[TUTORIAL] Fix SafetyNet issues with Magisk (also CTS profile match)


RainerReinfall

Members
Sep 3, 2020
42
20
I did it a few hours ago on my Mi 10 Ultra. Due to the many questions, I'm publishing here a fixed tutorial, how it worked for me!
Please share your results below.

____________

Install Magisk:
1. Download and install Magisk Manager » MagiskManager-v8.0.4.apk

Step 2:
2A. Download and install Magisk-v21.2.zip » Magisk-v21.2.zip
2B_1. Download Magisk_11.zip and Magisk-v21.2.zip, put these two files in the root of your phone storage
2B_2. Boot to TWRP and install Magisk_11.zip first, then Magisk-v21.2.zip directly after

3. Reboot your device

Installing and setting up the modules:
4. Open Magisk Manager and go the "Module" page. There you have to install "Busybox for Android NDK" first, then "MagiskHide Props Config" afterwards.
5. Reboot your device
6. Download and install Termux from Google Play
7. Type "su" hit enter,
8. Open up Termux and grant root/superuser access.
9. then the "props" command and hit enter
10. After MagiskHide-Props loaded successfully, type "2" to choose "Force BASIC key attestation"
11. Type "y" and hit enter for activating the option.
12. Type "y" and hit enter to reboot your phone.

Hide your Magisk (get Google Pay etc. working):
13. Enable your app installation over USB in your developer settings on your phone.
14. Go into your Magisk Manager Settings and click "Hide Magisk" under the "Manager" category, there enter an alternative name for your Magisk. (I choose "Manager")
15. After installing the hidden Magisk manager, go into its settings and enable "MagiskHide" under the "Magisk" category.

(16. If it doesn't work until now, clear data of Google Play, Google Play Services and Google Service Framework.)

Now you're done! SafetyNet should pass now at BASIC level. The most banking Apps as well as Google Pay should work!
Your Widevine level should also stay at the same level as before (L1 in my case).

____________

This tutorial contains parts of @Poney70's tutorial. It didn't work for me, so this is the whole way it worked for me!
Big thanks and props to him!
| Latest Update: 4th Jan 2021
 
Last edited:
Changed the mistake with the version.

Google Pay tested 30 minutes ago in a store.
Works fine!
42c72308125a0e2777d964182fb4e980.jpg
58d7e37c3b8bde41986c8dafdd5201a7.jpg
 
I did it a few hours ago on my Mi 10 Ultra. Due to the many questions, I'm publishing here a fixed tutorial, how it worked for me!

Hi, I have followed your steps exactly to the letter, on the latest xiaomi.eu ROM, and it doesn't work: attestation passes but there is still a CTS profile mismatch, and Google Pay won't work. Could you suggest why that might be?
 
Hi, I have followed your steps exactly to the letter, on the latest xiaomi.eu ROM, and it doesn't work: attestation passes but there is still a CTS profile mismatch, and Google Pay won't work. Could you suggest why that might be?
Change props in force attestation to basic for another smartphone model (e. g. Mi 10 Global) and then clear cache and data of GMS and Google Pay. Restart phone. It should work for you.

Sent from my Mi Ultra via Tapatalk
 
  • Like
Reactions: s3axel and Adam_W
Can confirm this is working 100% thank you so much!
 

Attachments

  • Screenshot_2020-11-25-15-04-49-082_com.google.android.gms.jpg
    Screenshot_2020-11-25-15-04-49-082_com.google.android.gms.jpg
    271.6 KB · Views: 779
  • Screenshot_2020-11-25-14-41-58-680_org.freeandroidtools.safetynettest.jpg
    Screenshot_2020-11-25-14-41-58-680_org.freeandroidtools.safetynettest.jpg
    229.2 KB · Views: 853
  • Screenshot_2020-11-25-14-41-30-838_r.mcheqm.zabvfzwn.jpg
    Screenshot_2020-11-25-14-41-30-838_r.mcheqm.zabvfzwn.jpg
    125.4 KB · Views: 728
Change props in force attestation to basic for another smartphone model (e. g. Mi 10 Global) and then clear cache and data of GMS and Google Pay. Restart phone. It should work for you.

Sent from my Mi Ultra via Tapatalk
Thank you, that worked!
 
  • Like
Reactions: Zencooler
Change props in force attestation to basic for another smartphone model (e. g. Mi 10 Global) and then clear cache and data of GMS and Google Pay. Restart phone. It should work for you.

Sent from my Mi Ultra via Tapatalk
Thanks for this added info (and of course for the great tutorial to start with!), specifically the clearing of cache & data for GMS did the trick for me, finally have a working gpay!

Gesendet von meinem Mi 10 Ultra mit Tapatalk
 
I did it a few hours ago on my Mi 10 Ultra. Due to the many questions, I'm publishing here a fixed tutorial, how it worked for me!
Please share your results below.
My result:
It works but...
I follow all the steps (I mean all of them - Thermux, different mods and commands I don't understand, and lots of reboots) and I get a valid result if I check Safetynet.
But my bank-app detects the root. Yes, I can call them and give them the device id and unblock the access but you said we should share our results.
I do not trust GooglePay with my card data (not this data too... They know a lot about me already) so I cannot confirm if it works.

The only thing I did not do is to delete the TWRP folder (I've seen once a post somewhere mentioning that as a way of detecting rooted devices). Maybe I'll just rename the folder, not delete it.

Sent from my MI 8 using Tapatalk
 
Tried again on latest MIUI Weekly release and it's no longer working. Can I get a confirmation on this? I need to know if I'm doing something wrong or something changed with the last weeks release. Thanks
 
My result:
It works but...
I follow all the steps (I mean all of them - Thermux, different mods and commands I don't understand, and lots of reboots) and I get a valid result if I check Safetynet.
But my bank-app detects the root. Yes, I can call them and give them the device id and unblock the access but you said we should share our results.
I do not trust GooglePay with my card data (not this data too... They know a lot about me already) so I cannot confirm if it works.

The only thing I did not do is to delete the TWRP folder (I've seen once a post somewhere mentioning that as a way of detecting rooted devices). Maybe I'll just rename the folder, not delete it.

Sent from my MI 8 using Tapatalk
You have to hide root in the Magisk Manager for your banking apps.
 
Tried again on latest MIUI Weekly release and it's no longer working. Can I get a confirmation on this? I need to know if I'm doing something wrong or something changed with the last weeks release. Thanks
Still working. What exactly is the error you get?
 
Still working. What exactly is the error you get?
Yeah...magisk manager hide wasn't working. I had to uninstall magisk manager every time I used the banking app. Finally had the courage to do a full wipe and format and everything seems to be working fine now. Must've been something I've done. Important thing is everything is up and running now. Thanks for the reply
 
Yeah...magisk manager hide wasn't working. I had to uninstall magisk manager every time I used the banking app. Finally had the courage to do a full wipe and format and everything seems to be working fine now. Must've been something I've done. Important thing is everything is up and running now. Thanks for the reply
Working even without Magisk?
 
Working even without Magisk?
Yes....most banking apps look for twrp folder and magisk manager installed. My problem was that safety net passed but magisk hide manager option didn't do anything. Most apps were seeing that os was modified even is you used the hide manager option and manager was renamed. Most custom roms have this issue. So the only option left was uninstalling the manager...root was still working even if you uninstall it.
 
I am on android 11. Can i just install the newest magisk? Why do we have to install the older one first?
 
I did it a few hours ago on my Mi 10 Ultra. Due to the many questions, I'm publishing here a fixed tutorial, how it worked for me!
Please share your results below.

____________

Install Magisk:
1. Download and install Magisk Manager » MagiskManager-v8.0.4.apk

Step 2:
2A. Download and install Magisk-v21.2.zip » Magisk-v21.2.zip
2B_1. Download Magisk_11.zip and Magisk-v21.2.zip, put these two files in the root of your phone storage
2B_2. Boot to TWRP and install Magisk_11.zip first, then Magisk-v21.2.zip directly after

3. Reboot your device

Installing and setting up the modules:
4. Open Magisk Manager and go the "Module" page. There you have to install "Busybox for Android NDK" first, then "MagiskHide Props Config" afterwards.
5. Reboot your device
6. Download and install Termux from Google Play
7. Type "su" hit enter,
8. Open up Termux and grant root/superuser access.
9. then the "props" command and hit enter
10. After MagiskHide-Props loaded successfully, type "2" to choose "Force BASIC key attestation"
11. Type "y" and hit enter for activating the option.
12. Type "y" and hit enter to reboot your phone.

Hide your Magisk (get Google Pay etc. working):
13. Enable your app installation over USB in your developer settings on your phone.
14. Go into your Magisk Manager Settings and click "Hide Magisk" under the "Manager" category, there enter an alternative name for your Magisk. (I choose "Manager")
15. After installing the hidden Magisk manager, go into its settings and enable "MagiskHide" under the "Magisk" category.

(16. If it doesn't work until now, clear data of Google Play, Google Play Services and Google Service Framework.)

Now you're done! SafetyNet should pass now at BASIC level. The most banking Apps as well as Google Pay should work!
Your Widevine level should also stay at the same level as before (L1 in my case).

____________

This tutorial contains parts of @Poney70's tutorial. It didn't work for me, so this is the whole way it worked for me!
Big thanks and props to him!
| Latest Update: 4th Jan 2021
On Mi 9 Pro android 10, I followed all the instructions, but now Magisk is definitely hidden, I cannot find it anymore so I cannot have anymore access to settings on Magisk Manager. SafetyNet Passed with success, Basic Integrity, CTS Profile Match and Response Signature Verification.
How can I get back Magisk Manager and access to my settings?