Database Develop

Pokemon GO: Bypass SafetyNet directly with Xposed?

Hi everyone,
Google SafetyNet has become a pain in the a** for everyone who want's to play Pokemon GO (fair, no cheating), but can't live without root and Xposed, like me. Bypassing SafetyNet in general is a cat-and-mouse game. Chainfire described the problem very good in his post Hiding root: a losing game.
Well, people look for SafetyNet workarounds for different reasons. Whether it is for Android Pay, Pokemon GO or Snapchat, the approach is always to hide root and Xposed, and let SafetyNet do its job so that it reports back that the device is safe.
I'm thinking about a different approach, (first) only concerning Pokemon GO. What if we could hook the SafetyNet API calls directly in the app using Xposed? This way, SafetyNet's result wouldn't matter, the answer reported back to the app is always set to "everything OK, device is safe" by Xposed.
I know, this is easier said than done. I already took a look at the Pokemon GO source code, but didn't test anything so far. But there's a class called com.nianticlabs.nia.platform.SafetyNetService, containing a method called checkResult, which returns a boolean. Sounds promising (fingerscrossed).
The reason why didn't test anything so far is because I don't know, how SafetyNet works exactly. But could this possibly work? Did someone try out something like this already?
Greetings

I'm hoping for a similar solution. The SnapPrefs Xposed module does something like this I think and works great.

It think, but I may be wrong, that there is some kind of security preventing us from doing that.
PoGo ask to safetyNet if everything is okay, safetyNet responds to the device and sign the response using a private key that will authenticate the response and make sure it has not been modified and is a genuine response.
So without this key, no way to spoof the response.
Again, I may be wrong but I think it works this way.

You might be right. I have never looked at the SnapPrefs*source code so I have no idea how it*works. All I know is that it does a great job of*bypassing SafetyNet...
If*a similar solution could be implemented it would fix a lot of trouble for us players*who just want to keep*root and play the damn game.

Wetzel402 said:
You might be right. I have never looked at the SnapPrefs*source code so I have no idea how it*works. All I know is that it does a great job of*bypassing SafetyNet...
If*a similar solution could be implemented it would fix a lot of trouble for us players*who just want to keep*root and play the damn game.
Click to expand...
Click to collapse
Snapprefs does not bypass safetynet
Sent from my Nexus 6P using XDA Labs

Rakuu said:
Snapprefs does not bypass safetynet
Sent from my Nexus 6P using XDA Labs
Click to expand...
Click to collapse
My rooted phone would not log into SnapChat due to it failing safetynet. After installing the SnapPrefs module and rebooting I was able to log in on the first attempt. I'm not saying it allows safetynet to pass but it is doing something to bypass it. Doing something similar for Pogo may or may not work.

Snapprefs
I now know a bit more about SafetyNet from some very interesting and shocking articles at John Kozyrakis blog [1] [2] [3].
I took a quick look at the Snapprefs source code, but it's very big. I didn't find anything concerning SafetyNet so far.
I don't use Snapchat, so I can't try it out. Wetzel402 says the module works. @Wetzel402, so this means, that Snapchat usually doesn't work with root and Xposed (because of SafetyNet), but with Snapprefs it does?
In theory, my approach from the initial post could work, it depends on the app using SafetyNet. Unfortunately, it most probably won't work for Pokemon GO. The mentioned method checkResult is a pre-step, checking only if SafetyNet communication worked. Evaluation of SafetyNet's result is done in native code, which cannot be hooked by Xposed.
I didn't take a look at Snapchat's source code so far, but if evaluating SafetyNet's result is done in Java, maybe this is hooked by Snapprefs and that's why Snapchat works independent of SafetyNet's result. But this is just an assumption.
I have further ideas. I will try them out and report my results here. Stay tuned.
[1] https://koz.io/inside-safetynet/
[2] https://koz.io/inside-safetynet-2/
[3] https://koz.io/inside-safetynet-3/

Cypher_01 said:
I now know a bit more about SafetyNet from some very interesting and shocking articles at John Kozyrakis blog [1][2][3].
I took a quick look at the Snapprefs source code, but it's very big. I didn't find anything concerning SafetyNet so far.
I don't use Snapchat, so I can't try it out. Wetzel402 says the module works. @Wetzel402, so this means, that Snapchat usually doesn't work with root and Xposed (because of SafetyNet), but with Snapprefs it does?
In theory, my approach from the initial post could work, it depends on the app using SafetyNet. Unfortunately, it most probably won't work for Pokemon GO. The mentioned method checkResult is a pre-step, checking only if SafetyNet communication worked. Evaluation of SafetyNet's result is done in native code, which cannot be hooked by Xposed.
I didn't take a look at Snapchat's source code so far, but if evaluating SafetyNet's result is done in Java, maybe this is hooked by Snapprefs and that's why Snapchat works independent of SafetyNet's result. But this is just an assumption.
I have further ideas. I will try them out and report my results here. Stay tuned.
[1] https://koz.io/inside-safetynet/
[2] https://koz.io/inside-safetynet-2/
[3] https://koz.io/inside-safetynet-3/
Click to expand...
Click to collapse
As far as I know recent Snapchat versions don't check anymore, people have said even with only root they can log in now when they previously couldn't, this may have been what happened.
Sent from my Nexus 6P using XDA Labs

Based on my experience, I have two phones, one rooted and one not. Snapchat*works on*the unrooted one but would fail to log in on the rooted one. After installing*the*SnapPrefs*module I was able to log into Snapchat. I can't confirm if*Snapchat was updated*in the meantime however.
I would*imagine*if*a*future xposed module could spoof the device status to SafetyNet or completely bypass the requesting/response process within PoGo it could be possible.

Wetzel402 said:
Based on my experience, I have two phones, one rooted and one not. Snapchat*works on*the unrooted one but would fail to log in on the rooted one. After installing*the*SnapPrefs*module I was able to log into Snapchat. I can't confirm if*Snapchat was updated*in the meantime however.
I would*imagine*if*a*future xposed module could spoof the device status to SafetyNet or completely bypass the requesting/response process within PoGo it could be possible.
Click to expand...
Click to collapse
Could you do us a favor? Simply deactivate Snapprefs in Xposed installer and reboot. If you can login, Snapchat has been updated to that effect. If you can't login, Snapprefs does the job.

Cypher_01 said:
Could you do us a favor? Simply deactivate Snapprefs in Xposed installer and reboot. If you can login, Snapchat has been updated to that effect. If you can't login, Snapprefs does the job.
Click to expand...
Click to collapse
That seems...too...simple
Alright, I did the following...
Signed out of Snapchat
Disabled Snapprefs
Uninstalled Snapchat
Reboot
Reinstalled Snapchat
Logged in successfully
Enabled Snapprefs
Based on this experiment the Snapchat app was, in fact, updated so that it no longer is checking for root/xposed in the manner it once was...

Wetzel402 said:
That seems...too...simple
Click to expand...
Click to collapse
Wetzel402 said:
Alright, I did the following...
Signed out of Snapchat
Disabled Snapprefs
Uninstalled Snapchat
Reboot
Reinstalled Snapchat
Logged in successfully
Enabled Snapprefs
Based on this experiment the Snapchat app was, in fact, updated so that it no longer is checking for root/xposed in the manner it once was...
Click to expand...
Click to collapse
OK, in a way, that's not good, at least it means that we cannot learn anything from Snapprefs.

Cypher_01 said:
OK, in a way, that's not good, at least it means that we cannot learn anything from Snapprefs.
Click to expand...
Click to collapse
Agreed. This is disappointing because I was hoping we could learn something from the Snapprefs source code.

Does not function on phones with Toybox - BLU STUDIO XL 2

Thank you for all you hard work, I have been a user for many releases prior and love that your software has always been "there and working well". So why only speak up when I have a problem, so for that I apologize.
I have managed to obtain a version of Xposed (Systemless) ported for Magisk installed on my phone (SDK 23) and while Magisk lists Xposed in its installed module list with a check box saying it is active, the Xposed menu shows the green notification area that says it is working, when I install XprivacyLua, and while after the installation of XprivacyLUa, in the Modules section of Xposed there is a check box showing that XprivacyLua is installed and active, the problem is that the Xprivacy app thinks it is not loaded. I sent trace logs captured via adb to the Xprivacy developer and he says that Xposed believes the XprivacyLua app is not installed (even though all indications are that it is active).
Someone who knows more about this than me stated my problem was likely with Toybox being on the phone and something about symlinks where he gave another suggestion about loading Busybox and then following with loading a BusyBox binary zip package via TWRP. All this does is render me not able to access MagiskManager any longer.
Do you know anything about such an issue and how I might get around it? I am saddened that using this valuable tool is being made so difficult from all the new hardware changes. I normally stick with age old phones, but accidents happen, the old one's cracked and my new one won't seem to work with Xposed.
Thanks!
BLU STUDIO XL 2 16/2G
MT6737
ARMv7 Processor rev4 (V71)
armv71

Is there anyone who can help me with my issue? I have poor eyesight and need a larger phone like the BLU, plus as often as I drop phones I cannot afford to buy the fancy, expensive and popular gaming models that everyone seems to purchase.
I am willing to do what ever it takes to resolve the issue, including running traces, submitting file structure maps or anything the developer needs to address the issue with Toybox or whatever the problem that is causing XprivacyLua not to be enabled by Xposed.
Thank you again.

Donphillipe said:
Is there anyone who can help me with my issue? I have poor eyesight and need a larger phone like the BLU, plus as often as I drop phones I cannot afford to buy the fancy, expensive and popular gaming models that everyone seems to purchase.
I am willing to do what ever it takes to resolve the issue, including running traces, submitting file structure maps or anything the developer needs to address the issue with Toybox or whatever the problem that is causing XprivacyLua not to be enabled by Xposed.
Thank you again.
Click to expand...
Click to collapse
What about making system run in permissive mode?
have you tried?
I have not "jumped" from superSU to majisk so my method is to use superSU.
I have a recovery install package that sets file in place to make permissive and force superSU to install systemless.
you can give a try.
the updater-script prints out a message it was made for "blu tank xtreme pro" but it is fine for other phones too. I made it for/ with other dev who wanted to have one step to make root and permissive.
I do not know how will respond to majisk, so better off to try ununstall that first, and start fresh.

April build on pixel 2xl and 16.0 resulting in 'Invalid Response'

I just did a system flash for the april build on the pixel 2 xl, and reinstalled magisk 16.0. Root is working fine. I've tested magiskhide and it works to deny root to apps that request it. I've hidden magisk. I've also reinstalled it with the built in app name randomizer. I've disabled USB debugging.
However, when I run the safetynet test it results in a 'The response is invalid' result. I've tried the suggestions under 'The response is invalid' section from https://forum.xda-developers.com/apps/magisk/guide-magisk-troubleshooting-t3641417 (which actually links to https://www.didgeridoohan.com/magisk/MagiskHide) to no avail.
Would greatly appreciate any suggestions.
Thanks in advance!

Do you have the Manager hidden? See what happens if you unhide it.
Looks like something is going on when the Manager is hidden... Not really an issue though, if MagiskHide still works. You can use other apps to test SafetyNet meanwhile.

Didgeridoohan said:
Do you have the Manager hidden? See what happens if you unhide it.
Looks like something is going on when the Manager is hidden... Not really an issue though, if MagiskHide still works. You can use other apps to test SafetyNet meanwhile.
Click to expand...
Click to collapse
With hidden Manager I get a constant crash, because of a null-pointer exception.
With normal Manager it works, except for the fact, that I can not pass safetynet (at the moment), be ause I use microG.
So the hidden Manager has definitely problems (I try to look into it, if I'm back home), but the other issue is probably related to an updated on googles side (PlayStore and/or safetynet apk).
All on my J5 not pixels, but it looks like a general problem.

(from post: https://forum.xda-developers.com/showpost.php?p=76337427&postcount=1771) @Didgeridoohan
I discovered what caused the issue on my phone: option to scramble the Magisk Manager (Hide Magisk Manager) seemed to trigger "invalid response". I tried it several times (hide/restore) and every time it happened the same.
The checkbox in Settings "MagiskHide" had no effect in my case over "Invalid Response" result, although when unchecked, it didn't pass SafetyNet Check (as expected).
I spent the better part of the day assuming it was something I did that caused it. Hopefully it will be fixed soon.
Edit
testing with SafetyNet Playground shown success even if Magisk thrown "response is invalid"... seems the fault is not affecting the core functionality, only the report itself.
Cheers!

New Natwest app (June 2018) Refuses to work when Xposed Running

Just as the title says, the new natwest app update (2018 June) refuses to work when Xposed Framework is enabled, but runs find when the framework is disabled. I am interested to know how it detects when the framework is operational, and how can I fool the app into running while Xposed framework is running.
Here is my system:
Samsung Galaxy S5
running Lineage OS 14.1, rooted
Xposed framework version 89
I have tried a number of methods to hide the running framework with no success
Tried DotMod to hide xposed --> not working
Tried XprivacyLua, denying all sorts of permissions such as view activity and running apps --> not working
Only works when i disable the framework and restart the phone. But that is ofcourse tiresome, cos no one wants to restart their entire phone just to check their bank app.
Current solution is to revert to previous versions of natwest bank app, but again that is trivial, as sooner or later they will refuse to work on outdated apps and force update.
Talking to the dev team, the only clue they mention is their new app checks the memory for running malicious apps, and if it detects anything it refuses to run. So it is not safetynet (infact safetynet fails, but the app runs)
Fair enough, but ive tried denying it literally all permissions, both from Privacy guard of lineage os 14.1 and XprivacyLua, and nothing works. Either the app is using some clever method to bypass these, or they dont do their work properly.
I miss old xprivacy, where you had a billion more options within permissions, with info of when and what did each app accessed.
I need xposed in order to disable my proximity sensor which is broken, and constantly thinks the value is zero, hence blacking out my screen during calls
Any help or advice will be much appreciated.

I believe it was with the 2016 November security update that Google changed something that forced an update to Xposed that made it practically impossible to hide. Xposed is easily detectable in the running zygote (something you can't hide), and the only solution is the one you've already found; disable and reboot.

i keep reading many times now "the only solution is reboot" - that is not a solution, we need to find a way to better hide xposed. Perhaps I need to research a bit more on zygote and find out and how it works exactly, and see if there is a way to mask it. Honestly all these android updates are pissing me off, its getting harder and harder to mod your phone, and I dont get why they struggle so hard to make it difficult for us modders.
I will attempt to flash back to kitkat and try, I would not be suprised if it ends up working.
In the windows enviroment you can always do wtv ur heart desires, and if that means destroying your PC so be it. But in android enviroment is so damn hard, and no devs want to share how they implement things in fear of someone hacking them or wtv. But all this is doing is hurting modders, making us hate some apps with harsh rules and moving away, doesnt do any good for anyone!!

It's perfectly possible to hide Xposed if you downgrade to a security patch prior to November -16. You're likely gonna have to dig around a bit for the proper files and versions though.
And believe me, there have been some pretty brilliant minds that have tried to find a way to hide Xposed and found it not to be possible. Of course, "nothing's impossible" and maybe someone with a brilliant idea finds a miraculous way. You never know...

[Q] Why aren't there any cool modules for Magisk? (compared to modules for Xposed)

Extremely sorry if I am spamming the forum with this thread, but thought of starting this discussion to see if the geeks can help with sharing the knowledge.
I don't think I have to emphasize on why Magisk over Xposed (The Magisk Forum has a lot of articles on why.), but I am surprised to realize that Magisk is still the so called "new guy" even after these many years of launch..
All I get for a sample search "best modules Magisk" is a bunch of tweaking modules which say they can alter your ART mechanism or save your battery, I mean, who cares for the performance in 2019!!! we have got beastly phones and just want magik to happen on them. Magisk is still the same serious experimental mod that lets you root and hide it from banking/work apps but not yet cool.
For example, every time I installed Xposed on a new phone, I would go look for the famous "Gravity Box" just to enable the status bar brightness control gesture.
And the "X-insta" that lets me download media from Instagram . (Of course this module seems to be dead for a few months).
And a bunch of adblockers.
And a hell lot mods that I don't remember from the top of my head, but it was really magic.. And it is slowing down (I feel so..)
Well, someone might say that we can install Xposed itself as a module, but that just crashes the "SafetyNet" which is very annoying, it makes the phone useless without being able to open GooglePay and other banking apps.
I know I might be wrong but I am posting just to see if people use any equivalent "cool" modules in Magisk that are not easily seen in the Magisk Modules repo or if someone has found a way to pass the "SafetyNet" with Xposed+Magisk to make Android awesome again!!:good:

sagar2208 said:
Extremely sorry if I am spamming the forum with this thread, but thought of starting this discussion to see if the geeks can help with sharing the knowledge.
I don't think I have to emphasize on why Magisk over Xposed (The Magisk Forum has a lot of articles on why.), but I am surprised to realize that Magisk is still the so called "new guy" even after these many years of launch..
All I get for a sample search "best modules Magisk" is a bunch of tweaking modules which say they can alter your ART mechanism or save your battery, I mean, who cares for the performance in 2019!!! we have got beastly phones and just want magik to happen on them. Magisk is still the same serious experimental mod that lets you root and hide it from banking/work apps but not yet cool.
For example, every time I installed Xposed on a new phone, I would go look for the famous "Gravity Box" just to enable the status bar brightness control gesture.
And the "X-insta" that lets me download media from Instagram . (Of course this module seems to be dead for a few months).
And a bunch of adblockers.
And a hell lot mods that I don't remember from the top of my head, but it was really magic.. And it is slowing down (I feel so..)
Well, someone might say that we can install Xposed itself as a module, but that just crashes the "SafetyNet" which is very annoying, it makes the phone useless without being able to open GooglePay and other banking apps.
I know I might be wrong but I am posting just to see if people use any equivalent "cool" modules in Magisk that are not easily seen in the Magisk Modules repo or if someone has found a way to pass the "SafetyNet" with Xposed+Magisk to make Android awesome again!!:good:
Click to expand...
Click to collapse
Magisk doesn't work the same way as Xposed,one mounts and modifies files and the other hooks and modifies app code at runtime,and yes there is a way to use Xposed and pass safetynet if you are either on Oreo or Pie,it's called Edxposed
Edxposed is an open source Xposed alternative released early this year that uses a different method to hook into the system which allows it to pass safetynet and it allows you to blacklist apps in which you don't to load Xposed into,and if you are in pie there is already a beta of gravitybox that fully supports Pie (it's not yet in the Xposed repo because it's not fully stable yet)

Here are some pictures showing edxposed passing safetynet and me using the event lock module on Android pie,incase you are interested here are the links to edxposed https://forum.xda-developers.com/xposed/android-9-0-xposed-solutions-t3889513 it works on both Oreo and Pie (ignore the last step and just use edxposed installer) it's the last link and the first post,if you have any doubts feel free to ask there

DanGLES3 said:
Here are some pictures showing edxposed passing safetynet and me using the event lock module on Android pie,incase you are interested here are the links to edxposed https://forum.xda-developers.com/xposed/android-9-0-xposed-solutions-t3889513 it works on both Oreo and Pie (ignore the last step and just use edxposed installer) it's the last link and the first post,if you have any doubts feel free to ask there
Click to expand...
Click to collapse
A Hope!!
Thank you very much for the info, will try and post an update..

Even after these many years of launch people seems to not understand Magisk purpose, features and way of work. Same for Xposed.
Does Magisk has "modules" ? Yes! Does Xposed has "modules" ? Yes! But that's it. The name. The only thing in common between Magisk and Xposed is _the name, the word, "module" _ for their respective plug-ins, addons. Nothing more. Period.
Magisk attachs to Android, works completely different from the way Xposed does. What they do and what they can do are different. They are not even closer to be an alternative of one to another.
Having that said, do not expect that modules of one can deliver similar features of a module of another. If this somehow someday for an specific pair of modules happen be sure they are accomplishing that but doing in complete different ways behind the scenes.
About Xposed not breaking SafetyNet, we have now for Android O+ the alternatives EdXposed (open source) and Tai Chi (closed source). They do not break it because the way they're implemented is different from original Xposed by Rovo. They are different approachs, new code with new ways of work, but that delivers same entrance points, same nomenclature, as original Xposed itself. Thus being (generally speaking) compatible with modules originally built to original Xposed.
Both EdXposed and Tai Chi are experimental yet, although working fine at least on Android P. If they show themselves as solid solutions then probably we will see new Xposed like modules appearing out there. I do hope so.

wilsonhlacerda said:
Even after these many years of launch people seems to not understand Magisk purpose, features and way of work. Same for Xposed.
Does Magisk has "modules" ? Yes! Does Xposed has "modules" ? Yes! But that's it. The name. The only thing in common between Magisk and Xposed is _the name, the word, "module" _ for their respective plug-ins, addons. Nothing more. Period.
Magisk attachs to Android, works completely different from the way Xposed does. What they do and what they can do are different. They are not even closer to be an alternative of one to another.
Having that said, do not expect that modules of one can deliver similar features of a module of another. If this somehow someday for an specific pair of modules happen be sure they are accomplishing that but doing in complete different ways behind the scenes.
About Xposed not breaking SafetyNet, we have now for Android O+ the alternatives EdXposed (open source) and Tai Chi (closed source). They do not break it because the way they're implemented is different from original Xposed by Rovo. They are different approachs, new code with new ways of work, but that delivers same entrance points, same nomenclature, as original Xposed itself. Thus being (generally speaking) compatible with modules originally built to original Xposed.
Both EdXposed and Tai Chi are experimental yet, although working fine at least on Android P. If they show themselves as solid solutions then probably we will see new Xposed like modules appearing out there. I do hope so.
Click to expand...
Click to collapse
Couldn't have said it better (my previous texts were written at 3am so pardon for any mistake I did XD)