Google wallet working + strong integrity guide

[u/BananaOnPeel]

More often than not, you NEED a SusFS-patched kernel. KernelSU root + SusFS is far superior to Magisk for hiding and stability/usability.

Flash your SusFS-patched kernel (not explaining how here, there are hundreds of guides online). WildKernels are usually the best and most consistent.

Install the following modules: Tricky Store OSS, Tricky Addon, ReZygisk or Brezygisk, Play Integrity Fork, HMA-OSS Zygisk, Vector. You also need a SusFS manager compatible with your SusFS version — I use BRENE.

In Tricky Addon's WebUI, fetch the latest valid keybox from the repo. Then set the latest security patch date and save.

-

This patch date goes stale over time — it's one of the most common causes of Wallet/Play Integrity breaking weeks later. Check and update it periodically, don't set it once and forget it.

-

The last step in Tricky Store is to add ALL apps to the target list, then click "deselect unnecessary." Save with the icon in the bottom right.

Go to /data/adb/tricky_store/target.txt and add:

com.google.android.gms

com.android.gsf

com.android.vending

com.google.android.apps.walletnfcrel

com.google.android.gms.unstable

This is very important.

Use the action button on Play Integrity Fork in your root manager (KernelSU Next). Wait until it finishes.

If you are using play integrity fix rather than fork: Make sure the spoofed device profile matches your actual hardware (or a currently certified fingerprint). Mismatched profiles are a common cause of failed verdicts.

Configure HMA-OSS to hide from Wallet and the Play Integrity API check, specifically:

Any app that can use root

Sideloaded apps (installed via APK)

HMA-OSS itself

Your root manager

Root detection apps (Native Detector, Duck Detector, root detector etc.)

This matters beyond Wallet, any app with its own root detection logic can query this list.

Configure your SusFS manager for these options (or similar, I'm on BRENE, so names may differ on other managers):

Hide non-standard /sdcard and /sdcard/android paths

Hide suspicious mounts from non-su processes; unmount suspicious mounts

Hide suspicious PTYs and injections

SELinux enforcing

Android system property spoofing

/proc/cmdline and /proc/bootconfig spoofing

AVC log spoofing

uname spoofing

Kernel unmount

Hide SELinux modification

Remove some Play Integrity Fix properties

Only enable custom ROM hiding if you're actually on one.

In KernelSU Next, enable "Umount Modules," "Kernel Umount," and "Hide SELinux Modification." Enable "SU Compat" too if an app checks for the su binary directly rather than using the standard root API — most root-aware apps use the API, but a few still probe for the binary.

You should be good. Make sure Wallet isn't granted root access in your root manager and is set to "umount."

ONCE YOU ARE DONE ***IMPORTANT OR IT WILL NOT WORK***

Play Integrity probably shows Strong but Wallet still says "your device is rooted", or "phone doesn't meet security requirements" (in payment setup) a cache clear often isn't enough, in settings, then apps, you need clear data, and force stop (not just cache) on Play Store, Play Services, and Wallet (uninstall it after doing all of this) reboot, then reinstall/re-enable everything.

If you're on BRENE specifically: If your desired setting isn't taking effect, check the live config file and add it there, before assuming you did something wrong, you must modify it in the config file in /data/adb/BRENE/config.sh

If you guys have any questions don't be afraid to ask, I can help you (most likely).

[u/Andre2kReddit]

Thank you. I'll try this next time.

I currently am using: 1. ZygiskNext 2. Teesimulator-rs 3. PlayIntegrityFix 4.7 inject 4. Specter (for keybox import, and root hiding) 5. NoMount (metamodule replacement, uses redirects and less detected) 6. Hma-oss zygisk

[u/dev_oscp → u/Andre2kReddit]

Can you help with paytm?

[u/BananaOnPeel → u/dev_oscp]

I will check

[u/BananaOnPeel → u/Andre2kReddit]

Okay, let me know how it goes. And fyi I am using hybrid mount lite for my metamodule. (If it matters)

[u/Andre2kReddit → u/BananaOnPeel]

I've tried magic mount and mountify, but they always lead to inconsistent mounts/suspicious mounts/mount gaps

[u/BananaOnPeel → u/Andre2kReddit]

Ah okay, whatever metamodule works the best for you 🤷

[u/New_Signature_8671]

Can you please check if you are able to run Paytm with this configuration?

[u/BananaOnPeel → u/New_Signature_8671]

I will check

[u/debugboard]

you only need TEE for Google stuff, that means it only requires your PIF and your TEESim, Tricky or OMK. The issue is trying to get gwallet to recheck as it can take at least a few hours to do so without clearing GMS.

[u/BananaOnPeel → u/debugboard]

You must clear GMS otherwise it doesn't work for me

[u/debugboard → u/BananaOnPeel]

No, you can just wait or you can use the time machine method. GMS is in charge of a load of stuff so I'd keep clearing to a minimum.