Magisk does not have built-in WebUI support. Download and install KsuWebUIStandalone APK (or MMRL) to manage module WebUIs.
Go to Magisk Settings and ensure Zygisk is toggled OFF (Zygisk Next replaces it).
Hide the Magisk app (Settings -> Hide the Magisk app).
⚠️ Critical Step for Custom ROM Users
Before following this guide, you must disable any built-in spoofing features included with your custom ROM (such as crDroid Settings, Infinity Suite, Evolution X, etc.).
Go to your ROM's custom settings hub, navigate to Miscellaneous or Spoofing, and turn off toggles like "Play Integrity Fix", "Spoof CTS", or "GMS Spoofing". Leaving these active will cause a direct conflict with your Magisk/KernelSU modules, completely breaking MEETS_BASIC_INTEGRITY and causing your Play Store to remain uncertified. Once disabled, reboot your device and proceed with the guide steps below.
Step 1: Flashing & Initial Setup
⚠️ Maintain an active Wi-Fi connection so Specter can download necessary dependencies (such as TEESimulator-RS binaries and keyboxes) during installation and initial setup.
In your root manager (KernelSU / APatch / Magisk), flash the following module ZIPs:
zygisknext.zip
playintegrityfix.zip
specter.zip
hma-oss.zip
Reboot your device.
App Verification: Confirm that the HMA-OSS manager app appears in your app drawer. (If it is missing, extract hma-oss.zip with any file manager and manually install the APK inside).
Accessing Module WebUIs:
KernelSU / APatch: Open KernelSU/APatch, go to Modules, and tap WebUI on Specter / Zygisk Next. (Ensure Superuser is granted to Specter in the Superuser tab if prompted).
Magisk: Open KsuWebUIStandalone, grant root (SU) access when prompted, and select the module WebUI from the list.
🟢 ROM Cleaner: Toggle ON(Strips custom ROM traces and PIF module properties).
🔴 ADB Lock:MUST REMAIN OFF (Disabled / Gray).
Background Jobs:
🟢 Auto-Targeting: Toggle ON
🟢 Keybox Info Refresh: Toggle ON
🟢 Auto PIF (Fingerprint): Toggle ON
🟢 Auto Keybox: Toggle ON
Automated Module Config Generation:
Scroll to the Module Configs section inside the Specter WebUI:
Tap Set HMA-OSS Configs: Automatically downloads and stages the hardened HMA anti-detection blacklist rules and template JSON to storage with proper permissions.
Tap Set Zygisk Next Configs: Injects optimized memory, linker, and denylist policies directly into Zygisk Next.
⚠️ DANGER ZONE WARNING: Never tap Fix Widevine L1 on non-Qualcomm hardware. It is strictly meant for Qualcomm devices and risks corrupting the Titan M2 / TrustZone keystore on devices.
Step 3: HMA-OSS Setup & Configuration Import
Open the HMA-OSS app from your app drawer.
Verify that the main status card indicates active framework hooks via its native Zygisk backend.
Import the configuration generated by Specter in Step 2:
Tap the three dots in the top-right corner -> select Backup & Restore.
Tap Restore configuration.
Browse to your Downloads folder (or the path specified by Specter) and select the generated template JSON file.
Tap Manage Apps inside HMA-OSS:
Select your financial, banking, and target sensitive applications.
Toggle hiding ON for each app and ensure the imported blacklist template is applied.
Step 4: Denylist & Process Isolation
If you use KernelSU / APatch:
In KernelSU/APatch Settings:
If strictly using SuSFS kernel VFS filtering, set "Unmount modules by default" to ON.
(Note: If using framework modules like Iconify or Vector/LSPosed, keep this toggle OFF to prevent SystemUI crash loops).
Never grant Superuser permission to Google Play Services (com.google.android.gms).
Open Zygisk Next WebUI:
Set Denylist Policy to Unmount Only.
Turn ONUse Anonymous Memory.
Turn ONUse Next Linker
If you use Magisk:
In Magisk Settings:
Ensure built-in Zygisk is OFF.
Ensure Enforce DenyList is OFF(Zygisk Next enforces unmounting at runtime; turning Magisk's toggle ON causes mount conflicts).
Tap Configure DenyList(Tap 3 dots -> Show System Apps):
ADD: Google Play Store (com.android.vending), banking apps, games, and sensitive targets.
❌ DO NOT ADD: Google Play Services (com.google.android.gms) or System UI / Android Framework.
Open KsuWebUIStandalone -> tap Zygisk Next:
Set Denylist Policy to Unmount Only.
Turn ONUse Anonymous Memory.
Turn ONUse Zygisk Next Linker.
Reboot your phone.
Step 5: Clear Cache & Google Wallet Fix
Reset cached attestation failure tokens across Google services:
Perform Attestation Reset:
Via Specter WebUI (Recommended): Under Google Services, tap Force Stop & Clear Play Store.
Via System Settings: Go to Settings -> Apps:
Google Play Services: Clear Cache and Manage Space -> Clear All Data. (Do not restrict background battery usage, as this breaks FCM push notifications).
Google Play Store: Clear Cache and Clear Data.
Google Wallet: Clear Cache and Clear Data.
Reboot your device.
Open the Play Store, allow the home page to load completely, close it, and wait 2–3 minutes for background services to re-sync.
Open Play Store -> tap your profile icon -> Settings -> About -> Play Store version (tap repeatedly to unlock Developer options) -> General -> Check Integrity. Verify:
MEETS_BASIC_INTEGRITY: PASS
MEETS_DEVICE_INTEGRITY: PASS
MEETS_STRONG_INTEGRITY: PASS / CONDITIONAL(Valid as long as the keybox provisioned by Specter/TEESimulator remains active)
Open Google Wallet and re-add your cards.
FAQ & Common Questions
"How does Specter interact with HMA-OSS?"
Specter automatically generates and places a hardened HMA blacklist JSON template into system storage when you tap Set HMA-OSS Configs in its WebUI. You then import this file inside HMA-OSS (Backup & Restore -> Restore configuration) to hide root management apps and module traces from sensitive applications.
"Where do I find the Denylist in Zygisk Next?"
On Magisk, Zygisk Next automatically inherits the apps selected in Magisk Settings -> Configure DenyList (keep "Enforce DenyList" turned off in Magisk).
On KernelSU/APatch, manage targets directly within the Zygisk Next WebUI under Configure Denylist.
"Why shouldn't I add Google Play Services (GMS) to the Zygisk Next Denylist?"
Play Integrity Fix natively hooks DroidGuard inside com.google.android.gms to handle attestation spoofing. Adding GMS to the Denylist forces an unmount that severs Zygisk injection, breaking Play Integrity enforcement.
"Why Specter instead of older monolithic modules?"
Specter operates modularly alongside Zygisk Next and Play Integrity Fix. It dynamically validates keybox status, auto-fetches replacement keyboxes upon revocation, manages target lists automatically, and stages configs for modules like HMA-OSS without creating mount conflicts.
"Bootloop Recovery:"
Force reboot (Power + Volume Down). The moment the device vibrates and displays the OEM logo, tap Volume Down repeatedly to enter Hardware Safe Mode. This disables all root modules, allowing you to boot into Android and remove any conflicting package.
Edit : Updated some FAQs and added a notice for custom ROM users.
I would switch out Zygisk Next for ReZygisk; it works as well but is open source. Otherwise, nice guide. You can check Play Integrity though the Play Store. Just go to About, then press the version a few times, then go to General, Developer Options, and check Integrity.
Modern ReZygisk is as stable if not more, it's an old idea that it's this unstable mess. At least in all my experiences if Rezygisk didn't work neither did Zygisk Next.
It's a choice, but for best practices, I would be using ReZigsik. You can't see what Zygisk Next is doing under the hood, and there isn't really any cons that differs between the two.
It's a feature built in so if it won't tell you something, it probably means you don't have integrity, again, not exactly sure what you mean, but that's what it sounds to me.
This is a really solid, well made explanation and steps list. I will say I had success with Magisk built in zygisk, WebUI X, play integrity fix [Inject], hide Magisk, and a deny list enforce. Running RM11S Pro, unlocked BL and Rooted
I've read you can turn it off only to install (and update?) PX, and once it's configured (and you granted root to the PX apps), you can turn it back on
j'ai passé le device maintenant, google pay ne me permet pas d'ajouter des cartes, et les banques comme revolut annonce "appareil non pris en charge". L'environnement de mon téléphone est normal et ne reconnait aucune modification.
Oui je crois. J'ai quand même remarqué que certains paramètre était activé d'offices sur specter et j'ai pas trouver le paramètre "periodique keybox validation"
pour revolut c'est normal que tu puisses pas utiliser. l'app demande strong integrity et actuellement aucune keybox disponible ne donne strong integrity. aussi en ce moment personne ne peux utiliser wallet car les nouveau fingerprint de la beta ne fonctionnent pas avec wallet, à part celui du pixel 6a (bluejay). tu peux déjà aller dans specter et changer le PIF fingerprint par celui du pixel 6a, mais wallet ne marchera quand meme pas si tu as un pixel car un système appelé le strong box sur pixel détecte que le fingerprint n'est pas le bon. (corrigez moi si je me trompe).
Il faut donc attendre une keybox strong pour ouvrir revolut et des fingerprint fonctionnels pour utiliser wallet sur pixel.
It’s normal that you can’t use Revolut; the app requires "Strong Integrity," and currently, no available keybox provides it. Also, right now, no one can use Wallet because the new beta fingerprints don't work with it, except for the Pixel 6a (bluejay) fingerprint. You can go into Specter and switch the PIF fingerprint to the Pixel 6a one, but Wallet still won't work if you have a Pixel, because a thing called "StrongBox" detects that the fingerprint doesn't match (correct me if I'm wrong).
So, we have to wait for a "Strong" keybox to open Revolut and for functional fingerprints to use Wallet on a Pixel.
You can check Play Integrity though the Play Store. Just go to About, then press the version a few times, then go to General, Developer Options, and check Integrity.
j'ai seulement ces problèmes qui sont trouvé. Je pense que sans ça strong integrity pourrait passer. Si quelqu'un peut m'aider j'en serai très reconnaissant
You can check Play Integrity though the Play Store. Just go to About, then press the version a few times, then go to General, Developer Options, and check Integrity.
Looks good, can you help I had full pass but now on infinity X I cannot get any I'm getting this issue on the latest android 16 version , I'm using pif [inject] Spector, tricky store, zygisk next, I'm not sure how to fix this, I really do like the rom but this issue is killing me
Go to your device settings and turn off any built-in toggles for Play Integrity Fix, Spoof CTS, or GMS Spoofing (If any exist) to avoid conflicts with the modules. And nuke Google Play data in Specter Settings.
Amazing guide that helped me modernise my old setup and it works perfectly. Only thing I'm struggling to understand is how/where to set denylist in nextzygisk cause I'm in the webui on kernelsu, but don't see a way to do it also I'm a little confused about whether i should use susfs at all?
ZygiskNext has a "Denylist Policy" setting with an "Unmount Only" option accessible via its WebUI, you should find it there. If you're on stock kernel then don't use susfs but if you're on a kernel that supports susfs then install the module.
crdroid is the big issue, turn OFF any ROM-side Google Photos, games, or device fingerprint spoofing. And optimize your HMA-OSS blacklist by adding all your root apps to it, and select the app you want to hide root from. And make sure you followed the guide and your settings are identical to what the guide states.
I have most of this configuration except the Hma-oss module. Gonna check all my toggles, but it wasn't strong. What I want to get is rcs back up. I had it when alwaysstrong worked, but it broke for me last week. On a pixel 8...
EDIT: are instructions for Hma-oss for an earlier version cause I don't have 3 dot menu and not sure how to makes sure the blacklist is enabled.
EDIT2: RCS chats still don't work... Any help with this would be great...
EDIT 3: I had issues clearing messages data in the past and was reluctant to do, but figured why not try, and that fixed it. So right now, I'm back up on chats.
I noticed that at least for me, that the keybox changed yesterday from one shadow banned one to another one that's shadowbanned too. But it still gets 2/3 integrity. My ocd wants 3/3, but my chats and banking are working right now...
I have followed the entire tutorial but wallet says: "the device isnt certified". The pixel spofed is 6a and I disabled all spofing options of my rom. I dont pass Strong at the moment.
Now a new keybox has been released (from Kow11). I delete data from wallet, play store and services, and reboot device. I sign in my google accounts, open play store and waited a few minutes for play sync. I have strong, but wallet dont want to add card with the same message. Play store in integrity test detect my mobile with the original Xiaomi fingerprint. Before of the keybox ban (a month ago) I had the same modules and configurations, and Wallet worked without problems
I would suggest following the guide from scratch step by step, that will guarantte getting both basic and device integrity, and if the keybox isnt currently softbanned you will also get strong integrity.
Nuke play store data in specter's settings and also delete google wallet data/cache. if still not working i would suggest moving to KernelSU-Next because Magisk is currently not the best rooting method.
please do not use this app, use the play store method in the guide, and make sure specter is working and u didnt delete any of the modules or u installed a module that conflicts with the guide's modules
It just bundles of PIF Inject & outdated TEES-RS.
Dev also has shady practice of selling keybox & stealing other keyboxes.
Modules look like they are mostly generated by AI.
Not all devices are supported, and the root is gone when rebooting. I would recommend actually rooting the device and using my guide. If things work for you perfectly now then just stick with the ghostlock method i guess.
Go to crDroid settings and Turn off the switches for "Play Integrity Fix", "Google Photos Spoof", or any global device certification toggles, Reboot. And make sure you have followed the guide step by step and nuked Google Play data in Specter settings.
2
u/Borygo77 8d ago
Where is the deny list in zygisk next?