TEESimulator-RS

52 Commits 1 Branch 30 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
JingMatrix	d2492df02e	Remove SELinux context manipulations during injection (#87 ) After few tests in various devices, it seems that SELinux context modifications are unnecessary for the injection to work. We thus remove all related manipulations. Further (partial) reverting of the commit must be justified with SELinux logs: > adb shell su -c 'cat /proc/kmsg \| grep avc'	2026-01-28 22:14:08 +01:00
JingMatrix	04d003ff4d	Fix x86_64 injection: Red Zone adjustment and fallback logic (#91 ) - Strictly adhere to the System V AMD64 ABI by skipping the 128-byte "Red Zone" before modifying the stack, see page 23 of https://gitlab.com/x86-psABIs/x86-64-ABI/-/jobs/artifacts/master/raw/x86-64-ABI/abi.pdf?job=build for details. - Added `inject_via_staging` as a fallback strategy: 1. Copies the payload to `/data/local/tmp`. 2. Sets permissions/context (`u:object_r:system_file:s0`). 3. Loads via standard `dlopen`. 4. Immediately unlinks the file for stealth. - Introduced `RegisterRestorer` RAII class to guarantee original registers are restored even if the injection logic returns early due to error.	2026-01-26 23:15:09 +01:00
JingMatrix	d18692fbef	Add module template files Current AOSP keybox can be found at: https://cs.android.com/android/platform/superproject/main/+/main:device/generic/trusty/keymaster_soft_wrapped_attestation_keys.xml However, the support of parsing private keys in iecs format is not implemented yet.	2025-11-26 00:19:05 +01:00

Author

SHA1

Message

Date

JingMatrix

d2492df02e

Remove SELinux context manipulations during injection (#87 )

After few tests in various devices, it seems that SELinux context modifications are unnecessary for the injection to work.

We thus remove all related manipulations. Further (partial) reverting of the commit must be justified with SELinux logs:

> adb shell su -c 'cat /proc/kmsg | grep avc'

2026-01-28 22:14:08 +01:00

JingMatrix

04d003ff4d

Fix x86_64 injection: Red Zone adjustment and fallback logic (#91 )

- Strictly adhere to the System V AMD64 ABI by skipping the 128-byte "Red Zone" before modifying the stack, see page 23 of https://gitlab.com/x86-psABIs/x86-64-ABI/-/jobs/artifacts/master/raw/x86-64-ABI/abi.pdf?job=build for details.

- Added `inject_via_staging` as a fallback strategy:
  1. Copies the payload to `/data/local/tmp`.
  2. Sets permissions/context (`u:object_r:system_file:s0`).
  3. Loads via standard `dlopen`.
  4. Immediately unlinks the file for stealth.

- Introduced `RegisterRestorer` RAII class to guarantee original registers are restored even if the injection logic returns early due to error.

2026-01-26 23:15:09 +01:00

JingMatrix

d18692fbef

Add module template files

Current AOSP keybox can be found at:
https://cs.android.com/android/platform/superproject/main/+/main:device/generic/trusty/keymaster_soft_wrapped_attestation_keys.xml

However, the support of parsing private keys in iecs format is not implemented yet.

2025-11-26 00:19:05 +01:00