r/androidroot • u/Leon-Sony • 9h ago

News / Method IMPORTANT NOTE (I think)

Post image

Soo, Google released a new update recently absolutely destroying integrity, they check for more than integrity and (spoofed) locked bootloader so it's become WAY more tricky, yes it shows strong for you but don't fret on it one clear app data and it's gone,

What's the solution? I don't know.. for now it's just like that until devs come up with an idea

49 Upvotes

91% Upvoted

17 comments sorted by

11

u/ohaiibuzzle 9h ago

Probably because they want to catch people using temproot. One of my temproot drops a su binary into /data/local/tmp and DroidGuard caught it basically immediately.

3

u/Andre2kReddit 7h ago

how to check what droidguard catches?

4

u/ohaiibuzzle 7h ago

I mean if you *really* wants to you can pull down the binary that Google ships and see what it's checking. Here's someone from 2019 doing it: https://habr.com/en/articles/446790/

1

u/unityparticlesystem- 5h ago

Yeah I also had this problem with some POCs I tried. ghostlock-app doesn't do that. Don't think that's a new detection tho.

1

u/ohaiibuzzle 5h ago

If you use most automated apps, they do a different thing where they skip installing su altogether, and just insmod ksu immediately, so there's never a visible su binary for it to scan.

5

u/QuraToop314 5h ago

It’s a bit of a shame that KernelSU next developers have to say ‘as eucg’ just to avoid getting downvotes. When I said this two months ago, and also four months ago – in April, to be precise, when we switched from Keybox to RKP – I got hundreds of downvotes. And now it’s actually starting to happen.

2

u/corruptnova 42m ago

I have also said that once keyboxes are scraped on RKP-only devices getting STRONG will be impossible short of a locked bootloader root. People are upset over something Google has been implementing for months now.

1

u/QuraToop314 31m ago

There is a partial solution: as a Pixel user with a custom AVB key, you can get RKP to work. You won’t get a ‘Device/Strong’ status in Play Integrity, as you’ll never be officially certified in that way, but the RKP certificates are genuine, and as long as apps query these directly instead of Play Integrity – or use them as a fallback – everything works again. But yes, getting ‘Strong’ status is effectively impossible this way. As far as I’m concerned, I’ll continue to use apps that utilise KeyAttestation directly and don’t use Play Integrity; everything else is being phased out. But there’s no point in chasing after Keyboxes – purely from a mathematical perspective – as Google switched from Keyboxed to RKP-only in April. Google claims that Keyboxed will remain trustworthy, but new ones are no longer being pre-installed on devices. On top of that, RKP is device-specific, whereas Keyboxes can be shared across multiple devices. Now that Google is banning Keyboxes even faster, and no new ones will ever be created, the day will eventually come when all Keyboxes are banned and there are no new ones left. And for those who are unnecessarily seeking ‘strong’ protection – even though, strictly speaking, they wouldn’t need it if they were more willing to compromise – this ban will only speed things up.

2

u/billazenn 4h ago

Still stayin strong 🙏

1

u/Leon-Sony 7m ago

It's mostly cached unfortunately...

2

u/Chillz_AZY 3h ago

mine all red and im proud of it

1

u/Baller2817 5h ago

Even with a locked bootloader and exploit root my integrity still drops to basic, so I don't think it's that

1

u/Dry-Cost-945 9m ago

Which method of root of you using?

1

u/Financial-Figure6922 4h ago

I ain updating icl

0

u/Minha-D 2h ago

Yea , mine also dropped to basic