Related
So I think most of you already know about Google's strict update to their SafetyNet API, which is used by Android Pay, and Pokemon Go among other apps.
If you don't, SafetyNet is a protocol used by Google Play Services that returns whether your device has been "tampered with". Having Root Access, Xposed installed, or a custom ROM or Kernel, have been known to trip this check, which will prevent the apps that utilize SafetyNet's functionality from running on the device.
Several developers on XDA and in the rooting community have been working overtime in an attempt to find a loophole in SafetyNet's code - enter the likes of Magisk and SuHide, each of which no longer work to hide root from SafetyNet as of the date of this writing.
Now, my personal belief is that after a person has purchased an Android device (and in effect that copy of the device's software) they should be free to make any and all modifications they choose to it - at the risk of their own security of course. Additionally, with apps like Pokemon Go, which offer in-game purchases and then change user agreements through app updates which block potential users after they may have made these same in-game purchases, the argument could be made that the SafetyNet API is even promoting fraud.
It isn't my intention to convince anyone of my position, only understand it. At this time, I am trying to gain a better understanding of exactly what elements found on a device prompt SafetyNet to return that a device has been tampered with. I was once rooted, with Xposed installed, but have since uninstalled both, and even re-flashed stock firmware. Even still, the SafetyNet Helper App I have been using for research always returns a failure. For posterity, I am also unable to log into Pokemon Go on stock firmware with no root or Xposed.
If root access is enabled, I have found that the SafetyNet check itself (step 1) will fail and the app will present a red screen, whereas if root access is not installed, the SafetyNet check will pass, but the Device Signature Verification with Google (step 2) will fail, which results in an overall failure where apps like Android Pay and Pokemon Go are concerned. The most modern counter I have found to hide root from SafetyNet is found here but even it states that the device must be able to pass the SafetyNet check on its own before this modifies SuperUser can be installed, so I feel a bit stuck.
I haven't seen anyone address SafetyNet and the Xperia Z5 Compact in the same sentence, and so my question is, can the Z5C pass SafetyNet at all since its most recent update? Please, download the SafetyNet Helper App from the Play Store and run it on your Z5C. Let me know if you get a red screen (failure at first step) a blue screen (failure at second step) or a green screen (passing). Also tell me about your device, and any modifications you have made to it. Seeing as how I can no longer pass the SafetyNet check at all on newly flashed stock firmware, I worry that the Xperia Z5C may not have been given Google's "Device Signiture Verification" - like many other international Android devices.
And if anyone else can shed some light on this situation, I would be most grateful.
Blue screen error.
Krypton custom rom based on .253 with zach's kernel. xposed installed
Sent from my iPad using Tapatalk
What about downgrading Google Play Services? as far as i remember the Safetynet APi is included in this package. Don't know if it is server based or written inside the package, though.
Has anyone found a way to bypass SafetyNet for Nougat?
grayleshy said:
Has anyone found a way to bypass SafetyNet for Nougat?
Click to expand...
Click to collapse
I also want to know this, when running safetynet test it shows me a red screen, even though I already removed root and flashed stock firmware.
rolo143 said:
I also want to know this, when running safetynet test it shows me a red screen, even though I already removed root and flashed stock firmware.
Click to expand...
Click to collapse
because of unlocked bootloader
im using magisksu + magiskhide and its bypassing the safetynet
meistr91 said:
because of unlocked bootloader
Click to expand...
Click to collapse
There is a workaround?
meistr91 said:
because of unlocked bootloader
Click to expand...
Click to collapse
Can I relock it again?
https://forum.xda-developers.com/z5-compact/general/recovery-nougat-7-0-android-bootable-t3609358
rolo143 said:
Can I relock it again?
Click to expand...
Click to collapse
Magisk changes the properties and "relocks" it for you during the start up procedures.
--- previous post
NeoBeum said:
https://forum.xda-developers.com/z5-compact/general/recovery-nougat-7-0-android-bootable-t3609358
Magisk changes the properties and "relocks" it for you during the start up procedures.
Click to expand...
Click to collapse
But magisk requires root. I remove root because there are some games and apps that detect it. So I wanted to pass SafetyNet but still can't.
I have Magisk working, I'm just rebuilding the recovery project and fixing some stuff
Has one been able to patch libandroid to make suhide work on Nougat with security patches after October 2016?
I have CarbonROM 5.1 Moo installed on my Zperia Z5 compact. This along with Magisk 14.3. (And... yeah... As it seems, the Magisk module "Universal SafetyNet Fix" is also required in my case. )
With this, it all works fine. SafetyNet checks out as valid/okay. No problems.
Netflix is not working since I have android 10, I installed from 0 and Netflix doesn't appear in Google play, and official apk doesn't work for me.
Recently CTS won't pass with Magisk installed (even with Magisk hide). Google must have changed SafetyNet rules, Magisk did not catch up yet. It's not clear if this issue is impacting all Magisk users or only some. I can't pass CTS anymore, Android 9.
_mysiak_ said:
Recently CTS won't pass with Magisk installed (even with Magisk hide). Google must have changed SafetyNet rules, Magisk did not catch up yet. It's not clear if this issue is impacting all Magisk users or only some. I can't pass CTS anymore, Android 9.
Click to expand...
Click to collapse
Likewise on stock android 10 for the past 2 or 3 days. No mods installed as such and failing CTS.
Play store is still showing verified device but I hear some users are getting non verified message which will not allow them install certain apps
How about those who become L3 in the attempt to fix sensors of downgraded to Android 9 and flashed persist partition ?
amnher said:
How about those who become L3 in the attempt to fix sensors of downgraded to Android 9 and flashed persist partition ?
Click to expand...
Click to collapse
Probably out of luck, DRM certificates are gone forever. At least that was the case for Mi A1 phone, but seems to be the same for A3.
_mysiak_ said:
Probably out of luck, DRM certificates are gone forever. At least that was the case for Mi A1 phone, but seems to be the same for A3.
Click to expand...
Click to collapse
Will warranty be a solution? Phone is less than two weeks old
amnher said:
Will warranty be a solution? Phone is less than two weeks old
Click to expand...
Click to collapse
No, you screwed it up. As far as I know, service center can't restore DRM keys even if they wanted to, they are flashed in factory and unique to each phone. The only solution is probably to replace whole motherboard. This was the case with Mi A1 and all Sony phones where unlocking of bootloader removed DRM keys as well. Nevertheless, you can try your luck and contact your service center..
_mysiak_ said:
No, you screwed it up. As far as I know, service center can't restore DRM keys even if they wanted to, they are flashed in factory and unique to each phone. The only solution is probably to replace whole motherboard. This was the case with Mi A1 and all Sony phones where unlocking of bootloader removed DRM keys as well. Nevertheless, you can try your luck and contact your service center..
Click to expand...
Click to collapse
This is worst I really did not expect that in messing with persist image really permanently destroys it and I will not be able to enjoy HD videos of Netflix on my a3. Other than that, what are the disadvantages of loosing L1 (messed up DRM) ?
they pulled back the update maybe that's the reason.
and if your device is bootloader unlocked it's also a reason...
i installed Netflix from apkpure.
amnher said:
This is worst I really did not expect that in messing with persist image really permanently destroys it and I will not be able to enjoy HD videos of Netflix on my a3. Other than that, what are the disadvantages of loosing L1 (messed up DRM) ?
Click to expand...
Click to collapse
Yeah, it's unfortunate, many people are advising to "just flash persist.img and it will solve your issues", but it doesn't seem to help in first place and additionally damages the phone beyond repair. Lesson learned for you I guess, don't trust some random folks on the Internet..
Btw. as far as I know, 720p videos should be still playable on Netflix, it affects only full HD and 4K content (which need L1), which you wouldn't enjoy on 720p screen anyway. On Mi A1 I had only L3 (that was the default DRM level) and I did not notice any usability issues, Netflix, Google play music etc. were working nicely. On the small screen I did not notice that Netflix was playing at lower resolution.
_mysiak_ said:
Yeah, it's unfortunate, many people are advising to "just flash persist.img and it will solve your issues", but it doesn't seem to help in first place and additionally damages the phone beyond repair. Lesson learned for you I guess, don't trust some random folks on the Internet..
Btw. as far as I know, 720p videos should be still playable on Netflix, it affects only full HD and 4K content (which need L1), which you wouldn't enjoy on 720p screen anyway. On Mi A1 I had only L3 (that was the default DRM level) and I did not notice any usability issues, Netflix, Google play music etc. were working nicely. On the small screen I did not notice that Netflix was playing at lower resolution.
Click to expand...
Click to collapse
Im at service center and they do not know what DRM is... but they will flash via testpoint i dunno if it will help
amnher said:
Im at service center and they do not know what DRM is... but they will flash via testpoint i dunno if it will help
Click to expand...
Click to collapse
I'm afraid that not, DRM keys are lost already, they would have to generate/obtain new ones. In each case, let us know how it went..
_mysiak_ said:
I'm afraid that not, DRM keys are lost already, they would have to generate/obtain new ones. In each case, let us know how it went..
Click to expand...
Click to collapse
It came back to 10.3.3.0 which is lower than before when i purchase it. Sadly L3 and they opened a brand new mi a3 and it was L1 so they are surprised. The technicial now is tying to do an ota. Though i doubt it will be fixed
Ps. Failed now they will change the motherboard
Check this out:
forum.xda-developers.com/yureka/themes-apps/fix-device-isnt-compatible-version-t3892194
I dunno it helps, but it worked for me
callmegov said:
Check this out:
forum.xda-developers.com/yureka/themes-apps/fix-device-isnt-compatible-version-t3892194
I dunno it helps, but it worked for me
Click to expand...
Click to collapse
It changes these things in build prop, I doubt that it will help with anything for Netflix and even OP says that it's only to show Netflix in playstore (for phone models which are "unsupported" by Netflix officially, which is not the case for Mi A3).
ro.product.model=Pixel 3 XL
ro.product.brand=google
ro.product.name=crosshatch
ro.product.device=crosshatch
ro.product.cpu.abi=arm64-v8a
ro.product.cpu.abilist=arm64-v8a,armeabi-v7a,armeabi
ro.product.cpu.abilist32=armeabi-v7a,armeabi
ro.product.cpu.abilist64=arm64-v8a
ro.product.manufacturer=Google
ro.product.locale=en-US
Basically, f*ck Netflix and Google. We can't even watch the things, even if we want to pay for it, so f*ck them, I'll just download the movies/shows from somewhere else and put it on my SD card.
[Solved]
Hey guys! Good news
:victory: Got Netflix back to work with unlocked bootloader, current Bliss Rom and Magisk installed. :victory:
I believed that ctsProfile failure was the culprit of not being able to install Netflix from Google Play so I get it to pass thanks to @pkdon123 suggestion and files shared by @rudranshrajput and off course some G search. Here's what I've done (not sure if all steps are needed, I went throught it just once):
Solved ctsProfile with flashing two files through Magisk and rebooting.
Used Magisk Hide to hide it from GP and Google Services Framework. Then run SafetyNet check and ctsProfile passed without any issue.
Clear cache and data from both apps - GP and GSF. Then I had to reboot twice to get GP to work again but finally was able to find and install Netflix from there straight away and everything is working perfectly.
Let me know if it works for you guys. Good luck :fingers-crossed:
Horstorm said:
Hey guys! Good news
:victory: Got Netflix back to work with unlocked bootloader, current Bliss Rom and Magisk installed. :victory:
I believed that ctsProfile failure was the culprit of not being able to install Netflix from Google Play so I get it to pass thanks to @pkdon123 suggestion and files shared by @rudranshrajput and off course some G search. Here's what I've done (not sure if all steps are needed, I went throught it just once):
Solved ctsProfile with flashing two files through Magisk and rebooting.
Used Magisk Hide to hide it from GP and Google Services Framework. Then run SafetyNet check and ctsProfile passed without any issue.
Clear cache and data from both apps - GP and GSF. Then I had to reboot twice to get GP to work again but finally was able to find and install Netflix from there straight away and everything is working perfectly.
Let me know if it works for you guys. Good luck :fingers-crossed:
Click to expand...
Click to collapse
Hiding the full play services causes battery drain.
You only need to hide com.google.android.gms.unstable from play services.
All of this is already mentioned in the magisk documentation.
Also Netflix will still work with rooted device you just need to download it from a different source like apkmirror. It doesn't download from the playstore because play store isn't certified which is why we hide it in magisk.
If people took the time to read the applicable documentation then threads like this wouldn't have to exist
garylawwd said:
Hiding the full play services causes battery drain.
You only need to hide com.google.android.gms.unstable from play services.
All of this is already mentioned in the magisk documentation.
Also Netflix will still work with rooted device you just need to download it from a different source like apkmirror. It doesn't download from the playstore because play store isn't certified which is why we hide it in magisk.
If people took the time to read the applicable documentation then threads like this wouldn't have to exist
Click to expand...
Click to collapse
I was having the same exact problem and I solve this problem by enabling magiskhide and doing exactly what you have said I also tested by downloading the apk from the APK mirror and it was working absolutely fine but my problem was that I wouldn't be able to get Netflix updates from the play store also my device was uncertified and I was trying to make it certified which was easily done by flashing magisk also keep in mind that if you have only unlock the bootloader on stock ROM CTS won't pass and device will be non certified so if you want to stay on your stock ROM you need to lock the bootloader but I would suggest that instead of locking the bootloader you can flash magisk and use magisk hide just as a precaution as if she does anything wrong in future ota you can save yourself easily just by having and unlock bootloader.
garylawwd said:
Hiding the full play services causes battery drain.
You only need to hide com.google.android.gms.unstable from play services.
All of this is already mentioned in the magisk documentation.
Also Netflix will still work with rooted device you just need to download it from a different source like apkmirror. It doesn't download from the playstore because play store isn't certified which is why we hide it in magisk.
If people took the time to read the applicable documentation then threads like this wouldn't have to exist
Click to expand...
Click to collapse
Thanks for a suggestion. I didn't read the Magisk documentation and the truth is that I should but 'ain't nobody got time for that'... I consider myself just as an Android enthusiast and spending time to read all documentation I should to install custom rom and get root access would take enormous amount of precious time. I totally agree that If everyone would read the documentation (also write it responsibly) no such forums would be necessary. On the other hand this is why forums like this (Q&A, Guides,...) exist -> to share the knowledge.
And to the actual problem:
I had no clue that it could be actually connected to Magisk itself due to it worked on same device for several months on different custom roms without any issue. That's why I was looking for an answer in the ROM's thread. After disabling full GP Services I didn't notice higher battery drain, but disabling gms.unstable is sufficient. Installing Netflix from other sources is short-term solution which I off course did but I was looking for a solution that will last.
Off Topic: I've noticed that you're quite active in this forum and seems to have the knowledge. Keep it up and keep the patience. Thank you :good:
Hello very friendly helping people!
Im a 10 year iPhone user, but over time i came to hate all the restrictions and so i got myself a K30 Ultra and later today it should finally arrive!
Unfortunately i found out that it doesnt check the Google SafetyNet thingy and i can't use Google Pay with it. That kinda sucks, I never thought about stuff like this on iOS, but I'm confident there is a solution for it.
I found out about rooting my device, but it somehow isn't possible because of the Mediatek chip. But then I also found out that apperenty there IS a way to use the program/thingy that makes the phone pass SafetyNet (Magisk) without the need of a custom ROM.
I'm sorry if im confusing words like rooting im very noobish about all this.
So here are my questions in short form:
1. Can I make Google Pay Work in any way on my Redmi K30 Ultra?
2. Does this also affect my banking apps (I'm using DKB and Kontist) and can this be solved, too?
3. Could you link me some guides how to do it?
4. Is there any danger doing it (like deleting my phone if it doesnt work) and is there a possibility to safe my device on the PC or something like this to be safe?
5. Are their any safety concerns doing "it" (not sure what the solution will be) and should I install an anti virus program on the device? I just read about the cerberus trojan and its kinda scary. I think iOS systems were always pretty safe against those.
6. Anything else i need to know?
Thank you so much! I appreciate it a lot that there is a place where i can go to get help on those things! <3
Google Pay and any other banking apps refuse to work when a rooted Android gets detected by them. BTW: SafetyNet API doesn't purely check whether the device's Android is rooted, as the API is designed to check the overall integrity of device's Android.
jwoegerbauer said:
Google Pay and any other banking apps refuse to work when a rooted Android gets detected by them. BTW: SafetyNet API doesn't purely check whether the device's Android is rooted, as the API is designed to check the overall integrity of device's Android.
Click to expand...
Click to collapse
Hey, thanks for your post!
Are you implying that there is no way around that and its doomed to forever not work on my device?
To clarify things: SafetyNet is run by an app that has implemented this API, it's not run by Android OS itself. Yes, Magisk allows you to lever out this test by manipulating device's fingerprint so you will possibly be able to use Google Pay etc.pp
FYI: Any app not having SafetyNet API implemented easily can check whether Android got rooted / tampered or not. The app simply runs functions like
Code:
isRootNative
isDetectedDevKeys
isDetectedTestKeys
isFoundBusyboxBinary
isFoundDangerousProps
isFoundHooks
isFoundResetprop
isFoundSuBinary
isFoundWrongPathPermission
isFoundXposed
isNotFoundReleaseKeys
isPermissiveSelinux
isSuExists
isMagiskSUExists
isFoundMagisk
isFoundRootCloakingApps
what can't get prevented by Magisk.
jwoegerbauer said:
Yes, Magisk allows you to lever out this test by manipulating device's fingerprint so you will possibly be able to use Google Pay etc.pp
Click to expand...
Click to collapse
Ok, perfect. Would you be able to link me to a guide that shows me how to install Magisk on my device? It has a Mediatek chip so a custom ROM isn't possible (as far as I understand).
Mirardt said:
Ok, perfect. Would you be able to link me to a guide that shows me how to install Magisk on my device? It has a Mediatek chip so a custom ROM isn't possible (as far as I understand).
Click to expand...
Click to collapse
How to install Magisk without a Custom ROM is explained here.
If a Custom ROM like TWRP isn't officially made public for your device then you have to compile TWRP at your own.
This is TWRP and Magisk for the latest firmware on the K30 Ultra. https://mifirm.net/downloadtwrp/166
---------- Post added at 07:39 PM ---------- Previous post was at 07:37 PM ----------
Google Pay on a rooted device with Magisk installed /is/ possible, my Galaxy Note 9 with Dr. Ketan's ROM works with Google Pay and I believe it's due to the CTS Profile fix which is available in its ROM Tool app. So there's going to be some way to make it work with the K30 Ultra.
JaboJG said:
This is TWRP and Magisk for the latest firmware on the K30 Ultra. https://mifirm.net/downloadtwrp/166
Click to expand...
Click to collapse
Oh wow how cool is that, that is custom for the K30 ultra
And do I install that with the guide linked above or do I need some certain skill and experience to do that. It says it isn't tested yet. If I do a mirror of my phone before nothing really bad can happen right?
Google Pay on a rooted device with Magisk installed /is/ possible, my Galaxy Note 9 with Dr. Ketan's ROM works with Google Pay and I believe it's due to the CTS Profile fix which is available in its ROM Tool app. So there's going to be some way to make it work with the K30 Ultra.
Click to expand...
Click to collapse
Nice!!!
Yeah the only think that failed SafetyNet Test is the "CTS profile match". But I can't use those roms for my K30 ultra, right, so I just do it with Magisk?
Thanks so much!!
You need to unlock your bootloader with the Mi Unlock tool then flash TWRP over fastboot, and in TWRP make the appropriate backups and flash Magisk. There's many guides and it's relatively straight forward.
K30 Ultra is basically a brand new phone, it's like a month old. It'll be a while but keep an eye on XDA Forums, on the internet, and on YouTube. Somebody will eventually describe or figure out how to fix the CTS Profile.
I think I'm not gonna modify mine and I'll just wear my Apple Watch to use it for contactless payments.
JaboJG said:
You need to unlock your bootloader with the Mi Unlock tool then flash TWRP over fastboot, and in TWRP make the appropriate backups and flash Magisk. There's many guides and it's relatively straight forward.
K30 Ultra is basically a brand new phone, it's like a month old. It'll be a while but keep an eye on XDA Forums, on the internet, and on YouTube. Somebody will eventually describe or figure out how to fix the CTS Profile.
I think I'm not gonna modify mine and I'll just wear my Apple Watch to use it for contactless payments.
Click to expand...
Click to collapse
Alright, so I read 12384 guides and had a very tiny sense of it. The Mi Unlock tool stopped me, though, and now I'll have to wait another 6 days.
As I understood it, my data will be erased, but can be just be restored by MIUI if backed up before. I'm gonna let you know how it worked after I'll do it in about a week.
Probably I won't have to patience to wait. Google Pay is a really nice to have, but neither voLTE, nor voWifi works on my device, so I for sure have do hack that some weird way, because i have no mobile network at all at home and absolutely need voWifi.
Thank you very much for your kind help! <3
No problem at all.
I'm not sure if Wifi-Calling (voWifi) works with my carrier as I've turned it on with the carrier and in the phone, and it doesn't seem to be making calls over wifi. Not a big deal for me though as I've got Unlimited calls with my carrier.
Please let us know if and when you do flash the TWRP as I'd like feedback before flashing it myself.
Do your banking apps refuse to work or is it only google pay that fails due to the safetynet fail?
JaboJG said:
No problem at all.
I'm not sure if Wifi-Calling (voWifi) works with my carrier as I've turned it on with the carrier and in the phone, and it doesn't seem to be making calls over wifi. Not a big deal for me though as I've got Unlimited calls with my carrier.
Please let us know if and when you do flash the TWRP as I'd like feedback before flashing it myself.
Click to expand...
Click to collapse
Yeah, me too, but I have a very bad connection in my flat so I do need voWifi anyway. I will let you know and hope I won't brick my device. But as I understand it, bricking the device just by flashing twrp is very unlikely, right?
MerlijnD said:
Do your banking apps refuse to work or is it only google pay that fails due to the safetynet fail?
Click to expand...
Click to collapse
Only Google Pay, both of my banking apps work perfectly. I couldnt scan the security bar code though, some internal google app wouldn't allow it. So i had to put in both the (very long) idendification and security numbers in manually.
Alright thanks. Another thing im interested in is if Snapchat works when safetynet fails. Did you do any tests regarding that?
MerlijnD said:
Alright thanks. Another thing im interested in is if Snapchat works when safetynet fails. Did you do any tests regarding that?
Click to expand...
Click to collapse
Not using Snapchat, but I just installed it and it starts without problems. Didn't made an account though.
So I'm gonna be able to flash twrp and Magisk in exactly 14 hours and have some questions i would really appreciate an answer to <3
Using this: https://mifirm.net/downloadtwrp/166
1. The thing i want to flash first is twrp and it is the file called "recovery.img" in the downloaded folder, is that correct?
2. Just flashing twrp is "relatively" safe and if I do a backup and the device bricks by installing Magsik after, i can recover it through twrp, correct?
3. Should I not install todays new security update to MIUI or does that not matter at all?
edit: 4. Do I need/want to have "USB debugging", "Install via USB" and "USBebugging (Security Settings)" enabled or just "OEM unlocking"?
Thank you so much! I'm very nervous since i didn't read any experiences of rooting the K30 Ultra before and I'm scared of killing it.
Hey Mirardt, good luck. Let us know how you get on!
1. Yeah, you'll use fastboot to flash the recovery.img for TWRP.
2. Do a full backup with TWRP and you should be safe.
3. Doesn't matter, it's just the September Android security update.
4. Yeah turn on USB Debugging and connect your phone to your computer - it will ask you if you want to allow this computer to debug your phone, choose accept and always (or something similar to those words.) Do this before flashing TWRP.
Mirardt said:
So I'm gonna be able to flash twrp and Magisk in exactly 14 hours and have some questions i would really appreciate an answer to <3
Using this: https://mifirm.net/downloadtwrp/166
1. The thing i want to flash first is twrp and it is the file called "recovery.img" in the downloaded folder, is that correct?
2. Just flashing twrp is "relatively" safe and if I do a backup and the device bricks by installing Magsik after, i can recover it through twrp, correct?
3. Should I not install todays new security update to MIUI or does that not matter at all?
edit: 4. Do I need/want to have "USB debugging", "Install via USB" and "USBebugging (Security Settings)" enabled or just "OEM unlocking"?
Thank you so much! I'm very nervous since i didn't read any experiences of rooting the K30 Ultra before and I'm scared of killing it.
Click to expand...
Click to collapse
JaboJG said:
Hey Mirardt, good luck. Let us know how you get on!
1. Yeah, you'll use fastboot to flash the recovery.img for TWRP.
2. Do a full backup with TWRP and you should be safe.
3. Doesn't matter, it's just the September Android security update.
4. Yeah turn on USB Debugging and connect your phone to your computer - it will ask you if you want to allow this computer to debug your phone, choose accept and always (or something similar to those words.) Do this before flashing TWRP.
Click to expand...
Click to collapse
Hey Jabo, nice, I'm gonna do just that! Just for clarification, I use Mi Unlock Tool first, THEN twrp, then backup, then magisk?
I'll let you know and thanks for the good luck!
edit: so the command would be "fastboot flash recovery recovery.img", right?
I'm VERY sorry for the noobish questions.
I'm going to quickly use this thread to ask how to actually unlock the K30 Ultra Bootloader. I did everything the guides said, but Mi Unlock still doesn't recognize the phone when it's plugged in. Any Advice?
Hey guys (especially JaboJG). quick update: Flashing twrp and Magsik both just worked perfectly. no brick. Thanks for your help!!
The only issue is that it didnt help in passing Google Safety Check. I tried almost everything there is and will post my logs of MagiskHide Props in their thread soon.
Also, now some apps don't work anymore because they detect the root. I hope we will find a fix.
macrett said:
I'm going to quickly use this thread to ask how to actually unlock the K30 Ultra Bootloader. I did everything the guides said, but Mi Unlock still doesn't recognize the phone when it's plugged in. Any Advice?
Click to expand...
Click to collapse
No idea, sorry. It just worked for me.
Follow the instruction of your OS (GrapheneOS or CalyxOS) as normal, then just before locking the bootloader back follow the guide here. The end result is a OS with Magisk and root, but the bootloader can not be lock again (because of the root process).
So, if you would like to be able to record call, block advertisement and enjoy your device because it is your freedom to do with your device what ever you want, root your OS.
PS, if security is more important then privacy, rooting is not the way to go, at the moment I didnt find how to maintain both
Old news.
And technically, you CAN relock the bootloader if you wanted to, by resigning everything. There's links (somewhere, you'll have to search for it) to a program on git that someone wrote to do this, but I haven't tried it.
The reality is that locking the bootloader really doesn't do much for you. It might protect you a BIT if you lose physical control over it, but when you lose physical control over a device, you have to assume that its been compromised anyway.
Locking the bootloader will be essential in the future when Google enforces Hardware Backed attestation for those who use contactless payments.
This is good to know.
shoey63 said:
Locking the bootloader will be essential in the future when Google enforces Hardware Backed attestation for those who use contactless payments.
This is good to know.
Click to expand...
Click to collapse
Source?
96carboard said:
Source?
Click to expand...
Click to collapse
It's all in This thread
Edit: More reading Here
shoey63 said:
It's all in This thread
Edit: More reading Here
Click to expand...
Click to collapse
Your links seem to be showing something about current issues that people are having, not about something "in the future" regarding enforcement of locked bootloader.
Edit: what I'm looking for is some statement from gooble that they intend to make some changes with respect to this, otherwise it appears to be just speculation.
Edit 2: The subject is also pretty off topic, since there's a good chance that it doesn't come into play at all with graphene or calyx, both of which do NOT include integrated binary gooble services. Graphene goes to a lot of trouble to make it installable, but strongly isolated from everything else, which includes restricting hardware status flags from being readable by it. Calyx promotes microG.
96carboard said:
Old news.
And technically, you CAN relock the bootloader if you wanted to, by resigning everything. There's links (somewhere, you'll have to search for it) to a program on git that someone wrote to do this, but I haven't tried it.
The reality is that locking the bootloader really doesn't do much for you. It might protect you a BIT if you lose physical control over it, but when you lose physical control over a device, you have to assume that its been compromised anyway.
Click to expand...
Click to collapse
It may be old news for you, I didnt find it anywhere. That is why I posted it here, just in case there are people like me that looking for that answer.
Asking in the GrapheneOS chats, I only got an answer that rooting is not supported and not recommended.
Since I'm using call recorder to my work and will be glad to block advertisements locally, and god forbid, I also would like to use either Graphene or CalyxOS.
I dont see other way around it unless using root.
Can you please send your links for looking back the bootloader? that will be awesome. Thanks!
HQwarp said:
Can you please send your links for looking back the bootloader? that will be awesome. Thanks!
Click to expand...
Click to collapse
Use the search bar at the top of the screen, or read through all the other threads in the 6 and 6pro forums, that's what I would have to do to find it for you.
96carboard said:
Use the search bar at the top of the screen, or read through all the other threads in the 6 and 6pro forums, that's what I would have to do to find it for you.
Click to expand...
Click to collapse
Very sad respond from you. You can be helpful and point me to the right direction and with less arrogance attitude of yours...
XDA is a place to share knowledge, not to show your arrogance on how good you are to type in google search.
FYI, if anyone want to sign the bootloader after using Magisk this is probably the way
Rooting Graphene/Calyx/LeOS/DivestOS/eOS/CopperHead completely defeats t he purpose as now it gives potentially a malicious app root abilities.
As the head of Graphene's Twitter once said "but why... that opens so many security risk doors"|
You can't re-lock the bootloader with root unless you create a new avb-key. Don't bother rooting security roms, its pointless.
Yes, you are right, it is lowering the security of the phone. But, that's ok, each one with his use case of attack. If it is ok for you to use your phone without sudo, good for you. Since I'm not Edward Snowden and I'm not afraid to use sudo on my machines, and when I do, I know enough when and how to use it.
Therefore, I don't see why I can't use sudo on my phone. Especially when some of us do need our phone to perform tasks that currently are not supported by Security oriented OS as you mentioned, AND also do want to lower our information footprint on the net. For this case using sudo on the formation ROMs seems ideal.
HQwarp said:
Very sad respond from you.
Click to expand...
Click to collapse
Very sad that you expect to be spoon fed when you have the capacity to search for yourself.
to make it easier for people who may look for it (I was one of those people)
this is that script mentioned earlier which will allow you to resign the rom to allow you to lock the bootloader with Magisk https://forum.xda-developers.com/t/...s-and-add-adb-root-and-other-changes.4440367/
This is exactly what I needed https://github.com/chenxiaolong/avbroot
I believe so anyway, still actually trying to get it to work, just need to setup android studio as far as I can make out
then you can easily patch the rom with magisk and sign it with your own keys
And this information could be useful as well https://forum.xda-developers.com/t/signing-boot-images-for-android-verified-boot-avb-v8.3600606/
FireRattus said:
to make it easier for people who may look for it (I was one of those people)
this is that script mentioned earlier which will allow you to resign the rom to allow you to lock the bootloader with Magisk https://forum.xda-developers.com/t/...s-and-add-adb-root-and-other-changes.4440367/
Click to expand...
Click to collapse
So how would this work? Would I have to unlock and wipe after every update
cammykool said:
So how would this work? Would I have to unlock and wipe after every update
Click to expand...
Click to collapse
I have been working on this when I have had time, I have been able to successfully flash Graphene with Magisk and lock the bootloader, turning what I learned into this guide https://forum.xda-developers.com/t/lock-boot-loader-magisk-root-grapheneos.4510295/
I believe there is a way to update with signed OTA files that are patched with Magisk, using AVBRoot that I use in the guide
I haven't figured this part out yet. it took me long enough just to work it out for the firmware/system rom but I will definitely be trying and updating the guide as I learn more about the process
FireRattus said:
I have been working on this when I have had time, I have been able to successfully flash Graphene with Magisk and lock the bootloader, turning what I learned into this guide https://forum.xda-developers.com/t/lock-boot-loader-magisk-root-grapheneos.4510295/
I believe there is a way to update with signed OTA files that are patched with Magisk, using AVBRoot that I use in the guide
I haven't figured this part out yet. it took me long enough just to work it out for the firmware/system rom but I will definitely be trying and updating the guide as I learn more about the process
Click to expand...
Click to collapse
That sounds extremely promising.
Since proton is obsolete now, I'm searching for a rom with sandboxed google play that I can root. Rooting GrapheneOS seems to be the only way for that.
Locking bootlaoder doesn't really matter to me, but rooting graphene and then being able to dirty flash updates later (I don't care about OTAs, even if it's cool and comfortable) is important.
How would you update graphene right now when you're rooted? Just dirty flash the new rom, then flash patched boot.img?
Spl4tt said:
That sounds extremely promising.
Since proton is obsolete now, I'm searching for a rom with sandboxed google play that I can root. Rooting GrapheneOS seems to be the only way for that.
Locking bootlaoder doesn't really matter to me, but rooting graphene and then being able to dirty flash updates later (I don't care about OTAs, even if it's cool and comfortable) is important.
How would you update graphene right now when you're rooted? Just dirty flash the new rom, then flash patched boot.img?
Click to expand...
Click to collapse
If you don't care about locking the boot loader you do lose some physical security advantages of it
but it does make the process easier, I believe you should just be able to use AVBRoot as it's intended
GitHub - chenxiaolong/avbroot: Maintain Android Verified Boot using a custom key while rooted with Magisk
Maintain Android Verified Boot using a custom key while rooted with Magisk - GitHub - chenxiaolong/avbroot: Maintain Android Verified Boot using a custom key while rooted with Magisk
github.com
Once you have completed all the initial steps then updates are as simple as
Follow step 6 in the previous section to patch the new OTA (or an existing OTA with a newer Magisk APK).
Reboot to recovery mode. If stuck at a No command screen, press the volume up button once while holding down the power button.
Sideload the patched OTA.
Reboot.
Click to expand...
Click to collapse
FireRattus said:
If you don't care about locking the boot loader you do lose some physical security advantages of it
but it does make the process easier, I believe you should just be able to use AVBRoot as it's intended
GitHub - chenxiaolong/avbroot: Maintain Android Verified Boot using a custom key while rooted with Magisk
Maintain Android Verified Boot using a custom key while rooted with Magisk - GitHub - chenxiaolong/avbroot: Maintain Android Verified Boot using a custom key while rooted with Magisk
github.com
Once you have completed all the initial steps then updates are as simple as
Click to expand...
Click to collapse
If updating is that easy with a locked bootloader I'm gonna try this. Thanks for your efforts man
Anyone know if I can I expect the same procedures to work for GOS installed on a Pixel 5 or 4?
Hi, I just changed the battery on my H930 (Italy) and it's back to life. I kindly wanted to know, starting from the already unlocked Bootloader and from an LG Pie, if there is a custom rom, even if not very recent, without any bugs, which retains all the main functions (in particular Hi-Fi DAC, NFC, photos, Wi-Fi, bluetooth ,etc). Furthermore, I would need to use payments with Google Pay and therefore bypass the related checks. If someone can give me a hand of help ... eternal gratitude!
Stock Pie ROMs have been known to be poorly setup by LG. Since they have discontinued their development, these will not be fixed.
In the USA, custom ROMs don't work with VOLTE or VOWIFI... which is why I always recommend stock for USA phones to retain this capability. I don't know if Italy/Europe has any of these issues.
For these reasons, I have always recommended stock Oreo ROMs here in the USA, as these were the most stable and worked well. I have since left my V30 phone but it still has Oreo on it (and still works). For US users, I often recommend US998 ROMs as these work for most carriers (including international). So I might suggest that one to start.
As for GPay, they have gotten quite advanced with root detection. I would recommend skipping root if you can, of course. If you cannot, then I did use Magisk Hide in the past and it worked for me, but that was a few years ago, so I don't know if that works anymore. I would advise NOT using Xposed, as this was being detected as well... besides which Xposed was causing problems anyway, so I found it was not worth the hassle.
I thank you for the valuable suggestions, I guess I will keep it a few more years with Pie and with Magisk Hide I will try to remove the root. Actually I don't remember rooting it. Is it possible that "security reasons" that don't allow me to load cards depend on unlocking the bootloader?
Yes, just unlocking the bootloader can be part of the detection, even if it's not rooted. You often have to go the next step to root and then use Magisk Hide to make it "safe" from there.
Note, at least on older versions, you had to start with the TWRP install of an older version of Magisk. Once installed, then you can update it (usually) without much problem. I recall doing that myself. I believe the TWRP install required Magisk 18.x, and then I had updated to 20.x. You can check the WTF thread to see what that requires, as those instructions should still be valid.
Another option is relocking the BL, of course.
Also note, I know that at one time I had seen where once you fail the security check, you had to clear data for Google Services or something, and maybe even GPay. Otherwise, it "remembered" that you had failed, and would not recheck. By deleting data, it would force it to recheck, so you may need to do this after doing Magisk Hide. Note that you ay need to hide services as well. Again, I'm saying this based on older info... I don't know if things have changed since then.
clalos33 said:
I thank you for the valuable suggestions, I guess I will keep it a few more years with Pie and with Magisk Hide I will try to remove the root. Actually I don't remember rooting it. Is it possible that "security reasons" that don't allow me to load cards depend on unlocking the bootloader?
Click to expand...
Click to collapse
Yes, unlocking the bootloader will cause the security check to fail because you've broken the front door down. You can now do other things like root and make changes to your phone. They know this, so the assumption is if you unlocked the bootloader you are now attempting to take control of your own phone, and they don't want that.
Thank you again for your helpful suggestions. In consideration that I do not plan to use custom rom I will try to lock the Bootloader