This commit adds support for using different `keybox.xml` files for different applications. This allows for greater flexibility, enabling the use of distinct cryptographic identities for specific groups of apps.
The `target.txt` configuration now supports a new syntax. A line with a filename in brackets, like `[demo_keybox.xml]`, sets the active keybox for all subsequent packages in the file.
The implementation refactors the configuration and keybox loading logic:
- PkgConfig now parses the new syntax and maps packages to their designated keybox files.
- KeyBoxUtils is updated to dynamically load and cache multiple keybox files on demand, instead of relying on a single global state.
- Certificate generation and hacking functions now use this new configuration to select the correct keybox for each operation based on the application's UID.
- Make use of waitForService() for >= Android 11.
- Reserve manual polling for Android 10 due to lack of waitForService().
- Rework on logs to be less cluttering.
Signed-off-by: Dakkshesh <beakthoven@gmail.com>
fixes: https://github.com/beakthoven/TrickyStoreOSS/commit/23774e64a94c5cab08daa3ba2cec7a98db850cbd
logs:
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: fatal: failed to get packages
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: java.lang.NullPointerException: Attempt to invoke interface method 'void android.os.IBinder.linkToDeath(android.os.IBinder$DeathRecipient, int)' on a null object reference
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at qe.a(Unknown Source:13)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at qe.c(Unknown Source:1)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at io.github.beakthoven.TrickyStoreOSS.interceptors.SecurityLevelInterceptor.onPreTransact(Unknown Source:107)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at io.github.beakthoven.TrickyStoreOSS.interceptors.BinderInterceptor.handlePreTransact(Unknown Source:50)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at io.github.beakthoven.TrickyStoreOSS.interceptors.BinderInterceptor.onTransact(Unknown Source:21)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.os.Binder.execTransactInternal(Binder.java:1392)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.os.Binder.execTransact(Binder.java:1299)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.os.BinderProxy.transactNative(Native Method)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.os.BinderProxy.transact(BinderProxy.java:685)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.system.keystore2.IKeystoreSecurityLevel$Stub$Proxy.generateKey(IKeystoreSecurityLevel.java:307)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.security.KeyStoreSecurityLevel.lambda$generateKey$0(KeyStoreSecurityLevel.java:145)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.security.KeyStoreSecurityLevel.$r8$lambda$XUH2FEW76sslYQDkYWi9Fg4yVEI(Unknown Source:0)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.security.KeyStoreSecurityLevel$$ExternalSyntheticLambda1.execute(Unknown Source:12)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.security.KeyStoreSecurityLevel.handleExceptions(KeyStoreSecurityLevel.java:55)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.security.KeyStoreSecurityLevel.generateKey(KeyStoreSecurityLevel.java:145)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at android.security.keystore2.AndroidKeyStoreKeyPairGeneratorSpi.generateKeyPair(AndroidKeyStoreKeyPairGeneratorSpi.java:651)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at java.security.KeyPairGenerator$Delegate.generateKeyPair(KeyPairGenerator.java:750)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at W.a(Unknown Source:497)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at vi.a(Unknown Source:20)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at io.github.beakthoven.TrickyStoreOSS.MainKt.a(Unknown Source:175)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at io.github.beakthoven.TrickyStoreOSS.MainKt.main(Unknown Source:15)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at com.android.internal.os.RuntimeInit.nativeFinishInit(Native Method)
08-30 15:46:05.226 1811 1811 E TrickyStoreOSS: at com.android.internal.os.RuntimeInit.main(RuntimeInit.java:379)
Signed-off-by: Dakkshesh <beakthoven@gmail.com>
The previous implementation used `pingBinder()` to check the liveness of the PackageManager service on every call to `getPm()`. This polling approach introduces an unnecessary IPC round-trip overhead for every access.
This commit refactors the logic to use the canonical, event-driven pattern for handling remote service death by implementing `linkToDeath`.
A `DeathRecipient` is now registered with the binder upon the first connection. If the service process (`system_server`) dies for any reason, the `binderDied()` callback is automatically invoked by the system. This callback proactively clears the cached service instance, ensuring that the next call to `getPm()` will transparently re-establish a valid connection.
- Reuse and extend the attestation we perform for detection of functional TEE.
- Extract properties like boot hash, os version, attest version, keymaster version from the generated certificate.
- Use previous methods as fallback for devices without functional TEE.
- Set ro.boot.vbmeta.digest during initialization with the boot hash value.
Signed-off-by: Dakkshesh <beakthoven@gmail.com>
- We dont need the whole dev.rikka.hidden.stub library so just remove it and simplify dependencies.
- We already have our own stub package so we can just include the missing stubs that we want directly in it.
Signed-off-by: Dakkshesh <beakthoven@gmail.com>
- To avoid "Unknown tag 724" error on older platfoms like Android 10/11
- Conditionally downgrade keymaster versions to 3.0 on these platforms
Signed-off-by: Dakkshesh <beakthoven@gmail.com>
- Fixes the following on older android 10/11 platforms:
08-11 14:53:05.143 1388 1388 I TrickyStoreOSS: TrickyStore injector starting...
08-11 14:53:05.144 1388 1388 I TrickyStoreOSS: Starting injection of /data/adb/modules/tricky_store/libTrickyStoreOSS.so (entry: entry) into process 1024
08-11 14:53:05.151 587 587 I Zygote : Preloading shared libraries...
08-11 14:53:05.155 1026 1053 I ServiceManager: Waiting for service 'package_native' on '/dev/binder'...
08-11 14:53:05.155 1388 1388 W TrickyStoreOSS: Primary dlopen failed for library: /data/adb/modules/tricky_store/libTrickyStoreOSS.so, dlerror: dlopen failed: cannot locate symbol "_ZN7android7RefBase12weakref_type18incWeakRequireWeakEPKv" referenced by "/data/adb/modules/tricky_store/libTrickyStoreOSS.so"..., trying fallback
08-11 14:53:05.155 1388 1388 I TrickyStoreOSS: Using fallback dlopen method for compatibility
08-11 14:53:05.158 1388 1388 E TrickyStoreOSS: Fallback dlopen failed for library: /data/adb/modules/tricky_store/libTrickyStoreOSS.so, dlerror: dlopen failed: cannot locate symbol "_ZN7android7RefBase12weakref_type18incWeakRequireWeakEPKv" referenced by "/data/adb/modules/tricky_store/libTrickyStoreOSS.so"...
08-11 14:53:05.158 1388 1388 E TrickyStoreOSS: Failed to load library in remote process
08-11 14:53:05.158 1388 1388 E TrickyStoreOSS: Injection failed
- Also improve error handling in injection process
Signed-off-by: Dakkshesh <beakthoven@gmail.com>
- There are some issues with Android 10/11 that causes injection failures.
- Raise the compatiblity requirement until they are fixed.
Signed-off-by: Dakkshesh <dakkshesh5@gmail.com>
- Removed unused boilerplate from initial bring up
- Inlined some functions which were fragmented due to some initial plans that were dropped
- Moved appropriate functions to CertificateUtils
- Tidy up some function and variable names
Signed-off-by: Dakkshesh <beakthoven@gmail.com>
- Our codebase is written well to support this.
- LSPlt will continue to use c++20 via its cmake logic.
Signed-off-by: Dakkshesh <beakthoven@gmail.com>
JingMatrix