From 0617297b227b11dcb5733a2d738e11c4970430a3 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Tue, 19 May 2026 06:06:58 +0100 Subject: [PATCH] feat(spoof): include vbmeta.device_state Live install on the user's Pixel surfaced a fourth bootloader-lock prop the source plan never enumerated. The Chunqiu-style detector card listed three indicators on its bootloader-unlock row and flagged red because ro.boot.vbmeta.device_state remained unlocked even after ro.boot.verifiedbootstate, ro.boot.flash.locked, and ro.boot.veritymode were all spoofed. Add ro.boot.vbmeta.device_state=locked to BootStateManager.targets. Verified post-reboot on device: all four props now report the spoofed values. --- .../main/java/org/matrix/TEESimulator/config/BootStateManager.kt | 1 + 1 file changed, 1 insertion(+) diff --git a/app/src/main/java/org/matrix/TEESimulator/config/BootStateManager.kt b/app/src/main/java/org/matrix/TEESimulator/config/BootStateManager.kt index 2681b7f..1efb69b 100644 --- a/app/src/main/java/org/matrix/TEESimulator/config/BootStateManager.kt +++ b/app/src/main/java/org/matrix/TEESimulator/config/BootStateManager.kt @@ -10,6 +10,7 @@ object BootStateManager { "ro.boot.verifiedbootstate" to "green", "ro.boot.flash.locked" to "1", "ro.boot.veritymode" to "enforcing", + "ro.boot.vbmeta.device_state" to "locked", ) fun apply() {