universalofm
Registered Member
- Aug 10, 2024
- 97
- 94
is it possible to reverse engineer play integrity and device atestation? Would really like to hear this from someone who has experience in this field
is it possible? Play integrity
- Thread starter universalofm
- Start date
- Nov 20, 2025
- 232
- 101
The hardness of this task is equal to breaking HTTPS (the protocol whole Internet works on). Both are based on private and public keys principle.
When Play Integrity (part of Android firmware) checks the app, it returns results signed with Google's private key. Now the 3rd-party backend (e.g. Instagram) can easily check if signature is correct by using Google's public key. But it would take 100000000 years (or so) to fake this signature.
Luckily, Android is still kinda free (it's originally Android Open Source Project) so Play Integrity doesn't have to be included in the firmware. It's Google's proprietary software. Moreover, in China Google services are banned completely. So just use firmware without Play Integrity.
When Play Integrity (part of Android firmware) checks the app, it returns results signed with Google's private key. Now the 3rd-party backend (e.g. Instagram) can easily check if signature is correct by using Google's public key. But it would take 100000000 years (or so) to fake this signature.
Luckily, Android is still kinda free (it's originally Android Open Source Project) so Play Integrity doesn't have to be included in the firmware. It's Google's proprietary software. Moreover, in China Google services are banned completely. So just use firmware without Play Integrity.