[Magisk] V0latyle:
THIS IS NOT A SUPPORT THREAD. For questions and support regarding how to fix your Play Integrity verdicts, see the Play Integrity Fix thread.

⚠️BEFORE YOU ASK A QUESTION, READ THIS POST AND THE FAQ!⚠️

****Update 12/11/23****

Google has been busy banning mismatched fingerprints, and as of now there is no "one size fits all" solution to spoof said prints. The best way forward is to find your own fingerprint and use it with @osm0sis's Play Integrity Fork.

Play Integrity API

What is Play Integrity?

Play Integrity is an API that is used by applications to determine device compatibility and security state. It has replaced SafetyNet for the most part, with a deadline of January 2025, when Google's SafetyNet servers will go offline. Apps that continue to exclusively depend on SafetyNet will no longer work once this happens. Most developers have already migrated to Play Integrity.​

How is Play Integrity different from SafetyNet?

In many ways, it's very similar. It uses many of the same checks as SafetyNet, but the responses have been made a bit simpler.​

Like SafetyNet, Play Integrity allows app developers to select a tiered enforcement strategy based on their requirements for the target environment.​

Is Play Integrity the same as Play Protect?

No. Play Integrity provides users with the ability to verify device compatibility and security, much like SafetyNet did. Play Protect is a part of the Play Store that ensures that your device is certified, and helps to protect against malware. However, the Play Protect certification result does depend on your DEVICE_INTEGRITY result. See here.​

Note: Your Play Certification may lag behind your Integrity verdicts. It is possible for Play Store to continue to report "Device is certified" even if you're failing DEVICE_INTEGRITY, and vice versa - it may still report "Not certified" even though you're passing. To fix this, wipe Play Store data.​

Why does this matter?

Like SafetyNet, many payment, banking, and DRM apps use this API to determine a device's compatibility and security state. Failing verdicts may limit your ability to install and use those apps.​

My device passes SafetyNet but I can't use Google Pay/other apps.

Don't rely on SafetyNet as a good assessment of your device's compatibility and security. It is possible to pass SafetyNet, but fail Play Integrity. Make sure you are specifically checking your device's Play Integrity verdicts.​

Rooted Pixel 5 on stock firmware: USNF 2.3.1 shows SafetyNet Pass using YASNAC, but device fails Play Integrity DEVICE_INTEGRITY check.

How do I know if my device is passing Play Integrity checks?

To check Play Integrity status, you can do so through the Play Store.​

​

Tap the Profile icon in the upper right, go to Settings > About > Tap Play Store version 8 times. This unlocks developer mode in the Play Store.​

Now go to Settings > General > Developer options > Check integrity.​

​

If you prefer a clear visual indicator, you can use this app:​

Play Integrity API Checker - Apps on Google Play

Get info about your Device Integrity through the Play Intergrity API

play.google.com

Github​

​

This app not only checks Play Integrity verdicts, but checks for traces of root, Magisk, and Xposed:​

TB Checker - Play Integrity - Apps on Google Play

All in one tools check android devices

play.google.com

​

​

If you're a nerd and you want to see key attestation details, use this:​

Key Attestation Demo - Apps on Google Play

Demo for Key Attestation feature of the Android system.

play.google.com

Github​

​

What can I do to fix it?

It depends on your device and software state.​

​

The only universal answer is this: You have to spoof a fingerprint from a device that isn't capable of hardware attestation, thereby causing Play Integrity to fall back to basic attestation. This print is ONLY spoofed to DroidGuard, the GMS root detection engine, so all other apps will still see your device's "real" print.​

​

There are two ways to do this: either you'll have to use a Magisk module, or the fixes in the module must be baked into the ROM you're using.​

If you are on the OEM ROM, or a custom ROM that hasn't been "fixed", you can use a module like Play Integrity Fork, and find a fingerprint to spoof with it. It is important that you use your own, instead of a shared print. To select a random print, you can use PIFS; PixelFlasher will also do this for you.

If you are on a custom ROM, it is up to the ROM developer to "bake" the fix into their work. However, because this means you'll be sharing a fingerprint with everyone else who's using that ROM, there's a good chance it will get blacklisted by Google sooner.

To find a custom fingerprint, read @simplepinoi177's guide here:​

How to search & find your own fingerprints [noob friendly]: A Comprehensive Guide w/ tips & Discussion for Complete Noobs (from one)

It seems Google has banned more than 95% of custom fingerprints, so this thread/guide has kind been laid to the wayside. But it's still a great resource to understanding the foundations of fingerprints and all that... This is for any/all utterly...

xdaforums.com

The basics:​

Look for devices that shipped BEFORE Android 8, but were updated to at least Android 8 during their lifetime

Don't go any older than Android 5.0 (API 21)

Don't go any newer than Android 8.1 (API 27)

Most of the information you need should be in build.prop; this is often in several places in the device build, I've found that /vendor/build.prop works well

Use Pixel Flasher to process the props and generate a custom print. See @badabing2003's guide here:

🔧 [MODULE] Play Integrity Fix (SafetyNet fix)

PLAY INTEGRITY FIX This module tries to fix Play Integrity and SafetyNet verdicts to get a valid attestation. BEFORE YOU START: - Your ROM must be signed with a private key from maintainer, you can check with this command: unzip -l...

xdaforums.com

Why doesn't the

original Universal SafetyNet Fix

work?

This project is not consistently maintained and does not include the necessary fixes.​

​

Do I need to pass STRONG integrity?

This is ultimately up to the individual app developer. We don't know which ones may require this result, we only know which ones don't. Google, coincidentally, is not one of these - to use GPay/Wallet, you only need BASIC and DEVICE.​

​

Please note that the only attestation requriements Google can enforce is for thier own apps. They cannot require any third party app to use hardware backed attestation. That's the whole point of providing the Play Integrity API - it's simply a means for developers to determine how secure your device is.​

​

It's also worth noting that many if not most "security intensive" apps out there rely on third party security engines that often look for additional signs a device might be modified; see the next point below.​

​

If you are having problems with a specific app, chances are that app uses its own root detection methods; you may need to use additional modules such as Shamiko.​

​

I'm passing BASIC and DEVICE but an app is still detecting root. What do I do?

Some apps may implement their own root detection methods. Oddly enough, it seems that Google has documented a means for app developers to verify crytographic hardware keys without using Play Integrity at all,​

​

Other methods of root detection may include:​

checking for the presence of a SU binary

checking for the presence of a root manager app such as Magisk or SuperSu

checking for traces of Zygisk / Xposed / LSPosed

checking for permissive SELinux

checking whether USB Debugging is enabled

It's a game of cat and mouse with these, as the methods they use are not always clear. Please be aware that this thread is ONLY intended for support with passing Play Integrity, and questions regarding hiding root for individual apps should be referred to the this thread.​

​

​

​

Spoiler content hidden.

​

​

For more information, please read the discussion in this thread.​