In short

Of the fourteen signals platforms use to identify a cloud phone, nine can be addressed in software and five cannot: CPU ABI, hardware keystore attestation, camera HAL characteristics, carrier ASN and TEE presence. Any provider running containers or VMs fails all five permanently.

The patchable nine

  1. Build fingerprint — ro.build.fingerprint, model, brand, manufacturer. Trivial to set, and trivially wrong on most providers because the combination does not correspond to a real shipped ROM.
  2. Android ID and GSF ID — patchable, but only meaningful if never reused. Most providers recycle them across tenants.
  3. Advertising ID — resettable by design, so easy. Still linked in the platform's device graph if shared.
  4. Installed package list — needs to look like a phone somebody uses, not a clean AOSP image with one app.
  5. Sensor values — patchable in the sense that you can report anything, but entropy and autocorrelation analysis catches synthetic values.
  6. Locale, timezone, keyboard — easy to set, easy to get wrong. A French SIM with an en-US locale and a Chinese keyboard is a flag.
  7. Battery and storage state — a device at exactly 100% with 94% free storage on every boot is not a phone anyone owns.
  8. Screen resolution and density — must match the claimed model exactly, including the cutout geometry.
  9. Wi-Fi and Bluetooth environment — an empty scan list is suspicious in any populated area.

The structural five

1. CPU ABI

A real Android phone reports arm64-v8a. An x86 container reports x86_64, and no amount of property spoofing changes what instruction set the code actually executes on — native libraries will tell the truth the moment one is loaded.

2. Hardware keystore attestation

The certificate chain must terminate at a Google root, and the private key must live in a secure element provisioned at manufacture. There is no software path to producing one.

3. Camera HAL characteristics

Sensor physical size, active array, focal lengths, aperture list and noise floor must describe a camera that exists. Injection layers over a nonexistent camera produce characteristics that match no shipped device.

4. Carrier ASN

The IP either belongs to a mobile network operator or it does not. Residential proxies improve this; only a real SIM in a real modem solves it.

5. TEE presence and version

Apps can query the trusted execution environment directly. Emulated TEEs report inconsistent versions or fail the query outright.

You can patch a signal. You cannot patch not having the hardware.

What this means when you are shopping

Ask any provider three questions: what CPU architecture is the host, what does Play Integrity return, and is the IP a mobile carrier ASN. If the answers are not "ARM64 bare metal", "MEETS_STRONG_INTEGRITY" and "yes", the remaining nine signals do not matter — you will be caught on the five that do.