From 4ecbfc7259a944da6a3762a25be3f1d3c8a24ac1 Mon Sep 17 00:00:00 2001 From: Andrea-lyz Date: Fri, 15 May 2026 16:23:05 +0200 Subject: [PATCH] fix: use SecurityLevel.KEYSTORE in createSwAuth to match real hardware Duck Detector's 'TEE Simulator generate-mode fingerprint' probe scans the generateKey reply parcel for a 16-byte marker where the securityLevel byte is 0x00 (SOFTWARE). Real KeyMint HAL uses 0x64 (KEYSTORE=100) for keystore-enforced metadata (creation time, user ID, etc.). This single-line change aligns with real hardware behavior and defeats the probe. Tested on OnePlus 13 (Android 16, KSU 3.2.4): - Before: 'TEE Simulator generate-mode fingerprint: Matched' (score 50) - After: 'No TEE Simulator generate-mode fingerprint observed' (score 4) Reference: https://github.com/eltavine/Duck-Detector-Refactoring/commit/e368038 --- .../keystore/shim/KeyMintSecurityLevelInterceptor.kt | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt index 682b47c..40243be 100644 --- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt +++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt @@ -1123,7 +1123,12 @@ private fun KeyMintAttestation.toAuthorizations( } return Authorization().apply { this.keyParameter = param - this.securityLevel = SecurityLevel.SOFTWARE + // Real KeyMint HAL marks keystore-enforced metadata (creation + // time, user id, etc.) with SecurityLevel.KEYSTORE (0x64), not + // SOFTWARE (0x00). Using SOFTWARE here is detectable by probes + // that scan the generateKey reply parcel for the 0x00 byte at + // the securityLevel slot of the last authorization entry. + this.securityLevel = SecurityLevel.KEYSTORE } }