From 521e28cece845f55f3b73c52b2e8f3a60629725f Mon Sep 17 00:00:00 2001
From: Enginex0 <enginex0@users.noreply.github.com>
Date: Tue, 19 May 2026 05:04:36 +0100
Subject: [PATCH] fix(spoof): order spoofers before keystore hook

BootStateManager.apply and PatchLevelManager.initialize ran after
initializeInterceptors, so keystore2 cached ro.boot.* and
ro.build.version.security_patch from the un-spoofed values during
hook init. Move both before the interceptor so the hook sees the
spoofed snapshot. ConfigurationManager stays between them since
it only loads files and is independent of prop state.
---
 app/src/main/java/org/matrix/TEESimulator/App.kt | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/app/src/main/java/org/matrix/TEESimulator/App.kt b/app/src/main/java/org/matrix/TEESimulator/App.kt
index 4ddf822..94e14fe 100644
--- a/app/src/main/java/org/matrix/TEESimulator/App.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/App.kt
@@ -42,13 +42,18 @@ object App {
 
         try {
             prepareEnvironment()
-            // Initialize and start the appropriate keystore interceptors.
-            initializeInterceptors()
+
+            // Spoof boot-state and patch-level props before any hook attaches,
+            // so keystore2's cached snapshot reflects the spoofed values.
+            BootStateManager.apply()
+            PatchLevelManager.initialize()
 
             // Load the package configuration.
             ConfigurationManager.initialize()
-            BootStateManager.apply()
-            PatchLevelManager.initialize()
+
+            // Initialize and start the appropriate keystore interceptors.
+            initializeInterceptors()
+
             // Set up the device's boot key and hash, which are crucial for attestation.
             AndroidDeviceUtils.setupBootKeyAndHash()