First, thanks to the OP
@Viking Hogar Strasni and everyone contributing to this thread. The OP’s method may work perfectly on other devices and configurations.
I am only documenting the
alternative setup that worked for me, together with a few fixes that may help others. With this setup I now have:
- Play Integrity: 3/3
- Play Store: certified
- Google Wallet: successful real contactless payment
- Revolut: working
- Existing HMA profiles: preserved
This does not mean every module or setting below is required on every device.
1. My working module stack
- GKI kernel with KernelSU Next
- NoMount
- BRENE
- Zygisk Next
- HMA-OSS
- TEESimulator-RS
- Play Integrity Fork
- Specter
In simple terms:
- KernelSU Next provides root access.
- NoMount changes how root modules are mounted.
- BRENE uses SUSFS to hide common root and bootloader traces.
- Zygisk Next allows modules to operate inside Android app processes.
- HMA-OSS hides selected apps and packages from other apps.
- TEESimulator-RS provides the attestation keybox.
- Play Integrity Fork applies the fingerprint used for Play Integrity.
- Specter coordinates the keybox, fingerprint, target list and hiding configuration.
The attached screenshot shows the exact module combination and versions that worked for me. It is only a reference for my configuration; the OP’s original setup may work without this exact stack.
2. Back up the existing setup first
These steps assume that the device already supports an appropriate KernelSU kernel.
Before changing anything:
- Back up the current boot partitions.
- Export the existing HMA configuration.
- Save any working PIF, target and keybox configuration.
- Make sure the kernel was built for the exact device and Android version.
!!Flashing a kernel built for another device is at your own risk!!
3. Remove conflicting modules
I removed older modules that performed the same functions as the new stack. In my case, this included:
- Integrity Box
- ReSuSFS
- NeoZygisk
This does not mean those modules are bad or that the OP’s Integrity Box method cannot work. I removed them because I had chosen to test the alternative Specter setup.
Try to avoid running:
- Two Zygisk implementations
- Two Play Integrity or PIF modules
- Two keybox managers
- Multiple modules controlling the same hiding or mounting method
Having several modules trying to perform the same job can produce unpredictable results.
4. Install the base components
This is the order I followed:
- Install or flash a compatible GKI kernel with KernelSU Next.
- Install the matching KernelSU Next manager.
- Confirm that the KernelSU manager and kernel driver versions are compatible.
- Install NoMount.
- Install BRENE.
- Install Zygisk Next.
- Install HMA-OSS Zygisk.
- Install TEESimulator-RS.
- Install Play Integrity Fork.
- Install Specter.
- Remove or disable any conflicting older modules.
- Reboot the phone.
After rebooting, open KernelSU and verify that all modules are enabled. Zygisk Next should report that its
Zygote injection is working.
If KernelSU reports a manager or driver version mismatch, update the KernelSU manager before continuing.
5. Configure Specter and Play Integrity
In Specter, I used the following configuration:
- Select Pixel 6a as the PIF device.
- Keep the default PIF values.
- Install a currently valid and non-revoked keybox.
- Allow Specter to update the target list.
- Run Specter’s full Action pipeline once.
- Wait until it reports that the pipeline completed successfully.
- Reboot the phone.
The Action pipeline stops the relevant Google processes, updates the target list, installs a keybox and writes the selected PIF fingerprint.
It was useful during the initial setup, but it is
not something I continue to run regularly.
6. Check Play Integrity
After rebooting:
- Run a Play Integrity test.
- Confirm that all three verdicts pass.
- Avoid repeatedly testing it unnecessarily once it is working.
I received
3/3 Play Integrity with this configuration.
7. Check Play Store certification
It is possible to pass
3/3 Play Integrity while the Play Store temporarily continues to show that the device is not certified.
If this happens, what worked for me was clearing
only the Play Store data and rebooting:
Code:
adb shell "su -c 'am force-stop com.android.vending; pm clear com.android.vending'"
adb reboot
After rebooting:
- Open the Play Store.
- Complete any initial prompts.
- Give it a few minutes to initialise.
- Check the certification status again.
The Play Store then changed to
Device is certified, while Play Integrity remained 3/3.
8. Test Google Wallet
Once the Play Store is certified:
- Open Google Wallet.
- Check whether it displays a security warning.
- Allow some time for Google’s server-side status to refresh.
- Test it at a real contactless payment terminal when possible.
The absence of a warning is encouraging, but it does not guarantee that contactless payment has been approved.
A real payment is the final test.
In my case, I successfully completed a real contactless payment after applying this setup.
9. Fix Revolut not starting
If Revolut closes shortly after its splash screen or refuses to start:
- Open KernelSU.
- Locate Revolut in the app list.
- Make sure root permission is OFF for Revolut.
- Enable Umount modules for Revolut.
- Open HMA-OSS.
- Add Revolut to the appropriate hiding template.
- Confirm that the template is assigned to Revolut.
- Reboot and test it again.
If Revolut still closes:
- Uninstall Revolut.
- Reinstall it directly from the Play Store.
- Open KernelSU and configure Revolut again:
- Root permission: OFF
- Umount modules: ON
- Open HMA and assign the appropriate hiding template again.
- Reboot the phone.
- Test Revolut.
Reinstalling Revolut can recreate its app keystore if the previous one became invalid under an older root configuration.
A reinstall may also reset the app’s KernelSU and HMA assignments, so those settings should always be checked again afterwards.
10. Protect existing HMA configurations
Be careful with Specter’s
Set HMA-OSS Configs function. It may replace the existing HMA configuration, including custom templates used for work, banking or other apps.
Before using that function:
- Open HMA-OSS.
- Export the current HMA configuration.
- Save the backup outside HMA’s private app storage.
- Let Specter apply its required configuration.
- Restore or merge the previous templates afterwards.
- Check that Wallet, Revolut and other protected apps are assigned correctly.
If you already have a carefully configured HMA setup, it is better to
preserve it and add the required hiding rules instead of blindly replacing the entire configuration.
11. Leave the setup alone once it works
Once Play Integrity passes, the Play Store is certified and the required apps work, I recommend leaving the configuration unchanged.
I disabled:
- Automatic PIF updates
- Automatic keybox updates
I also stopped running Specter’s full Action pipeline after everything started working.
Running the pipeline again could:
- Replace the working keybox
- Select another fingerprint
- Rebuild the target list
- Stop or clear Google services
- Change related hiding or HMA settings
I would only update the keybox or fingerprint if the current one stops working or is confirmed to be revoked. Before making changes, export the working configuration.
12. Final confirmed results
With this configuration I have personally confirmed:
- Play Integrity: 3/3
- Play Store: certified
- Google Wallet: no security warning
- Google Wallet: successful real contactless payment
- Revolut: working
- Existing HMA profiles: preserved
Again, this is only a report of
what worked for me. It is not intended to supersede the OP’s guide, and the OP’s original solution may remain the better or simpler option for many users.
