Database Users

SafetyNet failing

I'm having trouble getting SafetyNet to pass for the past 2 days or so. It fails on stock, unrooted rom, with an unlocked bootloader. It also fails with the latest Magisk. I also tried restoring a backup of /boot and /system that was passing SafetyNet a few days ago, and no luck.
Has SafetyNet suddenly stopped working for anyone else? Any tips for success?

Working fine on magisk 13.2 rooted TWRP all else stock currently.

Ok, I just tried dirty flashing OTA zip and latest Magisk 13.2 and still no luck. Will try a full reset tomorrow...

yubimusubi said:
Ok, I just tried dirty flashing OTA zip and latest Magisk 13.2 and still no luck. Will try a full reset tomorrow...
Click to expand...
Click to collapse
See the Magisk General Support Thread . There's been an update to SafetyNet and there's a temporary workaround on GitHub.

adrman said:
See the Magisk General Support Thread . There's been an update to SafetyNet and there's a temporary workaround on GitHub.
Click to expand...
Click to collapse
That did not fix it for me, but I'm glad to know I'm not the only one having issues lately. Will keep an eye on that thread.

Just to close the loop on this...
Even after a full wipe through TWRP I couldn't get SafetyNet to pass. I ended up re-locking bootloader, reflashing stock recovery and stock system, and once I confirmed it was passing, unlocked bootloader again and installed Magisk. It is working now, but no idea how my system got into such a state.

Yeah mine isn't working anymore either. Was working till I tried it last night and no go. Waiting for the 13.3 with a fix i guess

I had the same issue with magisk failing both SafetyNet checks using stock OOS 4.5.5, TWRP 3.1.1, Magisk 13.2. The fix from github which removes all build properties with "magisk" in the name worked for me (any resetprop errors can be ignored; it just means that specific property was not set).
Code:
$ adb shell
OnePlus5:/ $ su -
(accept magisk prompt on phone to allow root)
OnePlus5:/ # resetprop --delete init.svc.magisk_pfs; \
resetprop --delete init.svc.magisk_pfsd; \
resetprop --delete init.svc.magisk_service; \
resetprop --delete persist.magisk.hide; \
resetprop --delete ro.magisk.disable
After this both SafetyNet checks pass. This will be reset any time you change magisk settings, upgrade magisk, or reboot, and SafetyNet will fail again after. But you can run the same command to work around again. Haven't tried the "Universal Init.d Enabler" magisk module mentioned in the other thread, I just created a shell script with the above command and call it from from Terminal Emulator if needed.

There's no point in trying different versions, factory resetting, etc. You can either run the temporary fix posted by MonkeeSage (which worked for me), or wait for an update.

geoff5093 said:
There's no point in trying different versions, factory resetting, etc. You can either run the temporary fix posted by MonkeeSage (which worked for me), or wait for an update.
Click to expand...
Click to collapse
Agree. In my case something was totally bonk with my system to the point that none of the fixes would let it pass. I think it stemmed from a random crash that corrupted some data, and that it was just coincidence that a SafetyNet update happened about the same time. I know it sounds crazy, but nothing short of going full stock and locked then re-rooting worked. Trust me I didn't want to wipe my data so I tried everything else first.
I can confirm now that the workaround script is necessary, and works for me when run at each reboot.

@Funk Wizard put up a mention of this little apk that does the steps needed to make safetynet pass while the Google vs. US wars are on. Credits are due to @Agusyc15 ::
Here's the link: https://forum.xda-developers.com/oneplus-5/themes/app-pass-safetynet-2017-07-17-magisk-v13-t3638444

Magisk has been updated to 13.3 and has fixed the SafetyNet failing caused by the last update from Google.
Magisk 13.3
Confirmed working for me.

13.3 works for me too.

Yep all good here as well.

13.3 sorted my issues

Guys what is the safest way to install magisk 13.3 on our op5 so it passes android pay, gets op5 ota updates, etc?
Btw I dont flash twrp, I usually just boot into twrp from fastboot. That shouldnt make a difference right? I havent even unlocked this device yet.

LOL
My SafetyNet has failed this morning when checking.
Was perfectly fine yesterday morning, once updated to the 13.3 build.

L22EEW said:
LOL
My SafetyNet has failed this morning when checking.
Was perfectly fine yesterday morning, once updated to the 13.3 build.
Click to expand...
Click to collapse
Have you installed Magisk 5.1.1? This fixes it. Google seem to be really cracking down on.it though in general.

Batfink33 said:
Have you installed Magisk 5.1.1? This fixes it. Google seem to be really cracking down on.it though in general.
Click to expand...
Click to collapse
I have, as I had a OTA update for Magisk app this morning. When I updated the app, I carried out a SafetyNet check - which failed.
Grrr..

L22EEW said:
I have, as I had a OTA update for Magisk app this morning. When I updated the app, I carried out a SafetyNet check - which failed.
Grrr..
Click to expand...
Click to collapse
That's strange, 5.1.1 with 13.3 works fine for me. It didn't before 5.1.1.

Pixel XL March Factory Images Available

Just saw this on the developers website
https://developers.google.com/android/images

Have any Magisk users has success removing images, downloading the ota, and reflashing Magisk to the other slot before rebooting? The download always fails for me.

GroovinChip said:
Have any Magisk users has success removing images, downloading the ota, and reflashing Magisk to the other slot before rebooting? The download always fails for me.
Click to expand...
Click to collapse
Yeah - I've never been able to get that to work and seems more complicated than just flashing factory (with -w removed) or sideloading OTA and then just reinstalling MAGISK....
I was curious if the current version of MAGISK worked on top of March 2018 security updates. I haven't seen any posts saying otherwise, but would be interested to see some confirmation that some have tried it successfully (regardless of actual upgrade method)....assume we will again have to remove all password/pin prior to upgrading to get passed the TWRP decryption issues that emerged with the Feb 2018 updates. I haven't seen any new versions of TWRP released to resolve that issue yet.

sb1893 said:
Yeah - I've never been able to get that to work and seems more complicated than just flashing factory (with -w removed) or sideloading OTA and then just reinstalling MAGISK....
I was curious if the current version of MAGISK worked on top of March 2018 security updates. I haven't seen any posts saying otherwise, but would be interested to see some confirmation that some have tried it successfully (regardless of actual upgrade method)....assume we will again have to remove all password/pin prior to upgrading to get passed the TWRP decryption issues that emerged with the Feb 2018 updates. I haven't seen any new versions of TWRP released to resolve that issue yet.
Click to expand...
Click to collapse
I just flashed update and magisk and so far no problems.

Great to hear! Really appreciate you sharing your success. I'll be taking the plunge this evening or tomorrow. Will share anything relevant that comes up.

Anybody have any luck flashing the OTA in TWRP? I keep getting error 7

For anyone that has problems: follow this guide
Works on every update, also I did it yesterday.
Now running march update + magisk + custom kernel flawlessly.

sb1893 said:
Great to hear! Really appreciate you sharing your success. I'll be taking the plunge this evening or tomorrow. Will share anything relevant that comes up.
Click to expand...
Click to collapse
I just upgraded to March Security patches...and I can confirm that it went smoothly. I flashed factory (removed -w). Then fastbooted twrp (after removing security pattern). Flashed MAGISK v16. Confirmed root and MAGISK Hide working as expected. Confirmed SafetyNet passing. Re-setup security and fingerprints (probably took the largest portion of time). Up and running - all looks good. Total process probably took less than 30 minutes.

no problems for me either. i flashed the march full factory image and rooted with magisk v16. i didn't permanently install twrp. i just fastboot booted it. i did confirm that twrp wasn't able to decrypt my phone, so i set screen lock security to none and then twrp was able to boot.

TENN3R said:
For anyone that has problems: follow this guide
Works on every update, also I did it yesterday.
Now running march update + magisk + custom kernel flawlessly.
Click to expand...
Click to collapse
can i ask which kernel are you using? i am currently running stock+ magisk and was wondering if i could further extend the battery life beyond 5.5hrs sot

Android P dev preview 1 was released today.
Sent from my Pixel XL using XDA Labs

samad.ansari said:
can i ask which kernel are you using? i am currently running stock+ magisk and was wondering if i could further extend the battery life beyond 5.5hrs sot
Click to expand...
Click to collapse
I used elementalx for a very long time, awesome kernel, but recently I switched to linux stable kernel, which is pure stock but updated to latest linux stable available (more security patches at kernel level).
And since pure android phones are always the best with stock files, I'm very happy with this kernel.

TWRP was updated to 3.2.1-1 yesterday and is now able to decrypt the data partition!!
https://dl.twrp.me/marlin/

themastermonk said:
TWRP was updated to 3.2.1-1 yesterday and is now able to decrypt the data partition!!
https://dl.twrp.me/marlin/
Click to expand...
Click to collapse
Confirmed. I was able to successfully fastboot boot TWRP-3.2.1-1 on my Pixel XL running March Security update. And I used my pattern to unlock and it successfully decrypted. Good news. Removing / restoring security/fingerprints was the most time consuming part of applying updates. Great work and many thanks @Dees_Troy!!!

Passing Safety Net

Hi All,
I have been running Lineage OS since it became available for OnePlus 5 with the Safety Net successfully being passed using Magisk and using firmware and modems from jamal2367.
That was up until Lineage required an updated firmware/modem to 5.1.4 and I found jamal2367 has stopped doing the firmware and modem for the OnePlus 5. I installed the firmware from shadowstep the new firmware provider and now I fail the safety net checks.
I have tired the following:
Flashing multiple weekly releases of Lineage OS
Flashing new version of TWRP
Flashing new version of TWRP blu_spark
Flashing new version of TWRP codeworkx
Flashing the ElementalX-OP5-3.10.zip
Flashing Boeffla-Kernel-2.0
Flashing blu_spark_r132
Flashing OSS 5.1.4
Flashing OSS 5.1.5
all with Magisk 17.1 installed
All with full wipes including the sdcard
The only thing that worked was installing OSS 5.1.5 with and relocking the bootloader.
Does anybody know what I have missed and how I can get the Safety Net to pass the ctsProfile.
Thanks in advance.

alrighte_then said:
Does anybody know what I have missed and how I can get the Safety Net to pass the ctsProfile.
Thanks in advance.
Click to expand...
Click to collapse
Relocking the Bootloader will of course work but you didn't need to do that.
What you missed:
That version of Magisk is clearly not working well with your setup and not hiding your Bootloader state properly. (Providing you set it up correctly).
Had you done all those steps without Magisk it would have passed. The custom Kernels alone would have gotten you a Pass due to them ignoring the Verified Boot state.
So, LOS+Kernel = Pass. If you need Magisk, try to find a version that is working properly with your setup. With Magisk working properly the custom Kernel is then optional.
Also, TWRP has nothing to do with it. Just use the latest Codeworkx.

Hi Dirk,
Thanks for your response, I have just tied to install it in the order you suggested
I install TWRP (twrp-3.2.3-0-20180822-codeworkx-cheeseburger.img)
I wiped everything including sdcard
I installed Element Kernel (ElementalX-OP5-3.10.zip)
I installed Lineage OS (lineage-15.1-20180903-nightly-cheeseburger-signed.zip)
I installed Gapps (MindTheGapps-8.1.0-arm64-20180808_153856.zip)
I installed a safety net tester called safetyNet 'attest'
When I run the safetynet test I am still getting CTS profile match: false.
Any ideas what I can do next to make this work?
Thanks for any help

alrighte_then said:
Hi Dirk,
Thanks for your response, I have just tied to install it in the order you suggested
I install TWRP (twrp-3.2.3-0-20180822-codeworkx-cheeseburger.img)
I wiped everything including sdcard
I installed Element Kernel (ElementalX-OP5-3.10.zip)
I installed Lineage OS (lineage-15.1-20180903-nightly-cheeseburger-signed.zip)
I installed Gapps (MindTheGapps-8.1.0-arm64-20180808_153856.zip)
I installed a safety net tester called safetyNet 'attest'
When I run the safetynet test I am still getting CTS profile match: false.
Any ideas what I can do next to make this work?
Thanks for any help
Click to expand...
Click to collapse
You flashed the Kernel before the ROM, so you overwrote that Kernel with the LOS one. Flash LOS then the custom Kernel.
On Magisk.. i've seen many people complain that they can't get the latest version to pass Safetynet. Again, it could just be people not configuring it correctly, or it might be better to try the previous version. Just to make sure you should tell us what you do to set it up.
You need to Hide Play Store, Banking Apps etc, and Magisk Manager too i believe. If you install Magisk and set it up when your current state is 'Uncertified', you will need to clear Data/Cache on Play Store for it to change to 'Certified'.
Also, don't rely on 'Safetynet Checker' apps. If the Play Store settings say 'Certified' try an app like Google Pay. It should work fine.

If you get cts profile mismatch. Download CTS props config from magisk modules and you will pass
Download magisk 17.1

Hi All,
Just to give you an update one where I got to with this.....
You where right the newer builds of Lineage OS do not pass safety net but the older ones do.
So after much playing around I and many flashes and wipes I found it impossible to boot a Lineage with a custom kernel, I believe this is probably down to the forced encryption.
The thing that worked for me in the end was installing "MagiskHide Props Config" and changing the figure print, I am it is very similar to the module Jamie suggested.
So I now have Lineage OS working fully with root, magisk and passing SafetyNet
Thanks everyone for you help.

The thing that worked for me in the end was installing "MagiskHide Props Config" and changing the figure print, I am it is very similar to the module Jamie suggested.
So I now have Lineage OS working fully with root, magisk and passing SafetyNet
Thanks everyone for you help.[/QUOTE]
Hello; can you explain to me in detail, step by step, how to do it? Thanks in advance.
" changing the figure print"

safetynet question - cts profile false

I was running stock 7.1.1 and everything was fine. Then i decided to try LOS 15.1, with magisk 17.4 but encountered an issue with safetynet cts profile false that prevented me from using android pay. I then proceeded to flash B35 EDL, and then do the sd upgrage to Oreo B20, but i still have the same issue with failing cts profile.
AI'm no longer rooted, running stock but still fail safetynet. Any one have any ideas what I can try next? at this point i just want cts profile to pass on the current oreo b20 stock.
Thanks!

It could be that SafetyNet detects that you have an unlocked bootloader, but there are ways to hide that (custom kernel, Magisk, etc). Do you have Xposed installed? That's an automatic SN fail. You haven't changed system partition in any way at all? It's also possible that Google hasn't yet approved B20 despite it being official rather than beta. There could be other factors too. SN looks at lots of things, many of which Google won't talk about.

You need to install magisk hide props and then in a terminal
"Su"
Grant superuser
Then
"Props"
And follow the on-screen instructions. Stupid that Google pay has a problem with rooted phones as it's painfully simple to get around it
You can find magisk hide props in the "download" section of magisk manager

Check the settings in the Google play store, Device not certified can be an issue when you change Roms.
The link between the device and Google has been broken, hence the device not certified.
There is an app Device ID that can add the certification back to its original state.
Hope this helps

Turned out to be it was because of the unlocked bootloader.
funny story... i locked the bootloader without having oem unlock enabled . Got bricked, couldn't boot into EDL... so i had to take it apart and ground the test point to put it into EDL.

xavoc said:
Turned out to be it was because of the unlocked bootloader.
funny story... i locked the bootloader without having oem unlock enabled . Got bricked, couldn't boot into EDL... so i had to take it apart and ground the test point to put it into EDL.
Click to expand...
Click to collapse
There's a tool for that now; you may not have had to open it: https://forum.xda-developers.com/axon-7/how-to/salesmultidla2017-tool-to-unblick-dfu-t3854229

TPMJB said:
You need to install magisk hide props and then in a terminal
"Su"
Grant superuser
Then
"Props"
And follow the on-screen instructions. Stupid that Google pay has a problem with rooted phones as it's painfully simple to get around it
You can find magisk hide props in the "download" section of magisk manager
Click to expand...
Click to collapse
Im trying out Magisk 16.7 (I saw some posts that said 17 causes bootloops) and MM 6.0.1. I don't see hide props in downloads? What can I do to pass safetynet? Thanks
I'm now running twrp with Oreo B20 stock.

xavoc said:
Im trying out Magisk 16.7 (I saw some posts that said 17 causes bootloops) and MM 6.0.1. I don't see hide props in downloads? What can I do to pass safetynet? Thanks
I'm now running twrp with Oreo B20 stock.
Click to expand...
Click to collapse
try this thread https://forum.xda-developers.com/axon-7/development/kernel-magisk-17-stock-roms-t3856809/page2
Update to Magisk v17 and then try the above solution

xavoc said:
Im trying out Magisk 16.7 (I saw some posts that said 17 causes bootloops) and MM 6.0.1. I don't see hide props in downloads? What can I do to pass safetynet? Thanks
I'm now running twrp with Oreo B20 stock.
Click to expand...
Click to collapse
"Magisk hide props config" is literally what it is called. If you can't find it, you're doing it wrong.
If all else fails, google then install manually.

Had to upgrade to magisk 17 to see the hide prop module download. Still couldn't pass safetynet with Oreo B20. Switched to LOS 15.1 and now everything works.

No certification of play protect

Dear comunity,
I really need your help with this. I have a OP6T and finally updated to the android 11. Before the update, I removed magisk (it was giving me some errors from time to time and I wasn't using the root for anything) through TWRP and then I just updated to the latest OOS through OTA. Everything went smoothly until today, when I went to a store and tried to pay using google pay an error appeared and it seems I have no longer the device certified by the play protect.
What did I miss during the update? Is there any workaround?
Thank you in advance!

I would try wiping and installing the latest oos through twrp instead of ota

I just did this to have everything stock again. Since I installed via OTA, didn't I loose the twrp recovery? Wiping are you referring to a complete clean install? I'm not quite prepared for that :|

igoigo said:
I just did this to have everything stock again. Since I installed via OTA, didn't I loose the twrp recovery? Wiping are you referring to a complete clean install? I'm not quite prepared for that :|
Click to expand...
Click to collapse
I don't understand why it would not be certified after ota update. You can try uninstalling updates for play services and play store maybe that will help. Or there might be magisk files that persisted. Could try to root with magisk again and uninstall it using the magisk app. Just ideas for ya cause I really don't know for sure. But I do know for sure even with stock oos you can still boot a twrp and use it even if you dont make it permanent. So you could use twrp to delete magisk or anything that would be throwing off the safety net. Could also try a safety net checking app to narrow down the problem depending if it passes or not. I just suggested clean install because there may be conflicting device names or whatever from going from custom to ota update. Hope it helps

Brettroth said:
I don't understand why it would not be certified after ota update. You can try uninstalling updates for play services and play store maybe that will help. Or there might be magisk files that persisted. Could try to root with magisk again and uninstall it using the magisk app. Just ideas for ya cause I really don't know for sure. But I do know for sure even with stock oos you can still boot a twrp and use it even if you dont make it permanent. So you could use twrp to delete magisk or anything that would be throwing off the safety net. Could also try a safety net checking app to narrow down the problem depending if it passes or not. I just suggested clean install because there may be conflicting device names or whatever from going from custom to ota update. Hope it helps
Click to expand...
Click to collapse
Thank you for the suggestions. I installed root checker and it didn't detect any root. I was thinking on installing again TWRP to then install/uninstall magisk. But I can try to check the safety net, its strange indeed, I have everything working without any problems, even the google or bank apps.
When I uninstalled magisk I had to do it through TWRP because my magisk manager that was in "hide mode" woulnd't open because it was constantly crashing. As you said, probably there is some remnant files from magisk left.
EDIT: I run the safety checker and it found a problem with "CTS profile matched", any idea what is this?

igoigo said:
Thank you for the suggestions. I installed root checker and it didn't detect any root. I was thinking on installing again TWRP to then install/uninstall magisk. But I can try to check the safety net, its strange indeed, I have everything working without any problems, even the google or bank apps.
When I uninstalled magisk I had to do it through TWRP because my magisk manager that was in "hide mode" woulnd't open because it was constantly crashing. As you said, probably there is some remnant files from magisk left.
EDIT: I run the safety checker and it found a problem with "CTS profile matched", any idea what is this?
Click to expand...
Click to collapse
Basically has 2 different ID's probably from going custom to ota update. That's why I suggested clean install. Anytime going from one rom to another clean install is needed.

@Brettroth the thing is, I was/am in the stock rom, the only thing I had "custom" was the magisk (which I uninstalled before update) and TWRP recovery :|

igoigo said:
@Brettroth the thing is, I was/am in the stock rom, the only thing I had "custom" was the magisk (which I uninstalled before update) and TWRP recovery :|
Click to expand...
Click to collapse
Sorry I thought you were on custom

igoigo said:
@Brettroth the thing is, I was/am in the stock rom, the only thing I had "custom" was the magisk (which I uninstalled before update) and TWRP recovery :
Click to expand...
Click to collapse
You should be able to just dirty flash the oos from twrp then. Should fix any mismatched id's

I will try the dirty flash through twrp

Brettroth said:
You should be able to just dirty flash the oos from twrp then. Should fix any mismatched id's
Click to expand...
Click to collapse
Finally got some time during my holidays to try this, but now I'm facing some problems. I tried to fastboot flash the TWRP version that you suggested in another thread but the recovery can't read my storage due to encryption. Do you have any suggestion?

igoigo said:
Finally got some time during my holidays to try this, but now I'm facing some problems. I tried to fastboot flash the TWRP version that you suggested in another thread but the recovery can't read my storage due to encryption. Do you have any suggestion?
Click to expand...
Click to collapse
This will decrypt android 12

Brettroth said:
This will decrypt android 12
Click to expand...
Click to collapse
But I'm with in Android 11 stock ROM (11.1.2.2) will it work?

igoigo said:
But I'm with in Android 11 stock ROM (11.1.2.2) will it work?
Click to expand...
Click to collapse
Yeah it should. The other twrp should have worked also with a11. You might have corrupted your data. Probably need to wipe data by typing yes to fix.

How can I have corrupted my data by just flashing the recovery? Can't I flash the stock boot.img?
EDIT:
I was able to flash the stock boot.img and everything is working now. Starting again, what do you suggest, boot TWRP and then instal zip and flash OOS+TWRP? My problem is, which TWRP version should I boot and flash, since the one I tested gave this problem.

Hi, my case is a bit different as i havent used magisk and i have a difderent phone, but my solution to "device is not play store certified" which was showing in play store, about section was as follows:
Enable Developper mode (setting/about/software info/click 7 times or so on "build number")
A developer menu appears in settings at the bottom, within it i disabled "OEM Unlocking".
Restarted phone checked, was still not certified, cleared data for "google play services" and "google play store", restarted, and voila.
Hope it helps