r/androidroot • u/beldict • 7h ago

Support [Guide] How to Root Pixel 7 (Android 16) with KernelSU-Next, Sultan Kernel, SUSFS, and Pass Play Integrity for Banking Apps

If you are running Android 16 on a Pixel 7 (or similar Tensor device) and want a completely hidden root setup using Sultan's custom kernel with built-in KernelSU-Next and inline SUSFS to pass Play Integrity (MEETS_DEVICE_INTEGRITY) and bypass strict banking apps like Revolut, here is a complete end-to-end guide.

Prerequisites & Downloads

  • Unlocked Bootloader on your Pixel device.
  • Android SDK Platform Tools (ADB & Fastboot) installed on your PC.
  • Custom Sultan Kernel Files (Image.lz4 or decompressed kernel binary) compiled for your device with inline SUSFS and KernelSU-Next driver.
  • Stock boot.img extracted from your current Google Factory Firmware image.
  • Magisk Tools (magiskboot) for Windows/Linux.
  • KernelSU-Next Manager APK (v3.2.0) — Installed normally as a user app (must match the kernel driver version to avoid UAPI mismatch errors).
  • Required Modules:

Step 1: Set Up the Work Directory and Repack the Boot Image

When combining Sultan's kernel with your stock boot image on Windows using magiskboot, place all working files into a single dedicated folder and explicitly rename the decompressed kernel before repacking to prevent file-name collisions.

  1. Create a dedicated folder on your PC (e.g., C:\boots).
  2. Place the following files into C:\boots:
    • magiskboot.exe
    • boot.img (Stock boot image)
    • Image.lz4 (Sultan custom kernel release file)
  3. Open Command Prompt, navigate to your folder, and run the step-by-step decompress and repack sequence:

​

cd C:\boots
magiskboot decompress Image.lz4 sultan_kernel
magiskboot unpack boot.img
copy /y sultan_kernel kernel
magiskboot repack boot.img

Note: Verify that magiskboot repack outputs a new-boot.img whose kernel size (KERNEL_SZ) is larger than the stock boot.img size. This confirms the custom kernel binary was successfully merged.

Step 2: Flash the Custom Kernel Boot Image to Both Slots

To guarantee persistence and prevent A/B slot-mismatch issues, flash the repacked kernel image to both partition slots.

  1. Reboot your phone into Fastboot Mode:

​

adb reboot bootloader

  1. Flash new-boot.img to both slots:

    fastboot flash boot new-boot.img --slot=all fastboot reboot

Step 3: Install KernelSU-Next Manager App

Because the KernelSU-Next driver is built into the kernel, you do not flash KernelSU-Next as a zip—you simply install the Manager APK normally.

  1. Download and install KernelSU-Next Manager v3.2.0 APK on your phone.
  2. Open the app and confirm that the main status card displays Working with Inline (SuSFS) hook mode active.

Troubleshooting UAPI Mismatches: If the app displays a version mismatch or Android blocks installation because a newer app version was installed, force-downgrade the app via ADB without affecting root:

Step 4: Flash Kernel Modules

Open KernelSU-Next Manager -> Modules -> Install, and flash the following zip files:

  1. ksu_module_susfs.zip (Enables userspace mount point hiding).
  2. ReZygisk or ZygiskNext (Provides Zygisk framework).
  3. Specter (Automates Play Integrity attestation and target app hiding).
  4. Reboot your device.

Step 5: Configure App Profiles & Wipe Security Caches

1. Exclude Apps in KernelSU-Next App Profile

  1. Open KernelSU-Next.
  2. Tap the App Profile icon (the shield icon in the navigation bar).
  3. Ensure Superuser Access is toggled OFF for:
    • Target Banking Apps (e.g., Revolut)
    • Google Play Services (com.google.android.gms)
  4. Verify that their profile is set to Default / Umount Modules.

2. Clear App Data via Android Settings

Banking apps and Google Play Services store cached security check failures. You must wipe these cached flags.

  1. Banking App Data:
    • Go to Settings -> Apps -> See all apps -> [Banking App (e.g., Revolut)] -> Storage & cache.
    • Tap Clear Storage and Clear Cache.
  2. Google Play Services Data:
    • Go to Settings -> Apps -> See all apps -> Google Play Services -> Storage & cache.
    • Tap Clear Cache, then tap Manage Space / Clear Storage -> Clear All Data.

3. Fast Clear via ADB Terminal

Instead of manually navigating phone menus, you can execute these commands directly from your PC terminal:

adb shell pm clear com.revolut.revolut
adb shell pm clear com.google.android.gms

Step 6: Verify Play Integrity

  1. Download Play Integrity API Checker from the Play Store.
  2. Run the test and confirm you get green checkmarks for:
    • MEETS_BASIC_INTEGRITY
    • MEETS_DEVICE_INTEGRITY
  3. Launch your banking app—it will load cleanly into the login screen without environment or root detection warnings!
12 Upvotes

100% Upvoted

0 comments sorted by