Play Integrity Api bypass

[Displax]

Bypass PIA (for now?) by changing fingerprint to old "marlin" 7.1.2 (does not required to apply other security patch level).
This kills two rabbits:
• fix old SN CTS profile check on some weird Custom ROMs
• bypass Integrity (MEETS_DEVICE_INTEGRITY) for now.

Other commit fix OnePlus OOS 12 problems ( thanks to @HuskyDG )

[Displax]

Close #224, #222, #220, #218, #212, #211, #210, #204, #203, #201, #196, #188, #171, #170

[kdrag0n]

Nice solution, thanks for looking into this. Have you noticed any features acting up with the old fingerprint?

Ideally, I think this should be scoped to Play Integrity code by identifying methods it calls near the beginning and end of integrity checks, and adding hooks to set and restore the fingerprint. I feel like setting a fingerprint that doesn't match the system in so many ways is bound to cause an issue somewhere.

[kdrag0n]

For example, the existing attestation hook could probably be used as a begin or end hook, depending on when Play Integrity calls it. We'd have to find another hook that can be installed within the constraints of reflection.

[Displax]

@kdrag0n
Hi, thank you for attention! Yes, I agree with you. We need separate target hook for this (if feasible) - will be more polite solution.
My solution - just quick example (and core resolve) with temp fix for impatient people))
Though to be honest I didn't notice any problems on my side (and no one report it for now). But need more testing with various devices.
Anyway, you have more knowledge than me on how to do it correctly and in better way ;)

Target process (one of?) "com.android.vending/com.google.android.finsky.integrityservice.IntegrityService"

[kdrag0n]

Random thought: maybe the "delete key" method on the existing security provider could serve as an end hook. GMS generates a new keypair for each attestation so it probably deletes the keypair shortly afterwards.

Of course, this is all theoretical as it depends on the exact order of steps in the integrity checking process. Worst case scenario, we could just sleep for 1 second or so and revert the fingerprint change in a background thread. Not sure when I'll have time to look into it myself, but feel free to try implementing this idea:

• Set the fingerprint in the key attestation hook
• Spawn a thread to revert it after 3 seconds:

thread(daemon = true) {
    Thread.sleep(3000)
    /* revert */
}

[Displax]

@kdrag0n
Some theoretical thought... Can we simulate device with broken keystore (like some zenfone, oneplus models)? Reported that they pass STRONG_INTEGRITY even that it completely broken.

[Lohkdesgds]

I applied the mod version, I got

✔️ MEETS_DEVICE_INTEGRITY
✔️ MEETS_BASIC_INTEGRITY
❌ MEETS_STRONG_INTEGRITY
on integritycheck app.

Other apps like RootBeet Sample and SafetyNet Test all work great too, but they also did before this issue.

My device is an Zenfone 6 (2019), fingerprint is itself.

Google Pay/Wallet working just fine (YAAAAY)

I have MagiskHideProps, Shamiko, this and a module that enables stuff on my camera. I'm new to root, but I feel great KEKW
Thank you ;P

[pndwal]

@kdrag0n Some theoretical thought... Can we simulate device with broken keystore (like some zenfone, oneplus models)? Reported that they pass STRONG_INTEGRITY even that it completely broken.

Seems what is broken in keymaster implementations varies.

Reports I've seen indicate that affected OnePlus devices generally don't pass STRONG_INTEGRITY, whereas Rog phone 3 (for one) passes...

[Efpophis]

Hi guys, just want to let you know... I have a OnePlus 8T with the latest Android 12, rooted with latest Magisk, etc. Installing the module from this PR fixed my play store certification problem. I did have to wipe the past store app data after installing the module in order for it to pass certification. The Integrity checker app shows the strong integrity test failing, but that doesn't seem to make a difference with anything. Basic safety net stuff passes just fine.

Thank you!

[pndwal]

Re. "Req version that doesn't append a space character to the device model name" #211

@Displax, that issue makes me wonder...

It seems to me that if fingerprint should match the (expected) model as the issue suggests, then @kdrag0n's original model prop mismatch (to bypass hardware attestation enforcement) might also be produced by using a mismatched fingerprint, as your mod already does... (It is also apparent that this mismatch, at least with a very old print, causes no (known) problems for passing new MEETS_DEVICE_INTEGRITY.)

I haven't been able to test this*, but I now wonder if anyone using USNF with your 'Play Integrity Api bypass' (which introduces targeted fingerprint spoofing for gsm attestation process) actually needs altered model in addition if mismatch is achieved without it... Perhaps fingerprint spoofing can / does kill two birds... as well as two rabbits... 😛

*- On my Xiaomi RN8T w/ Android 10, if I restore ro.product.model using MHPC (ie. remove appended space) and reboot, I still have S/N passing w/ official USNF, so my device doesn't need the mismatch anyway...

[Displax]

I haven't been able to test this*, but I now wonder if anyone using USNF with your 'Play Integrity Api bypass' (which introduces targeted fingerprint spoofing for gsm attestation process) actually needs altered model in addition if mismatch is achieved without it...

Tested already, mismatched "model" still needed anyway

[ImperatorStorm]

Pixel 6 Pro, rooted with base rom with Magisk 25.2, failing STRONG_INTEGRITY with patch.
Android 12

[Displax]

Pixel 6 Pro, rooted with base rom with Magisk 25.2, failing STRONG_INTEGRITY with patch.
Android 12

Expected

[xAffan]

Anyone with ROG 3 can test? Spoofing/Replicating should be fairly easy but someone please test and post the results here