yashsingh1/xdaforums huggingface dataset:
[Android Software/Hacking General [Developers Only]] Vision:
Now with the new frameworkpatch.

Anyone do it with success post results.

Screenshot etc. without sensitive info of course, only the lines add in AndroidKeyStoreSpi.smali and Instrumentation.smali property, because is different the space between the line on different devices.

EDIT: I try it but stuck at MIUI logo, I think something I write wrong in the lines I add from the guide.

Android 11 MIUI 12.5
[Android Software/Hacking General [Developers Only]] chiteroman:
Check logcat:

adb logcat -s "chiteroman"
[Android Software/Hacking General [Developers Only]] Vision:
Thank you for answering.

Unfortunately can't use the adb for little while.

Because I have the surya and you have vayu

How is look your AndroidKeyStoreSpi.smali and Instrumentation.smali after correctly add the lines inside from your guide? I think I have wrong something about syntax.

If you can send me a screenshot of this 2 ? How you add the lines?
[Android Software/Hacking General [Developers Only]] Vision:
Search for "newApplication" methods and before the return operation

Which one? or both ?

.method public static whitelist test-api newApplication(Ljava/lang/Class;Landroid/content/Context; )Landroid/app/Application;

.method public whitelist test-api newApplication(Ljava/lang/ClassLoader;Ljava/lang/String;Landroid/content/Context; )Landroid/app/Application;
[Android Software/Hacking General [Developers Only]] Clourynth:
help, when i compile classes with api level 30, this error appear

but when using api level 28, the compiler start working (in the second screenshot)

my device using android 11 (api level 30)

what should i do?
[Android Software/Hacking General [Developers Only]] QuadCore_xRV:
I can't seem to get Smali to build on any of my computers. Tried Debian, tried windows. No luck. Am I missing something? Can't progress through the rest of the instructions unless I can build it right?
[Android Software/Hacking General [Developers Only]] Vision:
If you mean when Open the frameworkpatch in android studio and try it to complile.

I think something about grammar, syntax is wrong,
[Android Software/Hacking General [Developers Only]] AnotherM1m:
Can this be used to restore the attestation keys of a device if lost after a bad brick?

The device has its firehose leaked if it can help
[Android Software/Hacking General [Developers Only]] Vision:
Read this

GitHub - chiteroman/Reprogram-TEE-on-Qualcomm-devices: Guide to reprogram the TEE on Qualcomm devices to fix lost attestation keys

Guide to reprogram the TEE on Qualcomm devices to fix lost attestation keys - chiteroman/Reprogram-TEE-on-Qualcomm-devices

github.com
[Android Software/Hacking General [Developers Only]] AnotherM1m:
Thank you! are engineering rom general images or are device/vendor specific for qualcomm devices?
[Android Software/Hacking General [Developers Only]] eac5:
Same here, specifying the corresponding API level when decompiling with baksmali doesn't help either. It won't assemble even if no modifications at all were made to the files
[Android Software/Hacking General [Developers Only]] chiteroman:
Try with these jars
[Android Software/Hacking General [Developers Only]] Vision:
Is specific for each device, if you Google, eng Rom for device, and found and download it
[Android Software/Hacking General [Developers Only]] eac5:
Thanks, same result unfortunately, after that error a crippled classes.dex is produced about half the size of the original. All the other steps work np, a bit frustrating getting stuck on this one haha
[Android Software/Hacking General [Developers Only]] Vision:
Yeah, the same @chiteroman what happens if we ignore this step ?
[Android Software/Hacking General [Developers Only]] eac5:
You'll get a totally broken framework.jar which'll just bootloop the system or freeze it at best, so use a non-persistent rw mod like overlayfs and backup the original framework to be safe.

Edit: I opened an issue about this on smali GitHub, let's see if anything can come up
[Android Software/Hacking General [Developers Only]] Vision:
For that maybe I get bootloop, I do it systemless with a Magisk module, but the framework.jar itself without chance anything and just test complie without the API work, as understand this with API need it after we modify the framework.jar and add and the extra classes.dex
[Android Software/Hacking General [Developers Only]] eac5:
After some digging around I changed

smali/dexlib2/src/main/java/com/android/tools/smali/dexlib2/writer/DebugInfoCache.java at 137d16c188a3b7d0ca0ff5beb004b5a5725faa93 · google/smali

Contribute to google/smali development by creating an account on GitHub.

github.com

this function to always return 0 and recompiled, attaching the new fatJars. Now it assembles fine, no errors. Appears to be some stupid debugging thing that doesn't want to hash correctly? Dunno. Patched framework still doesn't let me pass strong nor even device, but at least it now doesn't bootloop or crash. My keybox is good, either something needs changing in the project code for my device, or it's simply not possible on it due to RKP or some other bs.
[Android Software/Hacking General [Developers Only]] Vision:
Thank you.

Now can compile with API 30
[Android Software/Hacking General [Developers Only]] Vision:
How is look your AndroidKeyStoreSpi.smali and Instrumentation.smali after correctly add the lines inside from your guide? I think I have wrong something about syntax.

If you can send me a screenshot of this 2 ? How you add the lines?

Search for "newApplication" methods and before the return operation

Which one? or both ?

.method public static whitelist test-api newApplication(Ljava/lang/Class;Landroid/content/Context; )Landroid/app/Application;

.method public whitelist test-api newApplication(Ljava/lang/ClassLoader;Ljava/lang/String;Landroid/content/Context; )Landroid/app/Application;
[Android Software/Hacking General [Developers Only]] eac5:
View attachment 6098279

View attachment 6098280

That's how it is. I do both newApplication
[Android Software/Hacking General [Developers Only]] Vision:
Thank you. I appreciate

I had 1 error and i have correct it, but still stuck at MIUI, i don't know why, maybe i do something wrong in the last part

View attachment 6098298

EDIT: After the compile as release, the dex it looks like this inside

View attachment 6098342
[Android Software/Hacking General [Developers Only]] eac5:
Is there any use to decompile the final dex? I just build it as a signed release in studio and pull the classes from the APK output
[Android Software/Hacking General [Developers Only]] QuadCore_xRV:
I'm back again. I've recompiled classes3.dex and classes.dex with the modifications, I've never used android studio before, can someone send me something with some info on how to "change EC and RSA keys" and compile as release?
[Android Software/Hacking General [Developers Only]] eac5:
You set the keys and certs in this file inside your project

FrameworkPatch/app/src/main/java/com/android/internal/util/framework/Keybox.java at main · chiteroman/FrameworkPatch

Modify framework.jar to build on system level a valid certificate chain - chiteroman/FrameworkPatch

github.com

Then on bottom left in build variables select release

And follow this

How to build and find a release APK or Bundle in Android Studio

A step by step guide on creating and locating a release APK or Bundle in Android Studio for testing purposes or for the Google Play Store.

www.delasign.com

to build. Then extract the classes.dex from your APK and continue. You'll wanna switch studio to the old UI as the new ones sucks, I couldn't find anything there.
[Android Software/Hacking General [Developers Only]] Vision:
No, just checking, exactly this I have done, but maybe I missed something
[Android Software/Hacking General [Developers Only]] HUBERTH:
Are you on stock MIUI Global or is it Xiaomi.eu etc?

Share both of your newApplication methods
[Android Software/Hacking General [Developers Only]] Vision:
Stock MIUI 12.5 EEA, @eac5 has been shared how write property the lines.

Read this: Post in thread 'TEE hacking' https://xdaforums.com/t/tee-hacking.4662185/post-89486477
[Android Software/Hacking General [Developers Only]] HUBERTH:
I know he did (I wouldn't say he's right tho), I just wanted to see the structure as it differs in a stock Global and custom and can cause that bootloop
[Android Software/Hacking General [Developers Only]] Vision:
Now with add the lines, look like this

View attachment 6098557View attachment 6098558
[Android Software/Hacking General [Developers Only]] HUBERTH:
thanks, so thats indeed a stock rom

try p1 and p3 instead of v0 and v0
[Android Software/Hacking General [Developers Only]] Vision:
Go to try, and my AndroidKeyStoreSpi after add the lines, look like this

View attachment 6098561
[Android Software/Hacking General [Developers Only]] Vision:
@idHUBERTH Just now i realized and test it, i decompile and compile without change anything the framework.jar and go to bootloop, so something is wrong with it
[Android Software/Hacking General [Developers Only]] HUBERTH:
did you try to open that zip? maybe when packing into zip you're doing the structure like this:

framework.zip -> framework folder -> files

instead of

framework.zip -> files
[Android Software/Hacking General [Developers Only]] Vision:
This part is right, i figure out with this https://github.com/REAndroid/APKEditor decompile and compile work without API 30 with modify AndroidKeyStoreSpi and newApplication.

So something i make wrong with smali.jar and backsmali.

EDIT: Now go to bootloop only when add and the final dex, in my case classes5.dex, with add keybox and without, test both to be sure.

Maybe I have some settings on Android Studio and cause this when create the apk and after extract the classes.dex
[Android Software/Hacking General [Developers Only]] eac5:
Couple things I fount.

smali has fixed the issue I opened, basically same thing I did, but they also made hashing work.

Fix hashcode calculation of debug info (#48) · google/smali@01a6240

`Arrays.asList(data)` returns a one element list with the array as the one element. Fixes #47

github.com

Now the jars can be remade to proper ones.

As pointed out above, for Instrumentation the correct registers are actually p3 and p1, or whatever you have. I highlighted the way to find the needed ones in there and KeyStoreSpi. It's in the comments, i.e.

.param p3, "context" # Landroid/content/Context; ---> in invoke-static we put p3 because it uses Landroid/content/Context;, and p3 is the context register in that method. The GitHub instructions are kinda unclear on this, but now it makes sense.

It's still not working for me, framework structure is correct (no top level folder), but I get a "Failed to parse debian.mime.types" exception in my file manager after replacing framework, which suggests it's being packed incorrectly. Doesn't matter whether I add the keybox dex.

Compering the res folder of the original and mod, there's some differences in the fields. Despite size and CRC being equal, the method, characteristics, version, and offset all differ. Which apparently screws with the system parser.

Perhaps another packing method is required to achieve a proper result.

I also added a small thing to Android.java of FrameworkPatch,

private static String fixPEM(String pemString) {

String fixed = pemString.trim();

fixed = fixed.replaceAll("\\r\\n|\\r|\\n", "\n");

fixed = fixed.replaceAll("(?m)^\\s+", "");

return fixed;
}

This should hopefully get rid of any potential parse errors when the thing actually works, it helped in my BootloaderSpoofer fork, add fixPEM() to key/cert in parseKeyPair and parseCert

View attachment 6098594

View attachment 6098593

View attachment 6098596
[Android Software/Hacking General [Developers Only]] Vision:
Thank you.

Excellent work and guide.

Read: Post in thread 'TEE hacking' https://xdaforums.com/t/tee-hacking.4662185/post-89487559

Only when add the final dex
[Android Software/Hacking General [Developers Only]] eac5:
I saw, I'm not bootlooping at all since fixing the smali thing, but it's still incorrect. I also don't know how this thing is supposed to work, maybe signing the apk somehow interferes with your keybox dex s.t. it's incompatible with the others? Dunno. The original framework packing is weird as hell, the classes are all 'store', but folder content is all 'deflate'. Will look into how to achieve something similar, maybe AOSP build system or something
[Android Software/Hacking General [Developers Only]] Vision:
Oh understand, yeah complicated things, how @chiteroman make this last step with the final dex without bootloop?
[Android Software/Hacking General [Developers Only]] westruk:
Anyone know how it possible ? Widevine L1 with broken TEE (flash persist).
[Android Software/Hacking General [Developers Only]] eac5:
Don't quote me on this, but your system ID is all scrambled, it should numerical, like 1-5 digits. Having it like this means Netflix/DSNP and maybe more won't work properly.
[Android Software/Hacking General [Developers Only]] privacyguy123:
Key was banned the day it was uploaded here - don't think it's an amazing idea to share any of this stuff publicly big dawg lol.
[Android Software/Hacking General [Developers Only]] Vision:
Maybe something settings in Android Studio is wrong when create the app and after extract the dex.

Is other way to compile the final dex?

Anyone who actually add the final dex in framework.jar and device normal boot, can decompile the final dex and take screenshots to see how looks inside? Maybe mine is missing something for that go to bootloop

EDIT: and if all going good, boot is normal or take some time?
[Android Software/Hacking General [Developers Only]] HUBERTH:
Nice find bro, I pulled the latest commit and it actually fixes the compilation error on 2 of my phones
[Android Software/Hacking General [Developers Only]] Vision:
@chiteroman

Finally, I figured out, the cause my device go to bootloop after add final dex, my framework.jar greatest number is classes4.dex so according to the instructions must set the final dex classes5.dex, but if write classes6.dex, my device open normal.

I don't understand the instructions say this

View attachment 6099225
[Android Software/Hacking General [Developers Only]] BunnyPig1:
I read it as an example, if it is anything below classes6.dex you must copy it as classes6.dex.

So if it's < 6 classes4.dex/classes5.dex or anything you need to copy it as classes6.dex.
[Android Software/Hacking General [Developers Only]] Vision:
You have try it this frameworkpatch?

Oh, so now I have it right, and no bootloop, but still like @eac5 say, not working still can't pass
[Android Software/Hacking General [Developers Only]] BunnyPig1:
No, I haven't tried any of this, just following the thread out of curiousity.

I just wanted to clarify what the instructions said. Why it wasn't working for you was because it was copied as the wrong type. You said that when you copied it as classes6.dex your device started working, just as the instructions explained. It sounds like it's a requirement that it's copied as classes6.dex even if the greatest number is anything else than classes6.dex.

Sorry if I made it sound like I know anything about this, I just wanted to help explain what it said.
[Android Software/Hacking General [Developers Only]] Vision:
Understand, you help, and thank you for that.
[Android Software/Hacking General [Developers Only]] Vision:
@chiteroman

I see frameworkpatch updated, what does this updated mean?

mean pass 2/3 without PIF module (with users without Magisk)?, or something I missed.

I try this new but pass 0/3

View attachment 6099672
[Android Software/Hacking General [Developers Only]] Vision:
I'm curious, why anyone can't make it work this with frameworkpatch, what we doing so wrong? 🤔
[Android Software/Hacking General [Developers Only]] Max-P:
Are you sure you have a good keybox? Have you checked the revocation list to be sure?

I'd try but I wasn't able to find a keybox that's not revoked already, although admittedly my Google-fu isn't as good as it once was.

The might also be other stuff in the way like props or bootloader lock status.

Assuming the patch works of course. Has chiteroman confirmed it works for him without his reprogrammed TEE?
[Android Software/Hacking General [Developers Only]] Vision:
Yeah, I'll check again.

I'm not the only, and for him @eac5 not working.

For the last question, I'm not sure.
[Android Software/Hacking General [Developers Only]] chiteroman:
Yes
[Android Software/Hacking General [Developers Only]] Vision:
So, what we doing so wrong and can't get it to work? 😂🤣
[Android Software/Hacking General [Developers Only]] chiteroman:
Tried in older Android versions (A11) and it doesn't pass Strong, but KA gives a valid certificate chain. Weird 😭
[Android Software/Hacking General [Developers Only]] Vision:
I have surya A11, MIUI 12,5, don't say that 😂🤣

Don't take my hope 😂🤣

If you want test for A11, I'm here.

At least, if we can get 2/3 without need FP, this is also something out of nothing
[Android Software/Hacking General [Developers Only]] Vision:
@chiteroman

Maybe need merge the files inside of the final dex, with a existing classes.dex, and not add
[Android Software/Hacking General [Developers Only]] chiteroman:
When I tried on A11, I built the ROM from scratch, so that isn't the problem.
[Android Software/Hacking General [Developers Only]] Vision:
Thank for info.

With short words, this work good after A13+ and before this version have problems or only A11 on MIUI etc?

2.1 Hardware Trusted Environment

2.1 Hardware Trusted Environment

trust.mi.com
[Android Software/Hacking General [Developers Only]] boynb98:
Hello, I have edited the framework.jar, but when I replace the new file in the /system/framework/ folder, it seems to still receive the old information and not be changed. I searched the forums and found the reason why framework.odex did not regenerate itself. So is there any way to solve this problem?

Model Xiaomi Mi A1

Android Pie
[Android Software/Hacking General [Developers Only]] Vision:
Yeah, if you read the previous pages, users have did this and still the same not working, like yours, what you mean by that "I searched the forums and found the reason why framework.odex did not regenerate itself." ?
[Android Software/Hacking General [Developers Only]] bou1l3m:
you must have the right key box not banned and no one wants to help or indicate where we can find it
[Android Software/Hacking General [Developers Only]] boynb98:
Can you tell me how to handle that problem
[Android Software/Hacking General [Developers Only]] Vision:
Little incorrect, and with banned keybox, still this frameworkpatch must working, but can't pass and in key attestation app must say certificate is not trusting
[Android Software/Hacking General [Developers Only]] boynb98:
means I edited framework.jar but new data is not updated. I did some research and someone said I needed to delete the framework.odex file, but I couldn't find it
[Android Software/Hacking General [Developers Only]] Vision:
Maybe, because you not have framework.odex, and simple with a file manager (like total commander) you can run a search for framework.odex, and if exist, show you where
[Android Software/Hacking General [Developers Only]] boynb98:
Can someone help me modify framework.jar. I can pay for you to do it
[Android Software/Hacking General [Developers Only]] Vision:
Is all free, do you have read the previous pages here? has been answered how exactly modify framework.jar
[Android Software/Hacking General [Developers Only]] boynb98:
I have read and tried everything but it doesn't work, now I get this error. It's really difficult for a beginner like me. too many problems

- "Could not create image space with image file '/system/framework/boot.art'. Attempting to fall back to imageless running. Error was: Failed to open oat file '/system/framework/arm/boot-framework.oat' referenced from image /system/framework/arm/boot-framework.art: Failed to allocate ElfFile reservation for /system/framework/arm/boot- framework.oat: Insufficient reservation, required 10158080, available 1859584 "
[Android Software/Hacking General [Developers Only]] badabing2003:
I don't mean this in any negative way, this is not something beginners should venture into unless you have a device to spare and are willing to risk losing it and are also willing to do lots of researching / learning / experimenting.

And don't bother even trying this unless you have found a keybox that is not revoked.
[Android Software/Hacking General [Developers Only]] eac5:
Sounds like you might be on your way to messing up your phone in some nasty way. Perhaps it's better to stop now, this whole thing is an unnecessary gimmick anyway. Or if you're really determined, at least take a step back and get familiar with the fundamentals.

Speaking of, if anybody wants to continue playing around, message me, I'll send you a valid keybox free of charge. Naturally it's in your best interest to keep it private.
[Android Software/Hacking General [Developers Only]] Vision:
Like @badabing2003 and @eac5 say is difficult for beginners, and need patience and understanding the guide and all the steps.

I don't understand why you have this errors, only framework.jar not the odex or art
[Android Software/Hacking General [Developers Only]] kodein:
Hi, could you PM me?
[Android Software/Hacking General [Developers Only]] privacyguy123:
Giving out working keyboxes = banned so fast, IMO.
[Android Software/Hacking General [Developers Only]] kodein:
If you have already banned the distribution of functional keys, it would be enough to add at least where to look for them....
[Android Software/Hacking General [Developers Only]] Vision:
If no leak, and trusted, by the way, you manage to make it work ?
[Android Software/Hacking General [Developers Only]] Vision:
@chiteroman

I try it this, just for fun, on Nox A12, little different but the same as phone the framework.jar, open but blink it continues, I click very fast in Key attestation app and show me this, I try it and in A11 emulator and bootloop like really phone

View attachment 6102573
[Android Software/Hacking General [Developers Only]] bou1l3m:
what does that mean ?
[Android Software/Hacking General [Developers Only]] Vision:
I think this is very good, you're the first do it with success, congratulations 🎉
[Android Software/Hacking General [Developers Only]] Vision:
@chiteroman

I try it this, just for fun, on emulator Nox A12, little different but the same as phone the framework.jar (without edit Instrumentation.smali) open but have some glitch, I click very fast in Key attestation app and show me this, I try it and in BlueStacks A11 emulator and bootloop like really phone, the only difference I see is another location between A11 and A12 and after inside in the dexView attachment 6102907View attachment 6102908View attachment 6102909
[Android Software/Hacking General [Developers Only]] naga.imut:
Hello Sir..

My TEE is broken, i want reprogram my TEE but i cant found valid keybox. Can you help me share your keybox?

Thanks in advanced
[Android Software/Hacking General [Developers Only]] bou1l3m:
if we share the keyboxes they will be banned within a few hours
[Android Software/Hacking General [Developers Only]] naga.imut:
Its mean one keybox for one device?
[Android Software/Hacking General [Developers Only]] Vision:
@chiteroman

I hope this method, not only for new, like A12 and newer versions 🥲
[Android Software/Hacking General [Developers Only]] eac5:
Ask and you shall receive. The fact that nobody PMs and keep asking in the thread instead is quite telling of y'alls capacity to follow instructions, meaning not much success will come from using these methods.
[Android Software/Hacking General [Developers Only]] badabing2003:
I hope your joking.

If you want people to PM you, don't block conversations.
[Android Software/Hacking General [Developers Only]] Vision:
Now I get it, so you have success on A11 except pass Strong, but the other do the job, and device normal boot, without bootloop, so now need properly add a extra help in the guide for A11.