ci(release): fetch full history for accurate commit count

Fork identity: rename across module metadata, CI pipeline, and build
scripts. Version scheme changed from v4.5-115-7e87766 to v4.6-117
format — commit count auto-increments, git hash dropped from filenames.

.github/workflows/build.yml

@@ -3,16 +3,10 @@ name: Build
 on:
   push:
     branches: [ "main" ]
-    paths-ignore:
+    paths-ignore: [ '**.md' ]
-      - '**.md'
-      - '.github/**'
-      - '!.github/workflows/**'
   pull_request:
     branches: [ "main" ]
-    paths-ignore:
+    paths-ignore: [ '**.md' ]
-      - '**.md'
-      - '.github/**'
-      - '!.github/workflows/**'
   workflow_dispatch:
 
 concurrency:
@@ -22,18 +16,9 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      attestations: write
-      contents: read
-    
-    outputs:
-      releaseName: ${{ steps.prepareArtifact.outputs.releaseName }}
-      debugName: ${{ steps.prepareArtifact.outputs.debugName }}
 
     steps:
-      - name: Check out
+      - uses: actions/checkout@v4
-        uses: actions/checkout@v4
         with:
           submodules: "recursive"
           fetch-depth: 0
@@ -45,6 +30,25 @@ jobs:
           java-version: 21
           cache: 'gradle'
 
+      - name: Setup Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: aarch64-linux-android,armv7-linux-androideabi,i686-linux-android,x86_64-linux-android
+
+      - name: Cache Rust artifacts
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+            ~/.cargo/bin/cargo-ndk
+            native-certgen/target
+          key: rust-${{ runner.os }}-${{ hashFiles('native-certgen/Cargo.lock') }}
+          restore-keys: rust-${{ runner.os }}-
+
+      - name: Install cargo-ndk
+        run: command -v cargo-ndk || cargo install cargo-ndk
+
       - name: Set up ccache
         uses: hendrikmuhs/ccache-action@v1.2
         with:
@@ -60,73 +64,88 @@ jobs:
       - name: Build with Gradle
         run: |
           chmod +x ./gradlew
-
           ./gradlew zipRelease zipDebug -Porg.gradle.parallel=true -Porg.gradle.vfs.watch=true -Dorg.gradle.jvmargs=-Xmx2048m
 
-      - name: Prepare artifact
+      - name: Read version
-        if: success()
+        id: ver
-        id: prepareArtifact
         run: |
-          set -e
+          ver=$(grep 'val verName' app/build.gradle.kts | sed 's/.*"\(.*\)".*/\1/')
-          RELEASE_FILE=$(find out -name "*Release*.zip" | head -1)
+          count=$(git rev-list HEAD --count)
-          DEBUG_FILE=$(find out -name "*Debug*.zip" | head -1)
+          echo "version=${ver}-${count}" >> "$GITHUB_OUTPUT"
 
-          if [[ -z "$RELEASE_FILE" || -z "$DEBUG_FILE" ]]; then
+      - name: List build artifacts
-            echo "Error: Could not find release or debug files in out/"
+        run: |
-            echo "Contents of out/ directory:"
+          echo "Release: $(ls out/*Release*.zip | head -1) ($(du -h out/*Release*.zip | head -1 | cut -f1))"
-            ls -la out/ || echo "out/ directory does not exist"
+          echo "Debug: $(ls out/*Debug*.zip | head -1) ($(du -h out/*Debug*.zip | head -1 | cut -f1))"
-            exit 1
-          fi
 
-          # Extract names
+      - uses: actions/upload-artifact@v4
-          RELEASE_NAME=$(basename "$RELEASE_FILE" .zip)
-          DEBUG_NAME=$(basename "$DEBUG_FILE" .zip)
-          
-          echo "releaseName=$RELEASE_NAME" >> $GITHUB_OUTPUT
-          echo "debugName=$DEBUG_NAME" >> $GITHUB_OUTPUT
-
-          mkdir -p module-release module-debug
-          unzip -q "$RELEASE_FILE" -d module-release
-          unzip -q "$DEBUG_FILE" -d module-debug
-          echo "  Release: $RELEASE_NAME"
-          echo "  Debug: $DEBUG_NAME"
-
-      - name: Upload release
-        if: success()
-        id: release
-        uses: actions/upload-artifact@v4
         with:
-          name: ${{ steps.prepareArtifact.outputs.releaseName }}
+          name: TEESimulator-RS-release-zip
-          path: "./module-release/*"
+          path: out/TEESimulator-RS-*-Release.zip
           retention-days: 30
-          compression-level: 6
+          compression-level: 0
 
-      - name: Upload debug
+      - uses: actions/upload-artifact@v4
-        if: success()
-        id: debug
-        uses: actions/upload-artifact@v4
         with:
-          name: ${{ steps.prepareArtifact.outputs.debugName }}
+          name: TEESimulator-RS-debug-zip
-          path: "./module-debug/*"
+          path: out/TEESimulator-RS-*-Debug.zip
           retention-days: 7
-          compression-level: 6
+          compression-level: 0
 
-      - name: Upload release mappings
+      - uses: actions/upload-artifact@v4
-        if: success()
-        uses: actions/upload-artifact@v4
         with:
-          name: release-mappings-${{ github.run_number }}
+          name: release-mappings
-          path: "./app/build/outputs/mapping/release"
+          path: app/build/outputs/mapping/release
           retention-days: 30
           compression-level: 9
 
-      - name: Summary
+  release:
-        if: always()
+    needs: build
+    if: (github.event_name == 'push' || github.event_name == 'workflow_dispatch') && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Read version
+        id: ver
         run: |
-          echo "## Build Summary" >> $GITHUB_STEP_SUMMARY
+          ver=$(grep 'val verName' app/build.gradle.kts | sed 's/.*"\(.*\)".*/\1/')
-          echo "- **Status**: ${{ job.status }}" >> $GITHUB_STEP_SUMMARY
+          count=$(git rev-list HEAD --count)
-          echo "- **Gradle Tasks**: assembleRelease, assembleDebug" >> $GITHUB_STEP_SUMMARY
+          echo "version=${ver}-${count}" >> "$GITHUB_OUTPUT"
-          if [[ "${{ job.status }}" == "success" ]]; then
+
-            echo "- **Release Artifact**: ${{ steps.prepareArtifact.outputs.releaseName }}" >> $GITHUB_STEP_SUMMARY
+      - uses: actions/download-artifact@v4
-            echo "- **Debug Artifact**: ${{ steps.prepareArtifact.outputs.debugName }}" >> $GITHUB_STEP_SUMMARY
+        with:
-          fi
+          name: TEESimulator-RS-release-zip
+          path: zips
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: TEESimulator-RS-debug-zip
+          path: zips
+
+      - name: Extract changelog
+        run: |
+          ver="${VER#v}"
+          awk "/^## TEESimulator-RS v${ver%%-*}/{flag=1; next} /^## TEESimulator-RS v/{if(flag) exit} flag" module/changelog.md > /tmp/notes.md
+          cat /tmp/notes.md
+        env:
+          VER: ${{ steps.ver.outputs.version }}
+
+      - name: Create release
+        run: |
+          gh release delete "$VER" --yes 2>/dev/null || true
+          RELEASE=$(ls zips/*Release*.zip | head -1)
+          DEBUG=$(ls zips/*Debug*.zip | head -1)
+          gh release create "$VER" \
+            --title "$VER" \
+            --latest \
+            --notes-file /tmp/notes.md \
+            "$RELEASE" \
+            "$DEBUG"
+        env:
+          VER: ${{ steps.ver.outputs.version }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -3,7 +3,8 @@
   <p align="center"><b>Full TEE Emulation for Rooted Android</b></p>
   <p align="center">Hardware attestation. Software keys. Zero detection.</p>
   <p align="center">
-    <img src="https://img.shields.io/badge/version-v4.0-blue?style=for-the-badge" alt="v4.0">
+    <a href="https://github.com/Enginex0/TEESimulator/actions/workflows/build.yml"><img src="https://github.com/Enginex0/TEESimulator/actions/workflows/build.yml/badge.svg" alt="Build"></a>
+    <img src="https://img.shields.io/badge/version-v4.2-blue?style=for-the-badge" alt="v4.2">
     <img src="https://img.shields.io/badge/Android-10%2B-green?style=for-the-badge&logo=android" alt="Android 10+">
     <img src="https://img.shields.io/badge/Telegram-community-blue?style=for-the-badge&logo=telegram" alt="Telegram">
   </p>
@@ -112,6 +113,24 @@ TEESimulator replaces TrickyStore, TrickyStoreOSS, and their forks. Existing con
 
 ---
 
+## 🔨 Building from Source
+
+The CI workflow builds on every push to `main`. You can also build locally or trigger a build from your own fork.
+
+**Prerequisites:** JDK 21, Android SDK/NDK 27, Rust stable with `aarch64-linux-android` target, `cargo-ndk`.
+
+```bash
+git clone https://github.com/Enginex0/TEESimulator.git
+cd TEESimulator
+./gradlew zipRelease zipDebug
+```
+
+Output ZIPs land in `out/`. The Gradle build automatically invokes `cargo ndk` to cross-compile `libcertgen.so` before packaging.
+
+To rebuild from a fork, push to `main` or use **Actions → Build → Run workflow**. The workflow installs all toolchains (Java, Rust, cargo-ndk, ccache) and uploads Release + Debug ZIPs as artifacts.
+
+---
+
 ## ⚙️ Configuration
 
 All configuration files live at `/data/adb/tricky_store/` and are monitored by `FileObserver` — changes take effect immediately without rebooting.

app/build.gradle.kts

@@ -29,7 +29,7 @@ val gitExecutor = objects.newInstance(GitExecutor::class.java)
 
 val gitCommitCount = gitExecutor.execute("git rev-list HEAD --count", rootDir).toInt()
 val gitCommitHash = gitExecutor.execute("git rev-parse --verify --short HEAD", rootDir)
-val verName = "v4.2"
+val verName = "v4.6"
 
 android {
     namespace = "org.matrix.TEESimulator"
@@ -73,7 +73,7 @@ dependencies {
 
 // --- Rust native cert gen build task ---
 val buildRustCertgen by tasks.registering(Exec::class) {
-    group = "TEESimulator Native Build"
+    group = "TEESimulator-RS Native Build"
     description = "Builds libcertgen.so via cargo-ndk for arm64-v8a."
 
     workingDir = rootProject.projectDir.resolve("native-certgen")
@@ -108,21 +108,21 @@ androidComponents {
         // --- Define output locations and file names ---
         // Stage all files in a temporary directory inside 'build' before zipping
         val tempModuleDir = project.layout.buildDirectory.dir("module/${variant.name}")
-        val zipFileName = "TEESimulator-$verName-$gitCommitCount-$gitCommitHash-$capitalized.zip"
+        val zipFileName = "TEESimulator-RS-$verName-$gitCommitCount-$capitalized.zip"
 
         // Task 1: Prepare all module files in the temporary build directory.
         // Using Sync ensures that stale files from previous runs are removed.
         val prepareModuleFilesTask =
             tasks.register<Sync>("prepareModuleFiles${capitalized}") {
-                group = "TEESimulator Module Packaging"
+                group = "TEESimulator-RS Module Packaging"
                 description = "Prepares all files for the ${variant.name} module zip."
 
                 if (isDebug) {
                     dependsOn("package${capitalized}")
                 } else {
                     dependsOn("minify${capitalized}WithR8")
+                    dependsOn("strip${capitalized}DebugSymbols")
                 }
-                dependsOn("strip${capitalized}DebugSymbols")
                 dependsOn(buildRustCertgen)
 
                 if (isDebug) {
@@ -140,12 +140,13 @@ androidComponents {
                     }
                 }
 
-                from(
+                val nativeLibsDir = if (isDebug) {
-                    project.layout.buildDirectory.dir(
+                    "intermediates/merged_native_libs/${variant.name}/merge${capitalized}NativeLibs/out/lib"
-                        "intermediates/stripped_native_libs/${variant.name}/strip${capitalized}DebugSymbols/out/lib"
+                } else {
-                    )
+                    "intermediates/stripped_native_libs/${variant.name}/strip${capitalized}DebugSymbols/out/lib"
-                ) {
+                }
-                    into("lib") // Place them in the 'lib' subfolder of the staging directory.
+                from(project.layout.buildDirectory.dir(nativeLibsDir)) {
+                    into("lib")
                     include("**/libinject.so", "**/libTEESimulator.so", "**/libsupervisor.so", "**/libcertgen.so")
                 }
 
@@ -161,8 +162,7 @@ androidComponents {
                     // Use expand() for simple key-value replacement.
                     expand(
                         "REPLACEMEVERCODE" to gitCommitCount.toString(),
-                        "REPLACEMEVER" to
+                        "REPLACEMEVER" to "$verName-$gitCommitCount",
-                            "$verName ($gitCommitCount-$gitCommitHash-${variant.name})",
                     )
                 }
 
@@ -173,7 +173,7 @@ androidComponents {
         // Task 2: Zip the prepared files from the temporary directory.
         val zipTask =
             tasks.register<Zip>("zip${capitalized}") {
-                group = "TEESimulator Module Packaging"
+                group = "TEESimulator-RS Module Packaging"
                 description = "Creates the flashable zip for the ${variant.name} module."
                 dependsOn(prepareModuleFilesTask)
 
@@ -186,7 +186,7 @@ androidComponents {
         fun createInstallTasks(rootProvider: String, installCli: String) {
             val pushTask =
                 tasks.register<Exec>("push${rootProvider}Module${capitalized}") {
-                    group = "TEESimulator Module Installation"
+                    group = "TEESimulator-RS Module Installation"
                     description =
                         "Pushes the ${variant.name} module to the device for $rootProvider."
                     dependsOn(zipTask)
@@ -200,7 +200,7 @@ androidComponents {
 
             val installTask =
                 tasks.register<Exec>("install${rootProvider}${capitalized}") {
-                    group = "TEESimulator Module Installation"
+                    group = "TEESimulator-RS Module Installation"
                     description = "Installs the ${variant.name} module via $rootProvider."
                     dependsOn(pushTask)
                     commandLine(
@@ -213,7 +213,7 @@ androidComponents {
                 }
 
             tasks.register<Exec>("install${rootProvider}AndReboot${capitalized}") {
-                group = "TEESimulator Module Installation"
+                group = "TEESimulator-RS Module Installation"
                 description = "Installs the ${variant.name} module via $rootProvider and reboots."
                 dependsOn(installTask)
                 commandLine("adb", "reboot")

app/src/main/cpp/supervisor.cpp

@@ -2,11 +2,13 @@
 #include <unistd.h>
 #include <sys/wait.h>
 #include <sys/prctl.h>
+#include <sys/resource.h>
 #include <signal.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 #include <errno.h>
+#include <time.h>
 
 static volatile sig_atomic_t should_exit = 0;
 
@@ -27,7 +29,12 @@ int main(int argc, char *argv[]) {
     const char *daemon_path = argv[1];
     char **daemon_argv = &argv[1];
 
+    int backoff_ms = 500;
+
     while (!should_exit) {
+        struct timespec child_start;
+        clock_gettime(CLOCK_MONOTONIC, &child_start);
+
         pid_t pid = fork();
 
         if (pid < 0) {
@@ -39,6 +46,7 @@ int main(int argc, char *argv[]) {
         if (pid == 0) {
             // Child: become the daemon
             prctl(PR_SET_PDEATHSIG, SIGKILL); // Die if parent dies
+            setpriority(PRIO_PROCESS, 0, 10);  // lower CPU priority than foreground
             execv(daemon_path, daemon_argv);
             perror("execv failed");
             _exit(127);
@@ -50,7 +58,18 @@ int main(int argc, char *argv[]) {
 
         if (should_exit) break;
 
-        // Instant restart - no delay
+        // Exponential backoff on rapid crashes, reset if child was stable
+        struct timespec now;
+        clock_gettime(CLOCK_MONOTONIC, &now);
+        long lived_ms = (now.tv_sec - child_start.tv_sec) * 1000 +
+                        (now.tv_nsec - child_start.tv_nsec) / 1000000;
+
+        if (lived_ms > 30000) {
+            backoff_ms = 500;
+        } else {
+            usleep(backoff_ms * 1000);
+            if (backoff_ms < 30000) backoff_ms *= 2;
+        }
     }
 
     return 0;

app/src/main/java/org/matrix/TEESimulator/App.kt

@@ -23,8 +23,6 @@ import org.matrix.TEESimulator.util.AndroidDeviceUtils
 object App {
     // The delay in milliseconds before retrying to initialize the interceptor.
     private const val RETRY_DELAY_MS = 1000L
-    // The sleep duration in milliseconds for the main service loop to keep the process alive.
-    private const val SERVICE_SLEEP_MS = 1000000L
 
     /**
      * The main entry point of the TEESimulator application.

app/src/main/java/org/matrix/TEESimulator/attestation/AttestationBuilder.kt

@@ -182,11 +182,36 @@ object AttestationBuilder {
                     AttestationConstants.TAG_DIGEST,
                     DERSet(params.digest.map { ASN1Integer(it.toLong()) }.toTypedArray()),
                 ),
+            )
+
+        if (params.ecCurve != null) {
+            list.add(
                 DERTaggedObject(
                     true,
                     AttestationConstants.TAG_EC_CURVE,
                     ASN1Integer(params.ecCurve.toLong()),
-                ),
+                )
+            )
+        }
+
+        params.padding.forEach {
+            list.add(
+                DERTaggedObject(true, AttestationConstants.TAG_PADDING, ASN1Integer(it.toLong()))
+            )
+        }
+
+        if (params.rsaPublicExponent != null) {
+            list.add(
+                DERTaggedObject(
+                    true,
+                    AttestationConstants.TAG_RSA_PUBLIC_EXPONENT,
+                    ASN1Integer(params.rsaPublicExponent.toLong()),
+                )
+            )
+        }
+
+        list.addAll(
+            listOf(
                 DERTaggedObject(true, AttestationConstants.TAG_NO_AUTH_REQUIRED, DERNull.INSTANCE),
                 DERTaggedObject(
                     true,
@@ -199,6 +224,7 @@ object AttestationBuilder {
                     buildRootOfTrust(null),
                 ),
             )
+        )
 
         // Use the same logic as getSimulatedHardwareProperties to conditionally add patch levels.
         val simulatedProperties = getSimulatedHardwareProperties(uid)

app/src/main/java/org/matrix/TEESimulator/attestation/AttestationConstants.kt

@@ -89,5 +89,5 @@ object AttestationConstants {
 
     // --- Other Constants ---
     // https://cs.android.com/android/platform/superproject/main/+/main:system/keymaster/km_openssl/attestation_record.cpp
-    const val CHALLENGE_LENGTH_LIMIT = 128 // kMaximumAttestationChallengeLength
+    const val CHALLENGE_LENGTH_LIMIT = 128
 }

app/src/main/java/org/matrix/TEESimulator/attestation/KeyMintAttestation.kt

@@ -19,7 +19,7 @@ import org.matrix.TEESimulator.logging.KeyMintParameterLogger
 data class KeyMintAttestation(
     val keySize: Int,
     val algorithm: Int,
-    val ecCurve: Int,
+    val ecCurve: Int?,
     val ecCurveName: String,
     val origin: Int?,
     val blockMode: List<Int>,
@@ -53,7 +53,7 @@ data class KeyMintAttestation(
         algorithm = params.findAlgorithm(Tag.ALGORITHM) ?: 0,
 
         // AOSP: [key_param(tag = EC_CURVE, field = EcCurve)]
-        ecCurve = params.findEcCurve(Tag.EC_CURVE) ?: 0,
+        ecCurve = params.findEcCurve(Tag.EC_CURVE),
         ecCurveName = params.deriveEcCurveName(),
 
         // AOSP: [key_param(tag = ORIGIN, field = Origin)]

app/src/main/java/org/matrix/TEESimulator/interception/keystore/InterceptorUtils.kt

@@ -18,6 +18,7 @@ object InterceptorUtils {
         val parcel = Parcel.obtain().apply {
             writeInt(EX_SERVICE_SPECIFIC)
             writeString(null)
+            writeInt(0) // empty remote stack trace header (AOSP Status.cpp:196)
             writeInt(errorCode)
         }
         return BinderInterceptor.TransactionResult.OverrideReply(parcel)
@@ -119,6 +120,8 @@ object InterceptorUtils {
 
     /** Checks if a reply parcel contains an exception without consuming it. */
     fun hasException(reply: Parcel): Boolean {
-        return runCatching { reply.readException() }.exceptionOrNull() != null
+        val exception = runCatching { reply.readException() }.exceptionOrNull()
+        if (exception != null) reply.setDataPosition(0)
+        return exception != null
     }
 }

app/src/main/java/org/matrix/TEESimulator/interception/keystore/Keystore2Interceptor.kt

@@ -10,6 +10,7 @@ import android.system.keystore2.KeyDescriptor
 import android.system.keystore2.KeyEntryResponse
 import java.security.SecureRandom
 import java.security.cert.Certificate
+import java.util.concurrent.ConcurrentHashMap
 import org.matrix.TEESimulator.attestation.AttestationPatcher
 import org.matrix.TEESimulator.attestation.KeyMintAttestation
 import org.matrix.TEESimulator.config.ConfigurationManager
@@ -54,6 +55,9 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
             .associate { field -> (field.get(null) as Int) to field.name.split("_")[1] }
     }
 
+    private const val RESPONSE_KEY_NOT_FOUND = 7
+    private val deletedSoftwareKeys: MutableSet<KeyIdentifier> = ConcurrentHashMap.newKeySet()
+
     override val serviceName = "android.system.keystore2.IKeystoreService/default"
     override val processName = "keystore2"
     override val injectionCommand = "exec ./inject `pidof keystore2` libTEESimulator.so entry"
@@ -156,8 +160,10 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
             val keyId = KeyIdentifier(callingUid, descriptor.alias)
 
             if (code == DELETE_KEY_TRANSACTION) {
-                if (KeyMintSecurityLevelInterceptor.getGeneratedKeyResponse(keyId) != null) {
+                val wasSoftwareKey = KeyMintSecurityLevelInterceptor.getGeneratedKeyResponse(keyId) != null
-                    KeyMintSecurityLevelInterceptor.cleanupKeyData(keyId)
+                KeyMintSecurityLevelInterceptor.cleanupKeyData(keyId)
+                if (wasSoftwareKey) {
+                    deletedSoftwareKeys.add(keyId)
                     SystemLogger.info(
                         "[TX_ID: $txId] Deleted cached keypair ${descriptor.alias}, replying with empty response."
                     )
@@ -166,9 +172,14 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                 return TransactionResult.ContinueAndSkipPost
             }
 
-            val response =
+            val response = KeyMintSecurityLevelInterceptor.getGeneratedKeyResponse(keyId)
-                KeyMintSecurityLevelInterceptor.getGeneratedKeyResponse(keyId)
+            if (response == null) {
-                    ?: return TransactionResult.Continue
+                if (deletedSoftwareKeys.remove(keyId)) {
+                    SystemLogger.info("[TX_ID: $txId] Returning KEY_NOT_FOUND for deleted key ${descriptor.alias}")
+                    return InterceptorUtils.createErrorReply(RESPONSE_KEY_NOT_FOUND)
+                }
+                return TransactionResult.Continue
+            }
 
             if (KeyMintSecurityLevelInterceptor.isAttestationKey(keyId))
                 SystemLogger.info("${descriptor.alias} was an attestation key")
@@ -294,7 +305,7 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                             certChain = keyData.second,
                             algorithm = parsedParameters.algorithm,
                             keySize = parsedParameters.keySize,
-                            ecCurve = parsedParameters.ecCurve,
+                            ecCurve = parsedParameters.ecCurve ?: 0,
                             purposes = parsedParameters.purpose,
                             digests = parsedParameters.digest,
                             isAttestationKey = true,
@@ -326,6 +337,7 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                         )
                         finalChain =
                             AttestationPatcher.patchCertificateChain(originalChain, callingUid)
+                        KeyMintSecurityLevelInterceptor.patchedChains[keyId] = finalChain
                     }
 
                     CertificateHelper.updateCertificateChain(response.metadata, finalChain)

app/src/main/java/org/matrix/TEESimulator/interception/keystore/ListEntriesHandler.kt

@@ -129,7 +129,7 @@ object ListEntriesHandler {
         startPastAlias: String?,
     ): List<KeyDescriptor> {
         return KeyMintSecurityLevelInterceptor.generatedKeys.keys
-            .filter { it.uid == uid && (startPastAlias == null || it.alias < startPastAlias) }
+            .filter { it.uid == uid && (startPastAlias == null || it.alias > startPastAlias) }
             .map { keyId ->
                 KeyDescriptor().apply {
                     this.domain = Domain.APP

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/GeneratedKeyPersistence.kt

@@ -129,6 +129,7 @@ object GeneratedKeyPersistence {
             val file = File(PERSISTENCE_DIR, keyFileName(keyId.uid, keyId.alias))
             if (file.exists()) {
                 if (file.delete()) {
+                    fileLocks.remove(keyFileName(keyId.uid, keyId.alias))
                     SystemLogger.debug("Deleted persisted key: $keyId")
                 } else {
                     SystemLogger.warning("Failed to delete persisted key file: ${file.name}")
@@ -158,6 +159,7 @@ object GeneratedKeyPersistence {
                     if (file.delete()) count++
                 }
             }
+            fileLocks.clear()
             SystemLogger.info("Deleted $count persisted key files")
         }.onFailure { e ->
             SystemLogger.error("Failed to delete all persisted keys", e)

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt

@@ -3,6 +3,7 @@ package org.matrix.TEESimulator.interception.keystore.shim
 import android.hardware.security.keymint.Algorithm
 import android.hardware.security.keymint.KeyParameter
 import android.hardware.security.keymint.KeyParameterValue
+import android.hardware.security.keymint.KeyOrigin
 import android.hardware.security.keymint.Tag
 import android.os.IBinder
 import android.os.Parcel
@@ -259,10 +260,8 @@ class KeyMintSecurityLevelInterceptor(
                     return InterceptorUtils.createErrorReply(RESPONSE_INVALID_ARGUMENT)
                 }
 
-                if (parsedParams.serial != null || parsedParams.imei != null ||
+                if (params.any { it.tag == Tag.DEVICE_UNIQUE_ATTESTATION }) {
-                    parsedParams.meid != null || parsedParams.secondImei != null ||
+                    SystemLogger.warning("[TX_ID: $txId] Rejecting DEVICE_UNIQUE_ATTESTATION for uid=$callingUid")
-                    params.any { it.tag == Tag.DEVICE_UNIQUE_ATTESTATION }) {
-                    SystemLogger.warning("[TX_ID: $txId] Rejecting device ID attestation for uid=$callingUid")
                     return InterceptorUtils.createErrorReply(KEYMINT_CANNOT_ATTEST_IDS)
                 }
 
@@ -316,6 +315,7 @@ class KeyMintSecurityLevelInterceptor(
         keyId: KeyIdentifier,
         isAttestKeyRequest: Boolean,
     ): TransactionResult {
+        val startNs = System.nanoTime()
         keyDescriptor.nspace = secureRandom.nextLong()
         SystemLogger.info("Generating software key for ${keyDescriptor.alias}[${keyDescriptor.nspace}].")
 
@@ -331,7 +331,7 @@ class KeyMintSecurityLevelInterceptor(
         } ?: throw Exception("Both native and BouncyCastle cert gen failed.")
 
         cleanupKeyData(keyId)
-        val response = buildKeyEntryResponse(keyData.second, parsedParams, keyDescriptor)
+        val response = buildKeyEntryResponse(callingUid, keyData.second, parsedParams, keyDescriptor)
         generatedKeys[keyId] = GeneratedKeyInfo(keyData.first, keyDescriptor.nspace, response)
         if (isAttestKeyRequest) attestationKeys.add(keyId)
 
@@ -343,12 +343,16 @@ class KeyMintSecurityLevelInterceptor(
             certChain = keyData.second.toList(),
             algorithm = parsedParams.algorithm,
             keySize = parsedParams.keySize,
-            ecCurve = parsedParams.ecCurve,
+            ecCurve = parsedParams.ecCurve ?: 0,
             purposes = parsedParams.purpose,
             digests = parsedParams.digest,
             isAttestationKey = isAttestKeyRequest,
         )
 
+        val elapsedMs = (System.nanoTime() - startNs) / 1_000_000
+        val delayMs = TEE_LATENCY_FLOOR_MS - elapsedMs
+        if (delayMs > 0) Thread.sleep(delayMs)
+
         return InterceptorUtils.createTypedObjectReply(response.metadata)
     }
 
@@ -377,7 +381,7 @@ class KeyMintSecurityLevelInterceptor(
             val config = CertGenConfig(
                 algorithm = params.algorithm,
                 keySize = params.keySize,
-                ecCurve = params.ecCurve,
+                ecCurve = params.ecCurve ?: 0,
                 rsaPublicExponent = params.rsaPublicExponent?.toLong() ?: 65537L,
                 attestationChallenge = params.attestationChallenge,
                 purposes = params.purpose.toIntArray(),
@@ -421,16 +425,25 @@ class KeyMintSecurityLevelInterceptor(
     }
 
     private fun buildKeyEntryResponse(
+        callingUid: Int,
         chain: List<Certificate>,
         params: KeyMintAttestation,
         descriptor: KeyDescriptor,
     ): KeyEntryResponse {
+        val normalizedKeyDescriptor =
+            KeyDescriptor().apply {
+                domain = Domain.KEY_ID
+                nspace = descriptor.nspace
+                alias = null
+                blob = null
+            }
         val metadata =
             KeyMetadata().apply {
                 keySecurityLevel = securityLevel
-                key = descriptor
+                key = normalizedKeyDescriptor
                 CertificateHelper.updateCertificateChain(this, chain.toTypedArray()).getOrThrow()
-                authorizations = params.toAuthorizations(securityLevel)
+                authorizations = params.toAuthorizations(callingUid, securityLevel)
+                modificationTimeMs = System.currentTimeMillis()
             }
         return KeyEntryResponse().apply {
             this.metadata = metadata
@@ -507,7 +520,7 @@ class KeyMintSecurityLevelInterceptor(
                     secondImei = null,
                 )
 
-                val response = buildKeyEntryResponse(certChain, attestation, descriptor)
+                val response = buildKeyEntryResponse(record.uid, certChain, attestation, descriptor)
                 generatedKeys[keyId] = GeneratedKeyInfo(keyPair, record.nspace, response)
                 if (record.isAttestationKey) attestationKeys.add(keyId)
 
@@ -528,12 +541,12 @@ class KeyMintSecurityLevelInterceptor(
         private const val MAX_ALIAS_LENGTH = 256 * 1024
         private const val KEYMINT_INVALID_INPUT_LENGTH = -21
         private const val RESPONSE_INVALID_ARGUMENT = 20
+        private const val TEE_LATENCY_FLOOR_MS = 15L
         private const val KEYMINT_CANNOT_ATTEST_IDS = -66
         private const val MAX_CONCURRENT_HW_KEYGEN_PER_UID = 2
         // Sliding window: max hardware keygen permits per UID within the burst window
         private const val MAX_HW_KEYGEN_PER_WINDOW = 2
         private const val BURST_WINDOW_MS = 30_000L
-
         private val uidHardwareKeygenCount = ConcurrentHashMap<Int, AtomicInteger>()
         private val hardwareKeygenTxIds = ConcurrentHashMap.newKeySet<Long>()
         private val uidKeygenTimestamps = ConcurrentHashMap<Int, MutableList<Long>>()
@@ -546,6 +559,10 @@ class KeyMintSecurityLevelInterceptor(
             val timestamps = uidKeygenTimestamps.computeIfAbsent(uid) { mutableListOf() }
             synchronized(timestamps) {
                 timestamps.removeAll { now - it > BURST_WINDOW_MS }
+                if (timestamps.isEmpty()) {
+                    uidKeygenTimestamps.remove(uid, timestamps)
+                    uidHardwareKeygenCount.remove(uid)
+                }
                 return timestamps.size
             }
         }
@@ -579,8 +596,7 @@ class KeyMintSecurityLevelInterceptor(
         }
 
         val generatedKeys = ConcurrentHashMap<KeyIdentifier, GeneratedKeyInfo>()
-        // Caches patched chains to prevent re-generation and signature inconsistencies
+        val patchedChains = ConcurrentHashMap<KeyIdentifier, Array<Certificate>>()
-        private val patchedChains = ConcurrentHashMap<KeyIdentifier, Array<Certificate>>()
         val attestationKeys: MutableSet<KeyIdentifier> = ConcurrentHashMap.newKeySet()
         private val interceptedOperations = ConcurrentHashMap<IBinder, OperationInterceptor>()
 
@@ -640,7 +656,10 @@ class KeyMintSecurityLevelInterceptor(
     }
 }
 
-private fun KeyMintAttestation.toAuthorizations(securityLevel: Int): Array<Authorization> {
+private fun KeyMintAttestation.toAuthorizations(
+    callingUid: Int,
+    securityLevel: Int,
+): Array<Authorization> {
     val authList = mutableListOf<Authorization>()
 
     fun createAuth(tag: Int, value: KeyParameterValue): Authorization {
@@ -655,13 +674,35 @@ private fun KeyMintAttestation.toAuthorizations(securityLevel: Int): Array<Autho
         }
     }
 
+    authList.add(createAuth(Tag.ALGORITHM, KeyParameterValue.algorithm(this.algorithm)))
+    if (this.ecCurve != null) {
+        authList.add(createAuth(Tag.EC_CURVE, KeyParameterValue.ecCurve(this.ecCurve)))
+    }
     this.purpose.forEach { authList.add(createAuth(Tag.PURPOSE, KeyParameterValue.keyPurpose(it))) }
     this.digest.forEach { authList.add(createAuth(Tag.DIGEST, KeyParameterValue.digest(it))) }
-
+    this.padding.forEach { authList.add(createAuth(Tag.PADDING, KeyParameterValue.paddingMode(it))) }
-    authList.add(createAuth(Tag.ALGORITHM, KeyParameterValue.algorithm(this.algorithm)))
     authList.add(createAuth(Tag.KEY_SIZE, KeyParameterValue.integer(this.keySize)))
-    authList.add(createAuth(Tag.EC_CURVE, KeyParameterValue.ecCurve(this.ecCurve)))
+    if (this.rsaPublicExponent != null) {
+        authList.add(createAuth(Tag.RSA_PUBLIC_EXPONENT, KeyParameterValue.longInteger(this.rsaPublicExponent.toLong())))
+    }
     authList.add(createAuth(Tag.NO_AUTH_REQUIRED, KeyParameterValue.boolValue(true)))
+    authList.add(createAuth(Tag.ORIGIN, KeyParameterValue.origin(this.origin ?: KeyOrigin.GENERATED)))
+    authList.add(createAuth(Tag.OS_VERSION, KeyParameterValue.integer(AndroidDeviceUtils.osVersion)))
+
+    val osPatch = AndroidDeviceUtils.getPatchLevel(callingUid)
+    if (osPatch != AndroidDeviceUtils.DO_NOT_REPORT) {
+        authList.add(createAuth(Tag.OS_PATCHLEVEL, KeyParameterValue.integer(osPatch)))
+    }
+    val vendorPatch = AndroidDeviceUtils.getVendorPatchLevelLong(callingUid)
+    if (vendorPatch != AndroidDeviceUtils.DO_NOT_REPORT) {
+        authList.add(createAuth(Tag.VENDOR_PATCHLEVEL, KeyParameterValue.integer(vendorPatch)))
+    }
+    val bootPatch = AndroidDeviceUtils.getBootPatchLevelLong(callingUid)
+    if (bootPatch != AndroidDeviceUtils.DO_NOT_REPORT) {
+        authList.add(createAuth(Tag.BOOT_PATCHLEVEL, KeyParameterValue.integer(bootPatch)))
+    }
+    authList.add(createAuth(Tag.CREATION_DATETIME, KeyParameterValue.dateTime(System.currentTimeMillis())))
+    authList.add(createAuth(Tag.USER_ID, KeyParameterValue.integer(callingUid / 100000)))
 
     return authList.toTypedArray()
 }

app/src/main/java/org/matrix/TEESimulator/logging/SystemLogger.kt

@@ -19,6 +19,7 @@ object SystemLogger {
      * @param message The message to log.
      */
     fun debug(message: String) {
+        if (!isDebugBuild) return
         Log.d(TAG, message)
     }
 

app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt

@@ -239,10 +239,10 @@ object CertificateGenerator {
         )
 
         val signerAlgorithm =
-            when (params.algorithm) {
+            when (signingKeyPair.private.algorithm) {
-                Algorithm.EC -> "SHA256withECDSA"
+                "EC" -> "SHA256withECDSA"
-                Algorithm.RSA -> "SHA256withRSA"
+                "RSA" -> "SHA256withRSA"
-                else -> throw IllegalArgumentException("Unsupported algorithm: ${params.algorithm}")
+                else -> throw IllegalArgumentException("Unsupported signing key: ${signingKeyPair.private.algorithm}")
             }
         val contentSigner =
             JcaContentSignerBuilder(signerAlgorithm)

module/changelog.md

@@ -1,3 +1,42 @@
+## TEESimulator-RS v4.6: Rebrand & Detection Fix
+
+- **RTT normalization rework** — Replaced Gaussian sleep (mean=55ms) with a 15ms floor fence. The old approach triggered Chunqiu Native Check 2.8 timing analysis; the floor-only approach satisfies the minimum RTT threshold without creating a detectable delay pattern.
+- **Cross-algorithm attestation** — Signing algorithm now derived from the attestation key's actual type, not the generated key's algorithm. Fixes BouncyCastle crash when signing RSA keys with EC attestation keys (Shizuku attestation flow).
+- **Device ID attestation** — Serial/IMEI/MEID/secondImei tags now flow through to software cert gen instead of blanket rejection. Only DEVICE_UNIQUE_ATTESTATION is rejected, matching AOSP keystore2 policy.
+- **Rebrand to TEESimulator-RS** — Distinguishes this fork from upstream. Version scheme simplified to v{major}.{minor}-{commitCount}.
+- **CI streamlined** — Release pipeline uses Gradle-generated filenames directly, eliminating the rename step.
+
+---
+
+## TEESimulator v4.5: Detection Hardening
+
+Tested against [KeyDetector](https://github.com/XiaoTong6666/KeyDetector) (23-check attestation validator). All keystore-level checks now pass.
+
+- **Key deletion consistency** — After deleting a software-generated key, `getKeyEntry` now correctly returns `KEY_NOT_FOUND` instead of falling through to a stale live-patch fallback. Fixes binder consistency checks that detect ghost key responses.
+- **generateKey timing normalization** — Software key generation RTT now matches real TEE latency profile (Gaussian distribution, mean=55ms, floor=15ms). Previously completed in ~4ms, which is an immediate timing side-channel.
+- **Delete cleanup scope** — `deleteKey` now clears all cached state (patched chains, attestation keys) regardless of whether the key was software or hardware-generated.
+
+---
+
+## TEESimulator v4.4: AOSP Conformance
+
+- **Binder error reply format** — Aligned EX_SERVICE_SPECIFIC wire layout with AOSP Status.cpp, including the remote stack trace header field.
+- **Key enumeration** — Corrected list_past_alias pagination order to match AOSP database.rs semantics.
+- **KeyMetadata fields** — Generated key responses now include modificationTimeMs, Tag.ORIGIN, and normalized KeyDescriptor fields per AOSP Keystore2.
+- **Parcel handling** — hasException() preserves reply position for downstream consumers.
+
+---
+
+## TEESimulator v4.3: Performance & Reliability
+
+- **Debug log gating** — `SystemLogger.debug()` now skipped entirely in release builds, eliminating unnecessary logcat syscalls on every intercepted transaction.
+- **Supervisor backoff** — Exponential restart delay (500ms → 30s cap) prevents CPU spin if the daemon crashes repeatedly. Resets automatically once stable.
+- **Process priority** — Daemon runs at nice=10, yielding CPU to foreground apps on constrained devices.
+- **Map eviction** — Rate limiter and file lock maps now evict stale entries instead of growing unbounded.
+- **CI pipeline** — Single-trigger build→release pipeline with proper changelog extraction and correctly sized artifacts.
+
+---
+
 ## TEESimulator v4.2: Detection Evasion Hardening
 
 Fixes 6 detection vectors flagged by attestation validator apps.

module/customize.sh

@@ -15,7 +15,7 @@ fi
 
 # --- Version Info ---
 VERSION=$(grep_prop version "${TMPDIR}/module.prop")
-ui_print "- Installing TEESimulator $VERSION"
+ui_print "- Installing TEESimulator-RS $VERSION"
 ui_print ""
 
 # --- Architecture Handling ---

module/module.prop

@@ -1,7 +1,7 @@
 id=tricky_store
-name=TEESimulator
+name=TEESimulator-RS
 version=${REPLACEMEVER}
 versionCode=${REPLACEMEVERCODE}
 author=JingMatrix, Enginex0
 description=Software simulation for Android hardware-backed key pairs with key attestation
-updateJson=https://raw.githubusercontent.com/Enginex0/TEESimulator/main/module/update.json
+updateJson=https://raw.githubusercontent.com/Enginex0/TEESimulator-RS/main/module/update.json

module/update.json

@@ -1,6 +1,6 @@
 {
-	"version": "v4.2",
+	"version": "v4.5",
-	"versionCode": 98,
+	"versionCode": 111,
-	"zipUrl": "https://github.com/Enginex0/TEESimulator/releases/download/v4.2/TEESimulator-v4.2-Release.zip",
+	"zipUrl": "https://github.com/Enginex0/TEESimulator/releases/download/v4.5/TEESimulator-v4.5-Release.zip",
 	"changelog": "https://raw.githubusercontent.com/Enginex0/TEESimulator/main/module/changelog.md"
 }

scripts/package.sh

@@ -235,7 +235,7 @@ print_summary() {
 
 # --- Main ---
 echo ""
-bold "TEESimulator package pipeline"
+bold "TEESimulator-RS package pipeline"
 echo ""
 
 [[ "$BUILD_RUST" == true ]] && build_rust

settings.gradle.kts

@@ -14,7 +14,7 @@ dependencyResolutionManagement {
     }
 }
 
-rootProject.name = "TEESimulator"
+rootProject.name = "TEESimulator-RS"
 
 include(":stub")