jzy/TEESimulator-RS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(intercept): revert updateAad SSE injection

Browse Source 
Reverts 59836e1. Unconditionally injecting SSE(INVALID_TAG) on
non-AEAD updateAad matched the AOSP TA spec but diverged from
real-device behavior on mt6768, which returns silently. A
behavior-fingerprint detector on the Xiaomi probe flagged the
divergence and the Tamper score climbed from 4 to 14, with a
second detector raising key-tamper. Roll back to investigate a
device-conformant approach.
This commit is contained in:
Enginex0
2026-05-19 14:29:39 +01:00
parent 5f72acb1e7
commit 22d1972bc7
2 changed files with 2 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+1 -2
View File
@@ -194,8 +194,7 @@ class KeyMintSecurityLevelInterceptor(
SystemLogger.info("Found new IKeystoreOperation. Registering interceptor...") SystemLogger.info("Found new IKeystoreOperation. Registering interceptor...")
val backdoor = getBackdoor(target) val backdoor = getBackdoor(target)
if (backdoor != null) { if (backdoor != null) {
val isAead = parsedParams.blockMode.firstOrNull() == BlockMode.GCM val interceptor = OperationInterceptor(operation, backdoor)
val interceptor = OperationInterceptor(operation, backdoor, isAead)
register(backdoor, operationBinder, interceptor, OperationInterceptor.INTERCEPTED_CODES) register(backdoor, operationBinder, interceptor, OperationInterceptor.INTERCEPTED_CODES)
interceptedOperations[operationBinder] = interceptor interceptedOperations[operationBinder] = interceptor
} else { } else {
app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt
+1 -7
View File
@@ -13,7 +13,6 @@ import org.matrix.TEESimulator.interception.keystore.InterceptorUtils
class OperationInterceptor( class OperationInterceptor(
private val original: IKeystoreOperation, private val original: IKeystoreOperation,
private val backdoor: IBinder, private val backdoor: IBinder,
private val isAead: Boolean,
) : BinderInterceptor() { ) : BinderInterceptor() {
override fun onPreTransact( override fun onPreTransact(
@@ -28,10 +27,6 @@ class OperationInterceptor(
val methodName = transactionNames[code] ?: "unknown code=$code" val methodName = transactionNames[code] ?: "unknown code=$code"
logTransaction(txId, methodName, callingUid, callingPid, true) logTransaction(txId, methodName, callingUid, callingPid, true)
if (code == UPDATE_AAD_TRANSACTION && !isAead) {
return InterceptorUtils.createServiceSpecificErrorReply(KeystoreErrorCodes.invalidTag)
}
if (code == FINISH_TRANSACTION || code == ABORT_TRANSACTION) { if (code == FINISH_TRANSACTION || code == ABORT_TRANSACTION) {
KeyMintSecurityLevelInterceptor.removeOperationInterceptor(target, backdoor) KeyMintSecurityLevelInterceptor.removeOperationInterceptor(target, backdoor)
} }
@@ -49,8 +44,7 @@ class OperationInterceptor(
private val ABORT_TRANSACTION = private val ABORT_TRANSACTION =
InterceptorUtils.getTransactCode(IKeystoreOperation.Stub::class.java, "abort") InterceptorUtils.getTransactCode(IKeystoreOperation.Stub::class.java, "abort")
val INTERCEPTED_CODES = val INTERCEPTED_CODES = intArrayOf(FINISH_TRANSACTION, ABORT_TRANSACTION)
intArrayOf(UPDATE_AAD_TRANSACTION, FINISH_TRANSACTION, ABORT_TRANSACTION)
private val transactionNames: Map<Int, String> by lazy { private val transactionNames: Map<Int, String> by lazy {
IKeystoreOperation.Stub::class IKeystoreOperation.Stub::class