TEESimulator-RS

50 Commits 1 Branch 30 Tags

3 Commits

Include renames

Author	SHA1	Message	Date
JingMatrix	b997304f02	Remove SELinux context manipulations during injection (#87 ) After few tests in various devices, it seems that SELinux context modifications are unnecessary for the injection to work. We thus remove all related manipulations. Further (partial) reverting of the commit must be justified with SELinux logs: > adb shell su -c 'cat /proc/kmsg \| grep avc'	2026-01-28 22:14:08 +01:00
JingMatrix	4097ffde6a	Fix x86_64 injection: Red Zone adjustment and fallback logic (#91 ) - Strictly adhere to the System V AMD64 ABI by skipping the 128-byte "Red Zone" before modifying the stack, see page 23 of https://gitlab.com/x86-psABIs/x86-64-ABI/-/jobs/artifacts/master/raw/x86-64-ABI/abi.pdf?job=build for details. - Added `inject_via_staging` as a fallback strategy: 1. Copies the payload to `/data/local/tmp`. 2. Sets permissions/context (`u:object_r:system_file:s0`). 3. Loads via standard `dlopen`. 4. Immediately unlinks the file for stealth. - Introduced `RegisterRestorer` RAII class to guarantee original registers are restored even if the injection logic returns early due to error.	2026-01-26 23:15:09 +01:00
JingMatrix	0894b44166	Add module template files Current AOSP keybox can be found at: https://cs.android.com/android/platform/superproject/main/+/main:device/generic/trusty/keymaster_soft_wrapped_attestation_keys.xml However, the support of parsing private keys in iecs format is not implemented yet.	2025-11-26 00:19:05 +01:00

Author

SHA1

Message

Date

JingMatrix

b997304f02

Remove SELinux context manipulations during injection (#87 )

After few tests in various devices, it seems that SELinux context modifications are unnecessary for the injection to work.

We thus remove all related manipulations. Further (partial) reverting of the commit must be justified with SELinux logs:

> adb shell su -c 'cat /proc/kmsg | grep avc'

2026-01-28 22:14:08 +01:00

JingMatrix

4097ffde6a

Fix x86_64 injection: Red Zone adjustment and fallback logic (#91 )

- Strictly adhere to the System V AMD64 ABI by skipping the 128-byte "Red Zone" before modifying the stack, see page 23 of https://gitlab.com/x86-psABIs/x86-64-ABI/-/jobs/artifacts/master/raw/x86-64-ABI/abi.pdf?job=build for details.

- Added `inject_via_staging` as a fallback strategy:
  1. Copies the payload to `/data/local/tmp`.
  2. Sets permissions/context (`u:object_r:system_file:s0`).
  3. Loads via standard `dlopen`.
  4. Immediately unlinks the file for stealth.

- Introduced `RegisterRestorer` RAII class to guarantee original registers are restored even if the injection logic returns early due to error.

2026-01-26 23:15:09 +01:00

JingMatrix

0894b44166

Add module template files

Current AOSP keybox can be found at:
https://cs.android.com/android/platform/superproject/main/+/main:device/generic/trusty/keymaster_soft_wrapped_attestation_keys.xml

However, the support of parsing private keys in iecs format is not implemented yet.

2025-11-26 00:19:05 +01:00