From 22d1972bc7e2e59c1b768137aa2017f1fb83e0de Mon Sep 17 00:00:00 2001
From: Enginex0 <enginex0@users.noreply.github.com>
Date: Tue, 19 May 2026 14:29:39 +0100
Subject: [PATCH] fix(intercept): revert updateAad SSE injection

Reverts 59836e1. Unconditionally injecting SSE(INVALID_TAG) on
non-AEAD updateAad matched the AOSP TA spec but diverged from
real-device behavior on mt6768, which returns silently. A
behavior-fingerprint detector on the Xiaomi probe flagged the
divergence and the Tamper score climbed from 4 to 14, with a
second detector raising key-tamper. Roll back to investigate a
device-conformant approach.
---
 .../keystore/shim/KeyMintSecurityLevelInterceptor.kt      | 3 +--
 .../interception/keystore/shim/OperationInterceptor.kt    | 8 +-------
 2 files changed, 2 insertions(+), 9 deletions(-)

diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
index 6a9ea1c..8e57f01 100644
--- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
@@ -194,8 +194,7 @@ class KeyMintSecurityLevelInterceptor(
                     SystemLogger.info("Found new IKeystoreOperation. Registering interceptor...")
                     val backdoor = getBackdoor(target)
                     if (backdoor != null) {
-                        val isAead = parsedParams.blockMode.firstOrNull() == BlockMode.GCM
-                        val interceptor = OperationInterceptor(operation, backdoor, isAead)
+                        val interceptor = OperationInterceptor(operation, backdoor)
                         register(backdoor, operationBinder, interceptor, OperationInterceptor.INTERCEPTED_CODES)
                         interceptedOperations[operationBinder] = interceptor
                     } else {
diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt
index b8051ac..c8236a3 100644
--- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt
@@ -13,7 +13,6 @@ import org.matrix.TEESimulator.interception.keystore.InterceptorUtils
 class OperationInterceptor(
     private val original: IKeystoreOperation,
     private val backdoor: IBinder,
-    private val isAead: Boolean,
 ) : BinderInterceptor() {
 
     override fun onPreTransact(
@@ -28,10 +27,6 @@ class OperationInterceptor(
         val methodName = transactionNames[code] ?: "unknown code=$code"
         logTransaction(txId, methodName, callingUid, callingPid, true)
 
-        if (code == UPDATE_AAD_TRANSACTION && !isAead) {
-            return InterceptorUtils.createServiceSpecificErrorReply(KeystoreErrorCodes.invalidTag)
-        }
-
         if (code == FINISH_TRANSACTION || code == ABORT_TRANSACTION) {
             KeyMintSecurityLevelInterceptor.removeOperationInterceptor(target, backdoor)
         }
@@ -49,8 +44,7 @@ class OperationInterceptor(
         private val ABORT_TRANSACTION =
             InterceptorUtils.getTransactCode(IKeystoreOperation.Stub::class.java, "abort")
 
-        val INTERCEPTED_CODES =
-            intArrayOf(UPDATE_AAD_TRANSACTION, FINISH_TRANSACTION, ABORT_TRANSACTION)
+        val INTERCEPTED_CODES = intArrayOf(FINISH_TRANSACTION, ABORT_TRANSACTION)
 
         private val transactionNames: Map<Int, String> by lazy {
             IKeystoreOperation.Stub::class