Introduction to App Attestation
Any application that uses APIs and transfers sensitive data needs to verify the integrity of the environment it is running in. Specifically, it must continuously ensure that:
To achieve this, the concept of App Attestation was introduced. Some developers use it as an additional security layer with traditional root detection mechanisms.
For example, even if you successfully bypass root detection using tools like Magisk modules, the application may still refuse to work. In most cases, this behavior is caused by app attestation checks failing.
To standardize and strengthen this mechanism, Google introduced Play Integrity as an official solution for app attestation.
What is Play Integrity API?
Before the Play Integrity API existed, Google provided a set of APIs known as SafetyNet. It was used to perform app attestation, but it had several limitations and was not always reliable or accurate.
As a result, Google decided to replace SafetyNet with a more robust and modern solution: Play Integrity API.
According to the official documentation:
> The Play Integrity API helps you check that user actions and server requests are coming from your genuine app, installed by Google Play, running on a genuine and certified Android device. By detecting risky interactions — like those from tampered app versions, untrustworthy devices, or emulated environments — your backend server can respond with appropriate actions to prevent abuse and unauthorized access, fight fraud, combat cheating, and protect users from attacks.
How Play Integrity API Works
The Play Integrity API operates through a sophisticated verification process:
Step-by-Step Flow
Deep Dive: Key Attestation Mechanics
To understand how to bypass Play Integrity, we must first understand the underlying mechanism it relies on: Android Key Attestation.
The Chain of Trust
At its core, Android Key Attestation is a cryptographic protocol that allows a server to verify that a cryptographic key pair is stored in a device's hardware-backed keystore (Trusted Execution Environment - TEE, or StrongBox).
When an app requests attestation, the device produces an X.509 certificate chain:
The Role of keybox.xml
During the manufacturing process, a file (often referred to as `keybox.xml` in the custom ROM/rooting community) is provisioned to the device's TEE. This file contains a batch of private keys and their corresponding certificate chains. The TEE uses these private keys to sign the attestation certificates generated by apps.
Crucial Detail: The private keys in the keybox never leave the secure hardware (in a stock, locked device).
Hardware vs. Software Attestation
Play Integrity Verdict Mechanisms
The verdict returned by the Play Integrity API is based on three main integrity mechanisms:
App Integrity
Device Integrity
Account Integrity
Understanding the Verdicts
MEETS_BASIC_INTEGRITY
This ensures that the Attestation Token is generated by genuine Google Play Services and cannot be easily forged or tampered with by external modifications.
MEETS_DEVICE_INTEGRITY
The app is running on a genuine and certified Android device. This specifically verifies the absence of root access, unlocked bootloaders, and system-level tampering.
MEETS_STRONG_INTEGRITY
This requires `MEETS_DEVICE_INTEGRITY` and security updates in the last year for all partitions of the device, including an Android OS partition patch and a vendor partition patch.
Server Decision Making
Based on the verdict, the server decides how to handle the request:
How Play Integrity Can Be Bypassed
Most Play Integrity bypass techniques rely on spoofing. Instead of sending the real device (rooted) properties or hardware fingerprint to the Play Integrity API, the application environment is manipulated to send the profile of a different, legitimate, and certified device.
TrickyStore Internals: The "Leaf Hack"
TrickyStore is a Zygisk module that spoofs the certificate chain to make a compromised (rooted) device appear as a valid, hardware-backed device.
Result: The server sees a chain that traces back to Google's Root, is signed by a valid Intermediate, and has a Leaf that matches the app and claims hardware security.
Initial State - Before Bypass
This is the initial Play Integrity check result on a rooted device:
After installing Magisk modules without proper configuration:
Prerequisites for Bypass
Required Tools
Step 1: Hiding Root Detection
Before anything else, we need to hide root from the device:
Step 2: Bypass MEETS_DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY
`MEETS_DEVICE_INTEGRITY` specifically verifies the absence of root access, unlocked bootloaders, and system-level tampering. To bypass it, we need to spoof the device profile using a legitimate device.
`MEETS_BASIC_INTEGRITY` is expected to pass normally as long as there are no modifications by modules because its primary check is to verify that you are not using an emulator and that the Attestation Token sent to Google was not directly intercepted or tampered with.
However, once you start installing modules and making changes, it will no longer pass unless the modifications are done correctly.
Steps to Bypass
Understanding keybox.xml
`keybox.xml` is a file storing vendor security credentials used in the Key Attestation process. The modules use a spoofed or replaced copy of this file (taken from a genuine device) to trick integrity checks into believing the device is certified and has a locked bootloader, thus achieving `MEETS_DEVICE_INTEGRITY`.
After completing these steps, check Play Integrity API Checker. Now `MEETS_DEVICE_INTEGRITY` and `MEETS_BASIC_INTEGRITY` should be successfully bypassed.
Step 3: Bypass MEETS_STRONG_INTEGRITY
This verdict checks the security update level. To bypass it, we need to spoof a modern date for security patch. The module tricks Google's integrity checks into believing the device is running the latest updates.
This manipulation is often necessary to successfully pass the strict `MEETS_STRONG_INTEGRITY` verdict, as Google may reject devices running significantly outdated patch levels.
Steps
After this, check Play Integrity API Checker. You will find that all checks have been successfully bypassed.
When checking Key Attestation APK, you will find that the bootloader appears as locked.
Server-Side Verification Logic
To understand what we are bypassing, it helps to look at how a backend server verifies the token. This is the logic that TrickyStore aims to fool.
const { google } = require('googleapis');
// Initialize the Play Integrity API client
const playIntegrity = google.playintegrity('v1');
async function verifyIntegrityToken(integrityToken, packageName) {
try {
// 1. Decrypt and verify the token with Google's servers
const res = await playIntegrity.v1.decodeIntegrityToken({
packageName: packageName,
resource: {
integrityToken: integrityToken,
},
});
const verdict = res.data.tokenPayloadExternal;
// 2. Check Device Integrity
// TrickyStore aims to ensure 'MEETS_DEVICE_INTEGRITY' is present here.
const deviceVerdict = verdict.deviceIntegrity.deviceRecognitionVerdict;
if (!deviceVerdict.includes('MEETS_DEVICE_INTEGRITY')) {
throw new Error('Device integrity check failed: ' + deviceVerdict);
}
// 3. Check App Integrity (Package Name & Certificate)
// This ensures the token wasn't generated by a spoofed app on a valid device.
if (verdict.appIntegrity.appRecognitionVerdict !== 'PLAY_RECOGNIZED') {
throw new Error('App not recognized by Play Store');
}
return { valid: true, payload: verdict };
} catch (error) {
console.error('Verification failed:', error.message);
return { valid: false, error: error.message };
}
}Advanced Detection Methods
Since Play Integrity can be bypassed with a valid keybox, high-security apps (banking, games) use "Defense in Depth" strategies to detect the environment itself.
Troubleshooting Common Failures
Even with TrickyStore, the bypass is not 100% reliable.
Important Warnings
Rate Limiting: Do not run Play Integrity API Checker too frequently, as Google may become suspicious of the keybox and block it. In that case, you will be forced to set a new valid `keybox.xml`.
Keybox Rotation: Keyboxes can be revoked by Google. Always have backup valid keyboxes available.
Legal Considerations: This information is for security research and authorized penetration testing only. Bypassing Play Integrity on apps without authorization may violate terms of service.
Security Implications for Developers
Why Bypass Matters for Testing
Understanding Play Integrity bypass is crucial for:
Recommendations for Developers
Tools Reference
TrickyStore
Tricky Addon
ReZygisk
KSU Web UI
Conclusion
Play Integrity API is Google's modern solution for app attestation, replacing the older SafetyNet. While it provides strong protection against tampering and root detection, security researchers can bypass these checks using device profile spoofing and keybox replacement techniques.
For penetration testers and security researchers, understanding these bypass techniques is essential for comprehensive mobile security assessments. For developers, this knowledge highlights the importance of defense-in-depth strategies that don't rely solely on client-side attestation.
Disclaimer: This guide is for educational and authorized security testing purposes only. Always obtain proper authorization before testing applications.
Original Article Credit: This article is based on research by [Adham A. Makroum (M4KR0)](https://m4kr0.vercel.app/posts/android-pentest/play-integrity-api-how-it-works--how-to-bypass-it/).