Understanding SafetyNet and Its Importance

SafetyNet Attestation is a crucial security API developed by Google that verifies the integrity and compatibility of Android devices. It’s designed to protect applications, especially financial and DRM-protected ones, from running on compromised or non-compliant devices. When you root your device with Magisk or install a custom ROM, you often trip SafetyNet, leading to app functionality issues, such as banking apps refusing to open, Netflix not streaming in HD, or Google Pay being disabled.

SafetyNet comprises two main checks:

• basicIntegrity: Checks if the device has been tampered with, such as being rooted or having an unlocked bootloader.
• ctsProfileMatch: Ensures the device passes the Android Compatibility Test Suite (CTS) and runs a Google-approved build. Custom ROMs often fail this as they are not Google-certified.

For advanced security, some devices and apps might also use hardware-backed attestation, which is much harder to bypass and often requires a locked bootloader.

Common Causes of SafetyNet Failures with Magisk/Custom ROMs

Before diving into fixes, understanding why SafetyNet fails is key:

• Unlocked Bootloader: Some strict SafetyNet implementations detect an unlocked bootloader.
• Root Detection: Magisk’s presence, even if hidden, can sometimes be detected.
• Custom ROMs: Non-certified ROMs often fail ctsProfileMatch.
• Outdated Magisk Modules: Incompatible or older modules can break SafetyNet.
• Improper Magisk Configuration: Magisk DenyList or Zygisk not set up correctly.
• Google Play Services/Store Cache: Corrupted cache can cause issues.
• build.prop Modifications: Changes to device properties that deviate from stock values.
• Kernel Modifications: Custom kernels can sometimes trigger SafetyNet flags.

Phase 1: Essential Magisk Configuration

1. Verify Zygisk is Enabled

Magisk’s Zygisk feature is fundamental for hiding root and running modules effectively. Ensure it’s active:

• Open Magisk app.
• Go to Settings (gear icon).
• Toggle on Zygisk.
• Reboot your device.

2. Configure Magisk DenyList

The DenyList tells Magisk which apps to hide root from. It’s crucial for apps that perform root detection.

• Open Magisk app.
• Go to Settings (gear icon).
• Tap on Configure DenyList.
• Enable Enforce DenyList.
• Tap the three dots menu in the top right and select Show system apps.
• Select all Google Play Services entries, Google Play Store, Google Play Framework, and all banking/DRM apps you use.
• Reboot your device after making changes.

Phase 2: Leveraging Magisk Modules

Certain Magisk modules are specifically designed to help bypass SafetyNet.

1. Install Universal SafetyNet Fix (USNF)

The Universal SafetyNet Fix module (often referred to as ‘USNF’ or ‘Kdrag0n’s USNF’) is essential for spoofing device properties to pass ctsProfileMatch.

• Download the latest USNF module ZIP file from a trusted source (e.g., GitHub releases).
• Open Magisk app.
• Go to Modules tab.
• Tap on Install from storage.
• Navigate to the downloaded USNF ZIP and select it.
• Let Magisk install the module.
• Tap Reboot.

2. Install Shamiko (Optional, but Recommended)

Shamiko works in conjunction with Zygisk and DenyList to further improve root hiding. It’s often more effective than DenyList alone.

• Download the latest Shamiko module ZIP file.
• Open Magisk app.
• Go to Modules tab.
• Tap on Install from storage.
• Navigate to the downloaded Shamiko ZIP and select it.
• Let Magisk install the module.
• Tap Reboot.

Note: Ensure you have both USNF and Shamiko active if using both. Shamiko requires Zygisk to be enabled and DenyList configured for it to work properly.

Phase 3: Refreshing Google Play Services

Sometimes, cached data in Google Play Services or Play Store can prevent SafetyNet from passing, even if root is perfectly hidden.

• Go to your device’s Settings > Apps > See all apps.
• Find Google Play Store.
• Tap Storage & cache > Clear cache and then Clear storage.
• Repeat the above steps for Google Play Services.
• Reboot your device.

Phase 4: Checking and Spoofing Device Fingerprint

The device fingerprint stored in your build.prop can sometimes be a giveaway for custom ROMs or modified devices. Spoofing it to a certified stock fingerprint can help.

1. Check Current Fingerprint

You can check your current fingerprint via `adb` or a terminal emulator:

adb shell getprop ro.build.fingerprint

Or directly on the device:

sugetprop ro.build.fingerprint

2. Spoof Fingerprint with Magisk Module

A common method is using a module like ‘MagiskHide Props Config’ (or just ‘props’).

• Install the ‘MagiskHide Props Config’ module via Magisk.
• Reboot your device.
• Open a terminal app on your phone (e.g., Termux) or use ADB shell.
• Run the command:

suprops

• Follow the on-screen prompts to select a certified fingerprint for a similar device model.
• Reboot after applying changes.

Manual `build.prop` editing is discouraged unless you know exactly what you’re doing, as incorrect edits can soft-brick your device.

Phase 5: Advanced Diagnostics and Edge Cases

1. Review Magisk Logs

The Magisk app’s logs can sometimes provide clues if a module is failing or if Zygisk isn’t injecting correctly.

2. Use a SafetyNet Checker App

Apps like ‘YASNAC’ (Yet Another SafetyNet Checker) can tell you specifically whether basicIntegrity or ctsProfileMatch is failing, which helps narrow down the problem.

3. Check for su Binary Conflicts

Ensure no old root binaries are lingering from previous rooting methods. Magisk automatically handles this, but in rare cases, manual cleanup might be needed.

4. Custom ROM Specific Patches

Some custom ROMs, especially those not actively maintained or with unique modifications, might require specific patches or configurations to pass SafetyNet. Consult your ROM’s community forums or documentation.

5. KernelSU Considerations

If you’re using KernelSU instead of Magisk, the approach to hiding root and passing SafetyNet will differ. KernelSU often relies on its own set of modules and hiding mechanisms, which might involve kernel-level modifications or specific patches not covered by traditional Magisk methods.

Conclusion

Fixing SafetyNet failures can be a process of trial and error, but by following these systematic steps, you significantly increase your chances of success. Always ensure your Magisk installation and modules are up-to-date, and remember that Google continually updates SafetyNet, requiring ongoing adjustments from the developer community. A systematic approach, starting with basic Magisk configuration and progressively moving to modules and system-level tweaks, is your best strategy for regaining full app functionality on your rooted or custom ROM device.