SafetyNet started failing #482

ArchangeGabriel · 2018-02-05T13:54:38Z

Somewhere around friday morning, SafetyNet started failing (CTS Profile match: false, but Basic Integrity: true). I have not changed anything on my device (OP5T, OmniROM, no root or whatsoever) between the time it worked and the time it stopped working, and I’ve tested on my old phone (OPO) on which it does not work either (but I had to reinstall on OmniROM on it and it has also Basic Integrity: false).

Is anyone else confirming? If not, what should I look for? If yes, I suppose this is due to some DroidGuard update that now detects μG?

The text was updated successfully, but these errors were encountered:

n76 · 2018-02-05T14:54:00Z

Last I checked SafetyNet on my phone it passed. When I saw your issue posted, I tried again and I am now getting the same CTS profile match fail result as you. To the best of my knowledge, nothing on my phone that should affect SafetyNet has changed (same versions/builds of Android, microG, etc.) So I can confirm your issue.

ArchangeGabriel · 2018-02-05T17:53:11Z

OK, since I’ve seen no sign of such an issue on forum of Magisk users for instance, I suppose this is quite μG specific. So we will have to wait for @mar-v-in to take a look at it.

ale5000-git · 2018-02-07T01:05:03Z

It isn't a problem with microG but more likely with the ROM.
I currently pass SafetyNet completely.

An official LineageOS ROM usually pass SafetyNet while an unofficial one may not pass it (for example because isn't signed).

But there may be additional problems:

If you install root (even if disabled) your device may not pass SafetyNet, you may be able to hide it but an update to SafetyNet may break you
If your device support verified boot (and if it fail because you have installed a custom ROM) your device may not pass SafetyNet (until you patch the ROM to simulate the missing support for it)
If you install Xposed or Magisk your device may not pass SafetyNet (if it isn't hidden to SafetyNet); patching the ROM for signature spoofing can't be detected by SafetyNet

n76 · 2018-02-07T01:15:49Z

@ale5000-git - None of you points explains my situation: SafetyNet test passed a few weeks ago and doesn't pass now. No change in my ROM, microG, etc.

I don't have root installed.
Not sure if the phone supports verified boot or not, but it hasn't changed.
I don't have Xposed, Magisk or other equivalent software installed.

ale5000-git · 2018-02-07T01:23:11Z

@n76
Have you done any OTA update?
Have you flashed any ZIP?
I'm not sure but everything can possible break it.

I suggest to try a full wipe to be sure that it isn't a "casual" problem.

The problem may also depend on how you install microG.
My flashable zip also mimic the filenames of real GApps (in some parts), I don't think it matter but just in case.

n76 · 2018-02-07T02:46:24Z

@ale5000-git
I switched from installing microG into a "normal" distribution to using Lineage with microG. So the only ZIP I've been flashing is the one for my phone from the downloads page.

I do have F-Droid set up with the microG repository and assure that I've the latest versions from that installed. (Signature for microG is the same on the ROM and repository so there is no issue with updating from the repository.)

ArchangeGabriel · 2018-02-07T11:19:36Z

@ale5000-git It’s way worse than that, I had it working before going to sleep but not when waking up ~8 hours later. Absolutely nothing has changed between those two attempts, the only thing the phone did during this time is… nothing. It was in airplane mode, and that’s all. Not even used it for alarm.

As stated above, I have no root, no Magisk, no Xposed, nothing. Just using official OmniROM. I have two affected phones, a OnePlus One, on which I’m going to try a clean flash (OmniROM and then LineageOS4uG to check), and that does not support verified boot, and a OnePlus 5T, that does support verified boot but of course verified boot is currently disabled because OmniROM, but the important point is that is was working literally just before, so even if not everyone is affected, this is definitively a change in DroidGuard.

So, what we need to figure out is what are the condition for SafetyNet to be tripped, and how to solve it.

@ale5000-git @n76 What ROM are you using (and eventually device)?

ale5000-git · 2018-02-07T11:56:23Z

SafetyNet fail also if you haven't an internet connection (maybe it fail also if it is inconstant).
Probably also if the firewall block it.

@ArchangeGabriel: Official LineageOS 14.1 on Galaxy S2 + microG unofficial installer.

ArchangeGabriel · 2018-02-07T12:02:41Z

I had an internet connection of course, I was just saying it was in airplane mode in the eight hours span during my two trials.

I’ll try the LineageOS4uG right now on my OPO.

ArchangeGabriel · 2018-02-07T13:58:49Z

Does not work either with LineageOS for uG on OPO:

02-07 14:57:52.050 10063 10063 D SafetyNetHelperSAMPLE: SafetyNet start request
02-07 14:57:52.054  4671  5210 D AudioService: Stream muted, skip playback
02-07 14:57:52.056 10063 10063 D SafetyNetHelper: apkCertificateDigests:[MZNsDhz8VAJMmFxPPso38ZRvZE6r7VIyzUqypkakG8E=]
02-07 14:57:52.101 10063 10063 D SafetyNetHelper: apkDigest:ETDTA7RlBujNlWPPrqXoNjm5jFhIzrCa/XwnUIWh6GM=
02-07 14:57:52.108  9034  9046 D SafeParcel: Unknown field num 9 in com.google.android.gms.common.internal.GetServiceRequest, skipping.
02-07 14:57:52.108  9034  9046 D GmsSafetyNetClientSvc: bound by: GetServiceRequest{serviceId=SAFETY_NET_CLIENT, gmsVersion=10084000, packageName='com.scottyab.safetynet.sample', extras=Bundle[{}]}
02-07 14:57:52.117 10063 10063 V SafetyNetHelper: Google play services connected
02-07 14:57:52.117 10063 10063 V SafetyNetHelper: running SafetyNet.API Test
02-07 14:57:52.163 10300 10337 W GmsDroidguardHelper: 
02-07 14:57:52.163 10300 10337 W GmsDroidguardHelper: java.lang.NoSuchFieldException: BUILD
02-07 14:57:52.163 10300 10337 W GmsDroidguardHelper: 	at java.lang.Class.getField(Class.java:1549)
02-07 14:57:52.163 10300 10337 W GmsDroidguardHelper: 	at org.microg.gms.droidguard.DroidguardHelper.createSystemInfoPair(DroidguardHelper.java:169)
02-07 14:57:52.163 10300 10337 W GmsDroidguardHelper: 	at org.microg.gms.droidguard.DroidguardHelper.getSystemInfo(DroidguardHelper.java:117)
02-07 14:57:52.163 10300 10337 W GmsDroidguardHelper: 	at org.microg.gms.droidguard.DroidguardHelper.guard(DroidguardHelper.java:64)
02-07 14:57:52.163 10300 10337 W GmsDroidguardHelper: 	at org.microg.gms.droidguard.RemoteDroidGuardService$1$1.run(RemoteDroidGuardService.java:23)
02-07 14:57:52.163 10300 10337 W GmsDroidguardHelper: 	at java.lang.Thread.run(Thread.java:761)
02-07 14:57:52.174 10300 10337 D GmsDroidguardHelper: -- Request --
02-07 14:57:52.174 10300 10337 D GmsDroidguardHelper: DGRequest{usage=DGUsage{type=attest, packageName=com.google.android.gms}, info=[KeyValuePair{key=BUILD, val=unknown}, KeyValuePair{key=BOARD, val=MSM8974}, KeyValuePair{key=BOOTLOADER, val=unknown}, KeyValuePair{key=BRAND, val=oneplus}, KeyValuePair{key=CPU_ABI, val=armeabi-v7a}, KeyValuePair{key=CPU_ABI2, val=armeabi}, KeyValuePair{key=DEVICE, val=A0001}, KeyValuePair{key=DISPLAY, val=bacon-userdebug 7.1.2 NJH47F 20180205 dev-keys}, KeyValuePair{key=FINGERPRINT, val=oneplus/bacon/A0001:6.0.1/MHC19Q/ZNH2KAS1KN:user/release-keys}, KeyValuePair{key=HARDWARE, val=bacon}, KeyValuePair{key=HOST, val=2d89f046753e}, KeyValuePair{key=ID, val=NJH47F}, KeyValuePair{key=MANUFACTURER, val=OnePlus}, KeyValuePair{key=MODEL, val=A0001}, KeyValuePair{key=PRODUCT, val=bacon}, KeyValuePair{key=RADIO, val=DI.3.0.c6-00241-M8974AAAAANAZM-1}, KeyValuePair{key=SERIAL, val=f9803a9}, KeyValuePair{key=TAGS, val=dev-keys}, KeyValuePair{key=TIME, val=1517798491000}, KeyValuePair{key=TYPE, val=user}, KeyValuePair{key=USER, val=root}, KeyValuePair{key=CODENAME, val=REL}, KeyValuePair{key=INCREMENTAL, val=216677e7a7}, KeyValuePair{key=RELEASE, val=7.1.2}, KeyValuePair{key=SDK, val=25}, KeyValuePair{key=SDK_INT, val=25}], versionNamePrefix=9.6.83 (430-, isGoogleCn=false, enableInlineVm=true, cached=[ByteString[size=20 md5=2b8833acccb8fe7894f463bbf3f7bebc]], currentVersion=3, arch=armv7l}
02-07 14:57:52.248 10300 10337 D GmsDroidguardHelper: Using cached file from /data/user/0/org.microg.gms.droidguard/app_dg_cache/2f2dbd0fd341afc7d36bd44feff6262c66a35639/the.apk
02-07 14:57:52.352 10337 10337 W Thread-3: type=1400 audit(0.0:38): avc: denied { read } for name="net" dev="sysfs" ino=7030 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:sysfs:s0 tclass=dir permissive=0
02-07 14:57:52.478 10300 10337 D SysHook : Replaced TreeSet with specially designed version
02-07 14:57:52.489 10337 10337 W Thread-3: type=1400 audit(0.0:39): avc: denied { read } for name="/" dev="rootfs" ino=1 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=0
02-07 14:57:52.489 10337 10337 W Thread-3: type=1400 audit(0.0:40): avc: denied { read } for name="/" dev="rootfs" ino=1 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=0
02-07 14:57:52.492 10337 10337 W Thread-3: type=1400 audit(0.0:41): avc: denied { read } for name="/" dev="rootfs" ino=1 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:rootfs:s0 tclass=dir permissive=0
02-07 14:57:52.507 10300 10337 D GmsDroidguardHelper: b -> 0
02-07 14:57:52.549 10337 10337 W Thread-3: type=1400 audit(0.0:42): avc: denied { read } for name="/" dev="tmpfs" ino=6826 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=0
02-07 14:57:52.555 10300 10337 D GmsDroidguardHelper: c -> com.google.android.gms
02-07 14:57:52.603 10063 10063 D SafetyNetResponse: decodedJWTPayload json:{"nonce":"XWXaPgdZ9jZ9CfhZ7PDafjdGqa3P3khg9RF6ilEKz/g=","timestampMs":1518011872587,"ctsProfileMatch":false,"apkCertificateDigestSha256":[],"basicIntegrity":false,"advice":"RESTORE_TO_FACTORY_ROM"}
02-07 14:57:52.603 10063 10063 D SafetyNetHelperSAMPLE: SafetyNet req success: ctsProfileMatch:false and basicIntegrity, false

ArchangeGabriel · 2018-02-07T14:42:41Z

@ale5000-git Could you post a working logcat for comparison? I’m wondering whether there is an issue with BUILD.

n76 · 2018-02-07T20:19:33Z

@ArchangeGabriel I am currently running lineage-14.1-20180117-microG-harpia.zip downloaded from https://download.lineage.microg.org/harpia/ on my Moto G4 Play (XT1607 RETUS). That particular build is no longer in that directory. It is probably time for me to upgrade to a February build to get the latest security updates. . .

ArchangeGabriel · 2018-02-07T22:10:16Z

@n76 February patches are not in yet. Anyway, we have both OmniROM and LineageOS-uG affected on three different devices, all of them without root and regarding my OnePlus One even with clean flashing.

ale5000-git · 2018-02-07T23:01:37Z

[ 02-07 23:49:17.516 13759:13759 V/c        ]
running SafetyNet.API Test

[ 02-07 23:49:17.665  2359:12891 I/ActivityManager ]
Start proc 13799:com.google.android.gms.unstable/u0a33 for service org.microg.gms.droidguard/.RemoteDroidGuardService

[ 02-07 23:49:17.790 13799:13799 I/art      ]
Starting a blocking GC AddRemoveAppImageSpace

[ 02-07 23:49:17.791 13799:13799 W/System   ]
ClassLoader referenced unknown path: /system/priv-app/DroidGuard/lib/arm

[ 02-07 23:49:17.845 13799:13814 D/libEGL   ]
loaded /system/lib/egl/libEGL_mali.so

[ 02-07 23:49:17.862 13799:13814 D/libEGL   ]
loaded /system/lib/egl/libGLESv1_CM_mali.so

[ 02-07 23:49:17.907 13799:13815 D/NetworkSecurityConfig ]
No Network Security Config specified, using platform default

[ 02-07 23:49:17.910 13799:13815 W/System   ]
ClassLoader referenced unknown path: /system/framework/tcmclient.jar

[ 02-07 23:49:17.923 13799:13814 D/libEGL   ]
loaded /system/lib/egl/libGLESv2_mali.so

[ 02-07 23:49:17.948 13799:13815 D/GmsDroidguardHelper ]
-- Request --
DGRequest{usage=DGUsage{type=attest, packageName=com.google.android.gms}, info=[KeyValuePair{key=BOARD, val=smdk4210}, KeyValuePair{key=BOOTLOADER, val=unknown}, KeyValuePair{key=BRAND, val=Samsung}, KeyValuePair{key=CPU_ABI, val=armeabi-v7a}, KeyValuePair{key=CPU_ABI2, val=armeabi}, KeyValuePair{key=DEVICE, val=GT-I9100}, KeyValuePair{key=DISPLAY, val=lineage_i9100-userdebug 7.1.2 NJH47F d671ee8657}, KeyValuePair{key=FINGERPRINT, val=samsung/GT-I9100/GT-I9100:4.1.2/JZO54K/I9100XWMS2:user/release-keys}, KeyValuePair{key=HARDWARE, val=smdk4210}, KeyValuePair{key=HOST, val=agrippa.acc.umu.se}, KeyValuePair{key=ID, val=NJH47F}, KeyValuePair{key=MANUFACTURER, val=samsung}, KeyValuePair{key=MODEL, val=GT-I9100}, KeyValuePair{key=PRODUCT, val=GT-I9100}, KeyValuePair{key=RADIO, val=unknown}, KeyValuePair{key=SERIAL, val=000980d34f3d7f}, KeyValuePair{key=TAGS, val=release-keys}, KeyValuePair{key=TIME, val=1516797199000}, KeyValuePair{key=TYPE, val=user}, KeyValuePair{key=USER, val=jenkins}, KeyValuePair{key=CODENAME, val=REL}, KeyValuePair{key=INCREMENTAL, val=d671ee8657}, KeyValuePair{key=RELEASE, val=7.1.2}, KeyValuePair{key=SDK, val=25}, KeyValuePair{key=SDK_INT, val=25}], versionNamePrefix=10.0.84 (430-, isGoogleCn=false, enableInlineVm=true, cached=[ByteString[size=20 md5=cb4e88399f46561c5af157eef491ee0c], ByteString[size=20 md5=2b8833acccb8fe7894f463bbf3f7bebc]], currentVersion=3, arch=armv7l}

[ 02-07 23:49:19.641 13799:13815 D/GmsDroidguardHelper ]
Using provided response data for /data/user/0/org.microg.gms.droidguard/app_dg_cache/980ab1b823cbef217c920c908d508455788d5b2c.apk

[ 02-07 23:49:19.859 13822:13822 I/dex2oat  ]
/system/bin/dex2oat --dex-file=/data/user/0/org.microg.gms.droidguard/app_dg_cache/980ab1b823cbef217c920c908d508455788d5b2c/the.apk --oat-fd=37 --oat-location=/data/user/0/org.microg.gms.droidguard/app_dg_cache/980ab1b823cbef217c920c908d508455788d5b2c/opt/the.dex --compiler-filter=speed

[ 02-07 23:49:19.859 13822:13822 E/cutils-trace ]
Error opening trace file: No such file or directory (2)

[ 02-07 23:49:20.289 13822:13822 I/dex2oat  ]
dex2oat took 432.512ms (threads: 2) arena alloc=312KB (319600B) java alloc=70KB (72096B) native alloc=493KB (505616B) free=1554KB (1591536B)

[ 02-07 23:49:20.427  1987: 2063 D/Yamaha-MC1N2-Audio ]
yamaha_mc1n2_audio_output_stop()

[ 02-07 23:49:20.427  1987: 2063 D/Yamaha-MC1N2-Audio ]
yamaha_mc1n2_audio_route_start()

[ 02-07 23:49:20.577 13799:13815 D/GmsDroidguardHelper ]
c -> com.google.android.gms

[ 02-07 23:49:20.581 13799:13815 D/GmsDroidguardHelper ]
b -> 4136736405143157405

[ 02-07 23:49:20.593 13815:13815 W/Thread-2 ]
type=1400 audit(0.0:893): avc: denied { search } for name="1986" dev=proc ino=36092 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:r:zygote:s0 tclass=dir permissive=0

[ 02-07 23:49:20.868 13815:13815 W/Thread-2 ]
type=1400 audit(0.0:894): avc: denied { read } for name="/" dev=tmpfs ino=373 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:device:s0 tclass=dir permissive=0

[ 02-07 23:49:20.890 13799:13815 E/         ]
Device driver API match
Device driver API version: 29
User space API version: 29 

[ 02-07 23:49:20.890 13799:13815 E/         ]
mali: REVISION=Linux-r3p2-01rel3 BUILD_DATE=Tue Jul 22 19:59:34 KST 2014 

[ 02-07 23:49:20.941 13799:13815 D/GmsDroidguardHelper ]
a: [removed] -> [removed]
7=ARM:Mali-400 MP
8=[removed]
9=[removed]

[ 02-07 23:49:21.675 13759:13759 D/d        ]
decodedJWTPayload json:{"nonce":"[removed]","timestampMs":1518043762800,"apkPackageName":"org.freeandroidtools.safetynettest","apkDigestSha256":"[removed]","ctsProfileMatch":true,"apkCertificateDigestSha256":["[removed]"],"basicIntegrity":true}

ale5000-git · 2018-02-07T23:05:39Z

You have scontext=u:r:untrusted_app:s0:c512,c768
instead I have scontext=u:r:priv_app:s0:c512,c768

Try to put both microG GmsCore and DroidGuard Helper in /system/priv-app to fix it.
Also in yours I see advice":"RESTORE_TO_FACTORY_ROM" probably for the same cause.

If it still do not work try the official LineageOS (without microG) and then a flashable microG zip.

n76 · 2018-02-07T23:23:57Z

@ale5000-git Seems you are correct. Doing the following for me gets SafetyNet to pass:

$ adb root
$ adb remount
$ adb push org.microg.gms.droidguard.apk /system/priv-app/
$ adb reboot

I guess I must have upgraded my Lineage with microG after my last successful SafetyNet test. Seems like Lineage with microG ought to install DroidGuard helper along with the other parts of microG.

ArchangeGabriel · 2018-02-08T08:35:54Z

OK, so this did it. Still, it means something changed on DroidGuard side and that it now requires additional rights, which is never good news.

However, I think that Lineage with uG should still not install DroidGuard Helper at all, it’s quite invasive and not needed by everyone.

ArchangeGabriel · 2018-02-08T08:39:29Z

And thank you @ale5000-git for figuring this out.

ale5000-git · 2018-02-08T09:51:25Z

For me it never worked as user app, it is possible you was having DroidGuard Helper as both system and user app and it worked but the OTA update removed the system app.

For me it is fine to have it installed with Lineage with uG since microG GmsCore have it disabled by default, so having it installed doesn't mean anything.

ArchangeGabriel · 2018-02-08T10:40:17Z

No, I’m sure I wasn’t having it as system-app, and also I remind you that nothing happened on my phone between working and non-working state. It was definitively working as user-app, but not anymore. Even GmsCore is not system-app on my system.

That’s right, SafetyNet being disabled by default, having DroidGuard lying somewhere might not be an issue. @corna should have a look at it. ;)

ale5000-git · 2018-02-08T10:49:23Z

On many ROMs you won't get location binding if GmsCore is not a system app.
Beside that being a system app will also reduce problems; if you wipe the phone and you don't remember to install GmsCore before other apps you will have a lot of not-working things.

ArchangeGabriel · 2018-02-08T10:58:33Z

I know, but I use OmniROM so I’m not affected by this first point AFAIK (though I admit having not tried network location with my OnePlus 5T yet, since the GPS works everywhere) and I don’t use GCM so I don’t really need GmsCore to be installed before anything else.

ArchangeGabriel · 2018-02-26T13:25:51Z

It seems that GmsCore must be installed as system-app for network location to work even under OmniROM apparently… Not sure if that is expected or an issue.

Anyway, this mean that every week I have to push back DroidGuard and GmsCore to /system/priv-app after OTA update… Is there a way to make a flashable zip just installing those two components? Because apparently OmniROM OTA can flash zips in a specific folder after update.

Espionage724 · 2018-04-07T10:24:19Z

I built LineageOS with patches to allow location providers outside /system and signature spoofing. I installed microG and DroidGuard as normal apps (non-privileged). SafetyNet works enough to start Pokemon GO (Basic Integrity is true, CTS profile match is false).

When using the LineageOS for microG ROM, SafetyNet fails both checks and Pokemon GO fails to start. This started happening relatively recently. I haven't tried pushing DroidGuard to priv-app.

So it seems DroidGuard has to be installed with GmsCore in the same location (standard apps or privileged) in order to work now?

ale5000-git · 2018-04-07T11:21:24Z

No, it must be installed in privileged app folder due to SELinux.
The position of GmsCore doesn't matter.

ArchangeGabriel · 2018-04-07T11:27:23Z

I’m surprised PoGO works for you with CTS false… Anyway, sometimes DroidGuard as normal app works, but every time it fails, pushing it to /system/priv-app made it work.

ArchangeGabriel · 2018-04-09T08:54:21Z

Less than 30 minutes ago, SafetyNet started failing again. Both LineageOS4μG and OmniROM, with DroidGuard in /system/priv-app. Anyone else confirming?

ArchangeGabriel · 2018-09-29T10:22:40Z

Does your org.microg.gms.droidguard-14.apk include the linked PR? Can you try with https://play.google.com/store/apps/details?id=com.scottyab.safetynet.sample?

jansohn · 2018-09-29T10:58:37Z

Yes, it does. SafetyNet Helper Sample app fails for response validation with error message:

ApiException[14] 14:

I also get an app crash the first time I try it. Retries do not crash the app anymore.

ArchangeGabriel · 2018-09-29T11:00:08Z

OK, that’s an unknown issue to me, sorry.

nyanpasu64 · 2018-09-29T11:03:34Z

Moto g4 plus, LineageMicroG 7.1.

I intermittently got error [14] versus a failed response, not sure what causes it to switch back and forth.

jansohn · 2018-09-29T13:25:11Z

@jimbo1qaz you mean LineageOS for microG 14.1 (Android 7.1), right? I'm still curious if this is working for someone on LineageOS 14.1...

ClearlyClaire · 2018-09-29T13:27:25Z

Fairphone 2 on LineageOS 14.1 (going to switch to 15.1 today) and it seems to work. The SafetyNey helper app returns CTS profile match: false, though, but that doesn't prevent me from playing Pokémon Go (the only other SafetyNet-using thing on my phone) Le 29 septembre 2018 15:25:18 GMT+02:00, jansohn <notifications@github.com> a écrit :

…

@jimbo1qaz you mean LineageOS for microG 14.1 (Android 7.1), right? I'm still curious if this is working for someone on LineageOS 14.1... -- You are receiving this because you commented. Reply to this email directly or view it on GitHub: #482 (comment)

-- Envoyé de mon appareil Android avec Courriel K-9 Mail. Veuillez excuser ma brièveté.

nyanpasu64 · 2018-09-29T13:37:39Z

Moto G4 Plus, LineageOS 14.1 microg edition.

I get "microg droidguard helper has stopped", with or without 0.1.0 as a system app (via my custom unreleased magisk module).

MicroG core is 0.2.6.14280-dirty from Git, with a few local hacks related to gmail.

2018-09-29 06:46:24.733 6846-6880/? E/AndroidRuntime: FATAL EXCEPTION: Thread-2
    Process: com.google.android.gms.unstable, PID: 6846
    java.lang.UnsatisfiedLinkError: dalvik.system.PathClassLoader[DexPathList[[zip file "/system/priv-app/microg-droidguard/org.microg.gms.droidguard-4.apk"],nativeLibraryDirectories=[/system/priv-app/microg-droidguard/lib/arm, /system/fake-libs, /system/priv-app/microg-droidguard/org.microg.gms.droidguard-4.apk!/lib/armeabi-v7a, /system/lib, /vendor/lib, /system/lib, /vendor/lib]]] couldn't find "libarthook_native.so"
        at java.lang.Runtime.loadLibrary0(Runtime.java:984)
        at java.lang.System.loadLibrary(System.java:1562)
        at de.larma.arthook.Native.<clinit>(Native.java:22)
        at de.larma.arthook.Native.is64Bit(Native.java:45)
        at de.larma.arthook.ArtHook.<clinit>(ArtHook.java:46)
        at de.larma.arthook.ArtHook.hook(ArtHook.java:75)
        at org.microg.gms.droidguard.SysHook.activate(SysHook.java:52)
        at org.microg.gms.droidguard.DroidguardHelper.guard(DroidguardHelper.java:91)
        at org.microg.gms.droidguard.RemoteDroidGuardService$1$1.run(RemoteDroidGuardService.java:23)
        at java.lang.Thread.run(Thread.java:761)

apparently my "my custom unreleased magisk module" didn't extract the libs right

I overrode the system droidguard app with 0.1.0-10-gf64bf69, it either spits out 14 immediately, spins for ~15 seconds, before spitting error 14, exactly once I got a failed response.

Sometimes microG itself crashes.

2018-09-29 07:04:49.986 9103-9120/? D/GmsDroidguardHelper: -- Request --
    DGRequest{usage=DGUsage{type=attest, packageName=com.google.android.gms}, info=[KeyValuePair{key=BOARD, val=MSM8952}, KeyValuePair{key=BOOTLOADER, val=0xB107}, KeyValuePair{key=BRAND, val=Motorola}, KeyValuePair{key=CPU_ABI, val=armeabi-v7a}, KeyValuePair{key=CPU_ABI2, val=armeabi}, KeyValuePair{key=DEVICE, val=athene_f}, KeyValuePair{key=DISPLAY, val=lineage_athene-userdebug 7.1.2 NJH47F 20180926 dev-keys}, KeyValuePair{key=FINGERPRINT, val=motorola/athene_f/athene_f:7.0/NPJ25.93-14/16:user/release-keys}, KeyValuePair{key=HARDWARE, val=qcom}, KeyValuePair{key=HOST, val=c8c1cb588aa5}, KeyValuePair{key=ID, val=NJH47F}, KeyValuePair{key=MANUFACTURER, val=Motorola}, KeyValuePair{key=MODEL, val=Moto G4 Plus}, KeyValuePair{key=PRODUCT, val=lineage_athene}, KeyValuePair{key=RADIO, val=unknown}, KeyValuePair{key=SERIAL, val=ZY223X6H5X}, KeyValuePair{key=TAGS, val=release-keys}, KeyValuePair{key=TIME, val=1537928018000}, KeyValuePair{key=TYPE, val=user}, KeyValuePair{key=USER, val=root}, KeyValuePair{key=CODENAME, val=REL}, KeyValuePair{key=INCREMENTAL, val=69b7b8da18}, KeyValuePair{key=RELEASE, val=7.1.2}, KeyValuePair{key=SDK, val=25}, KeyValuePair{key=SDK_INT, val=25}], versionNamePrefix=10.0.84 (430-, isGoogleCn=false, enableInlineVm=true, cached=[], currentVersion=3, arch=armv7l}
2018-09-29 07:04:49.989 468-468/? I/cnss-daemon: RTM_NEWROUTE Indication
2018-09-29 07:04:49.989 468-468/? I/cnss-daemon: ip type is ipv6
2018-09-29 07:04:50.363 9103-9120/? D/GmsDroidguardHelper: Using provided response data for /data/user/0/org.microg.gms.droidguard/app_dg_cache/261a4e4770eb25c279eacce4a0a58cc95056d1a4.apk
2018-09-29 07:04:50.435 9124-9124/? I/dex2oat: /system/bin/dex2oat -j2 --dex-file=/data/user/0/org.microg.gms.droidguard/app_dg_cache/261a4e4770eb25c279eacce4a0a58cc95056d1a4/the.apk --oat-fd=36 --oat-location=/data/user/0/org.microg.gms.droidguard/app_dg_cache/261a4e4770eb25c279eacce4a0a58cc95056d1a4/opt/the.dex --compiler-filter=speed
2018-09-29 07:04:50.591 9124-9124/? I/dex2oat: dex2oat took 156.341ms (threads: 2) arena alloc=196KB (201072B) java alloc=91KB (93520B) native alloc=508KB (520984B) free=1539KB (1576168B)
2018-09-29 07:04:50.852 9103-9120/? D/GmsDroidguardHelper: b -> 4522138061738393361
2018-09-29 07:04:50.858 9103-9120/? D/GmsDroidguardHelper: c -> com.google.android.gms
2018-09-29 07:04:51.087 957-3716/? I/ActivityManager: Process com.google.android.gms.unstable (pid 9103) has died
2018-09-29 07:04:51.088 957-3716/? D/ActivityManager: cleanUpApplicationRecord -- 9103
2018-09-29 07:04:51.088 445-445/? I/Zygote: Process 9103 exited due to signal (11)
2018-09-29 07:04:51.088 957-3716/? W/ActivityManager: Scheduling restart of crashed service org.microg.gms.droidguard/.RemoteDroidGuardService in 1000ms

2018-09-29 07:07:18.922 9128-9497/? A/art: art/runtime/oat_quick_method_header.cc:55] Failed to find Dex offset for PC offset 0x8beb07bb(PC 0x0, entry_point=0x7414f845 current entry_point=0x7414f845) in java.lang.Class java.lang.ClassLoader.loadClass(java.lang.String)
    
    --------- beginning of crash
2018-09-29 07:07:18.923 9128-9497/? A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0x7 in tid 9497 (Thread-2)
2018-09-29 07:07:19.005 9501-9501/? A/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
2018-09-29 07:07:19.006 9501-9501/? A/DEBUG: LineageOS Version: '14.1-20180926-microG-athene'
2018-09-29 07:07:19.006 9501-9501/? A/DEBUG: Build fingerprint: 'motorola/athene_f/athene_f:7.0/NPJ25.93-14/16:user/release-keys'
2018-09-29 07:07:19.006 9501-9501/? A/DEBUG: Revision: '0'
2018-09-29 07:07:19.006 9501-9501/? A/DEBUG: ABI: 'arm'
2018-09-29 07:07:19.006 9501-9501/? A/DEBUG: pid: 9128, tid: 9497, name: Thread-2  >>> com.google.android.gms.unstable <<<
2018-09-29 07:07:19.006 9501-9501/? A/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x7
2018-09-29 07:07:19.011 9501-9501/? A/DEBUG: Abort message: 'art/runtime/oat_quick_method_header.cc:55] Failed to find Dex offset for PC offset 0x8beb07bb(PC 0x0, entry_point=0x7414f845 current entry_point=0x7414f845) in java.lang.Class java.lang.ClassLoader.loadClass(java.lang.String)'
2018-09-29 07:07:19.012 9501-9501/? A/DEBUG:     r0 00000003  r1 00080100  r2 00000000  r3 afff97bf
2018-09-29 07:07:19.012 9501-9501/? A/DEBUG:     r4 a9c85300  r5 00000001  r6 2ac29bd8  r7 a89d4220
2018-09-29 07:07:19.012 9501-9501/? A/DEBUG:     r8 2ac2d060  r9 a9c85300  sl 2ac31ac0  fp a89ba000
2018-09-29 07:07:19.012 9501-9501/? A/DEBUG:     ip a9c05a05  sp a317e3c0  lr a9c05a11  pc a9c05a54  cpsr 600b0030
2018-09-29 07:07:19.018 9501-9501/? A/DEBUG: backtrace:
2018-09-29 07:07:19.018 9501-9501/? A/DEBUG:     #00 pc 003f3a54  /system/lib/libart.so (_ZN3artL12GoToRunnableEPNS_6ThreadE+31)
2018-09-29 07:07:19.018 9501-9501/? A/DEBUG:     #01 pc 003f3a0d  /system/lib/libart.so (_ZN3art12JniMethodEndEjPNS_6ThreadE+8)
2018-09-29 07:07:19.018 9501-9501/? A/DEBUG:     #02 pc 00000b27  /data/data/org.microg.gms.droidguard/app_dg_cache/261a4e4770eb25c279eacce4a0a58cc95056d1a4/opt/the.dex (offset 0xc000)

2018-09-29 07:27:05.774 7852-7852/? D/SafetyNetHelperSAMPLE: SafetyNet start request
2018-09-29 07:27:05.775 7852-7852/? D/SafetyNetHelper: apkCertificateDigests:[MZNsDhz8VAJMmFxPPso38ZRvZE6r7VIyzUqypkakG8E=]
2018-09-29 07:27:05.775 7852-7852/? V/SafetyNetHelper: running SafetyNet.API Test
2018-09-29 07:27:05.816 7654-8012/? W/GmsDroidguardHelper: java.lang.NoSuchFieldException: BUILD
        at java.lang.Class.getField(Class.java:1549)
        at org.microg.gms.droidguard.DroidguardHelper.createSystemInfoPair(DroidguardHelper.java:169)
        at org.microg.gms.droidguard.DroidguardHelper.getSystemInfo(DroidguardHelper.java:117)
        at org.microg.gms.droidguard.DroidguardHelper.guard(DroidguardHelper.java:64)
        at org.microg.gms.droidguard.RemoteDroidGuardService$1$1.run(RemoteDroidGuardService.java:23)
        at java.lang.Thread.run(Thread.java:761)

EDIT: Lucky patcher or Xposed causes safetynet to fail after 1 second. Uninstalling both leads to the weird behavior above.

nyanpasu64 · 2018-09-29T23:27:03Z

I tried installing Droidguard from https://github.com/ThibG/android_packages_apps_RemoteDroidGuard/tree/aarch64 (the unmerged pull request).

I had to use Lucky Patcher, Toolbox, Patch to Android, "package manager" to overwrite the system APK with my own debug builds.
I get basically the same issues as above (error 14, stalling, Failed to find Dex offset for PC offset 0x00000000 (i think)).
I also get error 8 (maybe internet is down).
Rebooting does not change behavior.

Chiffon-Pudding · 2018-09-29T23:38:16Z

hmm.
Nexus5,lineage-14.1-20180920,Magisk-v17.1,Nanodroid-18.3.1.20180921+microg core 0.2.6.13280,
Safetynet Passed.

If GPS has been turn OFF, I could sign in for Pokemon GO.
But if GPS has been turn ON, I could not do it(This device, OS, or software is not compatible with Pokemon GO.).

nyanpasu64 · 2018-09-29T23:55:51Z

i don't see how you could've possibly gotten it to work.

Moto g4 plus, lineage-microg 14.1.

So I got several "safetynet failed" results, decided to backup, wipe, and reflash. Now all I get are error 14/etc.

Removing /system/priv-app/droidguard.apk (I forgot to put in a subfolder) made no difference.

I tried installing Magisk Nanodroid (microG sub module) on top of Lineage-microG and uninstalling my user Droidguard, now microG crashes immediately with error:

    Process: com.google.android.gms.unstable, PID: 6480
    java.lang.NullPointerException: Attempt to invoke virtual method 'android.content.res.Configuration android.content.res.Resources.getConfiguration()' on a null object reference
        at android.app.ActivityThread.updateLocaleListFromAppContext(ActivityThread.java:5115)
        at android.app.ActivityThread.handleBindApplication(ActivityThread.java:5340)
        at android.app.ActivityThread.-wrap2(ActivityThread.java)
        at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1564)
        at android.os.Handler.dispatchMessage(Handler.java:102)
        at android.os.Looper.loop(Looper.java:154)
        at android.app.ActivityThread.main(ActivityThread.java:6186)
        at java.lang.reflect.Method.invoke(Native Method)
        at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)

Both nanodroid and 0.2.6.13280-dirty (git) have same error.

edit: i got safetynet to pass Basic but not CTS Profile. Unfortunately MicroG failed to generate a Play ID.

remove Magisk nanoguard module
disable all magisk modules, but don't enable Magisk Core
microg:
- Use lucky patcher to allow installing incompatible app signatures
- keep system app microg, install microg from git/androidstudio/gradlew.
- Clear dalvik cache to hide evidence of signature tampering
droidguard:
- do not add /priv-app/droidguard.apk, build and install droidguard from https://github.com/ThibG/android_packages_apps_RemoteDroidGuard/tree/aarch64

Chiffon-Pudding · 2018-09-30T00:51:00Z

@jimbo1qaz
I would like to confirm just in case; are you applying NanoDroid-patcher?
it's needed by signature spoofing for microg.
Also, is "Google SafetyNet" that on microG Setting, set to Enabled?
it's necessary to use Safetynet API.

nyanpasu64 · 2018-09-30T00:57:58Z

Can you explain your exact setup? I'm guessing:

lineage-14.1-20180920 (not microG edition)?
NanoDroid 18.3.1.20180921 (full or microg?)
NanoDroid-patcher via twrp
microg core 0.2.6.13280 (how did you bypass the signature mismatch? by installing microg as a user app before nanodroid added a system app?)

Where did you get microg core 0.2.6.13280 apk? Manually compile, or is there a CI build artifact repo with all .apk builds?

Chiffon-Pudding · 2018-09-30T01:21:39Z

@jimbo1qaz
Nexus5 hammerhead (16GB)
Flash zip(TWRP 3.2.3-0):

linageos-14.1-20180920-nighty-hammerhead-signed.zip (not "with microg")
Magisk-v17.1.zip
NanoDroid-setupwizard-18.3.1.20180921.zip (with microg, with Maps API v1)
NanoDroid-18.3.1.20180921.zip
NanoDroid-patcher-18.3.1.20180921.zip
(TWRP App not installed)
After booting:
Magisk update
Swap /system/priv-app/GmsCore/GmsCore.apk (0.2.6.13280 ,use X-plore, backup and renaming)
Reboot
Enable Google SafetyNet
Reboot
SafetyNet API check (Passed)

Iolaum · 2018-11-19T23:11:47Z

I used the droidGuard helper apk suggested at this comment by @Nanolx and enabled safetynet in microG settings. I then used the SafetyNet Test app from playstore, through Aurora store.

My results were
SafetyNet request: Success
Response Signature Validation: Success
Basic Integrity: Success
CTS Profile match: Fail

I 'm guessing this means that the PR works - because of the response signature success - but something else I did fails? Or maybe something else apart from droid guard helper needs fixing?

P.S. I am using this ROM for the Galaxy S5 Neo that I compiled through the L4mG docker ci/cd image through those steps. I didn't install/flash any extra system modifications (root, magisk, Xposed or anything else).

P.P.S. cc'ing @ArchangeGabriel because of this comment.

I probably missed something, as I 'm still learning but hope the feedback can still be helpful.

Nanolx · 2018-11-20T16:46:46Z

CTS Profile is the extended check. If you're on a Galaxy device with unlocked Bootloader, that will trip KNOX and thus CTS Profile match fails as the device is seen as tinkered. So that is not an issue, but the correct result.

The only way around this is Magisk.

Iolaum · 2018-12-16T18:07:06Z

@Nanolx This comment on the LineageOS subreddit, saying that knox is not checked by SafetyNet, prompted me to check after I went back to official LineageOs and gapps and frdoid on my S5Neo. When I rerun SafetyNet check everything passed, including CTS Profile match. I 'd guess this should rule out tripped knox as the reason why CTS Profile match failed since now it is passing while I still have a custom ROM and recovery installed.

Unfortunately I no longer have LinageOs with microg installed on the phone to try to debug this (on top of that I wouldn't know where to begin). Just posting here to inform that this problem had to do with safetynet and not knox.

kYc0o · 2019-01-19T15:22:26Z

Well for me none of the proposed solutions work. I'm on LineageOS 14.1 unofficial for SM-A300FU. The logcat output also shows DroidHelper crashing and I have the ApiException[14] 14: with the SafetyNet Sample app.

The logcat output:

01-19 16:10:45.879  4845  4845 D SafetyNetHelperSAMPLE: SafetyNet start request
01-19 16:10:45.881  4845  4845 D SafetyNetHelper: apkCertificateDigests:[MZNsDhz8VAJMmFxPPso38ZRvZE6r7VIyzUqypkakG8E=]
01-19 16:10:45.881  4845  4845 V SafetyNetHelper: running SafetyNet.API Test
01-19 16:10:45.979  5113  5132 D NetworkSecurityConfig: No Network Security Config specified, using platform default
01-19 16:10:45.980  5113  5132 W System  : ClassLoader referenced unknown path: /system/framework/tcmclient.jar
01-19 16:10:46.010  5113  5132 D GmsDroidguardHelper: -- Request --
01-19 16:10:46.010  5113  5132 D GmsDroidguardHelper: DGRequest{usage=DGUsage{type=attest, packageName=com.google.android.gms}, info=[KeyValuePair{key=BOARD, val=MSM8916}, KeyValuePair{key=BOOTLOADER, val=A300FUXXU1CPH3}, KeyValuePair{key=BRAND, val=samsung}, KeyValuePair{key=CPU_ABI, val=armeabi-v7a}, KeyValuePair{key=CPU_ABI2, val=armeabi}, KeyValuePair{key=SUPPORTED_ABIS, val=armeabi-v7a,armeabi}, KeyValuePair{key=DEVICE, val=a3ulte}, KeyValuePair{key=DISPLAY, val=lineage_a3ltexx-userdebug 7.1.2 N2G47O e45ef2b5f5 test-keys}, KeyValuePair{key=FINGERPRINT, val=samsung/a3ltexx/a3ulte:7.1.2/N2G47O/e45ef2b5f5:user/release-keys}, KeyValuePair{key=HARDWARE, val=qcom}, KeyValuePair{key=HOST, val=winkarbik}, KeyValuePair{key=ID, val=N2G47O}, KeyValuePair{key=MANUFACTURER, val=samsung}, KeyValuePair{key=MODEL, val=SM-A300FU}, KeyValuePair{key=PRODUCT, val=a3ltexx}, KeyValuePair{key=RADIO, val=unknown}, KeyValuePair{key=SERIAL, val=a7405641}, KeyValuePair{key=TAGS, val=release-keys}, KeyValuePair{key=TIME, val=1495735494000}, KeyValuePair{key=TYPE, val=user}, KeyValuePair{key=USER, val=jenkins}, KeyValuePair{key=CODENAME, val=REL}, KeyValuePair{key=INCREMENTAL, val=e45ef2b5f5}, KeyValuePair{key=RELEASE, val=7.1.2}, KeyValuePair{key=SDK, val=25}, KeyValuePair{key=SDK_INT, val=25}], versionNamePrefix=13.2.80 (040300-{{cl}}), isGoogleCn=false, enableInlineVm=true, cached=[ByteString[size=20 md5=c7c36e1888f2d6fc56d4fcb1705c6b2e]], currentVersion=3, arch=armv7l}
01-19 16:10:46.338  5113  5132 D GmsDroidguardHelper: Using cached file from /data/user/0/org.microg.gms.droidguard/app_dg_cache/d24334ada8172475d4470af3fefe3d369f2698f5/the.apk
01-19 16:10:46.699  5113  5132 F art     : art/runtime/oat_quick_method_header.cc:55] Failed to find Dex offset for PC offset 0x8ca84c6b(PC 0x0, entry_point=0x7357b395 current entry_point=0x7357b395) in java.nio.charset.CharsetDecoder java.nio.charset.CharsetICU.newDecoder()
01-19 16:10:46.702  5113  5132 F libc    : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x32627844 in tid 5132 (Thread-2)
01-19 16:10:46.703   263   263 W         : debuggerd: handling request: pid=5113 uid=10069 gid=10069 tid=5132
01-19 16:10:46.700  5136  5136 I debuggerd: type=1400 audit(0.0:730): avc: denied { read } for uid=0 name="the.apk" dev="mmcblk0p27" ino=41145 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=file permissive=1
01-19 16:10:46.700  5136  5136 I debuggerd: type=1400 audit(0.0:730): avc: denied { open } for uid=0 path="/data/data/org.microg.gms.droidguard/app_dg_cache/d24334ada8172475d4470af3fefe3d369f2698f5/the.apk" dev="mmcblk0p27" ino=41145 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=file permissive=1
01-19 16:10:46.700  5136  5136 W debuggerd: type=1300 audit(0.0:730): arch=40000028 syscall=322 per=800008 success=yes exit=9 a0=ffffff9c a1=b6ac1150 a2=20000 a3=0 items=0 ppid=263 ppcomm=debuggerd auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) exe="/system/bin/debuggerd" subj=u:r:debuggerd:s0 key=(null)
01-19 16:10:46.700   262   262 W auditd  : type=1320 audit(0.0:730): 
01-19 16:10:46.700  5136  5136 I debuggerd: type=1400 audit(0.0:731): avc: denied { getattr } for uid=0 path="/data/data/org.microg.gms.droidguard/app_dg_cache/d24334ada8172475d4470af3fefe3d369f2698f5/the.apk" dev="mmcblk0p27" ino=41145 scontext=u:r:debuggerd:s0 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=file permissive=1
01-19 16:10:46.700  5136  5136 W debuggerd: type=1300 audit(0.0:731): arch=40000028 syscall=197 per=800008 success=yes exit=0 a0=9 a1=bebaf7e0 a2=712048dd a3=0 items=0 ppid=263 ppcomm=debuggerd auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 ses=4294967295 tty=(none) exe="/system/bin/debuggerd" subj=u:r:debuggerd:s0 key=(null)
01-19 16:10:46.700   262   262 W auditd  : type=1320 audit(0.0:731): 
01-19 16:10:46.729  5136  5136 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
01-19 16:10:46.729  5136  5136 F DEBUG   : LineageOS Version: '14.1-20170525-UNOFFICIAL-a3ltexx'
01-19 16:10:46.729  5136  5136 F DEBUG   : Build fingerprint: 'samsung/a3ltexx/a3ulte:7.1.2/N2G47O/e45ef2b5f5:user/release-keys'
01-19 16:10:46.729  5136  5136 F DEBUG   : Revision: '1'
01-19 16:10:46.729  5136  5136 F DEBUG   : ABI: 'arm'
01-19 16:10:46.729  5136  5136 F DEBUG   : pid: 5113, tid: 5132, name: Thread-2  >>> com.google.android.gms.unstable <<<
01-19 16:10:46.729  5136  5136 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x32627844
01-19 16:10:46.733  5136  5136 F DEBUG   : Abort message: 'art/runtime/oat_quick_method_header.cc:55] Failed to find Dex offset for PC offset 0x8ca84c6b(PC 0x0, entry_point=0x7357b395 current entry_point=0x7357b395) in java.nio.charset.CharsetDecoder java.nio.charset.CharsetICU.newDecoder()'
01-19 16:10:46.733  5136  5136 F DEBUG   :     r0 30376562  r1 b426d140  r2 0001000a  r3 b2ce61cf
01-19 16:10:46.733  5136  5136 F DEBUG   :     r4 646c6568  r5 b2ce61c4  r6 00006953  r7 b426d140
01-19 16:10:46.733  5136  5136 F DEBUG   :     r8 b2b46328  r9 b3dc0497  sl b2ce61cf  fp 32627830
01-19 16:10:46.733  5136  5136 F DEBUG   :     ip b4178b40  sp b2ce6168  lr b3dc34f7  pc b3dfaea6  cpsr 000b0030
01-19 16:10:46.745  5136  5136 F DEBUG   : 
01-19 16:10:46.745  5136  5136 F DEBUG   : backtrace:
01-19 16:10:46.745  5136  5136 F DEBUG   :     #00 pc 000e8ea6  /system/lib/libart.so (_ZN3art11ClassLinker16FindOatMethodForEPNS_9ArtMethodEPb+349)
01-19 16:10:46.745  5136  5136 F DEBUG   :     #01 pc 000b14f3  /system/lib/libart.so (_ZN3art9ArtMethod23GetOatQuickMethodHeaderEj+158)
01-19 16:10:46.745  5136  5136 F DEBUG   :     #02 pc 00328ced  /system/lib/libart.so (_ZN3art12StackVisitor9WalkStackEb+120)
01-19 16:10:46.745  5136  5136 F DEBUG   :     #03 pc 0024d89f  /system/lib/libart.so (_ZN3art9JNIEnvExt19CheckNoHeldMonitorsEv+58)
01-19 16:10:46.745  5136  5136 F DEBUG   :     #04 pc 003f3a2f  /system/lib/libart.so (_ZN3art12JniMethodEndEjPNS_6ThreadE+42)
01-19 16:10:46.745  5136  5136 F DEBUG   :     #05 pc 0000d02f  /data/data/org.microg.gms.droidguard/app_dg_cache/d24334ada8172475d4470af3fefe3d369f2698f5/opt/the.dex (offset 0xc000)
01-19 16:10:47.070  5132  5132 W Thread-2: type=1701 audit(0.0:732): auid=4294967295 uid=10069 gid=10069 ses=4294967295 subj=u:r:priv_app:s0:c512,c768 reason="memory violation" sig=11
01-19 16:10:47.070  1435  1435 I android.ui: type=1400 audit(0.0:733): avc: denied { open } for uid=1000 path="/system/priv-app/DroidGuard/DroidGuard.apk" dev="mmcblk0p24" ino=94589 scontext=u:r:system_server:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=file permissive=1
01-19 16:10:47.086  5136  5136 E         : debuggerd: failed to kill process 5113: No such process
01-19 16:10:47.088  1357  1462 I BootReceiver: Copying /data/tombstones/tombstone_02 to DropBox (SYSTEM_TOMBSTONE)
01-19 16:10:47.093   263   263 W         : debuggerd: resuming target 5113
01-19 16:10:47.070  1435  1435 W android.ui: type=1300 audit(0.0:733): arch=40000028 syscall=322 per=800008 success=yes exit=242 a0=ffffff9c a1=8ecfec10 a2=20000 a3=0 items=0 ppid=581 ppcomm=main auid=4294967295 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 ses=4294967295 tty=(none) exe="/system/bin/app_process32" subj=u:r:system_server:s0 key=(null)
01-19 16:10:47.070   262   262 W auditd  : type=1320 audit(0.0:733): 
01-19 16:10:47.128  1357  1895 I ActivityManager: Process com.google.android.gms.unstable (pid 5113) has died
01-19 16:10:47.128  1357  1895 D ActivityManager: cleanUpApplicationRecord -- 5113
01-19 16:10:47.129   581   581 I Zygote  : Process 5113 exited due to signal (11)
01-19 16:10:47.131  1357  1895 W ActivityManager: Scheduling restart of crashed service org.microg.gms.droidguard/.RemoteDroidGuardService in 1000ms
01-19 16:10:47.135  4845  4845 E SafetyNetHelperSAMPLE: ApiException[14] 14: 
01-19 16:10:47.149  1357  4891 I OpenGLRenderer: Initialized EGL, version 1.4
01-19 16:10:47.149  1357  4891 D OpenGLRenderer: Swap behavior 1
01-19 16:10:47.164  1357  4891 E linker  : readlink("/proc/self/fd/261") failed: Permission denied [fd=261]
01-19 16:10:47.164  1357  4891 E linker  : warning: unable to get realpath for the library "/system/lib/hw/gralloc.msm8916.so". Will use given path.
01-19 16:10:48.144  1357  1432 I ActivityManager: Start proc 5140:com.google.android.gms.unstable/u0a69 for service org.microg.gms.droidguard/.RemoteDroidGuardService
01-19 16:10:48.154   290   325 I Magisk  : proc_monitor: org.microg.gms.droidguard/.RemoteDroidGuardService PID=[5140] ns=[4026534892]
01-19 16:10:48.210  5140  5140 I main    : type=1400 audit(0.0:734): avc: denied { read } for uid=10069 name="u:object_r:spcomlib_prop:s0" dev="tmpfs" ino=2456 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:spcomlib_prop:s0 tclass=file permissive=1
01-19 16:10:48.210  5140  5140 W main    : type=1300 audit(0.0:734): arch=40000028 syscall=334 per=800008 success=yes exit=0 a0=ffffff9c a1=befddb8c a2=4 a3=0 items=0 ppid=581 ppcomm=main auid=4294967295 uid=10069 gid=10069 euid=10069 suid=10069 fsuid=10069 egid=10069 sgid=10069 fsgid=10069 ses=4294967295 tty=(none) exe="/system/bin/app_process32" subj=u:r:priv_app:s0:c512,c768 key=(null)
01-19 16:10:48.210   262   262 W auditd  : type=1320 audit(0.0:734): 
01-19 16:10:48.218  5140  5140 I art     : Late-enabling -Xcheck:jni
01-19 16:10:48.248  5140  5140 I art     : Starting a blocking GC AddRemoveAppImageSpace
01-19 16:10:48.249  5140  5140 W System  : ClassLoader referenced unknown path: /system/priv-app/DroidGuard/lib/arm

Also have Magisk v18.0 hiding DroidGuard as proposed by @Nanolx in microg/RemoteDroidGuard#19 (comment)

Nanolx · 2019-01-26T18:17:48Z

Official DroidGuard Helper won't work, you need a build with this pull request here merged. Everything fine with that.

kYc0o · 2019-02-03T20:56:40Z

I have installed that one and the problem persists... I'll try a clean install and report back if that works.

kYc0o · 2019-02-05T15:09:53Z

After several tests my conclusion is: LineageOS 14.1 for A300FU doesn't pass SafetyNet under any of the conditions I tested so far:

DroidGuard (NanoDroid md5 ea538b995a7bd6143970101458852c94) as user app
DroidGuard in /system/priv-app/
DroidGuard hidden by Magisk
GmsCore (microg) as system app

So far, none of the combinations presented above led me to a successful SafetyNet check.

I installed then a modified version of the stock ROM and installed the nanodroid package with microg, then hide DroidGuard with magisk and SafetyNet check passes now. Though the concerned app I thought was affected by safetynet still doesn't work (airfrance app), but the SafetyNet checks are all green.

jansohn · 2019-02-05T15:42:24Z

@kYc0o it won't help you but I also never got SafetyNet working with LineageOS 14.1 either...

Iolaum · 2019-02-06T22:20:17Z

@kYc0o I think you need the following two things:

GmsCore with PRs that haven't been merged, see here from Nanolx. Nanolx has compiled a GmsCore version on his own fdroid repositoy.
DroidGuard helper with a PR that also hasn't been merged. See here for details from Nanolx.

I have added both apk's in a fork of mine and I used them to build LineageOS+microG for s5neoltexx (Galaxy S5 neo). Instructions on how I did it, if needed can be found here.

Hopefully that will help you. In my case it was Lineage 15.1 used as a base instead of 14.1 but I think they can also work for 14.1.

benwaffle · 2019-02-07T05:24:51Z

Using that updated droidguard apk and adding droidguard to MagiskHide gives me basicIntegrity: true and ctsProfile: false, which is enough for some apps

kYc0o · 2019-02-08T14:39:37Z

Thanks @Iolaum for your insight! Actually I also own a S5 neo, although I still prefer the A300FU.

Do you have the compiled apk's of those packages? I couldn't find them and I'd like to check if th md5 matches the versions I have currently installed.

I'll also test your build asap on my s5 neo.

Iolaum · 2019-02-09T15:53:09Z

@kYc0o I 've already put those apk in my repository which is linked on my previous post.

You can also get those apk's with the following Linux shell commands:

$ wget https://nanolx.org/fdroid/repo/GmsCore_23.apk
...
$ md5sum GmsCore_23.apk 
0eb42417c1f95e8c954887558b214ff9  GmsCore_23.apk

$ wget https://nanolx.org/fdroid/repo/DroidGuard_0.apk
...
$ md5sum DroidGuard_0.apk 
ea538b995a7bd6143970101458852c94  DroidGuard_0.apk

That is where I got them from.

Update: It looks like there's a newer version GmsCore_23 of the GmsCore from Nanolx.

kYc0o · 2019-02-10T22:48:16Z

Well, it turns that's the version I have:

a3ulte:/ $ md5sum /system/priv-app/GmsCore/GmsCore.apk                                                                                                                         
6400f03950b3f1d49a68a7ec10f50d04  /system/priv-app/GmsCore/GmsCore.apk
a3ulte:/ $ md5sum /system/app/DroidGuard/DroidGuard.apk                                                                                                                        
ea538b995a7bd6143970101458852c94  /system/app/DroidGuard/DroidGuard.apk

Actually in my current ROM (SEP 8.5) SafetyNet is all green, but my airfrance app doesn't log in. I guess that problem is related to other things and not to SafetyNet. In #691 I explain more in detail the issue.

Thanks a lot for your help!

Nanolx · 2019-07-08T10:15:49Z

@ale5000-git could you close this issue? It's about the old bug fixed by microg/RemoteDroidGuard#19

ArchangeGabriel closed this as completed Feb 8, 2018

ArchangeGabriel mentioned this issue Jan 15, 2024

org.microg.gms.droidguard should be installed (in /system/priv-app/) lineageos4microg/docker-lineage-cicd#549

Closed

ArchangeGabriel reopened this Apr 9, 2018

mar-v-in added the 🔒 Integrity Play Integrity, SafetyNet, DroidGuard and ReCAPTCHA label Apr 24, 2019

ale5000-git added the bug label Jul 8, 2019

ale5000-git closed this as completed Jul 8, 2019

SafetyNet started failing #482

SafetyNet started failing #482

Comments

ArchangeGabriel commented Feb 5, 2018

n76 commented Feb 5, 2018 • edited Loading

ArchangeGabriel commented Feb 5, 2018

ale5000-git commented Feb 7, 2018 • edited Loading

n76 commented Feb 7, 2018

ale5000-git commented Feb 7, 2018

n76 commented Feb 7, 2018

ArchangeGabriel commented Feb 7, 2018

ale5000-git commented Feb 7, 2018 • edited Loading

ArchangeGabriel commented Feb 7, 2018

ArchangeGabriel commented Feb 7, 2018

ArchangeGabriel commented Feb 7, 2018

n76 commented Feb 7, 2018

ArchangeGabriel commented Feb 7, 2018

ale5000-git commented Feb 7, 2018

ale5000-git commented Feb 7, 2018 • edited Loading

n76 commented Feb 7, 2018

ArchangeGabriel commented Feb 8, 2018

ArchangeGabriel commented Feb 8, 2018

ale5000-git commented Feb 8, 2018 • edited Loading

ArchangeGabriel commented Feb 8, 2018

ale5000-git commented Feb 8, 2018

ArchangeGabriel commented Feb 8, 2018

ArchangeGabriel commented Feb 26, 2018

Espionage724 commented Apr 7, 2018 • edited Loading

ale5000-git commented Apr 7, 2018 • edited Loading

ArchangeGabriel commented Apr 7, 2018

ArchangeGabriel commented Apr 9, 2018

ArchangeGabriel commented Sep 29, 2018

jansohn commented Sep 29, 2018 • edited Loading

ArchangeGabriel commented Sep 29, 2018

nyanpasu64 commented Sep 29, 2018

jansohn commented Sep 29, 2018

ClearlyClaire commented Sep 29, 2018 via email

nyanpasu64 commented Sep 29, 2018 • edited Loading

nyanpasu64 commented Sep 29, 2018 • edited Loading

Chiffon-Pudding commented Sep 29, 2018

nyanpasu64 commented Sep 29, 2018 • edited Loading

Chiffon-Pudding commented Sep 30, 2018

nyanpasu64 commented Sep 30, 2018 • edited Loading

Chiffon-Pudding commented Sep 30, 2018

Iolaum commented Nov 19, 2018 • edited Loading

Nanolx commented Nov 20, 2018 • edited Loading

Iolaum commented Dec 16, 2018

kYc0o commented Jan 19, 2019

Nanolx commented Jan 26, 2019

kYc0o commented Feb 3, 2019

kYc0o commented Feb 5, 2019

jansohn commented Feb 5, 2019

Iolaum commented Feb 6, 2019 • edited Loading

benwaffle commented Feb 7, 2019

kYc0o commented Feb 8, 2019

Iolaum commented Feb 9, 2019 • edited Loading

kYc0o commented Feb 10, 2019

Nanolx commented Jul 8, 2019

n76 commented Feb 5, 2018 •

edited

Loading

ale5000-git commented Feb 7, 2018 •

edited

Loading

ale5000-git commented Feb 7, 2018 •

edited

Loading

ale5000-git commented Feb 7, 2018 •

edited

Loading

ale5000-git commented Feb 8, 2018 •

edited

Loading

Espionage724 commented Apr 7, 2018 •

edited

Loading

ale5000-git commented Apr 7, 2018 •

edited

Loading

jansohn commented Sep 29, 2018 •

edited

Loading

nyanpasu64 commented Sep 29, 2018 •

edited

Loading

nyanpasu64 commented Sep 29, 2018 •

edited

Loading

nyanpasu64 commented Sep 29, 2018 •

edited

Loading

nyanpasu64 commented Sep 30, 2018 •

edited

Loading

Iolaum commented Nov 19, 2018 •

edited

Loading

Nanolx commented Nov 20, 2018 •

edited

Loading

Iolaum commented Feb 6, 2019 •

edited

Loading

Iolaum commented Feb 9, 2019 •

edited

Loading