Database Develop

[GUIDE] Pass SafetyNet on custom ROMs

What is SafetyNet?
"SafetyNet provides a set of services and APIs that help protect your app against security threats, including device tampering, bad URLs, potentially harmful apps, and fake users." -Android Developers
Like stated above, SafetyNet is a set of APIs embedded in Google Play Services to see whether a device has been tampered with from its factory state (e.g. a custom ROM is installed). Developers can use this API to block smartphones in which SafetyNet fails to pass.
How will this affect me and my usage of the device?
Several apps use this API to block users with custom ROMs, such as Google Pay, Netflix, and others, especially banking apps. If you don't use any of these, then failing SafetyNet probably won't matter to you. But if you do use some of these apps, you'll find that they often refuse to run.
How to pass SafetyNet:
You will need Magisk and Magisk Manager: https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
You will need this ZIP:
https://forum.xda-developers.com/apps/magisk/universal-safetynet-fix-magisk-17-t3840680
After you have downloaded both of these, go ahead and flash Magisk through TWRP. After installation is complete, Go to the Modules section in Magisk Manager and press the + button and select the SafetyNet spoofer ZIP. After it's done, reboot your phone. Then go to Settings in Magisk Manager and turn Magisk Hide off and then on again. Go to the Magisk Hide section and select the following apps to hide Magisk from:
Google
Google Services Framework
Google Play Store
(and other apps requiring SafetyNet to pass)
Then go to Play Store>Settings and see if it says your Device is certified. If not, clear Play Store data and try again.
Done! Now you will have passed SafetyNet!

JarlPenguin said:
What is SafetyNet?
"SafetyNet provides a set of services and APIs that help protect your app against security threats, including device tampering, bad URLs, potentially harmful apps, and fake users." -Android Developers
Like stated above, SafetyNet is a set of APIs embedded in Google Play Services to see whether a device has been tampered with from its factory state (e.g. a custom ROM is installed). Developers can use this API to block smartphones in which SafetyNet fails to pass.
How will this affect me and my usage of the device?
Several apps use this API to block users with custom ROMs, such as Google Pay, Netflix, and others, especially banking apps. If you don't use any of these, then failing SafetyNet probably won't matter to you. But if you do use some of these apps, you'll find that they often refuse to run.
How to pass SafetyNet:
You will need Magisk and Magisk Manager: https://forum.xda-developers.com/apps/magisk/official-magisk-v7-universal-systemless-t3473445
You will need this ZIP:
https://forum.xda-developers.com/apps/magisk/universal-safetynet-fix-magisk-17-t3840680
After you have downloaded both of these, go ahead and flash Magisk through TWRP. After installation is complete, Go to the Modules section in Magisk Manager and press the + button and select the SafetyNet spoofer ZIP. After it's done, reboot your phone. Then go to Settings in Magisk Manager and turn Magisk Hide off and then on again. Go to the Magisk Hide section and select the following apps to hide Magisk from:
Google
Google Services Framework
Google Play Store
(and other apps requiring SafetyNet to pass)
Then go to Play Store>Settings and see if it says your Device is certified. If not, clear Play Store data and try again.
Done! Now you will have passed SafetyNet!
Click to expand...
Click to collapse
I am on Lineage 15.1 based on 8.1, I followed every step you have mentioned but it shows ctsProfile : False and basicintegrity : true

{guide} pass SafteyNet any android 11

hello guys today i managed to bypass SafteyNet after couple of test and god know how many formats i did
but here i share the joy of it with you all
instead of texting guide i prefered to do full video guide in the video guide i will take you from point 0 where the phone is formated and fresh rooted to fully bypass SafteyNet with edxposed installed
last android version 11
basic integrity : pass
cts profile : pass
in advance sorry for my bad english in this post and in the video
do it on your OWN RISK
guide

skysatan said:
hello guys today i managed to bypass SafteyNet after couple of test and god know how many formats i did
but here i share the joy of it with you all
instead of texting guide i prefered to do full video guide in the video guide i will take you from point 0 where the phone is formated and fresh rooted to fully bypass SafteyNet with edxposed installed
last android version 11
basic integrity : pass
cts profile : pass
in advance sorry for my bad english in this post and in the video
do it on your OWN RISK
guide
Click to expand...
Click to collapse
Working like a charm on my S20 Ultra with Android 11 (Beyond Rom 2.0)
Thanks

m8980 said:
Working like a charm on my S20 Ultra with Android 11 (Beyond Rom 2.0)
Thanks
Click to expand...
Click to collapse
yw my friend

Thank you for the nice video,safety Net pass.

pannerch said:
Thank you for the nice video,safety Net pass.
Click to expand...
Click to collapse
yw bro

Edit: Please see Didgeridoohan's post below mine for additional info/context before following this breakdown of what happened in the video.
TL;DW version:
Starting clean, install magisk.
Install the following modules through the magisk download section (You don't need to reboot after installing each module): 'Busybox', 'MagiskHide Props Config'
Install what I think is this? The video is not at all clear, but I believe it to be the latest version of riru from here: https://github.com/RikkaApps/Riru/releases
Install what appears to be the latest sandhook debug version of this: https://github.com/ElderDrivers/EdXposed/releases (Video technically uses the previous 0.5.1.3 revision but that was the latest version at the time the video was posted)
Go into Magisk Manager settings, enable the magisk hide toggle
Select the option above this, 'Hide Magisk Manager' and hide it with whatever setting you like.
Restart? Not too sure if this is needed here, video guy's phone froze here and had to be hard restarted.
If you check Safetynet inside of Magisk now you should now pass basicintegrity while failing ctsprofile.
Install EdXposed Manager (I assume this one: https://github.com/ElderDrivers/EdXposedManager/releases/ ) (Note: A version of this is installed while installing the Riru/EdXposed through Magisk, no idea if this version is different to that)
Install Termux (I assume this one: https://f-droid.org/packages/com.termux/ )
(Optionally) Install the following apps to confirm that everything has been successful once we are finished:
SafetyNet Test - Apps on Google Play
SafetyNet device compatibility test
play.google.com
SafetyNet Checker - Apps on Google Play
SafetyNet is way to check health and environment where android device running.
play.google.com
Root and SafetyNet Checker - Apps on Google Play
Let you know if your device is Rooted and checks if it passes SafetyNet
play.google.com
Open up EdXoposed manager and confirm the framework is active.
Go into EdXposed settings, scroll down to app list mode and enable, scroll down to 'Pass Safetynet' and enable.
Run Termux, type in:
su
Hit enter, grant root access. Type in:
props
Hit enter. Select the first option (Edit device fingerprint), then select 'Pick a certified fingerprint'
In the next screens select your phone manufacturer and model from the lists that appear.
Confirm you selected the correct device by selecting yes, and then reboot when requested.
Run termux, enter su and props again. Confirm that 'Edit device fingerprint' is now Active.
Select 'Force BASIC key attestation'
Select 'Pick from device list' and select your own device from the lists.
Confir you selected the right device and reboot.
Run termux, su, props. 'Edit devide fingerprint' and 'Force BASIC key attestation' should now be active.
Select 'Device simulation'
Select 'Device simulation' again. Confirm you want to enable basic device simulation.
Select 'ro.product.manufacturer'. Confirm you want to enable simulating 'ro.product.manufacturer'. Reboot.
It should now be working.
That said, I was following the instructions on my pixel 2 XL as I typed them out and I'm still failing safetynet so YMMV.
Edit: Did some digging, in the 'Force BASIC key attestation' section I neede to select a device which was similar but not exactly my device. In my case I used the regular Pixel 2. This got it working.

ivivaitylin said:
TL;DW version:
Click to expand...
Click to collapse
If that's what's in the video, there are a few errors that could be corrected...
First one is rather minor: you do not need to install busybox together with MagiskHide Props Config (that requirement was removed in v5.2.6, more than 6 months ago (a small indication that it's not always a good idea to blindly follow random guides on the internet, they rarely get updated as the tools changes).
Enabling MagiskHide is of course necessary, but hiding the Manager isn't if all you want to do is to pass SafetyNet. It's a useful tool though, since many apps look for the Manager. But not SafetyNet...
And, if you want to use EdXposed (it's not necessary for passing SafetyNet, but there might be many useful modules), you need to keep in mind that Google constantly chases these tools and eventually they'll likely get detected. If you keep on the latest versions of EdXposed, the devs usually manages to keep one step ahead.
Changing the device fingerprint is only necessary if you aren't on a stock ROM, or have a device that isn't Google certified.
The "Force BASIC key attestation" option in MagiskHide Props Config is only necessary if your device uses hardware backed key attestation (you can see if it's basic or hardware when you make a SafetyNet check in the Magisk Manager). If you do need to force a basic check you should not pick your own device. That's very clearly stated both in the ui and the module docs. Picking your own device does absolutely nothing.
"Device simulation" isn't necessary at all, and if you're using a device fingerprint from your own device it won't do anything.
There's more on what options to use in MagiskHide Props Config in the module docs:
MagiskHidePropsConf/README.md at master · Magisk-Modules-Repo/MagiskHidePropsConf
This tool is now dead... Contribute to Magisk-Modules-Repo/MagiskHidePropsConf development by creating an account on GitHub.
github.com

Thanks for the info and breakdown, I've added something at the top of my post directing people to check your post before following it.

Didgeridoohan said:
If that's what's in the video, there are a few errors that could be corrected...
First one is rather minor: you do not need to install busybox together with MagiskHide Props Config (that requirement was removed in v5.2.6, more than 6 months ago (a small indication that it's not always a good idea to blindly follow random guides on the internet, they rarely get updated as the tools changes).
Enabling MagiskHide is of course necessary, but hiding the Manager isn't if all you want to do is to pass SafetyNet. It's a useful tool though, since many apps look for the Manager. But not SafetyNet...
And, if you want to use EdXposed (it's not necessary for passing SafetyNet, but there might be many useful modules), you need to keep in mind that Google constantly chases these tools and eventually they'll likely get detected. If you keep on the latest versions of EdXposed, the devs usually manages to keep one step ahead.
Changing the device fingerprint is only necessary if you aren't on a stock ROM, or have a device that isn't Google certified.
The "Force BASIC key attestation" option in MagiskHide Props Config is only necessary if your device uses hardware backed key attestation (you can see if it's basic or hardware when you make a SafetyNet check in the Magisk Manager). If you do need to force a basic check you should not pick your own device. That's very clearly stated both in the ui and the module docs. Picking your own device does absolutely nothing.
"Device simulation" isn't necessary at all, and if you're using a device fingerprint from your own device it won't do anything.
There's more on what options to use in MagiskHide Props Config in the module docs:
MagiskHidePropsConf/README.md at master · Magisk-Modules-Repo/MagiskHidePropsConf
This tool is now dead... Contribute to Magisk-Modules-Repo/MagiskHidePropsConf development by creating an account on GitHub.
github.com
Click to expand...
Click to collapse
you can use it with out EdXposed

skysatan said:
you can use it with out EdXposed
Click to expand...
Click to collapse
That's what you took from my post? The only thing I wrote about EdXposed is that Google often finds ways to detect it...

skysatan said:
hello guys today i managed to bypass SafteyNet after couple of test and god know how many formats i did
but here i share the joy of it with you all
instead of texting guide i prefered to do full video guide in the video guide i will take you from point 0 where the phone is formated and fresh rooted to fully bypass SafteyNet with edxposed installed
last android version 11
basic integrity : pass
cts profile : pass
in advance sorry for my bad english in this post and in the video
do it on your OWN RISK
guide
Click to expand...
Click to collapse
Video is not available anyone share the direct video link

pannerch said:
Thank you for the nice video,safety Net pass.
Click to expand...
Click to collapse
Send the link of the video i unable to watch that video in YouTube

How To Guide BYPASS SAFETYNET EASILY

Safetynet can be easily bypassed by :
step 1 : hide magisk
step 2 : turn on zygisk and enforce deny list
step 3 : open configure deny list & apply deny list on google apps | eg: google play services and playstore, etc.., (don't forget to clear cache & data)
step 4 : install riru module
step 5 : restart your phone
step 6 : install universal safety net fix module
step 7 : restart your phone
in newer version of magisk manager, magisk hide functionality is replaced by deny list
download modules from links given below or you can directly download it via files i attached
riru module link : (https://github.com/RikkaApps/Riru/releases)
universal safetynet-fix module link : (https://github.com/kdrag0n/safetynet-fix/releases)

Small clarification:
The deny list is currently (as of writing this) only available on unofficial Magisk releases. Any official Magisk release after build 23001 will have the deny list rather than MagiskHide.

Didgeridoohan said:
Small clarification:
The deny list is currently (as of writing this) only available on unofficial Magisk releases. Any official Magisk release after build 23001 will have the deny list rather than MagiskHide.
Click to expand...
Click to collapse
Yes, rooting this device via stable version is causing bootloop for now but alpha version(706a4922-alpha) is working fine that's why i mentioned deny list

Safety net stops working after few days then i have to flash riru and safety net again and it works 1,2 days then again it stops working, do you have any solution for this?

I cant get get the step 1 : hide magisk option to work.
When I click that option, it asks me for a new package name and it creates a new icon in the app drawer with that name, but it doesn't do anything. the original magisk icon still opens the app.
When i check safetynet in the app, it still says failed.
Any idea what I'm doing wrong?

Thanks for the guide. Currently running Derpfest 12 on a OP5T and Magisk 24.
Riru is suspended with zygote activated, whilst SafetyNet fix is suspended when it is not enabled.
In my case GPay works with zygote disabled, thus USNF working.

[Discussion] Magisk - The Age of Zygisk.

This is a discussion and help thread for the newer versions of Magisk.​
The main goal of this thread is to help users migrate to Magisk v24+
SafetyNet
Basic integrity Pass
CTS profile match Pass​
Play Protect certification
Device is certified​
Feel free to discuss or give links to other Magisk related issues.
Fixes for gPay, banking apps and/or other apps and games that detect a 'compromised' Android system.
Please try to restrain from discussing alternative (unofficial) Magisk builds that include changes that were removed or can not be included in the official Magisk builds. ​
Please read John's State of Magisk (medium.com)
State of Magisk: 2021
State of Magisk: 2020
Starting with the Magisk 23 (23010) canary builds.
MagiskHide is removed.
MagiskHide masked the sensitive properties of the device to hide it from SafetyNet.
Renaming (repackaging) the Magisk app is/was not part of MagiskHide.
You still have the option to Hide the Magisk app under setting.​
Magisk Module online Repo is removed.
The Magisk Module online Repo is still available and can be accessed outside of the Magisk app.​
Everything SafetyNet is removed.
This includes the SafetyNet check that was incorporated into the Magisk app.​
Zygisk is introduced.
Zygote + Magisk = Zygisk​
The Deny list replaces the Hide list.
The Hide list (more or less) hid Magisk from the process on the list.
The Deny list is similar but instead of hiding Magisk from the process, Magisk is unloaded so there is nothing to hide.​
Starting with the Magisk 23 (23017) canary builds.
Magisk supports update channels per module.
Each module can include it's own update link.​
Hide Magisk offline.
You do not need internet connection to rename (repackage) the Magisk app.​
What does this mean?
Not much.
It is just the next step in Magisk's development.
Zygisk is a big step forward. ​
Even before these changes in Magisk, the xda family and the Android community have always been active and willing to share.
Jump to Post​Magisk - Modules - Apps - Force Basic Attestation - Basic Attestation - Adjust Prop values - Notes - Points of Interest​
This is post will be updated once Magisk v24 is released.​

Magisk​The Magic Mask for Android.​
Magisk Links:
GitHub
Installation Instruction
Frequently Asked Questions
Magisk Documentation
Magisk Troubleshoot Wiki (by Didgeridoohan)
Release Notes
Download Links:
Stable and Beta releases.
GitHub
Canary
GitHub
The notes.md file is the change log.
The app-debug.apk is Magisk canary.
Click on app-debug.apk and choose View Raw or click on the Download option.​
Credits:
topjohnwu
All who contribute and support this project.

Modules​
MagiskHide Props Config
This module allows you to add, change and adjust prop values systemlessly using Magisk.​
MagiskHide Props Config Links:
GitHub
xdaThread
Download Links:
GitHub
Credits:
Didgeridoohan
All who contribute and support this project.
Universal SafetyNet Fix
It has been a year now since kdrag0n figured out how to 'trick' SafetyNet.
This 'trick' has been implemented properly into quite a few custom roms.
For custom roms that do not include it and/or stock roms, he turned it into a module.​
Universal SafetyNet Fix Links:
GitHub
xdaThread
Download Links:
GitHub
Credits:
kdrag0n
All who contribute and support this project.

Apps​
Fox's Magisk Module Manager
This app allows you to manage and install Magisk modules.
Including from an online repo.​
Fox's Magisk Module Manager Links:
GitHub
Download Links:
GitHub
Credits:
Fox2Code
All who contribute and support this project.
Play Intergrity API Checker
This app shows info about your device integrity as reported by Google Play Services.
If any of this fails could mean your device is rooted or tampered in a way (for example you have an unlocked bootloader).​
Development:
GitHub
Download Links:
PlayStore
Credits:
1nikolas
All who contribute and support this project.
YASNAC - Yet Another SafetyNet Attestation Checker
YASNAC (short for Yet Another SafetyNet Attestation Checker) is an Android app that demonstrates SafetyNet Attestation API.​
YASNAC Links:
GitHub
PlayStore
Download Links:
GitHub
PlayStore
Credits:
RikkaW
All who contribute and support this project.

Force Basic Attestation​
Newer devices are designed to support hardware attestation.
Currently there is no way to hide the sensitive device properties when checked using hardware attestation.​
To get around this, kdrag0n figured out how trick SafetyNet that the device does not support hardware attestation.
SafetyNet will then fall back to check using basic attestation.
Note:
This method will work for devices that support hardware attestation and devices that do not.
Enable Zygisk.
Install the USNF module.
Reboot
To keep posts short, the instructions are hid by spoiler tags.
Spoiler: Instructions
If you have not installed Magisk.
Follow the installation link in the Magisk post.​
Download the Universal SafetyNet Fix module.
Download link is in the Modules post.​
Enable Zygisk
Open the Magisk app.
Go to Settings.
Scroll down to the Magisk section.
Toggle Zygisk on.
Go back to the Magisk Home screen.
Go to Modules.
Select Install from storage.
Navigate to the Universal SafetyNet Fix module zip file and select it.
Reboot.
The USNF module will adjust the sensitive props that are needed to pass SafetyNet.
Depending on the device and system (ROM) configuration, you might need to adjust a few more.
See the Adjust Prop values post.​

Basic Attestation​<Reserve>
Older devices that can not support hardware attestation there are other options.
Enable Zygisk.
Enable Denylist.
Add com.google.android.gms.unstable to the Denylist.
Add com.google.android.gms to the Denylist if needed.
Reset the sensitive prop values for the device.
Click to expand...
Click to collapse
Due to other modules and methods that require DenyList to be inactive, this method is more for reference.
For ease of use and compatibility, I would recommend using the USNF module instead.
See the Force Basic Attestation post.​
This post will be updated in a few days.​

Adjust Prop values​<Reserve>
Reset sensitive prop values.
Spoiler: Instructions
Download the MagiskHide Props Config module.
Open the Magisk app and select the Modules option.
Select Install from storage option.
Navigate to where you saved the MHPC module and select it.
When the install is done, reboot.
Open a terminal app (or adb shell) and type props in the command line.
Make sure to grant root access
Select the Edit MagiskHide props (active) option.
(Currently option number 4)
It will show you the sensitive props that need to be adjusted.
If they all show (active) no changes needed.
If there is a prop value that shows as (enabled, not active) then you need to activate it by selecting it or a for all.
You will be prompted to set MagiskHide sensitive props?
Enter y(es), n(o) or e(xit):
If you are using a custom rom, you might also have to adjust the build fingerprint and security date.
From the MHPC main menu select Edit device fingerprint option.
(Currently option number 1)
Select Pick a certified fingerprint option.
(Currently option f)
Select the latest certified print for your device.
If your device is not listed, choose a device that is close to yours.​
This post will be updated soon.​

Notes​and​Common Issues​<Reserve>
Spoiler: SafetyNet
<Reserve>
Spoiler: Play Protect certification
<Reserve>
Spoiler: PlayStore App Purchases and Updates
<Reserve>

Points of Interest.​
LSPosed
Zygisk releases are now included.
Download Links:
GitHub - Releases
Shamiko
Download Links:
GitHub - Releases
Denylist Unmount
Download Links:
GitHub - Releases

Yay! I get post no. 10!
Good to see this thread up Doc! ... How are you linking / promoting it?
Want mentions in Magisk General Discussion thread, or not for now?...
I note that this thread has the advantage of having an active OP...
So what? - Means I can post rubbish and it will be cleaned! ... Love a clean house... Hope you're a good housekeeper @ipdev! PW

zputnyq said:
Hi all,
I'm on TJW's canary 23019.
Does anyone know/could explain what is/are the difference(s) with enforce denylist activated and not activated ?
Click to expand...
Click to collapse
denylist (which preserves some of MagiskHide infrastructure) is active, or not active...
Nb. For Zy-Shamiko hiding module solution to work, this needs to be deactivated for Shamiko to do the hiding itself; Shamiko just uses the same list for convenience / simplicity... PW
Edit: Lets kickstart things here!

pndwal said:
denylist (which preserves some of MagiskHide infrastructure) is active, or not active...
Nb. For Zy-Shamiko hiding module solution to work, this needs to be deactivated for Shamiko to do the hiding itself; Shamiko just uses the same list for convenience / simplicity... PW
Edit: Lets kickstart things here!
Click to expand...
Click to collapse
Ok, I get it. Thank you.
I was confused since I use an old device which doesn't really need this part to do the hiding & on v23017 John made that part work along with the configure denylist, I mean configure denylist is greyed out when denylist part isn't active.

zputnyq said:
Ok, I get it. Thank you.
I was confused since I use an old device which doesn't really need this part to do the hiding & on v23017 John made that part work along with the configure denylist, I mean configure denylist is greyed out when denylist part isn't active.
Click to expand...
Click to collapse
You could do worse than read the first 5 posts here! PW

Thanks @ipdev
I tried to put a short help for probably the most frequent posts/questions soon to expect.
(Sorry for cross-posting, I first put to the old and cluttered General Magisk thread but this is now better place)
===
Please carefully read Magisk Changelog and OP posts in this thread
Study the Magisk documentation from the official Magisk Github page - particularly about installing Magisk (if not familiar with patching the image in Magisk app and flashing the patched img from Fastboot- different from the old school about flashing Magisk zip through TWRP)
a) No more MagiskHide. New technology instead (for more or less the same - to help hiding root): Zygisk+DenyList
b) No more built in SafetyNet checker. Install from PlayStore e g: YASNAC to check your SN
c) Modules window does no more connect to the old Modules repository.
You must download module zip files manually and "Install from local storage".
Or search for and install Fox Magisk Module Manager (Fox Mmm) app - it will connect to the new, alternative repository and the old 'official' repo, allowing you to install from both
---
0) If upgrading Magisk and if you previously did "Hide Magisk app/Mngr" from Magisk app/mngr - always "Restore Magisk app/Mngr" before upgrading Magisk
1) Make sure that both Magisk app and Magisk are installed and updated to the new version v24 version. Inspect version numbers on the main Magisk window/page
2) Make sure to uninstall all Riru modules (Riru is not compatible with Zygisk that comes with Magisk v24)
3) Settings, Enable Zygisk and reboot.
Then check on the main window does it show Zygisk Yes
4) Settings, enable Enforce DenyList.
Configure DenyList, enable filters to Show OS and System apps.
Find Google Play Services and check-in only the two processes ending with gms and gms.unstable.
You will have to check in all your banking apps and so as you used with MagiskHide.
Always reboot upon reconfiguring DenyList
5) If SafetyNet does not pass, install USNF 2.2.1 and test again.
Always reboot upon installing a module, also if/when you enable Systemless Hosts
Note: Once you install/enable USNF 2.2.1, it will remove Google Play Services from your DenyList - but don't worry, USNF takes care of GMS
6) If you are on non-certified custom ROM and you still don't pass SN - then you will need Magisk Hide Props Config module - check for and consult the MHCP thread
---
If you want to hide Zygisk, then instal Shamiko module - and you must disable Enforce DenyList (although DenyList must stay configured).
But Shamiko is really not essential (might help for some banking apps but it's irrelevant for SafetyNet)
---
Banking apps - out of scope for this post (also, this thread is about the Magisk v24 itself, not abkut the particular banking apps)
Go to Magisk Github documentation, read Wiki, there is a section with tips you should try first
If putting your banking app to DenyList (now, instead of the old Magisk Hide) and hiding Magisk app does not help, and the other tips from Wiki do not help (like renaming TWRP folder and so), search in this thread how to use Hide My Applist (Zygisk-LSPosed module)
Every time you apply another tip to your troublesome banking app - go to Settings, Apps, and delete Cache and Data for that banking app before you try to open it again (some apps will cache that they previously found the phone was rooted)
Even with HMA, there are certain banking apps that cannot be tricked (on some phones like Xiami, etc)
---
Momo - absolutely not essential for your life
When you pass SN, Momo might still detect that your Bootloader is unlocked - you cannot hide it from Momo on e.g. Xiaomi phones
Generally, treat Momo as 'banking' apps (add to DenyList and reboot)
Momo does not look for apps (Magisk app, LSPosed mngr, LSPosed modules), hence for Momo you don't need to bother with HMA
Basic tips for Momo: Remove/rename TWRP folder, disable USB Debugging - for the rest, search for Momo posts in this thread - but still, there will be findings you could not hide from Momo (not encrypted Data, custom ROM, etc)
===
PS: Magisk Alpha v24.1 (vvb2060 and her team) has departed their way (different package name, revival of MagiskHide?), hence this post is now (mainly) for the official TJW Magisk Stable and Canary v24
(Some parts do apply also to Alpha but use Alpha on your own risk and ask the other Alpha users about the Alpha status and practices)
===
Last but not the list - there night be specifics for certain phones (like flashing with Odin for Samsung, end so on)
This post is generic, for your specific practices read/search through this thread and also on your phone/model subforuns on XDA

Hello - sorry if obvious but I'm having issues getting some apps checking for root to pass. I think the issue might well be the statement related to "Google Play Services and check-in only the two processes ending with gms and gms.unstable."
Regardless of whether I tick just these two, or if I tick the whole of Google Play Services, once I reboot and if I go back into Magisk the app reports that these services are no longer hidden.
This is Pixel6Pro Stock, January update, Magisk canary (but 24001 that synced with the public build) + Zygisk + USNF 2.2.1
Thank you
Chris

@ipdev
Thread was pinned. Thx for your effort

Nice. Will we be able to run a module like fakegapps without riru/LSPosed?

crypticc said:
Hello - sorry if obvious but I'm having issues getting some apps checking for root to pass. I think the issue might well be the statement related to "Google Play Services and check-in only the two processes ending with gms and gms.unstable."
Regardless of whether I tick just these two, or if I tick the whole of Google Play Services, once I reboot and if I go back into Magisk the app reports that these services are no longer hidden.
This is Pixel6Pro Stock, January update, Magisk canary (but 24001 that synced with the public build) + Zygisk + USNF 2.2.1
Thank you
Chris
Click to expand...
Click to collapse
No, you don't need to add Play Services processes w/ Zy-USNF as I explained here:
https://forum.xda-developers.com/t/magisk-general-support-discussion.3432382/post-86321879
Download YASNAC and check if you pass SafetyNet, then that you have Play Protect Device is certified in Play Store settings... If you have these, Bank app is using its own custom detection methods... PW

kurtn said:
Nice. Will we be able to run a module like fakegapps without riru/LSPosed?
Click to expand...
Click to collapse
Yes, Use Zygisk-LSPosed. PW

pndwal said:
No, you don't need to add Play Services processes w/ Zy-USNF as I explained here:
https://forum.xda-developers.com/t/magisk-general-support-discussion.3432382/post-86321879
Download YASNAC and check if you pass SafetyNet, then that you have Play Protect Device is certified in Play Store settings... If you have these, Bank app is using its own custom detection methods... PW
Click to expand...
Click to collapse
Yes I appreciate that. I guess my question was if it is correct that after reboot USNF deselects the gms and gms.unstable
Thanks for the explanation.
FYI found what was triggering the app and got it working. Before I had just renamed Magisk (I renamed to MagicApp if that matters) but that didn't work. Also "pausing" the app wasn't enough.
I needed to actually uninstall the Magisk Manager app itself.
So the mechanism being used by the other app wasn't looking for Magisk/SU, but the app iself.
The App failing doesn't have any local file permissions so must've been something else.
Actually I found two apps failing root check and both were resolved by uninstalling the (renamed) Magisk APK.
So I wondered if the app was simply listening to debug messages.
So I reinstalled and then reproduced the failure looking into ADB logcat.
I could see during opening and just before the protection was triggered logcat events against the ".Magisk" app related to denying access. Uninstalling Magisk app stopped those messages and then the app was able to start.
Should Magisk "hiding" the magisk manager app by renaming it from ".Magisk" also have relabelled all of the messages and such related to the app?

Question Pass safety net and having a certified device with root

Hello,
I've rooted my p7, how am i supposed to pass safety net?
I've used pixelflasher to root, install magisk and update.
In magisk, I've tried many times to set the "Google Play service" in the exclusion list, it always get uncheck.
I've installed the safety net fix in magisk.
Be sure to check play service, wallet... And empty their cache, all that in airplane mode and reboot.
But still... Play service become uncheck on exclude list and Google Play direct certified my device... Bank apps didn't work ...
What is different with the p7 than the p5?
My p5 is easy to do all that, i can flash the modified boot from magisk easily, which can't be done in cmd with the p7, only pixelflasher have been able to

Hide Magisk, use Zygisk denylist and Displax's universal safetynet fix.
https://forum.xda-developers.com/t/...nlock-bootloader-pass-safetynet-more.4505353/

1. Install displax's safetynetfix
2. Hide Magisk
3. Enable Zygisk
4. Enforce DenyList
5. Configure DenyList and check all your required apps (clear storage for apps already installed)
6. Install AirFrozen
7. Freeze Magisk in AirFrozen and now your banking apps should work fine

dewri21 said:
1. Install displax's safetynetfix
2. Hide Magisk
3. Enable Zygisk
4. Enforce DenyList
5. Configure DenyList and check all your required apps (clear storage for apps already installed)
6. Install AirFrozen
7. Freeze Magisk in AirFrozen and now your banking apps should work fine
Click to expand...
Click to collapse
I did like this but didn't use AirFrozen. I hid Magisk from within Magisk and my banking apps work fine and I'm device certified. Also, when using DenyList I expanded all the Google Play apps and made sure all the subcomponents were selected rather than just the one's picked by default. Accepted my choices with the arrow at the top of the screen rather than the nav button which seemed sometimes to not save my choices. YMMV.

Releases · Displax/safetynet-fix
Google SafetyNet attestation workarounds for Magisk - Displax/safetynet-fix
github.com
v2.3.1-mod_2.0 is required. Older version won't pass device integrity.
Hid magisk, enabled zygisk and denylist, but didn't need to deny any google apps. No shamiko either.
Use https://play.google.com/store/apps/details?id=gr.nikolasspyr.integritycheck to confirm you pass both device and basic integrity.
Still have L1 too

ktdt00 said:
I did like this but didn't use AirFrozen. I hid Magisk from within Magisk and my banking apps work fine and I'm device certified. Also, when using DenyList I expanded all the Google Play apps and made sure all the subcomponents were selected rather than just the one's picked by default. Accepted my choices with the arrow at the top of the screen rather than the nav button which seemed sometimes to not save my choices. YMMV.
Click to expand...
Click to collapse
I had to use AirFrozen for two of my banking apps. Rest were fine. So in case any banking app doesn't work, you know what to do.