Specter

Home Tools App Targeting Control Settings

Getting strong integrity, TEESimulator management, detection solve. Clean, focused, no bloat.

Download

Background

Specter is a complete rewrite of what I originally built as Yurikey.

Support

Telegram: Channel · Group
Ko-fi: ko-fi.com/dpejoh
BTC: bc1qfy4vfstns4aqhvck66x0r53n3hfkkzhwkt7zpw
ETC: 0x895762C0Fd2BeF54EE3cD478Fc03212aeA673a68

Quick start

Install Tricky Store / TEESimulator / TEESimulator-RS (Specter auto-installs TEESimulator-RS if none found — skip if using OhMyKeymint)
Install Play Integrity Inject or Play Integrity Fork
Install Specter via Magisk / KernelSU / APatch
Reboot. First-boot runs backup, target, security patch, keybox.
Open the WebUI

Features

Keybox: multi-source catalog, custom keybox, Google revocation, backup/restore
Auto Target: inotify + polling for new apps
App Targeting: per-app states, suffixes, blacklist
Security Patch: live fetch with offline fallback
ROM Fingerprint: cleans custom ROM props and prefixes
ADB Disabler: dev options, USB debugging, OEM unlock
PIF: auto-detect variant, fetch fingerprint, block spoof engines
GMS Kill: force-stops DroidGuard/GMS, clears Play Store
Module Configs: HMA-OSS/HMA/HMAL, Zygisk Next
Detection Cleanup: removes detector logs, temp dirs, caches
Widevine L1: attestation keys via KmInstallKeybox
Conflict Resolution: 8 modules — aggressive disabled, passive coexists, TEESimulator WebUI feature ownership
Scheduler: periodic keybox info, auto-target, autopif
First-Boot: backup originals, run full pipeline once

Requirements

Root access (Magisk / KernelSU / APatch)
Tricky Store / TEESimulator / TEESimulator-RS / or OhMyKeymint (Specter auto-installs TEESimulator-RS if none detected)
Play Integrity Inject or Play Integrity Fork

Build

git clone https://github.com/dpejoh/specter
cd specter
npm install
npm run build

Output: Specter-v{version}.zip

Testing

bash tests/run.sh          # Shell tests. 6 files, 97 assertions.
npm test                   # TS tests. 10 files, 92 tests (vitest + happy-dom).
npx tsc --noEmit           # TypeScript strict check

CI

TypeScript strict, ShellCheck (warning), shell tests, TS tests
Module structure verification
No hardcoded /data/adb/modules/Specter paths in lib/ or features/
No su -c in feature scripts

Legal

FOR EDUCATIONAL PURPOSES ONLY.
THE DEVELOPER DOES NOT CONDONE ILLEGAL ACTIVITIES INCLUDING BYPASSING DRM, VIOLATING TERMS OF SERVICE, OR COMMITTING FRAUD.
USERS ARE SOLELY RESPONSIBLE FOR COMPLYING WITH APPLICABLE LAWS.

Warning

SPECTER IS PROGRAMMED NOT TO CAUSE PROBLEMS, BUT AN UNLOCKED PHONE ALWAYS COMES WITH RISKS.
NOTHING IS 100% GUARANTEED. USE AT YOUR OWN RISK.
YOUR WARRANTY MAY BE VOIDED, APPS MAY BREAK, AND ACCOUNT BANS ARE POSSIBLE.
ALWAYS MAINTAIN BACKUPS OF IMPORTANT DATA.

Translations

The WebUI is translated into Arabic, Spanish, French, Indonesian, Polish, Russian, Turkish, and Chinese (mostly AI-generated — human review welcome).

To contribute translations: - Preferred: Join the Crowdin project — web UI, no git needed - Alternative: Edit the JSON files in src/webroot/lang/ and submit a PR

Automation: - Pushing changes to src/webroot/lang/source/string.json on main uploads the new keys to Crowdin - Every Monday a workflow downloads finished translations and opens a PR (i18n: translation updates from Crowdin) - Required repo secrets: CROWDIN_PROJECT_ID, CROWDIN_PERSONAL_TOKEN

Each *.json file is validated against source/string.json in CI (npm test). New keys without translations fall back to English.

Thanks

chiteroman, KOWX712 and osm0sis. PIF and forks.
5ec1cff, JingMatrix, Enginex0. Tricky Store and forks.
KOWX712, Enginex0. Tricky Store Addon.
eltavine. Duck Detector.
Citra-Standalone. TSupport-Advance.

License

GNU GPL v3.0