Repository navigation
[BOUNTY] Support Play Integrity over remote DroidGuard + Server/Guide [$85] #2851
Description
Play Integrity should be supported over the remote DroidGuard functionality and there should be documentation how to set up a phone as a DroidGuard server.
Why?
While existing solutions allow getting a sufficiently passing Play Integrity token with a non-integrity-compliant device, there is the following problems that come with it:
- the requirement for a rooted phone,
- running the integrity-checking code from google on your phone that's purposefully obfuscated and fetched at runtime,
- running strange bypassing software with root permissions, like the closed-source TrickyStore and
- all of this has to permanently be kept up-to-date in line with updates to Play Integrity to stay passing
This is tedious, never-ending work that everyone rather avoids.
If you're a busy person it's also not really feasible. Imagine coming out of a cinema with your friends and heading for a rentable scooter only to realize you're device doesn't pass Play Integrity anymore.
If PI would work over another device, like an old, stock one you still have at home, it would fix these problems.
It would also open the oppurtunity for commercial integrity-attestation offerings, where you would like pay monthly and they then allow you to use their devices over a server which then serves valid integrity tokens to your device.
How to implement?
-
Fix:
remote droidguard currently does not work for play integrity due to play integrity using a multi step droidguard process and the implementation only supports single step (which is used by most other things that use droidguard).
([BOUNTY] Support Play Integrity over remote DroidGuard + Server/Guide [$85] #2851 (comment))- MAYBE SOLVED by [BOUNTY #2851] Add multi-step remote DroidGuard session support #3471 NOT VERIFIED YET though
-
Write a remote DroidGuard server to handle the requests
- NOT YET SOLVED, but probably soon at https://github.com/kaduvert/PlayIntegrityServer
-
Create a guide/docs on how to set it up
- PROBABLE SOLUTION AS OF 9/8/2026: it won't be that hard just flash the module and connect to it over the exposed port
-
Either
-
make it run on stock phones (requires No-BL-Unlock rooting) or
-
create software that manages all the integrity-bypassing software on the custom-rom 'server device' so that it's always passes. as far as i know to make a custom phone pass you need:
- microG / GApps
- root solution (Magisk, KernelSU or similar)
- PlayIntegrityFix or similar
- TrickyStore or similar
also i think the server can't just be some unpriviledged app or termux process since you have to spoof the client device environment a bit such that the environment doesnt differ too much (i think these tokens are like scoped to some app or whatever and it's like encoded in it who the token is for. you need to familiarize yourself with the internals a bit to really work out a proper concept here)
-
PROBABLE SOLUTION AS OF 9/8/2026: Since the solution is probably a Zygisk module, and there is AlwaysStrong now, i guess the "managing of all the integrity-bypassing software" is achieved by it but i didn't clearly debug a whole setup yet
-
This issue was edited because it was traced to being a Play Integrity issue at #2851 (comment).
See
initial Dott/Firebase sms verification issue report
Affected app
Name: Dott
Package id: com.ridedott.rider
Describe the bug
Signing in or signing up fails, seemingly because of a firebase error
To Reproduce
Steps to reproduce the behavior:
- get Dott
- Click on sign up
- enter phone number
- click sign up
Expected behavior
sends sms verification or proceeds in general
Screenshots
sign up error page
dott vehicle coverage
System
Android Version: 15
Custom ROM: LineageOS+microg 22.1
microG
microG Core version: 0.3.6.244735
microG Self-Check results: All ticked
Additional context
full logcat of an app start and signup attempt, filtering out all logs, except those coming from com.ridedott.rider with personal or identifying information replaced by [...]:
Likely critical lines from the log:
1743924520.834 10285 20276 23037 W LocalRequestInterceptor: Error getting App Check token; using placeholder token instead. Error: com.google.firebase.FirebaseException: Error returned from API. code: 403 body: App attestation failed.
1743924521.066 10285 20276 23037 E FirebaseAuth: [SmsRetrieverHelper] SMS verification code request failed: unknown status code: 17499 Firebase App Check token is invalid.
1743924521.067 10285 20276 20276 D FirebaseAuth: Invoking original failure callbacks after phone verification failure for (my phone number), error - An internal error has occurred. [ Firebase App Check token is invalid. ]
microg Google device registration is enabled, as is cloud messaging and "SafetyNet".
my device meets basic integrity and device integrity, uses sdk level 35
Also if you're a BountyHounter:
Try everything you can to make it work, it's all good. Just know that most people who just set their AI to do it eventually turn up with garbage PRs, so you'll likely fail if you don't have killer AI or lots of clue yourself.
There's a reason this has a bounty on it. It's because it's not that easy.
Also if you feed all this into AI, including #3575 in it's context window is highly recommended
Activity
gibello commentedon Apr 7, 2025
Same issue here, on a new Murena (/e/OS, degooglized Android from e.Foundation) Fairphone 4. Previously used the app on Android, same phone number.
AFAIK, the phone uses LineageOS, and does not appear as rooted. Also same issue in developer mode, or not.
MicroG services version:
0.3.6.244735-dirty
/e/OS version:
2.9-a14-20250321478214-official-FP4
Note that Dott has been reported multiple times as not working with MicroG, like for example in Plexus app database, or in /e/OS list of app compatibility, with recurring login issues.
[-][com.ridedott.rider] Dott, a wide-spread german micromobility service provider, doesn't work[/-][+][com.ridedott.rider] Dott, a wide-spread european micromobility service provider, doesn't work[/+]Scrumplex commentedon Apr 14, 2025
Weirdly enough the predecessor of Dott (Tier) works just fine :/
D3SOX commentedon Aug 6, 2025
I have used TIER extensively without any problems why do they have to introduce this stupid new app.
This is annoying me so much I would be willing to pay a small sum for this issue to be resolved. About 25-30€
Sadly TIER is no longer operational so it is not possible to rent any scooters. Lime and Voi are working alternatives but they are not available exactly in the cities where I would use Dott.
kaduvert commentedon Aug 6, 2025
yes. i believe this is among the most important issues in microG right now.
we're talking about european microG-phone-only users unable to access real world infrastructure relevant nearly anytime they go anywhere.
please direct efforts to this @mar-v-in, this is critical. you can even earn a bit in the process.
ale5000-git commentedon Aug 7, 2025
The priority is opinable, for example in my city I have never heard of Dott (and I'm still in Europe).
There is Lime and Bird everywhere here.
Have you tried with microG v0.3.9?
D3SOX commentedon Aug 7, 2025
I want to mention again that this issue likely affects a lot of other apps that use the same mechanism. See the related issues linked above. So keep that in mind for prioritizing.
I will soon migrate from CalyxOS to LOS4microG and then I can report back with the latest version. I'll also try catching some additional logsLatest version doesn't help. A fix that requires deeper understanding of microG is required.
ale5000-git commentedon Aug 7, 2025
I wasn't saying that this is not important but there are a lot of other issues equally important.
This is just one of over 1000 issues.
D3SOX commentedon Aug 8, 2025
I understand. How is stuff actually prioritized? I think it would make sense to tackle the issues most of the people have first if possible. Thoughts?
Can a bounty for this be set up?
ale5000-git commentedon Aug 8, 2025
I don't know but note that there is only one official developer (@mar-v-in), others are external contributors and they will likely do what they want.
Anyone can add a new bounty here: https://www.bountyhub.dev/en/bounty/new
fm-knopfler commentedon Aug 10, 2025
Can someone create the bounty? I will contribute a few dollars.
bountyhub-bot commentedon Aug 10, 2025
🚀 Bounty Alert!
💰 A bounty of $35.00 has been created by D3SOX on BountyHub for this issue.
🔗 Claim this bounty by submitting a pull request that solves this issue!
You can also increase the amount of the bounty if you think the issue is worth more.
Good luck, and happy coding! 💻
D3SOX commentedon Aug 10, 2025
There you go @fm-knopfler
[-][com.ridedott.rider] Dott, a wide-spread european micromobility service provider, doesn't work[/-][+][BOUNTY] Dott, a major european rentable bike/scooter app, doesn't work [35$][/+]bountyhub-bot commentedon Aug 10, 2025
🚀 Bounty Update!
💰 A contribution of $65.00 has been made by fm-knopfler on BountyHub for this issue.
The total amount of the bounty is now $100
🔗 Claim this bounty by submitting a pull request that solves this issue!
Good luck, and happy coding! 💻
43 remaining items
Karan02204 commentedon Aug 9, 2026
I did fix the core issue @D3SOX ?
D3SOX commentedon Aug 9, 2026
@Karan02204 Oh really, then show us a video where the app Dott works. I'm waiting
SmartMenu9872 commentedon Aug 10, 2026
@D3SOX Thanks for clarifying. @SmartMenu9872 previously proposed a focused first pass, but before proceeding, could you confirm whether the $85 BountyHub reward is still available for a new accepted PR, given the existing open PRs?
Please also confirm whether you want the contribution focused on the multi-step Play Integrity flow, the remote DroidGuard server/guide, or both. We will not claim completion until the relevant flow is reproducibly working.
[-][BOUNTY] Support Play Integrity over remote DroidGuard + Server/Guide [$35][/-][+][BOUNTY] Support Play Integrity over remote DroidGuard + Server/Guide [$85][/+]mitre88 commentedon Aug 12, 2026
Hi there — I saw this bounty and I'd like to take a shot at it. I am targeting the $85 bounty on this issue. I'll fork the repository, implement a focused fix, and open a PR referencing this issue with a clear description of the change and how it was verified. I'm comfortable iterating on review feedback. Thanks!
weibeu commentedon Aug 16, 2026
This is really interesting and may unlock lot of usecases. +1 to this.
ZacLou commentedon Sep 5, 2026
I would like to work on this - opened a PR at #3783 implementing guardWithRequest() and multi-step session support for remote DroidGuard.
docs(droidguard): add remote DroidGuard setup and architecture guide (m…
feat(droidguard): add remote DroidGuard bridge server and setup guide
kaduvert commentedon Sep 8, 2026
i've spent some on this and will probably fix it in the near future, i've put "probable solution" under every TODO item to keep proper progress of where things are right now
To any bounty hounters: re-read the top posting, it's probably not worth it to start from 0 right now,
many things have already come about by now and you likely shouldn't set sail for this issue
to be clear:
THERE HAS NOT BEEN ANY FUNCTIONAL DEMO OR SOLUTION YET, but as it stands right now it's just a matter of debugging on a dummy phone anymore and verifying that the right code does the right things and works,
not coming up with any genius theoretical solution, these have probably been thought out by now.
Also to @D3SOX: thanks for pushing this with a bounty, i don't think it should be awarded to anyone yet but i think once all the debugging and verifying is done the distribution should look something like this:
let me know if you agree @D3SOX
shruhicollections-beep commentedon Sep 8, 2026
Reuse remote DroidGuard sessions across snapshots
fix(droidguard): retain busy native sessions across idle reaper (micr…
test(droidguard): keep busy sessions alive through idle expiry (micro…
indra112f commentedon Oct 10, 2026