search

microg / RemoteDroidGuard

Service to run Google's DroidGuard binary in an isolated environment
94 stars 28 forks source link

SafetyNet Issues #31

Closed dylangerdaly closed 2 years ago

dylangerdaly commented 2 years ago

Describe the bug Latest version of microG + RemoteDroidGuard isn't working.

{"nonce":"","timestampMs":1635290903792,"ctsProfileMatch":false,"apkCertificateDigestSha256":[],"basicIntegrity":false,"advice":"RESTORE_TO_FACTORY_ROM","evaluationType":"BASIC"}

Both basic and CTS are returning false, I've successfully applied kdrag0n's AOSP patches listed here, so the Build.Fingerprint etc APIs are indeed being hooked, as well as verifiedboot state.

It's at a point where both CTS and Basic should be passing successfully, is there a specific package name for DroidGuard? Currently I'm hooking calls to build flags if the package name is org.microg.gms.droidguard or com.google.android.gms.

This issue seems to be a specific issue with RemoteDroidGuard, standard GMS is reported to be working, does anyone know how this actually works? It looks like it's downloading an APK from somewhere then executing it?

Please advise.

System Android 12

ArchangeGabriel commented 2 years ago

This has been broken for years, see https://github.com/microg/RemoteDroidGuard/issues/24, https://github.com/microg/RemoteDroidGuard/pull/29, https://github.com/microg/RemoteDroidGuard/pull/30. The last one in particular is wrongly closed, IIRC @0x5ECF4ULT was still trying to work on it.

ArchangeGabriel commented 2 years ago

And yes, RemoteDroidGuard is downloading the DroidGuard binary (not sure whether that’s an APK or not, it’s been years since I last looked into this), and executing it in a partial sandbox.

0x5ECF4ULT commented 2 years ago

@ArchangeGabriel Google changed some things again and SN is more broken than before. The certificate hashes array seems to get populated by the sandbox DG is executing code in. I'm trying to figure out why this doesn't happen but my reversing skills are not that great.

ale5000-git commented 2 years ago

Fixed with latest microG GmsCore.