Develop Bugs

Xposed and Safety Net Pass -- How To!

XPOSED and Safety Net PASS -- Instructions How To
I've been using Xposed because it has functionality that I don't want to give up. But "regular" Xposed won't pass Safety Net.
Thanks to @drewcu, I now have found a way to use Xposed and PASS Safety Net.
This is important enough it deserves its own Guide thread. All credit goes to @drewcu -- and of course the edXposed devs! Go here and THANK this post. Full exchange is below, but please go thank @drewcu in that post.
_______
drewcu said:
Installed Magisk and edXposed and all is well.
Thanks!
Click to expand...
Click to collapse
ChazzMatt said:
First hearing about "edXposed". Quick Google search, sounds interesting, and some say it allows you to pass Safety Net, which regular Xposed (I use) doesn't. Is that true?
Which Magisk version are you installing with that?
Click to expand...
Click to collapse
drewcu said:
Latest Magisk 19.3.
YES, EdXposed absolutely passes Safetynet (both ctsProfile and basicIntegrity)! Install instructions here: https://github.com/ElderDrivers/EdXposed but see below for the specific EdXposed version I recommend using.
I personally use magisk-EdXposed-sandhook-v0.4.0.1_beta-SNAPSHOT-release.zip found https://www.lanzous.com/b642738. Newer Sandhook versions with resource hooking like v0.4.1.2_beta and v0.4.2.3_alpha (and the YAHFA versions too) found https://github.com/ElderDrivers/EdXposed/releases introduce some LAG for me that isn't present on 0.4.0.1. Haven't tried newer ALPHA versions like 0.4.3.7 but you are welcome to see if you experience the same lag. Would have to separately install both versions, start opening apps, clicking around, and counting time till the V30 responds to see the lag I am referring to. Is subtle but most noticeable in 0.4.1.2 and less so in 0.4.2.3.
The only Xposed module I use is GravityBox(O) and there is a version specifically for EdXposed -- 8.5.3.1-edxposed (https://github.com/GravityBox/GravityBox/releases/tag/v8.5.3.1-edxposed_o), although I updated to general version 8.5.4 (https://forum.xda-developers.com/xposed/modules/app-gravitybox-v8-0-0-beta-1-tweak-box-t3739929) and have no resource hooking problems with 0.4.0.1 like I thought there might be and had with general version 8.5.3. If you use any OTHER Xposed modules that require resource hooking, you will need to use an EdXposed version 0.4.1.2 or above which has resource hooking but also possibly some lag (perhaps none in the latest alpha I don't know).
So I stay on magisk-EdXposed-sandhook-v0.4.0.1_beta-SNAPSHOT-release because it works with the latest version of GravityBox no problem, has 0 lag unlike newer versions (I think an Oreo problem), and passes Safetynet just fine.
Not sure if some of the steps I took after reading a forum about Safetynet were necessary but I did them anyway -- namely:
1) EdXP Settings - Enable Black/White List
2) Black List Google Play Services and Google Play Store
3) Magisk Hide - ALL of Google Play Services
Enjoy!
Click to expand...
Click to collapse
TotallyAnxious said:
Thanks. I've been meaning to check out the new Xposed offshoots.
Click to expand...
Click to collapse
_________
@drewcu:
edXposed INSTRUCTIONS
Install instructions here: https://github.com/ElderDrivers/EdXposed but see below for the specific EdXposed version I recommend using.
I personally use magisk-EdXposed-sandhook-v0.4.0.1_beta-SNAPSHOT-release.zip found https://www.lanzous.com/b642738. Newer Sandhook versions with resource hooking like v0.4.1.2_beta and v0.4.2.3_alpha (and the YAHFA versions too) found https://github.com/ElderDrivers/EdXposed/releases introduce some LAG for me that isn't present on 0.4.0.1. Haven't tried newer ALPHA versions like 0.4.3.7 but you are welcome to see if you experience the same lag. Would have to separately install both versions, start opening apps, clicking around, and counting time till the V30 responds to see the lag I am referring to. Is subtle but most noticeable in 0.4.1.2 and less so in 0.4.2.3.
The only Xposed module I use is GravityBox(O) and there is a version specifically for EdXposed -- 8.5.3.1-edxposed (https://github.com/GravityBox/GravityBox/releases/tag/v8.5.3.1-edxposed_o), although I updated to general version 8.5.4 (https://forum.xda-developers.com/xposed/modules/app-gravitybox-v8-0-0-beta-1-tweak-box-t3739929) and have no resource hooking problems with 0.4.0.1 like I thought there might be and had with general version 8.5.3. If you use any OTHER Xposed modules that require resource hooking, you will need to use an EdXposed version 0.4.1.2 or above which has resource hooking but also possibly some lag (perhaps none in the latest alpha I don't know).
So I stay on magisk-EdXposed-sandhook-v0.4.0.1_beta-SNAPSHOT-release because it works with the latest version of GravityBox no problem, has 0 lag unlike newer versions (I think an Oreo problem), and passes Safetynet just fine.
Not sure if some of the steps I took after reading a forum about Safetynet were necessary but I did them anyway -- namely:
1) EdXP Settings - Enable Black/White List
2) Black List Google Play Services and Google Play Store
3) Magisk Hide - ALL of Google Play Services
Enjoy!

When I go to download the file, it's in, I assume, Chinese characters.
Any help.
Never mind, figured it out.

This is great. I'm so happy to have Gravity Box again.

I too had a problem with lag with newer versions of edxposed. I switched to the version recommend in the OP and all is well.

If you comfortable using "chinese" app. Taichi is simpler solution (personally), although not much modules currently supported. Both edxposed and taichi are available on magisk repo

Thanks @ChazzMatt, finally got around to installing Xposed again. Thank god for GravityBox!
edit: after playing around for a day, I'm disabling edx. I'm getting lag, force closes, unresponsive back button, and major battery drain. Sad to see the framework hasn't changed much in 1-2 years. It's not worth it for a single Xposed module.

Gravitybox system framework not respondinhlg.
On us996k
Guess I'm missing something?

qwas7899 said:
Gravitybox system framework not respondinhlg.
On us996k
Guess I'm missing something?
Click to expand...
Click to collapse
Edit; figured it out

qwas7899 said:
Edit; figured it out
Click to expand...
Click to collapse
share with the class.

Right. Didn't have riru-core module installed.

Thanks a lot for this guide . It's great to have xposed and safety net passing.

soo I tried to install edxposed sandhook (latest version), after a couple reboot, all went fine, but now I lost wifi and data connection (they cant be turned on), any ideas or fix? is it linked to that version of edxposed? I have a Lg ls998 converted to Us998h, thank you

LeTerrible said:
Just wanted to share my experience with NFC banking and FullHD working Netflix. Managed to delete everything google and installed Microg only (to get Gcam to work), my banking app, Netflix app, Canary EdXposed and it works flawlessly! Could never get FullHD and NFC banking to work previously with Xposed. Of note was the fact I am running Xprivacy, too. Just make sure you blacklist the apps in EdXposed and also hide them in Magisk and it all works
Hope this helps others as it really made my NoGapps/Rooted stock phone experiences significantly better.
Click to expand...
Click to collapse
Great.

I'm having trouble getting EdXposed to activate. I'm on a fresh clean install of the TWRP flashable version of US998 30b with Magisk 20.1 installed and working, and while i've got the Riru - Core module installed (v19.5), no matter which Riru - Ed Xposed module I use I get the following error message from EdXposed Manager 4.5.2 explaining why it's installed but not activated:
There seems to be a known issue("Wrong base directory: /mnt/expand/7f941a12-b7aa-4d2a-a664-f89a46b7d86c/user_de/0/org.meowcat.edxposed.manager") with your ROM.
Suggestions on where I go from here?

radwolf76 said:
I'm having trouble getting EdXposed to activate. I'm on a fresh clean install of the TWRP flashable version of US998 30b with Magisk 20.1 installed and working, and while i've got the Riru - Core module installed (v19.5), no matter which Riru - Ed Xposed module I use I get the following error message from EdXposed Manager 4.5.2 explaining why it's installed but not activated:
There seems to be a known issue("Wrong base directory: /mnt/expand/7f941a12-b7aa-4d2a-a664-f89a46b7d86c/user_de/0/org.meowcat.edxposed.manager") with your ROM.
Suggestions on where I go from here?
Click to expand...
Click to collapse
Solution Found. My EdXposed Manager had been installed to External Storage. It only works on Internal Storage.

Safety Net Fail w/ Gravitybox
It looks like as soon as I enable the Gravitybox module that you recommend, safetynet fails. Are you still passing with your setup (I'm wondering if there has been some update that this version of Gravitybox no longer passes)?
UPDATE: even though safetynet shows up as failing in Magisk, I am still able to use Google Pay, so maybe it is working? I'll update this post once I've tried using Google Pay to pay for something.
UPDATE again: after a couple of days, Google Pay showed a pop up message saying that it would no longer work. Uninstalling and reinstalling gets it working temporarily again it seems.

Dear @ChazzMatt
Should I install the old beta in the last page or the latest canary to avoid safety net and which versions is the best?

Note to everyone: installing xposed framework will trigger safetynet....and uninstalling it will do as well
And i don't know how to solve this except flashing a new rom

Galaxy Watch and Lineage OS

Hi,
I have Samsung S9 phone (Exynos version) with official Lineage OS 17 installed. Also I have Magisk (package renamed, Magisk Hide is active) as root control app.
Recently I've bought Galaxy Watch (not 2 or 3), installed Wearable, changed system props to be able to run it (as described here: https://forum.xda-developers.com/ga...earable-app-rooted-phone-help-t3838503/page10) and everything works OK, except inability to pay with watch.
When I run Samsung Pay from Wearable app, it tells about unauthorized modifications and exit.
I've found this interesting log, named com.samsung.android.samsungpay.gear.log in the root of internal storage.
In this log (which is XML) I see a section "detections", and there I see next stuff:
<Detection>
Date Time Source Policy Summary Current Warning Ver Name Description
2020-08-15 09:14:31 [7107] 52355100 00004000 00004000 00004000 5.3.0 (ROOTED ) com.topjohnwu.magisk
2020-08-15 09:19:06 [7107] 52355100 00004000 00004000 00004000 5.3.0 (ROOTED ) com.topjohnwu.magisk
</Detection>
I've double-checked, in Magisk I hide it from this Samsung app.
So, my question is - why it still able to detect magisk? And what I can do to be able to pay with watch?

Thank you for pointing this file out. Exactly what I was looking for.
Mine, too, says Magisk is found.
I still can't get the Samsung Wear App to work, but good to get confirmation what it is detecting, Magisk in this case.
I was getting this error on LineageOS even before Magisk. I specifically installed Magisk to see if that hide feature would help.
Now at least I can go back to plain LineageOS without Magisk and see what it says.
Thanks.

DulacLancelot said:
Thank you for pointing this file out. Exactly what I was looking for.
Mine, too, says Magisk is found.
I still can't get the Samsung Wear App to work, but good to get confirmation what it is detecting, Magisk in this case.
I was getting this error on LineageOS even before Magisk. I specifically installed Magisk to see if that hide feature would help.
Now at least I can go back to plain LineageOS without Magisk and see what it says.
Thanks.
Click to expand...
Click to collapse
Eh. I uninstalled Magisk. And the LineageOS root functionality is disabled. Wear Samsung Pay still detects root, and flags it multiples times as "MAGISK-11" or "MAGISK-2" or "framework".

Samsung Pay will never work on rooted devices. It's related to knox services.

w41ru5 said:
Samsung Pay will never work on rooted devices. It's related to knox services.
Click to expand...
Click to collapse
Wrong. I've had Samsung pay working on my watch with rooted pixel 3a xl

And i have it on my rooted Pixel 2 XL....
Install Magisk
Enable MagiskHide
MagiskHide all Samsung apps
Rename Magisk Manager
Do this before opening Samsung Pay

Safetynet fix on sm-t970 ??

i root my sm-t970 but i cant use app like netflix because my safetynet is locked...someone of you can advise me of to do that? or any other solutions?

davidlu333392 said:
i root my sm-t970 but i cant use app like netflix because my safetynet is locked...someone of you can advise me of to do that? or any other solutions?
Click to expand...
Click to collapse
Magisk hide.

Magisk hide seems to require props fingerprint. Currently there are no official fingerprint for galaxy tab s7, or plus

Waiting for this

I'm about to become your favorite person ever, everyone! ​I am currently passing SafetyNet after flashing the kdrag0n safetynet-fix to my Samsung Galaxy Tab S7+ SM-T970 and enabling the MagiskHide Props Config module in Magisk.​
HOWEVER, as was the case with literally all of the stock-based ROMs for the Galaxy S8, it appears that there will still be issues with a select few apps. For example, you will get soft-banned from Snapchat every few days. Also, certain healthcare apps will still be able to detect root (likely all related to Knox, since a Pixel 5 rooted via the same methods will launch the same apps without issue).
All the best from your fellow tinkerer - Godless1
(P.S. I'm going to copy and paste this into its own thread for better visibility.)

Godless1 said:
I'm about to become your favorite person ever, everyone! ​I am currently passing SafetyNet after flashing the kdrag0n safetynet-fix to my Samsung Galaxy Tab S7+ SM-T970 and enabling the MagiskHide Props Config module in Magisk.​
HOWEVER, as was the case with literally all of the stock-based ROMs for the Galaxy S8, it appears that there will still be issues with a select few apps. For example, you will get soft-banned from Snapchat every few days. Also, certain healthcare apps will still be able to detect root (likely all related to Knox, since a Pixel 5 rooted via the same methods will launch the same apps without issue).
All the best from your fellow tinkerer - Godless1
(P.S. I'm going to copy and paste this into its own thread for better visibility.)
Click to expand...
Click to collapse
It worked on my samsung galaxy tab s7 (sm-t870) thanks!

Question Cannot get phone to pass SafetyNet after rooting

I've unlocked the bootloader. I've grabbed boot.img and patched it with Magisk, etc. and now I'm rooted. Great.
But I cannot pass SafetyNet.
I've done MagiskHide, easy enough.
But I also installed the "Universal SafetyNet Fix" module ("This is a universal fix for SafetyNet on devices with hardware attestation and unlocked bootloaders or custom verified boot keys. It defeats both hardware attestation and the new SafetyNet CTS profile updates released on January 12, 2021. The only requirement is that you can pass basic attestation, which requires a valid combination of device and model names, build fingerprints, and security patch levels.")
And I've also installed the "MagiskHide Props Config" module and run the "props" command. I've tried going through various options, changing the signature (they don't have OnePlus 9 Pro though, best I could do was OnePlus 8T Pro) and even doing full emulation. No matter what options I try, I cannot pass SafetyNet. As a result, things like Netflix won't show up in the play store.
Anybody had any luck?
In the past I've additionally installed a custom kernel, one that would hide the fact that the bootloader was unlocked and help pass safetynet. I think that's the "puzzle piece" I'm missing.
I can't stand the new xda forums. Can't easily find the kernel development threads or even the custom ROM's threads.

There's an issue with safetynet on the latest Magisk. You need the canary version to pass safetynet.

entropism said:
There's an issue with safetynet on the latest Magisk. You need the canary version to pass safetynet.
Click to expand...
Click to collapse
Really? Omg I've been fighting with SafetyNet for 2 days trying different modules and options...
Ok let me try Canary.

Son of a ... Ok, well that worked. Kind of annoyed I learned all about "Universal SafetyNet Fix" and hardware attestation and the new SafetyNet CTS profile updates released on January 12, 2021. And then I learned about
MagiskHide Props Config and props files and device fingerprints, etc.
Oh well, at least I can pass safetynet.
Should I delete this thread? Help reduce some clutter.

glitchsys said:
Son of a ... Ok, well that worked. Kind of annoyed I learned all about "Universal SafetyNet Fix" and hardware attestation and the new SafetyNet CTS profile updates released on January 12, 2021. And then I learned about
MagiskHide Props Config and props files and device fingerprints, etc.
Oh well, at least I can pass safetynet.
Should I delete this thread? Help reduce some clutter.
Click to expand...
Click to collapse
I would leave the thread so that people can search if they have the same issue. Not everyone knows to use canary (obviously... lol) and there are other good ideas in your post that may resolve other issues.

This literally happened last week, and it will be pushed to the main Magisk module shortly. I learned about it when my 7T wouldn't pass safety.

I've enabled magical hide, have added props config module and changed fingerprint to Pixel 5, and have flashed universal safetynet fix, and lastly I updated to canary build. I still don't pass CTS. Any help?

I installed this Canary version from Magisk GitHub and pass... T-Mobile variant running it with Omega Kernel.

I am passing safety net, but can't get Netflix to work. It is saying it's not compatible with my device and to update to latest version

the bolt of thunder said:
I am passing safety net, but can't get Netflix to work. It is saying it's not compatible with my device and to update to latest ve
Click to expand...
Click to collapse
Did you clear data and cache for the play store and also Magisk hide all the Google Play Service information.. it's working for me..

I cleared data and cache for Netlfix only. I did Magisk hide all the Google Play Services. Unfortunately I unrooted and re-locked my bootloader. I will root again maybe after some time. Very sad.

the bolt of thunder said:
I am passing safety net, but can't get Netflix to work. It is saying it's not compatible with my device and to update to latest version
Click to expand...
Click to collapse
I had to uninstall all updates to Netflix and then update again in the Play Store to get it working again. Before the last OTA I had to install a standalone APK over the system Netflix because Play Store version didn't work at all. Netflix does work on rooted devices, it's just a bit of a hassle for some reason.

entropism said:
There's an issue with safetynet on the latest Magisk. You need the canary version to pass safetynet.
Click to expand...
Click to collapse
thanks

glitchsys said:
Son of a ... Ok, well that worked. Kind of annoyed I learned all about "Universal SafetyNet Fix" and hardware attestation and the new SafetyNet CTS profile updates released on January 12, 2021. And then I learned about
MagiskHide Props Config and props files and device fingerprints, etc.
Oh well, at least I can pass safetynet.
Should I delete this thread? Help reduce some clutter.
Click to expand...
Click to collapse
Did you uninstall magisk and all the modules? Having the same issue won't pass CTS profile match.

Reasons not to update to 11.0.0.2?

I've had the update notification on my 7T for some time now ... my phone is unlocked/rooted, w/ Magisk, MagiskHide, SafetyNet basic, everything working like a charm. I use GPay quite often, also a few apps (banking, etc.) do not like unlocking/rooting, so hiding root is necessary.
What's the status with OS11? I read some time ago where some upcoming changes in Android might make the previous hacks impossible, leading to programs not working on an unlocked and/or rooted phone anymore ...

A11 works great on TMobile hd1907, converted to global, unlocked, rooted, magisk hide, Dora v86 sdcardfs kernel

The reason I am waiting is the bug with missing audio in incoming calls when on Google FI network. Shall be fixed in the next FW according to the whatsnew screenshots from Indian version in this forum.

If your phone is running great why would you touch it?
As far as I can tell Gookill Android is in a flat spin but all they seem to think is they're going fast
I'm still on Pie and could update to 10 even 11... no way I'm loading that junk.
Feel the wuv...