Which android or PC emulator support better basic and device play integrity ?
Your android does it natively, but you are stuck with the problem where you would probably want to not use just your phone's actual profile to generate the device integrity token, but virtualization doesn't really help much in using the native capabilities of your android in creating authentic tokens since, well, you're in a virtual, not real, environment. Now, of course you can spoof everything, but you want consistency internally - as in your profile needs to stay consistent. Different sites care about this to different levels and some aren't even checking the token for... well I've seen apps that do one check and are done, others are checking every few hours, and also depends on how much you plan on using it. Native is a better environment unless the resources you need requires scale in which case it becomes more and more costly on the overhead. Only you can really tell where the goldilocks spot is at. Authenticity and scale are the two ends of the extreme. You can of course be authentic and still scale, but it will cost you obviously.
Also you should check if the apk is compiled with just arm64 or covers all of the architectures. Of course you can spoof the architecture anyway, but that's more overhead. Some apps are already designed with x86/AMD64 in mind, some act like it's the ultimate proof that you're a bot. The fact is most apps aren't built with security first mindsets and so you end up with a lot of different, sometimes totally nonsensical, and sometimes basically fake security so it can only be case by case. Wal-Mart's app used a very early version of Cyberfend which was bought by Akamai and stuck with what was basically the beta product for years and years and at one point I downloaded a ton of apks and found that nobody else was using their version. That was really weird. Then it turned out that they weren't checking half of the featur3es because they literally don't get called ever. Gamestop didn't meaningfully have any security until they put in Akamai BMP that was already outdated when they implemented it and so it did nothing (until the pandemic did everything). Darden Restaurants rolled their own crypto - which is like rule #1 in what not to do - and put the client cert and private key in the apk, defeating their own security system. All these apps said they use some sort of Google API for integrity except since you can simply skip it and be fine, well, use isn't require, is it? You kind of do need to write your own code if you want to check because nobody really knows what you want and so to cover the bases you would end up overpaying. Sometimes devs make really incredible errors that even though they did everything else right, they included a .git folder with the history and roll it back and you can find the production root key to their infra. Oops. Don't need to fake it when you can literally turn it off and then persist, right? And you didn't ask for it, they just left it there.
So yeah, even though it sounds like a waste of time, the fact is it happens often enough that the question really should start with "what is the actual security system in place that they actually care to implement and not just for looks". Then "is there a way already there that can just let you skip the whole thing". Don't worry if it's a flutter/dart implementation or something, strings are strings and I can't tell you how many times they just harcoded the secret and everything else wasn't being checked. The NY Times for over a year had all of their users use the same API key. Except they have a comment section, meaning you can pretend to be anyone. That, and their sports section, made it really funny. One of their apps also NEVER checked the validity of the access token meaning that you never had to pay the $30 extra a month if you simply built the flow yourself since their whole security was a json return that is a bool value which you can obviously just um, change, or even leave null. In these cases you don't even need an emulator since you can basially keep reusing the refresh token given the first time. They don't expire by default I think. There are refresh tokens somewhere that have been valid since 2016 or something. Microsoft never fully retired their Live API v5 from before 2013, you can literally use Onedrive with Skydrive scopes. The whole point of the integrity check was to approve the acquisition of tokens, but if your tokens don't expire or can easily be refreshed for.. 13 years, I think you are grandfathered into having integrity, no?
Even Tolstoy did not know how right he was when he wrote Anna Karenina. It'l pretty wild. Always read the docs, never assume.
