[BOUNTY] Support Play Integrity over remote DroidGuard + Server/Guide [$100]

[kaduvert]

Play Integrity should be supported over the remote DroidGuard functionality and there should be documentation how to set up a phone as a DroidGuard server.

Why?
While existing solutions allow getting a sufficiently passing Play Integrity token with a non-integrity-compliant device, there is the following problems that come with it:

• the requirement for a rooted phone,
• running the integrity-checking code from google on your phone that's purposefully obfuscated and fetched at runtime,
• running strange bypassing software with root permissions, like the closed-source TrickyStore and
• all of this has to permanently be kept up-to-date in line with updates to Play Integrity to stay passing

This is tedious, never-ending work that everyone rather avoids.
If you're a busy person it's also not really feasible. Imagine coming out of a cinema with your friends and heading for a rentable scooter only to realize you're device doesn't pass Play Integrity anymore.

If PI would work over another device, like an old, stock one you still have at home, it would fix these problems.
It would also open the oppurtunity for commercial integrity-attestation offerings, where you would like pay monthly and they then allow you to use their devices over a server which then serves valid integrity tokens to your device.

How to implement?

• Fix:

remote droidguard currently does not work for play integrity due to play integrity using a multi step droidguard process and the implementation only supports single step (which is used by most other things that use droidguard).
(#2851 (comment))

• Write a remote DroidGuard server to handle the requests
• Create a guide/docs on how to set it up
• Either
  • make it run on stock phones or
  • create software that manages all the integrity-bypassing software on the custom-rom 'server device' so that it's always passes. as far as i know to make a custom phone pass you need:
    • microG / GApps
    • Magisk or KernelSU
    • PlayIntegrityFix
    • TrickyStore

This issue was edited because it was traced to being a Play Integrity issue at #2851 (comment).

See

initial Dott/Firebase sms verification issue report

Affected app
Name: Dott
Package id: com.ridedott.rider

Describe the bug
Signing in or signing up fails, seemingly because of a firebase error

To Reproduce
Steps to reproduce the behavior:

1. get Dott
2. Click on sign up
3. enter phone number
4. click sign up

Expected behavior
sends sms verification or proceeds in general

Screenshots

sign up error page

dott vehicle coverage

System
Android Version: 15
Custom ROM: LineageOS+microg 22.1

microG
microG Core version: 0.3.6.244735
microG Self-Check results: All ticked

Additional context
full logcat of an app start and signup attempt, filtering out all logs, except those coming from com.ridedott.rider with personal or identifying information replaced by [...]:

dott 06_04-09-30-30_733.log

Likely critical lines from the log:

1743924520.834 10285 20276 23037 W LocalRequestInterceptor: Error getting App Check token; using placeholder token instead. Error: com.google.firebase.FirebaseException: Error returned from API. code: 403 body: App attestation failed.
1743924521.066 10285 20276 23037 E FirebaseAuth: [SmsRetrieverHelper] SMS verification code request failed: unknown status code: 17499 Firebase App Check token is invalid.
1743924521.067 10285 20276 20276 D FirebaseAuth: Invoking original failure callbacks after phone verification failure for (my phone number), error - An internal error has occurred. [ Firebase App Check token is invalid. ]

microg Google device registration is enabled, as is cloud messaging and "SafetyNet".
my device meets basic integrity and device integrity, uses sdk level 35

Possibly related: #1967, #1281

[gibello]

Same issue here, on a new Murena (/e/OS, degooglized Android from e.Foundation) Fairphone 4. Previously used the app on Android, same phone number.
AFAIK, the phone uses LineageOS, and does not appear as rooted. Also same issue in developer mode, or not.
MicroG services version:
0.3.6.244735-dirty
/e/OS version:
2.9-a14-20250321478214-official-FP4
Note that Dott has been reported multiple times as not working with MicroG, like for example in Plexus app database, or in /e/OS list of app compatibility, with recurring login issues.

[Scrumplex]

Weirdly enough the predecessor of Dott (Tier) works just fine :/

[D3SOX]

I have used TIER extensively without any problems why do they have to introduce this stupid new app.
This is annoying me so much I would be willing to pay a small sum for this issue to be resolved. About 25-30€

Sadly TIER is no longer operational so it is not possible to rent any scooters. Lime and Voi are working alternatives but they are not available exactly in the cities where I would use Dott.

[kaduvert]

yes. i believe this is among the most important issues in microG right now.

we're talking about european microG-phone-only users unable to access real world infrastructure relevant nearly anytime they go anywhere.

please direct efforts to this @mar-v-in, this is critical. you can even earn a bit in the process.

[ale5000-git]

yes. i believe this is among the most important issues in microG right now.

The priority is opinable, for example in my city I have never heard of Dott (and I'm still in Europe).
There is Lime and Bird everywhere here.

Have you tried with microG v0.3.9?

[D3SOX]

I want to mention again that this issue likely affects a lot of other apps that use the same mechanism. See the related issues linked above. So keep that in mind for prioritizing.

I will soon migrate from CalyxOS to LOS4microG and then I can report back with the latest version. I'll also try catching some additional logs
Latest version doesn't help. A fix that requires deeper understanding of microG is required.

[ale5000-git]

I want to mention again that this issue likely affects a lot of other apps that use the same mechanism. See the related issues linked above. So keep that in mind for prioritizing.

I wasn't saying that this is not important but there are a lot of other issues equally important.
This is just one of over 1000 issues.

[D3SOX]

I understand. How is stuff actually prioritized? I think it would make sense to tackle the issues most of the people have first if possible. Thoughts?
Can a bounty for this be set up?

[ale5000-git]

I understand. How is stuff actually prioritized? I think it would make sense to tackle the issues most of the people have first if possible. Thoughts?

I don't know but note that there is only one official developer (@mar-v-in), others are external contributors and they will likely do what they want.

Can a bounty for this be set up?

Anyone can add a new bounty here: https://www.bountyhub.dev/en/bounty/new

[fm-knopfler]

I understand. How is stuff actually prioritized? I think it would make sense to tackle the issues most of the people have first if possible. Thoughts?

I don't know but note that there is only one official developer (@mar-v-in), others are external contributors and they will likely do what they want.

Can a bounty for this be set up?

Anyone can add a new bounty here: https://www.bountyhub.dev/en/bounty/new

Can someone create the bounty? I will contribute a few dollars.

[bountyhub-bot]

🚀 Bounty Alert!

💰 A bounty of $35.00 has been created by D3SOX on BountyHub for this issue.

🔗 Claim this bounty by submitting a pull request that solves this issue!

You can also increase the amount of the bounty if you think the issue is worth more.

Good luck, and happy coding! 💻

[D3SOX]

There you go @fm-knopfler

[bountyhub-bot]

🚀 Bounty Update!

💰 A contribution of $65.00 has been made by fm-knopfler on BountyHub for this issue.
The total amount of the bounty is now $100

🔗 Claim this bounty by submitting a pull request that solves this issue!

Good luck, and happy coding! 💻