[TUTORIAL] Fix SafetyNet issues with Magisk (also CTS profile match)

[RainerReinfall]

I did it a few hours ago on my Mi 10 Ultra. Due to the many questions, I'm publishing here a fixed tutorial, how it worked for me!
Please share your results below.

____________

Install Magisk:
1. Download and install Magisk Manager » MagiskManager-v8.0.4.apk

Step 2:

Spoiler: Android 9/10 ROMS only

2A. Download and install Magisk-v21.2.zip » Magisk-v21.2.zip

Spoiler: Android 11 ROMS only

2B_1. Download Magisk_11.zip and Magisk-v21.2.zip, put these two files in the root of your phone storage
2B_2. Boot to TWRP and install Magisk_11.zip first, then Magisk-v21.2.zip directly after

3. Reboot your device

Installing and setting up the modules:
4. Open Magisk Manager and go the "Module" page. There you have to install "Busybox for Android NDK" first, then "MagiskHide Props Config" afterwards.
5. Reboot your device
6. Download and install Termux from Google Play
7. Type "su" hit enter,
8. Open up Termux and grant root/superuser access.
9. then the "props" command and hit enter
10. After MagiskHide-Props loaded successfully, type "2" to choose "Force BASIC key attestation"
11. Type "y" and hit enter for activating the option.
12. Type "y" and hit enter to reboot your phone.

Hide your Magisk (get Google Pay etc. working):
13. Enable your app installation over USB in your developer settings on your phone.
14. Go into your Magisk Manager Settings and click "Hide Magisk" under the "Manager" category, there enter an alternative name for your Magisk. (I choose "Manager")
15. After installing the hidden Magisk manager, go into its settings and enable "MagiskHide" under the "Magisk" category.

(16. If it doesn't work until now, clear data of Google Play, Google Play Services and Google Service Framework.)

Now you're done! SafetyNet should pass now at BASIC level. The most banking Apps as well as Google Pay should work!
Your Widevine level should also stay at the same level as before (L1 in my case).

____________

This tutorial contains parts of @Poney70's tutorial. It didn't work for me, so this is the whole way it worked for me!
Big thanks and props to him! | Latest Update: 4th Jan 2021

 

[someonenotyou]

Is it ANDROID 9/10 and ANDROID 11/12, or is it MIUI 9/10 and MIUI 11/12?

 

[Poney70]

Is it ANDROID 9/10 and ANDROID 11/12, or is it MIUI 9/10 and MIUI 11/12?

It is ANDROID 9/10 and ANDROID 11 (12 doesn't even exist yet... but it's not a dramatic mistake. ^^).

 

[RainerReinfall]

Changed the mistake with the version.

Google Pay tested 30 minutes ago in a store.
Works fine!

 

[Poney70]

@RainerReinfall You forgot this in your tutorial: Between step 6 and 7, you have to type "su" and grant root access to Termux before typing "props".

 

[Adam_W]

I did it a few hours ago on my Mi 10 Ultra. Due to the many questions, I'm publishing here a fixed tutorial, how it worked for me!

Hi, I have followed your steps exactly to the letter, on the latest xiaomi.eu ROM, and it doesn't work: attestation passes but there is still a CTS profile mismatch, and Google Pay won't work. Could you suggest why that might be?

 

[Zencooler]

Hi, I have followed your steps exactly to the letter, on the latest xiaomi.eu ROM, and it doesn't work: attestation passes but there is still a CTS profile mismatch, and Google Pay won't work. Could you suggest why that might be?

Change props in force attestation to basic for another smartphone model (e. g. Mi 10 Global) and then clear cache and data of GMS and Google Pay. Restart phone. It should work for you.

Sent from my Mi Ultra via Tapatalk

 

[Mox20]

Can confirm this is working 100% thank you so much!

 

[Adam_W]

Change props in force attestation to basic for another smartphone model (e. g. Mi 10 Global) and then clear cache and data of GMS and Google Pay. Restart phone. It should work for you.

Sent from my Mi Ultra via Tapatalk

Thank you, that worked!

 

[azad113]

Do I need root for this?

 

[Zencooler]

Do I need root for this?

Yes of course.

Sent from my Mi Ultra via Tapatalk

 

[RainerReinfall]

Do I need root for this?

Yes, rooting is part of the tutorial.

 

[s3axel]

Change props in force attestation to basic for another smartphone model (e. g. Mi 10 Global) and then clear cache and data of GMS and Google Pay. Restart phone. It should work for you.

Sent from my Mi Ultra via Tapatalk

Thanks for this added info (and of course for the great tutorial to start with!), specifically the clearing of cache & data for GMS did the trick for me, finally have a working gpay!

Gesendet von meinem Mi 10 Ultra mit Tapatalk

 

[DTTR76]

I did it a few hours ago on my Mi 10 Ultra. Due to the many questions, I'm publishing here a fixed tutorial, how it worked for me!
Please share your results below.

My result:
It works but...
I follow all the steps (I mean all of them - Thermux, different mods and commands I don't understand, and lots of reboots) and I get a valid result if I check Safetynet.
But my bank-app detects the root. Yes, I can call them and give them the device id and unblock the access but you said we should share our results.
I do not trust GooglePay with my card data (not this data too... They know a lot about me already) so I cannot confirm if it works.

The only thing I did not do is to delete the TWRP folder (I've seen once a post somewhere mentioning that as a way of detecting rooted devices). Maybe I'll just rename the folder, not delete it.

Sent from my MI 8 using Tapatalk

 

[Catani84]

Tried again on latest MIUI Weekly release and it's no longer working. Can I get a confirmation on this? I need to know if I'm doing something wrong or something changed with the last weeks release. Thanks

 

[RainerReinfall]

My result:
It works but...
I follow all the steps (I mean all of them - Thermux, different mods and commands I don't understand, and lots of reboots) and I get a valid result if I check Safetynet.
But my bank-app detects the root. Yes, I can call them and give them the device id and unblock the access but you said we should share our results.
I do not trust GooglePay with my card data (not this data too... They know a lot about me already) so I cannot confirm if it works.

The only thing I did not do is to delete the TWRP folder (I've seen once a post somewhere mentioning that as a way of detecting rooted devices). Maybe I'll just rename the folder, not delete it.

Sent from my MI 8 using Tapatalk

You have to hide root in the Magisk Manager for your banking apps.

 

[RainerReinfall]

Tried again on latest MIUI Weekly release and it's no longer working. Can I get a confirmation on this? I need to know if I'm doing something wrong or something changed with the last weeks release. Thanks

Still working. What exactly is the error you get?

 

[Catani84]

Still working. What exactly is the error you get?

Yeah...magisk manager hide wasn't working. I had to uninstall magisk manager every time I used the banking app. Finally had the courage to do a full wipe and format and everything seems to be working fine now. Must've been something I've done. Important thing is everything is up and running now. Thanks for the reply

 

[RainerReinfall]

Yeah...magisk manager hide wasn't working. I had to uninstall magisk manager every time I used the banking app. Finally had the courage to do a full wipe and format and everything seems to be working fine now. Must've been something I've done. Important thing is everything is up and running now. Thanks for the reply

Working even without Magisk?

 

[Catani84]

Working even without Magisk?

Yes....most banking apps look for twrp folder and magisk manager installed. My problem was that safety net passed but magisk hide manager option didn't do anything. Most apps were seeing that os was modified even is you used the hide manager option and manager was renamed. Most custom roms have this issue. So the only option left was uninstalling the manager...root was still working even if you uninstall it.

 

[donger]

I am on android 11. Can i just install the newest magisk? Why do we have to install the older one first?

 

[RainerReinfall]

I am on android 11. Can i just install the newest magisk? Why do we have to install the older one first?

I think that it should work. But I haven't tested it.

 

[xMarvin732]

after flashing the Mi10T Lite Xiaomi eu stable i get "CTS profile match: fail "

What can i do?

EDIT:
worked, set it to Mi10 Europe, fingerprint and BASIC key

 

[donger]

Damn dude everything just worked, great tutorial...

I think that it should work. But I haven't tested it.

confirming it works, you can update the steps if u want

 

[Ahaba]

I did it a few hours ago on my Mi 10 Ultra. Due to the many questions, I'm publishing here a fixed tutorial, how it worked for me!
Please share your results below.

____________

Install Magisk:
1. Download and install Magisk Manager » MagiskManager-v8.0.4.apk

Step 2:

Spoiler: Android 9/10 ROMS only

2A. Download and install Magisk-v21.2.zip » Magisk-v21.2.zip

Spoiler: Android 11 ROMS only

2B_1. Download Magisk_11.zip and Magisk-v21.2.zip, put these two files in the root of your phone storage
2B_2. Boot to TWRP and install Magisk_11.zip first, then Magisk-v21.2.zip directly after

3. Reboot your device

Installing and setting up the modules:
4. Open Magisk Manager and go the "Module" page. There you have to install "Busybox for Android NDK" first, then "MagiskHide Props Config" afterwards.
5. Reboot your device
6. Download and install Termux from Google Play
7. Type "su" hit enter,
8. Open up Termux and grant root/superuser access.
9. then the "props" command and hit enter
10. After MagiskHide-Props loaded successfully, type "2" to choose "Force BASIC key attestation"
11. Type "y" and hit enter for activating the option.
12. Type "y" and hit enter to reboot your phone.

Hide your Magisk (get Google Pay etc. working):
13. Enable your app installation over USB in your developer settings on your phone.
14. Go into your Magisk Manager Settings and click "Hide Magisk" under the "Manager" category, there enter an alternative name for your Magisk. (I choose "Manager")
15. After installing the hidden Magisk manager, go into its settings and enable "MagiskHide" under the "Magisk" category.

(16. If it doesn't work until now, clear data of Google Play, Google Play Services and Google Service Framework.)

Now you're done! SafetyNet should pass now at BASIC level. The most banking Apps as well as Google Pay should work!
Your Widevine level should also stay at the same level as before (L1 in my case).

____________

This tutorial contains parts of @Poney70's tutorial. It didn't work for me, so this is the whole way it worked for me!
Big thanks and props to him! | Latest Update: 4th Jan 2021

On Mi 9 Pro android 10, I followed all the instructions, but now Magisk is definitely hidden, I cannot find it anymore so I cannot have anymore access to settings on Magisk Manager. SafetyNet Passed with success, Basic Integrity, CTS Profile Match and Response Signature Verification.
How can I get back Magisk Manager and access to my settings?