Install Magisk, enable Zygisk, and use Shamiko + Universal SafetyNet Fix mod. But note: With an unlocked bootloader and no locked Knox-like chip, some apps (Google Pay, Pokemon Go) will still detect via hardware attestation. You may need to install a custom kernel that spoofs locked bootloader state.