PlayIntegrityFork

Overview

Maintained by renowned developer osm0sis, PlayIntegrityFork is an enhanced, highly flexible fork of the original PlayIntegrityFix engine. When an unlocked bootloader is detected, Google Play Services initiates cryptographic hardware-backed attestation (Key Attestation), immediately failing SafetyNet and Play Integrity evaluation.

PlayIntegrityFork intercepts requests made by Google’s attestation process (com.google.android.gms.unstable), forcing the attestation client to fall back to legacy software-backed attestation. It then substitutes device identity fields with verified certified OEM build properties, satisfying Google’s MEETS_BASIC_INTEGRITY and MEETS_DEVICE_INTEGRITY criteria.

Technical Architecture & How It Works

The DroidGuard Zygisk Interception

1. Target Identification: In Android, device integrity evaluation is orchestrated by a specialized sub-process of Google Play Services: com.google.android.gms.unstable.
2. Native Library Injection: When Zygisk initializes this process, PlayIntegrityFork injects a native companion library (libplayintegrityfork.so).
3. Property Masking: The module hooks __system_property_get and __system_property_read calls within libc. When Google Play Services queries build properties such as ro.build.fingerprint or ro.product.model, the hooked functions return values defined in /data/adb/pif.json.
4. Attestation Fallback: Android devices launched with older OS versions (typically Android 7.0 or earlier, or devices without hardware keymaster enforcement) did not mandate hardware-backed Keystore attestation. By presenting an older valid fingerprint with matching FIRST_API_LEVEL props, PlayIntegrityFork forces Google Play Services into software attestation mode.

Prerequisites & Installation

Step 1: Prepare Environment

1. Ensure your root solution has an active Zygisk implementation:
   • Magisk: Enable Zygisk in settings.
   • KernelSU / APatch: Install and verify Zygisk Next or ReZygisk.
2. Remove any obsolete props-spoofing modules (such as old PIF versions or MagiskHidePropsConf).

Step 2: Flash the Module

1. Download the latest PlayIntegrityFork-vX.zip from releases.
2. In your root manager, go to Modules $\rightarrow$ Install from Storage $\rightarrow$ select the zip.
3. Reboot your device.

Step 3: Clear GMS Cache

After rebooting, clear the cache and data for Google Play Services to flush cached integrity tokens:

su -c "pm clear com.google.android.gms"
su -c "killall com.google.android.gms.unstable"

Configuration & Custom pif.json

PlayIntegrityFork includes a default fallback fingerprint, but using a custom pif.json is strongly recommended to prevent ban waves.

Create or edit /data/adb/pif.json:

{
  "PRODUCT": "marlin",
  "DEVICE": "marlin",
  "MANUFACTURER": "Google",
  "BRAND": "google",
  "MODEL": "Pixel XL",
  "FINGERPRINT": "google/marlin/marlin:7.1.2/NJH47F/4146048:user/release-keys",
  "SECURITY_PATCH": "2017-08-05",
  "FIRST_API_LEVEL": "25"
}

Whenever you update /data/adb/pif.json, force-restart the unstable GMS process to apply new props immediately:

su -c "killall -9 com.google.android.gms.unstable"

Common Issues & Troubleshooting

• Banking App Still Detects Root: Passing Play Integrity does not automatically conceal root binaries. Ensure your banking app is added to Magisk’s DenyList or configured in Shamiko / Zygisk Assistant, and verify that the app does not detect the Magisk app package name (enable “Hide the Magisk app”).
• Play Store Shows ‘Device is not certified’: After passing MEETS_DEVICE_INTEGRITY, the Play Store app caches certification status for up to 24 hours. Go to Settings $\rightarrow$ Apps $\rightarrow$ Google Play Store $\rightarrow$ Storage $\rightarrow$ Clear Storage, then reboot.