DEV Community: Pranav Patel

Rooting your Android in 2026: how I finally passed Play Integrity on a 2018 OnePlus 6T

Pranav Patel — Mon, 27 Jul 2026 09:06:09 +0000

Five years ago I wrote about whether rooting is still worth it. The answer back then was "yes, if you know what you're doing." The answer in 2026 is "yes, if you're willing to spend an afternoon fighting Google."

This is a note-to-self and a working recipe for anyone stuck on the same wall. My device: OnePlus 6T (fajita), unlocked bootloader, teeBroken TEE. My goal: pass Play Integrity BASIC + DEVICE + STRONG so Indian banking apps and GPay UPI would actually work.

The setup that fought me

Started on LineageOS 22 (Android 15). Reasonable choice, actively maintained, official fajita support. Rooted with Magisk 30.7. Layered on the current 2026 module stack that every guide points to:

ZygiskNext
Play Integrity Fork
Tricky Store
Shamiko

Configured all of it correctly. PIF Fork was injecting into com.google.android.gms.unstable — the DroidGuard process — verified in logcat. Every field spoofed cleanly to a Pixel Tablet Canary fingerprint. Keybox loaded. DenyList set up. SELinux enforcing.

Result: 0 of 3 integrity checks passing. Not just STRONG failing, which would be expected. All three.

Why the "obvious" stack was doomed on LineageOS

Two things I didn't understand until I burned an afternoon on them.

1. Kernel string branding. DroidGuard reads /proc/version and the kernel uname string. LineageOS builds have "Lineage" in there. DroidGuard has a public blocklist of kernel branding strings — "Lineage", "lineageos", any variant — and it hard-fails integrity when it sees them. No amount of Build.* property spoofing at the Java layer touches this. Your PIF module is working perfectly and Google is still throwing the verdict away.

2. ROM signing keys. Many LineageOS nightlies still ship signed with the shared AOSP testkey rather than a maintainer's private key. Run:

unzip -l /system/etc/security/otacerts.zip

If you see testkey.x509.pem, that's another hard-fail signal for DEVICE integrity. It doesn't matter how fresh your Canary fingerprint is.

The XDA fajita community documented this months ago. The fix isn't a module. It's a different ROM.

The switch that worked

Wiped everything and moved to DerpFest 16 (Android 16.2) for fajita. Three properties matter, in order of impact:

Signed builds with a real private key — no testkey warning, DEVICE verdict path opens
Kernel 4.19 by edwin, de-branded — no "Lineage" string in /proc/version
Built-in spoofing framework at the ROM layer — which you turn OFF if you're going the module route

The maintainer (P.A.N.Z.) gives two paths in the release notes. I went with the module route because keybox distribution is genuinely easier through the module ecosystem in 2026.

The install that actually worked

Everything below assumes bootloader is already unlocked. If it isn't, do that first via the standard OnePlus process.

Get the files:

DerpFest fajita ROM zip (~1.6 GB)
The matching boot.img
The matching SHA256 checksum file
The KernelSU Next kernel zip specific to this DerpFest build (has SUSFS 2.1.0 baked in)
The KernelSU Next manager APK

Verify the ROM zip checksum before you touch anything else. shasum -a 256 on the zip, compare to the .sha256sum file. If they don't match, you'll waste hours chasing ghosts. Ask me how I know.

Flash the ROM:

# In fastboot mode
fastboot flash boot_a boot.img
fastboot flash boot_b boot.img
fastboot -w
fastboot --set-active=a
fastboot reboot recovery

The fastboot -w wipe is the step that fajita-specific guides forget to mention. Skip it and your first boot dies with enablefilecrypto_failed because the A15→A16 encryption migration needs a clean userdata.

In DerpFest recovery:

Factory reset → Format data/factory reset → Format data
Apply update → Apply from ADB
adb sideload DerpFest-<version>-fajita-Official-Stable.zip
Wait for "Install complete" — do not reboot until you see it
Reboot to system

First boot, complete setup, sign into Google, wait 10 minutes untouched.

Rooting with KernelSU Next

I picked KernelSU Next over Magisk here for one specific reason: DerpFest ships a KernelSU zip with SUSFS 2.1.0 pre-integrated, which gives materially better root hiding than Magisk + Shamiko in 2026.

Reboot to recovery, sideload the KernelSU Next ROOT zip, reboot to system, install the manager APK. Open the app. Should show:

Working (BUILT-IN, GKI1)
Kernel version 4.19.325
SUSFS enabled
SELinux Enforcing

Do NOT tap the manager upgrade prompt. The manager version needs to match the kernel version. Upgrading the manager without a matching kernel breaks root.

Turn off DerpFest's built-in spoofing

Critical step people miss and then wonder why they get 0/3 forever.

DerpFest has ROM-level integrity spoofing baked in. If you leave it on while running module-based spoofing on top, both fight for the same properties and DroidGuard sees inconsistent identity signals. Every OnePlus 13 DerpFest thread on XDA has the same "help me, 0/3 after installing modules" post — this is why.

Settings → DerpFest customizations → Spoofing:

Google Play Integrity spoof → OFF
Unlimited Photos storage → OFF (this one spoofs Pixel XL for Google Photos, also conflicts)

Leave keybox and PIF JSON slots empty in the ROM's Spoofing menu. Modules handle both.

The module stack

Install in this order via KernelSU Next → Modules → Install from storage. Reboot after each round.

Round 1: Foundation

ZygiskNext (github.com/Dr-TSNG/ZygiskNext)

Reboot.

Round 2: Attestation + integrity

TEESimulator-RS (github.com/Enginex0/TEESimulator-RS)
PIF Inject (github.com/KOWX712/PlayIntegrityFix — this is the community-maintained continuation after chiteroman removed the original)

Round 3: Orchestration and hiding

Specter (github.com/dpejoh/specter)
HMA-OSS (github.com/frknkrc44/HMA-OSS)
BRENE (github.com/rrr333nnn333/BRENE — KSU+SUSFS bonus)

Reboot.

Do NOT install:

Tricky Store — TEESimulator-RS replaces it
Shamiko — HMA-OSS replaces it
Any keybox manager (IntegrityBox, Yurikey, etc.) — Specter handles this
Any vbmeta fixer, props fixer, or PIF autofetch module — Specter handles all of them

Specter's whole philosophy is consolidation. It'll flag conflicting modules in its own description if you install any.

Configure with one tap

This is the payoff for using Specter. Open the Specter WebUI. Tap the Action button.

The pipeline runs through:

Play Store force-stopped and data cleared (flushes cached identity)
App target list merged (banking apps + GMS + Play Store)
Security patch date fetched from the current Pixel bulletin
Keybox fetched from the Tricky Addon Keybox Repository, checked against Google's revocation list, installed if valid
PIF fingerprint updated from a fresh Pixel Canary/stable via PIF Inject

Full log looks something like:

-> Keybox:
Fetching available keyboxes...
Randomly selected: @Xiaomi_Lei_Jun v4-fix (entry 1 of 2)
Downloading keybox...
Checking Google revocation for serial 3207438651777393527
Keybox is not revoked
Keybox install complete

Starting PIF fingerprint update
Detected: Play Integrity Fix [INJECT]
Selected Device: Pixel 10
PIF fingerprint updating complete

Full integrity pipeline completed

Reboot the phone one more time. Do not open any Google apps before testing.

Install Play Integrity API Checker (by Nikolas Spyridakis) from the Play Store. Tap Check.

For me, first try: BASIC ✅ DEVICE ✅ STRONG ✅.

What actually made this work

Everything above is mechanics. The reason it worked when the LineageOS attempt didn't:

The ROM stopped fighting me. DerpFest doesn't ship a testkey-signed userdebug build and doesn't leave "Lineage" in the kernel string. Those two properties alone were the difference between 0/3 and 3/3.
Specter replaced five modules with one. Fewer surface area means fewer fingerprints for DroidGuard to notice something off.
TEESimulator-RS instead of Tricky Store. fajita's TEE is broken. Tricky Store just holds a keybox and hopes the TEE will use it. TEESimulator-RS emulates the whole hardware attestation stack, which is what STRONG actually needs on a broken-TEE device.
T.A.K.R. integration. Manual keybox hunting is dead. The community-run repository at keybox.kowx712.cc tags each keybox as VALID or REVOKED, updates in near-real-time, and Specter pulls from it automatically.

Honest caveats

This is not a stable state. It's a snapshot.

Keyboxes get revoked. The Xiaomi_Lei_Jun keybox I'm using today may not work in three weeks. When it stops working, hit Specter's Action button again — it'll pull a new one.

PIF fingerprints get burned. Pixel Canary rotates every ~6 weeks. When integrity starts failing on a formerly working fingerprint, run the Action again.

Google tightens quarterly. The recipe that works today may need adjustments in six months.

fajita is a 2018 device. It's on borrowed time as a banking device. The recipe above works because DerpFest's maintainer is still actively de-branding the kernel and signing builds properly. When that stops, no module stack recovers the situation.

Compared to 2021

Back then I wrote that rooting was worth it for the customization and the control. That's still true. But the arms race between Google's attestation stack and the community's counter-measures has intensified far beyond what I imagined five years ago. Modules used to be enough. Now you need the ROM, the kernel, the signing keys, the attestation emulator, the keybox source, the fingerprint provider, and the hiding layer all cooperating. Miss any one of them and you get 0/3.

The good news is that the community's tooling has caught up. Five years ago you were reading a dozen XDA threads and stitching together your own workflow. In 2026, Specter's Action button does what used to take an afternoon of manual configuration, and does it better than most of us could by hand.

Worth it? Yes. But your definition of "worth it" has to include an ongoing maintenance treadmill, not a one-time setup.

Tags: #android #rooting #playintegrity #oneplus #kernelsu

Is rooting still worth it?

Pranav Patel — Fri, 01 Oct 2021 11:20:45 +0000

Rooting was way more difficult back then, but it was well worth the effort since Smartphones and their software were quite confined. Smartphone manufacturers and mobile network providers impose software restrictions for security reasons. These limits, however, may be overcome by rooting your Android device. It was humdrum to use a non-rooted device as you couldn't utilize it's full potentials. If you're new to this, check out my previous blog which explains everything you need to know about rooting.

Emerging operating systems like OnePlus' OxygenOS and Oppo's ColorOS nevertheless let you customize your phone to a huge extent. The present software could leave you obscure about whether or not you should root, hence I have nailed down the best reasons for both the compelling sides.

Plus side

On the positive side, you'll have more access to a wide range of fun apps and personalization choices. The perks of rooting in brief-

entirely customise almost every theme or graphic on the device.
increased battery life and performance.
latest software updates even if your manufactures don't support anymore.

Well, here are the top reasons why I considered rooting my device now:

1. Block ads globally with Adaway

This app basically blocks the outgoing connection requests to ads and trackers. This app is compatible with both, rooted as well as non-rooted devices. The non-rooted version uses VPN functionality, on the other hand, the rooted version directly updates your system hosts files, which comprises a set of mappings between host names and IP addresses. Download here

2. Better file management

You can literally take your file management to the next level by exploring the system root files and modifying them. Moreover you can easily delete hidden files and folders consuming up unnecessary space. There are thousands of file manger apps out there but the best one is Mixplorer, and I personally have been using this for it's rich features. Download here

3. Better battery stats

Grenify is an app designed to increase your phone's battery life. This too supports both
but if your phone is rooted, you can really maximize its potential. In short, greenify allows you to put any apps you don't need running in the background into a deep sleep or hibernation mode whenever they're not being used, resulting to a significantly better battery life.
In addition, if you're looking to preserve the health of your phone's battery life, you might want to check out battery charge limit, a root-only app that restricts how far you battery can be charged, ultimately resulting longevity of your phone's battery health.

4. Backing up

Titanium app was the MVP of root applications back then, and to be honest it still possibly is. It lets you backup literally your entire phone in a reliable and efficient way. Even though it's UI hasn't been updated for ages, there's no app that can replace this compact and featureful tool; some useful extra features include: enable multiple user profiles per app, uninstall bloatware & system apps which you don't use, etc.

5. Better privacy

Do you want to prevent your apps from accessing potentially harmful permissions while the screen is turned off? Permission ruler has your back; it is a powerful and automatic permission manager which disables them for all apps running in the background when your device is locked, including locations services, microphone, camera, etc. Hence this, in a way, increases phones battery as well.

6. Customization on a Higher Level

Use this powerful theming tool to apply system-wide themes - Substratum theme engine.
With help of Emoji Switcher you can change your system's emojis if you're fed up of using the current ones like me.
To get software updates even after you stop receiving official OTA updates, you can get your hands dirty on custom ROMs to try out the latest Android version. the custom roms like HavocOS and DotOS take your phones to another level of customization, enabling you to alter the smallest thing you could wish to change.

Down side

All this may indeed have convinced you to root your device but I advise you to consider all of the disadvantages of doing so and determine whether the risk is worth it.

1. Voiding your phones warranty

Yes, your warranty turns void once you root your phone/unlock its bootloader. This is a very important factor to consider because you might face problems getting your phone repaired if its still under warranty.

2. (Soft) Bricking your phone

If you accidentally mess up the system(root) while accessing the powerful tools, you might end up breaking your phone's software! Bootloops and various soft bricks can get frustrating to debug, it could take you days. So, its best if you backup every time you think to play around and know what your doing.

3. Broken Apps

For security reasons, almost all banking apps as well as apps like Gpay & Paytm, MyJio, etc. stop working on devices that are found to be rooted. Although Magisk hide feature and similar properties can mask it, however it's not reliable, hence its safer and advisable to use a non-rooted device to have all those apps working.

4. Harder to upgrade operating system

Native system updates become a lot harder as you cant have incremental updates but have to instead download the entire OS file manually which is far more inconvenient than just downloading the small update and installing it.

4. Malware and Hacking

Malware may quickly compromise the security of your mobile device. Gaining root access also involves getting beyond the Android operating system's security limitations. Worms, viruses, adware, and Trojans are more likely to infiltrate rooted Android software if it isn't protected by an efficient antivirus.

5. Performance issues

Because we're rooting our phones to modify some of the system files, this can often result in unexpected malfunctions or a larger drain on your phone's performance than typical. I've definitely noticed that the phones I've rooted felt a little more sluggish after rooting them. Nevertheless there are patches and apps which can help you cover this gap slightly, but what's better than a stable system provided by the manufacturers?

Rooting your Android in 2021.

Pranav Patel — Thu, 30 Sep 2021 19:59:42 +0000

You've undoubtedly seen and read about rooting if you've browsed anything about Android on the internet. There was a period when many Android phones didn't perform up to their potential and rooting was the solution. Androids nowadays are far superior to those of the past. Even the cheapest phone or tablet accessible in 2021 will perform better and do more than the finest Android phone available few years ago. Many of us, however, are still interested in rooting our phones and are seeking for additional information.

What exactly is rooting?

Every Android phone is based on the Linux kernel and middleware, and root grants you the necessary permissions to render it all, giving you full control over the operating system.
To put it in simpler words, Linux permissions and file-system ownership are used by your Android phone. When you sign in, you become a user, and your user rights determine what you are permitted to do. Root is a user as well. The only contrast is that the root user (superuser) has complete access to all files on the system.

Should you root your phone?

The next thing you'd be wondering is whether to root your Android or leave it just the same. Obviously, this is a personal preference, but both sides have concrete arguments. Trying to keep this article short and sweet, I'll be soon making an entirely new blog post just to discuss both sides; stay tuned! :)

Getting ready

To prepare your phone for rooting, you'll first need to unblock the bootloader of your smartphone. To avoid the fuss of installing and setting up the substantially large tool Android SDK, you can instead download Minimal ADB and Fastboot from XDA Developers, which only contains the ADB and Fastboot components needed for rooting as well as unblocking the bootloader.
Unlocking the bootloader differs a bit depending on the phone you have. The standard method is to use the OEM unlock command. You'll have to attain an official cryptographic token to unlock your bootloader if you have a Motorola, Sony, or LG device.

WARNING: Keep in mind that unlocking your Android's bootloader will void the warranty (except Xiaomi phones, mi allows you to root without voiding its warranty). You will lose all your data on rooting or unblocking your device's bootloader; Have a complete backup of your phone before preceding.

Easiest way to root in 2021

Rooting your device is a lot easier now than it used to be. The easiest approach is to install a simple root software like KingRoot, KingoRoot, or OneClickRoot, that allows you to root Android with literally just one click. The app automatically checks for compatibility and roots the phone accordingly.
However, the safest and honest way through this is by patching your boot image and installing Magisk systemlessly using a custom recovery. This is the most reliable and safest option out of all. It could get overwhelming to look at it first, but XDA has you covered; they've managed to thoroughly explain it here here with the help of screenshots.