[Android Software Development] pndwal:
Sorry, but you did say:

Of course devices are already successfully 'forced back to basic' attestation by USNF's fake keystore provider registration (this fallback trigger works as well for A13 LV devices as for other devices meaning gms is already obtaining basic attestations from droidguard) so are simply NOT forced to use hardware key based checking (although this is nothing to do with any prop changes)...

However even assuming (since we know hardware check is already 'forced back to basic') that you actually meant 'Devices released with Android 13 (API 33) are prevented from bypassing hardware evaluation type enforcement by PI API even if you try to bypass this' rather than "Devices released with Android 13 (API 33) are forced to use the hardware check even if you try to force it back to basic", while there is an extra level of enforcement for these (we now need a third mismatched prop, so model, fingerprint and ship level), A13 devices CAN still pass basic evaluation type integrity checks!!!...

By stating "Devices released with Android 13 are forced to use the hardware check even if you try to force it back to basic; Devices released with Android 12 can still be forced back to basic" you implied Devices released with Android 13 cannot pass basic evaluation type integrity checks (no?)... And of course this is NOT so, as stated!

So for A13 devices on Google's prop-based 'enforce hardware based verdicts' list (enforced by new PI API) we simply need mismatched model, fingerprint and ship level props with passing values assuming that the first two are still needed in A13 LV (I haven't tested if Google actually still uses those props w/ API level 33+ shipping level prop device flagging for hardware based verdict enforcement; the former may actually be 'swapped out' for the latter)... For A12 LV and earlier we need only mismatched model prop and (especially w/ A11+) mismatched fingerprint prop with passing values for many (most?) devices... 🙂

... Next, you seem to link the commit for ship level prop adjustment with 'forcing devices released with Android 12 back to basic'. As I mentioned, this is actually the very prop-based enforcement bypass needed (possibly in addition to the earlier two) to pass PI API's deviceIntegrity w/ basic evaluation type attestations in A13+ LV devices... It does nothing for A12 devices!...

Nb. We can also see that basic evaluation type attestations are being used already even without that commit as S/N API passes with just the model prop-based hardware based verdict enforcement bypass!... The fallback trigger means droidguard supplies basic attestation data to gsm so both S/N and PI API are now using basic attestations...

Further, stating "Devices released with Android 13 are forced to use the hardware check even if you try to force it back to basic" will worry those concerned about USNF's effectiveness w/ any A13+ device which is why I clarified that the ship level prop adjustment commit actually does work to allow basic attestation based verdicts to pass in A13 LV devices and observed:

... but praps you just meant "Devices released with Android 13 are forced to use the hardware check if you don't try hard enough to force it back to basic", or

correctly

, "...will fail deviceIntegrity check despite using basic attestation data if you don't try hard enough to make it accept a basic evaluation based verdict, ie. to bypass API's hardware based verdict enforcement"(?)...

Well said... Exactly... 'n thanks for screenshots! 😋 PW