SafetyNet issues - Xiaomi Mi A2 / 6X Questions & Answers

Hi, so recently I bought my Mi A2 and then decided to unlock it. All seems well, installing custom rom wasn't a problem at all.
However I find something rather annoying, so here's the thing. After unlocking the bootloader, the device build fingerprint was changed, from Jasmine_sprout into taimen, then Play Protect said my device wasn't certified. Installed Magisk, SafetyNet pass both cts and basic integrity but then nothing.
Play Protect now said my device is certified but I can't find some apps that I want to install, which on stock locked bootloader these apps appear on Play Store *such as Lens Distortions, Netflix, Torque Drift*. Then I figured out maybe the device fingerprint was the culprit, but no.
MagiskHide Props Config used, changed the fingerprint into legit Mi A2, still won't work. Trying another SafetyNet module, still won't work. It makes me wonder, why is this happening?
Previously was using Nokia 8 and it didn't have this kind of problem on the same condition e.g. unlocked and systemless root with Magisk, play protect said the device is certified yet these apps that I mentioned before still appear on Play Store.
But on Mi A2? No luck. SafetyNet does work but in the same time it doesn't. Does anyone here understand what might be the culprit of this annoying problem that I have? Tbh I'm really curious about it right now.

Related

saftey net question?

So on my Google pixel when I had it rooted and unlocked with Xposed installed it wouldn't allow me to log in due to safetynet not passing but on my note8 I can sign in when rooted even though safety net doesn't pass and Pokemon go let me sign in for a few days even though safety net failed although Pokemon go doesn't anymore but Snapchat still does, is there a reason for this?

Google Pay NFC & Magisk issues on otherwise-stock

So here's the predictable thread; I haven't seen it elsewhere here.
Have a RETLA beckham, dual-SIM... finally upgraded from my dual-SIM Z2 Play... ugh wish I'd known that I get to choose two SIM or SD card but not both; the Z2 Play accepted all three cards at once
OTA'd to PPWS29.131-27-1-15 (just today, though -11 also failed), Magisk 20.1, tested with no other modules installed... and GPay is rejecting the device for NFC. The Z2 Play has been working great with GPay for some time, but I knew this was a risk with going to a newer device.
Any MagiskHide or one-off module patches out there to make GPay happy on this device? (If you have it *working* in a config like this, I'd love to hear about it too.)
Oddly, after a factory reset, it's now working. However, one thing I don't remember whether I set properly the last time: Once Magisk is installed, it's necessary to turn *off* "OEM Unlocking" in the developer options menu (this doesn't actually lock the bootloader, of course, it's faked by Magisk)... and this time around it activated NFC payments successfully.
Sorry for the noise, though hopefully this can help someone else's search in the future.

[n9600] SafetyNet failing CTSProfile

With latest Safetynet upgrades safety net will not pass on Android Q suddenly stopped working for me while using magisk.
If anyone is still passing it on the N9600 on OneUI 2 let me know if you have a way to fix it but most methods are not working so i will have to live without my Mcdonalds Coupons Google Pay still works though
This was a security change that'd Google made on their end thus the majority of magisk users had cts profile failing as I'm typing this seems like Google has reverted this change maybe temporarily.
I also want to know
Hy sir if you solve that problem tell me also

Possible SafetyNet bypass (theoretically, devs welcome)

Wouldn't it be possible to intercept the SafetyNet check and then actually run the check on a device that still passes SN and send back the result? Since Samsung, OnePlus and Google devices are still able to pass SN with custom Software this should be possible.
I think it needs to be rerouted. Spoofed in a way that it doesn't get detected the same weight methods used in the hacking tool called Lucky patcher. And no I'm not endorsing the app. there's probably a topic about it on the actual Lucky patcher site but since we're not supposed to do really mention that type of tool even though can be used in the genuine way...
There was talk about it on Twitter about suggesting the exact same thing you're implying.
https://twitter.com/topjohnwu/status/1238514375150850048?s=09
I'm pretty sure the SafetyNet Deamon on your phone generates some sort of result that's based on your phone's fingerprint. This would mean if you'd want to pass SafetyNet on let's say a google pixel, you'd need another google pixel that generates the 'passing SN result' and then pass it to your unlocked google pixel. This may be possible but I don't have 2 identical phones for programming.
Also, the google framework is closed source and very obfuscated making it very difficult to figure out how SafetyNet actually works. SafetyNet itself checks the Zygote proccess for changes, so hooking in to your android phone to analyze a true SN pass would theoretically be impossible already. It'd be very hard to route a true safetynet result with a locked phone. But, if I can help in any way, I'll be glad to do so. Not experienced enough with how android 8 and up work to tweak them though.
bomboem said:
I'm pretty sure the SafetyNet Deamon on your phone generates some sort of result that's based on your phone's fingerprint. This would mean if you'd want to pass SafetyNet on let's say a google pixel, you'd need another google pixel that generates the 'passing SN result' and then pass it to your unlocked google pixel. This may be possible but I don't have 2 identical phones for programming.
Also, the google framework is closed source and very obfuscated making it very difficult to figure out how SafetyNet actually works. SafetyNet itself checks the Zygote proccess for changes, so hooking in to your android phone to analyze a true SN pass would theoretically be impossible already. It'd be very hard to route a true safetynet result with a locked phone. But, if I can help in any way, I'll be glad to do so. Not experienced enough with how android 8 and up work to tweak them though.
Click to expand...
Click to collapse
Here are my thoughts about this:
I'm not sure if the SN result is only valid for one device and or for one app.
Afaik the EdXposed magisk module is able to bypass SafetyNet. I tested it before this and it worked fine. Now the only thing that has been changed is that it also checks if the bootloader is unlocked in a cryptographically safe way. Afaik Samsung, OnePlus and Google devices should be able to pass that check. OnePlus and Google devices are able to relock the bootloader using a custom key of the rooted phone / custom rom. Samsung devices don't need to have to bootloader unlocked because of the Download (odin) mode. Those devices could then be used to spoof anything they want including the calling app and maybe the fingerprint of the phone.

Question Can the OnePlus 10 Pro 2213 be rooted while still allow streaming apps to be installed or function (latest NE2213_11_A.15)?

Seems like a stupid question, but yes I bought a 2213 EU version, unlocked the bootloader, rooted it the right way, did everything to pass safety net, device is play protect registered, getprop ro.boot.verifiedbootstate returns green, Google Pay works fine after root, DRM Info shows Widevine L1
Netflix won't install (not compatible with device)
HBOMax won't play
Peacock won't install
Hulu won't install
Is this possibly a OnePLus bug on the new NE2213_11_A.15 build, some new rooting thing with Android 12, bad luck, or is there some solution that I need to install?
I may be haded right back to the trusty OnePlus 8 Pro....which has none of these issues and has the Macro Camera which I actually miss....
Thanks in advance for any suggestions....
Also, if anyone in the US needs dual SIM, the EU versions supports all the US bands (and more), is dual SIM, and works flawlessly with T-Mobile...5G, VoWiFi, everything.
Same thing for me, i live in Sweden and we have Cmore & Discovery here that refuse to play after bootloader unlock and root, no magisk hide solution have worked for me. Maybe bootloader unlock with no root works, but cant try because my OP10 is bricked. My old OP9 was working perfect with all the streaming, i now have Xiaomi 12 Pro and was afraid the same thing would happend with this phone, only unlocked bootloader on this phone but no root and everything works 100%, streaming apps, gpay.
It just seems there is something wrong here in the way that OnePlus certified this device. Other Android 12 devices can be rooted without all these issue, right?
Can people US or Chinese / Indian versions get rooted and have access to the Streaming services?
MetroWestMA said:
It just seems there is something wrong here in the way that OnePlus certified this device. Other Android 12 devices can be rooted without all these issue, right?
Can people US or Chinese / Indian versions get rooted and have access to the Streaming services?
Click to expand...
Click to collapse
I have Hulu Disney plus and Netflix working but only play when streamed to my Chromecast. On device play doesn't work and only plays L3 even though device reads L1. Believe it's to deal with bootloader unlock and not root. But others posted that it was a OnePlus issue and was supposed to be resolved but hasn't been.
toolhas4degrees said:
I have Hulu Disney plus and Netflix working but only play when streamed to my Chromecast. On device play doesn't work and only plays L3 even though device reads L1. Believe it's to deal with bootloader unlock and not root. But others posted that it was a OnePlus issue and was supposed to be resolved but hasn't been.
Click to expand...
Click to collapse
It's a issue with this particular Snapdragon chip. The Samsung Galaxy Tab S8 uses the same processor and has the exact same problem.
g96818 said:
It's a issue with this particular Snapdragon chip. The Samsung Galaxy Tab S8 uses the same processor and has the exact same problem.
Click to expand...
Click to collapse
How can it be the chip. It could be the kernel associated didn't have correct commits from snapdragon. But still the drm is in the secure partition on our device that can't be altered also.
toolhas4degrees said:
How can it be the chip. It could be the kernel associated didn't have correct commits from snapdragon. But still the drm is in the secure partition on our device that can't be altered also.
Click to expand...
Click to collapse
Not sure, but that's the only common link between both devices from different manufacturers. They're basically using the same work around we are. I'll be testing it out shortly also since my S8 was just delivered.
It is just fundamentally blocking anything having to do with DRM. You can't even spoof the user agent and watch any streaming service through a browser -- it ask if the browser can play secure content (you say yes) and then gives an error. I am not even that much of a TV / Movie guy, but to be 100% blocked from any streaming just for rooting a device you own????
Pretty F&*^in extreme if you asked me....
The only question is do I wait for someone to hack it (if that's even possible), or do I just go back to my trusty OP 8 Pro and sell this...?
Are there any Android 12 rootable phones that don't have this issue...or is it all Android 12 phones?
MetroWestMA said:
It is just fundamentally blocking anything having to do with DRM. You can't even spoof the user agent and watch any streaming service through a browser -- it ask if the browser can play secure content (you say yes) and then gives an error. I am not even that much of a TV / Movie guy, but to be 100% blocked from any streaming just for rooting a device you own????
Pretty F&*^in extreme if you asked me....
The only question is do I wait for someone to hack it (if that's even possible), or do I just go back to my trusty OP 8 Pro and sell this...?
Are there any Android 12 rootable phones that don't have this issue...or is it all Android 12 phones?
Click to expand...
Click to collapse
i think it's a snapdragon issue rather than software issue.
MetroWestMA said:
Seems like a stupid question, but yes I bought a 2213 EU version, unlocked the bootloader, rooted it the right way, did everything to pass safety net, device is play protect registered, getprop ro.boot.verifiedbootstate returns green, Google Pay works fine after root, DRM Info shows Widevine L1
Netflix won't install (not compatible with device)
HBOMax won't play
Peacock won't install
Hulu won't install
Is this possibly a OnePLus bug on the new NE2213_11_A.15 build, some new rooting thing with Android 12, bad luck, or is there some solution that I need to install?
I may be haded right back to the trusty OnePlus 8 Pro....which has none of these issues and has the Macro Camera which I actually miss....
Thanks in advance for any suggestions....
Also, if anyone in the US needs dual SIM, the EU versions supports all the US bands (and more), is dual SIM, and works flawlessly with T-Mobile...5G, VoWiFi, everything.
Click to expand...
Click to collapse
How did you get widevine L1 after bootloader unlock?
devtherockstar said:
How did you get widevine L1 after bootloader unlock?
Click to expand...
Click to collapse
That's what DRM Info showed.
But for me it's all moot at this point. Yesterday, Google Pay stopped working (some new detection thing I presume), so I attempted to relock the bootloader with
./fastboot flashing lock
at which point the device started going into an infinite power cycle instant reboot no way to get into FASTBOOT, or Recovery or turn off the phone. So I just returning the phone and going back to OnePLus 8 / Android 11 where you can be fully rooted and everything just works.
What a disappointment and waste of time.
Thanks for everyone who offerred suggestions...I'll try back in 6 months or so and see if any of this gets sorted out.
It's not "issues with the chip". Google upped their ante with root detection, which breaks everything from netflix to google pay. See this thread.
I was the OP and had to return my bricked OP10Pro under the 30 day return period.
Anyway, I bought a Google 512GB Pixel 6 Pro used, rooted it, and did the basic stuff I have done since the OP8Pro -- and everything works -- GPay, Netflix, no DRM issues and no hassles.
So maybe it is the chip, but if google had "upped their game" I would think it would be with their own phones especially since the Tensor SOC (co developed with Samsung) has a trusted security module.
As far as the phones go, the Pixel Pro is heavier and the battery charges slower, but you get dual SIM and it works on all USA/Worldside 5G networks and bands. And the cameras are top notch. So kind of a tossup I guess.

Categories

Resources