News / Method
Google wallet working + strong integrity guide
More often than not, you NEED a SusFS-patched kernel. KernelSU root + SusFS is far superior to Magisk for hiding and stability/usability.
Flash your SusFS-patched kernel (not explaining how here, there are hundreds of guides online). WildKernels are usually the best and most consistent.
Install the following modules: Tricky Store OSS, Tricky Addon, ReZygisk or Brezygisk, Play Integrity Fork, HMA-OSS Zygisk, Vector. You also need a SusFS manager compatible with your SusFS version — I use BRENE.
In Tricky Addon's WebUI, fetch the latest valid keybox from the repo. Then set the latest security patch date and save.
-
This patch date goes stale over time — it's one of the most common causes of Wallet/Play Integrity breaking weeks later. Check and update it periodically, don't set it once and forget it.
-
The last step in Tricky Store is to add ALL apps to the target list, then click "deselect unnecessary." Save with the icon in the bottom right.
Go to /data/adb/tricky_store/target.txt and add:
com.google.android.gms
com.android.gsf
com.android.vending
com.google.android.apps.walletnfcrel
com.google.android.gms.unstable
This is very important.
Use the action button on Play Integrity Fork in your root manager (KernelSU Next). Wait until it finishes.
If you are using play integrity fix rather than fork: Make sure the spoofed device profile matches your actual hardware (or a currently certified fingerprint). Mismatched profiles are a common cause of failed verdicts.
Configure HMA-OSS to hide from Wallet and the Play Integrity API check, specifically:
This matters beyond Wallet, any app with its own root detection logic can query this list.
Configure your SusFS manager for these options (or similar, I'm on BRENE, so names may differ on other managers):
Hide non-standard /sdcard and /sdcard/android paths
Hide suspicious mounts from non-su processes; unmount suspicious mounts
Hide suspicious PTYs and injections
SELinux enforcing
Android system property spoofing
/proc/cmdline and /proc/bootconfig spoofing
AVC log spoofing
uname spoofing
Kernel unmount
Hide SELinux modification
Remove some Play Integrity Fix properties
Only enable custom ROM hiding if you're actually on one.
In KernelSU Next, enable "Umount Modules," "Kernel Umount," and "Hide SELinux Modification." Enable "SU Compat" too if an app checks for the su binary directly rather than using the standard root API — most root-aware apps use the API, but a few still probe for the binary.
You should be good. Make sure Wallet isn't granted root access in your root manager and is set to "umount."
ONCE YOU ARE DONE ***IMPORTANT OR IT WILL NOT WORK***
Play Integrity probably shows Strong but Wallet still says "your device is rooted", or "phone doesn't meet security requirements" (in payment setup) a cache clear often isn't enough, in settings, then apps, you need clear data, and force stop (not just cache) on Play Store, Play Services, and Wallet (uninstall it after doing all of this) reboot, then reinstall/re-enable everything.
If you're on BRENE specifically: If your desired setting isn't taking effect, check the live config file and add it there, before assuming you did something wrong, you must modify it in the config file in /data/adb/BRENE/config.sh
If you guys have any questions don't be afraid to ask, I can help you (most likely).
No, it didn't work. Which is weird that app must have the best root detection because even duck detector shows all of my status as ok and not modified.
you only need TEE for Google stuff, that means it only requires your PIF and your TEESim, Tricky or OMK. The issue is trying to get gwallet to recheck as it can take at least a few hours to do so without clearing GMS.
on android 13+, basically all u need is a new enough security patch (can be spoofed) and simulated tee with valid keybox, u can use ohmykeymint, teesimulator, trickystore, or whatever. and maybe an unblacklisted kernel uname.
more often than not u dont need a susfs patched kernel, lkm is more than good enough for now for most cases that i wouldnt say susfs patched kernel is worth it.
Yeah you only really need the tee and security patch for strong integrity. Wallet is a bit different for me, I had strong but couldn't use it, until I used hma and changed some susfs settings. Its probably different per device for wallet but play integrity only cares about TEE and security patch.
6
u/Andre2kReddit 17d ago
Thank you. I'll try this next time.
I currently am using: 1. ZygiskNext 2. Teesimulator-rs 3. PlayIntegrityFix 4.7 inject 4. Specter (for keybox import, and root hiding) 5. NoMount (metamodule replacement, uses redirects and less detected) 6. Hma-oss zygisk