OpenSkillIndex← back to search

Hacktricks-skills play-integrity-bypass

Android pentesting skill for bypassing Play Integrity API attestation (SafetyNet replacement). Use this skill whenever you need to test Android app security, bypass device attestation checks, achieve MEETS_BASIC_INTEGRITY/MEETS_DEVICE_INTEGRITY/MEETS_STRONG_INTEGRITY, or work with root hiding and key attestation spoofing. Trigger this for any Android security testing involving Play Integrity, SafetyNet, device certification, or app attestation validation.

install
source · Clone the upstream repo
git clone https://github.com/abelrguezr/hacktricks-skills
manifest: skills/mobile-pentesting/android-app-pentesting/play-integrity-attestation-bypass/SKILL.MD
source content

Play Integrity Attestation Bypass

A guide for Android security researchers to bypass Play Integrity API checks during application pentesting.

What Play Integrity Does

Play Integrity is Google's SafetyNet successor for app attestation. The flow:

  1. App calls the Play Integrity API
  2. Google Play Services gathers software/hardware signals
  3. Sends encrypted data to 
    googleapis.com
  4. Google returns a JWT (signed and encrypted)
  5. App forwards token to backend
  6. Backend validates signature with Google's public key, decrypts payload, enforces policy

Key Verdict Fields

FieldPurpose
appIntegrity
APK build/signature match (no repack/tamper)
deviceIntegrity
Genuine & certified device, locked bootloader, no root/system tamper
accountDetails
Installation via Google Play

Commonly Enforced Flags

  • MEETS_BASIC_INTEGRITY
    : Token generated by genuine Play Services (not emulator/tampered transport)
  • MEETS_DEVICE_INTEGRITY
    : Genuine/certified device, bootloader locked, no root/system tamper
  • MEETS_STRONG_INTEGRITY
    : Requires 
    DEVICE
    plus recent security patches on all partitions (OS + vendor)

Bypass Model

Instead of forging Google's JWT (impossible), spoof the signals Google evaluates so they correspond to a different, legitimate device profile.

Attack Chain

  1. Hide root so local checks and Play Services probes don't see Magisk/su
  2. Replace the key attestation certificate chain (
    keybox.xml
    ) with one from a genuine device so Play Integrity sees a certified/locked device
  3. Spoof the security patch level to satisfy 
    MEETS_STRONG_INTEGRITY

Important: Google mitigates by revoking abused keyboxes; rotation is required when a keybox is blocked.

Prerequisites & Tooling

Required Tools

ToolPurposeLink
ReZygiskRoot hiding (or ZygiskNext)https://github.com/PerformanC/ReZygisk
TrickyStoreKey attestation spoofing (Magisk module)https://github.com/5ec1cff/TrickyStore
Tricky AddonTarget list for TrickyStorehttps://github.com/KOWX712/Tricky-Addon-Update-Target-List
KSU Web UIUI helper to drive TrickyStorehttps://github.com/adivenxnataly/KsuWebUI

Validation Tools

ToolPurpose
Play Integrity API CheckerVerify integrity flags
Key AttestationCheck bootloader/attestation chain

Background Reading

Procedure: Achieve MEETS_BASIC_INTEGRITY + MEETS_DEVICE_INTEGRITY

Step 1: Install Root Hiding

  1. Install ReZygisk (or ZygiskNext) Magisk module
  2. In Magisk: Disable Zygisk, Enable Magisk Hide
  3. Reboot device

Step 2: Install TrickyStore Modules

  1. Flash TrickyStore Magisk module
  2. Flash Tricky Addon Magisk module
  3. Reboot device

Step 3: Configure TrickyStore

  1. Open KSU Web UI
  2. Navigate to 
    TrickyStore
    → 
    Select All
  3. Deselect Unnecessary
    (keep core system apps)
  4. Save configuration

Step 4: Inject Valid Keybox

  1. In KSU Web UI, go to 
    Keybox
    section
  2. Choose Valid to download/apply a new 
    keybox.xml
  3. This file contains vendor attestation credentials from a certified/locked device
  4. The attestation chain is now spoofed

Step 5: Verify

  1. Run Play Integrity API Checker
  2. Confirm 
    MEETS_BASIC_INTEGRITY
    = PASS
  3. Confirm 
    MEETS_DEVICE_INTEGRITY
    = PASS
  4. In Key Attestation APK, verify bootloader shows as locked

Procedure: Achieve MEETS_STRONG_INTEGRITY

STRONG
integrity fails on outdated patch levels. TrickyStore can spoof a modern security patch date for all partitions.

Step 1: Set Security Patch

  1. In TrickyStore (via KSU Web UI), pick Set Security Patch
  2. Select Get Security Patch Date (fetches current date)
  3. Save configuration

Step 2: Verify

  1. Re-run Play Integrity API Checker
  2. Confirm 
    MEETS_STRONG_INTEGRITY
    = PASS

Operational Notes

Revocation Risk

  • Hitting the API repeatedly with the same 
    keybox.xml
    can flag and block it
  • If blocked, replace with a fresh valid keybox
  • Monitor for 
    MEETS_DEVICE_INTEGRITY
    failures as a sign of revocation

Keybox Management

  • Publicly shared keyboxes burn fast (get revoked quickly)
  • Keep private copies of working keyboxes
  • Track community module updates (XDA/Telegram/GitHub) for new working chains
  • Rotate keyboxes periodically during extended testing

Scope Limitations

  • This bypass only spoofs attestation inputs
  • Backend signature verification by Google still succeeds because the JWT itself is genuine
  • Does not bypass 
    appIntegrity
    checks (APK signature verification)
  • Does not bypass backend business logic checks

Troubleshooting

IssueLikely CauseSolution
MEETS_BASIC_INTEGRITY
fails		Root not hiddenVerify ReZygisk installed, Zygisk disabled, Magisk Hide enabled
MEETS_DEVICE_INTEGRITY
fails		Keybox revoked or invalidDownload fresh keybox, check TrickyStore configuration
MEETS_STRONG_INTEGRITY
fails		Patch level not spoofedRun "Set Security Patch" in TrickyStore
Bootloader shows unlockedKeybox not appliedRe-inject keybox, reboot, verify in Key Attestation APK

Security Research Context

This technique is used for:

  • Testing Android app security controls
  • Understanding attestation bypass vectors
  • Red teaming mobile applications
  • Security research and education

Always obtain proper authorization before testing any application or device.

References