November 02, 2021
Some time ago, I installed LineageOS on my Samsung Galaxy S10. It’s been working great, but some apps detect that I have a custom ROM, because of SafetyNet (for example, Brave doesn’t let me claim rewards). In this post, I explain how I used Magisk to pass SafetyNet.
Update 2023-05-04: now on LineageOS 20, I’ve installed Magisk 26 and set up SafetyNet following the first couple of posts on the official XDA thread; everything works well.
Update 2022-05-05: Magisk 24 has been released, which changes how it does things. I haven’t gotten it working yet, right now only version 23 works. Tried it out and had to uninstall and revert to version 23. That’s suboptimal but I can’t spend hours troubleshooting it.
Magisk is a way to provide root access to applications, and can also be used to hide the fact that the device is using a custom ROM, like LineageOS. Unfortunately, I didn’t find any clear instructions to install Magisk using LineageOS recovery, everyone says to use TWRP (which seems to have incompatibilities and can lead to bootloops). Fortunately, it’s very easy with LineageOS recovery, so I can now write those instructions. My configuration is: Samsung Galaxy S10 (beyond1lte), LineageOS 18.1. If that’s not your configuration, these instructions might not work.
First, open Settings on your phone, go to System → Gestures → Power menu. Enable ‘advanced restart’. Then hold the power button, tap Power → Restart → Recovery. This will restart your phone into LineageOS recovery.
On your computer, download the Magisk release version 23.
Connect your phone to your computer, and in the recovery screen, use the volume buttons and power button to select Apply Update → ADB Sideload.
On your computer, open a terminal, navigate to where you downloaded the Magisk APK, and run adb sideload path-to-magisk.apk (replacing the last argument with the location of the Magisk APK).
Wait for that to complete, then select ‘reboot now’ in the recovery screen.
After a reboot, open up the Magisk app.
Go to its settings, and enable MagiskHide.
If you run the SafetyNet check, it’ll say that the CTS Profile check failed (as part of the basic check).
Go to the modules screen in Magisk, and install MagiskHide Props Config.
From your computer, run adb shell (you might need to run adb root), and run the command props (or if you have Termux installed on your phone, open it and run su -c props).
In there, edit your device’s fingerprint, setting it to the one that matches your device (compare with the model shown in Settings → About phone).
After changing this, SafetyNet should now pass. If any apps detect root, make sure to toggle them on in MagiskHide’s settings.