Bypass Play Integrity & M-Banking (Hide Root)
root5-10measy/5 steps
Guide to pass MEETS_DEVICE integrity & hide root for banking apps, plus breakdown of the Fenrir bootstate exploit.
PlayIntegrityFix (chiteroman / PIF)↗TrickyStore (Keybox Hardware Attestation)↗Zygisk Assistant / Shamiko (Hide Root)↗Fenrir Bootchain Research (R0rt1z2)↗
Use Track 1 (KSU / APatch + TrickyStore + Shamiko) for 100% safe daily usage. Track 2 (Fenrir LK patch) is an educational research overview; never flash custom bootchain/LK binaries on MT6789 Tanzanite without BROM SLA/DA auth knowledge due to hardbrick risks.
1
Use KernelSU / APatch (Recommended)
Prefer KernelSU or APatch over classic Magisk when dealing with strict banking apps. They operate inside kernel-space without leaving userspace su traces. Turn on SuList / DenyList mode.
2
Install Zygisk Next & Shamiko / Zygisk Assistant
If using KSU/APatch, flash Zygisk Next first, then install Shamiko or Zygisk Assistant. In your manager settings, configure all banking apps, e-wallets, and Google Play Services in DenyList / Unmount list.
3
Pass Play Integrity (PIF & TrickyStore)
Flash PlayIntegrityFix (PIF) module to spoof target props for MEETS_BASIC_INTEGRITY. For stable MEETS_DEVICE_INTEGRITY without periodic fingerprint bans, use TrickyStore with a valid keybox certificate. Verify via Play Integrity API Checker app.
adb shell getprop ro.boot.verifiedbootstate4
Hide Root Manager & Toggle USB Debugging
Open KSU/APatch/Magisk Settings → select 'Hide the app' or install stub APK with a random package name. Some banking apps (BCA, Livin) reject launch if 'USB Debugging' or 'Developer Options' are turned on in system settings - toggle them off when launching.
5
Dev Research: Fenrir EL3 Bootstate Exploit Breakdown
Fenrir (by R0rt1z2) targets a MediaTek bootchain flaw where Preloader loads bl2_ext (EL3) without signature validation on unlocked devices (seccfg). This allows spoofing bootstate to 'green' for persistent hardware Strong Integrity. Strict warning: Helio G99-Ultra MT6789 features strict bootchain checks; byte errors in EL3/LK trigger instant BROM hardbricks requiring authorized Xiaomi SLA/DA credentials. Never flash custom compiled LK/Preloader binaries on your daily Tanzanite. Stick to Track 1 (TrickyStore/PIF)!
Related ROMs