Five years ago I wrote about whether rooting is still worth it. The answer back then was "yes, if you know what you're doing." The answer in 2026 is "yes, if you're willing to spend an afternoon fighting Google."
This is a note-to-self and a working recipe for anyone stuck on the same wall. My device: OnePlus 6T (fajita), unlocked bootloader, teeBroken TEE. My goal: pass Play Integrity BASIC + DEVICE + STRONG so Indian banking apps and GPay UPI would actually work.
The setup that fought me
Started on LineageOS 22 (Android 15). Reasonable choice, actively maintained, official fajita support. Rooted with Magisk 30.7. Layered on the current 2026 module stack that every guide points to:
- ZygiskNext
- Play Integrity Fork
- Tricky Store
- Shamiko
Configured all of it correctly. PIF Fork was injecting into com.google.android.gms.unstable — the DroidGuard process — verified in logcat. Every field spoofed cleanly to a Pixel Tablet Canary fingerprint. Keybox loaded. DenyList set up. SELinux enforcing.
Result: 0 of 3 integrity checks passing. Not just STRONG failing, which would be expected. All three.
Why the "obvious" stack was doomed on LineageOS
Two things I didn't understand until I burned an afternoon on them.
1. Kernel string branding. DroidGuard reads /proc/version and the kernel uname string. LineageOS builds have "Lineage" in there. DroidGuard has a public blocklist of kernel branding strings — "Lineage", "lineageos", any variant — and it hard-fails integrity when it sees them. No amount of Build.* property spoofing at the Java layer touches this. Your PIF module is working perfectly and Google is still throwing the verdict away.
2. ROM signing keys. Many LineageOS nightlies still ship signed with the shared AOSP testkey rather than a maintainer's private key. Run:
unzip -l /system/etc/security/otacerts.zip
If you see testkey.x509.pem, that's another hard-fail signal for DEVICE integrity. It doesn't matter how fresh your Canary fingerprint is.
The XDA fajita community documented this months ago. The fix isn't a module. It's a different ROM.
The switch that worked
Wiped everything and moved to DerpFest 16 (Android 16.2) for fajita. Three properties matter, in order of impact:
- Signed builds with a real private key — no testkey warning, DEVICE verdict path opens
-
Kernel 4.19 by edwin, de-branded — no "Lineage" string in
/proc/version - Built-in spoofing framework at the ROM layer — which you turn OFF if you're going the module route
The maintainer (P.A.N.Z.) gives two paths in the release notes. I went with the module route because keybox distribution is genuinely easier through the module ecosystem in 2026.
The install that actually worked
Everything below assumes bootloader is already unlocked. If it isn't, do that first via the standard OnePlus process.
Get the files:
- DerpFest fajita ROM zip (~1.6 GB)
- The matching
boot.img - The matching SHA256 checksum file
- The KernelSU Next kernel zip specific to this DerpFest build (has SUSFS 2.1.0 baked in)
- The KernelSU Next manager APK
Verify the ROM zip checksum before you touch anything else. shasum -a 256 on the zip, compare to the .sha256sum file. If they don't match, you'll waste hours chasing ghosts. Ask me how I know.
Flash the ROM:
# In fastboot mode
fastboot flash boot_a boot.img
fastboot flash boot_b boot.img
fastboot -w
fastboot --set-active=a
fastboot reboot recovery
The fastboot -w wipe is the step that fajita-specific guides forget to mention. Skip it and your first boot dies with enablefilecrypto_failed because the A15→A16 encryption migration needs a clean userdata.
In DerpFest recovery:
- Factory reset → Format data/factory reset → Format data
- Apply update → Apply from ADB
adb sideload DerpFest-<version>-fajita-Official-Stable.zip- Wait for "Install complete" — do not reboot until you see it
- Reboot to system
First boot, complete setup, sign into Google, wait 10 minutes untouched.
Rooting with KernelSU Next
I picked KernelSU Next over Magisk here for one specific reason: DerpFest ships a KernelSU zip with SUSFS 2.1.0 pre-integrated, which gives materially better root hiding than Magisk + Shamiko in 2026.
Reboot to recovery, sideload the KernelSU Next ROOT zip, reboot to system, install the manager APK. Open the app. Should show:
- Working (BUILT-IN, GKI1)
- Kernel version 4.19.325
- SUSFS enabled
- SELinux Enforcing
Do NOT tap the manager upgrade prompt. The manager version needs to match the kernel version. Upgrading the manager without a matching kernel breaks root.
Turn off DerpFest's built-in spoofing
Critical step people miss and then wonder why they get 0/3 forever.
DerpFest has ROM-level integrity spoofing baked in. If you leave it on while running module-based spoofing on top, both fight for the same properties and DroidGuard sees inconsistent identity signals. Every OnePlus 13 DerpFest thread on XDA has the same "help me, 0/3 after installing modules" post — this is why.
Settings → DerpFest customizations → Spoofing:
- Google Play Integrity spoof → OFF
- Unlimited Photos storage → OFF (this one spoofs Pixel XL for Google Photos, also conflicts)
Leave keybox and PIF JSON slots empty in the ROM's Spoofing menu. Modules handle both.
The module stack
Install in this order via KernelSU Next → Modules → Install from storage. Reboot after each round.
Round 1: Foundation
- ZygiskNext (github.com/Dr-TSNG/ZygiskNext)
Reboot.
Round 2: Attestation + integrity
- TEESimulator-RS (github.com/Enginex0/TEESimulator-RS)
- PIF Inject (github.com/KOWX712/PlayIntegrityFix — this is the community-maintained continuation after chiteroman removed the original)
Round 3: Orchestration and hiding
- Specter (github.com/dpejoh/specter)
- HMA-OSS (github.com/frknkrc44/HMA-OSS)
- BRENE (github.com/rrr333nnn333/BRENE — KSU+SUSFS bonus)
Reboot.
Do NOT install:
- Tricky Store — TEESimulator-RS replaces it
- Shamiko — HMA-OSS replaces it
- Any keybox manager (IntegrityBox, Yurikey, etc.) — Specter handles this
- Any vbmeta fixer, props fixer, or PIF autofetch module — Specter handles all of them
Specter's whole philosophy is consolidation. It'll flag conflicting modules in its own description if you install any.
Configure with one tap
This is the payoff for using Specter. Open the Specter WebUI. Tap the Action button.
The pipeline runs through:
- Play Store force-stopped and data cleared (flushes cached identity)
- App target list merged (banking apps + GMS + Play Store)
- Security patch date fetched from the current Pixel bulletin
- Keybox fetched from the Tricky Addon Keybox Repository, checked against Google's revocation list, installed if valid
- PIF fingerprint updated from a fresh Pixel Canary/stable via PIF Inject
Full log looks something like:
-> Keybox:
Fetching available keyboxes...
Randomly selected: @Xiaomi_Lei_Jun v4-fix (entry 1 of 2)
Downloading keybox...
Checking Google revocation for serial 3207438651777393527
Keybox is not revoked
Keybox install complete
Starting PIF fingerprint update
Detected: Play Integrity Fix [INJECT]
Selected Device: Pixel 10
PIF fingerprint updating complete
Full integrity pipeline completed
Reboot the phone one more time. Do not open any Google apps before testing.
Install Play Integrity API Checker (by Nikolas Spyridakis) from the Play Store. Tap Check.
For me, first try: BASIC ✅ DEVICE ✅ STRONG ✅.
What actually made this work
Everything above is mechanics. The reason it worked when the LineageOS attempt didn't:
- The ROM stopped fighting me. DerpFest doesn't ship a testkey-signed userdebug build and doesn't leave "Lineage" in the kernel string. Those two properties alone were the difference between 0/3 and 3/3.
- Specter replaced five modules with one. Fewer surface area means fewer fingerprints for DroidGuard to notice something off.
- TEESimulator-RS instead of Tricky Store. fajita's TEE is broken. Tricky Store just holds a keybox and hopes the TEE will use it. TEESimulator-RS emulates the whole hardware attestation stack, which is what STRONG actually needs on a broken-TEE device.
-
T.A.K.R. integration. Manual keybox hunting is dead. The community-run repository at
keybox.kowx712.cctags each keybox as VALID or REVOKED, updates in near-real-time, and Specter pulls from it automatically.
Honest caveats
This is not a stable state. It's a snapshot.
Keyboxes get revoked. The Xiaomi_Lei_Jun keybox I'm using today may not work in three weeks. When it stops working, hit Specter's Action button again — it'll pull a new one.
PIF fingerprints get burned. Pixel Canary rotates every ~6 weeks. When integrity starts failing on a formerly working fingerprint, run the Action again.
Google tightens quarterly. The recipe that works today may need adjustments in six months.
fajita is a 2018 device. It's on borrowed time as a banking device. The recipe above works because DerpFest's maintainer is still actively de-branding the kernel and signing builds properly. When that stops, no module stack recovers the situation.
Compared to 2021
Back then I wrote that rooting was worth it for the customization and the control. That's still true. But the arms race between Google's attestation stack and the community's counter-measures has intensified far beyond what I imagined five years ago. Modules used to be enough. Now you need the ROM, the kernel, the signing keys, the attestation emulator, the keybox source, the fingerprint provider, and the hiding layer all cooperating. Miss any one of them and you get 0/3.
The good news is that the community's tooling has caught up. Five years ago you were reading a dozen XDA threads and stitching together your own workflow. In 2026, Specter's Action button does what used to take an afternoon of manual configuration, and does it better than most of us could by hand.
Worth it? Yes. But your definition of "worth it" has to include an ongoing maintenance treadmill, not a one-time setup.
Tags: #android #rooting #playintegrity #oneplus #kernelsu
Top comments (0)