Tutorial Installing Magisk and Play Integrity Fix

[Kacper Skrzypek]

As you are aware, new Stable releases (including rebuilds that are currently in the works) do not include our fix for passing SafetyNet/Play Integrity checks. There's the guide how to flash Magisk and relevant fix on these ROMs.

NOTE: You have to repeat the process (at least installing Magisk) after EVERY ROM UPDATE!

UPDATE 9.12.2023: We have implemented our fix in recent ROMs (AFTER 1.12.2023). If you want to use Play Integrity Fix, you must:
- uninstall eu.xiaomi.module.inject updates (if you updated module to newer version than present in ROM),
- disable eu.xiaomi.module.inject app (possible on ROMs released AFTER 7.12.2023).

If you can't do these steps, you will have to use another Magisk module to remove it from system (until an update for your phone, released after 7.12.2023, is available).

If you want to use Magisk with our module (not PIF), add Google Play Services to DenyList as present on the screenshot and enforce it.


The newest Play Integrity Fix automatically removes our APK.

1. Flash the newest available Stable build for your device (released on or after 18 November).
2. Prepare relevant files: Magisk (download APK), Play Integrity Fix and relevant file from the ROM package.
- If ROM package contains init_boot.img, then extract it (and ONLY it).
- If it doesn't, extract boot.img (and ONLY it).

Move them to device storage.

3. Install Magisk APK on device. After install run it and choose "Install" near Magisk name. Choose "Select and Patch a File", then find a relevant IMG file (boot.img or init_boot.img) you've moved to storage before. Then "Let's go".

Move generated image to the PC. Run device in Fastboot mode. If you've unpacked ROM on PC, you can use it to flash an image (if not, use platform-tools); go to the ROM directory > bin > your host OS dir. Paste image there (the best solution present on the screenshot), then right-click anywhere on the directory > run Terminal (if option doesn't show, use Ctrl+Shift+RMB - for Windows lower than 11).

Connect device to PC if you didn't already. Run following commands (.\ on screenshot is for PowerShell):
fastboot devices

Depending on your device:
fastboot flash init_boot_ab magisk_generated_name.img

OR

fastboot flash boot_ab magisk_generated_name.img

OR (on older devices)
fastboot flash boot magisk_generated_name.img

Then
fastboot reboot

Phone will reboot.

4. You should be able to see new Magisk app on Home screen. If it will ask for an install the full APK, then accept the prompt and install it. Magisk may also ask later for additional configuration, like on this screen:

Accept it. Device will reboot.
In some cases (like mine), app will say that you have to reinstall Magisk. Do it, choosing "Direct installation" and accept the prompt. Reboot device after installation.

5. Play Integrity Fix requires enabled Zygisk. Tap the gear button, then select "Zygisk". You can also enable "Enforce DenyList" - it will be useful for hiding apps that are detecting root from Magisk. Reboot device to apply changes.

6. Now it's time to install Play Integrity Fix. Run Magisk, select Modules > Install from storage and choose a ZIP with a fix. After successful install, reboot a device.


7. SafetyNet and Play Integrity should be passing just fine (until next Google fix; then you will have to wait for a fix update).

8. Clear app data: Google Wallet, Google Play Services, Google Play Store and Google Services Framework.
9. Reboot device. You should be able to add cards successfully.


If you aren't able to download specific apps from Play Store (e.g. Netflix) after flashing a fix, clear Play Store and Google Play Services data.

HOW TO HIDE SOME APPS FROM MAGISK
In my case, McDonald's or Google Wallet app is working just fine after flashing a fix, without having to hide the app in Magisk. But, in some cases, it may be not enough. How to do it then? We (I hope) activated DenyList while preparing to flash Play Integrity Fix, so let's use it!

1. Go to Magisk > gear icon > Configure DenyList.
2. There will be a list of apps on phone. Choose app that complains about root permissions.

3. If your bank app still doesn't work due to detecting ROOT, go back to settings and select "Hide the Magisk app". It will generate the same Magisk app, but with new package name, so it won't be so easily detected by apps. Allow Magisk to install apps, then choose your name and accept. It was enough in my case, app started to work (although it doesn't allow to send a screenshot, so you must trust me in this case)


If you have any questions, feel free to ask them!

 

[Birraque]

That`s will be a wilde ride for many users!
Thanks for your hard work and great Custom ROM.

NOTE: @Jacometto I confirme too that new Stable REBUILD (18, Nov) works flawlessly with Play Integrity Module bring back all payment and bank functionalities.

Cheers,

 

[Jacometto]

That`s will be a wilde ride for many users!
Thanks for your hard work and great Custom ROM.

Cheers,

It will certainly be!
I´m already testing it.

Poco F3 (alioth) updated with latest MIUI 14 Stable REBUILD without Play Integrity fix.
Already rooted and flashed with Play Integrity Fix by @chiteroman version 13 and 13.1
I CONFIRM that Play Integrity Certification, SafeNet Certification, Google Play Store Certification, Google Wallet (NFC Payments) and Bank apps are working flawlessly. (attached)
The whole system seems also faster them before. Awesome work!
Thanks @Igor Eisberg , @Kacper Skrzypek , @ingbrzy and all EU Team for your commitment to provide a great Custom MIUI for us.

Best regards,

 

[ekzeshka]

If you are using PlayIntegrity Fix, never hide gms. Hiding Google Wallet does nothing, it doesn't have any internal checks and relies on gms.

 

[Kacper Skrzypek]

If you are using PlayIntegrity Fix, never hide gms. Hiding Google Wallet does nothing, it doesn't have any internal checks and relies on gms.

Thanks!
So what needs to be hidden there?

 

[WickedKorteX]

Is the second space also automatically rooted or could I install banking apps there normally (unrooted)?

 

[ekzeshka]

Thanks!
So what needs to be hidden there?

Only the apps that actively check for root. Mostly banking apps, some games (PoGo, PUBG, etc), Uber, McDonalds, etc.
Don't go on an adding spree. If you launch an app and see a warning, only then try to hide it.

 

[Kacper Skrzypek]

Only the apps that actively check for root. Mostly banking apps, some games (PoGo, PUBG, etc), Uber, McDonalds, etc.
Don't go on an adding spree. If you launch an app and see a warning, only then try to hide it.

Thanks, corrected.

 

[WickedKorteX]

Only the apps that actively check for root. Mostly banking apps, some games (PoGo, PUBG, etc), Uber, McDonalds, etc.
Don't go on an adding spree. If you launch an app and see a warning, only then try to hide it.

OK, I'm sorry, but I didn't understand that at all. I meant if I root the smartphone, is the Second Space (second profile) automatically rooted too or not?

 

[ekzeshka]

OK, I'm sorry, but I didn't understand that at all. I meant if I root the smartphone, is the Second Space (second profile) automatically rooted too or not?

Yes, the whole system is rooted, not limited to any profile.

 

[abdullah alotaibi]

thanks for sharing

 

[laazaaroo]

As you are aware, new Stable releases (including rebuilds that are currently in the works) do not include our fix for passing SafetyNet/Play Integrity checks. There's the guide how to flash Magisk and relevant fix on these ROMs.

NOTE: You have to repeat the process (at least installing Magisk) after EVERY ROM UPDATE!

1. Flash the newest available Stable build for your device (released on or after 18 November).
2. Prepare relevant files: Magisk (download APK) and Play Integrity Fix.

If you are flashing via Fastboot, you will also need the following file from the ROM package. If ROM package contains init_boot.img, then unpack it (and ONLY it). If it doesn't, unpack boot.img (and ONLY it).
Move it to device storage.

Flashing Magisk method will differ, depending on whether you are using Fastboot or Recovery.
3. [TWRP] Boot device to TWRP and install the downloaded Magisk APK (recovery should be able to detect it despite it's a *.apk file - if not, change the extension to .zip). Reboot to system.
View attachment 49523View attachment 49524
[FASTBOOT] Install Magisk APK on device. After install run it and choose "Install" near Magisk name. Choose "Select and Patch a File", then find a relevant IMG file (boot.img or init_boot.img) you've moved to storage before. Then "Let's go".
View attachment 49527View attachment 49525
Move generated image to the PC. Run device in Fastboot mode. If you've unpacked ROM on PC, you can use it to flash an image (if not, use platform-tools); go to the ROM directory > bin > your host OS dir. Paste image there (the best solution present on the screenshot), then right-click > run Terminal.
View attachment 49528
Connect device to PC if you didn't already. Run following commands (.\ on screenshot is for PowerShell):

fastboot devices

Depending on your device:

fastboot flash boot_ab magisk_generated_name.img

OR

fastboot flash init_boot_ab magisk_generated_name.img

Then

fastboot reboot

Phone will reboot.
View attachment 49529
4. You should be able to see new Magisk app on Home screen. If it will ask for an install the full APK, then accept the prompt and install it. Magisk may also ask later for additional configuration, like on this screen:
View attachment 49530
Accept it. Device will reboot.
In some cases (like mine), app will say that you have to reinstall Magisk. Do it, choosing "Direct installation" and accept the prompt. Reboot device after installation.
View attachment 49531View attachment 49532View attachment 49533
5. Play Integrity Fix requires enabled Zygisk. Tap the gear button, then select "Zygisk". You can also enable "Enforce DenyList" - it will be useful for hiding apps that are detecting root from Magisk. Reboot device to apply changes.
View attachment 49534View attachment 49535View attachment 49536
6. Now it's time to install Play Integrity Fix. Run Magisk, select "Modules" > "Install from storage" and choose a ZIP with a fix. After successful install, reboot a device.

View attachment 49537View attachment 49538View attachment 49539
7. SafetyNet and Play Integrity should be passing just fine (until next Google fix; then you will have to wait for a fix update).
View attachment 49540View attachment 49541
8. Clear app data: Google Wallet, Google Play Services, Google Play Store and Google Services Framework.
9. Reboot device. You should be able to add cards successfully.
View attachment 49548

If you aren't able to download specific apps from Play Store (e.g. Netflix) after flashing a fix, clear Play Store and Google Play Services data.

HOW TO HIDE SOME APPS FROM MAGISK
In my case, McDonald's or Google Wallet app is working just fine after flashing a fix, without having to hide the app in Magisk. But, in some cases, it may be not enough. How to do it then? We (I hope) activated DenyList while preparing to flash Play Integrity Fix, so let's use it!

1. Go to Magisk > gear icon > Configure DenyList.
2. There will be a list of apps on phone. Choose app that complains about root permissions.
View attachment 49559
3. In most cases it will work, but in some (like Polish ID app, mObywatel) won't. Go back to settings and select "Hide the Magisk app". It will generate the same Magisk app, but with new package name, so it won't be so easily detected by apps. Allow Magisk to install apps, then choose your name and accept. It was enough in my case, app started to work (although it doesn't allow to send a screenshot, so you must trust me in this case)
View attachment 49543View attachment 49544

If you have any questions, feel free to ask them!

Im using the fastboot mode, my data will be erased? Or it will be kept? Thanks!

 

[Kacper Skrzypek]

Im using the fastboot mode, my data will be erased? Or it will be kept? Thanks!

No, data will not be erased.

 

[DExUS5]

Would it all work if I flash to the stock rom? (miui_CUPID_V14.0.8.0.TLCCNXM)

 

[laazaaroo]

No, data will not be erased.

Thanks! I will try tomorrow

 

[SanThes]

Sorry for the ignorance but where is the init_boot.img located? Couldn't find it.

 

[gogocar62]

unzip ROM > images > init_boot.img

 

[cygni]

No, data will not be erased.

I have TWRP on my phone. Will data be kept using TWRP?

 

[snickr]

Are the reuploads done for today? I was waiting for the HMNote10 but I can see now the last upload was 6 hours ago and the HMNote10 is not uploaded. Will I have to switch to Weekly for my Redmi Note 10 Pro instead or are more reuploads coming?

 

[cocotero]

Hi, I am new in the forum, this is my first post.

I've carefully followed the guide on this post, step by step, but the result I got is completely different, and sadly unsuccessful. I did it over my POCO X3 NFC (surya) running a xiaomi.eu 14.0.2.0.SJGMIXM custom 'rebuild' rom, just installed a couple of hours ago (so I guess it is valid for this process). Results:

- Safety.Net: Response payload validation failed (before Magisk + Play Integrity fix, I got a SUCCESS in the whole Test)
- Play Integrity Checker: the 3 integrity checking fail, DEVICE | BASIC | STRONG (before Magisk + Play Integrity fix, I got a SUCCESS in BASIC, and failure in others two).

I installed Magisk v26.4 and PlayIntegrityFix_v13 directly from the links on the tutorial. I did not get any error when installing them.

Can anyone here help me on what to do/check next?

Note: Spanish banking apps I use work fine, no need to hide

 

[rohan555]

Would it all work if I flash to the stock rom? (miui_CUPID_V14.0.8.0.TLCCNXM)

yep

 

[rohan555]

I have TWRP on my phone. Will data be kept using TWRP?

yep

 

[snickr]

Hi, I am new in the forum, this is my first post.

I've carefully followed the guide on this post, step by step, but the result I got is completely different, and sadly unsuccessful. I did it over my POCO X3 NFC (surya) running a xiaomi.eu 14.0.2.0.SJGMIXM custom 'rebuild' rom, just installed a couple of hours ago (so I guess it is valid for this process). Results:

- Safety.Net: Response payload validation failed (before Magisk + Play Integrity fix, I got a SUCCESS in the whole Test)
- Play Integrity Checker: the 3 integrity checking fail, DEVICE | BASIC | STRONG (before Magisk + Play Integrity fix, I got a SUCCESS in BASIC, and failure in others two).

I installed Magisk v26.4 and PlayIntegrityFix_v13 directly from the links on the tutorial. I did not get any error when installing them.

Can anyone here help me on what to do/check next?

Note: Spanish banking apps I use work fine, no need to hide

Try clearing the cache for GSF, Play Services, Play Store and rebooting afterwards.

 

[palla]

Xiaomi Ultra 13 - Clean install of 19/11 ROM and Magisk / Play Integrity Fix.

Failed followed instructions above, and tried all the suggestions.

 

[chris1701]

Try clearing the cache for GSF, Play Services, Play Store and rebooting afterwards.

Thanks for the advice. But we would like to know if magisk 26.4 is required or magisk delta can do the trick as well.
As the original magisk can't block the banking app and it is still being detected rooted with some banking apps, but delta can hide it.

Regarding the OP instruction, does it mean I need to remove the TWRP from the system or leave it there and then follow the rest of steps?

By the way, the Play integrity fix v13 module may affect some gaming app, like pikamin bloom (It will stuck on the loading page), so I am wondering if I can also add the unsf mod version (Universal Safety Net v 2.4.0-mod 2.0) on the rebuild stable rom.