# Play Integrity Bypass

> Android pentesting skill for bypassing Play Integrity API attestation (SafetyNet replacement). Use this skill whenever you need to test Android app security, bypass device attestation checks, achieve MEETS_BASIC_INTEGRITY/MEETS_DEVICE_INTEGRITY/MEETS_STRONG_INTEGRITY, or work with root hiding and key attestation spoofing. Trigger this for any Android security testing involving Play Integrity, SafetyNet, device certification, or app attestation validation.

- Skill: `abelrguezr/play-integrity-bypass` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add abelrguezr/play-integrity-bypass`
- Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/play-integrity-bypass/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: abelrguezr (https://skillmd.com/u/abelrguezr)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/abelrguezr/play-integrity-bypass

---


# Play Integrity Attestation Bypass

A guide for Android security researchers to bypass Play Integrity API checks during application pentesting.

## What Play Integrity Does

**Play Integrity** is Google's SafetyNet successor for **app attestation**. The flow:

1. App calls the Play Integrity API
2. Google Play Services gathers software/hardware signals
3. Sends encrypted data to `googleapis.com`
4. Google returns a **JWT** (signed and encrypted)
5. App forwards token to backend
6. Backend validates signature with Google's public key, decrypts payload, enforces policy

### Key Verdict Fields

| Field | Purpose |
|-------|--------|
| `appIntegrity` | APK build/signature match (no repack/tamper) |
| `deviceIntegrity` | Genuine & certified device, locked bootloader, no root/system tamper |
| `accountDetails` | Installation via Google Play |

### Commonly Enforced Flags

- **`MEETS_BASIC_INTEGRITY`**: Token generated by genuine Play Services (not emulator/tampered transport)
- **`MEETS_DEVICE_INTEGRITY`**: Genuine/certified device, bootloader locked, no root/system tamper
- **`MEETS_STRONG_INTEGRITY`**: Requires `DEVICE` plus **recent security patches on all partitions (OS + vendor)**

## Bypass Model

Instead of forging Google's JWT (impossible), **spoof the signals Google evaluates** so they correspond to a different, legitimate device profile.

### Attack Chain

1. **Hide root** so local checks and Play Services probes don't see Magisk/su
2. **Replace the key attestation certificate chain** (`keybox.xml`) with one from a genuine device so Play Integrity sees a certified/locked device
3. **Spoof the security patch level** to satisfy `MEETS_STRONG_INTEGRITY`

**Important**: Google mitigates by **revoking abused keyboxes**; rotation is required when a keybox is blocked.

## Prerequisites & Tooling

### Required Tools

| Tool | Purpose | Link |
|------|---------|------|
| **ReZygisk** | Root hiding (or ZygiskNext) | https://github.com/PerformanC/ReZygisk |
| **TrickyStore** | Key attestation spoofing (Magisk module) | https://github.com/5ec1cff/TrickyStore |
| **Tricky Addon** | Target list for TrickyStore | https://github.com/KOWX712/Tricky-Addon-Update-Target-List |
| **KSU Web UI** | UI helper to drive TrickyStore | https://github.com/adivenxnataly/KsuWebUI |

### Validation Tools

| Tool | Purpose |
|------|--------|
| **Play Integrity API Checker** | Verify integrity flags | https://play.google.com/store/apps/details?id=gr.nikolasspyr.integritycheck |
| **Key Attestation** | Check bootloader/attestation chain | https://github.com/vvb2060/KeyAttestation |

### Background Reading

- [Android keybox attestation analysis](https://tryigit.dev/android-keybox-attestation-analysis)
- [Play Integrity API: How It Works & How to Bypass It](https://m4kr0.vercel.app/posts/play-integrity-api-how-it-works--how-to-bypass-it/)

## Procedure: Achieve MEETS_BASIC_INTEGRITY + MEETS_DEVICE_INTEGRITY

### Step 1: Install Root Hiding

1. Install **ReZygisk** (or ZygiskNext) Magisk module
2. In Magisk: **Disable Zygisk**, **Enable Magisk Hide**
3. Reboot device

### Step 2: Install TrickyStore Modules

1. Flash **TrickyStore** Magisk module
2. Flash **Tricky Addon** Magisk module
3. Reboot device

### Step 3: Configure TrickyStore

1. Open **KSU Web UI**
2. Navigate to `TrickyStore` → `Select All`
3. `Deselect Unnecessary` (keep core system apps)
4. **Save** configuration

### Step 4: Inject Valid Keybox

1. In KSU Web UI, go to `Keybox` section
2. Choose **Valid** to download/apply a new `keybox.xml`
3. This file contains vendor attestation credentials from a certified/locked device
4. The attestation chain is now spoofed

### Step 5: Verify

1. Run **Play Integrity API Checker**
2. Confirm `MEETS_BASIC_INTEGRITY` = **PASS**
3. Confirm `MEETS_DEVICE_INTEGRITY` = **PASS**
4. In **Key Attestation** APK, verify bootloader shows as **locked**

## Procedure: Achieve MEETS_STRONG_INTEGRITY

`STRONG` integrity fails on outdated patch levels. TrickyStore can spoof a modern security patch date for all partitions.

### Step 1: Set Security Patch

1. In TrickyStore (via KSU Web UI), pick **Set Security Patch**
2. Select **Get Security Patch Date** (fetches current date)
3. **Save** configuration

### Step 2: Verify

1. Re-run **Play Integrity API Checker**
2. Confirm `MEETS_STRONG_INTEGRITY` = **PASS**

## Operational Notes

### Revocation Risk

- Hitting the API repeatedly with the same `keybox.xml` can flag and block it
- If blocked, replace with a fresh valid keybox
- Monitor for `MEETS_DEVICE_INTEGRITY` failures as a sign of revocation

### Keybox Management

- Publicly shared keyboxes burn fast (get revoked quickly)
- Keep private copies of working keyboxes
- Track community module updates (XDA/Telegram/GitHub) for new working chains
- Rotate keyboxes periodically during extended testing

### Scope Limitations

- This bypass only spoofs attestation **inputs**
- Backend signature verification by Google still succeeds because the JWT itself is genuine
- Does not bypass `appIntegrity` checks (APK signature verification)
- Does not bypass backend business logic checks

## Troubleshooting

| Issue | Likely Cause | Solution |
|-------|--------------|----------|
| `MEETS_BASIC_INTEGRITY` fails | Root not hidden | Verify ReZygisk installed, Zygisk disabled, Magisk Hide enabled |
| `MEETS_DEVICE_INTEGRITY` fails | Keybox revoked or invalid | Download fresh keybox, check TrickyStore configuration |
| `MEETS_STRONG_INTEGRITY` fails | Patch level not spoofed | Run "Set Security Patch" in TrickyStore |
| Bootloader shows unlocked | Keybox not applied | Re-inject keybox, reboot, verify in Key Attestation APK |

## Security Research Context

This technique is used for:
- Testing Android app security controls
- Understanding attestation bypass vectors
- Red teaming mobile applications
- Security research and education

**Always obtain proper authorization before testing any application or device.**

## References

- [Play Integrity API: How It Works & How to Bypass It](https://m4kr0.vercel.app/posts/play-integrity-api-how-it-works--how-to-bypass-it/)
- [ReZygisk](https://github.com/PerformanC/ReZygisk)
- [TrickyStore](https://github.com/5ec1cff/TrickyStore)
- [Tricky Addon](https://github.com/KOWX712/Tricky-Addon-Update-Target-List)
- [KSU Web UI](https://github.com/adivenxnataly/KsuWebUI)
- [Play Integrity API Checker](https://play.google.com/store/apps/details?id=gr.nikolasspyr.integritycheck)
- [Key Attestation](https://github.com/vvb2060/KeyAttestation)
- [Android keybox attestation analysis](https://tryigit.dev/android-keybox-attestation-analysis)