a stock boot.img (or custom kernel) with no traces of SuperUser anywhere
Install SuperUser 2.78 Link
Install suhide 0.55 Link
Reboot into system. Verify that you have root. I'm not 100% sure this is necessary, but I like to do it before proceeding.
Reboot back into recovery.
Flash xsetpropSu.zip (attached to this post) Link
Reboot the system
Install RootSwitch 1.3.3.2 Link
Open up RootSwitch, uncheck disable all SU daemons. Disable Root
Pass SafetyNet
Optional
Using tasker to automatically disable root when certain applications are run. @NYZack made a little writeup here
Credits:
@NYZack - Helping me figure out how to put all of this together
@Captain_Throwback - For help with xsetprop
@Chainfire - SuperSU + SuHide
@topjohnwu - Magisk

work around found

no longer relevant post..

I don't know if the kernel can be modified to pull that trick. Even if someone does though, it's not going to last long. Every bypass you can find, Google can find. Then they know what to fix. The only way to win, is not to play.
And no, you can't lock the bootloader without wiping data.

Well I got it to work...I will turn this thread into a Guide. Who knows how long it will last, but...at least it's working for now.

Thread updated with instructions. I hope this can help someone!

So there's no way to do this without rooting and magisk?

3dawg said:
So there's no way to do this without rooting and magisk?
Click to expand...
Click to collapse
I want root, so I did not try to do that. If your bootloader is unlocked, I do not think there's a way to do it.

Thanks
skaforey said:
Thread updated with instructions. I hope this can help someone!
Click to expand...
Click to collapse
Yes I just followed these instructions and I am green panel. I have to check at a terminal to pay with phone but it probably will work. One note that was kinda unclear in case others do same....It should read :
Turn the Root switch ON....not OFF....when wanting to use AP. You can turn it back on when you want to do other things that require root permissions. I believe this is dynamic and working with the magisk mount point in addition to tricking the boot process into thinking the bootloader is locked.
Thanks so much for this. I was so angry with Google. And I was just going to say FK it and not use AP.
WORKS! Do all the steps in the order he says above and you can turn root off and on at will and have Android Pay work just fine! YAY!

skaforey said:
This thread started as a plea for help, but thanks to @NYZack I have gotten it to work.
Here are the steps to follow
If you are already rooted, fully unroot. I do this by doing the following.
1) If you have suhide installed, download rm-suhide 0.51 Link
2) In the SuperUser app, go to settings and choose to do a full unroot. Choose "No" when it prompts you to restore your stock boot.img
3) Let the system reboot normally.
4) Reboot to recovery
5) Flash rm-suhide 0.51
6) Flash your ROM's boot.img extracted from your ROM (simply dirty flashing should also work), or install a custom kernel of your choice
At this point you should have a stock boot.img (or custom kernel) with no traces of SuperUser anywhere
Install SuperUser 2.78 Link
Install Magisk v8.zip Link
Install suhide 0.55 Link
Reboot into system
Install Magisk Manger 2.1 (apk) Link
Open up Magisk Manager app and go to modules. Click on the + button. Add the following zip for xsetprop Link
Install RootSwitch 1.3.1.2 Link
Reboot system
Using Root Explorer (or some other file manager capable of root access), browse to /magisk/xsetprop and modify post-fs-data.sh . Add the following line to the end of the file, save and exit
Code:
xsetprop ro.boot.flash.locked 1
Reboot system
Open up RootSwitch, uncheck disable all SU daemons. Disable Root
Pass SafetyNet
Click to expand...
Click to collapse
FYI - The latest version of the xSetProp zip (0.2.1 as of this post) handles setting that prop automatically, and has additional logging. I'd recommend using that and you can remove that portion of your guide.

Captain_Throwback said:
FYI - The latest version of the xSetProp zip (0.2.1 as of this post) handles setting that prop automatically, and has additional logging. I'd recommend using that and you can remove that portion of your guide.
Click to expand...
Click to collapse
Thank you! Instructions updated (also tried to give proper credit all around).
I think Chainfire might be in the process of doing something similar without the need for Magisk.
I suppose we could also probably use the xsetprop binary along with a su.d script to run the necessary commands on startup? This would avoid having to use Magisk all together.
If I get some time I might try that out.

No longer works after I reboot the device. It's almost like it knows about my hack. It passes the safety net thing with green screen yet I get message saying that can't verify blah blah...your phone might be rooted! I've updated to 0.2.1 of the xprop and double checked the other things like suhide and magisk and so on. Wth ... Less than a day and Google changed something? I'm baffled. Help!

Pkt_Lnt said:
http://www.xda-developers.com/android-safetynet-now-reportedly-tripped-by-unlocked-bootloaders/
Click to expand...
Click to collapse
Thanks so much for taking the time to write this out.
I am 100% successful with M ROMs like ResRemix
However on my Nexus 6 with N ROMs (like Nitrogen or cDroid) I can't get SafetyNet to pass this way. With Root Switch I can get PoGo to work but following these instructions to a T I still don't have green SN
I wonder if it is the kernel ? What kernel have you been successful with?
Lastly are you aware of any way to find success with 7.1 ROMs?
---------- Post added at 12:31 AM ---------- Previous post was at 12:27 AM ----------
photolarry said:
No longer works after I reboot the device. It's almost like it knows about my hack. It passes the safety net thing with green screen yet I get message saying that can't verify blah blah...your phone might be rooted! I've updated to 0.2.1 of the xprop and double checked the other things like suhide and magisk and so on. Wth ... Less than a day and Google changed something? I'm baffled. Help!
Click to expand...
Click to collapse
Is the message you are getting coming up with SafetyNet or with PoGo ... or when ??

jcrompton said:
Thanks so much for taking the time to write this out.
I am 100% successful with M ROMs like ResRemix
However on my Nexus 6 with N ROMs (like Nitrogen or cDroid) I can get SafetyNet to pass this way. With Root Switch I can get PoGo to work but following these instructions to a T I still don't have green SN
I wonder if it is the kernel ? What kernel have you been successful with?
Lastly are you aware of any way to find success with 7.1 ROMs?
---------- Post added at 12:31 AM ---------- Previous post was at 12:27 AM ----------
Is the message you are getting coming up with SafetyNet or with PoGo ... or when ??
Click to expand...
Click to collapse
Yea I know I think it's something to do with either the kernel I've selected or perhaps suhide no longer works...I'm not sure what the deal is. I'm running Franco #55 and even without root, I get failure but inside the testing app ...see attached

Thanks for this write-up! I was able to pass SafetyNet in both apps while running Pure Nexus 7 w/ Stock OpenGapps.
I think one key thing that was skipped in the OP - be sure your ROM is SafetyNet compatible to begin with. I've run numerous ROMs that even before Google started checking bootloaders, wouldn't pass SafetyNet even if unrooted. For example, I just tried the OP method with Despair's new 7.1 ROM and it failed (probably won't work on 7.0 either). But with Pure Nexus 7.0 it works great.

MrBrady said:
Thanks for this write-up! I was able to pass SafetyNet in both apps while running Pure Nexus 7 w/ Stock OpenGapps.
I think one key thing that was skipped in the OP - be sure your ROM is SafetyNet compatible to begin with. I've run numerous ROMs that even before Google started checking bootloaders, wouldn't pass SafetyNet even if unrooted. For example, I just tried the OP method with Despair's new 7.1 ROM and it failed (probably won't work on 7.0 either). But with Pure Nexus 7.0 it works great.
Click to expand...
Click to collapse
I'm using stock Rom and only custom kernel so this should work on Nbd90z....I'd think. Last test was dreaded message but I'm trying to add few things to suhide blacklist. We shall see

I get the green screen. But then when I tap at store nfc terminal...it claims error....I'm going to try hiding nfc service, and what I think is play services based on uid chainfire explained. I'll try a small purchase and remember to screen capture the error if occurs

skaforey said:
Thank you! Instructions updated (also tried to give proper credit all around).
I think Chainfire might be in the process of doing something similar without the need for Magisk.
I suppose we could also probably use the xsetprop binary along with a su.d script to run the necessary commands on startup? This would avoid having to use Magisk all together.
If I get some time I might try that out.
Click to expand...
Click to collapse
I built the mod for people that were already using Magisk. If you're not using Magisk, then of course you can try just putting the binary in /su/xbin and put the post-fs-data.sh in /su/su.d and see if that works for setting the props at boot time.
I don't use Xposed, so using Magisk + phh's Superuser was my target for the module. I also did try the su.d method with SuperSU, but it wasn't working on my device. I also didn't want to have to use RootSwitch. But feel free to unpack the zip and try whatever combinations you want.

photolarry said:
No longer works after I reboot the device. It's almost like it knows about my hack. It passes the safety net thing with green screen yet I get message saying that can't verify blah blah...your phone might be rooted! I've updated to 0.2.1 of the xprop and double checked the other things like suhide and magisk and so on. Wth ... Less than a day and Google changed something? I'm baffled. Help!
Click to expand...
Click to collapse
Still working for me. Are you sure you disabled root in Root Switch? It automatically re-enables upon logon. Also be sure your xsetprop file is correct.
You can check by using the getprop command

skaforey said:
Still working for me. Are you sure you disabled root in Root Switch? It automatically re-enables upon logon. Also be sure your xsetprop file is correct.
You can check by using the getprop command
Click to expand...
Click to collapse
I'm using it for android pay not pogo. And I did. I'm sure the prop is right or wouldn't get green go. It's an error from AP saying something about unable to verify and might be rooted....or words to that effect

Magisk safety net fails not sure why.

Hi
I'm using a Samsung Galaxy S4
I rooted the stock Samsung rom with SuperSU prior to install Magisk
At first I couldn't install 13.3 I had to install 12.0 because of some unknown reason installing 13.3 I got the error image mount failed same with all previous 13. versions however now 13.3 is now installed and SuperSU isn't installed.
When I run the SafetyNet Check in Magisk it reports:
ctsProfile: false
basicIntegrity: false
I want to be able to use apps like Android pay and such
Can someone please help me with getting this to work
Thanks!

Magisk v12.0 can't pass SafetyNet without workarounds like Universal SafetyNet fix module (and since the last update to SafetyNet a few days ago I've no idea if that works either).
You can't use Magisk to pass SafetyNet with SuperSU installed.
Here's some reading for you:
https://forum.xda-developers.com/apps/magisk/magisk-magisk-hide-troubleshooting-tips-t3561828
Pro tip: Try using the search function and browse the stickied threads before posting. There are very few things that hasn't been covered already in one way or another...

Didgeridoohan said:
Magisk v12.0 can't pass SafetyNet without workarounds like Universal SafetyNet fix module (and since the last update to SafetyNet a few days ago I've no idea if that works either).
You can't use Magisk to pass SafetyNet with SuperSU installed.
Here's some reading for you:
https://forum.xda-developers.com/apps/magisk/magisk-magisk-hide-troubleshooting-tips-t3561828
Pro tip: Try using the search function and browse the stickied threads before posting. There are very few things that hasn't been covered already in one way or another...
Click to expand...
Click to collapse
I've got 13.3 installed and SuperSU isn't installed plus I've already read a lot on this subject and most of my searches did nothing for me that's why I thought I would make a thread to see if anyone could help me.

AyanamiRei0 said:
I've got 13.3 installed and SuperSU isn't installed plus I've already read a lot on this subject and most of my searches did nothing for me that's why I thought I would make a thread to see if anyone could help me.
Click to expand...
Click to collapse
That was not very clear from your first post...
If you haven't already, start by reading through the link I posted. You wan't post #4.

Didgeridoohan said:
That was not very clear from your first post...
If you haven't already, start by reading through the link I posted. You wan't post #4.
Click to expand...
Click to collapse
Interesting trying to start magiskhide manually does nothing.

You could have remnants of Su on your phone. Even if you use the full uninstall method you can have leftovers. Tried a complete fresh reinstall?

phuhcue said:
You could have remnants of Su on your phone. Even if you use the full uninstall method you can have leftovers. Tried a complete fresh reinstall?
Click to expand...
Click to collapse
Oh it's working fine now installing Lineage OS and then install Magisk and it works perfectly.

With me my experiments with magisk in the past left some files in my data partition behind which makes safetynet fail.
I found them by going into twrp recovery, starting and adb shell and then executing find . | grep -i magisk
the two files i found were:
data/data/com.google.android.gms/files/backup_diff_script/com.topjohnwu.magisk
data/property/persist.magisk.hide
i deleted them with rm and safety net worked again.
So I can confirm that for my phone, unlocked bootloader, custom modem and custom recovery does not matter at all. But if your filesystem still contains traces of magisk, is a nono for google safetynet, pretty silly this road they are taking here.

safety net
i have the same problem on galaxy note 3 with magisk 15.3 on my galaxy s7 everything is ok but in note 3 i have safety net false...
can anyone help me?

spanpana said:
i have the same problem on galaxy note 3 with magisk 15.3 on my galaxy s7 everything is ok but in note 3 i have safety net false...
can anyone help me?
Click to expand...
Click to collapse
Old device... If the kernel version is lower than 3.8 it'll likely not have support for mount namespace and MagiskHide won't work. A custom kernel or ROM might work...

Didgeridoohan said:
Old device... If the kernel version is lower than 3.8 it'll likely not have support for mount namespace and MagiskHide won't work. A custom kernel or ROM might work...
Click to expand...
Click to collapse
thank's for your reply...!
i have custom rom resurection remix v.5.8.2 but i didnt change the kernel can you explain me how to do that please because i don't know...?

spanpana said:
thank's for your reply...!
i have custom rom resurection remix v.5.8.2 but i didnt change the kernel can you explain me how to do that please because i don't know...?
Click to expand...
Click to collapse
Check your kernel version first (usually found in Settings - About Phone). If it's less than 3.8, ask for help in your device's forum for if there's any custom kernels or ROMs available with an updated kernel.

Didgeridoohan said:
Check your kernel version first (usually found in Settings - About Phone). If it's less than 3.8, ask for help in your device's forum for if there's any custom kernels or ROMs available with an updated kernel.
Click to expand...
Click to collapse
ok my friend thank you very much...!:laugh::good:

Didgeridoohan said:
Old device... If the kernel version is lower than 3.8 it'll likely not have support for mount namespace and MagiskHide won't work. A custom kernel or ROM might work...
Click to expand...
Click to collapse
That's interesting. I get the same message on my old phone (running the 3.4.113 kernel), but I'm unable to even open Mario Run if MagiskHide is disabled. But when it's enabled, the game runs just fine. Is that normal? I thought Mario Run made use of SafetyNet... I'm using microG + DroidGuard Helper. I've tried running Android Pay, but I get this error message. But I'm not even sure if Android Pay is supposed to work since I'm using microG... What other apps use SafetyNet so I can try them?
Thanks.

robotsrules said:
That's interesting. I get the same message on my old phone (running the 3.4.113 kernel), but I'm unable to even open Mario Run if MagiskHide is disabled. But when it's enabled, the game runs just fine. Is that normal? I thought Mario Run made use of SafetyNet... I'm using microG + DroidGuard Helper. I've tried running Android Pay, but I get this error message. But I'm not even sure if Android Pay is supposed to work since I'm using microG... What other apps use SafetyNet so I can try them?
Thanks.
Click to expand...
Click to collapse
MagiskHide can't do it's thing to hide itself on such an old kernel, but it can still hide sensitive prop values. That's why Mario Run works... IIRC it looks for ro.debuggable, on of the props changed to "safe" values by MagiskHide.

Didgeridoohan said:
MagiskHide can't do it's thing to hide itself on such an old kernel, but it can still hide sensitive prop values. That's why Mario Run works... IIRC it looks for ro.debuggable, on of the props changed to "safe" values by MagiskHide.
Click to expand...
Click to collapse
Oh, I get it now... Thanks

[Q] Magisk v16 Problems T715

Hi all, i'm using a stock rom, rooted with magisk and debloated (manually). I always faced this problem, the 90% of the modules i try to install ends with something like that:
See Screen below
However i've never asked help because i tought it was a Magisk problem resolvible with an update...but every update ended always in the same way for me when trying to install some modules. I've also attached some logs here of when i tried to update xposed systemless if someone could help me it will be really apprecciated!
P.s Anyone facing the same problem? I've read somewhere that a similar problem is common with Motorola devices but idk if this is the case

Giuskiller said:
Hi all, i'm using a stock rom, rooted with magisk and debloated (manually). I always faced this problem, the 90% of the modules i try to install ends with something like that:
See Screen below
However i've never asked help because i tought it was a Magisk problem resolvible with an update...but every update ended always in the same way for me when trying to install some modules. I've also attached some logs here of when i tried to update xposed systemless if someone could help me it will be really apprecciated!
P.s Anyone facing the same problem? I've read somewhere that a similar problem is common with Motorola devices but idk if this is the case
Click to expand...
Click to collapse
Is this via Magisk manager?

ashyx said:
Is this via Magisk manager?
Click to expand...
Click to collapse
Yes this is via Magisk Manager, however the same error (could not mount something) appears also when i try to install a module via twrp. The "best" thing is that some module just works both way (Busybox NDK for example) while other fails both ways. No module work in a way and doesn't work in another. So basically if a module work in magisk can be installed also via twrp otherwise it cannot be installed, no matter what i try

I have the same problem. Trying to install viper4a.
I have no clue how to fix it

Giuskiller said:
Yes this is via Magisk Manager, however the same error (could not mount something) appears also when i try to install a module via twrp. The "best" thing is that some module just works both way (Busybox NDK for example) while other fails both ways. No module work in a way and doesn't work in another. So basically if a module work in magisk can be installed also via twrp otherwise it cannot be installed, no matter what i try
Click to expand...
Click to collapse
I think this is a bug in Magisk with the way some modules attempt to install and mount, which is why some work.
I'm surprised though that they don't install in TWRP. Is your device encrypted, can you mount /data in recovery?

ashyx said:
I think this is a bug in Magisk with the way some modules attempt to install and mount, which is why some work.
I'm surprised though that they don't install in TWRP. Is your device encrypted, can you mount /data in recovery?
Click to expand...
Click to collapse
Actually i'm at university, but when i come back home i will try and let you know. What i can say for now is that every zip i've flashed so far worked just flawlessy (well, apart magisk's ones)

Downloaded atmos dolby only module for nougat....rebooted snd stucked on samsung logo. Ohhhh.... How to get rid of this module, is anyway to do it?
Please help
Edit:
installed module uninstaller and followed it - > https://forum.xda-developers.com/showpost.php?p=72542167&postcount=242
working now.
Looking for info how to install viper4Android....

netgar said:
Downloaded atmos dolby only module for nougat....rebooted snd stucked on samsung logo. Ohhhh.... How to get rid of this module, is anyway to do it?
Please help
Edit:
installed module uninstaller and followed it - > https://forum.xda-developers.com/showpost.php?p=72542167&postcount=242
working now.
Looking for info how to install viper4Android....
Click to expand...
Click to collapse
Well as far as i know, if you're on stock rom you won't be able to install audio mods because they're in conflict with something in the Rom. You should use a custom rom instead. However not sure 100% about this, maybe some audio mods can work, but you should ask someone else, i'm not so informed

Viper4Android Pie Compatible???

As the title states ...v4a is it compatible with pie? Im rooted running a custom rom rooted with magisk. Installed v4a thru magisk manager it installs but i get the install driver /re-install driver message everytime. Is it an workaround to get it working?

recepo1 said:
As the title states ...v4a is it compatible with pie? Im rooted running a custom rom rooted with magisk. Installed v4a thru magisk manager it installs but i get the install driver /re-install driver message everytime. Is it an workaround to get it working?
Click to expand...
Click to collapse
working fine here. maybe a root/magisk issue.

bober10113 said:
working fine here. maybe a root/magisk issue.
Click to expand...
Click to collapse
What rom are you on and which version of magisk are you running?

recepo1 said:
What rom are you on and which version of magisk are you running?
Click to expand...
Click to collapse
infinity rom.
magisk v18 and also newer test canary builds.
but prety sure its an issue where you don't wait 3 minutes after rebooting before doing actions that require root.
and not sure to which extent you tried to make magisk work with various files and mods but maybe you should just factory wipe and try and get magisk working before anything else. also mayke sure busybox is installed. and dont forget that 3 minute rule after a reboot.

bober10113 said:
infinity rom.
magisk v18 and also newer test canary builds.
but prety sure its an issue where you don't wait 3 minutes after rebooting before doing actions that require root.
and not sure to which extent you tried to make magisk work with various files and mods but maybe you should just factory wipe and try and get magisk working before anything else. also mayke sure busybox is installed. and dont forget that 3 minute rule after a reboot.
Click to expand...
Click to collapse
Thanks im sure it maybe an magisk issue im running 17.3 because i kept losing root on v18. I acquire root with v4a but it freezes and then keeps telling me to reinstall driver after reboot. I will try the 3 minute rule though..thank you. You installed v4a directly thru magisk or flashed a different version?

recepo1 said:
Thanks im sure it maybe an magisk issue im running 17.3 because i kept losing root on v18. I acquire root with v4a but it freezes and then keeps telling me to reinstall driver after reboot. I will try the 3 minute rule though..thank you. You installed v4a directly thru magisk or flashed a different version?
Click to expand...
Click to collapse
v3.3 on magisk dated of jan. 16th.
use aroma option. it will reboot on its own from magisk console and the just follow the automated steps in recovery

bober10113 said:
v3.3 on magisk dated of jan. 16th.
use aroma option. it will reboot on its own from magisk console and the just follow the automated steps in recovery
Click to expand...
Click to collapse
Thank you appreciate your help i will give it a try

I have tried everything for hours to get viper4android to work with no avail until now. Go to the xda download page and select the beta version. Boom. It works. I know you might have long forgot this or already figured it out but I had to share

old legacy magisk module has been working for months and months.

Question [issue] GrapheneOS, Magisk and June update [SOLVED]

The latest OTA update made my phone bootloop if i re-flash magisk patched init_boot image...
After I asked Stock users, it looks like it's a GrapheneOS june update + Magisk specific issue.
Do someone else also have this issue?
Phone boots normally, then reboot to recovery instead of reaching lock screen.
For now, I re-flashed panther-factory-2023061402 init_boot.

Have you tried Magisk canary version? or maybe GrapheneOS doesn't like june update and newest Magisk and you need to either go back down to stable Magisk or an older version of Magisk?
Actually, after re-reading your OP, a module might be the cause of the bootloop -- I've recently seen similar behavior from other members where device bootloops or crashes during/right-after loading & starting up -- if you were on the stock ROM I would suggest you loading up in Safe Mode to see if it is a module issue; I don't know anything about GrapheneOS so I don't know if it offers anything similar. I wonder if the adb command to remove modules at boot would work....

mhh, right, i don't have a lot of modules aside hosts, fdroid and busybox, but it may be module-related.
Until now, I did everything with TWRP, but now, well, let's say it's a little more difficult =)
... safe mode works with GrapheneOS, good =)
re-enabling modules one by one until i find the culprit.
... and the failing module was... Magisk built-in Busybox 1.0.5 \o/

Albirew said:
mhh, right, i don't have a lot of modules aside hosts, fdroid and busybox, but it may be module-related.
Until now, I did everything with TWRP, but now, well, let's say it's a little more difficult =)
... safe mode works with GrapheneOS, good =)
re-enabling modules one by one until i find the culprit.
... and the failing module was... Magisk built-in Busybox 1.0.5 \o/
Click to expand...
Click to collapse
knew it....
glad I helped get you there!