Fix Android 11 Keystore execution: Init framework and spoof UID 1000 (#85)
This commit resolves `KeyStore` API failures on Android 11 when running as a standalone CLI executable (UID 0), addressing both environment initialization and permission denial issues. 1. Initialize Android Framework Environment: Android 11 Keystore APIs expect a fully initialized application context and a Main Looper, which are missing in a raw root process. This patch: - Manually bootstraps `ActivityThread` via `systemMain()`. - Initializes `Looper.prepareMainLooper()`. - Injects a dummy `Application` object attached to the system context to satisfy `KeyStore.getApplicationContext()` checks. - Updates framework stubs to allow compilation of these hidden APIs. 2. Bypass Keystore Permission Checks via UID Spoofing: `KeyStoreService::generateKey` enforces the `P_INSERT` permission. Analysis of `permissions.cpp` reveals that UID 0 (Root) is explicitly denied this permission (granted only `P_GET`), whereas UID 1000 (System) holds all permissions (`~0`). To bypass this restriction, the binder interceptor now detects transactions originating from UID 0 and rewrites the `sender_euid` to 1000. This fools `KeyStoreService` into granting the request. 3. Refactor Execution Loop: Replaces the previous `Thread.sleep()` maintenance loop with `Looper.loop()`.
This commit is contained in:
@@ -4,4 +4,12 @@ public class ActivityThread {
|
||||
public static void initializeMainlineModules() {
|
||||
throw new UnsupportedOperationException("STUB!");
|
||||
}
|
||||
|
||||
public static ActivityThread systemMain() {
|
||||
throw new UnsupportedOperationException("STUB!");
|
||||
}
|
||||
|
||||
public ContextImpl getSystemContext() {
|
||||
throw new UnsupportedOperationException("STUB!");
|
||||
}
|
||||
}
|
||||
|
||||
@@ -0,0 +1,4 @@
|
||||
package android.app;
|
||||
|
||||
public class ContextImpl {
|
||||
}
|
||||
Reference in New Issue
Block a user