Root Detection and Play Integrity for Game Developers

Everything CheatDroid does to another app needs root, or Shizuku for an app that was built debuggable. So it’s tempting to check for root and refuse to start. I make the thing you’d be checking for, and I wouldn’t.

Why a root check on its own is weak

The usual checks look for an su binary, the Magisk app, test-keys in the build tags, a writable system partition. Magisk leaves the system partition alone, hides from any app on its deny list and can rename its own app, so the first two come up empty, and the last two never pointed at Magisk in the first place. The people who root for other reasons don’t bother hiding: ad blocking, backups, an old phone kept alive with a custom ROM. They see your game refuse to start, and they’re the ones who write the review.

Use root as a signal. Log it, keep rooted phones out of ranked play, and let the single-player game run.

Play Integrity

The Play Integrity API asks Google to vouch for the phone and the install. The parts that matter for cheating:

• MEETS_DEVICE_INTEGRITY: a genuine Android device with Google Play services. On current phones an unlocked bootloader fails it, and nearly every rooted phone has one, unless something spoofs the answer.
• MEETS_STRONG_INTEGRITY: the same, backed by hardware key attestation. That’s the one I wouldn’t expect a cheater to fake.
• PLAY_RECOGNIZED and LICENSED: your unmodified app, installed by Google Play for an account that has it.

The app only asks for the token. Decode it on your server with Google’s API and decide there. A check that ends in an if inside your app is one more value in memory, and the memory scanner is right there.

Bind every token to the request it protects, with the request hash or a nonce from your server. Otherwise a good verdict from a clean phone can be captured once and sent from a rooted one forever.

Spend it where it pays: ranked matches, leaderboards, events with real prizes, granting anything that costs you money. A single-player game that refuses to run without strong integrity also refuses a lot of older phones.

Play’s automatic protection

My test emulator installs games through an unofficial Play client, and its Play Store isn’t signed in. Ketchapp’s Stack 4.1 didn’t start there. It opened Google Play’s sign-in page instead of the game, which looks like Play’s automatic protection checking where the install came from (in the Play Console under App integrity). It does nothing against CheatDroid, which never touches your APK. What it stops is a modded APK with the cheats built in, passed around on forums, and that’s where a lot of the cheating in popular games actually happens.