FingerprintPay

Overview

Developed by eritpchy, FingerprintPay is a critical customization module for users of custom ROMs (such as LineageOS, PixelOS, crDroid, or Paranoid Android) who utilize Asian financial payment platforms like Alipay, WeChat Pay, and QQ Wallet.

Stock firmware from OEMs like Xiaomi, OnePlus, Oppo, and Vivo includes proprietary hardware authentication daemons (IFAA and Tencent Soter) that sign biometric payment transactions. When flashing an AOSP-based custom ROM, these proprietary vendor services are absent, causing payment apps to permanently disable fingerprint authentication. FingerprintPay provides a software translation bridge, enabling standard Android biometrics inside these payment gateways.

Technical Architecture & How It Works

IFAA & Soter Protocol Emulation

1. Service Emulation: The module injects mock system services into Android’s system server, declaring availability of org.ifaa.android.manager.IFAAManager and com.tencent.soter.core.model.SoterCore.
2. KeyStore Signature Mapping: When Alipay or WeChat requests a signed payment attestation token, FingerprintPay invokes Android’s standard KeyStore to generate an asymmetric key pair protected by KeyGenParameterSpec.Builder(..., PURPOSE_SIGN).setUserAuthenticationRequired(true).
3. BiometricPrompt Handshake: The user is presented with the standard system fingerprint dialog. Upon successful hardware verification, the cryptographic key signs the payment payload and returns the expected token to the payment app.

Installation & Setup

1. Ensure Vector or LSPosed is installed and running.
2. Install the FingerprintPay.apk application.
3. Open Vector Manager $\rightarrow$ enable FingerprintPay $\rightarrow$ set scope to include System Framework, Alipay, and WeChat.
4. Reboot your phone.
5. Open the FingerprintPay app and verify that both IFAA and Soter service tests pass.
6. Open your payment app, navigate to Settings $\rightarrow$ Biometrics / Fingerprint Payment, and toggle on fingerprint verification.