frida_hook_safetynet.py

#Hooking SafetyNet stuff for fun (no profit tho :( )
#Several Functions just uncomment to use or modify :)
#by T31M

import frida
import sys

PACKAGE_NAME = "com.nianticlabs.pokemongo"

process = frida.get_usb_device().attach(PACKAGE_NAME)
print("Attached")

script = process.create_script("""

/*
Java.enumerateLoadedClasses({
    onMatch: function(match) {
        if(match.indexOf("safetynet") !== -1)
            send("Enumerate: " + match );

            Java.perform(function () {
            var TM = Java.use(match);
            TM.init.implementation = function (args) {
                send(args);
            }
            });

    },    
    onComplete: function() { }
});
*/

/*
var module = Process.findModuleByName("libcrypto.so");
//var exports = Module.enumerateExportsSync("libc.so");

//Process.enumerateModulesSync().forEach(function (module) {
    //send(module);
    Module.enumerateExportsSync(module.name).forEach(function (exp) {

        //send("Hook: " + exp.name + " in: " + module.name + " at: " + ptr(exp.address));

        try {
            Interceptor.attach(ptr(exp.address), {
                onEnter: function (args) {
                    send("Called: "+ exp.name);
                }
            });
         } catch (e) {
            send("Error: " + e + " at F: " + exp.name + "in M: " + module.name);
         }
    });
//});

*/

Java.perform(function () {
    //var TM = Java.use("com.google.android.gms.safetynet.SafetyNetApi");
    var TM = Java.use("com.nianticlabs.nia.platform.SafetyNetService");
    TM.checkResult.implementation = function (result) {
        this.result = result;
        send("Debug: checkResult() got called! Let's call the original implementation");
        send("Hook: Result: " + result);
        orig = this.checkResult(result);
        send("Original Returned: " + orig);
        return orig;
    };
});

Java.perform(function () {
    var TM = Java.use("com.nianticlabs.nia.platform.SafetyNetService");
    TM.nativeAttestResponse.implementation = function (nonce, result) {
            send("Debug: NativeAttestResponse() got called! Let's call the original implementation");
            send("Hook: Nonce: " + nonce);
            send("Hook: Result: " + result);
            //send("Original Returned: " + this.nativeAttestResponse(nonce, this.result));
            //return True;
    };
});

/*
Java.perform(function () {
    var TM = Java.use("com.nianticlabs.nia.platform.SafetyNetService");
    TM.attestResponse.implementation = function (nonce, result) {
            send("Debug: attestResponse() got called! Let's call the original implementation");
            send("Hook: Nonce: " + nonce);
            send("Hook: Result: " + result);
            send("Original Returned: " + this.attestResponse(nonce, this.result));
            //return True;
    };
});
*/

Java.perform(function() {
        var TM = Java.use("java.lang.StringBuilder");
        TM.append.overload("java.lang.String").implementation = function (add) {
            if(add.indexOf("rmn") == -1 && add != "" && add != ":" && add.indexOf("Thread") && add.length > 5) {
                send(add);
            }
            return (this.append(add));
        };
    });


""")

def get_messages(message, data):
    if message['type'] == 'send':
        payload = message['payload']
        print(payload);
    else:
        print (message)
 
script.on('message',get_messages)
script.load()
print("Script Loaded")
sys.stdin.read()

is Not Work Pro i Get The error "Error: could not parse 'C:\Users\David\Desktop\FridaScripts\frida_hook_safetynet.py' line 1: expecting '('
at (/frida/repl-2.js:1)"

This is a very old snipped from 2016 and some initial analysis of PokemonGO / Android Safetynet attestation / hooking it (without bypassing it).
Most likely Frida changed their API / the code snipped is just not compatible with newer versions of Frida (but there is also no value in trying to use this).
In any case basically any rooted phone that can run Frida server as root can be modded to bypass basic Safetynet attestation anyway.
This script was just for early research purposes.