Xiaomi 17 Pro/PANDORA — KernelSU Next works, but Wallet contactless and Revolut login still fail

[bariihh]

I’m looking for advice with a Xiaomi 17 Pro (PANDORA) running:

• xiaomi.eu OS3.0.318
• Android 16
• Kernel 6.12.23-android16-5
• Unlocked bootloader
• KernelSU Next v3.3.0

Earlier Magisk and regular KernelSU attempts did not provide working root, so I restored the original images. I then installed KernelSU Next by patching the stock init_boot.img from the matching OS3.0.318 ROM.
KernelSU Next now reports:

• Working after multiple reboots
• LKM (GKI2) mode
• Hook mode: Tracepoint
• SELinux: Enforcing

Installed and enabled modules:

• Magic Mount v1.0.1-sprout
• ZygiskNext 1.5.0
• Integrity Box v41
• TEESimulator v4.0

I ran Integrity Box Action once. It completed successfully, updated the keybox, added it to TEESimulator, and automatically selected a Pixel Canary configuration. The dashboard currently shows Strong, Pixelify, OTA, and 84 targeted apps.
I have not installed TrickyStore, Tricky Addon Enhanced, SUSFS, or another Zygisk/integrity implementation. No financial app has been granted root access, and I haven’t run a separate Play Integrity checker.
Current results:

• Google Play Store says the device is certified.
• Google Wallet opens and saves the card, but contactless setup says the device does not meet the security requirements.
• Revolut opens normally, but I cannot complete login.
• Outlook and Teams report an Intune/device-compliance issue, although that may be a separate employer policy.

Questions:

1. Is this a known problem on PANDORA with OS3.0.318 and the Android 16/6.12 kernel?
2. Is TEESimulator v4 sufficient with this setup?
3. Is Tricky Addon Enhanced or a target-list adjustment still needed?
4. Could the automatically selected Pixel Canary configuration be causing the Wallet problem?

I can provide redacted screenshots of KernelSU Next, the module versions, and the exact Wallet/Revolut errors if needed.

UPDATE:
Intune explicitly detected the device as rooted and initiated organizational-data removal. Therefore, the Outlook/Teams issue is confirmed as company-policy enforcement and is separate from the Google Wallet/Revolut problem.

 

[Viking Hogar Strasni]

I’m looking for advice with a Xiaomi 17 Pro (PANDORA) running:

• xiaomi.eu OS3.0.318
• Android 16
• Kernel 6.12.23-android16-5
• Unlocked bootloader
• KernelSU Next v3.3.0

Earlier Magisk and regular KernelSU attempts did not provide working root, so I restored the original images. I then installed KernelSU Next by patching the stock init_boot.img from the matching OS3.0.318 ROM.
KernelSU Next now reports:

• Working after multiple reboots
• LKM (GKI2) mode
• Hook mode: Tracepoint
• SELinux: Enforcing

Installed and enabled modules:

• Magic Mount v1.0.1-sprout
• ZygiskNext 1.5.0
• Integrity Box v41
• TEESimulator v4.0

I ran Integrity Box Action once. It completed successfully, updated the keybox, added it to TEESimulator, and automatically selected a Pixel Canary configuration. The dashboard currently shows Strong, Pixelify, OTA, and 84 targeted apps.
I have not installed TrickyStore, Tricky Addon Enhanced, SUSFS, or another Zygisk/integrity implementation. No financial app has been granted root access, and I haven’t run a separate Play Integrity checker.
Current results:

• Google Play Store says the device is certified.
• Google Wallet opens and saves the card, but contactless setup says the device does not meet the security requirements.
• Revolut opens normally, but I cannot complete login.
• Outlook and Teams report an Intune/device-compliance issue, although that may be a separate employer policy.

Questions:

1. Is this a known problem on PANDORA with OS3.0.318 and the Android 16/6.12 kernel?
2. Is TEESimulator v4 sufficient with this setup?
3. Is Tricky Addon Enhanced or a target-list adjustment still needed?
4. Could the automatically selected Pixel Canary configuration be causing the Wallet problem?

I can provide redacted screenshots of KernelSU Next, the module versions, and the exact Wallet/Revolut errors if needed.

UPDATE:
Intune explicitly detected the device as rooted and initiated organizational-data removal. Therefore, the Outlook/Teams issue is confirmed as company-policy enforcement and is separate from the Google Wallet/Revolut problem.

LKM is not GKI2
GKI2 have installed anykernel3.zip
TeeSimulator just hide unlocked bootloader
You need SUSFS to hide everything

 

[bariihh]

LKM is not GKI2
GKI2 have installed anykernel3.zip
TeeSimulator just hide unlocked bootloader
You need SUSFS to hide everything

Thanks. I understand that my current setup is LKM on the stock kernel, so SUSFS isn’t supported yet.
Which exact AnyKernel3 file should I use for Xiaomi 17 Pro/PANDORA, xiaomi.eu OS3.0.318, with kernel 6.12.23-android16-5? And has it been tested?

 

[Viking Hogar Strasni]

People test it. I didnt because I have Xiaomi 14
I can make pathed_boot.img which can you give temporaly root priviliegies!
Than you can flash anykernel3.zip.
In case of problem, reflash device or just flash boot.img
Need for that is screen from KSUN where is written kernel version and boot.img
Read with understanding
boot with my patched kernel
Type this command and press enter to when you mobile is connected in fastboot

fastboot boot patched_image.img

Start KSUN
It will said you have built-in (GKI2)
do not flash this patched image
In any case, give return info
In case of success, press that you

 

[bariihh]

Thanks for helping.

KernelSU screenshot attached.

The matching ROM is:

https://sourceforge.net/projects/xi...u_PANDORA_OS3.0.318.0.WBLCNXM_16.zip/download

My untouched boot.img comes from this ROM. The forum upload limit prevents me from attaching it.

I understand that the patched boot image is temporary. I must use:

fastboot boot patched_boot.img

and must not flash it.

Before I continue, please confirm:

1. Which AnyKernel3 build will I install, and where is its source/download page?
2. Does it support PANDORA, Android 16 and KMI 6.12.23-android16-5?
3. Which KernelSU Next and SUSFS versions does it contain?
4. My current init_boot_a has KernelSU Next LKM installed. Should I restore the original init_boot.img before testing the temporary image or before installing AnyKernel3?
5. Please provide SHA-256 hashes for the patched image and AnyKernel3 ZIP.

Thank you.

 

[Viking Hogar Strasni]

If you so smart, do it alone.
I give you specific request for help

 

[bariihh]

Sorry, I did not mean to offend you or question your knowledge. I am a beginner and only wanted to avoid misunderstanding the instructions.

I have attached the requested KernelSU screenshot. The original boot.img is inside this exact ROM package, because the forum does not allow me to upload the 96 MB file:

https://sourceforge.net/projects/xi...u_PANDORA_OS3.0.318.0.WBLCNXM_16.zip/download

Please let me know if this is sufficient.

 

[Viking Hogar Strasni]

I said
Send Picture and boot.img, not link
Zip IT on put link on mega, dropbox or google drive

 

[el_gato]

I said
Send Picture and boot.img, not link
Zip IT on put link on mega, dropbox or google drive

I don't mean to hijack this thread but I have exactly the same setup as OG (same phone, same kernel, same ROM). I have uploaded the boot.img and the screenshot here as a ZIP: https://drive.google.com/file/d/1iVUWAOEj1RbPKPm-ZUILdW3t9mYgYF8L/view?usp=sharing

If you could provide a patched boot.img that would be really nice! Thanks for your help!

 

[bariihh]

i have uploaded it here: https://www.mediafire.com/file/btwuda2mbtnamja/boot.img/file
let me know if you need anything else. thanks!

 

[Viking Hogar Strasni]

i have uploaded it here: https://www.mediafire.com/file/btwuda2mbtnamja/boot.img/file
let me know if you need anything else. thanks!

here is everything
Anykernel and patched_boot.img

 

[Viking Hogar Strasni]

I don't mean to hijack this thread but I have exactly the same setup as OG (same phone, same kernel, same ROM). I have uploaded the boot.img and the screenshot here as a ZIP: https://drive.google.com/file/d/1iVUWAOEj1RbPKPm-ZUILdW3t9mYgYF8L/view?usp=sharing

If you could provide a patched boot.img that would be really nice! Thanks for your help!

If you have everything same, you can use in previous post

 

[bariihh]

Thanks for your help! i will try and hope it works!

 

[Viking Hogar Strasni]

Thanks for your help! i will try and hope it works!

Give return info is it successed or not

 

[bariihh]

Give return info is it successed or not

Thank you again for your help.

The temporary patched boot image worked. KernelSU Next showed BUILT-IN (GKI2). After that, I installed the AnyKernel3 ZIP successfully.

My current setup:

• Kernel: 6.12.23-android16-Wild
• KernelSU Next: BUILT-IN (GKI2), working
• SUSFS: supported, v2.2.0 (GKI)
• SUSFS module R28 installed and enabled

Results:

• Revolut login now works.
• Google Wallet still does not work. It says my device does not meet the security requirements for contactless payments.
• Outlook and Teams are still blocked because Intune detects root. I understand this is a separate issue.

So the new kernel and SUSFS helped with Revolut, but not with Google Wallet.

Is this normal, or did I miss a step?

I attached screenshots of KernelSU, the modules and the Wallet error.

Thank you.

UPDATE: it is working now! Thank you for the help.

What I did:

1. Temporarily booted the provided patched boot image with fastboot boot. I did not flash it.
2. KernelSU Next then showed Built-In (GKI2).
3. Installed the provided AnyKernel3 Wild kernel and rebooted.
4. Installed the SUSFS module and rebooted.
5. Added the Verified Boot Hash requested by the SUSFS installer.
6. Updated Integrity Box to v42 and ran its Action once.
7. In the SUSFS WebUI, enabled Auto Try Umount (Userspace). I kept “Hide sus_mounts for all/non-su processes” enabled.
8. Rebooted and tried again.

Results:

• Revolut login works.
• Google Wallet now accepts my card for contactless payments.
• The SUSFS counters still show 0, but Wallet is working.
• I did not need to erase /data/adb or reinstall everything.
• Outlook and Teams still reject the phone because of the company’s Intune policy. I understand that this is a separate issue.

 

[Viking Hogar Strasni]

Thank you again for your help.

The temporary patched boot image worked. KernelSU Next showed BUILT-IN (GKI2). After that, I installed the AnyKernel3 ZIP successfully.

My current setup:

• Kernel: 6.12.23-android16-Wild
• KernelSU Next: BUILT-IN (GKI2), working
• SUSFS: supported, v2.2.0 (GKI)
• SUSFS module R28 installed and enabled

Results:

• Revolut login now works.
• Google Wallet still does not work. It says my device does not meet the security requirements for contactless payments.
• Outlook and Teams are still blocked because Intune detects root. I understand this is a separate issue.

So the new kernel and SUSFS helped with Revolut, but not with Google Wallet.

Is this normal, or did I miss a step?

I attached screenshots of KernelSU, the modules and the Wallet error.

Thank you.

UPDATE: it is working now! Thank you for the help.

What I did:

1. Temporarily booted the provided patched boot image with fastboot boot. I did not flash it.
2. KernelSU Next then showed Built-In (GKI2).
3. Installed the provided AnyKernel3 Wild kernel and rebooted.
4. Installed the SUSFS module and rebooted.
5. Added the Verified Boot Hash requested by the SUSFS installer.
6. Updated Integrity Box to v42 and ran its Action once.
7. In the SUSFS WebUI, enabled Auto Try Umount (Userspace). I kept “Hide sus_mounts for all/non-su processes” enabled.
8. Rebooted and tried again.

Results:

• Revolut login works.
• Google Wallet now accepts my card for contactless payments.
• The SUSFS counters still show 0, but Wallet is working.
• I did not need to erase /data/adb or reinstall everything.
• Outlook and Teams still reject the phone because of the company’s Intune policy. I understand that this is a separate issue.

I make another patched boot. download it
You will need to reflash device to remove all traces before making root.
Do not make any custom setting in modules
Reset all data for google play store, framework, services and wallet

 

[Viking Hogar Strasni]

Thank you again for your help.

The temporary patched boot image worked. KernelSU Next showed BUILT-IN (GKI2). After that, I installed the AnyKernel3 ZIP successfully.

My current setup:

• Kernel: 6.12.23-android16-Wild
• KernelSU Next: BUILT-IN (GKI2), working
• SUSFS: supported, v2.2.0 (GKI)
• SUSFS module R28 installed and enabled

Results:

• Revolut login now works.
• Google Wallet still does not work. It says my device does not meet the security requirements for contactless payments.
• Outlook and Teams are still blocked because Intune detects root. I understand this is a separate issue.

So the new kernel and SUSFS helped with Revolut, but not with Google Wallet.

Is this normal, or did I miss a step?

I attached screenshots of KernelSU, the modules and the Wallet error.

Thank you.

UPDATE: it is working now! Thank you for the help.

What I did:

1. Temporarily booted the provided patched boot image with fastboot boot. I did not flash it.
2. KernelSU Next then showed Built-In (GKI2).
3. Installed the provided AnyKernel3 Wild kernel and rebooted.
4. Installed the SUSFS module and rebooted.
5. Added the Verified Boot Hash requested by the SUSFS installer.
6. Updated Integrity Box to v42 and ran its Action once.
7. In the SUSFS WebUI, enabled Auto Try Umount (Userspace). I kept “Hide sus_mounts for all/non-su processes” enabled.
8. Rebooted and tried again.

Results:

• Revolut login works.
• Google Wallet now accepts my card for contactless payments.
• The SUSFS counters still show 0, but Wallet is working.
• I did not need to erase /data/adb or reinstall everything.
• Outlook and Teams still reject the phone because of the company’s Intune policy. I understand that this is a separate issue.

I make reupload anykernel3 and patched_boot

 

[el_gato]

I make another patched boot. download it
You will need to reflash device to remove all traces before making root.
Do not make any custom setting in modules
Reset all data for google play store, framework, services and wallet

That did the trick for me. Followed everything step by step with the new boot.img and the newest anykernel version. SUSFS doesn't have a hidden mount but it works nonetheless. First time since a while that Google wallet does not complain about anything and got 4 check marks.

Thanks a lot for your effort and an help!

 

[Viking Hogar Strasni]

That did the trick for me. Followed everything step by step with the new boot.img and the newest anykernel version. SUSFS doesn't have a hidden mount but it works nonetheless. First time since a while that Google wallet does not complain about anything and got 4 check marks.

Thanks a lot for your effort and an help!

Thanks for return information and proving my method work without problem. Problem occurs wheen somebody mix 2 rooting mehods
do not test any integrity.

 

[vortemid]

That did the trick for me. Followed everything step by step with the new boot.img and the newest anykernel version. SUSFS doesn't have a hidden mount but it works nonetheless. First time since a while that Google wallet does not complain about anything and got 4 check marks.

Thanks a lot for your effort and an help!

I have tried all of the steps:
1. Reinstalled the ROM without root
2. Flashed TWRP
3. Made pathed_boot.img from AnyKernel3 and boot.img from ROM
4. Boot this patched_boot.img
5. flashed Anykernel3 from KernelSU-Next(v3.3.0) and root (GKI2) is working
6. Installed all needed modules from first post (I personally prefer AlwaysStrong, but tried Teesimulator RS with Integrity Box)
7. Cleared all data on Google Play Services, Google Play and Google Wallet like 100 times
8. Everything is working except Google Wallet and I cannot fix it.

Have I missed something? Or do you know how to fix Wallet?

 

[Viking Hogar Strasni]

I have tried all of the steps:
1. Reinstalled the ROM without root
2. Flashed TWRP
3. Made pathed_boot.img from AnyKernel3 and boot.img from ROM
4. Boot this patched_boot.img
5. flashed Anykernel3 from KernelSU-Next(v3.3.0) and root (GKI2) is working
6. Installed all needed modules from first post (I personally prefer AlwaysStrong, but tried Teesimulator RS with Integrity Box)
7. Cleared all data on Google Play Services, Google Play and Google Wallet like 100 times
8. Everything is working except Google Wallet and I cannot fix it.

Have I missed something? Or do you know how to fix Wallet?

Google is in last week install update for main component and folder and they send info to google about file and documentsui on mobile
That is why wallet stop working
solution
uninstall updates for this 2 app
Main components and solutionsui custom template with unmount modules