From 938d414ebf1735a4a028819d0dff3d3dafd5a865 Mon Sep 17 00:00:00 2001 From: Enginex0 Date: Tue, 10 Mar 2026 16:55:39 +0100 Subject: [PATCH] docs(release): bump to v4.2 with changelog and update metadata --- app/build.gradle.kts | 2 +- module/changelog.md | 22 ++++++++++++++++++++++ module/update.json | 6 +++--- 3 files changed, 26 insertions(+), 4 deletions(-) diff --git a/app/build.gradle.kts b/app/build.gradle.kts index 931bbc1..73b1284 100644 --- a/app/build.gradle.kts +++ b/app/build.gradle.kts @@ -29,7 +29,7 @@ val gitExecutor = objects.newInstance(GitExecutor::class.java) val gitCommitCount = gitExecutor.execute("git rev-list HEAD --count", rootDir).toInt() val gitCommitHash = gitExecutor.execute("git rev-parse --verify --short HEAD", rootDir) -val verName = "v4.1" +val verName = "v4.2" android { namespace = "org.matrix.TEESimulator" diff --git a/module/changelog.md b/module/changelog.md index ce75d2b..98c66bd 100644 --- a/module/changelog.md +++ b/module/changelog.md @@ -1,3 +1,25 @@ +## TEESimulator v4.2: Detection Evasion Hardening + +Fixes 6 detection vectors flagged by attestation validator apps. + +### Attestation Policy Enforcement + +Replicate AOSP keystore2's `add_required_parameters()` validation that our software keygen path was bypassing: + +- **CREATION_DATETIME** — Reject caller-provided input with `INVALID_ARGUMENT (20)`, matching `security_level.rs:424`. Our cert gen still adds its own timestamp, same as real keystore2. +- **Device ID attestation** — Reject ATTESTATION_ID_SERIAL, IMEI, MEID, SECOND_IMEI, and DEVICE_UNIQUE_ATTESTATION with `CANNOT_ATTEST_IDS (-66)`. No consumer app has READ_PRIVILEGED_PHONE_STATE. +- **Error reply format** — Fixed AIDL ServiceSpecificException parcel write order (was errorCode→message, now message→errorCode). + +### Certificate Fix + +Leaf certificate Subject CN corrected from "Android KeyStore Key" to "Android Keystore Key" (lowercase s), matching AOSP `KeyGenParameterSpec.java:282`. Both Kotlin and Rust paths. + +### Binder Timing + +Skip interception for system transaction codes (PING, INTERFACE, DUMP) above LAST_CALL_TRANSACTION. Eliminates the JNI round-trip that inflated binder ping ratio to 3.85x (detector threshold: 3.0x). + +--- + ## TEESimulator v4.1: Boot Identity Persistence Bugfix release. The vbmeta boot key digest was randomizing on every reboot, producing a different RootOfTrust in attestation certificates each boot. diff --git a/module/update.json b/module/update.json index 35e9088..7c145e0 100644 --- a/module/update.json +++ b/module/update.json @@ -1,6 +1,6 @@ { - "version": "v4.1", - "versionCode": 95, - "zipUrl": "https://github.com/Enginex0/TEESimulator/releases/download/v4.1/TEESimulator-v4.1-Release.zip", + "version": "v4.2", + "versionCode": 98, + "zipUrl": "https://github.com/Enginex0/TEESimulator/releases/download/v4.2/TEESimulator-v4.2-Release.zip", "changelog": "https://raw.githubusercontent.com/Enginex0/TEESimulator/main/module/changelog.md" }