Bypassing “Get This App From Play” Integrity Check on Android Apps

Stumbled upon a road block in a research project where I need to bypass Google’s Integrity Check called PairIP.

*At first, I’m doubting myself if I should create this article, because I found all the method on the Internet. But, after sometime I thought I’ll share this as a short compiled version of the methods to help you guys. Shout out to all the articles and discussions that’ve help me to make this article :)

Disclaimer : All the information is for educational and authorized and legal actions only. Do not use these information for ilegal actions.

Get this app from Play Popped Up when running the patched app

I found several techniques to bypass this integrity checks, for example from this medium showed 3 ways to bypass :

1. Using LSPosed Module (https://github.com/ahmedmani/pairipfix)
2. Using Lucky Patcher to Remove License Verification (https://www.luckypatchers.com/download/)
3. Manual Modification (patch the AndroidManifest.xml to remove the activity and providers blocks that uses **com.pairip.licensecheck.***)

Also a full and deep technical analysis on how to bypass this is explained in this blog.

The One Simple yet Working Method

However, On top of all the methods, I found a method on a reddit discussion which “I personally think” is the simplest method. We will be using app called AppManager to disable a content provider called com.pairip.licensecheck.LicenseActivity and an activity called com.pairip.licensecheck.LicenseContentProvider within the target application.

Basically we want to force the app to run without using and running those content provider and activity. After disabling, make sure to apply the rules by clicking on triple dots and apply rules.

com.pairip.licensecheck.LicenseActivity

com.pairip.licensecheck.LicenseContentProvider

Final thought

PairIP Integrity Checks is one among many type of integrity checks. Bypassing an integrity checks is a crucial step during pentesting. However it’s also important to note that attackers and scammers keep evolving with their techniques, in a lot of cases scammers modify and tampered mobile banking apps (apk) with malwares and they inform and force users (especially elder users) to update they banking applications with an excuses of security issues on the outdated app, or even acting themselves as a customer service to help user register something on their bank account.

So, the next idea is for developers to find more sophisticated and stronger integrity checks, and for non-technical person to emphasize our elders to not easily believe a stranger that want to help you especially in fintech matter.

Finally, this is my medium post after a while, haha I wish myself to have more time creating more insightful articles. Or maybe my security certification journeys, we’ll see.

Anyway, thank you and Happy New Year btw !

References :

• https://www.reddit.com/r/Magisk/comments/1n0t9vq/comment/nsjv5bg/?utm_source=share&utm_medium=web3x&utm_name=web3xcss&utm_term=1&utm_content=share_button
• https://github.com/MuntashirAkon/AppManager
• https://petruknisme.medium.com/bypassing-pairip-integrity-checks-21d7bdd4a052
• https://blog.byterialab.com/reversing-googles-new-vm-based-integrity-protection-pairip/
• https://github.com/Solaree/pairipcore
• https://github.com/ahmedmani/pairipfix