CleveresTricky - Strong Integrity Guide

Use this guide to choose ROM-specific settings for Google Play Integrity (MEETS_STRONG_INTEGRITY, MEETS_DEVICE_INTEGRITY, and MEETS_BASIC_INTEGRITY) on Android 12 through Android 17 with KernelSU, APatch, or Magisk. On Magisk, open the WebUI from the module Action button through the standalone WebUI host app.

Where to find it: Dashboard / Keyboxes. Where is each feature?

Choose your ROM setup

ROM type	Setup path
Official stock ROM (recent patch / within 6 months)	Install CleveresTricky, add a valid Keybox, and leave other settings at their defaults.
Official ROM with security patch older than 6 months	Play Integrity requires an up-to-date identity. Enable `Identity` on Dashboard and choose Auto Identity or a certified device template.
Custom / AOSP ROM (LineageOS, crDroid, PixelExperience, Evolution X)	Enable `Identity` on Dashboard and choose Auto Identity or a certified device template.
Custom ROM with a non-standard Keystore	Not officially supported. Use legacy fallback methods if the vendor Keystore is broken or native hardware attestation does not work.

Details and limits

Official stock ROM

For official firmware such as Pixel, Xiaomi/HyperOS, Samsung/One UI, or OnePlus/OxygenOS:

Install the latest CleveresTricky module ZIP in KernelSU, APatch, or Magisk.
Open the CleveresTricky WebUI and add a valid Keybox. On Magisk, use the module Action button and standalone WebUI host app.

Usually all you need: Keep the other settings at their default values.

Official ROM with an outdated security patch (older than 6 months)

When official firmware has not received security updates and its Android security patch level is older than 6 months, Play Integrity requires an up-to-date identity:

Open Dashboard in the CleveresTricky WebUI.
Enable Identity (Identity Engine).
Choose Auto Identity or select an up-to-date certified device template.

AOSP ROM

For LineageOS, crDroid, PixelExperience, Evolution X, and similar ROMs:

Open Dashboard in the CleveresTricky WebUI.
Enable Identity (Spoof Engine).
Choose Auto Pixel Identity or a certified device model template for the device fingerprint.

Memory note: Identity and automatic fingerprint handling may slightly increase RAM usage due to dynamic runtime property evaluation.

Custom ROMs with non-standard Keystores

Custom ROMs are not officially supported. If the vendor Keystore is broken or native hardware attestation does not work, use the legacy fallback methods.

Keybox tools and import

Online Keybox Checker: Verify certificate validity, chain integrity, and revocation status at keybox.tryigit.dev/checker.
Keybox download and information: keybox.tryigit.dev.

Import a Keybox

Open the CleveresTricky WebUI from KernelSU, APatch, or Magisk.
Open Keybox Manager.
Select Import / Upload and choose your .xml or encrypted .cbox file.

No manual copying required: Do not copy keybox.xml into legacy TrickyStore directories such as /data/adb/tricky_store/keybox.xml. CleveresTricky manages and isolates the Keybox pool.

Limits and authorized use

Independent project: CleveresTricky is a community-maintained open-source research and compatibility project. It is not affiliated with Google LLC or AOSP.
Policies can change: Google may change Play Integrity checks, certification lists, and key revocation status without notice. A verdict that passes today may change later.
No remote guarantee: CleveresTricky improves local Android Keystore compatibility; it cannot guarantee a remote verdict or a permanent result. Use it at your own risk.
Authorized material only: No usable private attestation key is included. Use only key material you own or are legally authorized to test.

Back to all guides