Fix for wallet, play store, banks and gov. apps for anyone update 18.10.2026

[jim.androidis]

Specter doesnt create a blacklist template? If it does, in what menu and which name inside HMA-OSS?

Specter does create an HMA-OSS blacklist template. You can manage HMA-OSS template by opening HMA-OSS companion app. There open the "Manage Templates". There you will find Specter's created template named "HIDE ME CUSTOM APP" (see attached).

 

[J_Ark]

read post #1, Spoiler "Importmant"
somentimes you must change something for continues work
I dont have time or wish to check infinit number of combination
Probably in next few days, weeks will be new version of AnyKernel by Wild James
ReSusFs today have 2 update
I dont know why and Im not interested why
Also, I dont know what module will attack google developers or their AI
Every time check all Spoilers or just Recomended

Sorry, I don't fully understand what every part of it does, I feel very stupid asking but I hope I don't bother you too much. My apologies.

Right now it's like this.

 

[Viking Hogar Strasni]

Sorry, I don't fully understand what every part of it does, I feel very stupid asking but I hope I don't bother you too much. My apologies.

Right now it's like this.

Is it work or not
Did you flash init_boot or make gki root
Set pif as Pixel 6a
Update keybox from kow
if keybox is 11, then you have gki root, if keybox is 6, then you have mixed or LKM root

 

[SuediFox]

Specter does create an HMA-OSS blacklist template. You can manage HMA-OSS template by opening HMA-OSS companion app. There open the "Manage Templates". There you will find Specter's created template named "HIDE ME CUSTOM APP" (see attached).

Hmm.. no filtered request nor any template created. So some step is missing.

 

[J_Ark]

Is it work or not
Did you flash init_boot or make gki root
Set pif as Pixel 6a
Update keybox from kow
if keybox is 11, then you have gki root, if keybox is 6, then you have mixed or LKM root

Sorry, just flashed 5.10.236-android12-2025-05-KernelSU-Next-AnyKernel3.zip from KernelSU Next. I always have been on GKI root, I don't know if this counts.

 

[jim.androidis]

Hmm.. no filtered request nor any template created. So some step is missing.

Check what is highlighted in my guide in Step 4. When you press this option in Specter, it configures the black list list i mentioned in my earliest post.

 

[SuediFox]

Check what is highlighted in my guide in Step 4. When you press this option in Specter, it configures the black list list i mentioned in my earliest post.

View attachment 57575

Yep, followed that step & still no blacklist.

 

[jim.androidis]

Yep, followed that step & still no blacklist.

Press this option again in Specter and then open HMA-OSS companion app, open "Manage Templates", there you will find the blacklist template named "HIDE MY CUSTOM APP" right below "+ Create a settings template" option (see below).

 

[J_Ark]

Is it work or not
Did you flash init_boot or make gki root
Set pif as Pixel 6a
Update keybox from kow
if keybox is 11, then you have gki root, if keybox is 6, then you have mixed or LKM root

Flashed boot.img on mi 12T Pro with fastboot flash boot_a boot.img and flashed zip of Anykernel on my TWRP. Now there are no traces of LKM root.

What I don't know is how to:

Set pif as Pixel 6a
Update keybox from kow

EDIT: Think I found it.

 

[Viking Hogar Strasni]

Sorry, just flashed 5.10.236-android12-2025-05-KernelSU-Next-AnyKernel3.zip from KernelSU Next. I always have been on GKI root, I don't know if this counts.

did you follow procedure for upgrade anykernel

 

[SuediFox]

Press this option again in Specter and then open HMA-OSS companion app, open "Manage Templates", there you will find the blacklist template named "HIDE MY CUSTOM APP" right below "+ Create a settings template" option (see below).

View attachment 57577

Tried it several times, doesnt create a blacklist. Not sure why it doesnt. Maybe because I dont use BRENE or something.

The file blacklist.txt inside Specter is empty aswell so doesnt seem to find anything to blacklist.

 

[jim.androidis]

Tried it several times, doesnt create a blacklist. Not sure why it doesnt. Maybe because I dont use BRENE or something.

The file blacklist.txt inside Specter is empty aswell so doesnt seem to find anything to blacklist.

Maybe there are some module conflicts. From my experience, since this is a highly dynamic and involved process, you need to find a working setup with the minimum possible number of modules and then stick with it.

I would strongly recommend not continuously adding/removing modules or changing module settings that you do not fully understand. This can easily lead to conflicts, after which you may have to start the entire setup from scratch.

The setup I posted, under today’s conditions, works perfectly if you start fresh and follow all the steps. Everything goes through without issues, and you end up with both banking apps and Google Wallet working.

However, this is valid for today’s conditions. Things may change tomorrow or in the near future, so if something stops working, we will need to investigate the changes and adjust the setup accordingly.

 

[Eclipse1991]

Tried it several times, doesnt create a blacklist. Not sure why it doesnt. Maybe because I dont use BRENE or something.

The file blacklist.txt inside Specter is empty aswell so doesnt seem to find anything to blacklist.

If you just wanna hide all rooting traces via Hma oos, you just need to tick all these boxes for the App you want to consider

 

[Viking Hogar Strasni]

If you just wanna hide all rooting traces via Hma oos, you just need to tick all these boxes for the App you want to considerView attachment 57581

But same jobs do SuSFS, no mount, specter, playinterity fork

 

[Viking Hogar Strasni]

Maybe there are some module conflicts. From my experience, since this is a highly dynamic and involved process, you need to find a working setup with the minimum possible number of modules and then stick with it.

I would strongly recommend not continuously adding/removing modules or changing module settings that you do not fully understand. This can easily lead to conflicts, after which you may have to start the entire setup from scratch.

The setup I posted, under today’s conditions, works perfectly if you start fresh and follow all the steps. Everything goes through without issues, and you end up with both banking apps and Google Wallet working.

However, this is valid for today’s conditions. Things may change tomorrow or in the near future, so if something stops working, we will need to investigate the changes and adjust the setup accordingly.

Because of that, I have recomended in my post #1
Absolutly true.
But Banks will work allways including Revolut
But Wallet use AI, maps, youtube and lots of other sources for installed app, modules
And all of this modules get root rights from google

 

[J_Ark]

did you follow procedure for upgrade anykernel

I followed this steps after my first reply: https://xiaomi.eu/community/threads...l-devices-update-03-10-2026.75896/post-758046

 

[SuediFox]

Maybe there are some module conflicts. From my experience, since this is a highly dynamic and involved process, you need to find a working setup with the minimum possible number of modules and then stick with it.

I would strongly recommend not continuously adding/removing modules or changing module settings that you do not fully understand. This can easily lead to conflicts, after which you may have to start the entire setup from scratch.

The setup I posted, under today’s conditions, works perfectly if you start fresh and follow all the steps. Everything goes through without issues, and you end up with both banking apps and Google Wallet working.

However, this is valid for today’s conditions. Things may change tomorrow or in the near future, so if something stops working, we will need to investigate the changes and adjust the setup accordingly.

HMA-OSS installer whines about missmatch.
HMA is prob unessecary for me when running NoMount & ReSusFs anyways. Difference from what you wrote in ur guide is that I stay away from Brene per instructions from page 1.

 

[Viking Hogar Strasni]

HMA-OSS installer whines about missmatch.
HMA is prob unessecary for me when running NoMount & ReSusFs anyways. Difference from what you wrote in ur guide is that I stay away from Brene per instructions from page 1.

I dont like when some module uninstall other module
If they do that, what else will do it
I give them root permision
Everybody has his own choice
And as picture said, they will same root manager and same kernel,
If root manager support kernel, its ok,
If not support, change root manager
As I said, I can make it work on infinite number of combination, but I know its waste of time
I put 1 solution which work, there is other, but I dont have a time to support somebody curiosity and Im not payed for that
I use my free time to help people, some people are gratefull, somebody start to teach me, but as I said in Spoiler Importmant
If anybody have better solution, publish it, dont troll my solution
ReSukiSu will be good root manager when they publich final version, not release candidate
But Release Candidate have greater posibility then KSUN and also require special version of AnyKernel

 

[bariihh]

First, thanks to the OP @Viking Hogar Strasni and everyone contributing to this thread. The OP’s method may work perfectly on other devices and configurations.

I am only documenting the alternative setup that worked for me, together with a few fixes that may help others. With this setup I now have:

• Play Integrity: 3/3
• Play Store: certified
• Google Wallet: successful real contactless payment
• Revolut: working
• Existing HMA profiles: preserved

This does not mean every module or setting below is required on every device.

1. My working module stack​

• GKI kernel with KernelSU Next
• NoMount
• BRENE
• Zygisk Next
• HMA-OSS
• TEESimulator-RS
• Play Integrity Fork
• Specter

In simple terms:

• KernelSU Next provides root access.
• NoMount changes how root modules are mounted.
• BRENE uses SUSFS to hide common root and bootloader traces.
• Zygisk Next allows modules to operate inside Android app processes.
• HMA-OSS hides selected apps and packages from other apps.
• TEESimulator-RS provides the attestation keybox.
• Play Integrity Fork applies the fingerprint used for Play Integrity.
• Specter coordinates the keybox, fingerprint, target list and hiding configuration.

The attached screenshot shows the exact module combination and versions that worked for me. It is only a reference for my configuration; the OP’s original setup may work without this exact stack.

2. Back up the existing setup first​

These steps assume that the device already supports an appropriate KernelSU kernel.

Before changing anything:

1. Back up the current boot partitions.
2. Export the existing HMA configuration.
3. Save any working PIF, target and keybox configuration.
4. Make sure the kernel was built for the exact device and Android version.

!!Flashing a kernel built for another device is at your own risk!!

3. Remove conflicting modules​

I removed older modules that performed the same functions as the new stack. In my case, this included:

• Integrity Box
• ReSuSFS
• NeoZygisk

This does not mean those modules are bad or that the OP’s Integrity Box method cannot work. I removed them because I had chosen to test the alternative Specter setup.

Try to avoid running:

• Two Zygisk implementations
• Two Play Integrity or PIF modules
• Two keybox managers
• Multiple modules controlling the same hiding or mounting method

Having several modules trying to perform the same job can produce unpredictable results.

4. Install the base components​

This is the order I followed:

1. Install or flash a compatible GKI kernel with KernelSU Next.
2. Install the matching KernelSU Next manager.
3. Confirm that the KernelSU manager and kernel driver versions are compatible.
4. Install NoMount.
5. Install BRENE.
6. Install Zygisk Next.
7. Install HMA-OSS Zygisk.
8. Install TEESimulator-RS.
9. Install Play Integrity Fork.
10. Install Specter.
11. Remove or disable any conflicting older modules.
12. Reboot the phone.

After rebooting, open KernelSU and verify that all modules are enabled. Zygisk Next should report that its Zygote injection is working.

If KernelSU reports a manager or driver version mismatch, update the KernelSU manager before continuing.

5. Configure Specter and Play Integrity​

In Specter, I used the following configuration:

1. Select Pixel 6a as the PIF device.
2. Keep the default PIF values.
3. Install a currently valid and non-revoked keybox.
4. Allow Specter to update the target list.
5. Run Specter’s full Action pipeline once.
6. Wait until it reports that the pipeline completed successfully.
7. Reboot the phone.

The Action pipeline stops the relevant Google processes, updates the target list, installs a keybox and writes the selected PIF fingerprint.

It was useful during the initial setup, but it is not something I continue to run regularly.

6. Check Play Integrity​

After rebooting:

1. Run a Play Integrity test.
2. Confirm that all three verdicts pass.
3. Avoid repeatedly testing it unnecessarily once it is working.

I received 3/3 Play Integrity with this configuration.

7. Check Play Store certification​

It is possible to pass 3/3 Play Integrity while the Play Store temporarily continues to show that the device is not certified.

If this happens, what worked for me was clearing only the Play Store data and rebooting:

adb shell "su -c 'am force-stop com.android.vending; pm clear com.android.vending'"
adb reboot

After rebooting:

1. Open the Play Store.
2. Complete any initial prompts.
3. Give it a few minutes to initialise.
4. Check the certification status again.

The Play Store then changed to Device is certified, while Play Integrity remained 3/3.

8. Test Google Wallet​

Once the Play Store is certified:

1. Open Google Wallet.
2. Check whether it displays a security warning.
3. Allow some time for Google’s server-side status to refresh.
4. Test it at a real contactless payment terminal when possible.

The absence of a warning is encouraging, but it does not guarantee that contactless payment has been approved. A real payment is the final test.

In my case, I successfully completed a real contactless payment after applying this setup.

9. Fix Revolut not starting​

If Revolut closes shortly after its splash screen or refuses to start:

1. Open KernelSU.
2. Locate Revolut in the app list.
3. Make sure root permission is OFF for Revolut.
4. Enable Umount modules for Revolut.
5. Open HMA-OSS.
6. Add Revolut to the appropriate hiding template.
7. Confirm that the template is assigned to Revolut.
8. Reboot and test it again.

If Revolut still closes:

1. Uninstall Revolut.
2. Reinstall it directly from the Play Store.
3. Open KernelSU and configure Revolut again:
   • Root permission: OFF
   • Umount modules: ON
4. Open HMA and assign the appropriate hiding template again.
5. Reboot the phone.
6. Test Revolut.

Reinstalling Revolut can recreate its app keystore if the previous one became invalid under an older root configuration.

A reinstall may also reset the app’s KernelSU and HMA assignments, so those settings should always be checked again afterwards.

10. Protect existing HMA configurations​

Be careful with Specter’s Set HMA-OSS Configs function. It may replace the existing HMA configuration, including custom templates used for work, banking or other apps.

Before using that function:

1. Open HMA-OSS.
2. Export the current HMA configuration.
3. Save the backup outside HMA’s private app storage.
4. Let Specter apply its required configuration.
5. Restore or merge the previous templates afterwards.
6. Check that Wallet, Revolut and other protected apps are assigned correctly.

If you already have a carefully configured HMA setup, it is better to preserve it and add the required hiding rules instead of blindly replacing the entire configuration.

11. Leave the setup alone once it works​

Once Play Integrity passes, the Play Store is certified and the required apps work, I recommend leaving the configuration unchanged.

I disabled:

• Automatic PIF updates
• Automatic keybox updates

I also stopped running Specter’s full Action pipeline after everything started working.

Running the pipeline again could:

• Replace the working keybox
• Select another fingerprint
• Rebuild the target list
• Stop or clear Google services
• Change related hiding or HMA settings

I would only update the keybox or fingerprint if the current one stops working or is confirmed to be revoked. Before making changes, export the working configuration.

12. Final confirmed results​

With this configuration I have personally confirmed:

• Play Integrity: 3/3
• Play Store: certified
• Google Wallet: no security warning
• Google Wallet: successful real contactless payment
• Revolut: working
• Existing HMA profiles: preserved

Again, this is only a report of what worked for me. It is not intended to supersede the OP’s guide, and the OP’s original solution may remain the better or simpler option for many users.

 

[Viking Hogar Strasni]

First, thanks to the OP @Viking Hogar Strasni and everyone contributing to this thread. The OP’s method may work perfectly on other devices and configurations.

I am only documenting the alternative setup that worked for me, together with a few fixes that may help others. With this setup I now have:

• Play Integrity: 3/3
• Play Store: certified
• Google Wallet: successful real contactless payment
• Revolut: working
• Existing HMA profiles: preserved

This does not mean every module or setting below is required on every device.

1. My working module stack​

• GKI kernel with KernelSU Next
• NoMount
• BRENE
• Zygisk Next
• HMA-OSS
• TEESimulator-RS
• Play Integrity Fork
• Specter

In simple terms:

• KernelSU Next provides root access.
• NoMount changes how root modules are mounted.
• BRENE uses SUSFS to hide common root and bootloader traces.
• Zygisk Next allows modules to operate inside Android app processes.
• HMA-OSS hides selected apps and packages from other apps.
• TEESimulator-RS provides the attestation keybox.
• Play Integrity Fork applies the fingerprint used for Play Integrity.
• Specter coordinates the keybox, fingerprint, target list and hiding configuration.

The attached screenshot shows the exact module combination and versions that worked for me. It is only a reference for my configuration; the OP’s original setup may work without this exact stack.

2. Back up the existing setup first​

These steps assume that the device already supports an appropriate KernelSU kernel.

Before changing anything:

1. Back up the current boot partitions.
2. Export the existing HMA configuration.
3. Save any working PIF, target and keybox configuration.
4. Make sure the kernel was built for the exact device and Android version.

!!Flashing a kernel built for another device is at your own risk!!

3. Remove conflicting modules​

I removed older modules that performed the same functions as the new stack. In my case, this included:

• Integrity Box
• ReSuSFS
• NeoZygisk

This does not mean those modules are bad or that the OP’s Integrity Box method cannot work. I removed them because I had chosen to test the alternative Specter setup.

Try to avoid running:

• Two Zygisk implementations
• Two Play Integrity or PIF modules
• Two keybox managers
• Multiple modules controlling the same hiding or mounting method

Having several modules trying to perform the same job can produce unpredictable results.

4. Install the base components​

This is the order I followed:

1. Install or flash a compatible GKI kernel with KernelSU Next.
2. Install the matching KernelSU Next manager.
3. Confirm that the KernelSU manager and kernel driver versions are compatible.
4. Install NoMount.
5. Install BRENE.
6. Install Zygisk Next.
7. Install HMA-OSS Zygisk.
8. Install TEESimulator-RS.
9. Install Play Integrity Fork.
10. Install Specter.
11. Remove or disable any conflicting older modules.
12. Reboot the phone.

After rebooting, open KernelSU and verify that all modules are enabled. Zygisk Next should report that its Zygote injection is working.

If KernelSU reports a manager or driver version mismatch, update the KernelSU manager before continuing.

5. Configure Specter and Play Integrity​

In Specter, I used the following configuration:

1. Select Pixel 6a as the PIF device.
2. Keep the default PIF values.
3. Install a currently valid and non-revoked keybox.
4. Allow Specter to update the target list.
5. Run Specter’s full Action pipeline once.
6. Wait until it reports that the pipeline completed successfully.
7. Reboot the phone.

The Action pipeline stops the relevant Google processes, updates the target list, installs a keybox and writes the selected PIF fingerprint.

It was useful during the initial setup, but it is not something I continue to run regularly.

6. Check Play Integrity​

After rebooting:

1. Run a Play Integrity test.
2. Confirm that all three verdicts pass.
3. Avoid repeatedly testing it unnecessarily once it is working.

I received 3/3 Play Integrity with this configuration.

7. Check Play Store certification​

It is possible to pass 3/3 Play Integrity while the Play Store temporarily continues to show that the device is not certified.

If this happens, what worked for me was clearing only the Play Store data and rebooting:

adb shell "su -c 'am force-stop com.android.vending; pm clear com.android.vending'"
adb reboot

After rebooting:

1. Open the Play Store.
2. Complete any initial prompts.
3. Give it a few minutes to initialise.
4. Check the certification status again.

The Play Store then changed to Device is certified, while Play Integrity remained 3/3.

8. Test Google Wallet​

Once the Play Store is certified:

1. Open Google Wallet.
2. Check whether it displays a security warning.
3. Allow some time for Google’s server-side status to refresh.
4. Test it at a real contactless payment terminal when possible.

The absence of a warning is encouraging, but it does not guarantee that contactless payment has been approved. A real payment is the final test.

In my case, I successfully completed a real contactless payment after applying this setup.

9. Fix Revolut not starting​

If Revolut closes shortly after its splash screen or refuses to start:

1. Open KernelSU.
2. Locate Revolut in the app list.
3. Make sure root permission is OFF for Revolut.
4. Enable Umount modules for Revolut.
5. Open HMA-OSS.
6. Add Revolut to the appropriate hiding template.
7. Confirm that the template is assigned to Revolut.
8. Reboot and test it again.

If Revolut still closes:

1. Uninstall Revolut.
2. Reinstall it directly from the Play Store.
3. Open KernelSU and configure Revolut again:
   • Root permission: OFF
   • Umount modules: ON
4. Open HMA and assign the appropriate hiding template again.
5. Reboot the phone.
6. Test Revolut.

Reinstalling Revolut can recreate its app keystore if the previous one became invalid under an older root configuration.

A reinstall may also reset the app’s KernelSU and HMA assignments, so those settings should always be checked again afterwards.

10. Protect existing HMA configurations​

Be careful with Specter’s Set HMA-OSS Configs function. It may replace the existing HMA configuration, including custom templates used for work, banking or other apps.

Before using that function:

1. Open HMA-OSS.
2. Export the current HMA configuration.
3. Save the backup outside HMA’s private app storage.
4. Let Specter apply its required configuration.
5. Restore or merge the previous templates afterwards.
6. Check that Wallet, Revolut and other protected apps are assigned correctly.

If you already have a carefully configured HMA setup, it is better to preserve it and add the required hiding rules instead of blindly replacing the entire configuration.

11. Leave the setup alone once it works​

Once Play Integrity passes, the Play Store is certified and the required apps work, I recommend leaving the configuration unchanged.

I disabled:

• Automatic PIF updates
• Automatic keybox updates

I also stopped running Specter’s full Action pipeline after everything started working.

Running the pipeline again could:

• Replace the working keybox
• Select another fingerprint
• Rebuild the target list
• Stop or clear Google services
• Change related hiding or HMA settings

I would only update the keybox or fingerprint if the current one stops working or is confirmed to be revoked. Before making changes, export the working configuration.

12. Final confirmed results​

With this configuration I have personally confirmed:

• Play Integrity: 3/3
• Play Store: certified
• Google Wallet: no security warning
• Google Wallet: successful real contactless payment
• Revolut: working
• Existing HMA profiles: preserved

Again, this is only a report of what worked for me. It is not intended to supersede the OP’s guide, and the OP’s original solution may remain the better or simpler option for many users.

absolute agree
but as I said
do not test play integrity because google will ban your acc or your device or your kebox
Also, If you use BreneSuSFS, use BreZygisk, its from same developer
NoMount also hide trace of module installation
Also, Before you install AnyKernel, boot.img must be original, not allready patched and it must be installed throgh Twrp or Root Manager
Most importman why I make this tutorial is not to make Google play Integrity tested
Second condition, its must be simple by KISS methodology

 

[yukkio]

First, thanks to the OP @Viking Hogar Strasni and everyone contributing to this thread. The OP’s method may work perfectly on other devices and configurations.

I am only documenting the alternative setup that worked for me, together with a few fixes that may help others. With this setup I now have:

• Play Integrity: 3/3
• Play Store: certified
• Google Wallet: successful real contactless payment
• Revolut: working
• Existing HMA profiles: preserved

This does not mean every module or setting below is required on every device.

1. My working module stack​

• GKI kernel with KernelSU Next
• NoMount
• BRENE
• Zygisk Next
• HMA-OSS
• TEESimulator-RS
• Play Integrity Fork
• Specter

In simple terms:

• KernelSU Next provides root access.
• NoMount changes how root modules are mounted.
• BRENE uses SUSFS to hide common root and bootloader traces.
• Zygisk Next allows modules to operate inside Android app processes.
• HMA-OSS hides selected apps and packages from other apps.
• TEESimulator-RS provides the attestation keybox.
• Play Integrity Fork applies the fingerprint used for Play Integrity.
• Specter coordinates the keybox, fingerprint, target list and hiding configuration.

The attached screenshot shows the exact module combination and versions that worked for me. It is only a reference for my configuration; the OP’s original setup may work without this exact stack.

2. Back up the existing setup first​

These steps assume that the device already supports an appropriate KernelSU kernel.

Before changing anything:

1. Back up the current boot partitions.
2. Export the existing HMA configuration.
3. Save any working PIF, target and keybox configuration.
4. Make sure the kernel was built for the exact device and Android version.

!!Flashing a kernel built for another device is at your own risk!!

3. Remove conflicting modules​

I removed older modules that performed the same functions as the new stack. In my case, this included:

• Integrity Box
• ReSuSFS
• NeoZygisk

This does not mean those modules are bad or that the OP’s Integrity Box method cannot work. I removed them because I had chosen to test the alternative Specter setup.

Try to avoid running:

• Two Zygisk implementations
• Two Play Integrity or PIF modules
• Two keybox managers
• Multiple modules controlling the same hiding or mounting method

Having several modules trying to perform the same job can produce unpredictable results.

4. Install the base components​

This is the order I followed:

1. Install or flash a compatible GKI kernel with KernelSU Next.
2. Install the matching KernelSU Next manager.
3. Confirm that the KernelSU manager and kernel driver versions are compatible.
4. Install NoMount.
5. Install BRENE.
6. Install Zygisk Next.
7. Install HMA-OSS Zygisk.
8. Install TEESimulator-RS.
9. Install Play Integrity Fork.
10. Install Specter.
11. Remove or disable any conflicting older modules.
12. Reboot the phone.

After rebooting, open KernelSU and verify that all modules are enabled. Zygisk Next should report that its Zygote injection is working.

If KernelSU reports a manager or driver version mismatch, update the KernelSU manager before continuing.

5. Configure Specter and Play Integrity​

In Specter, I used the following configuration:

1. Select Pixel 6a as the PIF device.
2. Keep the default PIF values.
3. Install a currently valid and non-revoked keybox.
4. Allow Specter to update the target list.
5. Run Specter’s full Action pipeline once.
6. Wait until it reports that the pipeline completed successfully.
7. Reboot the phone.

The Action pipeline stops the relevant Google processes, updates the target list, installs a keybox and writes the selected PIF fingerprint.

It was useful during the initial setup, but it is not something I continue to run regularly.

6. Check Play Integrity​

After rebooting:

1. Run a Play Integrity test.
2. Confirm that all three verdicts pass.
3. Avoid repeatedly testing it unnecessarily once it is working.

I received 3/3 Play Integrity with this configuration.

7. Check Play Store certification​

It is possible to pass 3/3 Play Integrity while the Play Store temporarily continues to show that the device is not certified.

If this happens, what worked for me was clearing only the Play Store data and rebooting:

adb shell "su -c 'am force-stop com.android.vending; pm clear com.android.vending'"
adb reboot

After rebooting:

1. Open the Play Store.
2. Complete any initial prompts.
3. Give it a few minutes to initialise.
4. Check the certification status again.

The Play Store then changed to Device is certified, while Play Integrity remained 3/3.

8. Test Google Wallet​

Once the Play Store is certified:

1. Open Google Wallet.
2. Check whether it displays a security warning.
3. Allow some time for Google’s server-side status to refresh.
4. Test it at a real contactless payment terminal when possible.

The absence of a warning is encouraging, but it does not guarantee that contactless payment has been approved. A real payment is the final test.

In my case, I successfully completed a real contactless payment after applying this setup.

9. Fix Revolut not starting​

If Revolut closes shortly after its splash screen or refuses to start:

1. Open KernelSU.
2. Locate Revolut in the app list.
3. Make sure root permission is OFF for Revolut.
4. Enable Umount modules for Revolut.
5. Open HMA-OSS.
6. Add Revolut to the appropriate hiding template.
7. Confirm that the template is assigned to Revolut.
8. Reboot and test it again.

If Revolut still closes:

1. Uninstall Revolut.
2. Reinstall it directly from the Play Store.
3. Open KernelSU and configure Revolut again:
   • Root permission: OFF
   • Umount modules: ON
4. Open HMA and assign the appropriate hiding template again.
5. Reboot the phone.
6. Test Revolut.

Reinstalling Revolut can recreate its app keystore if the previous one became invalid under an older root configuration.

A reinstall may also reset the app’s KernelSU and HMA assignments, so those settings should always be checked again afterwards.

10. Protect existing HMA configurations​

Be careful with Specter’s Set HMA-OSS Configs function. It may replace the existing HMA configuration, including custom templates used for work, banking or other apps.

Before using that function:

1. Open HMA-OSS.
2. Export the current HMA configuration.
3. Save the backup outside HMA’s private app storage.
4. Let Specter apply its required configuration.
5. Restore or merge the previous templates afterwards.
6. Check that Wallet, Revolut and other protected apps are assigned correctly.

If you already have a carefully configured HMA setup, it is better to preserve it and add the required hiding rules instead of blindly replacing the entire configuration.

11. Leave the setup alone once it works​

Once Play Integrity passes, the Play Store is certified and the required apps work, I recommend leaving the configuration unchanged.

I disabled:

• Automatic PIF updates
• Automatic keybox updates

I also stopped running Specter’s full Action pipeline after everything started working.

Running the pipeline again could:

• Replace the working keybox
• Select another fingerprint
• Rebuild the target list
• Stop or clear Google services
• Change related hiding or HMA settings

I would only update the keybox or fingerprint if the current one stops working or is confirmed to be revoked. Before making changes, export the working configuration.

12. Final confirmed results​

With this configuration I have personally confirmed:

• Play Integrity: 3/3
• Play Store: certified
• Google Wallet: no security warning
• Google Wallet: successful real contactless payment
• Revolut: working
• Existing HMA profiles: preserved

Again, this is only a report of what worked for me. It is not intended to supersede the OP’s guide, and the OP’s original solution may remain the better or simpler option for many users.

Did you set up something within nomount?
My setup is working fine but I'm reading many people using that module.

 

[Viking Hogar Strasni]

Did you set up something within nomount?
My setup is working fine but I'm reading many people using that module.

everything is installed through nomount

 

[yukkio]

everything is installed through nomount

What do you mean? Nomount configures itself? Sorry, few years using modules but I didn't hear about nomount and I'm curious.

 

[Viking Hogar Strasni]

first installation is through nomount, it write on screen

 

[J_Ark]

Flashed boot.img on mi 12T Pro with fastboot flash boot_a boot.img and flashed zip of Anykernel on my TWRP. Now there are no traces of LKM root.

What I don't know is how to:

Set pif as Pixel 6a
Update keybox from kow

EDIT: Think I found it.

@Viking Hogar Strasni HMA-OSS should be uninstalled? I think I got it from previous guide.

​