For those who are interested on running Google Wallet, the detection is not Play Integrity, a custom api is made in Google Play Service with the following URI:
https://androidpay-users-pa.googleapis.com/cm/t/security/getstoragekey?forcehl=1&hl=en-??
The response is a message telling if the device is secure or not.
https://androidpay-users-pa.googleapis.com/cm/t/security/getstoragekey?forcehl=1&hl=en-??
The response is a message telling if the device is secure or not.
❤🔥18❤7🔥1
Xiaomi/other devices A13+ users are about to shine!
adding a built-in fingerprint customizer.
This will help users to resolve the issue of getting BASIC integrity.
Requirement:
- Have a valid fingerprint of your device (whether you take it from your software update or anywhere else, as long as it's valid, it's not a must to be Google beta anymore!)
- Does not need to use PIF anymore!
adding a built-in fingerprint customizer.
This will help users to resolve the issue of getting BASIC integrity.
Requirement:
- Have a valid fingerprint of your device (whether you take it from your software update or anywhere else, as long as it's valid, it's not a must to be Google beta anymore!)
- Does not need to use PIF anymore!
🔥46❤19👍6🤗2
Google Wallet calls GMS for the DroidGuard Environment check
notice, i said Environment check and NOT Play Integrity.
So actually Google finally did good with this powerful VM, they coded a good binary program to detect root/avb inconstancies etc.., maybe Magisk Alpha?
notice, i said Environment check and NOT Play Integrity.
So actually Google finally did good with this powerful VM, they coded a good binary program to detect root/avb inconstancies etc.., maybe Magisk Alpha?
🤔24❤6👍2👎2😱1
A dangerous option will be added in PS and its the ability to dispatch the DGTok from PI.
This feature will now make DG's resp useless, and force rely on the KA only that is based in PS.
However this could end in two paths:
- It gets patched.
- Nothing happens.
This feature will now make DG's resp useless, and force rely on the KA only that is based in PS.
However this could end in two paths:
- It gets patched.
- Nothing happens.
👍27👏3💯3
One must particularly ask why add this feature?
"It was the main reason that DG was used for revoking keys by not neglecting environment checks & etc..."
"It was the main reason that DG was used for revoking keys by not neglecting environment checks & etc..."
👍16❤2
This media is not supported in your browser
VIEW IN TELEGRAM
The impact of disabling DGTok (dispatching the DG Resp).
😱28🔥10❤5🥰2👍1
PlayStrong's main purpose is to last a very long time, we sometimes limit the use of it, because we're doing some changes like Key Rotation etc...
This limitation was only added due to the unique exp found for, anyone can break it with really simple change.
Once this gets patched, future release will not anymore conduct limitations & there will be an open source once the project is finished.
This limitation was only added due to the unique exp found for, anyone can break it with really simple change.
Once this gets patched, future release will not anymore conduct limitations & there will be an open source once the project is finished.
❤35👍7👏3👌3🔥2
Duration is extended again, and another update is coming, probably today.
🔥18❤3🥰3👍1
Google Play Store_47.6.28-31 [0] [PR] 797877006.apks
28.9 MB
Google Play Store_47.6.28-31 [0] [PR] 797877006.apks
👏30❤9👍8
- Generate Fingerprint feature seemed to look incorrect, it will be removed in the next update and replaced with the possibility to find a Pixel based device fingerprint that should be accompanied with the device's Attestation osVersion and security patch (re-checked with key lifespan), to make sure that it's consistent.
- Remove the random filling of the VerifiedBootKey, which will be replaced with the TrickyStore v1.4.0 bridge by KeyAttestation.
- Keys now will have a duration lifespan of 3 years of security patches since their generation, this will reduce the amount of STRONG integ responses and will be replaced instead with DEVICE. (both are the same and companies will not force that, only DEVICE).
- Remove the random filling of the VerifiedBootKey, which will be replaced with the TrickyStore v1.4.0 bridge by KeyAttestation.
- Keys now will have a duration lifespan of 3 years of security patches since their generation, this will reduce the amount of STRONG integ responses and will be replaced instead with DEVICE. (both are the same and companies will not force that, only DEVICE).
🔥24❤11😢9👍3🤔3
These measures are ensured to reduce key revocation in the future & make it harder for PI to discover anomalies.
🤔18❤4🔥3😎3😁2👍1🍌1
Add PlayStore to denylist.
Latest versions of PlayStore have added DroidGuard checks.
Proof of Concept:
existence of
Latest versions of PlayStore have added DroidGuard checks.
Proof of Concept:
existence of
/data/data/com.android.vending/app_dg_cache/EA908AC69FD243C28051AD07A6A4F504FC4A6B55😴27👍11😭9❤1
While taking a trip on XDA, it seems many have already discovered a similar exploit, not that of PlayStrong's (since PS does it well & correctly for A13 +).
Expect this to not last more than 2 weeks, since people mentioned the ability to use it for revoked keys.
Such a shame, "not keeping secrets" is their main job unfortunately.
I wonder what they will do when everything is blacked out.
Expect this to not last more than 2 weeks, since people mentioned the ability to use it for revoked keys.
Such a shame, "not keeping secrets" is their main job unfortunately.
I wonder what they will do when everything is blacked out.
🫡27🕊7❤3
I heard too many were afraid of using this, mentioning that "i didn't want to give extra details".
I can assure you the reason for that is because it contained an exploit that used to pass PI despite having revoked keys.
Once it gets patched, the source code will be available, alongside RKA, which is what everyone is waiting for.
I can assure you the reason for that is because it contained an exploit that used to pass PI despite having revoked keys.
Once it gets patched, the source code will be available, alongside RKA, which is what everyone is waiting for.
❤35👍8
PIF, and all versions related to it can be detected due to inconsistent Build.MODEL, since PIF can't crawl for this info (Google doesn't list them), changing fingerprint, other props is futile, it's impossible for a device to exist with Google Beta Fingerprint & Model like Xiaomi/Samsung/.... Models.
PlayStrong's only one capable of obtaining this info correctly, as per 3.7.4 (will be released soon).
PlayStrong's only one capable of obtaining this info correctly, as per 3.7.4 (will be released soon).
❤33👏4👍2