From 191085087b3655d8d7e1699880ced92261e582cb Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Thu, 26 Mar 2026 01:30:07 +0100 Subject: [PATCH] fix(interception): route oversized transactions to software gen The 256KB native size guard skipped interception entirely for oversized transactions, causing them to reach the real TEE which returns different attestation values. This inconsistency is exactly what G10 detects. Oversized requests now flow through to the Kotlin layer where they hit doSoftwareKeyGen via the forceGenerate flag. Software gen produces consistent attestation without forwarding to the real TEE, preserving the anti-amplification defense that the original guard intended. --- app/src/main/cpp/binder_interceptor.cpp | 6 ------ .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 8 +++----- 2 files changed, 3 insertions(+), 11 deletions(-) diff --git a/app/src/main/cpp/binder_interceptor.cpp b/app/src/main/cpp/binder_interceptor.cpp index ff0d66c..68c4cf5 100644 --- a/app/src/main/cpp/binder_interceptor.cpp +++ b/app/src/main/cpp/binder_interceptor.cpp @@ -350,16 +350,10 @@ static sp g_stub_instance = nullptr; namespace { -constexpr binder_size_t kMaxInterceptableDataSize = 256 * 1024; - void inspectAndRewriteTransaction(binder_transaction_data *txn_data) { if (!txn_data || txn_data->target.ptr == 0) return; - // Bypass interception for oversized payloads to prevent thread starvation from flood attacks - if (txn_data->data_size > kMaxInterceptableDataSize) - return; - // AIDL methods use codes in [FIRST_CALL_TRANSACTION, LAST_CALL_TRANSACTION] (1..0x00ffffff). // System transactions (PING, INTERFACE, DUMP, SHELL_COMMAND) use codes above that range. // Skip those — intercepting a ping adds measurable latency that timing detectors flag. diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index 9b83758..086d0e6 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -403,10 +403,7 @@ class KeyMintSecurityLevelInterceptor( } private fun handleGenerateKey(txId: Long, callingUid: Int, callingPid: Int, data: Parcel): TransactionResult { - if (data.dataSize() > MAX_ALIAS_LENGTH) { - SystemLogger.warning("Skipping oversized transaction: ${data.dataSize()} bytes") - return TransactionResult.ContinueAndSkipPost - } + val oversized = data.dataSize() > MAX_ALIAS_LENGTH return runCatching { data.enforceInterface(IKeystoreSecurityLevel.DESCRIPTOR) @@ -476,7 +473,8 @@ class KeyMintSecurityLevelInterceptor( val isAttestKeyRequest = parsedParams.isAttestKey() val forceGenerate = - ConfigurationManager.shouldGenerate(callingUid) || + oversized || + ConfigurationManager.shouldGenerate(callingUid) || (ConfigurationManager.shouldPatch(callingUid) && isAttestKeyRequest) || (attestationKey != null && isAttestationKey(KeyIdentifier(callingUid, attestationKey.alias)))