Attestation & Banking Fix

How to Pass Google Play Integrity API with Magisk

Google's Play Integrity API replaces legacy SafetyNet to block unlocked bootloaders and rooted devices from running banking apps, Google Wallet, and streaming services. Follow our definitive 2026 walkthrough to pass MEETS_DEVICE_INTEGRITY and MEETS_BASIC_INTEGRITY using Zygisk, Play Integrity Fix (PIF), and Shamiko.

Understanding Play Integrity Verdict Tiers

  • MEETS_BASIC_INTEGRITY: Verifies the operating system is not grossly tampered with. Passed automatically by Magisk systemless mounts.
  • MEETS_DEVICE_INTEGRITY: Confirms the device profile matches a Google-certified production Android device. This is the required verdict for Google Wallet, contactless NFC payments, and banking apps.
  • MEETS_STRONG_INTEGRITY: Hardware-backed cryptographic attestation signed directly by the factory hardware keystore/StrongBox. Cannot be passed on unlocked bootloaders without proprietary hardware bypasses.

The 3-Pillar Solution Stack for Passing Play Integrity

Passing modern Google Play Integrity checks requires three coordinated components working together:

Play Integrity Mitigation Architecture
[ 1. Zygisk Engine ] --------> Injects hooks directly into Android Zygote process before apps fork. * Allows live runtime modification of framework classes. [ 2. Play Integrity Fix ] ---> Intercepts KeyStore attestation requests from Google Play Services. * Spoofs unbanned certified device props (fingerprint, model, patch date). * Forces GMS to fall back to software-based attestation evaluation. [ 3. Shamiko Root Conceal ] -> Hides root binaries, su sockets, Magisk daemon, and mount namespaces. * Provides stealth concealment from heuristic banking app scanners.

Step-by-Step Installation & Configuration Guide

Step 1: Configure Magisk Settings & DenyList

  1. Open the Magisk App and tap the gear icon in the top right.
  2. Scroll down to the Magisk section:
    • Toggle ON: Zygisk (or use standalone Zygisk Next).
    • Critical Shamiko Rule: If using Shamiko (Step 3), keep Enforce DenyList TOGGLED OFF. Shamiko reads your configured DenyList and handles stealth in-memory unmounting and syscall interception without breaking Zygisk hooks. (Only toggle ON if NOT using Shamiko).
  3. Tap Configure DenyList:
    • Tap the 3-dot menu and check "Show system apps".
    • Search for Google Play Services (com.google.android.gms), tap it, and check all sub-processes (especially com.google.android.gms.unstable).
    • Search for Google Play Store (com.android.vending) and check it.
    • Search for your target banking apps, payment wallets, and corporate apps and check all their processes.

Step 2: Install Play Integrity Fix (PIF)

  1. Download the latest official Play Integrity Fix module zip by chiteroman/osm0sis from our PIF Module Catalog.
  2. In Magisk App, tap the Modules tab -> tap "Install from storage" -> select the downloaded zip.
  3. Allow the module to flash successfully (do NOT reboot yet).

Step 3: Install Shamiko Module for Stealth Root Concealment

  1. Download the latest Shamiko zip from our Shamiko Directory.
  2. In Magisk App, tap Modules -> Install from storage -> select the Shamiko zip.
  3. Verify in Magisk settings that Enforce DenyList is OFF (Shamiko will operate in Blacklist mode by default based on your configured DenyList).
  4. Tap the Reboot button in Magisk to apply all modules.

Step 4: Clear Google Play Caches & Test

ADB Cache Clearing Commands
# Force stop and clear Google Play Services & Play Store data: $adb shell pm clear com.google.android.gms $adb shell pm clear com.android.vending # Reboot device $adb reboot

How to Verify Your Play Integrity Verdict

Download open-source verification tools from GitHub or Google Play Store (such as Play Integrity API Checker by YASNAC or TB Checker). Tap Check Integrity.

Expected Successful Verdict
[✓] MEETS_BASIC_INTEGRITY : PASS (Green) [✓] MEETS_DEVICE_INTEGRITY : PASS (Green) [X] MEETS_STRONG_INTEGRITY : FAIL (Expected for unlocked bootloaders)

Handling Fingerprint Bans & Updates (custom.pif.json)

Google periodically bans leaked device fingerprints on their servers. When a ban occurs, MEETS_DEVICE_INTEGRITY will temporarily fail until you update the fingerprint:

custom.pif.json Structure
{ "MANUFACTURER": "Google", "MODEL": "Pixel 5", "FINGERPRINT": "google/redfin/redfin:11/RQ3A.211001.001/7641976:user/release-keys", "BRAND": "google", "PRODUCT": "redfin", "DEVICE": "redfin", "RELEASE": "11", "ID": "RQ3A.211001.001", "INCREMENTAL": "7641976", "SECURITY_PATCH": "2021-10-05" }

Place the updated custom.pif.json file in /data/adb/pif.json (or inside the PIF module folder) and reboot to instantly restore green device integrity.

Related Guides & Next Steps

Explore interconnected tutorials, module guides, and developer references related to this topic:

Play Integrity Fix (PIF)

Module

Download PIF module by chiteroman/osm0sis with custom.pif.json.

Next Step: Read Guide →

Shamiko Stealth Module

Module

Hide root processes from banking apps with in-process hooks.

Next Step: Read Guide →

Bypass Banking Root Detection

Troubleshoot

Complete 5-pillar stealth root concealment defense stack.

Next Step: Read Guide →
Source & Verification Standard

Verified against official upstream release Magisk v30.7 with Play Integrity API v2 (February 23, 2026). Primary reference: topjohnwu/Magisk on GitHub.