mirror of https://github.com/5ec1cff/TrickyStore.git synced 2025-09-06 06:37:07 +00:00

Files

Chris Renshaw 0a52c2b4a0 Add AOSP software keybox to pass MEETS_DEVICE_INTEGRITY by default

* Add AOSP software keybox to pass MEETS_DEVICE_INTEGRITY by default

* Tweak README further

spoof_build_vars can be used to help pass DEVICE integrity with the default AOSP sw keybox, or help to pass STRONG integrity with an unrevoked hw keybox

2024-07-24 10:09:06 +08:00

2.6 KiB

Raw Blame History

Tricky Store

A trick of keystore. Android 12 or above is required.

Usage

Flash this module and reboot.
For more than DEVICE integrity, put an unrevoked hardware keybox.xml at /data/adb/tricky_store/keybox.xml (Optional).
Customize target packages at /data/adb/tricky_store/target.txt (Optional).
Enjoy!

keybox.xml

format:

<?xml version="1.0"?>
<AndroidAttestation>
    <NumberOfKeyboxes>1</NumberOfKeyboxes>
    <Keybox DeviceID="...">
        <Key algorithm="ecdsa|rsa">
            <PrivateKey format="pem">
-----BEGIN EC PRIVATE KEY-----
...
-----END EC PRIVATE KEY-----
            </PrivateKey>
            <CertificateChain>
                <NumberOfCertificates>...</NumberOfCertificates>
                    <Certificate format="pem">
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
                    </Certificate>
                ... more certificates
            </CertificateChain>
        </Key>...
    </Keybox>
</AndroidAttestation>

Build Vars Spoofing

Zygisk (or Zygisk Next) is needed for this feature to work.

If you still do not pass you can try enabling Build variable spoofing by creating the file /data/adb/tricky_store/spoof_build_vars.

Tricky Store will automatically generate example config props inside /data/adb/tricky_store/spoof_build_vars on next reboot, then you can manually edit your spoof config.

Here is an example of spoof config:

MANUFACTURER=Google
MODEL=Pixel
FINGERPRINT=google/sailfish/sailfish:8.1.0/OPM1.171019.011/4448085:user/release-keys
BRAND=google
PRODUCT=sailfish
DEVICE=sailfish
RELEASE=8.1.0
ID=OPM1.171019.011
INCREMENTAL=4448085
TYPE=user
TAGS=release-keys
SECURITY_PATCH=2017-12-05

Support TEE broken devices

Tricky Store will hack the leaf certificate by default. On TEE broken devices, this will not work because we can't retrieve the leaf certificate from TEE. You can add a ! after a package name to enable generate certificate support for this package.

For example:

# target.txt
# use leaf certificate hacking mode for KeyAttestation App
io.github.vvb2060.keyattestation
# use certificate generating mode for gms
com.google.android.gms!

Known issues

App Attest Key is not supported.
StrongBox is not supported.

2.6 KiB Raw Blame History