Working SafetyNet for Redmi Note 9S

[sandraschlingel]

Hi Folks,

has anyone a Redmi Note 9S with open Bootloader and a SafetyNet fix that work?
I tried the globel rom and the eu version, with Magisk /Magisk canary, with edxposed but it never work.
ctsProfile : fail
evalType: hardware
Maybe it is not possible?!
Is here someone who have fix it and can tell me what i have to do?

Many Thanks!

 

[rbarat]

What is necessary to do is:
-download Fastboot version of Global ROM from here: https://xiaomifirmwareupdater.com/miui/
for 9S is latest Global 11.0.10.0
-remove file Persist.img from ZIP
-install this in TWRP to Persist partition
-restart phone twice

Then Google Pay will work correctly -> also uses the Safety test. I suppose it will help other applications as well.

It is not necessary to install Magisk or any Magisk patches!!!

How to install TWRP for 9S (Curtana) here: https://xiaomi.eu/community/threads/custom-twrp-3-4-1b-for-redmi-note-9s-curtana.56943/

 

[LOLO9393]

What is necessary to do is:
-download Fastboot version of Global ROM from here: https://xiaomifirmwareupdater.com/miui/
for 9S is latest Global https://xiaomifirmwareupdater.com/miui/curtana/stable/V11.0.4.0.QJWEUXM/
-remove file Persist.img from ZIP
-install this in TWRP to Persist partition
-restart phone twice

Then Google Pay will work correctly.

It is not necessary to install Magisk or any Magisk patches!!!

How to install TWRP for 9S (Curtana) here: https://xiaomi.eu/community/threads/custom-twrp-3-4-1b-for-redmi-note-9s-curtana.56943/

The Analogue procedure also works for Joyeuse (of course you need to use ROM for Joyeuse).

But what about DRM rights from L1 to L3.....
It is to be known before installing new persist.
Some people doesn't want to loose their rights.
Question to OP:
Why do you want to pass safety test, you don't have NFC?

 

[rbarat]

Why do you want to pass safety test, you don't have NFC?

You're right for 9S it's useless because it doesn't have NFC, but this could help with other apps that check security, maybe.
The phone then passes the Safety test.It's tested on Joyuse.

 

[sandraschlingel]

Many Thanks!
I will test it and report...
Is root after this possible with magisk and working SafetyNet check?

@LOLO9393
I need it because many apps do not work when the check is not true.

 

[rbarat]

Try install Magisk and hide them. Some people in another discussion said that it also worked with the hidden Magisk. But I didn't try.

There are also various fix modules for Magisk, but I haven't tried them.

As far as I know, with the procedure I described above, payments over Google Pay works, which also uses the Safety test.
This could help with other apps that check security.

 

[sandraschlingel]

@rbarat
I try it with the Persist.img from your first post and it works.
Many Thanks!

 

[nani667]

How to get back L1 tho

 

[sandraschlingel]

Maybe never?!
I dont need it...
I dont know, but you can backup your persist.img

 

[nani667]

..

 

[rbarat]

Another working trick for Google Pay, there is not necessary to use Persist.img file...

Read here - https://xiaomi.eu/community/threads...i-note-9-pro-joyeuse.56896/page-5#post-557494

 

[LeX1991]

Wrote a small tutorial about it here:

https://xiaomi.eu/community/threads/custom-twrp-3-4-1b-for-redmi-note-9-pro-joyeuse.56896/page-5#post-557532

 

[rbarat]

Thanks to LeX1991 for a nice tutorial, I added it to the first TWRP posts for both Jeyeuse and Curtana.

 

[nani667]

Another working trick for Google Pay, there is not necessary to use Persist.img file...

Read here - https://xiaomi.eu/community/threads...i-note-9-pro-joyeuse.56896/page-5#post-557494

after you have made us lose L1

 

[r3pairer]

Has anyone kept a backup of his original Persist.img? Would it work to recover the L1?

edit: Never mind, I figured out that there is no way to recover it.

 

[rbarat]

Has anyone kept a backup of his original Persist.img? Would it work to recover the L1?

edit: Never mind, I figured out that there is no way to recover it.

The backup is created automatically. See your phone's internal storage.

Or install Global ROM via Flashtool and you will get to its original state.

 

[r3pairer]

The backup is created automatically. See your phone's internal storage.

Or install Global ROM via Flashtool and you will get to its original state.

So you are saying that if I install the Global rom via Flashtool I will get back my Widevine CDM up to L1 after having flashed the persist.img? Because from what I read from various people, none of them was able to recover the L1.

 

[nani667]

So you are saying that if I install the Global rom via Flashtool I will get back my Widevine CDM up to L1 after having flashed the persist.img? Because from what I read from various people, none of them was able to recover the L1.

already tried that..sad that we were not told that persist will lose L1 forever..

 

[r3pairer]

already tried that..sad that we were not told that persist will lose L1 forever..

Indeed.. It was bad timing, one week later and we would have avoided it. But it is not the end of the world either, if fact only Netflix and Amazon prime need the L1 and I don't use either of them. Youtube plays normally in 4K and Twitch in Full HD from what I've tried.
There is one thing that I don't understand though and I wrote it at the thread for the Redmi Note 9 Pro too, but noone answered.
The persist.img that I flashed, I grabbed it from the official 11.0.5.0 global fastboot rom. If I had flashed the whole official 11.0.5.0 global fastboot rom with the fastboot method to my phone, would this drop my Widevine CDM from L1 to L3?
Isn't the persist.img being flashed as well when installing the whole rom? What is different there and it stays to L1?

 

[nani667]

Indeed.. It was bad timing, one week later and we would have avoided it. But it is not the end of the world either, if fact only Netflix and Amazon prime need the L1 and I don't use either of them. Youtube plays normally in 4K and Twitch in Full HD from what I've tried.
There is one thing that I don't understand though and I wrote it at the thread for the Redmi Note 9 Pro too, but noone answered.
The persist.img that I flashed, I grabbed it from the official 11.0.5.0 global fastboot rom. If I had flashed the whole official 11.0.5.0 global fastboot rom with the fastboot method to my phone, would this drop my Widevine CDM from L1 to L3?
Isn't the persist.img being flashed as well when installing the whole rom? What is different there and it stays to L1?

Yeah, it's not like I need the L1 or anything, I don't use Amazon Prime or Netflix.. So it is no biggie, but I feel we should have been told.. Before I unlocked my device I asked here if this ROM had Wildvine L1 and CTS... Someone here just said that I should flash persist to get Google Pay working.. Google Pay that I have no use for...

And by the time I knew it L1 was gone forever.. I went through the stress of flashing stock with Mi Flash, it was hopeless.. In any case, it is not like I need L1, but it is just sad that someone here just decided to mislead the masses into losing L1 forever

 

[LOLO9393]

Indeed.. It was bad timing, one week later and we would have avoided it. But it is not the end of the world either, if fact only Netflix and Amazon prime need the L1 and I don't use either of them. Youtube plays normally in 4K and Twitch in Full HD from what I've tried.
There is one thing that I don't understand though and I wrote it at the thread for the Redmi Note 9 Pro too, but noone answered.
The persist.img that I flashed, I grabbed it from the official 11.0.5.0 global fastboot rom. If I had flashed the whole official 11.0.5.0 global fastboot rom with the fastboot method to my phone, would this drop my Widevine CDM from L1 to L3?
Isn't the persist.img being flashed as well when installing the whole rom? What is different there and it stays to L1?

You are in position to try it and make it cleared?
Just download the fastboot rom and flash it via Miflash.

Yeah, it's not like I need the L1 or anything, I don't use Amazon Prime or Netflix.. So it is no biggie, but I feel we should have been told.. Before I unlocked my device I asked here if this ROM had Wildvine L1 and CTS... Someone here just said that I should flash persist to get Google Pay working.. Google Pay that I have no use for...

And by the time I knew it L1 was gone forever.. I went through the stress of flashing stock with Mi Flash, it was hopeless.. In any case, it is not like I need L1, but it is just sad that someone here just decided to mislead the masses into losing L1 forever

I am sorry for you but I advised as soon I saw that . (post 3 and in other RN9 topic).

 

[rbarat]

I don't understand that either. How is it possible that when I burn the entire original Global ROM via MiFlash, the widevine does not restore to the L1 state?

 

[t_adams]

Hello!! Update on this subject.

Managed to restore L1 on my Curtana.
I don't know if it will work for everyone but this is how I've done it.

After trying several roms I did go back to stock ROM.

So I flashed original persist on twrp(in my case only bcz I've messed it before), extracted it from original fastboot EEA. Version 11.0.4 and copied persist.img to sd card. On twrp flash image. After this still L3. If you still have original persist ignore this part.

Used mi flash to flash EEA 11.0.4 and relock bootloader, still L3 at that point.
Gave up trying for a few days at this stage but read a post on mi community of a user saying that he got L1 back on latest Xiaomi.eu. as I prefer .eu tried today to flash it again.

So I downloaded latest Xiaomi.eu 11.0.11 and copied to sd card.

Unlocked bootloader again, flashed twrp 3.4.1-10.0-b5.

On twrp flashed xiaomi.eu and after formatted data bcz I was coming from stock ROM.

After restoring all software the only thing I did different is on the security->fingerprint screen there's a payment option with L1 certificate download option. Did that and now I have L1 again.
Don't know exactly what triggered it, maybe latest rom addressed it, maybe the certificate or got lucky.

Can anyone try it to see if it's isolated solution or if it can help more people?

Enviado do meu Redmi Note 9S através do Tapatalk

 

[rbarat]

This guide does not work on my Joyeuse phone. I'm still at L3 level

 

[t_adams]

This guide does not work on my Joyeuse phone. I'm still at L3 level

Still don't know what have triggered the L1 on my case. If it didn't work for you seems to be an isolated case then.

Enviado do meu Redmi Note 9S através do Tapatalk