docs(release): bump to v4.2 with changelog and update metadata

AIDL methods use codes 1..0x00ffffff. System transactions like
PING_TRANSACTION (0x5f4e4750) fall above that range. Intercepting
pings forces a full JNI round-trip to Java and back, adding enough
latency for timing detectors to flag the ratio (3.85x vs 3.0x
threshold). Early-return for codes above LAST_CALL_TRANSACTION
eliminates this overhead while preserving all AIDL interception.

app/build.gradle.kts

@@ -29,7 +29,7 @@ val gitExecutor = objects.newInstance(GitExecutor::class.java)
 
 val gitCommitCount = gitExecutor.execute("git rev-list HEAD --count", rootDir).toInt()
 val gitCommitHash = gitExecutor.execute("git rev-parse --verify --short HEAD", rootDir)
-val verName = "v4.1"
+val verName = "v4.2"
 
 android {
     namespace = "org.matrix.TEESimulator"

app/src/main/cpp/binder_interceptor.cpp

@@ -358,6 +358,12 @@ void inspectAndRewriteTransaction(binder_transaction_data *txn_data) {
     if (txn_data->data_size > kMaxInterceptableDataSize)
         return;
 
+    // AIDL methods use codes in [FIRST_CALL_TRANSACTION, LAST_CALL_TRANSACTION] (1..0x00ffffff).
+    // System transactions (PING, INTERFACE, DUMP, SHELL_COMMAND) use codes above that range.
+    // Skip those — intercepting a ping adds measurable latency that timing detectors flag.
+    if (txn_data->code > 0x00ffffffu && txn_data->code != intercept::kBackdoorCode)
+        return;
+
     bool hijack = false;
     ThreadTransactionInfo info;
 

app/src/main/java/org/matrix/TEESimulator/interception/keystore/InterceptorUtils.kt

@@ -17,8 +17,8 @@ object InterceptorUtils {
     fun createErrorReply(errorCode: Int): BinderInterceptor.TransactionResult.OverrideReply {
         val parcel = Parcel.obtain().apply {
             writeInt(EX_SERVICE_SPECIFIC)
-            writeInt(errorCode)
             writeString(null)
+            writeInt(errorCode)
         }
         return BinderInterceptor.TransactionResult.OverrideReply(parcel)
     }

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt

@@ -254,6 +254,18 @@ class KeyMintSecurityLevelInterceptor(
                     return InterceptorUtils.createErrorReply(KEYMINT_INVALID_INPUT_LENGTH)
                 }
 
+                if (params.any { it.tag == Tag.CREATION_DATETIME }) {
+                    SystemLogger.warning("[TX_ID: $txId] Rejecting CREATION_DATETIME in generateKey params")
+                    return InterceptorUtils.createErrorReply(RESPONSE_INVALID_ARGUMENT)
+                }
+
+                if (parsedParams.serial != null || parsedParams.imei != null ||
+                    parsedParams.meid != null || parsedParams.secondImei != null ||
+                    params.any { it.tag == Tag.DEVICE_UNIQUE_ATTESTATION }) {
+                    SystemLogger.warning("[TX_ID: $txId] Rejecting device ID attestation for uid=$callingUid")
+                    return InterceptorUtils.createErrorReply(KEYMINT_CANNOT_ATTEST_IDS)
+                }
+
                 val keyId = KeyIdentifier(callingUid, keyDescriptor.alias)
                 val isAttestKeyRequest = parsedParams.isAttestKey()
 
@@ -515,6 +527,8 @@ class KeyMintSecurityLevelInterceptor(
         // Binder buffer is ~1MB; 256KB provides 4x safety margin for transaction overhead
         private const val MAX_ALIAS_LENGTH = 256 * 1024
         private const val KEYMINT_INVALID_INPUT_LENGTH = -21
+        private const val RESPONSE_INVALID_ARGUMENT = 20
+        private const val KEYMINT_CANNOT_ATTEST_IDS = -66
         private const val MAX_CONCURRENT_HW_KEYGEN_PER_UID = 2
         // Sliding window: max hardware keygen permits per UID within the burst window
         private const val MAX_HW_KEYGEN_PER_WINDOW = 2

app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt

@@ -213,7 +213,7 @@ object CertificateGenerator {
         uid: Int,
         securityLevel: Int,
     ): Certificate {
-        val subject = params.certificateSubject ?: X500Name("CN=Android KeyStore Key")
+        val subject = params.certificateSubject ?: X500Name("CN=Android Keystore Key")
         val leafNotAfter =
             (signingKeyPair.public as? X509Certificate)?.notAfter
                 ?: Date(System.currentTimeMillis() + 31536000000L)

module/changelog.md

@@ -1,3 +1,25 @@
+## TEESimulator v4.2: Detection Evasion Hardening
+
+Fixes 6 detection vectors flagged by attestation validator apps.
+
+### Attestation Policy Enforcement
+
+Replicate AOSP keystore2's `add_required_parameters()` validation that our software keygen path was bypassing:
+
+- **CREATION_DATETIME** — Reject caller-provided input with `INVALID_ARGUMENT (20)`, matching `security_level.rs:424`. Our cert gen still adds its own timestamp, same as real keystore2.
+- **Device ID attestation** — Reject ATTESTATION_ID_SERIAL, IMEI, MEID, SECOND_IMEI, and DEVICE_UNIQUE_ATTESTATION with `CANNOT_ATTEST_IDS (-66)`. No consumer app has READ_PRIVILEGED_PHONE_STATE.
+- **Error reply format** — Fixed AIDL ServiceSpecificException parcel write order (was errorCode→message, now message→errorCode).
+
+### Certificate Fix
+
+Leaf certificate Subject CN corrected from "Android KeyStore Key" to "Android Keystore Key" (lowercase s), matching AOSP `KeyGenParameterSpec.java:282`. Both Kotlin and Rust paths.
+
+### Binder Timing
+
+Skip interception for system transaction codes (PING, INTERFACE, DUMP) above LAST_CALL_TRANSACTION. Eliminates the JNI round-trip that inflated binder ping ratio to 3.85x (detector threshold: 3.0x).
+
+---
+
 ## TEESimulator v4.1: Boot Identity Persistence
 
 Bugfix release. The vbmeta boot key digest was randomizing on every reboot, producing a different RootOfTrust in attestation certificates each boot.

module/update.json

@@ -1,6 +1,6 @@
 {
-	"version": "v4.1",
-	"versionCode": 94,
-	"zipUrl": "https://github.com/Enginex0/TEESimulator/releases/download/v4.1/TEESimulator-v4.1-Release.zip",
+	"version": "v4.2",
+	"versionCode": 98,
+	"zipUrl": "https://github.com/Enginex0/TEESimulator/releases/download/v4.2/TEESimulator-v4.2-Release.zip",
 	"changelog": "https://raw.githubusercontent.com/Enginex0/TEESimulator/main/module/changelog.md"
 }

native-certgen/src/certbuilder.rs

@@ -51,7 +51,7 @@ fn build_leaf_cert(
     let subject_dn_der = if let Some(ref subject) = params.cert_subject {
         subject.clone()
     } else {
-        encode_simple_cn_dn("Android KeyStore Key")
+        encode_simple_cn_dn("Android Keystore Key")
     };
 
     // Validity