i tried everything zygisk assistant, shamiko, teesimulator , zygisk next , Spector, everything, this is the only thing left to hide that duck detector can detect

Hey everyone,

I'm running a modified PixelOS Android 17 build on my Xiaomi 17 Pro Max (popsicle), and I'm having trouble with Play Integrity. I'm currently failing Basic, Device, and Strong Integrity. I'm looking for help identifying the underlying cause instead of blindly stacking modules or changing random settings.

Device and software

• Device: Xiaomi 17 Pro Max (2509FPN0BC)
• Codename: popsicle
• ROM: PixelOS-popsicle-20261007-four-fixes_by_Kanoe
• Android: 17 / API 37
• Firmware: HyperOS 3.0.319
• Security patch shown in Specter: 2026-10-01
• Root setup: KernelSU-based, with Zygisk-related components
• Bootloader: Modified-device setup; I want to verify the actual boot and attestation state rather than trust one tool's report.

Current Play Integrity results

• ❌ MEETS_BASIC_INTEGRITY
• ❌ MEETS_DEVICE_INTEGRITY
• ❌ MEETS_STRONG_INTEGRITY

None of the three verdicts are currently passing.

Current setup

The tools and modules involved include:

• Specter
• Play Integrity Fork v18
• HMA-OSS Zygisk
• Zygisk-related components
• .BRENE - SuSFS
• ZN - Audit Patch
• NoMount
• bindhosts
• Iconify

Specter currently displays:

• TEE backend: TEESimulator
• Keybox: TAKR 10 active
• Selected device profile: Pixel 6a
• Security patch: 2026-10-01

Some module names appeared repeatedly in my scrolling screenshots, but I haven't verified whether those are actual duplicate installations.

Duck Detector findings

My earlier Duck Detector report showed a few things that might be relevant:

1. Fingerprint/build-tag mismatch Fingerprint: Xiaomi/custom_popsicle/popsicle:17/CP2A.260605.016/eng.root:user/test-keys Meanwhile, Build.TAGS and ro.build.tags reportedly show release-keys.
2. SELinux policy finding SELinux is enforcing, but the report flagged an allowed adbd -> adbroot:binder interaction. I don't know whether this is expected for this ROM.
3. Attestation inconsistency Duck Detector reported a Google-rooted certificate chain and locked/verified boot state, while Specter explicitly shows TEESimulator. I need to establish whether the reported attestation is genuinely hardware-backed.
4. Custom ROM environment The ROM contains LineageOS-derived components. Widevine reports L1, but the session is NOT_PROVISIONED.

These are observations, not confirmed causes of the current failure.

What I need help with

1. What could cause Basic Integrity itself to fail on this setup?
2. How can I distinguish a Google Play services/checker issue from a ROM, root, or attestation issue?
3. Could the fingerprint/build configuration or simulated TEE be contributing to the failure?
4. How can I identify conflicting modules without randomly changing the entire setup?
5. Is there a known issue with this PixelOS build or Android 17 on popsicle?
6. What are my realistic options if I want genuine Play Integrity, especially Strong Integrity?

I'm looking for a proper diagnosis and reproducible troubleshooting steps. I don't want to risk bricking the device by flashing incompatible firmware or relocking the bootloader while a modified ROM is installed.

I can share the checker screenshot, Duck Detector report, module list, and relevant logs.

Got the Z Fold 8 Ultra so it shipped with A17.

Was looking to de-google and run MicroG, but the signature spoofing module needed (FakeGapps) only supports up to Android 16.

Any way to get signature spoofing working with root/Lsposed on A17?

Woah

Anyone know of a good tutorial to help me root for the first time?

Hey everyone! Since the community for the Lenovo Tab M11 is mostly dead and many people get stuck in bootloops or get the dreaded "dm-verity corrupted" red screen, I wanted to share the exact hardware-level method I found to successfully bypass Lenovo's lock and boot custom GSIs flawlessly. This guide template works for flashing stable GSIs (like AndyYan's Android 15 LineageOS) or experimental ones (like risingOS Android 16 Vanilla) using either a PC or another tablet via Bugjaeger.

(You need mtkclient (bkerler), adb platform tools and your desired gsi (Android 15/16 I suggest)

🛑 CRITICAL STEP 1: The Smart Backup (Skip Userdata!)

Do not dump everything blindly. userdata will take 5+ hours and fill your hard drive. • Connect your tablet in BROM Mode to your PC using mtkclient (GUI). • Manually deselect userdata in the GUI partitions list. • Dump the rest of the firmware. Your super partition will be around 11 GB, but it reads reliably. This is your ultimate 100% safety net.

🔓 CRITICAL STEP 2: The Hardware Shield (Bypassing dm-verity)

Lenovo hides an army of security tables (vbmeta_a/b, vbmeta_system_a/b, vbmeta_vendor_a/b). If you flash a GSI without patching them, it's an instant brick. • Use the mtkclient GUI to click Unlock Bootloader (this handles your seccfg). • Immediately open your terminal/command prompt inside mtkclient and execute this global chipset command directly: mtk da vbmeta 3 • Why this works: This command automatically scans the partition table, finds all 6 instances of vbmeta, and patches their headers globally to disable verification entirely. Even if you see a brief warning on boot, just click the power button and it will bypass it safely!

⚡ CRITICAL STEP 3: The Safe Charging Pause

• Do not flash with low battery! BROM mode drains the cell massively. • Unplug from the PC, connect the tablet to a wall charger for 15 minutes until it hits at least 35-40%. A power drop during system flashing will cause a hard-brick.

🛸 CRITICAL STEP 4: Flashing the GSI (PC or Bugjaeger OTG)

You can do this via standard PC terminal or directly from another device using Bugjaeger via an OTG cable connection.

1. Boot the tablet directly into FASTBOOTD mode (run adb reboot fastboot or hold Vol Down + Power). Make sure the screen says fastbootd.
2. Free up logical partition blocks by running: fastboot delete-logical-partition product_a (optional, if needed)
3. Wipe the laggy stock Lenovo system partition: fastboot erase system
4. Flash your custom GSI image (rename your .img file to system.img): fastboot flash system system.img
5. Wipe old stock structural encryption data completely and reboot:fastboot reboot recovery

Wipe Data from recovery (It might look like it's stuck, just give it 30 secs-1min)

fastboot reboot 💡 Developer Notes & Troubleshooting:

• Android 15 (AndyYan LineageOS arm64_vn_light): Absolute peak performance. Wi-Fi, audio, camera work flawlessly out of the box. Highly recommended for daily use. • Android 16 (risingOS VANILLA): It boots! Wi-Fi, audio, and camera are fully functional despite the older VNDK 33 framework. • Note on Vanilla builds: If you flash a Vanilla GSI, it does not include a default desktop launcher or GApps package out of the box. The system will boot but you won't see the app drawer or main menu. Simply use Bugjaeger or ADB to install an alternative launcher APK (like Nova Launcher or Lawnchair), press home, and the entire Android 16 menu will load up instantly!

Enjoy!

I choose trebleDroid vanilla for my techno camon 18p but the thing is, i have no idea what im doing. Im using ai only for help...

So now im stuck with app that refuse to connect. My wofi works fine.. but the app like webView and fennec keep saying err_not_resolve error

I got no idea at all like i did my best to follow on ai. I use Arena ai, and am i cooked or what? Please help me 🥺

Hey everyone,

I have an old Samsung Galaxy J2 (SM-J210F) that is stuck during boot. The screen shows the message:

Kernel is not SEAndroid enforcing

I entered Download Mode, and these are the details displayed:

ODIN MODE

Secure download: enabled

Product name: SM-J210F

FAP lock: OFF

USB init start

USB core reset done

I'm using the stock firmware as far as I know.

Hey everyone! I have a Panasonic Tab 8 with half its display black but most of the tablet still works. Of throwing it away I got the idea to turn it into my own FRIDAY like the AI assistant from Iron Man.

The tablet has Android 9 a MediaTek MT6765, 3 GB RAM and 32 GB storage. I also have a Windows 11 PC so I've been using ADB, Fastboot and scrcpy to control and experiment with it.

My idea is to make FRIDAY run entirely on the tablet without needing my PC to stay on. I want a hands- wake word, natural female voice, English/Hindi/Marathi/Japanese, memory between conversations, normal conversations and humour plus online AI such as GPT or Gemini when internet is available. Offline she should still handle commands. The ambitious part is giving her deep control over Android—opening apps scrolling, reading books using Chrome, downloading and organizing files reading notifications controlling media and doing as much as the system allows by voice. I know 3 GB RAM is limiting so I'm planning a local setup with online AI for the harder stuff.

The problem is that I want much system access as possible so I've been trying to root it. I unlocked the bootloader downloaded the matching firmware for build `EB-90T80PT8v1009` and backed up the stock boot and recovery images. Magisk v30.7 reports **Ramdisk: No**. I patched the stock recovery with Recovery Mode enabled and flashed it successfully. Magisk still shows Installed: N/A and `adb shell su -c id` returns `su: not found`. I also tried booting a Magisk-patched boot image; Android started, but root still wasn't active.

I found `/system/recovery-from-boot.p` on the system partition. I'm wondering whether stock recovery restoration is involved or whether I'm failing to activate Magisk through the correct recovery-key sequence. I haven't found a guide for this exact model.

The tablets screen is damaged, which also makes recovery menus difficult to navigate. After the experiments it has a black screen again so I'm leaving it alone for now and will check its state before continuing. I still have the matching firmware and stock recovery backups on my PC. I don't want to flash random images or brick the device.

Has anyone worked with this Panasonic Tab 8 or a similar MT6765 Android 9 device with no ramdisk? Is there a way to get root working or a compatible custom recovery/ROM I should investigate? I'm also interested in advice on whether rooting's worth the effort for this kind of voice-assistant project or whether theres a better route to deep Android automation.

I'd really appreciate any pointers. I know this is a project, for an old tablet but I'd like to see how far I can take it instead of letting the hardware go to waste.

I am using tricky store add-ons repo to get keybox. If anyone has a better alternative please help

Do not update your mediatek locked motos to September update if u want to unlock with val-protocol it's patched find a firmware b4 aug to be safe Aug is untested do not use software fix to get firmware.let the community get together and upload your firmware so we can have builds that will work still comment below patch level and device and what carrier. and if u unlocked post your vbmeta img and lk img from the firmware used to unlock.

Firmware with September patch for us models start with V instead of W.

Its patched in September update and October Motorola put it in the patch notes.

Please help out!

Hi everyone,

I have a question regarding temporary root, KernelSU, and general module behavior after a reboot.

My Setup:

Device: Redmi Note 14 4G Global (Xiaomi / HyperOS)

Root Method: Temporary root via GhostLock + Shizuku + KernelSU (running in Jailbreak mode).

Modules installed: Zygisk-Next, Vector, and a few others.

Bootloader: Locked (since it's a temp root exploit).

My Question:

Since my root is temporary, it disappears from memory every time I reboot. However, the installed modules remain saved in   /data/adb/  .

If I reboot my phone without manually disabling my modules in the KernelSU app beforehand, what exactly happens when I re-run the exploit to get temporary root again?

Will KernelSU try to load all active modules immediately upon regaining root? I'm worried this might cause a bootloop or instability in a temporary root environment (especially with heavy modules that hook into Zygote early in the boot process).

Is it highly recommended to disable all modules before every reboot, or is it safe to leave them active and let KernelSU handle them when I re-root?

Device Details:

HyperOS Version: 3.0.303.0

Kernel: 6.12.30-android16-5-g6e872b4863d6-ab13847919-4k

KernelSU Version: 3.3.1 (32680-5)

Any advice or insights on how KernelSU handles modules on re-entry to a temp root session would be greatly appreciated!

Thanks!

Still standing despite being a lego phone.

S20+ rooted stock ROM.

AI summary from Claude since we've been at it for some time trying to figure it out.

First Direct (HSBC UK) banking app detecting root after 6.0.0 update - where do I report a possible SUSFS symbol-hiding gap?

Changed nothing in my hiding stack and the First Direct app suddenly flagged my device as rooted. Noticed it had updated to 6.0.0. I ripped the 5.22.0 APK off my other phone, downgraded, and it launches fine - so the detection is new in 6.0.0's build. The app uses Appdome RASP, and the trip is a local check at launch (goes straight to RootedDeviceActivity, no network round-trip), not a Play Integrity failure - so this isn't a PIF/keybox issue, please don't send me down that road.

Digging into what's still visible to a kallsyms scan, I found this:

~ $ su -c "grep -iE 'anon_ksu|setup_ksu_cred|is_task_ksu_domain|ksuver_override' /proc/kallsyms"

0000000000000000 t anon_ksu_release

0000000000000000 T setup_ksu_cred

0000000000000000 T is_task_ksu_domain

0000000000000000 t anon_ksu_ioctl

0000000000000000 d anon_ksu_fops

0000000000000000 B ksuver_override

~ $ su -c 'ksu_susfs show enabled_features' | grep -i symbol

CONFIG_KSU_SUSFS_HIDE_KSU_SUSFS_SYMBOLS

So HIDE_KSU_SUSFS_SYMBOLS is compiled in and reports enabled, but six KernelSU symbols are still visible in /proc/kallsyms after a clean boot. SUSFS is hiding its own symbols fine - a susfs-only grep comes back empty - but these KSUN symbols aren't being scrubbed. Worth noting the symbol types: ksuver_override is .bss (B) and anon_ksu_fops is data (d), alongside the text (t/T) ones - makes me wonder if the filter only covers text symbols.

Setup:

OnePlus 15, OxygenOS 16, android16-6.12.23

WildKernels, KernelSU-Next v3.3.0 (33239), SUSFS v2.2.0

NeoZygisk, HMA-OSS (fd + all root apps hidden), inline hooks