yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] pr3dicament:
You see, I somewhat understand and somewhat don't, you know? I like to be thorough. What about the build.prop parser? I will be editing that out shortly, just asking atm,
[Android Software/Hacking General [Developers Only]] pr3dicament:
Damn. Guess I'm screwed.
[Android Software/Hacking General [Developers Only]] pr3dicament:
I can't find a way to "uninstall PIF" though. If they mean the Prebuilt.apk. well... It just doesn't let me install it and I can't find the damn app. I dont want to delete it within root explorer if it means it will keep saying "package conflicts with currently installed package" --- i tried looking for "All apps" including system ones..every app was there except that one, so I could not "uninstall"
[Android Software/Hacking General [Developers Only]] Vision:
@chiteroman he say try add support.
[Android Software/Hacking General [Developers Only]] pndwal:
For what? STRONG?... If you lock you'll get it back on OP8T it seems... Thought you just wanted DEVICE w/ RCS working anyway. 🤔 PW
[Android Software/Hacking General [Developers Only]] pr3dicament:
I need root for AFWall among other things. It isn't just RCS..but that's the only thing I can't get working. I don't mind the device not passing strong. I said this not long ago. Not worried about strong. This is a reason that I repeat myself, unfortunately.
[Android Software/Hacking General [Developers Only]] pr3dicament:
Yeah they said try. I guess we will see.
[Android Software/Hacking General [Developers Only]] pndwal:
I don't know why you keep repeating stuff... Eg, this:

... You don't need STRONG w/ root... What's the problem?... You have one of the few devices where you can have DEVICE_INTEGRITY unlocked without spoofing a non-banned Print!... So easy to have DEVICE_INTEGRITY without even PIF for OP8T!... And using device print means you'll have RCS working too!... And Play Protect 'Device is certified'...

But you keep harping on about being "S*r*w*d" because of broken TEE etc instead of just trying what I wrote. (Bill confirmed no PIF needed with APatch, probably works with Magisk too if you just use Shamiko, but you need to TRY it.)

Clue: PIF normally 'breaks TEE' (breaks hardware key attestation) in order to meet DEVICE_INTEGRITY anyway because we simply can't have it with HKA measurements sent to Google... With OP8T the job of triggering fallback to basic attestation is DONE FOR YOU simply by using device unlocked!!! And Google doesn't enforce HARDWARE_BACKED evaluationType for OP8T fingerprints either, so you're really blessed!!! 🤷 PW
[Android Software/Hacking General [Developers Only]] jakell888888888:
Hello, everyone! I don't know if there is a fourth person in this forum who can help me solve the problem of passing strong_integrity verification. I have been paying attention recently and have been looking for a valid key but I failed. Is there any other way that can help me pass strong_integrity verification? I can pay Some fees. Thank you for the above and pay tribute to the developers @osm0sis@changhuapeng@chiteroman
[Android Software/Hacking General [Developers Only]] pr3dicament:
I use the playintegiryfork from @osm0sis along w/ private print.
[Android Software/Hacking General [Developers Only]] pr3dicament:
This was from before on the same day. Same day that I got the private print. It was basically late at night when i found one. I don't mind not having strong, but if there's a way to get strong.. let's do that.. ya know? lets test it

My dad's OnePlus 6T (my older phone) can watch maxgo, netflix, and everything with a private print as well. Separate print. LOS21. I'll probably put him on AOSP later.

I can't do maxgo or netflix, it just crashes, it says "something is wrong with your setup" and then tries to redirect me to support (maxgo) -- netflix just obviously doesn't log in, as it won't log in with a 10 digit DRM that I have.. works fine for my father.. he can also use Netflix, which is DRM.. if we could somehow get DRM working that would be CRAZY. My dad's 6T happens to have a device specific DRM that doesnt change basically.. it's always 4-5 digits. my older 8T was like that but I shorted that board out. i might still try it. It's still around.
[Android Software/Hacking General [Developers Only]] pr3dicament:
I also have a minor problem with the rom I'm on, I couldn't remove PifPrebuilt. Can't be done, turns out. There's nothing out with a june patch. my dad can do everything on his phone and all i did was use a different print parsed.. but for whatever reason DRM doesnt change when we unlock its bootloader

for me, i can only cast it with maxgo. i have a browser anyway.
[Android Software/Hacking General [Developers Only]] pndwal:
Re DEVICE_INTEGRITY I just meant you don't need any print spoofing since device never uses hardware key attestation (HKA) when unlocked anyway, nor does Google enforce HARDWARE_BACKED evaluationType for OP8T fingerprints either... But I think you still don't understand... 🙃 PW
[Android Software/Hacking General [Developers Only]] pr3dicament:
They don't? I wasn't aware of that... well it still takes me to get a private fingerprint to get rcs so.. that's part of what I cared about. So in theory then, i don't need STRONG, right?
[Android Software/Hacking General [Developers Only]] pr3dicament:
I'm able to download the mcdonalds app, I heard that needed strong? I hate mcdonalds btw.
[Android Software/Hacking General [Developers Only]] Vision:
Yeah, for RCS with a private FP, no need Strong (until now).

Really? before some days i pass it with 2/3.

If you pass 2/3 can confirm if open or eventually need strong ?
[Android Software/Hacking General [Developers Only]] pndwal:
I feel I've said it over and over now...

Your 8T device print will allow RCS...

Strong is out of the question without a leaked (black market?) Google signed valid OEM keybox... Too much for you and me (honestly).

But you'll just pass DEVICE by installing APatch for root and nothing more!

For Magisk, what I told Bill:

But he's happy using a spoofed fingerprint too...

If you try, be aware that @osm0sis couldn't get DEVICE with scripts-only mode on a OnePlus device with A10+ apparently... Good for A8 and A9... You may find it just works or may need to discover what extra sensitive props etc need adjusting... Might be worth a shot... 🙃 PW
[Android Software/Hacking General [Developers Only]] pr3dicament:
i only pass 2/3. but i dont know how to confirm if i need strong or not, i just feel like someone said that and i can use the mdc's app, so idk. what else can i download that needs strong?
[Android Software/Hacking General [Developers Only]] pr3dicament:
I'm happy using a private fingerprint. What are you talking about, spoofed fingerprint? Also...

I use Magisk for root and it works just fine.
[Android Software/Hacking General [Developers Only]] pndwal:
Do whatever makes you happy.

'Private' print is spoofed... Device print isn't... Both allow RCS... Currently used Public print doesn't...

Fine... 🙂 PW
[Android Software/Hacking General [Developers Only]] Vision:
Simply, after download Mdc's from Google Play, open it and if open and not say anything and go to home screen, this mean no need Strong.

Ingress Prime (augmented reality game, need Strong).

Apps&Games need PI (List)

Here you can post what apps&games need to pass 2/3 (Play Integrity) to show it on Google Play. Some apps&games appear and can download but when open (for apps until now) can't use if not pass DEVICE, because required to pass 2/3. Also from now...

xdaforums.com
[Android Software/Hacking General [Developers Only]] RubberGooseGuy:
Idk if this is the right place but is this broken teeView attachment 6116612
[Android Software/Hacking General [Developers Only]] chiteroman:
Three dots -> untick Attest device ids
[Android Software/Hacking General [Developers Only]] RubberGooseGuy:
Then it works fine but is there anyway to fix ids

EDIT: My device got really ruined I managed to restore it but now it show thisView attachment 6116776
[Android Software/Hacking General [Developers Only]] jakell888888888:
This post has not been updated for a while.

Is there a better way or does anyone have the keybox code?

Currently meets_strong_integrity

This verification really gave me a headache. I even contacted some mobile phone manufacturers and found some executives. They said that they could not provide key boxes because they were very strict about this management and had no good way. I just wanted to ask if anyone else cares about this issue, or anyone who needs this verification like me.

chiteroman​
[Android Software/Hacking General [Developers Only]] pndwal:
This may tell you why:

https://xdaforums.com/t/module-play-integrity-fix-safetynet-fix.4607985/post-89579911

🙃 PW
[Android Software/Hacking General [Developers Only]] Stockarm:
I guys that's rip broken tee also
[Android Software/Hacking General [Developers Only]] Vision:
Not exactly.

You need PIF fork script-only-mode and add to MagiskHide/DenyList or whateven you have the gms.unstable.

Or try Shamiko.

and read this page: https://xdaforums.com/t/module-framework-patcher-go.4674536/page-10
[Android Software/Hacking General [Developers Only]] Stockarm:
Yes it worked now I bypass basic
[Android Software/Hacking General [Developers Only]] Vision:
What Android you have?

And which one you tried ?
[Android Software/Hacking General [Developers Only]] Stockarm:
iam on A14

if you mean pif i tried script only mode by osm0sis
[Android Software/Hacking General [Developers Only]] Vision:
Yeah.

So with default classes.dex get basic or ?
[Android Software/Hacking General [Developers Only]] Stockarm:
yes
[Android Software/Hacking General [Developers Only]] Stockarm:
that's why iam suspecting my tee is broken
[Android Software/Hacking General [Developers Only]] Vision:
Understand.

Simple, disable this module, and go to key attestation, what show?
[Android Software/Hacking General [Developers Only]] Stockarm:
View attachment 6119192
[Android Software/Hacking General [Developers Only]] Vision:
Oh yeah, unfortunately (I think) you have broken TEE
[Android Software/Hacking General [Developers Only]] Stockarm:
yes that's bad to hear although i already knew it
[Android Software/Hacking General [Developers Only]] Stockarm:
also i tried keybox trick even knowing it would break tee
[Android Software/Hacking General [Developers Only]] Vision:
What trick you mean? 🤔
[Android Software/Hacking General [Developers Only]] Stockarm:
i mean framework.jar with keybox.xml
[Android Software/Hacking General [Developers Only]] Vision:
You mean had add your own keybox.xml ?
[Android Software/Hacking General [Developers Only]] Vision:
It doesn't break like that the TEE.

If you add your own keybox.xml with the frameworkpatch, the change can reverse, more easy if do it via module.
[Android Software/Hacking General [Developers Only]] Stockarm:
i did changes but not with modules replaces framework.jar but had backup of it
[Android Software/Hacking General [Developers Only]] Stockarm:
but after pushing back the backup files i still get certificate chains are broken
[Android Software/Hacking General [Developers Only]] Vision:
Via System write.

You can easy, download the Rom for your device and extract the framework.jar to see if fix.
[Android Software/Hacking General [Developers Only]] Stockarm:
yes i backup it from the rom zip
[Android Software/Hacking General [Developers Only]] Stockarm:
that's why i find it strange
[Android Software/Hacking General [Developers Only]] Vision:
Yeah is strange 🤔

And you keybox, you sure is valid?
[Android Software/Hacking General [Developers Only]] Vision:
You know what type is it ?
[Android Software/Hacking General [Developers Only]] Stockarm:
which type of what?
[Android Software/Hacking General [Developers Only]] Stockarm:
ah if you mean the phone it's samsung and exynos
[Android Software/Hacking General [Developers Only]] Vision:
And that, but and if you know what type is the keybox?
[Android Software/Hacking General [Developers Only]] Stockarm:
Idk I will change the ROM and maybe goto stock
[Android Software/Hacking General [Developers Only]] Vision:
Difficult choice.

And with simple, you have a leaked valid keybox? You can PM me to tell me, if you don't want write it public.
[Android Software/Hacking General [Developers Only]] BlackWater$:
Is this tee can be fixed

Phone realme

Rooted kitsune mask

View attachment 6120740
[Android Software/Hacking General [Developers Only]] Stockarm:
i have lost the file i think
[Android Software/Hacking General [Developers Only]] Vision:
Oh 😕

Because must know what keybox it is to pass Strong.
[Android Software/Hacking General [Developers Only]] pr3dicament:
I think there are a lot of language barriers... unfortunate. Hard to figure out what people are trying to say.
[Android Software/Hacking General [Developers Only]] Aarif goku:
Does anyone have KmInstallKeybox file

The one I'm using from random GitHub/lab pages aren't working and I'm not sure what to to to fix this error

CANNOT LINK EXECUTABLE "./KmInstallKeybox": library "libkeymasterprovision.so" not found: needed by main executable

Unable to fix this issue

I need to get KmInstallKeybox file
[Android Software/Hacking General [Developers Only]] Vision:
You mean from this tutorial?

GitHub - chiteroman/Reprogram-TEE-on-Qualcomm-devices: Guide to reprogram the TEE on Qualcomm devices to fix lost attestation keys

Guide to reprogram the TEE on Qualcomm devices to fix lost attestation keys - chiteroman/Reprogram-TEE-on-Qualcomm-devices

github.com
[Android Software/Hacking General [Developers Only]] Aarif goku:
Yeah but didn't find KmInstallKeybox there so used external sources and they give that error. I cannot find libkeymasterprovision.so but I have other files named libkeymaster. I'm trying to download stock rom to see if I can find any.

Why I'm trying this because there have been few who fixed their moto device's TEE by following some Chinese guide which is exactly the same as chiteroman's except the KmInstallKeybox file was manually provided at the keybox.xml location.
[Android Software/Hacking General [Developers Only]] Vision:
Yeah understand.

I think the KmInstallKeybox is part of the command not a file.
[Android Software/Hacking General [Developers Only]] Aarif goku:
Something to watch on for broken TEE.

GitHub - aviraxp/Zygisk-KeystoreInjection: Generate a valid certificate chain from scratch by injecting custom Keystore provider

Generate a valid certificate chain from scratch by injecting custom Keystore provider - aviraxp/Zygisk-KeystoreInjection

github.com
[Android Software/Hacking General [Developers Only]] liujianhui707:
I got this,but I don't know how to decode the keybox.maybe you can try.

Google AttestationKey介绍_attestation key-CSDN博客

文章浏览阅读1w次，点赞3次，收藏38次。参考:1、googole文档:《Keymaster2—Attestation Key Provisioning》2、MTK文档:《AttestationKeyToolUserGuide_3.0.pdf》AttestationKey用途：Keymaster2 extends the capabilities of hardware-backed key storage on Android devices. Oneof the features is key attestation, allows _attestation key

blog.csdn.net
[Android Software/Hacking General [Developers Only]] privacyguy123:
As fas as I can see: useless.
[Android Software/Hacking General [Developers Only]] Vision:
Some news.

Maybe the successor of all.

GitHub - 5ec1cff/TrickyStore

Contribute to 5ec1cff/TrickyStore development by creating an account on GitHub.

github.com

And the thread about this module.

Tricky Store - The Next Generation PIF

IMPORTANT: I'm not the dev. of this module or have any affiliated with the dev. All the credits for the images and apps and modules, go to the original devs. A Big Thanks to @chiteroman and @osm0sis for his create project PIF and PIFork, and...

xdaforums.com
[Android Software/Hacking General [Developers Only]] Vision:
Unfortunately the private key can't extract from a device

View attachment 6084038

From your device extact this info TEE_A505F_XXV_ASC8 ?
[Android Software/Hacking General [Developers Only]] RockerAlex:
there isnt 1 person on this forum or the internet that will pass 3/3 with this guide because it is obviously missing important information. chiteroman knows this and its annoying AF - I dont even understand the point in this thread
[Android Software/Hacking General [Developers Only]] hex3l:
For the moment I have succesfully bypassed the key generation of my "not working" TEE via a zygisk module.

Currently testing only in Key Attestation app to analyze the results.

In order to improve the generation of the certificate extension I need some help since I do not have a working TEE / a working TEE with an available Keybox.

@chiteroman since you have flashed the TEE with an available keybox would you mind PM me?

I will just ask some information about the parameters present in the result of the Key Attestation app in order to improve the key generation, thank you!

Here the screenshot of the not working tee and one with the bypass using a revoked keybox.

Spoiler content hidden.

Spoiler content hidden.
[Android Software/Hacking General [Developers Only]] Vision:
This discussion is have interested.

Can we do it with Root access (Magisk) without PC need? · Issue #1 · chiteroman/Reprogram-TEE-on-Qualcomm-devices

Is it possible?

github.com
[Android Software/Hacking General [Developers Only]] simonpunk2013:
Hi Guys, I have some questions and hope someone can verify for me or share your idea with me.

1. Do we have to flash another keybox? I think doing so can filter a lot of uncertain scenes that generate keys from private key, without flashing the keybox there should be a lot of places to deal with, right?

2. Does keymaster version has to be 1.0 version (Tee, not Strongbox)? seems 1.0 doesn't include some system props in the certs like device name, model, manufacture, etc.., or What else does Strongbox possibly check other than TEE?

3. If so, then some props must be spoofed with the device that leaked the cert at least? and also a module to spoof the props in native just like PIF, right?

4. In the past, I noticed that on the keyattestation app, the cert we re-sign is always the same everytime, without re-sign I can see it is different every time on the root of trust key, so do we need to deal with this as well?

5. For people who successfully pass Strong with framework patch, are all of you using custom ROM only and flash leaked keybox? hopefully there is case that passing Strong with stock ROM only.
[Android Software/Hacking General [Developers Only]] maoliaoiwanna:
Same problem here. I'm using MIUI 13 with android 12, and if I patched framework.jar, my device with bootloop. However, if I patched miui-service.jar it won't bootloop. So I was wondering is this caused by some protection checks or something?
[Android Software/Hacking General [Developers Only]] Vision:
You follow the https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices first?

Maybe we write something wrong inside, 1 space more or but grammar, something like that and for that go to bootloop
[Android Software/Hacking General [Developers Only]] maoliaoiwanna:
Reprogramming TEE will replace the root key of your device, and after that patching the framework will give you a valid certificate chain. So not doing the reprogramming will not result in bootloop after patching the framework.jar, they are not related. Btw I tried only patching the miui-service.jar(I'm running MIUI 13 with android 12), and my device will not bootloop. So I think that might be a verification of framework.jar?
[Android Software/Hacking General [Developers Only]] Vision:
Oh understand, what the results in Key Attestation?

And maybe @chiteroman know about this you say
[Android Software/Hacking General [Developers Only]] maoliaoiwanna:
I haven't reprogrammed TEE yet and my TEE is working , so key attestation just shows "Bootloader unlocked". However I want to patch the framework to try the hooking method, as the bootloader spoofer did, and that lead to bootloop. I've collected the boot log and found that it seems that if I add a dex file, system will crash after it finds that the dex in the framework.jar mismatch framework.oat. But I tried not adding a dex to the jar and it still won't work. System crashed with ClassNotFound Exception but the target class do exist... I really wonder why...
[Android Software/Hacking General [Developers Only]] Vision:
Understand, me too try the same method, without success, because as i learn until now, must first follow the guide for reprogrammed TEE, as many users say
[Android Software/Hacking General [Developers Only]] LucasBS1:
Any way the general population can volunteer to help on this ?

- Do I need to dump things from our locked ROMs (somehow) ?

- When one says "reprogram TEE", does it mean reflashing the microcontroller with special hardware ?

We need this.

Cloning fingerprints is a lost game already. And soon, without Strong, the end of rooting itself...
[Android Software/Hacking General [Developers Only]] Vision:
1) https://github.com/chiteroman/Reprogram-TEE-on-Qualcomm-devices/issues/7

2)

View attachment 6096751
[Android Software/Hacking General [Developers Only]] HippoMan:
Question: I already have BootloaderSpoofer version 3.8 properly installed on my device (although it currently isn't set up in conjunction with any apps and therefore isn't doing anything).

If I uninstall version 3.8 and then install version 4.0, and if I then run into any problems, what are the chances that I will simply be able to uninstall 4.0 and re-install 3.8, without hosing or bricking my device? I don't want to experiment with 4.0 unless it's *very* likely that I can *quickly* and *painlessly* perform a clean 4.0 uninstall if there are any problems.

My device is a Nothing 2 running stock A13 with Magisk Alpha 27002 and with LSPosed 1.9.2.

PS: To be clear, BootloaderSpoofer 3.8 is actually set up on my device in conjunction with "Key Attestation" and nothing else. I don't consider "Key Attestation" to be an "app" (but rather, a "service"), and that's why I said above that BootloaderSpoofer isn't running in conjunction with any apps.
[Android Software/Hacking General [Developers Only]] hex3l:
Unfortunately I now have no more time to work on what I was doing.

In hope that someone could find it useful, I published everything on github.

GitHub - hex3l/PlayIntegrityForkKsBypass: PIF fork that provides attestation by bypassing the Android KeyStore while using a valid keybox. Not complete and explicitly set to work only in the context of Key Attestation app

PIF fork that provides attestation by bypassing the Android KeyStore while using a valid keybox. Not complete and explicitly set to work only in the context of Key Attestation app - hex3l/PlayInteg...

github.com
[Android Software/Hacking General [Developers Only]] Vision:
I appreciate your work to the community.

I wish now the other big brains like @chiteroman @osm0sis @pndwal @zgfg can analyze your work and merge their ideas with yours and finally trick TEE
[Android Software/Hacking General [Developers Only]] chiteroman:
GitHub - chiteroman/FrameworkPatch: Modify framework.jar to build on system level a valid certificate chain

Modify framework.jar to build on system level a valid certificate chain - chiteroman/FrameworkPatch

github.com

FrameworkPatch updated!

Now you can pass Strong without reprogramming the TEE.

You only need a valid keybox and a bit of Java/Smali knowledge 😝
[Android Software/Hacking General [Developers Only]] osm0sis:
Hardly a big brain over here, just a logical brain with a good memory. 😛

Presumably this message isn't about me, since I don't really know anything about the keystore/TEE side of things.. 😐
[Android Software/Hacking General [Developers Only]] Vision:
I get your point, but you're experts to other, and with all ideas on the table, maybe all ideas merge together can get the finals results.

Like your PIF fork, many users take and put their ideas to make another great project like @hex3l .

I appreciate it for your work and effort to all community.
[Android Software/Hacking General [Developers Only]] Vision:
Finally, maybe now can found a little peace.

Thank you.

We appreciate it for your work and effort to all community.