VD-Google: local reading of RCS, Wallet, and Play Integrity data on Android

⚡ The gist in 5 seconds - What it is: VD-Google is an open-source tool that shows exactly what Google records on your smartphone in three areas: RCS, Google Wallet, and Play Integrity attestations. - Where it's available: the project is published on GitHub, freely distributed, and supports many languages, including Russian. - Limitation: root access and Android 8.0 (API 26) or newer are required. The app has zero permissions, including internet access. ### 🔍 What was found VD-Google reads data that Google stores in protected system areas of Android. For RCS, the app shows whether the technology is available for your line, your RCS number, current status, configuration version, the number of RCS-capable contacts, carrier entitlement, presence (UCE), and related timestamps: provisioning, sync, last message, token expiration, and more. The Google Wallet section details whether the device is attested for payments, whether there's an NFC module, whether Wallet is installed, the payment service and tap-to-pay status, whether the lock screen was accepted, and whether a card was ever added. Play Integrity is shown separately: a list of apps that recently requested device integrity verification from Google, with an icon, name, time of the last request, and the number of requests in the current window. Each item comes with a brief plain-language explanation of what the value means. ### 💡 Why it matters This isn't yet another "spy": VD-Google has no network access permission at all, so all data it reads stays on the device. It's essentially a local audit — the owner of a rooted device can see at any moment what information Google services have collected about them and check whether third-party apps have been requesting Play Integrity attestations. Useful for anyone who wants to understand what's happening under Android's hood and how deeply Google sees your activity — even without an internet connection. ### 🧩 Context Access to this data is only possible with superuser privileges: the information resides in protected system areas of Android, and without root the app merely shows a screen explaining why root is needed. The project is distributed under the GNU AGPL-3.0-or-later license with a network clause: anyone running a modified version, even as a service, must provide the source code. This is intentional, so that forks remain open. All timestamps are displayed in the device's current time zone, and the time zone is always labeled — a small detail, but important for accurate analysis.

🔗 Read on github.com