I didn't realize Android verified apps on boot. I had a silly patch for Twitter (done by directly hexediting one of the overlay APKs on-device, because I'm lazy) and it worked fine until I rebooted, then Twitter disappeared.
Or is this some Play Services verification thing?
Conversation
Replying to
If you mod apps the "right" way with your own signature then obviously that works fine (though the app can tell and SafetyNet etc will fail).
2
9
Can also detect this via the hardware keystore attestation API. Unlike SafetyNet, that's not easy to bypass especially if you can do pairing rather than trusting the root after the initial check.
It's part of what we use for our Auditor app: attestation.app/about.
Very few apps bother to use that. I think the reason is simply that very few app developers are bothering to use the hardware keystores and therefore they lack awareness that there's a proper hardware-based attestation API. SafetyNet uses it but in a very weak way with fallback.
3
In the past you could bypass safetynet if you could modified the odex file since safetynet only checked the APK. Yes I know you normally don’t have write perms on the odex.
1
Auditor has android:useEmbeddedDex="true":
github.com/GrapheneOS/Aud
For GrapheneOS, it's also bundled into the OS and pre-optimized inside the OS image like other system apps. It's currently possible to install out-of-band updates though so that property is important.
