Revision [290]

This is an old revision of MagiskHideSafetyNet made by didgeridoohan on 2018-05-01 15:40:08.

 


SafetyNet


Passing SafetyNet

If everything works out, SafetyNet should pass with no further input from the user. Nothing needs to be added to the Hide list. You'll see in the Magisk Manager if it works by checking the SafetyNet status. If SafetyNet doesn't pass after enabling Hide, try rebooting (also see “MagiskHide isn’t working”).

Google continuously updates SafetyNet. Currently, no versions prior to Magisk v13.3 will pass SafetyNet without major workarounds.

Test MagiskHide

First thing to do is to make sure MagiskHide is actually working by using a root checker or a root app. Start by making sure the app can detect that your device is rooted. After that, add the app to the Hide list and see if it no longer can detect root. If that is the case, MagiskHide is working on your device. If you can't get it to work, see ""MagiskHide Issues".

Android logging

Android logging has to be enabled for MagiskHide to work (see ”MagiskHide requirements”).

CTS profile mismatch vs Basic integrity

There are two parts to a SafetyNet check, CTS compatibility and Basic integrity. The CTS check is a server side checkup up that's difficult to spoof, while Basic integrity is done on the device side and is a lower level of security. Some apps only use the Basic integrity part of the SafetyNet API and thus can be used even if SafetyNet doesn't fully pass.

Checking if Basic integrity passes

You can check SafetyNet directly in the Magisk Manager, to see if you at least pass Basic integrity. If you can't pass SafetyNet, but Basic integrity shows as true, that basically means Google doesn't trust your device for some reason (also see "SafetyNet incompatible devices and ROMs" below). You should be able to fix this by matching prop values with a ROM that passes SafetyNet (see "Matching official prop values to pass SafetyNet" and "Spoofing device fingerprint" below).

SafetyNet incompatible devices and ROMs

There are devices/ROM’s that just won’t be able to pass SafetyNet fully. This has to do with how Google certifies devices, CTS certification (Compatiblity Test Suite). If a device hasn’t passed the Google certification process, or if the ROM alters how the device is perceived by Google, it won’t be able to fully pass SafetyNet (CTS profile mismatch). You might be able to get basic integrity to report as true (see Checking if Basic integrity passes above) and this means that MagiskHide is working as it should and it's most likely a CTS certification issue.

You can match your ROM's ro.build.fingerprint (and possibly other props) with an official ROM for your device, or any other device that is certified, to make it pass SafetyNet fully (see "Matching official prop values to pass SafetyNet" and "Spoofing device fingerprint" below).

Matching official prop values to pass SafetyNet

If you use an unofficial/developers ROM you might have to match an official/stable ROM's details (usually ro.build.fingerprint and possibly ro.build.description) to pass SafetyNet (also see "Spoofing device fingerprint" below).

coolguy_16 have made a guide for Moto G 2015 here. Thank you to diegopirate for the tip.

Spoofing device fingerprint

Try changing your device's ro.build.fingerprint to a device's/ROM's that is known to pass SafetyNet. The Magisk module MagiskHide Props Config can do this. This can also be done with a boot script (don't forget to set the proper permissions for the script to execute) and the resetprop tool (also see "Sensitive props").

To change the device fingerprint with a boot script, add the following to a file you place in /sbin/.core/img/.core/service.d (and don't forget to set the proper permissions for the script to execute):
#!/system/bin/sh
resetprop ro.build.fingerprint <fingerprint value>


The response is invalid

If you get an invalid response result when checking SafetyNet, check if you've repackaged (hidden) the Magisk Manager (see "Hiding the Magisk Manager"). This is probably caused by a feature in the Play Services that checks for maliciously repackaged APK's. It's purely cosmetical and only means you can't check SafetyNet directly in the Manager. Use a different app to check SafetyNet, like SafetyNet Playground. From Magisk Manager v5.7.0 the SafetyNet check is disabled to reflect this.

Another thing to try is to force close Play Services, clearing it's data and/or rebooting the device.

You could also try using a different GAPPS package (if you're on a custom ROM) or update the Play Services manually by downloading the latest version from APKMirror.

SafetyNet check never finishes

If the SafetyNet status check never finishes (make sure to wait a while), it might mean that your Google Play Services aren’t working properly or have crashed. Try force closing Play Services, clearing data and/or rebooting the device.

You could also try using a different GAPPS package (if you're on a custom ROM) or update the Play Services manually by downloading the latest version from APKMirror.

SafetyNet API error

This error is usually caused by the Manager not having internet access. Try clearing data for the Manager and make sure that you have a working internet connection when starting the SafetyNet check. The Manager need to download the necessary files to be able to do the check and internet access is required to get a response from Google's servers.

Device uncertified in Play store/Netflix (and other apps) won't install or doesn't show up

If some apps won't install or doesn't show up in the Play store, check the Play store settings. At the bottom there might be a section called "Device certification". Some apps won't install if this shows "uncertified" (a couple of known apps are Netflix and Mario Run). It might even be that your device show "certified" and they don't show up. Even if there isn't a "Device certification" section in your version of the Play store, try the below if you have issues with apps like Netflix not installing or showing up.

The solution is to make sure your device passes SafetyNet and then clear data for the Play store and reboot. If you have multiple users on your device, you might have to clear data for all users. Next time you open up the Play store, "Device certification" should show "certified" and the apps should be able to install/show up again. You might have to wait a bit before the apps show up. Some users have reported having to wait mere minutes, others several hours up to a whole day.

Some users have reported having to add the Play store to the MagiskHide list.

I still can't pass SafetyNet

Start reading through the rest of the guide. For example More hiding tips, MagiskHide Issues, Other things to try, Asking for help/reporting bugs and other parts.
Valid XHTML :: Valid CSS: :: Powered by WikkaWiki