Develop Bugs

SafetyNet still tripped after RUU

I ran the latest RUU to update my US unlocked HTC 10 to 2.41.617.3. I was hoping that it would fix it so I could pass the SafetyNet but even right after a wipe, data format, clean install and no root, the safetycheck test still comes back with CTS profile match: false. Am I doing something wrong here?

ray985 said:
I ran the latest RUU to update my US unlocked HTC 10 to 2.41.617.3. I was hoping that it would fix it so I could pass the SafetyNet but even right after a wipe, data format, clean install and no root, the safetycheck test still comes back with CTS profile match: false. Am I doing something wrong here?
Click to expand...
Click to collapse
The only other thing I can think of that would trip it is an unlocked bootloader.
Other than that, SN would **** up.
My advice is to just install Magisk and enable Magisk hide to pass SafetyNet.

Ariac Konrel said:
The only other thing I can think of that would trip it is an unlocked bootloader.
Other than that, SN would **** up.
My advice is to just install Magisk and enable Magisk hide to pass SafetyNet.
Click to expand...
Click to collapse
Thanks. I tried using Magisk and Magisk hide but unfortunately they don't work at bypass SafetyNet either for me.

ray985 said:
Thanks. I tried using Magisk and Magisk hide but unfortunately they don't work at bypass SafetyNet either for me.
Click to expand...
Click to collapse
If your bootloader is unlocked, it will fail. Install any of the current custom kernels on the forum, they all have the bootloader fix to allow it to pass safetynet. You may even be able to relock your bootloader via sunshine.

ray985 said:
Thanks. I tried using Magisk and Magisk hide but unfortunately they don't work at bypass SafetyNet either for me.
Click to expand...
Click to collapse
aer0zer0 said:
If your bootloader is unlocked, it will fail. Install any of the current custom kernels on the forum, they all have the bootloader fix to allow it to pass safetynet. You may even be able to relock your bootloader via sunshine.
Click to expand...
Click to collapse
That's what I did on my WWE variant. I bought and ran SunShine to set my device S-OFF/locked. Since then it passes SafetyNet on my end.
As it's behaviour is the same as S-OFF/unlocked it even comes in handy as soon as one's going to sell it. In such case one could easily RUU back to stock an set the secureflag back to S-ON afterwards. Renders the device in a state that's looking like you never touched it at all.
Sent from my htc_pmeuhl using XDA Labs

5m4r7ph0n36uru said:
That's what I did on my WWE variant. I bought and ran SunShine to set my device S-OFF/locked. Since then it passes SafetyNet on my end.
As it's behaviour is the same as S-OFF/unlocked it even comes in handy as soon as one's going to sell it. In such case one could easily RUU back to stock an set the secureflag back to S-ON afterwards. Renders the device in a state that's looking like you never touched it at all.
Sent from my htc_pmeuhl using XDA Labs
Click to expand...
Click to collapse
i was one of the first to mail in, so mine is set to unlocked on vzw by default. I haven't had any need to change it though.

aer0zer0 said:
If your bootloader is unlocked, it will fail. Install any of the current custom kernels on the forum, they all have the bootloader fix to allow it to pass safetynet. You may even be able to relock your bootloader via sunshine.
Click to expand...
Click to collapse
Thanks, I'll play around with some of the custom kernels and see if that fixes it.

Some first questions. Bootloader, Brick, OTA

Hello everyone,
So I will get the Mi A2 lite on Tuesday 64GB/4GB RAM version.
I was wondering if the bootloader will stay unlocked after OTA update.
Also I read on reddit that the latest OTA (January) can possibly brick the device
https://www.reddit.com/r/Xiaomi/comments/ajoh56/psaupdate_bug_do_not_update_to_latest_january
Thanks in advance.

The bootloader only relocks if you wish to do that on your own by either fastboot command or MiFlash with relock selected.

I updated my mi a2 lite while bootloader is unlocked and nothing happened

thorin0815 said:
The bootloader only relocks if you wish to do that on your own by either fastboot command or MiFlash with relock selected.
Click to expand...
Click to collapse
So if the first thing I do is unlock the bootloader I'm pretty much safe...

grish said:
So if the first thing I do is unlock the bootloader I'm pretty much safe...
Click to expand...
Click to collapse
Unlocking/locking is pretty easy on this device, but beware that when you unlock/lock your bootloader phone will erase all data on board. There is a way to bypass that erase too though. So you can do pretty much everything with no serious consequences.

marstonpear said:
Unlocking/locking is pretty easy on this device, but beware that when you unlock/lock your bootloader phone will erase all data on board. There is a way to bypass that erase too though. So you can do pretty much everything with no serious consequences.
Click to expand...
Click to collapse
So there's basically nothing that can go wrong when I unlock the bootloader via fastboot/adb after first boot?

Nope, but your device will be classified as uncertified device inside Playstore, which could be a problem with apps like Netflix or banking stuff.
After the unlocking you could root your device with Magisk to pass Safety.Net, but this could be problematic with OTA's again.

thorin0815 said:
Nope, but your device will be classified as uncertified device inside Playstore, which could be a problem with apps like Netflix or banking stuff.
After the unlocking you could root your device with Magisk to pass Safety.Net, but this could be problematic with OTA's again.
Click to expand...
Click to collapse
Thought that only happens when you use a different system image or modify the partitions. Guess I'll wait a bit then.

grish said:
Thought that only happens when you use a different system image or modify the partitions. Guess I'll wait a bit then.
Click to expand...
Click to collapse
I used Magisk and only Magisk systemless modules, but after I updated from 10.0.2.0 to 10.0.3.0 via OTA my device started to bootloop. Even though I did uninstall Magisk and reinstall after the OTA the right way like I did all the times before.
For the moment I just stay with an unlocked bootloader but without root. I miss Viper4Android, but it's not worth the hassle. I'm using my older Moto G4 as my Spotify player now.
Edit: I just remembered that it happened at the update from Oreo to Pie aswell.

thorin0815 said:
I used Magisk and only Magisk systemless modules, but after I updated from 10.0.2.0 to 10.0.3.0 via OTA my device started to bootloop. Even though I did uninstall Magisk and reinstall after the OTA the right way like I did all the times before.
For the moment I just stay with an unlocked bootloader but without root. I miss Viper4Android, but it's not worth the hassle. I'm using my older Moto G4 as my Spotify player now.
Edit: I just remembered that it happened at the update from Oreo to Pie aswell.
Click to expand...
Click to collapse
The loop, you mean?
Can you use netflix with unlocked bl?

grish said:
The loop, you mean?
Click to expand...
Click to collapse
Yup!
Can you use netflix with unlocked bl?
Click to expand...
Click to collapse
You won't find the Netflix app inside the Play Store when your bootloader is unlocked (Safety.Net fails), but you can download it for example from APKMirror.
https://www.apkmirror.com/?post_type=app_release&searchtype=apk&s=netflix
Edit: Just tested it with the latest beta version and it worked without problems.

thorin0815 said:
Yup!
You won't find the Netflix app inside the Play Store when your bootloader is unlocked (Safety.Net fails), but you can download it for example from APKMirror.
https://www.apkmirror.com/?post_type=app_release&searchtype=apk&s=netflix
Edit: Just tested it with the latest beta version and it worked without problems.
Click to expand...
Click to collapse
Thanks a lot.
Do you think the bootloop was because of magisk when going from oreo to pie?

grish said:
Thanks a lot.
Do you think the bootloop was because of magisk when going from oreo to pie?
Click to expand...
Click to collapse
Well, I don't know any other reason, because I haven't touched the system partitions at all.

thorin0815 said:
Well, I don't know any other reason, because I haven't touched the system partitions at all.
Click to expand...
Click to collapse
Unlocking the bootloader on oreo can't be the issue?

grish said:
Unlocking the bootloader on oreo can't be the issue?
Click to expand...
Click to collapse
I don't think the unlocked bootloader was the reason. Never experienced problems with OTA's on all my devices just because of an unlocked bootloader.

With Magisk 17.3 I could install OTAs without a problem, but since Magisk has been updated to 18.0, OTAs don't work anymore. I have to unroot, flash stock, update then recover all the data then root again. It's a pain in the a** to do that everytime so I'm sticking with stock and locked bootloader for now. Also bootloop issues were reported on Mi A2 devices, not Lite AFAIK.

For me problems started with Pie, with Oreo I never faced problems with Magisk and OTA updates. Magisk 18.0 worked just fine for me with Oreo.

Need assistance with relocking bootloader on PIXEL 3 XL running Q Beta 3

Just want to know how i can go about re locking the device to set up G-pay
Don't want to end up bricking the device,
Anyone able to assist?

If you are 100% stock, and have a backup of everything of importance, as this will wipe your device, just execute: fastboot flashing lock

I relocked my bootloader on Q DP3, no luck using Google Pay. The beta rom is not CTS compatible.
collindubya said:
Just want to know how i can go about re locking the device to set up G-pay
Don't want to end up bricking the device,
Anyone able to assist?
Click to expand...
Click to collapse

Several people in the Pixel 3 forum are reporting issues with Google Pay on Beta 3, but I used it Tuesday afternoon with no issue. I haven't tried again yet but I updated in the afternoon and rebooted to complete the update when I got in my car to go home. Stopped at the store on the way and used Google Pay without issue.

Gpay works. Did you wipe your wipe after relocking it? I know it says it wipes it. But doesn't truly wipe everything unless you access factory recovery and wipe it there too. I relocked my bl and gpay works fine. Beta 3 is certified now. Look in play store settings. Certified. So everything will work now. Having the oem ticked on with the bl locked will also deny some features. That switch has to be off to be truly locked. After relocking you have to go into settings and flip that off. It will be on after relocking.

Pixel 3 XL install Netflix on rooted device

Hi, I rooted my pixel, after that I tried to install Netflix all from the web but it says that my device is not supported. I tried to hide magisk and even google play and google play services and it didn't worked. How can I install the latest Netflix app on my device ? Thanks

You can't at the moment. It looks like the Play Store is seeing something that neither Magisk Hide or even a cloaked unlocked bootloader can hide. My guess is that it is an attestation similar to how Google Pay is working to fight root and unlocked bootloaders. Clearly, the Netflix help page that claims that certification is the kicker is dead wrong at this point and as of a moth or two ago. Maybe a return to stock, re-lock of your bootloader and facory reset (which locking your BL would do anyways) might get you there, but I am not about to do that. For now, sideload the most recent one off of APK Mirror and if you need to update due to some lost functionality, use one from there when it becomes available.

install netflix then root

pacman photog said:
install netflix then root
Click to expand...
Click to collapse
True, but Play Store will not update Netflix after that one time. I have 4 devices installed that way, and since the Play Store version with 3.14 in it the updates will not show. One of the devices hadn't got 3.14 when the others had and it got the Netflix update two ago. The others didn't get it. That device did not get the last update nor did the others. I suggested in another thread possibly uninstalling the Play Store o get it to revert to the original version and then checking to see if Netflix is available. Even if it works, I am not about to keep an older version of Play Store or have to do that every time Netflix updates. The older version of Netflix is working fine.

My Netflix is on version 7. Not sure what you speaking about version 3

pacman photog said:
My Netflix is on version 7. Not sure what you speaking about version 3
Click to expand...
Click to collapse
I was talking about the Play Store version itself (Play Store>settings).

#1 wait for final q and root.
#2 Netflix doesn't need update lol
#3 my bad lol

What I find fascinating about this is I assumed it was because the bootloader was unlocked. But, flashing the Android Q Beta, allows you to install Netflix with no issues unlocked. But, if you go back and flash P? It's no longer an option. So my theory is out the window..

jbarcus81 said:
What I find fascinating about this is I assumed it was because the bootloader was unlocked. But, flashing the Android Q Beta, allows you to install Netflix with no issues unlocked. But, if you go back and flash P? It's no longer an option. So my theory is out the window..
Click to expand...
Click to collapse
Rooted both ways, neither way? Safetynet?

sliding_billy said:
Rooted both ways, neither way? Safetynet?
Click to expand...
Click to collapse
Rooted, and non rooted. SafetyNet passes fine. I observed this on fresh installations. If I do a fresh factory install of P, I can't install Netflix even before rooting. If I flash stock P, and lock the bootloader? I can install Netflix.
Now with Q? Bootloader unlocked, factory flash Q, can install Netflix. It's very interesting that this doesn't happen with a factory flash of P..

jbarcus81 said:
Rooted, and non rooted. SafetyNet passes fine. I observed this on fresh installations. If I do a fresh factory install of P, I can't install Netflix even before rooting. If I flash stock P, and lock the bootloader? I can install Netflix.
Now with Q? Bootloader unlocked, factory flash Q, can install Netflix. It's very interesting that this doesn't happen with a factory flash of P..
Click to expand...
Click to collapse
This is leading me to believe my previous thoughts about Netflix on the Play Store. I think the Play Store is looking at SafetyNet/Device Certified 1st regardless of device. If that passes, move to the device/OS and see if it is listed for additional checking. Since Q has not been released publicly yet, I am guessing that the check goes no further and shows Netflix. This will probably change at public Q release if not sooner, and updates will cease even if the program is installed already. I believe my Tab S2 713 simply is not listed for additional checking since it is rooted and has an unlocked BL but passes SafetyNet. Play Store shows available and provides updates.
The big question is what additional testing is being performed. I doubt it is checking for unlocked BL unless the kernel masking of unlocked BL simply doesn't work anymore. I tend to think it is a database attestation check similar to what GPay does. Finding that or using MagiskHide Props Config module to set a working fingerprint might work long term, but since older versions of Netflix (already installed on all of my devices) are working OK without updating I am in no hurry to do too much testing.

sliding_billy said:
This is leading me to believe my previous thoughts about Netflix on the Play Store. I think the Play Store is looking at SafetyNet/Device Certified 1st regardless of device. If that passes, move to the device/OS and see if it is listed for additional checking. Since Q has not been released publicly yet, I am guessing that the check goes no further and shows Netflix. This will probably change at public Q release if not sooner, and updates will cease even if the program is installed already. I believe my Tab S2 713 simply is not listed for additional checking since it is rooted and has an unlocked BL but passes SafetyNet. Play Store shows available and provides updates.
The big question is what additional testing is being performed. I doubt it is checking for unlocked BL unless the kernel masking of unlocked BL simply doesn't work anymore. I tend to think it is a database attestation check similar to what GPay does. Finding that or using MagiskHide Props Config module to set a working fingerprint might work long term, but since older versions of Netflix (already installed on all of my devices) are working OK without updating I am in no hurry to do too much testing.
Click to expand...
Click to collapse
Same here.. it's not a deal breaker, it's just frustrating. There's another app from the Playstore that does this from T-Mobile. T-Mobile Device Unlock (or whatever it's called). What made me really raise my eye-brows is during the initial setup of the phone after a fresh flash. In P, during initial setup, when you get to 'install additional apps' it's not listed. If I flash Q, go through setup, it's listed in additional apps.. It's very strange.

jbarcus81 said:
Same here.. it's not a deal breaker, it's just frustrating. There's another app from the Playstore that does this from T-Mobile. T-Mobile Device Unlock (or whatever it's called). What made me really raise my eye-brows is during the initial setup of the phone after a fresh flash. In P, during initial setup, when you get to 'install additional apps' it's not listed. If I flash Q, go through setup, it's listed in additional apps.. It's very strange.
Click to expand...
Click to collapse
Too funny about the T-Mobile device unlock. I had that show up on my phone a few weeks ago, and I deleted it. I have 5 devices on T-Mobile, and that was the only one that it showed up on. I have seen that app before since my boys had a prepaid T-Mobile phone years ago that had that app. The app not showing in additional apps makes sense since it doesn't show up in Play Store from the device and if you search it on the PC it will say not compatible with any of your devices or compatible with some of your devices. I actually chatted with Netflix a little while ago and played stupid about the whole thing. The agent seemed to think that as long as your device was certified the app would show.

jbarcus81 said:
Rooted, and non rooted. SafetyNet passes fine. I observed this on fresh installations. If I do a fresh factory install of P, I can't install Netflix even before rooting. If I flash stock P, and lock the bootloader? I can install Netflix.
Now with Q? Bootloader unlocked, factory flash Q, can install Netflix. It's very interesting that this doesn't happen with a factory flash of P..
Click to expand...
Click to collapse
Glad I found you. That's exactly what I came on here to find -- glad someone else noticed like I did.

vonDubenshire said:
Glad I found you. That's exactly what I came on here to find -- glad someone else noticed like I did.
Click to expand...
Click to collapse
Where did you get the Netflix app? Play store says not compatible with my device. Rooted QB5.
Sent from my [device_name] using XDA-Developers Legacy app
---------- Post added at 07:43 PM ---------- Previous post was at 07:27 PM ----------
Daisymae said:
Where did you get the Netflix app? Play store says not compatible with my device. Rooted QB5.
Sent from my [device_name] using XDA-Developers Legacy app
Click to expand...
Click to collapse
Forget above. My bad.
Sent from my [device_name] using XDA-Developers Legacy app

yeh appareently APK Mirror doesn't host the Netflix app anymore either, so get it from another site.

Something interesting... Did a clean install of July Pie.. Was using Q but was having some random issues with GPS.. Anyways, I installed the APK and now I'm being told by the application itself that it's not compatible with my device.. WTH!?!?!?? Can't even side-load now??

Pretty sure the Android DRM (Digital Rights Management) Framework does the Netflix locking. There's a magisk module for DRM Bypassing for Netflix

jbarcus81 said:
Something interesting... Did a clean install of July Pie.. Was using Q but was having some random issues with GPS.. Anyways, I installed the APK and now I'm being told by the application itself that it's not compatible with my device.. WTH!?!?!?? Can't even side-load now??
Click to expand...
Click to collapse
You also may need to spoof the device fingerprint. I am on Q so it lets me download right now no matter what. I just spoofed fingerprint for G Pay on top of the database

Just stumbled upon this thread and just wanted to comment. I'm rooted with an unlocked bootloader and I've had no issues with installing Netflix of having it update when needed. I've even had to uninstall and reinstall once with no issue.

ctsProfile: false - Allthough not rooted

Hi there,
It might be a dumb question, but im kinda clueless.
I have my device not rooted and the SavetyNet-Check of Magisk says ctsProfile: false.
My bootloader is unlocked since the beginning. Could that be the reason for it? And if so how could I avoid it? Rooting or Relocking the bootloader?
Background:
Because I experience problems with a couple of banking apps that they dont start/crash on startup and one of them saying it might be of having my device rooted.
So thats why I thought maybe SafetyNet Check is not good and checked it and figured out one check is not passing.

wsjoke said:
Some kernels lack the feature needed to pass cts without magisk installed you can either
1. install magisk to pass CTS
2. Use a kernel that has the patch (loki and my own kernel "chunchunmaru" should have it but both are for Q only as off now)
Click to expand...
Click to collapse

First, in what rom you are? Why u install magisk manager if u don't have root? What apps don't open? We aren't magicians or clairvoyants, please always mention more details

wsjoke said:
Hi there,
It might be a dumb question, but im kinda clueless.
I have my device not rooted and the SavetyNet-Check of Magisk says ctsProfile: false.
My bootloader is unlocked since the beginning. Could that be the reason for it? And if so how could I avoid it? Rooting or Relocking the bootloader?
Background:
Because I experience problems with a couple of banking apps that they dont start/crash on startup and one of them saying it might be of having my device rooted.
So thats why I thought maybe SafetyNet Check is not good and checked it and figured out one check is not passing.
Click to expand...
Click to collapse
I assume that you are from stock. It is the problem from Mi A2 Lite's device fingerprint that somehow it is not certified. Probably for reasons:
1. Magisk manager is present
2. Unlocked bootloader
3. Usually, it will pass when fingerprint has the same value from 10.0.1.0. After that, it fails for no reason. One theory suggests it might have to do with vulnerabilities present from our device (the System Toolkit app, when you dial *#*#64663#*#*), thus revoking certification from Play Store.
If you're on custom ROM, that would be it, except from POSP that has passed CTS. Also it could be the GApps you are using.

Os_Herdz said:
First, in what rom you are? Why u install magisk manager if u don't have root? What apps don't open? We aren't magicians or clairvoyants, please always mention more details
Click to expand...
Click to collapse
Stock rom, I previously had my phone rooted, thats why I still have installed magisk.
Various Banking Apps doesnt work as intended. For example https://play.google.com/store/apps/details?id=de.commerzbanking.mobil&hl=de cant unlock with fingerprint anymore. https://play.google.com/store/apps/details?id=com.starfinanz.mobile.android.dkbpushtan&hl=de doesnt open at all and opens a website which says a rooted phone could cause this issue.