Google Play Integrity API: How It Works & How to Bypass It
Deep dive into Google Play Integrity API, understanding app attestation mechanisms, device integrity verdicts, and practical techniques to bypass MEETS_DEVICE_INTEGRITY and MEETS_STRONG_INTEGRITY checks during Android security testing.
What is Play Integrity API?
Play Integrity API is Google's modern app attestation solution that replaced SafetyNet. It verifies that API requests come from legitimate, unmodified apps running on genuine Android devices.
Key Concept: App Attestation
App attestation ensures API requests come from unmodified apps on non-rooted, certified devices. Even if you bypass traditional root detection with Magisk, Play Integrity can still detect tampering.
How Play Integrity Works
Client Side
- App requests integrity check
- Google collects device signals
- Receives encrypted JWT token
- Forwards token to backend
Server Side
- Verifies Google signature
- Decrypts JWT payload
- Extracts verdict values
- Makes access decision
Evolution of Android Attestation
SafetyNet Era (2014-2022)
Initial app attestation API with CTS profile matching. Had reliability issues and was easier to bypass.
Hardware Attestation (2017+)
Introduction of hardware-backed key attestation for stronger device verification.
Play Integrity Launch (2022)
Google replaces SafetyNet with more robust Play Integrity API with multiple verdict levels.
Keybox Spoofing (2023+)
Community develops TrickyStore and similar tools to spoof hardware attestation credentials.
Arms Race (2024-Present)
Ongoing cat-and-mouse game between Google revocations and new bypass techniques.
Play Integrity Verdicts
The API returns different verdict levels that indicate the device's integrity status. Most apps require at least MEETS_DEVICE_INTEGRITY.
Basic Integrity
Not emulator, valid token
Device Integrity
Genuine, certified device
Strong Integrity
Recent security patches
App Integrity
Unmodified APK
MEETS_BASIC_INTEGRITY
Token is from genuine Google Play Services. Not an emulator and token wasn't intercepted.
MEETS_DEVICE_INTEGRITY
Device is genuine, certified, not rooted, and has a locked bootloader.
MEETS_STRONG_INTEGRITY
Requires device integrity PLUS security patches from the last year for all partitions (OS and vendor).
Bypass Methodology
The bypass relies on spoofing device profiles. Instead of sending real (rooted) device data, we send credentials from a legitimate, certified device.
Bypass Steps
Hide Root
ReZygisk + Magisk Hide
Install Modules
TrickyStore + Addon
Spoof Keybox
Valid keybox.xml
Patch Date
Spoof security patch
Before Bypass: Failed Checks
On a rooted device, Play Integrity checks fail by default:
The Problem
Traditional root hiding isn't enough. Even with Magisk Hide, Play Integrity API can detect device tampering through hardware attestation.
Required Tools
Magisk Modules
- ReZygisk - Zygisk implementation
- TrickyStore - Keybox spoofing
- Tricky Addon - Package management
- Magisk Hide - Root concealment
Verification Apps
- Play Integrity API Checker
- Key Attestation APK
- KSU Web UI - Configuration
- Root Checker (optional)
Step-by-Step Bypass Process
1Open TrickyStore in KSU Web UI
2Select Apps & Deselect Unnecessary
3Download Valid keybox.xml
What is keybox.xml?
keybox.xml stores vendor security credentials used in Key Attestation. By replacing it with a copy from a genuine certified device, we trick integrity checks into believing the device has a locked bootloader.
Result: Device Integrity Bypassed
Bypass MEETS_STRONG_INTEGRITY
4Set Security Patch Date
Final Result: All Checks Bypassed
Success!
All three verdict levels (BASIC, DEVICE, STRONG) are now bypassed. The device appears as a genuine, certified Android device with a locked bootloader.
Important Warnings
Rate Limiting
Don't run integrity checks too frequently. Google may flag and block the keybox if suspicious activity is detected.
Legal Disclaimer
This information is for security research and authorized testing only. Bypassing Play Integrity without authorization may violate terms of service.
Value for Security Testing
Why Testers Need This
Developer Recommendations
Key Takeaway
Understanding Play Integrity bypass is essential for mobile security assessments. It demonstrates why apps need defense-in-depth rather than relying on a single attestation mechanism.
Original Research Credit: This article is based on research by Adham A. Makroum (M4KR0)
Need Mobile Security Testing?
Let our experts assess your Android applications for Play Integrity implementation, root detection bypasses, and overall mobile security posture.
Get Mobile Assessment