Add spoofVendingSdk to force legacy verdicts from new PI

[TheFreeman193]

This adds the spoofVendingSdk advanced option to custom.pif.json which, when enabled, spoofs the build SDK level for Play Store (com.android.vending). It is disabled by default.

When spoofVendingSdk is set to 1, PIFork spoofs SDK level 32 for Play Store. Values higher than 1 will spoof that SDK level. PIFork will not spoof an SDK level higher than device's real one as this is likely to cause instability.

Additionally, killgms.sh has been replaced with killpi.sh which stops both DroidGuard and Play Store processes. Stopping both processes is necessary to see changes to new Play Integrity verdicts.

Context

Play Integrity verdicts are changing in May 2025 for devices running Android 13 and later, and will require a locked bootloader for MEETS_DEVICE_INTEGRITY. The new Play Integrity system uses signals from both DroidGuard and Play Store. When Play Store sees an SDK level less than 33, Play Integrity returns the legacy (pre-Android 13) verdicts. This spoofing feature may help in getting MEETS_DEVICE_INTEGRITY verdicts when the bootloader is unlocked.

Known Issues

Devices will experience degraded functionality in Play Store when this feature is enabled:

• Back gesture/nav button from within the Play Store exits directly to homescreen for all
• Blank account sign-in status and broken app updates for ROMs A14+
• Incorrect app variants may be served for all
• Full Play Store crashes for some setups

We're investigating ways to rectify this.

[osm0sis]

Brilliant work! 😍

I'd be happy to merge this as an undocumented feature for testing purposes as-is, would just need to "undocument" it a bit by removing it from the scripts' --advanced outputs for now until the Play Store issues can be addressed.

Also would be tidier if it could somehow not touch vending at all unless the feature was enabled, but not sure how possible that is with how the Zygisk JNI works.. 🤔

[TheFreeman193]

I don't think we can have Zygisk dlclose the entire module for vending before it's forked from Zygote without moving the readJson() processing to preAppSpecialize, but we can certainly turn off JNI loading the custom classes. Since class loading is dynamic in Java this would leave everything inside the ART untouched when disabled.

Something along the lines of:

if (spoofBuild + spoofProvider + spoofSignature + spoofVendingSdk > 0 ||
pkgName == "com.google.android.gms.unstable" && verboseLogs > 99)
    inject();

This would have the added benefit of not loading the custom classes for DroidGuard either when field, signature, and provider spoofing are all turned off, unless logFields() is needed.