Database Develop

[Guide] Pass Safetynet on a rooted 7.0 AOSP based ROM - Updated 11-01-2016

Update (11/09) - This method no longer works with the november security updates from Google as it causes suhide to break.
Here are the steps to follow
If you are already rooted, fully unroot. I do this by doing the following.
1) In the SuperUser app, go to settings and choose to do a full unroot. Choose "No" when it prompts you to restore your stock boot.img
2) Let the system reboot normally.
3) Reboot to recovery
4) If you have Magisk installed, flash the Magisk uninstaller Link
5) If you have suhide installed, flash rm-suhide 0.51 Link
6) Flash your ROM's boot.img extracted from your ROM (simply dirty flashing should also work), or install a custom kernel of your choice
At this point you should have a stock boot.img (or custom kernel) with no traces of SuperUser anywhere
Install SuperUser 2.78 Link
Install suhide 0.55 Link
Reboot into system. Verify that you have root. I'm not 100% sure this is necessary, but I like to do it before proceeding.
Reboot back into recovery.
Flash xsetpropSu.zip (attached to this post) Link
Reboot the system
Install RootSwitch 1.3.3.2 Link
Open up RootSwitch, uncheck disable all SU daemons. Disable Root
Pass SafetyNet
Optional
Using tasker to automatically disable root when certain applications are run. @NYZack made a little writeup here
Credits:
@NYZack - Helping me figure out how to put all of this together
@Captain_Throwback - For help with xsetprop
@Chainfire - SuperSU + SuHide
@topjohnwu - Magisk

work around found

no longer relevant post..

I don't know if the kernel can be modified to pull that trick. Even if someone does though, it's not going to last long. Every bypass you can find, Google can find. Then they know what to fix. The only way to win, is not to play.
And no, you can't lock the bootloader without wiping data.

Well I got it to work...I will turn this thread into a Guide. Who knows how long it will last, but...at least it's working for now.

Thread updated with instructions. I hope this can help someone!

So there's no way to do this without rooting and magisk?

3dawg said:
So there's no way to do this without rooting and magisk?
Click to expand...
Click to collapse
I want root, so I did not try to do that. If your bootloader is unlocked, I do not think there's a way to do it.

Thanks
skaforey said:
Thread updated with instructions. I hope this can help someone!
Click to expand...
Click to collapse
Yes I just followed these instructions and I am green panel. I have to check at a terminal to pay with phone but it probably will work. One note that was kinda unclear in case others do same....It should read :
Turn the Root switch ON....not OFF....when wanting to use AP. You can turn it back on when you want to do other things that require root permissions. I believe this is dynamic and working with the magisk mount point in addition to tricking the boot process into thinking the bootloader is locked.
Thanks so much for this. I was so angry with Google. And I was just going to say FK it and not use AP.
WORKS! Do all the steps in the order he says above and you can turn root off and on at will and have Android Pay work just fine! YAY!

skaforey said:
This thread started as a plea for help, but thanks to @NYZack I have gotten it to work.
Here are the steps to follow
If you are already rooted, fully unroot. I do this by doing the following.
1) If you have suhide installed, download rm-suhide 0.51 Link
2) In the SuperUser app, go to settings and choose to do a full unroot. Choose "No" when it prompts you to restore your stock boot.img
3) Let the system reboot normally.
4) Reboot to recovery
5) Flash rm-suhide 0.51
6) Flash your ROM's boot.img extracted from your ROM (simply dirty flashing should also work), or install a custom kernel of your choice
At this point you should have a stock boot.img (or custom kernel) with no traces of SuperUser anywhere
Install SuperUser 2.78 Link
Install Magisk v8.zip Link
Install suhide 0.55 Link
Reboot into system
Install Magisk Manger 2.1 (apk) Link
Open up Magisk Manager app and go to modules. Click on the + button. Add the following zip for xsetprop Link
Install RootSwitch 1.3.1.2 Link
Reboot system
Using Root Explorer (or some other file manager capable of root access), browse to /magisk/xsetprop and modify post-fs-data.sh . Add the following line to the end of the file, save and exit
Code:
xsetprop ro.boot.flash.locked 1
Reboot system
Open up RootSwitch, uncheck disable all SU daemons. Disable Root
Pass SafetyNet
Click to expand...
Click to collapse
FYI - The latest version of the xSetProp zip (0.2.1 as of this post) handles setting that prop automatically, and has additional logging. I'd recommend using that and you can remove that portion of your guide.

Captain_Throwback said:
FYI - The latest version of the xSetProp zip (0.2.1 as of this post) handles setting that prop automatically, and has additional logging. I'd recommend using that and you can remove that portion of your guide.
Click to expand...
Click to collapse
Thank you! Instructions updated (also tried to give proper credit all around).
I think Chainfire might be in the process of doing something similar without the need for Magisk.
I suppose we could also probably use the xsetprop binary along with a su.d script to run the necessary commands on startup? This would avoid having to use Magisk all together.
If I get some time I might try that out.

No longer works after I reboot the device. It's almost like it knows about my hack. It passes the safety net thing with green screen yet I get message saying that can't verify blah blah...your phone might be rooted! I've updated to 0.2.1 of the xprop and double checked the other things like suhide and magisk and so on. Wth ... Less than a day and Google changed something? I'm baffled. Help!

Pkt_Lnt said:
http://www.xda-developers.com/android-safetynet-now-reportedly-tripped-by-unlocked-bootloaders/
Click to expand...
Click to collapse
Thanks so much for taking the time to write this out.
I am 100% successful with M ROMs like ResRemix
However on my Nexus 6 with N ROMs (like Nitrogen or cDroid) I can't get SafetyNet to pass this way. With Root Switch I can get PoGo to work but following these instructions to a T I still don't have green SN
I wonder if it is the kernel ? What kernel have you been successful with?
Lastly are you aware of any way to find success with 7.1 ROMs?
---------- Post added at 12:31 AM ---------- Previous post was at 12:27 AM ----------
photolarry said:
No longer works after I reboot the device. It's almost like it knows about my hack. It passes the safety net thing with green screen yet I get message saying that can't verify blah blah...your phone might be rooted! I've updated to 0.2.1 of the xprop and double checked the other things like suhide and magisk and so on. Wth ... Less than a day and Google changed something? I'm baffled. Help!
Click to expand...
Click to collapse
Is the message you are getting coming up with SafetyNet or with PoGo ... or when ??

jcrompton said:
Thanks so much for taking the time to write this out.
I am 100% successful with M ROMs like ResRemix
However on my Nexus 6 with N ROMs (like Nitrogen or cDroid) I can get SafetyNet to pass this way. With Root Switch I can get PoGo to work but following these instructions to a T I still don't have green SN
I wonder if it is the kernel ? What kernel have you been successful with?
Lastly are you aware of any way to find success with 7.1 ROMs?
---------- Post added at 12:31 AM ---------- Previous post was at 12:27 AM ----------
Is the message you are getting coming up with SafetyNet or with PoGo ... or when ??
Click to expand...
Click to collapse
Yea I know I think it's something to do with either the kernel I've selected or perhaps suhide no longer works...I'm not sure what the deal is. I'm running Franco #55 and even without root, I get failure but inside the testing app ...see attached

Thanks for this write-up! I was able to pass SafetyNet in both apps while running Pure Nexus 7 w/ Stock OpenGapps.
I think one key thing that was skipped in the OP - be sure your ROM is SafetyNet compatible to begin with. I've run numerous ROMs that even before Google started checking bootloaders, wouldn't pass SafetyNet even if unrooted. For example, I just tried the OP method with Despair's new 7.1 ROM and it failed (probably won't work on 7.0 either). But with Pure Nexus 7.0 it works great.

MrBrady said:
Thanks for this write-up! I was able to pass SafetyNet in both apps while running Pure Nexus 7 w/ Stock OpenGapps.
I think one key thing that was skipped in the OP - be sure your ROM is SafetyNet compatible to begin with. I've run numerous ROMs that even before Google started checking bootloaders, wouldn't pass SafetyNet even if unrooted. For example, I just tried the OP method with Despair's new 7.1 ROM and it failed (probably won't work on 7.0 either). But with Pure Nexus 7.0 it works great.
Click to expand...
Click to collapse
I'm using stock Rom and only custom kernel so this should work on Nbd90z....I'd think. Last test was dreaded message but I'm trying to add few things to suhide blacklist. We shall see

I get the green screen. But then when I tap at store nfc terminal...it claims error....I'm going to try hiding nfc service, and what I think is play services based on uid chainfire explained. I'll try a small purchase and remember to screen capture the error if occurs

skaforey said:
Thank you! Instructions updated (also tried to give proper credit all around).
I think Chainfire might be in the process of doing something similar without the need for Magisk.
I suppose we could also probably use the xsetprop binary along with a su.d script to run the necessary commands on startup? This would avoid having to use Magisk all together.
If I get some time I might try that out.
Click to expand...
Click to collapse
I built the mod for people that were already using Magisk. If you're not using Magisk, then of course you can try just putting the binary in /su/xbin and put the post-fs-data.sh in /su/su.d and see if that works for setting the props at boot time.
I don't use Xposed, so using Magisk + phh's Superuser was my target for the module. I also did try the su.d method with SuperSU, but it wasn't working on my device. I also didn't want to have to use RootSwitch. But feel free to unpack the zip and try whatever combinations you want.

photolarry said:
No longer works after I reboot the device. It's almost like it knows about my hack. It passes the safety net thing with green screen yet I get message saying that can't verify blah blah...your phone might be rooted! I've updated to 0.2.1 of the xprop and double checked the other things like suhide and magisk and so on. Wth ... Less than a day and Google changed something? I'm baffled. Help!
Click to expand...
Click to collapse
Still working for me. Are you sure you disabled root in Root Switch? It automatically re-enables upon logon. Also be sure your xsetprop file is correct.
You can check by using the getprop command

skaforey said:
Still working for me. Are you sure you disabled root in Root Switch? It automatically re-enables upon logon. Also be sure your xsetprop file is correct.
You can check by using the getprop command
Click to expand...
Click to collapse
I'm using it for android pay not pogo. And I did. I'm sure the prop is right or wouldn't get green go. It's an error from AP saying something about unable to verify and might be rooted....or words to that effect

I know this is early, but OP3 users--systemless root...

I plan on rooting pretty much immediately, and was hoping to use FreedomOS (not sure it will be supported early, but I'll switch when it is). Either way, how difficult is it to set up systemless root and Xposed? I used to play PokemonGO on my LG V10, but I won't sacrifice root for one game that I use for walks/fun. Same applies here, but I heard systemless solves this issue. Any insight if this will be supported?

It's fairly easy. Unlock your bootloader as soon as you get your phone so you don't need to wipe, and setup your pc with fastboot/adb. Then once twrp is released it's just a matter of flashing that and using it to flash the zip files you need. You can find a lot of guides around XDA for how to setup ADB/fastboot and bypass root checks with xposed.

namanjr said:
It's fairly easy. Unlock your bootloader as soon as you get your phone so you don't need to wipe, and setup your pc with fastboot/adb. Then once twrp is released it's just a matter of flashing that and using it to flash the zip files you need. You can find a lot of guides around XDA for how to setup ADB/fastboot and bypass root checks with xposed.
Click to expand...
Click to collapse
I assume it's a per app basis on going systemless/bypassing root checks, or is it all handled in Xposed now? Just curious, and thanks for the answer!

You have to hide su per app with suhide for pokemon go. For safetynet apps you need a custom kernel and rootswitch to pass.

namanjr said:
You have to hide su per app with suhide for pokemon go. For safetynet apps you need a custom kernel and rootswitch to pass.
Click to expand...
Click to collapse
suhide not working with november update....

oTeMpLo said:
suhide not working with november update....
Click to expand...
Click to collapse
Systemless still work? Different install IIRC.

oTeMpLo said:
suhide not working with november update....
Click to expand...
Click to collapse
you can use suhide with a open source rom by removing this https://android.googlesource.com/platform/frameworks/base/+/b8be33b0bedec211708c4525b9d3f3b4effb385c

Anyone do any tests to get PGo working with root? I have SuperSU installed systemless, but when I tried to install SUhide or whatever it's called, my phone wouldn't get past the boot logo so I had to uninstall it.

Cannot install any apps after installing Xposed framework (-504 error in Google Play)

A few days ago I posted a question about not being able to install any Xposed modules here, so far no one answered: https://forum.xda-developers.com/xposed/xposed-framework-installed-running-t3567230
I thought this problem had something to do with the modules specifically, but it turns out that on my phone, for whatever reason, installing the framework subsequently prevents ALL apps from installing, even those from Google Play itself, displaying a "-504" error.
I see people have asked this question before, but are also not getting answers: https://forum.xda-developers.com/xposed/install-apps-installing-framework-t3430922
Please, if anyone has any idea of why this can be and how to fix it, let me know. Any help will be infinitely appreciated!

What phone and ROM are you using?
One thing you could try is to install systemless Xposed through Magisk. Then use MagiskHide to hide both root and Xposed from all Google apps and potential sources of conflict. If it's a software limitation/conflict, this may be a workaround.
Keep in mind that you will have to root your phone with Magisk rather than SuperSU or any other form of root.

Anova's Origin said:
What phone and ROM are you using?
One thing you could try is to install systemless Xposed through Magisk. Then use MagiskHide to hide both root and Xposed from all Google apps and potential sources of conflict. If it's a software limitation/conflict, this may be a workaround.
Keep in mind that you will have to root your phone with Magisk rather than SuperSU or any other form of root.
Click to expand...
Click to collapse
Hey, thank you for your answer!
I am using a Sony Xperia M4 Aqua E2306, rom is 26.1.A.1.112 Latin America Generic. It is rooted and with TWRP installed accroding to this thread: https://forum.xda-developers.com/m4-aqua/general/root-e2306-m4-aqua-guide-t3270521
I also have a locked bootloader, and it cannot be unlocked, so unfortunately that shuts the door on most rooting options.
I never heard of Magisk before, but from what I'm seeing, it looks it TWRP is required to get root with Magisk, but some kind of root is already required on my phone in order to get TWRP. So I'm not sure how to go about this.

If your phone is already rooted, then you can download Magisk Manager application and have it installed it's necessary frameworks through the app itself. You won't be able to use Magisk's root, but you'll still be able to install systemless Xposed and hide it from other apps.
Edit: Ignore all of that actually, I just realized that magisk requires boot image modifications so you have to have an unlocked bootloader to use it.

Anova's Origin said:
If your phone is already rooted, then you can download Magisk Manager application and have it installed it's necessary frameworks through the app itself. You won't be able to use Magisk's root, but you'll still be able to install systemless Xposed and hide it from other apps.
Edit: Ignore all of that actually, I just realized that magisk requires boot image modifications so you have to have an unlocked bootloader to use it.
Click to expand...
Click to collapse
Oh well, thanks anyway. I might try it anyways, maybe it will work, you never know. Don't have much to lose at this point

Anova's Origin said:
What phone and ROM are you using?
One thing you could try is to install systemless Xposed through Magisk. Then use MagiskHide to hide both root and Xposed from all Google apps and potential sources of conflict. If it's a software limitation/conflict, this may be a workaround.
Keep in mind that you will have to root your phone with Magisk rather than SuperSU or any other form of root.
Click to expand...
Click to collapse
FIY Magisk cannot hide Xposed...

I also facing these problem on my rooted Asus zenfone 2 (ze550ml 2gb ram version, Stock ROM, bootloader unlocked) and Asus Zenpad C 7 (p01y, stock rom, bootloader unlocked). The xposed firmware (version 86) is successfully install but can't install any apps from play store and using apk...
I really hope that dev team can solve it.....
Sorry for any grammatical mistakes....

The only way is to flash the firmware

I'm getting the same problem on my LG G4 with v88.2 of Xposed :/

I don't Know if this is too late,but I also have this problem. But there is a work around, go into the xposed installer and turn the switch off so its disabled on the next boot. rebot the device and exposed and its modules are disabled, allowing you to install apps from play store and downloaded .apk files... it would still be nice to install applications while its still on.
Sent from my LG-K550 using XDA Labs

I had this issue on my LGG3. This happens when you have Lucky Patcher enabled in your xposed modules. Disabling it (Lucky Patcher) should solve the problem.

Root + Franco Kernel = Paytm Not Working

So My Problem is a little weird... First of all let me tell you , I will be mentioning here an app called Paytm ( Indian Version of PayPal)
What did I encounter?
Paytm used to work on any custom ROM (or I say rooted ROM) earlier. But now I see that it is not working with :-
1.Any Custom Rom (Rooted) (tried on havoc, lineage and skydragon)
2.Oxygen OS with Franco Kernel (Rooted)
Now Weird Observations
1. It somehow manages to work on every Custom Rom if it is not Rooted
2. It even Works on ROOTed Oxygen OS but only with stock kernel, the moment I change the kernel it crashes
PS - only tried with Franco Kernel
3. Also For Any custom Rooted ROM with any kernel, it magically starts working after 5-6 crashes (everytime the app is opened) that too very sluggish
My attempts :-
1. I tried to hide root from the app because originally it showed a message that root detected but now the message doesn't show up but it still doesn't work
2. Cleaning all cache and data
3. Clean flashing different roms for a number of times
Can someone please help me with the issue cause this app is my daily driver.
I read alot and surf on XDA , so in my head this issue resembles with I think something called safety net ( idk what i am saying just guessing)

Which root solution did you use, Magisk or SuperSU?
Magisk Hide works pretty well for a lot of apps. But of course, it depends on how the app is looking for root.
And obviously, if you used Magisk, and tried Magisk Hide, than this point is moot.

redpoint73 said:
Which root solution did you use, Magisk or SuperSU?
Magisk Hide works pretty well for a lot of apps. But of course, it depends on how the app is looking for root.
And obviously, if you used Magisk, and tried Magisk Hide, than this point is moot.
Click to expand...
Click to collapse
Yes I used Magisk and I did used Magisk Hide, but there was no success

PreciousPulkit said:
Yes I used Magisk and I did used Magisk Hide, but there was no success
Click to expand...
Click to collapse
You can also hide Magisk Manager.
If you have selected your app in Magisk Hide and hidden the Manger, then wipe the storage of you app and reboot. That may fix the problem.
Sent from my OnePlus3T using XDA Labs

Sky go help needed to hide root with magisk

On my phone xiaomi A1 rooted it works on the wife's phone xiaomi note 5 pro rooted it used to work fine but for some reason it has suddenly detected root and won't work now. I have checked all the settings to do with hiding are still selected as before, strange thing is it has worked briefly for a few seconds but then stopped again.
Please can people tell me if they have had this happen and how they fixed it please.
What checks is it doing to detect root does anyone know?
Thanks

hycraig said:
On my phone xiaomi A1 rooted it works on the wife's phone xiaomi note 5 pro rooted it used to work fine but for some reason it has suddenly detected root and won't work now. I have checked all the settings to do with hiding are still selected as before, strange thing is it has worked briefly for a few seconds but then stopped again.
Please can people tell me if they have had this happen and how they fixed it please.
What checks is it doing to detect root does anyone know?
Thanks
Click to expand...
Click to collapse
Try updating magisk.
Try to disable xposed modules.
Try to disable all modules.
See if it works now.
Then one by one reenable them.
Sent from my SM-G985F using Tapatalk

vash_h said:
Try updating magisk.
Try to disable xposed modules.
Try to disable all modules.
See if it works now.
Then one by one reenable them.
Sent from my SM-G985F using Tapatalk
Click to expand...
Click to collapse
Thanks for your reply magisk is up to date and I don't have any modules just magisk on its own. I do find it strange how it just stopped working after many months of being used regularly.

hycraig said:
Thanks for your reply magisk is up to date and I don't have any modules just magisk on its own. I do find it strange how it just stopped working after many months of being used regularly.
Click to expand...
Click to collapse
Credits Google
Now safetynet fails after March update
You need to change device props to pixel or lock bootloader

hycraig said:
Thanks for your reply magisk is up to date and I don't have any modules just magisk on its own. I do find it strange how it just stopped working after many months of being used regularly.
Click to expand...
Click to collapse
Biggest_Noob said:
Credits Google
Now safetynet fails after March update
You need to change device props to pixel or lock bootloader
Click to expand...
Click to collapse
My safteynet passes fine on both my devices
Thanks

somehow they manage to detect root even if magisk manager is running under custom package name and magisk hide is enabled.
Last version that is still running is 13.1.1 (apk available on apkmirror).

h4lli said:
somehow they manage to detect root even if magisk manager is running under custom package name and magisk hide is enabled.
Last version that is still running is 13.1.1 (apk available on apkmirror).
Click to expand...
Click to collapse
thanks @h4lli i couldn't see sky go version 13.1.1 for uk
so i got Sky Go UK 12.4.14 from apkmirror and can confirm is working fine

yeah still doesnt work, latest sky go app 20, latest magisk, still detects, anyone able to reverse the sky app to see what methods its using?

Fyi - any version other than the latest (20.6.1) at the moment forces an upgrade to 20.6.1, which then detects root.
Safety net is passing both basic and cts with Eval type basic. I'm on latest canary (20425).
I've tried :-
Uninstalling all apps that skygo could look for (titanium, openvpn etc.)
Using a work profile (shelter and island)
Disabling oem unlocking
Disabling usb/adb debugging
Disabling developer options
Deleting all files and folders that have magisk, twrp or titanium in them.
Basically everything here https://www.didgeridoohan.com/magisk/MagiskHide#hn_Hiding_root_from_apps
So, I think it's basically no go for sky go at the moment. Happy to be corrected if someone has it working.
Beardy

beardymarrow said:
Fyi - any version other than the latest (20.6.1) at the moment forces an upgrade to 20.6.1, which then detects root.
Safety net is passing both basic and cts with Eval type basic. I'm on latest canary (20425).
I've tried :-
Uninstalling all apps that skygo could look for (titanium, openvpn etc.)
Using a work profile (shelter and island)
Disabling oem unlocking
Disabling usb/adb debugging
Disabling developer options
Deleting all files and folders that have magisk, twrp or titanium in them.
Basically everything here https://www.didgeridoohan.com/magisk/MagiskHide#hn_Hiding_root_from_apps
So, I think it's basically no go for sky go at the moment. Happy to be corrected if someone has it working.
Beardy
Click to expand...
Click to collapse
Yeah still can't get it working. Damn it.

Hast everyone a sollution for running the sky Go App on rooted phones?

Skygo doesnt Work... hast anyone a sollution?

eula1977 said:
Skygo doesnt Work... hast anyone a sollution?
Click to expand...
Click to collapse
Have you tried this? It worked for me
SkyGo app detected root!
Hi everyone i have a problema using SkyGo app on my device because It detects the root. I renamed magisk , used magisk Hide , tried magiskhide props config , tried to delete cache and re-install SkyGo app but nothing worked...any solution...
forum.xda-developers.com