Play Integrity and Root Environment Attestation Script

Role: Staff FinTech Mobile Anti-Fraud Engineer with deep specialization in native runtime protection, app attestation, and anti-tamper defense.

Context

• GCP Cloud Project Number: {{cloud_project_number}}
• Android Application ID: {{package_id}}
• Minimum Integrity Verdict: {{risk_tolerance_threshold}}
• Security Gateway Endpoint: {{reporting_endpoint_url}}
• Threat Response Policy: {{tamper_action_protocol}}

Task

Develop an end-to-end Kotlin runtime protection and Google Play Integrity verification script that assesses device authenticity, detects rooting or hooks, requests server-side token validation, and executes configured countermeasures.

Method

1. Initialize Google Play Integrity Standard Integrity Manager utilizing {{cloud_project_number}}.
2. Build a native check routine scanning for common rooting artifacts (su binaries, Magisk, KernelSU, busybox) and known hooking frameworks (Frida, Xposed).
3. Check SELinux enforcement status and verify system property flags indicating test-keys or modified builds.
4. Generate a cryptographically secure nonce tying the user session to the Play Integrity request.
5. Warm up the integrity token provider and request an attestation token for {{package_id}}.
6. Transmit the attestation token and local risk indicators to {{reporting_endpoint_url}} via secure coroutine channel.
7. Parse server-validated verdicts against {{risk_tolerance_threshold}} (MEETS_DEVICE_INTEGRITY, MEETS_STRONG_INTEGRITY).
8. Trigger {{tamper_action_protocol}} immediately upon verdict mismatch, debugger attachment, or runtime hook detection.

Constraints

• Code MUST be modularized into a production-grade Kotlin singleton or dependency-injected service.
• The script MUST NOT perform server-side token decryption locally on the client device.
• Root checks MUST run asynchronously without degrading cold-start performance by more than 50 milliseconds.
• The countermeasure execution MUST securely terminate the application process when fatal compromise is detected.

Output format

• Section 1: Attestation Architecture & Nonce Generation Logic
• Section 2: Complete Integrity & Anti-Root Script (Kotlin with Play Integrity SDK integration)
• Section 3: Telemetry Reporting & Action Protocol Handler
• Section 4: Backend Token Decryption & Verification Spec (JSON format expected by {{reporting_endpoint_url}})

Self-review

• Ensure {{cloud_project_number}} and {{package_id}} are referenced correctly in the token provider setup.
• Verify that native binary scanning includes stealth paths used by KernelSU and APatch.
• Check that the nonce generation incorporates a cryptographic timestamp to prevent replay attacks.