[Android Software/Hacking General [Developers Only]] osm0sis:
Merry Christmas and Happy Holidays! 🎅

PIFork v5 makes good on my full future proofing goal of supporting both all Build fields and all system properties! This includes any Google may add to Android and/or enforce new checks for down the road, you'd just need to add them to your custom.pif.json and they'll already just work! Huge thanks to @arda99 for the amazing help with the full properties support! 🙌

To switch from chiteroman's module, simply move your pif.json to /data/adb/modules/playintegrityfix/custom.pif.json then flash my module zip. You'll see it detect the custom.pif.json during the flash, retain it through the upgrade, and migrate it to the new format. Make sure you're following normal json format with a single entry of quoted key and value per line, and make sure your FIRST_API_LEVEL is present and correctly filled beforehand for best results. (y)

I work on these projects in my limited time off, so if you like the progress I'm making, or enjoy anything else I've done on xda, please consider sponsoring my ongoing work using my GitHub Sponsors profile. For a one-time donation you can hit the donate link from my profile. Thanks for your support!

GitHub - osm0sis/PlayIntegrityFork: Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props

Fix Play Integrity (and SafetyNet) verdicts, allowing custom fields and props - osm0sis/PlayIntegrityFork

github.com

Play Integrity Fork v5:

- allow spoofing literally any system property, supporting * leading wildcards to match multiple properties in a single entry

- remove all backwards/cross-fork compatibility cruft and deprecated entries support

- add logging levels by (optionally) putting VERBOSE_LOGS as the last json entry with a value of 0 (off), 1, 2, 3 or 100

- spoof sys.usb.state as "mtp" to DroidGuard by default to hide USB Debugging

- update example.pif.json for new system properties default entries

- add migration script to automatically upgrade an old custom.pif.json during install/update (may also be run manually)

Note in the example.pif.json that my new properties entries still just correspond to things that we were already spoofing, but it is important that we properly separate Build fields and system properties going forward since they are actually separate checks in DroidGuard, so we need to stop conflating them: https://raw.githubusercontent.com/osm0sis/PlayIntegrityFork/main/module/example.pif.json

When setting VERBOSE_LOGS to 100 you can see everything DroidGuard is checking in system properties, and the ones I've seen of interest in it so far are as follows:

build.version.extensions.ad_services
build.version.extensions.r
build.version.extensions.s
build.version.extensions.t
build.version.extensions.u
ro.board.first_api_level
ro.boot.flash.locked
ro.boot.hardware.revision
ro.boot.vbmeta.digest
ro.boot.vbmeta.device_state
ro.boot.verifiedbootstate
ro.build.id
ro.build.version.sdk
ro.build.version.security_patch
ro.debuggable
ro.hardware.egl
ro.product.first_api_level
ro.product.vndk.version
ro.secure
ro.vendor.api_level
ro.vendor.build.version.sdk
ro.vndk.version
ro.zygote
sys.usb.state

You'll notice we already cover the big ones that are safe to spoof globally in the module's post-fs-data.sh and service.sh boot scripts, and others are in the new defaults. A lot of the list doesn't seem to be currently enforced, but just be aware that more could at some point and this is how you can check them. 🤘

Known Issues:

- ShadowHook is currently broken on the Android 14 QPR2 Betas (due for Stable in March), resulting in system properties failing to be spoofed via the libc hook. I've reported it to them and am waiting for them to triage, but I'll be looking into other options as well.

References:

https://android.googlesource.com/platform/frameworks/base/+/master/core/java/android/os/Build.java

Happy hacking! :cowboy: