docs(changelog): add AUTO mode banking app fix to v6.0.0 notes

fix(config): restore AUTO mode resolution for bare target entries
v6.0 changed bare target.txt entries from AUTO to GENERATE, breaking apps like BHIM that need TEE-backed attestation keys. Restore AUTO as default and resolve it at config level (PATCH if TEE works, GENERATE if not) to bypass the non-deterministic raceTeePatch path.
2026-03-31 18:59:28 +01:00 · 2026-03-31 18:53:18 +01:00 · 2026-03-26 12:34:36 +01:00 · 2026-03-26 12:28:23 +01:00 · 2026-03-26 12:28:17 +01:00 · 2026-03-26 05:03:01 +01:00
35 changed files with 1636 additions and 1533 deletions
@@ -1,4 +0,0 @@
 # Ensure shell scripts always have LF line endings, even on Windows.
 # These get packaged into flashable zips and run on Android devices.
 *.sh text eol=lf
 module/daemon text eol=lf
@@ -1,259 +1,139 @@
 <p align="center">
-  <h1 align="center">🔐 TEESimulator</h1>
+  <h1 align="center">TEESimulator-RS</h1>
  <p align="center"><b>Full TEE Emulation for Rooted Android</b></p>
  <p align="center">Hardware attestation. Software keys. Zero detection.</p>
  <p align="center">
-    <a href="https://github.com/Enginex0/TEESimulator/actions/workflows/build.yml"><img src="https://github.com/Enginex0/TEESimulator/actions/workflows/build.yml/badge.svg" alt="Build"></a>
+    <a href="https://github.com/Enginex0/TEESimulator-RS/actions/workflows/build.yml"><img src="https://github.com/Enginex0/TEESimulator-RS/actions/workflows/build.yml/badge.svg" alt="Build"></a>
-    <img src="https://img.shields.io/badge/version-v4.2-blue?style=for-the-badge" alt="v4.2">
+    <img src="https://img.shields.io/badge/Android-10%2B-green?logo=android" alt="Android 10+">
-    <img src="https://img.shields.io/badge/Android-10%2B-green?style=for-the-badge&logo=android" alt="Android 10+">
+    <a href="https://t.me/superpowers9"><img src="https://img.shields.io/badge/Telegram-community-blue?logo=telegram" alt="Telegram"></a>
    <img src="https://img.shields.io/badge/Telegram-community-blue?style=for-the-badge&logo=telegram" alt="Telegram">
  </p>
 </p>
 ---
 > [!NOTE]
-> **This is a personal fork of [JingMatrix/TEESimulator](https://github.com/JingMatrix/TEESimulator)** with additional hardening, native Rust certificate generation, key persistence, and anti-detection features. For the upstream project, see the original repo.
+> Fork of [JingMatrix/TEESimulator](https://github.com/JingMatrix/TEESimulator) with native Rust certificate generation, key persistence, and AOSP-compliant attestation behavior. For the upstream project, see the original repo.
---
+## What It Does
-## 🧬 What is TEESimulator?
+TEESimulator intercepts Binder IPC at the `ioctl` level inside the `keystore2` process and generates entire certificate chains from scratch, signed by your keybox, with correct attestation extensions. Apps that verify hardware attestation see a legitimate device.
-TEESimulator is a **complete software simulation** of Android's hardware-backed [Trusted Execution Environment](https://source.android.com/docs/security/features/trusty) for [Key Attestation](https://developer.android.com/privacy-and-security/security-key-attestation). Instead of patching certificates from the real TEE after the fact, TEESimulator intercepts Binder IPC at the `ioctl` level and generates entire certificate chains from scratch — signed by your keybox, with correct attestation extensions, indistinguishable from hardware-generated keys.
+This is not TrickyStore. TEESimulator replaces TrickyStore and its forks entirely. It shares the same config paths for drop-in compatibility, but the internals are different: native Rust cert generation, binder-level interception via `lsplt`, per-UID rate limiting, key persistence, and AOSP-spec attestation behavior.
-The result: **apps that verify hardware attestation see a legitimate, unmodified device** — even on rooted hardware with an unlocked bootloader.
+## Requirements
 > **This is not TrickyStore.** TEESimulator replaces TrickyStore and its forks entirely. It shares the same config paths for drop-in compatibility, but the architecture is fundamentally different: native Rust certificate generation, binder-level interception via `lsplt`, per-UID rate limiting, key persistence, and a multi-layer defense against detector apps.
 ---
 ## 🔥 Why TEESimulator?
 🔐 **Native Cert Generation** — v4.0 generates X.509 certificate chains in Rust with `ring` and manual DER encoding. No BouncyCastle overhead, no Java crypto quirks, byte-perfect issuer chain linkage.
 🎯 **Binder-Level Interception** — Hooks `ioctl()` on `libc.so` via `lsplt` inside the `keystore2` process. Intercepts `generateKey`, `importKey`, and `getKeyEntry` transactions before the HAL ever sees them.
 🛡️ **Detector Resistant** — Per-UID rate limiting blocks DuckDetector-style keygen flooding. Oversized challenges rejected with real KeyMint error codes. Chain consistency verified byte-for-byte.
 💾 **Key Persistence** — Generated keys survive reboots. Apps that store attestation keys (banking, biometrics) don't break after a restart.
 🔧 **Drop-In Replacement** — Same config paths as TrickyStore (`/data/adb/tricky_store/`). Swap the module ZIP, keep your keybox and target list.
 ---
 ## ✨ Features
 **Core Attestation Engine**
 - [x] **Full certificate chain generation** — leaf + intermediates + root, signed by your keybox
 - [x] **Native Rust certgen** — `libcertgen.so` built with `ring`, `rsa`, and manual DER assembly
 - [x] **BouncyCastle fallback** — unsupported curves (P-224, P-521, Curve25519) fall back to Java
 - [x] **ASN.1 attestation extensions** — OID 1.3.6.1.4.1.11129.2.1.17 with all AOSP-specified tags
 - [x] **Multi-keybox support** — different keybox files per app group via `target.txt`
 **Interception Layer**
 - [x] **Binder ioctl hook** — `lsplt` PLT hook on `libc.so` inside `keystore2` process
 - [x] **generateKey / importKey / getKeyEntry** — all three transaction types intercepted
 - [x] **256KB native payload cap** — oversized binder payloads bypass interception cleanly
 - [x] **Challenge validation** — rejects >128-byte attestation challenges with `INVALID_INPUT_LENGTH`
 **Hardening**
 - [x] **Per-UID rate limiter** — 2 hardware keygens per 30s burst window, software fallback on overflow
 - [x] **importKey eviction guard** — retained patch chains prevent generate-then-import cache attacks
 - [x] **Key persistence** — file-backed storage with file-level locking, survives reboots and keybox rotations
 - [x] **Global exception handler** — uncaught exceptions logged, daemon stays alive
 **Configuration**
 - [x] **Live config reload** — `FileObserver` watches all config files, changes apply immediately
 - [x] **Security patch spoofing** — per-package `system`, `vendor`, `boot` patch levels with dynamic templates
 - [x] **Lifecycle scripts** — KSU Action button clears key cache, uninstall removes all traces
 ---
 ## 📋 Requirements
 > [!IMPORTANT]
-> TEESimulator requires root access and a valid `keybox.xml` for hardware-level attestation results. Without a keybox, the module generates software-level certificates that won't pass strict hardware attestation checks.
+> A valid `keybox.xml` is required for hardware-level attestation. Without one, the module generates software-level certificates that won't pass strict hardware checks.
-**You need:**
+1. Android 10+
-1. Android 10 or above
+2. Root manager: KernelSU, Magisk, or APatch
-2. A supported root manager (KernelSU, Magisk, or APatch)
+3. `keybox.xml` at `/data/adb/tricky_store/keybox.xml`
 3. A hardware-backed `keybox.xml` placed at `/data/adb/tricky_store/keybox.xml`
---
+## Quick Start
-## 📱 Compatibility
+1. Download the latest ZIP from [Releases](https://github.com/Enginex0/TEESimulator-RS/releases)
 2. Install via your root manager and reboot
 3. Place your keybox at `/data/adb/tricky_store/keybox.xml`
 4. Configure targets in `/data/adb/tricky_store/target.txt`
 5. Verify with Play Integrity or Key Attestation Demo
-### Root Managers
+## Architecture
-| Manager | Status | Notes |
+**Native Cert Generation** — `libcertgen.so` generates X.509 chains in Rust using `ring` and manual DER encoding. BouncyCastle fallback for unsupported curves (P-224, P-521, Curve25519).
 |---|---|---|
 | KernelSU | ✅ Tested | Full support including Action button and lifecycle scripts |
 | Magisk | ✅ Supported | Standard module install |
 | APatch | ✅ Supported | Standard module install |
-### Tested Devices
+**Binder Interception** — PLT hook on `ioctl()` in `libc.so` via `lsplt` inside `keystore2`. Intercepts `generateKey`, `importKey`, and `getKeyEntry` transactions.
-| Device | Android | TEE | Status |
+**AOSP Compliance** — Self-signed certs for non-attested keys (matching `ta/src/keys.rs`), correct AuthorizationList tag ordering, version-guarded extension fields, `authorize_create` enforcement.
 |---|---|---|---|
 | Redmi 14C (2409BRN2CA) | 14 (SDK 34) | Beanpod KeyMaster | ✅ Daily driver |
-> Tested against DuckDetector, Luna, Play Integrity, and Key Attestation Demo. If you test on a different device, [open an issue](https://github.com/Enginex0/TEESimulator/issues) with your results.
+**Key Persistence** — Generated keys survive reboots. File-backed with file-level locking.
---
+**Rate Limiting** — Per-UID hardware keygen cap (2/30s window, 2 concurrent). Overflow falls to software certs.
-## 🚀 Quick Start
+## Configuration
-1. **Download** the latest release ZIP from [Releases](https://github.com/Enginex0/TEESimulator/releases)
+All config files live at `/data/adb/tricky_store/` and are hot-reloaded via `FileObserver`.
 2. **Install** via your root manager (KSU / Magisk / APatch) and reboot
 3. **Place your keybox** at `/data/adb/tricky_store/keybox.xml`
 4. **Configure targets** in `/data/adb/tricky_store/target.txt`
 5. **Verify** — check Play Integrity or run Key Attestation Demo
-TEESimulator replaces TrickyStore, TrickyStoreOSS, and their forks. Existing config files are compatible.
+### target.txt
---
+Controls which apps get intercepted and the simulation mode.
-## 🔨 Building from Source
+| Suffix | Mode |
 |--------|------|
 | `!` | Force software key generation |
 | `?` | Force leaf certificate patching (real TEE key, patched cert) |
 | *(none)* | Automatic selection |
-The CI workflow builds on every push to `main`. You can also build locally or trigger a build from your own fork.
+Multi-keybox support via `[filename.xml]` headers:
 **Prerequisites:** JDK 21, Android SDK/NDK 27, Rust stable with `aarch64-linux-android` target, `cargo-ndk`.
 ```bash
 git clone https://github.com/Enginex0/TEESimulator.git
 cd TEESimulator
 ./gradlew zipRelease zipDebug
 ```
 Output ZIPs land in `out/`. The Gradle build automatically invokes `cargo ndk` to cross-compile `libcertgen.so` before packaging.
 To rebuild from a fork, push to `main` or use **Actions → Build → Run workflow**. The workflow installs all toolchains (Java, Rust, cargo-ndk, ccache) and uploads Release + Debug ZIPs as artifacts.
 ---
 ## ⚙️ Configuration
 All configuration files live at `/data/adb/tricky_store/` and are monitored by `FileObserver` — changes take effect immediately without rebooting.
 ### The `keybox.xml` Root of Trust
 This file provides the master cryptographic identity. It contains a private key and a hardware-backed certificate chain from a real device. TEESimulator signs all generated certificates with this key, making them appear legitimate to verifiers.
 ```xml
 <?xml version="1.0"?>
 <AndroidAttestation>
    <Keybox DeviceID="...">
        <Key algorithm="ecdsa|rsa">
            <PrivateKey format="pem">...</PrivateKey>
            <CertificateChain>...</CertificateChain>
        </Key>
    </Keybox>
 </AndroidAttestation>
 ```
 ### Target Packages (`target.txt`)
 Controls which apps get intercepted and what simulation mode to use.
 #### Mode Suffixes
 *   **`!` → Force Generation** — Creates a complete software-based virtual key. Full TEE simulation.
 *   **`?` → Force Leaf Hacking** — Real TEE key generated, but its attestation certificate is intercepted and patched.
 *   **No symbol → Automatic** — Module selects the best mode for your device.
 #### Multi-Keybox
 Specify different keybox files for different app groups. Apps listed after a `[filename.xml]` line use that keybox. Apps before any declaration use the default `keybox.xml`.
 ```
 # Default keybox
 com.google.android.gms!
 io.github.vvb2060.keyattestation?
 # Switch to a different keybox for the following apps
 [aosp_keybox.xml]
 com.google.android.gsf
 # Another keybox
 [demo_keybox.xml]
 org.matrix.demo
 ```
-### Security Patch Level (`security_patch.txt`)
+### security_patch.txt
-Configure the `osPatchLevel`, `vendorPatchLevel`, and `bootPatchLevel` reported in attestation certificates. This only affects attestation data — it does not change actual system properties.
+Override patch levels reported in attestation certificates. Global defaults at top, per-package overrides with `[package.name]`.
 #### Global and Per-Package
 Settings at the top of the file are global defaults. Add `[package.name]` to override for specific apps.
 #### Keys
 | Key | Scope |
-|---|---|
+|-----|-------|
 | `system` | OS patch level |
 | `vendor` | Vendor patch level |
 | `boot` | Boot/kernel patch level |
-| `all` | Shorthand — sets all three at once |
+| `all` | Sets all three |
-#### Special Keywords
+Special values: `today`, `YYYY-MM-DD` templates, `no` (omit tag), `device_default`, `prop` (read from system property).
 | Keyword | Effect |
 |---|---|
 | `today` | Current date, dynamically resolved on each attestation |
 | `YYYY-MM-DD` templates | Semi-dynamic — `YYYY-MM-05` resolves to the 5th of the current month |
 | `no` | Omit this patch level tag entirely from the attestation |
 | `device_default` | Use the device's real hardware value |
 | `prop` | Read from `ro.build.version.security_patch` (matches what detectors see via getprop) |
 #### Example
 ```
 # Global — default for all apps
 system=YYYY-MM-05
 vendor=device_default
 boot=no
 # Override for GMS
 [com.google.android.gms]
-system=2024-10-01
+system=2025-10-01
 # Custom config for a demo app
 [org.matrix.demo]
 all=2025-09-15
 boot=device_default
 ```
---
+## Building from Source
-## 💬 Community
+Prerequisites: JDK 21, Android SDK/NDK 27, Rust stable with `aarch64-linux-android` target, `cargo-ndk`.
 ```bash
 git clone --recursive https://github.com/Enginex0/TEESimulator-RS.git
 cd TEESimulator-RS
 ./gradlew zipRelease zipDebug
 ```
 Output ZIPs in `out/`. Gradle invokes `cargo ndk` automatically to cross-compile `libcertgen.so`.
 Push to `main` or use **Actions > Build > Run workflow** to trigger CI.
 ## Compatibility
 | Root Manager | Status |
 |---|---|
 | KernelSU | Tested (Action button + lifecycle scripts) |
 | Magisk | Supported |
 | APatch | Supported |
 ## Community
 <p align="center">
  <a href="https://t.me/superpowers9">
-    <img src="https://img.shields.io/badge/⚡_JOIN_THE_GRID-SuperPowers_Telegram-black?style=for-the-badge&logo=telegram&logoColor=cyan&labelColor=0d1117&color=00d4ff" alt="Telegram">
+    <img src="https://img.shields.io/badge/SuperPowers_Telegram-Join-blue?style=for-the-badge&logo=telegram" alt="Telegram">
  </a>
 </p>
---
+## Credits
-## 🙏 Credits
+- [JingMatrix](https://github.com/JingMatrix/TEESimulator) — original TEESimulator and interception architecture
 - [5ec1cff](https://github.com/5ec1cff/TrickyStore) — TrickyStore, the project that pioneered keystore interception
 - [LSPlt](https://github.com/LSPosed/LSPlt) — PLT hook library
 - [ring](https://github.com/briansmith/ring) — Rust cryptography library
 - [MhmRdd](https://github.com/MhmRdd) — AOSP compliance work via upstream [PR #157](https://github.com/JingMatrix/TEESimulator/pull/157)
 - [fatalcoder524](https://github.com/fatalcoder524) — contributor and collaborator
 - [huguangares](https://github.com/huguangares) — collaborator and tester
- **[JingMatrix](https://github.com/JingMatrix/TEESimulator)** — original author of TEESimulator and the interception architecture
+## License
 - **[5ec1cff](https://github.com/5ec1cff/TrickyStore)** — TrickyStore, the project that pioneered keystore interception on Android
 - **[LSPlt](https://github.com/LSPosed/LSPlt)** — PLT hook library used for binder interception
 - **[ring](https://github.com/briansmith/ring)** — Rust cryptography library powering native cert generation
 - **[MhmRdd](https://github.com/MhmRdd)** — AOSP compliance improvements via upstream [PR #157](https://github.com/JingMatrix/TEESimulator/pull/157), including authorize_create enforcement, attestation extension alignment, and binder transaction filtering
 - **[fatalcoder524](https://github.com/fatalcoder524)** — a real contributor and collaborator on this project
 - **[huguangares](https://github.com/huguangares)** — collaborator and tester
---
+[GNU General Public License v3.0](LICENSE)
 ## 📄 License
 This project is licensed under the [GNU General Public License v3.0](LICENSE).
 ---
 <p align="center">
  <b>🔐 Because the best attestation is the one the TEE never generated.</b>
 </p>
@@ -29,7 +29,7 @@ val gitExecutor = objects.newInstance(GitExecutor::class.java)
 val gitCommitCount = gitExecutor.execute("git rev-list HEAD --count", rootDir).toInt()
 val gitCommitHash = gitExecutor.execute("git rev-parse --verify --short HEAD", rootDir)
-val verName = "v5.1"
+val verName = "v6.0.0"
 android {
    namespace = "org.matrix.TEESimulator"
@@ -121,8 +121,8 @@ androidComponents {
                    dependsOn("package${capitalized}")
                } else {
                    dependsOn("minify${capitalized}WithR8")
                    dependsOn("strip${capitalized}DebugSymbols")
                }
                dependsOn("strip${capitalized}DebugSymbols")
                dependsOn(buildRustCertgen)
                if (isDebug) {
@@ -140,11 +140,12 @@ androidComponents {
                    }
                }
-                from(
+                val nativeLibsDir = if (isDebug) {
-                    project.layout.buildDirectory.dir(
+                    "intermediates/merged_native_libs/${variant.name}/merge${capitalized}NativeLibs/out/lib"
-                        "intermediates/stripped_native_libs/${variant.name}/strip${capitalized}DebugSymbols/out/lib"
+                } else {
-                    )
+                    "intermediates/stripped_native_libs/${variant.name}/strip${capitalized}DebugSymbols/out/lib"
-                ) {
+                }
                from(project.layout.buildDirectory.dir(nativeLibsDir)) {
                    into("lib")
                    include("**/libinject.so", "**/libTEESimulator.so", "**/libsupervisor.so", "**/libcertgen.so")
                }
@@ -235,20 +235,15 @@ class BinderInterceptor : public BBinder {
    struct RegistrationEntry {
        wp<IBinder> target;
        sp<IBinder> callback_interface;
        // Transaction codes to intercept. Empty = intercept all (legacy behavior).
        std::vector<uint32_t> filtered_codes;
    };
    // Reader-Writer lock for the registry to allow concurrent reads (lookups)
    mutable std::shared_mutex registry_mutex_;
    std::map<wp<IBinder>, RegistrationEntry> registry_;
 public:
    BinderInterceptor() = default;
    // Checks if a specific Binder+code combination should be intercepted.
    // Returns true if the binder is registered AND the code is in its filter
    // (or the filter is empty, meaning intercept everything).
    bool shouldIntercept(const wp<BBinder> &target, uint32_t code) const {
        std::shared_lock lock(registry_mutex_);
        auto it = registry_.find(target);
@@ -359,7 +354,9 @@ void inspectAndRewriteTransaction(binder_transaction_data *txn_data) {
    if (!txn_data || txn_data->target.ptr == 0)
        return;
-    // Skip system transactions (PING, INTERFACE, DUMP) to avoid latency detectors
+    // AIDL methods use codes in [FIRST_CALL_TRANSACTION, LAST_CALL_TRANSACTION] (1..0x00ffffff).
    // System transactions (PING, INTERFACE, DUMP, SHELL_COMMAND) use codes above that range.
    // Skip those — intercepting a ping adds measurable latency that timing detectors flag.
    if (txn_data->code > 0x00ffffffu && txn_data->code != intercept::kBackdoorCode)
        return;
@@ -431,44 +428,29 @@ void processBinderReadBuffer(const binder_write_read &bwr) {
    uintptr_t ptr = bwr.read_buffer;
    uintptr_t end = ptr + bwr.read_consumed;
    LOGV("[Hook] Processing Read Buffer: Size=%llu, Consumed=%llu", bwr.read_size, bwr.read_consumed);
    while (ptr < end) {
        // Ensure we can read at least the command header
        if (end - ptr < sizeof(uint32_t))
            break;
        uint32_t cmd = *reinterpret_cast<const uint32_t *>(ptr);
        ptr += sizeof(uint32_t);
        // Calculate payload size from the ioctl command code
        size_t cmd_size = _IOC_SIZE(cmd);
        // Log the command using our generated to-string function
        LOGV("[Driver -> User] Command: %s (0x%x), DataSize: %zu", getBinderReturnCommandName(cmd), cmd, cmd_size);
        // Safety check: ensure the command's data does not exceed the buffer
        if (ptr + cmd_size > end) {
-            LOGE("[Hook] Buffer overflow detected while parsing command %s", getBinderReturnCommandName(cmd));
+            LOGE("[Hook] Buffer overrun parsing command 0x%x", cmd);
            break;
        }
-        // We are primarily interested in BR_TRANSACTION commands to intercept
+        if (__builtin_expect(cmd == BR_TRANSACTION || cmd == BR_TRANSACTION_SEC_CTX, 0)) {
-        if (cmd == BR_TRANSACTION || cmd == BR_TRANSACTION_SEC_CTX) {
+            binder_transaction_data *txn;
            binder_transaction_data *txn = nullptr;
            if (cmd == BR_TRANSACTION_SEC_CTX) {
-                // The data is wrapped in a secctx struct
+                txn = &reinterpret_cast<binder_transaction_data_secctx *>(ptr)->transaction_data;
                auto *wrapper = reinterpret_cast<binder_transaction_data_secctx *>(ptr);
                txn = &wrapper->transaction_data;
            } else {
                txn = reinterpret_cast<binder_transaction_data *>(ptr);
            }
            inspectAndRewriteTransaction(txn);
        }
        // Advance pointer to the next command
        ptr += cmd_size;
    }
 }
@@ -488,13 +470,17 @@ int intercepted_ioctl(int fd, int request, ...) {
    // 1. Call original kernel ioctl to let the driver do its work
    int result = g_original_ioctl(fd, request, arg);
    // 2. After the call returns, check if it was a BINDER_WRITE_READ and if it succeeded
    if (result >= 0 && request == BINDER_WRITE_READ && arg != nullptr) {
        const auto *bwr = static_cast<const binder_write_read *>(arg);
-
+        // Fast reject: only enter the parser if the buffer could contain a BR_TRANSACTION.
-        // We only care about data read FROM the driver (i.e., incoming commands)
+        // Pings, ref ops, and looper management never produce BR_TRANSACTION, so scanning
-        if (bwr->read_consumed > 0) {
+        // their buffers is pure overhead (~2-5us per ioctl in debug builds).
-            processBinderReadBuffer(*bwr);
+        if (bwr->read_consumed >= sizeof(uint32_t)) {
            uint32_t first_cmd = *reinterpret_cast<const uint32_t *>(bwr->read_buffer);
            if (first_cmd == BR_TRANSACTION || first_cmd == BR_TRANSACTION_SEC_CTX
                || bwr->read_consumed > sizeof(uint32_t) + _IOC_SIZE(first_cmd)) {
                processBinderReadBuffer(*bwr);
            }
        }
    }
@@ -537,14 +523,11 @@ status_t BinderInterceptor::handleRegister(const Parcel &data) {
    if (data.readStrongBinder(&callback) != OK || !callback)
        return BAD_VALUE;
    // We can only intercept local Binders (BBinder), not remote proxies (BpBinder)
    if (target->localBinder() == nullptr) {
        LOGE("Cannot intercept remote binder proxies.");
        return BAD_TYPE;
    }
    // Read optional transaction code filter. If present: int32 count + count * uint32 codes.
    // If absent or count <= 0: intercept all transaction codes (legacy behavior).
    std::vector<uint32_t> codes;
    int32_t code_count = 0;
    if (data.dataAvail() >= sizeof(int32_t) && data.readInt32(&code_count) == OK && code_count > 0) {
@@ -612,8 +595,15 @@ bool BinderInterceptor::processInterceptedTransaction(uint64_t tx_id, sp<BBinder
    Parcel pre_req, pre_resp;
    writeTransactionData(pre_req, tx_id, target, code, flags, request);
-    if (callback->transact(intercept::kPreTransact, pre_req, &pre_resp) != OK) {
+    status_t pre_status = callback->transact(intercept::kPreTransact, pre_req, &pre_resp);
-        LOGW("[TX_ID: %" PRIu64 "] Pre-transaction callback failed. Forwarding original call.", tx_id);
+    if (pre_status != OK) {
        // Block when interceptor is dead to prevent privacy leak to third-party apps
        if (callback->pingBinder() != OK) {
            LOGE("[TX_ID: %" PRIu64 "] Interceptor DEAD. Blocking to prevent attestation leak.", tx_id);
            result = DEAD_OBJECT;
            return true;
        }
        LOGW("[TX_ID: %" PRIu64 "] Pre-transaction callback failed (not dead). Forwarding.", tx_id);
        return false;
    }
@@ -667,7 +657,8 @@ bool BinderInterceptor::processInterceptedTransaction(uint64_t tx_id, sp<BBinder
        VALIDATE_STATUS(tx_id, post_req.appendFrom(reply, 0, reply_size));
    }
-    if (callback->transact(intercept::kPostTransact, post_req, &post_resp) == OK) {
+    status_t post_status = callback->transact(intercept::kPostTransact, post_req, &post_resp);
    if (post_status == OK) {
        int32_t post_action = post_resp.readInt32();
        if (post_action == intercept::kActionOverrideReply && reply) {
            result = post_resp.readInt32(); // Read new status
@@ -23,8 +23,6 @@ import org.matrix.TEESimulator.util.AndroidDeviceUtils
 object App {
    // The delay in milliseconds before retrying to initialize the interceptor.
    private const val RETRY_DELAY_MS = 1000L
    // The sleep duration in milliseconds for the main service loop to keep the process alive.
    private const val SERVICE_SLEEP_MS = 1000000L
    /**
     * The main entry point of the TEESimulator application.
@@ -44,7 +42,9 @@ object App {
            // Initialize and start the appropriate keystore interceptors.
            initializeInterceptors()
            // Load the package configuration.
            ConfigurationManager.initialize()
            // Set up the device's boot key and hash, which are crucial for attestation.
            AndroidDeviceUtils.setupBootKeyAndHash()
            // Android ships with a stripped-down Bouncy Castle provider under the name "BC".
@@ -43,11 +43,12 @@ object AttestationBuilder {
        securityLevel: Int,
    ): Extension {
        val keyDescription = buildKeyDescription(params, uid, securityLevel)
-        var formattedString =
+        SystemLogger.verbose {
-            keyDescription.joinToString(separator = ", ") {
+            val formattedString = keyDescription.joinToString(separator = ", ") {
                AttestationPatcher.formatAsn1Primitive(it)
            }
-        SystemLogger.verbose("Forged attestation data: ${formattedString}")
+            "Forged attestation data: $formattedString"
        }
        return Extension(ATTESTATION_OID, false, DEROctetString(keyDescription.encoded))
    }
@@ -115,6 +116,7 @@ object AttestationBuilder {
            }
        val bootPatch = AndroidDeviceUtils.getBootPatchLevelLong(uid)
        SystemLogger.info("Attestation patch levels for uid=$uid: os=$osPatch, vendor=$vendorPatch, boot=$bootPatch")
        properties[AttestationConstants.TAG_BOOT_PATCHLEVEL] =
            if (bootPatch != DO_NOT_REPORT) {
                DERTaggedObject(
@@ -129,7 +131,6 @@ object AttestationBuilder {
        return properties
    }
    /** Constructs the main `KeyDescription` sequence, which is the core of the attestation. */
    private fun buildKeyDescription(
        params: KeyMintAttestation,
        uid: Int,
@@ -148,15 +149,11 @@ object AttestationBuilder {
        val fields =
            arrayOf(
-                ASN1Integer(
+                ASN1Integer(AndroidDeviceUtils.getAttestVersion(securityLevel).toLong()),
-                    AndroidDeviceUtils.getAttestVersion(securityLevel).toLong()
+                ASN1Enumerated(securityLevel),
-                ), // attestationVersion
+                ASN1Integer(AndroidDeviceUtils.getKeymasterVersion(securityLevel).toLong()),
-                ASN1Enumerated(securityLevel), // attestationSecurityLevel
+                ASN1Enumerated(securityLevel),
-                ASN1Integer(
+                DEROctetString(params.attestationChallenge ?: ByteArray(0)),
                    AndroidDeviceUtils.getKeymasterVersion(securityLevel).toLong()
                ), // keymasterVersion
                ASN1Enumerated(securityLevel), // keymasterSecurityLevel
                DEROctetString(params.attestationChallenge ?: ByteArray(0)), // attestationChallenge
                DEROctetString(uniqueId),
                softwareEnforced,
                teeEnforced,
@@ -164,37 +161,24 @@ object AttestationBuilder {
        return DERSequence(fields)
    }
    /**
     * Computes the unique ID per the KeyMint HAL spec:
     * HMAC-SHA256(T || C || R, HBK) truncated to 128 bits.
     *
     * T = temporal counter (creationTime / 2592000000, i.e. 30-day periods since epoch)
     * C = DER-encoded ATTESTATION_APPLICATION_ID
     * R = 0x00 (no factory reset since ID rotation)
     * HBK = device-unique secret generated once during module installation
     */
    private fun computeUniqueId(creationTimeMs: Long, aaidDer: ByteArray): ByteArray {
        val temporalCounter = creationTimeMs / 2592000000L
        val message =
            ByteBuffer.allocate(8 + aaidDer.size + 1)
                .putLong(temporalCounter)
                .put(aaidDer)
-                .put(0x00) // RESET_SINCE_ID_ROTATION = false
+                .put(0x00)
                .array()
        val mac = Mac.getInstance("HmacSHA256")
        mac.init(SecretKeySpec(hbk, "HmacSHA256"))
        return mac.doFinal(message).copyOf(16)
    }
    /** Device-unique key seed, generated once at module installation. */
    private val hbk: ByteArray by lazy {
        val file = java.io.File(ConfigurationManager.CONFIG_PATH, "hbk")
        if (file.exists() && file.length() == 32L) {
            file.readBytes()
        } else {
            // Fallback: generate in-memory (won't persist across reboots)
            SystemLogger.warning("hbk not found, generating ephemeral HBK.")
            ByteArray(32).also { java.security.SecureRandom().nextBytes(it) }
        }
@@ -277,20 +261,14 @@ object AttestationBuilder {
                DERTaggedObject(
                    true,
                    AttestationConstants.TAG_RSA_OAEP_MGF_DIGEST,
-                    DERSet(
+                    DERSet(params.rsaOaepMgfDigest.map { ASN1Integer(it.toLong()) }.toTypedArray()),
                        params.rsaOaepMgfDigest.map { ASN1Integer(it.toLong()) }.toTypedArray()
                    ),
                )
            )
        }
        if (params.rollbackResistance == true && attestVersion >= 3) {
            list.add(
-                DERTaggedObject(
+                DERTaggedObject(true, AttestationConstants.TAG_ROLLBACK_RESISTANCE, DERNull.INSTANCE)
                    true,
                    AttestationConstants.TAG_ROLLBACK_RESISTANCE,
                    DERNull.INSTANCE,
                )
            )
        }
@@ -308,31 +286,19 @@ object AttestationBuilder {
        if (params.allowWhileOnBody == true) {
            list.add(
-                DERTaggedObject(
+                DERTaggedObject(true, AttestationConstants.TAG_ALLOW_WHILE_ON_BODY, DERNull.INSTANCE)
                    true,
                    AttestationConstants.TAG_ALLOW_WHILE_ON_BODY,
                    DERNull.INSTANCE,
                )
            )
        }
        if (params.trustedUserPresenceRequired == true && attestVersion >= 3) {
            list.add(
-                DERTaggedObject(
+                DERTaggedObject(true, AttestationConstants.TAG_TRUSTED_USER_PRESENCE_REQUIRED, DERNull.INSTANCE)
                    true,
                    AttestationConstants.TAG_TRUSTED_USER_PRESENCE_REQUIRED,
                    DERNull.INSTANCE,
                )
            )
        }
        if (params.trustedConfirmationRequired == true && attestVersion >= 3) {
            list.add(
-                DERTaggedObject(
+                DERTaggedObject(true, AttestationConstants.TAG_TRUSTED_CONFIRMATION_REQUIRED, DERNull.INSTANCE)
                    true,
                    AttestationConstants.TAG_TRUSTED_CONFIRMATION_REQUIRED,
                    DERNull.INSTANCE,
                )
            )
        }
@@ -462,7 +428,6 @@ object AttestationBuilder {
            )
        )
        // ATTESTATION_APPLICATION_ID is only included when an attestation challenge is present.
        if (params.attestationChallenge != null) {
            list.add(
                DERTaggedObject(
@@ -472,6 +437,7 @@ object AttestationBuilder {
                )
            )
        }
        if (AndroidDeviceUtils.getAttestVersion(securityLevel) >= 400) {
            list.add(
                DERTaggedObject(
@@ -482,8 +448,11 @@ object AttestationBuilder {
            )
        }
-        // Keystore2-enforced tags belong in softwareEnforced, not teeEnforced.
+        if (params.callerNonce == true) {
-        // The HAL does not enforce these; keystore2's authorize_create handles them.
+            list.add(
                DERTaggedObject(true, AttestationConstants.TAG_CALLER_NONCE, DERNull.INSTANCE)
            )
        }
        params.activeDateTime?.let {
            list.add(
                DERTaggedObject(true, AttestationConstants.TAG_ACTIVE_DATETIME, ASN1Integer(it.time))
@@ -491,38 +460,22 @@ object AttestationBuilder {
        }
        params.originationExpireDateTime?.let {
            list.add(
-                DERTaggedObject(
+                DERTaggedObject(true, AttestationConstants.TAG_ORIGINATION_EXPIRE_DATETIME, ASN1Integer(it.time))
                    true,
                    AttestationConstants.TAG_ORIGINATION_EXPIRE_DATETIME,
                    ASN1Integer(it.time),
                )
            )
        }
        params.usageExpireDateTime?.let {
            list.add(
-                DERTaggedObject(
+                DERTaggedObject(true, AttestationConstants.TAG_USAGE_EXPIRE_DATETIME, ASN1Integer(it.time))
                    true,
                    AttestationConstants.TAG_USAGE_EXPIRE_DATETIME,
                    ASN1Integer(it.time),
                )
            )
        }
        params.usageCountLimit?.let {
            list.add(
-                DERTaggedObject(
+                DERTaggedObject(true, AttestationConstants.TAG_USAGE_COUNT_LIMIT, ASN1Integer(it.toLong()))
                    true,
                    AttestationConstants.TAG_USAGE_COUNT_LIMIT,
                    ASN1Integer(it.toLong()),
                )
            )
        }
        if (params.unlockedDeviceRequired == true) {
            list.add(
-                DERTaggedObject(
+                DERTaggedObject(true, AttestationConstants.TAG_UNLOCKED_DEVICE_REQUIRED, DERNull.INSTANCE)
                    true,
                    AttestationConstants.TAG_UNLOCKED_DEVICE_REQUIRED,
                    DERNull.INSTANCE,
                )
            )
        }
@@ -554,15 +507,9 @@ object AttestationBuilder {
     */
    @Throws(Throwable::class)
    internal fun createApplicationId(uid: Int): DEROctetString {
        // AOSP keystore_attestation_id.cpp: gather_attestation_application_id()
        // uses a hardcoded identity for AID_SYSTEM (1000) and AID_ROOT (0):
        //   packageName = "AndroidSystem", versionCode = 1, no signing digests.
        val appUid = uid % 100000
        if (appUid == 0 || appUid == 1000) {
-            return buildApplicationIdDer(
+            return buildApplicationIdDer(listOf("AndroidSystem" to 1L), emptySet())
                listOf("AndroidSystem" to 1L),
                emptySet(),
            )
        }
        val pm =
@@ -95,5 +95,5 @@ object AttestationConstants {
    // --- Other Constants ---
    // https://cs.android.com/android/platform/superproject/main/+/main:system/keymaster/km_openssl/attestation_record.cpp
-    const val CHALLENGE_LENGTH_LIMIT = 128 // kMaximumAttestationChallengeLength
+    const val CHALLENGE_LENGTH_LIMIT = 128
 }
@@ -16,6 +16,7 @@ import org.matrix.TEESimulator.logging.SystemLogger
 import org.matrix.TEESimulator.pki.KeyBox
 import org.matrix.TEESimulator.pki.KeyBoxManager
 import org.matrix.TEESimulator.util.toHex
 import java.util.Date
 /**
 * Handles the modification (patching) of Android Key Attestation extensions within certificates.
@@ -36,7 +37,12 @@ object AttestationPatcher {
     * @return A new, cryptographically valid, patched certificate chain. Returns the original chain
     *   on any failure.
     */
-    fun patchCertificateChain(originalChain: Array<Certificate>?, uid: Int): Array<Certificate> {
+    fun patchCertificateChain(
        originalChain: Array<Certificate>?,
        uid: Int,
        notBefore: Date? = null,
        notAfter: Date? = null,
    ): Array<Certificate> {
        if (originalChain.isNullOrEmpty()) {
            SystemLogger.error("Attempted to patch a null or empty certificate chain for UID $uid.")
            return originalChain ?: emptyArray()
@@ -63,6 +69,8 @@ object AttestationPatcher {
                        keybox,
                        originalLeaf.sigAlgName,
                        uid,
                        notBefore,
                        notAfter,
                    )
                // 4. Construct the NEW, VALID chain by prepending the patched leaf to the keybox's
@@ -111,17 +119,27 @@ object AttestationPatcher {
        keybox: KeyBox,
        sigAlgName: String,
        uid: Int,
        notBefore: Date? = null,
        notAfter: Date? = null,
    ): Certificate {
        // The issuer of our new leaf is the subject of the first certificate in our custom keybox
        // chain.
        val newIssuer = X509CertificateHolder(keybox.certificates[0].encoded).subject
        val effectiveNotBefore = notBefore ?: originalLeafHolder.notBefore
        val effectiveNotAfter = notAfter ?: originalLeafHolder.notAfter
        if (notBefore != null || notAfter != null) {
            SystemLogger.debug(
                "Overriding cert dates: notBefore=${effectiveNotBefore} (was ${originalLeafHolder.notBefore}), notAfter=${effectiveNotAfter} (was ${originalLeafHolder.notAfter})"
            )
        }
        val builder =
            X509v3CertificateBuilder(
                newIssuer,
                originalLeafHolder.serialNumber,
-                originalLeafHolder.notBefore,
+                effectiveNotBefore,
-                originalLeafHolder.notAfter,
+                effectiveNotAfter,
                originalLeafHolder.subject,
                originalLeafHolder.subjectPublicKeyInfo,
            )
@@ -146,7 +164,7 @@ object AttestationPatcher {
        // Log the signature of the newly created certificate to observe its non-deterministic
        // nature.
        val signatureBytes = (newCertificate as X509Certificate).signature
-        SystemLogger.verbose("Signature of patched leaf cert: ${signatureBytes.toHex()}")
+        SystemLogger.verbose { "Signature of patched leaf cert: ${signatureBytes.toHex()}" }
        return newCertificate
    }
@@ -268,8 +286,10 @@ object AttestationPatcher {
    private fun createPatchedAttestationExtension(parsed: ParsedAttestation, uid: Int): Extension {
        val (allFields, teeEnforcedMap, originalRootOfTrust) = parsed
-        var formattedString = allFields.joinToString(separator = ", ") { formatAsn1Primitive(it) }
+        SystemLogger.verbose {
-        SystemLogger.verbose("Original attestation data: ${formattedString}")
+            val formattedString = allFields.joinToString(separator = ", ") { formatAsn1Primitive(it) }
            "Original attestation data: $formattedString"
        }
        // Build the new Root of Trust and add/replace it in the map.
        val newRootOfTrust = AttestationBuilder.buildRootOfTrust(originalRootOfTrust)
@@ -296,8 +316,10 @@ object AttestationPatcher {
        allFields[AttestationConstants.KEY_DESCRIPTION_TEE_ENFORCED_INDEX] = sortedTeeEnforced
        val patchedSequence = DERSequence(allFields)
-        formattedString = patchedSequence.joinToString(separator = ", ") { formatAsn1Primitive(it) }
+        SystemLogger.verbose {
-        SystemLogger.verbose("Patched  attestation data: ${formattedString}")
+            val formattedString = patchedSequence.joinToString(separator = ", ") { formatAsn1Primitive(it) }
            "Patched  attestation data: $formattedString"
        }
        val patchedOctets = DEROctetString(patchedSequence)
        return Extension(ATTESTATION_OID, false, patchedOctets)
@@ -1,8 +1,13 @@
 package org.matrix.TEESimulator.attestation
 import android.annotation.SuppressLint
 import android.security.keystore.KeyGenParameterSpec
 import android.security.keystore.KeyProperties
 import java.security.KeyPairGenerator
 import java.security.KeyStore
 import java.security.SecureRandom
 import java.security.cert.X509Certificate
 import java.security.spec.ECGenParameterSpec
 import org.bouncycastle.asn1.ASN1Integer
 import org.bouncycastle.asn1.ASN1ObjectIdentifier
 import org.bouncycastle.asn1.ASN1OctetString
@@ -52,14 +57,55 @@ object DeviceAttestationService {
        val bootPatchLevel: Int?,
    )
    // A unique alias for the key used to perform the TEE functionality check.
    private const val TEE_CHECK_KEY_ALIAS = "TEESimulator_AttestationCheck"
    /**
     * Lazily determines if the device's TEE is functional by attempting to generate an
     * attestation-backed key pair. The result is cached.
     */
    val isTeeFunctional: Boolean by lazy { checkTeeFunctionality() }
    /**
     * Lazily fetches and parses attestation data from a genuinely generated certificate. The result
     * is cached. Returns null if the TEE is not functional or parsing fails.
     */
    val CachedAttestationData: AttestationData? by lazy { fetchAttestationData() }
    /**
     * Checks if the TEE is working correctly by generating a key in the Android Keystore with an
     * attestation challenge.
     *
     * @return `true` if a key with attestation was generated successfully, `false` otherwise.
     */
    private fun checkTeeFunctionality(): Boolean {
        SystemLogger.info("Performing TEE functionality check...")
        return try {
            val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
            val keyPairGenerator =
                KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, "AndroidKeyStore")
            // A random challenge is required for attestation.
            val challenge = ByteArray(16).apply { SecureRandom().nextBytes(this) }
            val spec =
                KeyGenParameterSpec.Builder(TEE_CHECK_KEY_ALIAS, KeyProperties.PURPOSE_SIGN)
                    .setAlgorithmParameterSpec(ECGenParameterSpec("secp256r1"))
                    .setDigests(KeyProperties.DIGEST_SHA256)
                    .setAttestationChallenge(challenge)
                    .build()
            keyPairGenerator.initialize(spec)
            keyPairGenerator.generateKeyPair()
            SystemLogger.info("TEE functionality check successful.")
            true
        } catch (e: Exception) {
            SystemLogger.warning("TEE functionality check failed.", e)
            false
        }
    }
    /**
     * Retrieves the attestation certificate generated during the TEE check. The key entry is
     * deleted after retrieval to clean up.
@@ -67,6 +113,8 @@ object DeviceAttestationService {
     * @return The leaf `X509Certificate` containing the attestation, or `null` if unavailable.
     */
    private fun getAttestationCertificate(): X509Certificate? {
        if (!isTeeFunctional) return null
        return try {
            val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
            val certChain = keyStore.getCertificateChain(TEE_CHECK_KEY_ALIAS)
@@ -100,11 +148,12 @@ object DeviceAttestationService {
            // The extension's value is an ASN.1 sequence.
            val keyDescriptionSeq = ASN1Sequence.getInstance(extension.extnValue.octets)
-            var formattedString =
+            SystemLogger.verbose {
-                keyDescriptionSeq.joinToString(separator = ", ") {
+                val formattedString = keyDescriptionSeq.joinToString(separator = ", ") {
                    AttestationPatcher.formatAsn1Primitive(it)
                }
-            SystemLogger.verbose("Cached attestation data: ${formattedString}")
+                "Cached attestation data: $formattedString"
            }
            val fields = keyDescriptionSeq.toArray()
            val attestVersion =
@@ -1,6 +1,7 @@
 package org.matrix.TEESimulator.attestation
 import android.hardware.security.keymint.*
 import android.hardware.security.keymint.KeyOrigin
 import java.math.BigInteger
 import java.util.Date
 import javax.security.auth.x500.X500Principal
@@ -16,12 +17,11 @@ import org.matrix.TEESimulator.logging.KeyMintParameterLogger
 // Reference:
 // https://cs.android.com/android/platform/superproject/main/+/main:system/security/keystore2/src/key_parameter.rs
 data class KeyMintAttestation(
    val keySize: Int,
    val algorithm: Int,
    val ecCurve: Int?,
    val ecCurveName: String,
    val keySize: Int,
    val origin: Int?,
    val noAuthRequired: Boolean?,
    val blockMode: List<Int>,
    val padding: List<Int>,
    val purpose: List<Int>,
@@ -41,12 +41,12 @@ data class KeyMintAttestation(
    val manufacturer: ByteArray?,
    val model: ByteArray?,
    val secondImei: ByteArray?,
    // Enforcement tags
    val activeDateTime: Date?,
    val originationExpireDateTime: Date?,
    val usageExpireDateTime: Date?,
    val usageCountLimit: Int?,
    val callerNonce: Boolean?,
    val nonce: ByteArray?,
    val unlockedDeviceRequired: Boolean?,
    val includeUniqueId: Boolean?,
    val rollbackResistance: Boolean?,
@@ -54,6 +54,7 @@ data class KeyMintAttestation(
    val allowWhileOnBody: Boolean?,
    val trustedUserPresenceRequired: Boolean?,
    val trustedConfirmationRequired: Boolean?,
    val noAuthRequired: Boolean?,
    val maxUsesPerBoot: Int?,
    val maxBootLevel: Int?,
    val minMacLength: Int?,
@@ -63,13 +64,11 @@ data class KeyMintAttestation(
    constructor(
        params: Array<KeyParameter>
    ) : this(
        keySize = params.findInteger(Tag.KEY_SIZE) ?: params.deriveKeySizeFromCurve(),
        // AOSP: [key_param(tag = ALGORITHM, field = Algorithm)]
        algorithm = params.findAlgorithm(Tag.ALGORITHM) ?: 0,
        // AOSP: [key_param(tag = KEY_SIZE, field = Integer)]
        // For EC keys, derive keySize from EC_CURVE when KEY_SIZE is absent.
        keySize = params.findInteger(Tag.KEY_SIZE) ?: params.deriveKeySizeFromCurve(),
        // AOSP: [key_param(tag = EC_CURVE, field = EcCurve)]
        ecCurve = params.findEcCurve(Tag.EC_CURVE),
        ecCurveName = params.deriveEcCurveName(),
@@ -77,9 +76,6 @@ data class KeyMintAttestation(
        // AOSP: [key_param(tag = ORIGIN, field = Origin)]
        origin = params.findOrigin(Tag.ORIGIN),
        // AOSP: [key_param(tag = NO_AUTH_REQUIRED, field = BoolValue)]
        noAuthRequired = params.findBoolean(Tag.NO_AUTH_REQUIRED),
        // AOSP: [key_param(tag = BLOCK_MODE, field = BlockMode)]
        blockMode = params.findAllBlockMode(Tag.BLOCK_MODE),
@@ -121,13 +117,12 @@ data class KeyMintAttestation(
        manufacturer = params.findBlob(Tag.ATTESTATION_ID_MANUFACTURER),
        model = params.findBlob(Tag.ATTESTATION_ID_MODEL),
        secondImei = params.findBlob(Tag.ATTESTATION_ID_SECOND_IMEI),
        // Enforcement tags
        activeDateTime = params.findDate(Tag.ACTIVE_DATETIME),
        originationExpireDateTime = params.findDate(Tag.ORIGINATION_EXPIRE_DATETIME),
        usageExpireDateTime = params.findDate(Tag.USAGE_EXPIRE_DATETIME),
        usageCountLimit = params.findInteger(Tag.USAGE_COUNT_LIMIT),
        callerNonce = params.findBoolean(Tag.CALLER_NONCE),
        nonce = params.findBlob(Tag.NONCE),
        unlockedDeviceRequired = params.findBoolean(Tag.UNLOCKED_DEVICE_REQUIRED),
        includeUniqueId = params.findBoolean(Tag.INCLUDE_UNIQUE_ID),
        rollbackResistance = params.findBoolean(Tag.ROLLBACK_RESISTANCE),
@@ -135,6 +130,7 @@ data class KeyMintAttestation(
        allowWhileOnBody = params.findBoolean(Tag.ALLOW_WHILE_ON_BODY),
        trustedUserPresenceRequired = params.findBoolean(Tag.TRUSTED_USER_PRESENCE_REQUIRED),
        trustedConfirmationRequired = params.findBoolean(Tag.TRUSTED_CONFIRMATION_REQUIRED),
        noAuthRequired = params.findBoolean(Tag.NO_AUTH_REQUIRED),
        maxUsesPerBoot = params.findInteger(Tag.MAX_USES_PER_BOOT),
        maxBootLevel = params.findInteger(Tag.MAX_BOOT_LEVEL),
        minMacLength = params.findInteger(Tag.MIN_MAC_LENGTH),
@@ -144,21 +140,13 @@ data class KeyMintAttestation(
        params.forEach { KeyMintParameterLogger.logParameter(it) }
    }
-    fun isAttestKey(): Boolean {
+    fun isAttestKey(): Boolean = purpose.size == 1 && purpose.contains(KeyPurpose.ATTEST_KEY)
        return purpose.size == 1 && purpose.contains(KeyPurpose.ATTEST_KEY)
    }
-    fun isImportKey(): Boolean {
+    fun isImportKey(): Boolean = origin == KeyOrigin.IMPORTED || origin == KeyOrigin.SECURELY_IMPORTED
        return origin == KeyOrigin.IMPORTED || origin == KeyOrigin.SECURELY_IMPORTED
    }
 }
 // --- Private helper extension functions for parsing KeyParameter arrays ---
 /** Maps to AOSP field = Integer */
 private fun Array<KeyParameter>.findBoolean(tag: Int): Boolean? =
    this.find { it.tag == tag }?.value?.boolValue
 /** Maps to AOSP field = Integer */
 private fun Array<KeyParameter>.findInteger(tag: Int): Int? =
    this.find { it.tag == tag }?.value?.integer
@@ -191,7 +179,7 @@ private fun Array<KeyParameter>.findBlob(tag: Int): ByteArray? =
 private fun Array<KeyParameter>.findAllBlockMode(tag: Int): List<Int> =
    this.filter { it.tag == tag }.map { it.value.blockMode }
-/** Maps to AOSP field = PaddingMode (Repeated) */
+/** Maps to AOSP field = BlockMode (Repeated) */
 private fun Array<KeyParameter>.findAllPaddingMode(tag: Int): List<Int> =
    this.filter { it.tag == tag }.map { it.value.paddingMode }
@@ -203,7 +191,9 @@ private fun Array<KeyParameter>.findAllKeyPurpose(tag: Int): List<Int> =
 private fun Array<KeyParameter>.findAllDigests(tag: Int): List<Int> =
    this.filter { it.tag == tag }.map { it.value.digest }
-/** Derives keySize from EC_CURVE tag when KEY_SIZE is not explicitly provided. */
+private fun Array<KeyParameter>.findBoolean(tag: Int): Boolean? =
    if (this.any { it.tag == tag }) true else null
 private fun Array<KeyParameter>.deriveKeySizeFromCurve(): Int {
    val curveId = this.find { it.tag == Tag.EC_CURVE }?.value?.ecCurve ?: return 0
    return when (curveId) {
@@ -7,6 +7,7 @@ import android.os.IBinder
 import android.os.ServiceManager
 import java.io.File
 import java.util.concurrent.ConcurrentHashMap
 import org.matrix.TEESimulator.attestation.DeviceAttestationService
 import org.matrix.TEESimulator.logging.SystemLogger
 import org.matrix.TEESimulator.pki.KeyBoxManager
@@ -65,7 +66,6 @@ object ConfigurationManager {
        // Initial load of all configuration files.
        loadTargetPackages(File(configRoot, TARGET_PACKAGES_FILE))
        loadPatchLevelConfig(File(configRoot, PATCH_LEVEL_FILE))
        // Start watching for any subsequent file changes.
        ConfigObserver.startWatching()
        SystemLogger.info("Configuration initialized and file observer started.")
@@ -83,7 +83,6 @@ object ConfigurationManager {
        return packages.firstNotNullOfOrNull { pkg -> packageKeyboxes[pkg] } ?: DEFAULT_KEYBOX_FILE
    }
    /** Determines if the certificate for a given UID needs to be patched. */
    fun shouldPatch(uid: Int): Boolean {
        val mode = getPackageModeForUid(uid)
        return mode == Mode.PATCH || mode == Mode.AUTO
@@ -92,13 +91,10 @@ object ConfigurationManager {
    /** Determines if a new certificate needs to be generated for a given UID. */
    fun shouldGenerate(uid: Int): Boolean = getPackageModeForUid(uid) == Mode.GENERATE
    /** Determines if no operation is needed for a given UID. */
    fun shouldSkipUid(uid: Int): Boolean = getPackageModeForUid(uid) == null
    /** Determines if the UID is in AUTO mode (no explicit ! or ? suffix). */
    fun isAutoMode(uid: Int): Boolean = getPackageModeForUid(uid) == Mode.AUTO
    /** Resolves the operating mode for a given UID based on its packages and the TEE status. */
    private fun getPackageModeForUid(uid: Int): Mode? {
        val packages = getPackagesForUid(uid)
        if (packages.isEmpty()) return null
@@ -107,7 +103,7 @@ object ConfigurationManager {
            when (packageModes[pkg]) {
                Mode.GENERATE -> return Mode.GENERATE
                Mode.PATCH -> return Mode.PATCH
-                Mode.AUTO -> return Mode.AUTO
+                Mode.AUTO -> return if (DeviceAttestationService.isTeeFunctional) Mode.PATCH else Mode.GENERATE
                null -> continue
            }
        }
@@ -156,25 +152,24 @@ object ConfigurationManager {
                    return@forEach
                }
                val mode: Mode
                val rawPkg: String
                when {
                    // Suffix '!' means force GENERATE mode.
                    trimmedLine.endsWith("!") -> {
-                        mode = Mode.GENERATE
+                        val pkg = trimmedLine.removeSuffix("!").trim()
-                        rawPkg = trimmedLine.removeSuffix("!").trim()
+                        newModes[pkg] = Mode.GENERATE
                        newKeyboxes[pkg] = currentKeybox
                    }
                    // Suffix '?' means force PATCH mode.
                    trimmedLine.endsWith("?") -> {
-                        mode = Mode.PATCH
+                        val pkg = trimmedLine.removeSuffix("?").trim()
-                        rawPkg = trimmedLine.removeSuffix("?").trim()
+                        newModes[pkg] = Mode.PATCH
                        newKeyboxes[pkg] = currentKeybox
                    }
                    else -> {
-                        mode = Mode.AUTO
+                        newModes[trimmedLine] = Mode.AUTO
-                        rawPkg = trimmedLine
+                        newKeyboxes[trimmedLine] = currentKeybox
                    }
                }
                newModes[rawPkg] = mode
                newKeyboxes[rawPkg] = currentKeybox
            }
            // Atomically update the configuration maps.
@@ -251,7 +246,14 @@ object ConfigurationManager {
            }
            // Parse global and per-package configurations.
-            val newGlobalLevel = parseLines(contextLines[""])
+            var newGlobalLevel = parseLines(contextLines[""])
            // TrickyAddon writes Pixel bulletin dates for boot/vendor but system=prop
            // resolves to the real device prop — force boot/vendor through the same path
            // to prevent cross-component date mismatches on non-Pixel devices.
            if (newGlobalLevel?.system.equals("prop", ignoreCase = true)) {
                SystemLogger.info("system=prop: forcing boot/vendor to derive from device props (were: boot=${newGlobalLevel?.boot}, vendor=${newGlobalLevel?.vendor})")
                newGlobalLevel = newGlobalLevel?.copy(boot = "prop", vendor = "prop")
            }
            contextLines.remove("") // Remove global context to iterate over packages next
            for ((pkg, lines) in contextLines) {
@@ -282,8 +284,10 @@ object ConfigurationManager {
            val file = if (event != DELETE) File(configRoot, path) else null
            when (path) {
-                TARGET_PACKAGES_FILE -> loadTargetPackages(file!!)
+                TARGET_PACKAGES_FILE -> file?.let { loadTargetPackages(it) }
-                PATCH_LEVEL_FILE -> loadPatchLevelConfig(file!!)
+                    ?: SystemLogger.warning("$TARGET_PACKAGES_FILE was deleted.")
                PATCH_LEVEL_FILE -> file?.let { loadPatchLevelConfig(it) }
                    ?: SystemLogger.warning("$PATCH_LEVEL_FILE was deleted.")
                // Any change to an XML file is assumed to be a keybox.
                // The cache in KeyBoxManager will handle reloading it on its next use.
                else ->
@@ -326,8 +330,6 @@ object ConfigurationManager {
        return iPackageManager
    }
    /** Checks if any package belonging to the UID holds the given permission. */
    /** Checks a SELinux permission for a caller identified by PID against the keystore context. */
    fun checkSELinuxPermission(callingPid: Int, tclass: String, perm: String): Boolean {
        return try {
            val callerCtx =
@@ -340,7 +342,6 @@ object ConfigurationManager {
        }
    }
    /** Checks if any package belonging to the UID holds the given permission. */
    fun hasPermissionForUid(uid: Int, permission: String): Boolean {
        val userId = uid / 100000
        return getPackagesForUid(uid).any { pkg ->
@@ -352,7 +353,6 @@ object ConfigurationManager {
        }
    }
    /** Retrieves the package names associated with a UID. */
    fun getPackagesForUid(uid: Int): Array<String> {
        return uidToPackagesCache.getOrPut(uid) {
            try {
@@ -293,12 +293,6 @@ abstract class BinderInterceptor : Binder() {
            }
        }
        /**
         * Uses the backdoor binder to register an interceptor for a specific target service.
         *
         * @param filteredCodes If non-empty, only these transaction codes will be intercepted at
         *   the native level. All other codes pass through without the round-trip to Java.
         */
        fun register(
            backdoor: IBinder,
            target: IBinder,
@@ -68,13 +68,8 @@ abstract class AbstractKeystoreInterceptor : BinderInterceptor() {
        }
    }
    /**
     * Transaction codes this interceptor needs to handle at the native level. Override in
     * subclasses to filter; empty means intercept everything (legacy behavior).
     */
    protected open val interceptedCodes: IntArray = intArrayOf()
    /** Registers this interceptor with the native hook layer and sets up a death recipient. */
    private fun setupInterceptor(service: IBinder, backdoor: IBinder) {
        keystoreService = service
        SystemLogger.info("Registering interceptor for service: $serviceName")
@@ -23,7 +23,7 @@ object InterceptorUtils {
        val parcel = Parcel.obtain().apply {
            writeInt(EX_SERVICE_SPECIFIC)
            writeString(null)
-            writeInt(0)
+            writeInt(0) // empty remote stack trace header (AOSP Status.cpp:196)
            writeInt(errorCode)
        }
        return BinderInterceptor.TransactionResult.OverrideReply(parcel)
@@ -130,10 +130,6 @@ object InterceptorUtils {
        return exception != null
    }
    /**
     * Creates an `OverrideReply` that writes a `ServiceSpecificException` with the given error
     * code via EX_SERVICE_SPECIFIC.
     */
    fun createServiceSpecificErrorReply(
        errorCode: Int
    ): BinderInterceptor.TransactionResult.OverrideReply {
@@ -144,14 +140,6 @@ object InterceptorUtils {
        return BinderInterceptor.TransactionResult.OverrideReply(parcel)
    }
    /**
     * Patches the system-level authorization values (OS_PATCHLEVEL, VENDOR_PATCHLEVEL,
     * BOOT_PATCHLEVEL) in an authorization array to match the configured patch levels for the
     * given calling UID. Each authorization's original [Authorization.securityLevel] is preserved.
     *
     * When a patch level is configured as "no" ([AndroidDeviceUtils.DO_NOT_REPORT]), the original
     * hardware value is kept as-is.
     */
    fun patchAuthorizations(
        authorizations: Array<Authorization>?,
        callingUid: Int,
@@ -6,17 +6,16 @@ import android.os.Build
 import android.os.IBinder
 import android.os.Parcel
 import android.system.keystore2.Domain
 import android.system.keystore2.IKeystoreSecurityLevel
 import android.system.keystore2.IKeystoreService
 import android.system.keystore2.KeyDescriptor
 import android.system.keystore2.KeyEntryResponse
 import java.security.SecureRandom
 import java.security.cert.Certificate
 import java.util.Collections
 import java.util.concurrent.ConcurrentHashMap
 import org.matrix.TEESimulator.attestation.AttestationPatcher
 import org.matrix.TEESimulator.attestation.KeyMintAttestation
 import org.matrix.TEESimulator.config.ConfigurationManager
 import org.matrix.TEESimulator.interception.keystore.shim.GeneratedKeyPersistence
 import org.matrix.TEESimulator.interception.keystore.shim.KeyMintSecurityLevelInterceptor
 import org.matrix.TEESimulator.logging.KeyMintParameterLogger
 import org.matrix.TEESimulator.logging.SystemLogger
@@ -49,8 +48,6 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
        else null
    private val GET_NUMBER_OF_ENTRIES_TRANSACTION =
        InterceptorUtils.getTransactCode(stubBinderClass, "getNumberOfEntries")
    private val GET_SECURITY_LEVEL_TRANSACTION =
        InterceptorUtils.getTransactCode(stubBinderClass, "getSecurityLevel")
    private val transactionNames: Map<Int, String> by lazy {
        stubBinderClass.declaredFields
@@ -61,20 +58,10 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
            .associate { field -> (field.get(null) as Int) to field.name.split("_")[1] }
    }
-    // Keys whose certs were updated via updateSubcomponent; skip re-patching on getKeyEntry.
+    private const val RESPONSE_KEY_NOT_FOUND = 7
    private val deletedSoftwareKeys: MutableSet<KeyIdentifier> = ConcurrentHashMap.newKeySet()
    private val userUpdatedKeys = ConcurrentHashMap.newKeySet<KeyIdentifier>()
    // Backdoor binder for registering new interceptors at runtime.
    private var backdoorBinder: IBinder? = null
    // Per-security-level interceptor instances, keyed by SecurityLevel constant.
    private val securityLevelInterceptors = ConcurrentHashMap<Int, KeyMintSecurityLevelInterceptor>()
    // Identity set of SecurityLevel binders already registered with the native hook,
    // tracked by System.identityHashCode to avoid re-registering the same BBinder.
    private val registeredSecurityLevelBinders: MutableSet<Int> =
        Collections.newSetFromMap(ConcurrentHashMap())
    override val serviceName = "android.system.keystore2.IKeystoreService/default"
    override val processName = "keystore2"
    override val injectionCommand = "exec ./inject `pidof keystore2` libTEESimulator.so entry"
@@ -87,7 +74,6 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                LIST_ENTRIES_TRANSACTION,
                LIST_ENTRIES_BATCHED_TRANSACTION,
                GET_NUMBER_OF_ENTRIES_TRANSACTION,
                GET_SECURITY_LEVEL_TRANSACTION,
            )
            .toIntArray()
    }
@@ -97,7 +83,6 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
     * security level sub-services (e.g., TEE, StrongBox).
     */
    override fun onInterceptorReady(service: IBinder, backdoor: IBinder) {
        backdoorBinder = backdoor
        val keystoreInterface = IKeystoreService.Stub.asInterface(service)
        setupSecurityLevelInterceptors(keystoreInterface, backdoor)
    }
@@ -109,11 +94,11 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                    SystemLogger.info("Found TEE SecurityLevel. Registering interceptor...")
                    val interceptor =
                        KeyMintSecurityLevelInterceptor(tee, SecurityLevel.TRUSTED_ENVIRONMENT)
-                    securityLevelInterceptors[SecurityLevel.TRUSTED_ENVIRONMENT] = interceptor
+                    register(
                    registerSecurityLevelBinder(
                        backdoor,
                        tee.asBinder(),
                        interceptor,
                        KeyMintSecurityLevelInterceptor.INTERCEPTED_CODES,
                    )
                    interceptor.loadPersistedKeys()
                }
@@ -126,11 +111,11 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                    SystemLogger.info("Found StrongBox SecurityLevel. Registering interceptor...")
                    val interceptor =
                        KeyMintSecurityLevelInterceptor(strongbox, SecurityLevel.STRONGBOX)
-                    securityLevelInterceptors[SecurityLevel.STRONGBOX] = interceptor
+                    register(
                    registerSecurityLevelBinder(
                        backdoor,
                        strongbox.asBinder(),
                        interceptor,
                        KeyMintSecurityLevelInterceptor.INTERCEPTED_CODES,
                    )
                    interceptor.loadPersistedKeys()
                }
@@ -138,30 +123,6 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
            .onFailure { SystemLogger.error("Failed to intercept StrongBox SecurityLevel.", it) }
    }
    /**
     * Registers an interceptor for a SecurityLevel binder, tracking the binder identity
     * to avoid duplicate registrations when keystore2 returns the same BBinder.
     */
    private fun registerSecurityLevelBinder(
        backdoor: IBinder,
        binder: IBinder,
        interceptor: KeyMintSecurityLevelInterceptor,
    ) {
        val identity = System.identityHashCode(binder)
        if (registeredSecurityLevelBinders.add(identity)) {
            register(
                backdoor,
                binder,
                interceptor,
                KeyMintSecurityLevelInterceptor.INTERCEPTED_CODES,
            )
        } else {
            SystemLogger.debug(
                "SecurityLevel binder $binder (identity=$identity) already registered, skipping."
            )
        }
    }
    override fun onPreTransact(
        txId: Long,
        target: IBinder,
@@ -184,9 +145,23 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
            if (isGMS || ConfigurationManager.shouldSkipUid(callingUid)) {
                return TransactionResult.ContinueAndSkipPost
            } else {
                return TransactionResult.Continue
            }
            return runCatching {
                    val isBatchMode = code == LIST_ENTRIES_BATCHED_TRANSACTION
                    if (ListEntriesHandler.cacheParameters(txId, data, isBatchMode)) {
                        TransactionResult.Continue
                    } else {
                        TransactionResult.ContinueAndSkipPost
                    }
                }
                .getOrElse {
                    SystemLogger.error(
                        "[TX_ID: $txId] Failed to parse parameters for ${transactionNames[code]!!}",
                        it,
                    )
                    TransactionResult.ContinueAndSkipPost
                }
        } else if (
            code == GET_KEY_ENTRY_TRANSACTION ||
                code == DELETE_KEY_TRANSACTION ||
@@ -206,7 +181,6 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                    ?: return TransactionResult.ContinueAndSkipPost
            if (code == DELETE_KEY_TRANSACTION) {
                // Handle delete by alias (APP domain) or nspace (KEY_ID domain).
                val keyId =
                    if (descriptor.alias != null) {
                        KeyIdentifier(callingUid, descriptor.alias)
@@ -225,6 +199,7 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                        KeyMintSecurityLevelInterceptor.generatedKeys.containsKey(keyId)
                    KeyMintSecurityLevelInterceptor.cleanupKeyData(keyId)
                    if (isSoftwareKey) {
                        deletedSoftwareKeys.add(keyId)
                        SystemLogger.info(
                            "[TX_ID: $txId] Deleted cached keypair ${keyId.alias}, replying with empty response."
                        )
@@ -239,9 +214,14 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
            }
            val keyId = KeyIdentifier(callingUid, descriptor.alias)
-            val response =
+            val response = KeyMintSecurityLevelInterceptor.getGeneratedKeyResponse(keyId)
-                KeyMintSecurityLevelInterceptor.getGeneratedKeyResponse(keyId)
+            if (response == null) {
-                    ?: return TransactionResult.Continue
+                if (deletedSoftwareKeys.remove(keyId)) {
                    SystemLogger.info("[TX_ID: $txId] Returning KEY_NOT_FOUND for deleted key ${descriptor.alias}")
                    return InterceptorUtils.createErrorReply(RESPONSE_KEY_NOT_FOUND)
                }
                return TransactionResult.Continue
            }
            if (KeyMintSecurityLevelInterceptor.isAttestationKey(keyId))
                SystemLogger.info("${descriptor.alias} was an attestation key")
@@ -251,13 +231,6 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                KeyMintParameterLogger.logParameter(it.keyParameter)
            }
            return InterceptorUtils.createTypedObjectReply(response)
        } else if (code == GET_SECURITY_LEVEL_TRANSACTION) {
            // Pass through to post-hook so we can register interceptors for newly-created
            // SecurityLevel binders. keystore2 may create a new BBinder per call, so the
            // initial registration in setupSecurityLevelInterceptors might not cover all
            // binder instances that clients receive.
            logTransaction(txId, "getSecurityLevel", callingUid, callingPid)
            return TransactionResult.Continue
        } else {
            logTransaction(
                txId,
@@ -286,10 +259,6 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
        if (target != keystoreService || reply == null || InterceptorUtils.hasException(reply))
            return TransactionResult.SkipTransaction
        if (code == GET_SECURITY_LEVEL_TRANSACTION) {
            return handlePostGetSecurityLevel(txId, data, reply)
        }
        if (code == GET_NUMBER_OF_ENTRIES_TRANSACTION) {
            logTransaction(txId, "post-${transactionNames[code]!!}", callingUid, callingPid)
            return runCatching {
@@ -313,12 +282,8 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
            logTransaction(txId, "post-${transactionNames[code]!!}", callingUid, callingPid)
            return runCatching {
                    val isBatchMode = code == LIST_ENTRIES_BATCHED_TRANSACTION
                    val params =
                        ListEntriesHandler.cacheParameters(txId, data, isBatchMode)
                            ?: throw Exception("Abort updating entries for invalid parameters.")
                    val updatedKeyDescriptors =
-                        ListEntriesHandler.injectGeneratedKeys(txId, callingUid, params, reply)
+                        ListEntriesHandler.injectGeneratedKeys(txId, callingUid, reply)
                    InterceptorUtils.createTypedArrayReply(updatedKeyDescriptors)
                }
                .getOrElse {
@@ -348,8 +313,8 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                    val response = reply.readTypedObject(KeyEntryResponse.CREATOR)!!
                    val keyId = KeyIdentifier(callingUid, keyDescriptor.alias)
                    // Skip patching for keys whose certs were explicitly set via updateSubcomponent.
                    if (userUpdatedKeys.remove(keyId)) {
                        SystemLogger.trace { "[TRACE-$txId] getKeyEntry $keyId: userUpdated=true, skipping patch" }
                        SystemLogger.debug("[TX_ID: $txId] Skipping cert patch for user-updated key $keyId.")
                        return TransactionResult.SkipTransaction
                    }
@@ -360,13 +325,36 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                            authorizations?.map { it.keyParameter }?.toTypedArray() ?: emptyArray()
                        )
-                    if (parsedParameters.isAttestKey() &&
+                    SystemLogger.trace { "[TRACE-$txId] getKeyEntry $keyId: isImport=${parsedParameters.isImportKey()} origin=${parsedParameters.origin} inImportedKeys=${KeyMintSecurityLevelInterceptor.importedKeys.contains(keyId)} hasPatchedChain=${KeyMintSecurityLevelInterceptor.getPatchedChain(keyId) != null} isAttestKey=${parsedParameters.isAttestKey()}" }
-                        !KeyMintSecurityLevelInterceptor.importedKeys.contains(keyId)
+
-                    ) {
+                    if (parsedParameters.isImportKey()) {
                        val retainedChain = KeyMintSecurityLevelInterceptor.getPatchedChain(keyId)
                        if (retainedChain == null) {
                            SystemLogger.trace { "[TRACE-$txId] getKeyEntry $keyId: imported, no retained chain, skip" }
                            SystemLogger.info("[TX_ID: $txId] Skip patching for imported key (no prior attestation).")
                            return TransactionResult.SkipTransaction
                        }
                        SystemLogger.trace { "[TRACE-$txId] getKeyEntry $keyId: imported, SERVING RETAINED CHAIN (detection vector!)" }
                        SystemLogger.info("[TX_ID: $txId] Imported key overwrote attested alias, serving retained chain for $keyId")
                        CertificateHelper.updateCertificateChain(response.metadata, retainedChain).getOrThrow()
                        response.metadata.authorizations =
                            InterceptorUtils.patchAuthorizations(
                                response.metadata.authorizations,
                                callingUid,
                            )
                        return InterceptorUtils.createTypedObjectReply(response)
                    }
                    if (KeyMintSecurityLevelInterceptor.importedKeys.contains(keyId)) {
                        SystemLogger.trace { "[TRACE-$txId] getKeyEntry $keyId: in importedKeys set, skip" }
                        SystemLogger.debug("[TX_ID: $txId] Skipping attest-key override for imported key $keyId")
                        return TransactionResult.SkipTransaction
                    }
                    if (parsedParameters.isAttestKey()) {
                        SystemLogger.warning(
                            "[TX_ID: $txId] Found hardware attest key ${keyId.alias} in the reply."
                        )
                        // Attest keys that are not under our control should be overriden.
                        val keyData =
                            CertificateGenerator.generateAttestedKeyPair(
                                callingUid,
@@ -398,12 +386,26 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                                parsedParameters,
                            )
                        KeyMintSecurityLevelInterceptor.attestationKeys.add(keyId)
                        GeneratedKeyPersistence.save(
                            keyId = keyId,
                            keyPair = keyData.first,
                            nspace = newNspace,
                            securityLevel = response.metadata.keySecurityLevel,
                            certChain = keyData.second,
                            algorithm = parsedParameters.algorithm,
                            keySize = parsedParameters.keySize,
                            ecCurve = parsedParameters.ecCurve ?: 0,
                            purposes = parsedParameters.purpose,
                            digests = parsedParameters.digest,
                            isAttestationKey = true,
                        )
                        return InterceptorUtils.createTypedObjectReply(response)
                    }
                    val originalChain = CertificateHelper.getCertificateChain(response)
                    // Check if we should perform attestation patch.
                    if (originalChain == null || originalChain.size < 2) {
                        SystemLogger.info(
                            "[TX_ID: $txId] Skip patching short certificate chain of length ${originalChain?.size}."
@@ -411,8 +413,6 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                        return TransactionResult.SkipTransaction
                    }
                    // First, try to retrieve the already-patched chain from our cache to ensure
                    // consistency.
                    val cachedChain = KeyMintSecurityLevelInterceptor.getPatchedChain(keyId)
                    val finalChain: Array<Certificate>
@@ -422,16 +422,12 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                        )
                        finalChain = cachedChain
                    } else {
                        // If no chain is cached (e.g., key existed before simulator started),
                        // perform a live patch as a fallback. This may still be detectable.
                        SystemLogger.info(
                            "[TX_ID: $txId] No cached chain for $keyId. Performing live patch as a fallback."
                        )
                        finalChain =
                            AttestationPatcher.patchCertificateChain(originalChain, callingUid)
                        KeyMintSecurityLevelInterceptor.patchedChains[keyId] = finalChain
                        SystemLogger.debug("Cached patched certificate chain for $keyId.")
                    }
                    CertificateHelper.updateCertificateChain(response.metadata, finalChain)
@@ -460,13 +456,11 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
        val descriptor = data.readTypedObject(KeyDescriptor.CREATOR)
            ?: return TransactionResult.ContinueAndSkipPost
        // Resolve by nspace (KEY_ID) or alias (APP), same as createOperation.
        val generatedKeyInfo =
            when (descriptor.domain) {
                Domain.KEY_ID ->
                    KeyMintSecurityLevelInterceptor.findGeneratedKeyByKeyId(
-                        callingUid,
+                        callingUid, descriptor.nspace
                        descriptor.nspace,
                    )
                Domain.APP ->
                    descriptor.alias?.let {
@@ -476,8 +470,11 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
            }
        if (generatedKeyInfo == null) {
-            // Hardware key: mark so getKeyEntry skips cert re-patching.
+            descriptor.alias?.let {
-            descriptor.alias?.let { userUpdatedKeys.add(KeyIdentifier(callingUid, it)) }
+                val kid = KeyIdentifier(callingUid, it)
                userUpdatedKeys.add(kid)
                SystemLogger.trace { "[TRACE] updateSubcomponent $kid: not generated key, added to userUpdatedKeys" }
            }
            return TransactionResult.ContinueAndSkipPost
        }
@@ -488,73 +485,13 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
        metadata.certificate = publicCert
        metadata.certificateChain = certificateChain
        GeneratedKeyPersistence.rePersistIfNeeded(callingUid, generatedKeyInfo)
        SystemLogger.verbose(
            "Key updated with sizes: [publicCert, certificateChain] = [${publicCert?.size}, ${certificateChain?.size}]"
        )
        return InterceptorUtils.createSuccessReply(writeResultCode = false)
    }
    /**
     * Intercepts the reply from getSecurityLevel to dynamically register our interceptor
     * for the returned IKeystoreSecurityLevel binder.
     *
     * keystore2 may create a new BBinder for each getSecurityLevel call, so the binder
     * registered during initial setup (in setupSecurityLevelInterceptors) might not be the
     * same one that client apps receive. By intercepting every getSecurityLevel reply, we
     * ensure that all SecurityLevel binders are covered.
     */
    private fun handlePostGetSecurityLevel(
        txId: Long,
        data: Parcel,
        reply: Parcel,
    ): TransactionResult {
        val backdoor = backdoorBinder
        if (backdoor == null) {
            SystemLogger.warning("[TX_ID: $txId] post-getSecurityLevel: backdoor not available")
            return TransactionResult.SkipTransaction
        }
        return runCatching {
            // Read the security level argument from the original request.
            data.enforceInterface(IKeystoreService.DESCRIPTOR)
            val requestedLevel = data.readInt()
            // hasException already consumed the exception header from the reply.
            // Next item is the IKeystoreSecurityLevel binder.
            val secLevelBinder = reply.readStrongBinder()
            if (secLevelBinder == null) {
                SystemLogger.verbose(
                    "[TX_ID: $txId] getSecurityLevel($requestedLevel) returned null binder"
                )
                return@runCatching TransactionResult.SkipTransaction
            }
            // Only intercept TEE and StrongBox security levels.
            if (requestedLevel != SecurityLevel.TRUSTED_ENVIRONMENT &&
                requestedLevel != SecurityLevel.STRONGBOX
            ) {
                return@runCatching TransactionResult.SkipTransaction
            }
            // Get or create the interceptor for this security level. The interceptor may not
            // exist yet if the initial setupSecurityLevelInterceptors call failed for this level.
            val interceptor = securityLevelInterceptors.getOrPut(requestedLevel) {
                val secLevelInterface =
                    IKeystoreSecurityLevel.Stub.asInterface(secLevelBinder)
                SystemLogger.info(
                    "[TX_ID: $txId] Late-creating interceptor for security level $requestedLevel"
                )
                KeyMintSecurityLevelInterceptor(secLevelInterface, requestedLevel).also {
                    it.loadPersistedKeys()
                }
            }
            registerSecurityLevelBinder(backdoor, secLevelBinder, interceptor)
            TransactionResult.SkipTransaction
        }.getOrElse {
            SystemLogger.error("[TX_ID: $txId] Failed to process post-getSecurityLevel.", it)
            TransactionResult.SkipTransaction
        }
    }
 }
@@ -399,18 +399,17 @@ private data class LegacyKeygenParameters(
    /**
     * Converts the legacy parameters into the modern [KeyMintAttestation] data structure, which is
-     * required by [AttestationBuilder] and [CertificateGenerator].
+     * required by the refactored [AttestationBuilder] and [CertificateGenerator].
     */
    fun toKeyMintAttestation(): KeyMintAttestation {
        // This conversion acts as a bridge, allowing our new generic components
        // to be used by the legacy interceptor.
        return KeyMintAttestation(
            algorithm = this.algorithm,
            ecCurve = 0, // Not explicitly available in legacy args, but not critical
            ecCurveName = this.ecCurveName ?: "",
            keySize = this.keySize,
-            origin = null, // Not needed to build attestaion
+            algorithm = this.algorithm,
-            noAuthRequired = null,
+            ecCurve = 0,
            ecCurveName = this.ecCurveName ?: "",
            origin = null,
            blockMode = listOf<Int>(),
            padding = listOf<Int>(),
            purpose = this.purpose,
@@ -437,6 +436,7 @@ private data class LegacyKeygenParameters(
            usageExpireDateTime = null,
            usageCountLimit = null,
            callerNonce = null,
            nonce = null,
            unlockedDeviceRequired = null,
            includeUniqueId = null,
            rollbackResistance = null,
@@ -444,6 +444,7 @@ private data class LegacyKeygenParameters(
            allowWhileOnBody = null,
            trustedUserPresenceRequired = null,
            trustedConfirmationRequired = null,
            noAuthRequired = null,
            maxUsesPerBoot = null,
            maxBootLevel = null,
            minMacLength = null,
@@ -5,6 +5,7 @@ import android.system.keystore2.Domain
 import android.system.keystore2.IKeystoreService
 import android.system.keystore2.KeyDescriptor
 import java.util.TreeMap
 import java.util.concurrent.ConcurrentHashMap
 import org.matrix.TEESimulator.interception.keystore.shim.KeyMintSecurityLevelInterceptor
 import org.matrix.TEESimulator.logging.SystemLogger
@@ -21,6 +22,15 @@ object ListEntriesHandler {
    // Estimate for maximum size of a Binder response in bytes.
    private const val RESPONSE_SIZE_LIMIT = 358400
    // Parameters of AOSP function `list_key_entries` in utils.rs.
    private data class ListEntriesParams(
        val domain: Int,
        val namespace: Long,
        val startPastAlias: String?,
    )
    private val pendingParams = ConcurrentHashMap<Long, ListEntriesParams>()
    // Based on AOSP function `estimate_safe_amount_to_return` in utils.rs.
    private fun estimateSafeAmountToReturn(
        keyDescriptors: Array<KeyDescriptor>,
@@ -50,7 +60,7 @@ object ListEntriesHandler {
    }
    // Parse and store parameters for later use (in post-transaction).
-    fun cacheParameters(txId: Long, data: Parcel, isBatchMode: Boolean): ListEntriesParams? {
+    fun cacheParameters(txId: Long, data: Parcel, isBatchMode: Boolean): Boolean {
        data.enforceInterface(IKeystoreService.DESCRIPTOR)
        val domain = data.readInt()
@@ -61,21 +71,20 @@ object ListEntriesHandler {
        // See AOSP function `get_key_descriptor_for_lookup` in service.rs.
        // Note that all generated keys belong to Domain::APP.
        if (domain == Domain.APP) {
-            val params = ListEntriesParams(domain, namespace, startPastAlias)
+            pendingParams[txId] = ListEntriesParams(domain, namespace, startPastAlias)
-            SystemLogger.debug("[TX_ID: $txId] Cached $params.")
+            SystemLogger.debug("[TX_ID: $txId] Cached ${pendingParams[txId]}.")
-            return params
+            return true
        }
-        return null
+        return false
    }
    // Merge software-backed keys with hardware-backed keys in the reply parcel.
-    fun injectGeneratedKeys(
+    fun injectGeneratedKeys(txId: Long, callingUid: Int, reply: Parcel): Array<KeyDescriptor> {
-        txId: Long,
+        val params =
-        callingUid: Int,
+            pendingParams.remove(txId)
-        params: ListEntriesParams,
+                ?: throw IllegalStateException("No params found for listing entries")
-        reply: Parcel,
+
    ): Array<KeyDescriptor> {
        // By default we use the calling uid as namespace if domain is Domain::APP.
        // The namespace parameter is thus ignored for non-privileged applications.
        // See AOSP function `get_key_descriptor_for_lookup` in service.rs.
@@ -131,6 +140,3 @@ object ListEntriesHandler {
            }
    }
 }
 // Parameters of AOSP function `list_key_entries` in utils.rs.
 data class ListEntriesParams(val domain: Int, val namespace: Long, val startPastAlias: String?)
@@ -0,0 +1,74 @@
 package org.matrix.TEESimulator.interception.keystore.shim
 import android.hardware.security.keymint.Algorithm
 import android.hardware.security.keymint.KeyPurpose
 import android.hardware.security.keymint.KeyParameter
 import android.hardware.security.keymint.Tag
 import org.matrix.TEESimulator.attestation.KeyMintAttestation
 object AuthorizeCreate {
    fun check(
        keyParams: KeyMintAttestation?,
        opParams: KeyMintAttestation,
        rawOpParams: Array<KeyParameter>? = null,
    ): Int? {
        if (keyParams == null) return null
        val purpose = opParams.purpose.firstOrNull() ?: return null
        // Algorithm-level rejection runs before purpose-list check (AOSP HAL behavior)
        return checkAlgorithmPurpose(keyParams, purpose)
            ?: checkPurpose(keyParams, purpose)
            ?: checkTemporalValidity(keyParams, purpose)
            ?: checkCallerNonce(keyParams, purpose, rawOpParams)
    }
    private fun checkAlgorithmPurpose(keyParams: KeyMintAttestation, purpose: Int): Int? {
        val algo = keyParams.algorithm
        if ((algo == Algorithm.EC || algo == Algorithm.RSA) &&
            (purpose == KeyPurpose.VERIFY || purpose == KeyPurpose.ENCRYPT)
        ) {
            return KeystoreErrorCodes.unsupportedPurpose
        }
        if (algo == Algorithm.RSA && purpose == KeyPurpose.AGREE_KEY)
            return KeystoreErrorCodes.unsupportedPurpose
        return null
    }
    private fun checkPurpose(keyParams: KeyMintAttestation, purpose: Int): Int? {
        if (purpose == KeyPurpose.WRAP_KEY)
            return KeystoreErrorCodes.incompatiblePurpose
        if (purpose !in keyParams.purpose)
            return KeystoreErrorCodes.incompatiblePurpose
        return null
    }
    private fun checkTemporalValidity(keyParams: KeyMintAttestation, purpose: Int): Int? {
        val now = System.currentTimeMillis()
        keyParams.activeDateTime?.let { activeDate ->
            if (now < activeDate.time) return KeystoreErrorCodes.keyNotYetValid
        }
        keyParams.originationExpireDateTime?.let { expireDate ->
            if (purpose == KeyPurpose.SIGN || purpose == KeyPurpose.ENCRYPT) {
                if (now > expireDate.time) return KeystoreErrorCodes.keyExpired
            }
        }
        keyParams.usageExpireDateTime?.let { expireDate ->
            if (purpose == KeyPurpose.VERIFY || purpose == KeyPurpose.DECRYPT) {
                if (now > expireDate.time) return KeystoreErrorCodes.keyExpired
            }
        }
        return null
    }
    private fun checkCallerNonce(keyParams: KeyMintAttestation, purpose: Int, rawOpParams: Array<KeyParameter>?): Int? {
        if (purpose != KeyPurpose.SIGN && purpose != KeyPurpose.ENCRYPT) return null
        if (keyParams.callerNonce == true) return null
        if (rawOpParams?.any { it.tag == Tag.NONCE } == true)
            return KeystoreErrorCodes.callerNonceProhibited
        return null
    }
 }
@@ -16,7 +16,7 @@ import java.util.concurrent.locks.ReentrantLock
 import org.matrix.TEESimulator.config.ConfigurationManager.CONFIG_PATH
 import org.matrix.TEESimulator.interception.keystore.KeyIdentifier
 import org.matrix.TEESimulator.logging.SystemLogger
-
+import org.matrix.TEESimulator.pki.CertificateHelper
 data class PersistedKeyData(
    val uid: Int,
@@ -250,6 +250,77 @@ object GeneratedKeyPersistence {
        return result
    }
    // Re-persist updates the cert chain for an already-persisted key without
    // reconstructing authorization parameters from the response. This avoids
    // pulling keymint Tag dependencies into this file and is correct because
    // the only field that changes post-generation is the patched cert chain.
    fun rePersistIfNeeded(
        callingUid: Int,
        generatedKeyInfo: KeyMintSecurityLevelInterceptor.GeneratedKeyInfo,
    ) {
        val metadata = generatedKeyInfo.response.metadata
        if (metadata == null) {
            SystemLogger.debug("rePersist: no metadata, skipping")
            return
        }
        val secLevel = metadata.keySecurityLevel
        val entry = KeyMintSecurityLevelInterceptor.generatedKeys.entries.find { (id, info) ->
            id.uid == callingUid && info.nspace == generatedKeyInfo.nspace
        }
        if (entry == null) {
            SystemLogger.debug("rePersist: key not found in map for uid=$callingUid nspace=${generatedKeyInfo.nspace}")
            return
        }
        val keyId = entry.key
        val filename = keyFileName(keyId.uid, keyId.alias)
        val existing = File(PERSISTENCE_DIR, filename)
        if (!existing.exists()) {
            SystemLogger.debug("rePersist: no existing file for $keyId, skipping")
            return
        }
        val newChain = CertificateHelper.getCertificateChain(metadata)
        if (newChain == null) {
            SystemLogger.warning("rePersist: could not extract cert chain for $keyId")
            return
        }
        val persisted = runCatching {
            DataInputStream(BufferedInputStream(FileInputStream(existing))).use { input ->
                val version = input.readInt()
                if (version != FORMAT_VERSION) {
                    SystemLogger.warning("rePersist: unknown format version $version for $keyId")
                    return
                }
                readPersistedKeyData(input)
            }
        }.getOrNull()
        if (persisted == null) {
            SystemLogger.warning("rePersist: failed to read existing data for $keyId")
            return
        }
        val keyPair = generatedKeyInfo.keyPair ?: return
        save(
            keyId = keyId,
            keyPair = keyPair,
            nspace = generatedKeyInfo.nspace,
            securityLevel = secLevel,
            certChain = newChain.toList(),
            algorithm = persisted.algorithm,
            keySize = persisted.keySize,
            ecCurve = persisted.ecCurve,
            purposes = persisted.purposes,
            digests = persisted.digests,
            isAttestationKey = persisted.isAttestationKey,
        )
        SystemLogger.debug("Re-persisted key $keyId with updated cert chain")
    }
    // Corrupted binary files can have arbitrary length fields — cap allocations
    private fun requireBounds(value: Int, max: Int, name: String): Int {
        require(value in 0..max) { "$name out of bounds: $value (max $max)" }
        return value
@@ -260,4 +331,49 @@ object GeneratedKeyPersistence {
            .digest("$uid:$alias".toByteArray(Charsets.UTF_8))
        return digest.joinToString("") { "%02x".format(it) } + ".bin"
    }
    // Reads all fields after version has already been consumed
    private fun readPersistedKeyData(input: DataInputStream): PersistedKeyData {
        val secLevel = input.readInt()
        val uid = input.readInt()
        val alias = input.readUTF()
        val nspace = input.readLong()
        val isAttestKey = input.readBoolean()
        val algo = input.readInt()
        val kSize = input.readInt()
        val curve = input.readInt()
        val purposeCount = requireBounds(input.readInt(), 64, "purposeCount")
        val purposes = (0 until purposeCount).map { input.readInt() }
        val digestCount = requireBounds(input.readInt(), 64, "digestCount")
        val digests = (0 until digestCount).map { input.readInt() }
        val pkLen = requireBounds(input.readInt(), 8192, "pkLen")
        val pkBytes = ByteArray(pkLen)
        input.readFully(pkBytes)
        val certCount = requireBounds(input.readInt(), 10, "certCount")
        val certChainBytes = (0 until certCount).map {
            val certLen = requireBounds(input.readInt(), 65536, "certLen")
            val certBytes = ByteArray(certLen)
            input.readFully(certBytes)
            certBytes
        }
        return PersistedKeyData(
            uid = uid,
            alias = alias,
            nspace = nspace,
            securityLevel = secLevel,
            isAttestationKey = isAttestKey,
            algorithm = algo,
            keySize = kSize,
            ecCurve = curve,
            purposes = purposes,
            digests = digests,
            privateKeyBytes = pkBytes,
            certChainBytes = certChainBytes,
        )
    }
 }
@@ -44,7 +44,6 @@ class OperationInterceptor(
        private val ABORT_TRANSACTION =
            InterceptorUtils.getTransactCode(IKeystoreOperation.Stub::class.java, "abort")
        /** Only intercept finish/abort for cleanup. Other ops pass through without round-trip. */
        val INTERCEPTED_CODES = intArrayOf(FINISH_TRANSACTION, ABORT_TRANSACTION)
        private val transactionNames: Map<Int, String> by lazy {
@@ -8,8 +8,8 @@ import android.hardware.security.keymint.KeyParameterValue
 import android.hardware.security.keymint.KeyPurpose
 import android.hardware.security.keymint.PaddingMode
 import android.hardware.security.keymint.Tag
 import android.os.RemoteException
 import android.os.ServiceSpecificException
 import java.util.concurrent.locks.LockSupport
 import android.system.keystore2.IKeystoreOperation
 import android.system.keystore2.KeyParameters
 import java.security.KeyPair
@@ -20,48 +20,16 @@ import org.matrix.TEESimulator.attestation.KeyMintAttestation
 import org.matrix.TEESimulator.logging.KeyMintParameterLogger
 import org.matrix.TEESimulator.logging.SystemLogger
 /** Keystore2 error codes for ServiceSpecificException. Negative = KeyMint, positive = Keystore. */
 internal object KeystoreErrorCode {
    const val INVALID_OPERATION_HANDLE = -28
    const val VERIFICATION_FAILED = -30
    const val UNSUPPORTED_PURPOSE = -2
    const val INCOMPATIBLE_PURPOSE = -3
    const val SYSTEM_ERROR = 4
    const val TOO_MUCH_DATA = 21
    const val KEY_EXPIRED = -25
    const val KEY_NOT_YET_VALID = -24
    /** KeyMint ErrorCode::CALLER_NONCE_PROHIBITED */
    const val CALLER_NONCE_PROHIBITED = -55
    /** KeyMint ErrorCode::INVALID_ARGUMENT */
    const val INVALID_ARGUMENT = -38
    /** KeyMint ErrorCode::INVALID_TAG */
    const val INVALID_TAG = -40
    /** Keystore2 ResponseCode::PERMISSION_DENIED */
    const val PERMISSION_DENIED = 6
    /** Keystore2 ResponseCode::KEY_NOT_FOUND */
    const val KEY_NOT_FOUND = 7
 }
 // A sealed interface to represent the different cryptographic operations we can perform.
 private sealed interface CryptoPrimitive {
-    fun updateAad(data: ByteArray?)
+    fun updateAad(aadInput: ByteArray?) {
-
+        throw ServiceSpecificException(KeystoreErrorCodes.invalidTag)
    }
    fun update(data: ByteArray?): ByteArray?
    fun finish(data: ByteArray?, signature: ByteArray?): ByteArray?
    fun abort()
    /** Returns parameters from the begin phase (e.g. GCM nonce), or null if none. */
    fun getBeginParameters(): Array<KeyParameter>? = null
 }
 // Helper object to map KeyMint constants to JCA algorithm strings.
 private object JcaAlgorithmMapper {
    fun mapSignatureAlgorithm(params: KeyMintAttestation): String {
        val digest =
@@ -71,17 +39,18 @@ private object JcaAlgorithmMapper {
                Digest.SHA_2_512 -> "SHA512"
                else -> "NONE"
            }
-        val keyAlgo =
+        return when (params.algorithm) {
-            when (params.algorithm) {
+            Algorithm.EC -> "${digest}withECDSA"
-                Algorithm.EC -> "ECDSA"
+            Algorithm.RSA -> {
-                Algorithm.RSA -> "RSA"
+                val isPss = params.padding.firstOrNull() == PaddingMode.RSA_PSS
-                else ->
+                if (isPss) "${digest}withRSA/PSS" else "${digest}withRSA"
                    throw ServiceSpecificException(
                        KeystoreErrorCode.SYSTEM_ERROR,
                        "Unsupported signature algorithm: ${params.algorithm}",
                    )
            }
-        return "${digest}with${keyAlgo}"
+            else ->
                throw ServiceSpecificException(
                    KeystoreErrorCodes.incompatibleAlgorithm,
                    "Unsupported signature algorithm: ${params.algorithm}",
                )
        }
    }
    fun mapCipherAlgorithm(params: KeyMintAttestation): String {
@@ -91,7 +60,7 @@ private object JcaAlgorithmMapper {
                Algorithm.AES -> "AES"
                else ->
                    throw ServiceSpecificException(
-                        KeystoreErrorCode.SYSTEM_ERROR,
+                        KeystoreErrorCodes.incompatibleAlgorithm,
                        "Unsupported cipher algorithm: ${params.algorithm}",
                    )
            }
@@ -99,32 +68,29 @@ private object JcaAlgorithmMapper {
            when (params.blockMode.firstOrNull()) {
                BlockMode.ECB -> "ECB"
                BlockMode.CBC -> "CBC"
                BlockMode.CTR -> "CTR"
                BlockMode.GCM -> "GCM"
-                else -> "ECB" // Default for RSA
+                else -> "ECB"
            }
        val padding =
            when (params.padding.firstOrNull()) {
                PaddingMode.NONE -> "NoPadding"
                PaddingMode.PKCS7 -> "PKCS7Padding"
                PaddingMode.RSA_PKCS1_1_5_ENCRYPT -> "PKCS1Padding"
                PaddingMode.RSA_PKCS1_1_5_SIGN -> "PKCS1Padding"
                PaddingMode.RSA_OAEP -> "OAEPPadding"
-                else -> "NoPadding" // Default for GCM
+                else -> "NoPadding"
            }
        return "$keyAlgo/$blockMode/$padding"
    }
 }
 // Concrete implementation for Signing.
 private class Signer(keyPair: KeyPair, params: KeyMintAttestation) : CryptoPrimitive {
    private val signature: Signature =
        Signature.getInstance(JcaAlgorithmMapper.mapSignatureAlgorithm(params)).apply {
            initSign(keyPair.private)
        }
    override fun updateAad(data: ByteArray?) {
        throw ServiceSpecificException(KeystoreErrorCode.INVALID_TAG)
    }
    override fun update(data: ByteArray?): ByteArray? {
        if (data != null) signature.update(data)
        return null
@@ -138,17 +104,12 @@ private class Signer(keyPair: KeyPair, params: KeyMintAttestation) : CryptoPrimi
    override fun abort() {}
 }
 // Concrete implementation for Verification.
 private class Verifier(keyPair: KeyPair, params: KeyMintAttestation) : CryptoPrimitive {
    private val signature: Signature =
        Signature.getInstance(JcaAlgorithmMapper.mapSignatureAlgorithm(params)).apply {
            initVerify(keyPair.public)
        }
    override fun updateAad(data: ByteArray?) {
        throw ServiceSpecificException(KeystoreErrorCode.INVALID_TAG)
    }
    override fun update(data: ByteArray?): ByteArray? {
        if (data != null) signature.update(data)
        return null
@@ -156,16 +117,11 @@ private class Verifier(keyPair: KeyPair, params: KeyMintAttestation) : CryptoPri
    override fun finish(data: ByteArray?, signature: ByteArray?): ByteArray? {
        if (data != null) update(data)
-        if (signature == null)
+        if (signature == null) {
-            throw ServiceSpecificException(
+            throw ServiceSpecificException(KeystoreErrorCodes.verificationFailed, "Signature to verify is null")
-                KeystoreErrorCode.VERIFICATION_FAILED,
+        }
                "Signature to verify is null",
            )
        if (!this.signature.verify(signature)) {
-            throw ServiceSpecificException(
+            throw ServiceSpecificException(KeystoreErrorCodes.verificationFailed, "Signature verification failed")
                KeystoreErrorCode.VERIFICATION_FAILED,
                "Signature/MAC verification failed",
            )
        }
        return null
    }
@@ -173,19 +129,27 @@ private class Verifier(keyPair: KeyPair, params: KeyMintAttestation) : CryptoPri
    override fun abort() {}
 }
 // Concrete implementation for Encryption/Decryption.
 private class CipherPrimitive(
    cryptoKey: java.security.Key,
    params: KeyMintAttestation,
    private val opMode: Int,
 ) : CryptoPrimitive {
    private val isAead = params.blockMode.firstOrNull() == BlockMode.GCM
    private val cipher: Cipher =
        Cipher.getInstance(JcaAlgorithmMapper.mapCipherAlgorithm(params)).apply {
-            init(opMode, cryptoKey)
+            val nonce = params.nonce
            if (nonce != null && isAead) {
                init(opMode, cryptoKey, javax.crypto.spec.GCMParameterSpec(128, nonce))
            } else if (nonce != null) {
                init(opMode, cryptoKey, javax.crypto.spec.IvParameterSpec(nonce))
            } else {
                init(opMode, cryptoKey)
            }
        }
-    override fun updateAad(data: ByteArray?) {
+    override fun updateAad(aadInput: ByteArray?) {
-        if (data != null) cipher.updateAAD(data)
+        if (!isAead) throw ServiceSpecificException(KeystoreErrorCodes.invalidTag)
        if (aadInput != null) cipher.updateAAD(aadInput)
    }
    override fun update(data: ByteArray?): ByteArray? =
@@ -194,9 +158,6 @@ private class CipherPrimitive(
    override fun finish(data: ByteArray?, signature: ByteArray?): ByteArray? =
        if (data != null) cipher.doFinal(data) else cipher.doFinal()
    override fun abort() {}
    /** Returns the cipher IV as a NONCE parameter for GCM operations. */
    override fun getBeginParameters(): Array<KeyParameter>? {
        val iv = cipher.iv ?: return null
        return arrayOf(
@@ -206,23 +167,20 @@ private class CipherPrimitive(
            }
        )
    }
    override fun abort() {}
 }
 // Concrete implementation for ECDH Key Agreement.
 private class KeyAgreementPrimitive(keyPair: KeyPair) : CryptoPrimitive {
    private val agreement: javax.crypto.KeyAgreement =
        javax.crypto.KeyAgreement.getInstance("ECDH").apply { init(keyPair.private) }
    override fun updateAad(data: ByteArray?) {
        throw ServiceSpecificException(KeystoreErrorCode.INVALID_TAG)
    }
    override fun update(data: ByteArray?): ByteArray? = null
    override fun finish(data: ByteArray?, signature: ByteArray?): ByteArray? {
        if (data == null)
            throw ServiceSpecificException(
-                KeystoreErrorCode.INVALID_ARGUMENT,
+                KeystoreErrorCodes.invalidArgument,
                "Peer public key required for key agreement",
            )
        val peerKey =
@@ -235,23 +193,25 @@ private class KeyAgreementPrimitive(keyPair: KeyPair) : CryptoPrimitive {
    override fun abort() {}
 }
 /**
 * A software-only implementation of a cryptographic operation. This class acts as a controller,
 * delegating to a specific cryptographic primitive based on the operation's purpose.
 *
 * Tracks operation lifecycle: once [finish] or [abort] is called, subsequent calls throw
 * [ServiceSpecificException] with [KeystoreErrorCode.INVALID_OPERATION_HANDLE].
 */
 class SoftwareOperation(
    private val txId: Long,
    keyPair: KeyPair?,
    secretKey: javax.crypto.SecretKey?,
    params: KeyMintAttestation,
-    var onFinishCallback: (() -> Unit)? = null,
+    private val latencyFloorMs: Long = 0L,
 ) {
    private val primitive: CryptoPrimitive
    @Volatile var finalized = false
        private set
-    @Volatile private var finalized = false
+    var onFinishCallback: (() -> Unit)? = null
    val beginParameters: KeyParameters?
        get() {
            val params = primitive.getBeginParameters() ?: return null
            if (params.isEmpty()) return null
            return KeyParameters().apply { keyParameter = params }
        }
    init {
        val purpose = params.purpose.firstOrNull()
@@ -273,121 +233,175 @@ class SoftwareOperation(
                KeyPurpose.AGREE_KEY -> KeyAgreementPrimitive(keyPair!!)
                else ->
                    throw ServiceSpecificException(
-                        KeystoreErrorCode.UNSUPPORTED_PURPOSE,
+                        KeystoreErrorCodes.unsupportedPurpose,
                        "Unsupported operation purpose: $purpose",
                    )
            }
    }
    /** Parameters produced during begin (e.g. GCM nonce), to populate CreateOperationResponse. */
    val beginParameters: KeyParameters?
        get() {
            val params = primitive.getBeginParameters() ?: return null
            if (params.isEmpty()) return null
            return KeyParameters().apply { keyParameter = params }
        }
    private fun checkActive() {
-        if (finalized)
+        if (finalized) {
-            throw ServiceSpecificException(
+            SystemLogger.debug("[SoftwareOp TX_ID: $txId] Rejected: operation already finalized (pruned or completed)")
-                KeystoreErrorCode.INVALID_OPERATION_HANDLE,
+            throw ServiceSpecificException(KeystoreErrorCodes.invalidOperationHandle)
-                "Operation already finalized.",
+        }
            )
    }
-    fun updateAad(data: ByteArray?) {
+    private fun checkInputLength(data: ByteArray?) {
-        checkActive()
+        if (data != null && data.size > MAX_RECEIVE_DATA) {
-        try {
+            SystemLogger.info("[SoftwareOp TX_ID: $txId] Input too large: ${data.size} > $MAX_RECEIVE_DATA, throwing TOO_MUCH_DATA(${KeystoreErrorCodes.tooMuchData})")
-            primitive.updateAad(data)
+            throw ServiceSpecificException(KeystoreErrorCodes.tooMuchData)
        } catch (e: ServiceSpecificException) {
            finalized = true
            throw e
        } catch (e: Exception) {
            finalized = true
            SystemLogger.error("[SoftwareOp TX_ID: $txId] Failed to updateAad.", e)
            throw ServiceSpecificException(KeystoreErrorCode.SYSTEM_ERROR, e.message)
        }
    }
    fun updateAad(aadInput: ByteArray?) {
        SystemLogger.debug("[SoftwareOp TX_ID: $txId] updateAad() inputSize=${aadInput?.size ?: 0}")
        checkActive()
        checkInputLength(aadInput)
        primitive.updateAad(aadInput)
    }
    fun update(data: ByteArray?): ByteArray? {
        SystemLogger.debug("[SoftwareOp TX_ID: $txId] update() inputSize=${data?.size ?: 0}")
        checkActive()
        checkInputLength(data)
        try {
            return primitive.update(data)
        } catch (e: ServiceSpecificException) {
            finalized = true
            throw e
        } catch (e: Exception) {
            finalized = true
            SystemLogger.error("[SoftwareOp TX_ID: $txId] Failed to update operation.", e)
-            throw ServiceSpecificException(KeystoreErrorCode.SYSTEM_ERROR, e.message)
+            throw mapToServiceSpecificException(e)
        }
    }
    fun finish(data: ByteArray?, signature: ByteArray?): ByteArray? {
        checkActive()
        checkInputLength(data)
        try {
            val startNs = if (latencyFloorMs > 0) System.nanoTime() else 0L
            val result = primitive.finish(data, signature)
-            SystemLogger.info("[SoftwareOp TX_ID: $txId] Finished operation successfully.")
+            if (latencyFloorMs > 0) {
                val elapsedMs = (System.nanoTime() - startNs) / 1_000_000
                val delayMs = latencyFloorMs - elapsedMs
                if (delayMs > 0) LockSupport.parkNanos(delayMs * 1_000_000)
            }
            finalized = true
            onFinishCallback?.invoke()
            SystemLogger.info("[SoftwareOp TX_ID: $txId] Finished operation successfully.")
            return result
        } catch (e: ServiceSpecificException) {
            throw e
        } catch (e: Exception) {
            SystemLogger.error("[SoftwareOp TX_ID: $txId] Failed to finish operation.", e)
-            throw ServiceSpecificException(KeystoreErrorCode.SYSTEM_ERROR, e.message)
+            throw mapToServiceSpecificException(e)
        } finally {
            finalized = true
        }
    }
    fun abort() {
        checkActive()
        finalized = true
        primitive.abort()
        SystemLogger.debug("[SoftwareOp TX_ID: $txId] Operation aborted.")
    }
 }
-/** Binder interface for [SoftwareOperation]. Synchronized and input-length validated. */
+    private fun mapToServiceSpecificException(e: Exception): ServiceSpecificException = when (e) {
-class SoftwareOperationBinder(private val operation: SoftwareOperation) :
+        is SignatureException -> ServiceSpecificException(KeystoreErrorCodes.verificationFailed, e.message)
-    IKeystoreOperation.Stub() {
+        is javax.crypto.BadPaddingException -> ServiceSpecificException(KeystoreErrorCodes.invalidArgument, e.message)
-
+        is javax.crypto.IllegalBlockSizeException -> ServiceSpecificException(KeystoreErrorCodes.invalidInputLength, e.message)
-    private fun checkInputLength(data: ByteArray?) {
+        is java.security.InvalidKeyException -> ServiceSpecificException(KeystoreErrorCodes.incompatibleKey, e.message)
-        if (data != null && data.size > MAX_RECEIVE_DATA)
+        else -> ServiceSpecificException(KeystoreErrorCodes.unknownError, e.message)
            throw ServiceSpecificException(KeystoreErrorCode.TOO_MUCH_DATA)
    }
    @Throws(RemoteException::class)
    override fun updateAad(aadInput: ByteArray?) {
        synchronized(this) {
            checkInputLength(aadInput)
            operation.updateAad(aadInput)
        }
    }
    @Throws(RemoteException::class)
    override fun update(input: ByteArray?): ByteArray? {
        synchronized(this) {
            checkInputLength(input)
            return operation.update(input)
        }
    }
    @Throws(RemoteException::class)
    override fun finish(input: ByteArray?, signature: ByteArray?): ByteArray? {
        synchronized(this) {
            checkInputLength(input)
            checkInputLength(signature)
            return operation.finish(input, signature)
        }
    }
    @Throws(RemoteException::class)
    override fun abort() {
        synchronized(this) { operation.abort() }
    }
    companion object {
        private const val MAX_RECEIVE_DATA = 0x8000
    }
 }
 internal object KeystoreErrorCodes {
    val tooMuchData: Int by lazy {
        resolveField("android.system.keystore2.ResponseCode", "TOO_MUCH_DATA", 21)
    }
    val invalidOperationHandle: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "INVALID_OPERATION_HANDLE", -28)
    }
    val invalidTag: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "INVALID_TAG", -76)
    }
    val verificationFailed: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "VERIFICATION_FAILED", -30)
    }
    val invalidArgument: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "INVALID_ARGUMENT", -38)
    }
    val invalidInputLength: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "INVALID_INPUT_LENGTH", -21)
    }
    val incompatibleKey: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "INCOMPATIBLE_KEY", -31)
    }
    val incompatiblePurpose: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "INCOMPATIBLE_PURPOSE", -13)
    }
    val unsupportedPurpose: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "UNSUPPORTED_PURPOSE", -14)
    }
    val incompatibleAlgorithm: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "INCOMPATIBLE_ALGORITHM", -18)
    }
    val keyNotYetValid: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "KEY_NOT_YET_VALID", -39)
    }
    val keyExpired: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "KEY_EXPIRED", -40)
    }
    val callerNonceProhibited: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "CALLER_NONCE_PROHIBITED", -55)
    }
    val unknownError: Int by lazy {
        resolveField("android.hardware.security.keymint.ErrorCode", "UNKNOWN_ERROR", -1000)
    }
    fun resolveField(className: String, fieldName: String, fallback: Int): Int =
        runCatching {
            Class.forName(className).getField(fieldName).getInt(null)
        }.getOrElse {
            SystemLogger.debug("Resolved $className.$fieldName via fallback: $fallback")
            fallback
        }
 }
 class SoftwareOperationBinder(private val operation: SoftwareOperation) :
    IKeystoreOperation.Stub() {
    @Synchronized
    override fun updateAad(aadInput: ByteArray?) {
        operation.updateAad(aadInput)
    }
    @Synchronized
    override fun update(input: ByteArray?): ByteArray? {
        return operation.update(input)
    }
    @Synchronized
    override fun finish(input: ByteArray?, signature: ByteArray?): ByteArray? {
        return operation.finish(input, signature)
    }
    @Synchronized
    override fun abort() {
        operation.abort()
    }
 }
@@ -37,22 +37,6 @@ object KeyMintParameterLogger {
            .associate { field -> (field.get(null) as Int) to field.name }
    }
    val hardwareAuthenticatorTypeNames: Map<Int, String> by lazy {
        HardwareAuthenticatorType::class
            .java
            .fields
            .filter { it.type == Int::class.java }
            .associate { field -> (field.get(null) as Int) to field.name }
    }
    val keyOriginNames: Map<Int, String> by lazy {
        KeyOrigin::class
            .java
            .fields
            .filter { it.type == Int::class.java }
            .associate { field -> (field.get(null) as Int) to field.name }
    }
    val paddingNames: Map<Int, String> by lazy {
        PaddingMode::class
            .java
@@ -97,33 +81,22 @@ object KeyMintParameterLogger {
            when (param.tag) {
                Tag.ALGORITHM -> algorithmNames[value.algorithm]
                Tag.BLOCK_MODE -> blockModeNames[value.blockMode]
                Tag.DIGEST -> digestNames[value.digest]
                Tag.EC_CURVE -> ecCurveNames[value.ecCurve]
                Tag.ORIGIN -> keyOriginNames[value.origin]
                Tag.PADDING -> paddingNames[value.paddingMode]
                Tag.PURPOSE -> purposeNames[value.keyPurpose]
-                Tag.USER_AUTH_TYPE ->
+                Tag.DIGEST -> digestNames[value.digest]
                    hardwareAuthenticatorTypeNames[value.hardwareAuthenticatorType]
                Tag.AUTH_TIMEOUT,
                Tag.BOOT_PATCHLEVEL,
                Tag.KEY_SIZE,
-                Tag.MAC_LENGTH,
+                Tag.MIN_MAC_LENGTH -> value.integer.toString()
                Tag.MIN_MAC_LENGTH,
                Tag.OS_VERSION,
                Tag.OS_PATCHLEVEL,
                Tag.USER_ID,
                Tag.VENDOR_PATCHLEVEL -> value.integer.toString()
                Tag.CERTIFICATE_SERIAL -> BigInteger(value.blob).toString()
                Tag.ACTIVE_DATETIME,
                Tag.CERTIFICATE_NOT_AFTER,
                Tag.CERTIFICATE_NOT_BEFORE,
                Tag.CREATION_DATETIME,
                Tag.ORIGINATION_EXPIRE_DATETIME,
                Tag.USAGE_EXPIRE_DATETIME -> Date(value.dateTime).toString()
                Tag.CERTIFICATE_SUBJECT -> X500Name(X500Principal(value.blob).name).toString()
                Tag.USER_SECURE_ID,
                Tag.RSA_PUBLIC_EXPONENT -> value.longInteger.toString()
-                Tag.NO_AUTH_REQUIRED -> value.boolValue.toString()
+                Tag.NO_AUTH_REQUIRED -> "true"
                Tag.ATTESTATION_CHALLENGE,
                Tag.ATTESTATION_ID_BRAND,
                Tag.ATTESTATION_ID_DEVICE,
@@ -1,42 +1,86 @@
 package org.matrix.TEESimulator.logging
 import android.util.Log
 import java.util.concurrent.atomic.AtomicInteger
 import java.util.concurrent.atomic.AtomicLong
 import org.matrix.TEESimulator.BuildConfig
 /**
 * A centralized logging utility for the TEESimulator application. This object provides a consistent
 * logging tag and format for all application logs, making it easier to filter and debug in Logcat.
 *
 * Includes a rate limiter that caps logd syscalls during binder stress to prevent thread pool
 * contention. The first [RATE_LIMIT_BURST] messages per [RATE_LIMIT_WINDOW_MS] window are logged
 * normally; subsequent messages are suppressed and a summary is emitted when the window resets.
 */
 object SystemLogger {
-    // The tag used for all log messages from this application.
+    @PublishedApi internal const val TAG = "TEESimulator"
    private const val TAG = "TEESimulator"
-    private val isDebugBuild = BuildConfig.DEBUG
+    @PublishedApi internal val isDebugBuild = BuildConfig.DEBUG
    // Rate limiter: allow BURST messages per WINDOW, then suppress until window resets.
    private const val RATE_LIMIT_BURST = 15
    private const val RATE_LIMIT_WINDOW_MS = 1000L
    private val windowStart = AtomicLong(System.currentTimeMillis())
    private val windowCount = AtomicInteger(0)
    private val suppressedCount = AtomicInteger(0)
    /**
     * Returns true if this message should be emitted. Resets the window if expired
     * and emits a suppression summary for the previous window.
     */
    @PublishedApi internal fun acquireLogPermit(): Boolean {
        val now = System.currentTimeMillis()
        val start = windowStart.get()
        if (now - start > RATE_LIMIT_WINDOW_MS) {
            // Window expired: reset and emit suppression summary if needed.
            if (windowStart.compareAndSet(start, now)) {
                val suppressed = suppressedCount.getAndSet(0)
                windowCount.set(1) // this call counts as #1 in the new window
                if (suppressed > 0) {
                    Log.i(TAG, "[rate-limit] suppressed $suppressed log messages in previous window")
                }
                return true
            }
        }
        val count = windowCount.incrementAndGet()
        if (count <= RATE_LIMIT_BURST) return true
        suppressedCount.incrementAndGet()
        return false
    }
    /**
     * Logs a debug message. Use this for fine-grained information that is useful for debugging.
     *
     * @param message The message to log.
     */
    fun debug(message: String) {
        if (!isDebugBuild) return
        if (!acquireLogPermit()) return
        Log.d(TAG, message)
    }
    /** Lazy debug: lambda only evaluates if message will be logged. */
    inline fun debug(message: () -> String) {
        if (!isDebugBuild) return
        if (!acquireLogPermit()) return
        Log.d(TAG, message())
    }
    /**
     * Logs an informational message. Use this to report major application lifecycle events.
     *
     * @param message The message to log.
     */
    fun info(message: String) {
        if (!acquireLogPermit()) return
        Log.i(TAG, message)
    }
    /** Lazy info: lambda only evaluates if message will be logged. */
    inline fun info(message: () -> String) {
        if (!acquireLogPermit()) return
        Log.i(TAG, message())
    }
    /**
-     * Logs a warning message. Use this to report unexpected but non-fatal issues.
+     * Logs a warning message. Warnings are never rate-limited.
     *
     * @param message The message to log.
     * @param throwable An optional exception to log with the message.
     */
    fun warning(message: String, throwable: Throwable? = null) {
        if (throwable != null) {
@@ -47,11 +91,7 @@ object SystemLogger {
    }
    /**
-     * Logs an error message. Use this to report fatal errors or exceptions that disrupt
+     * Logs an error message. Errors are never rate-limited.
     * functionality.
     *
     * @param message The message to log.
     * @param throwable An optional exception to log with the message.
     */
    fun error(message: String, throwable: Throwable? = null) {
        if (throwable != null) {
@@ -64,11 +104,22 @@ object SystemLogger {
    /**
     * Logs a verbose message. This level is for highly detailed logs that are generally not needed
     * unless tracking a very specific issue.
     *
     * @param message The message to log.
     */
    fun verbose(message: String) {
        if (!isDebugBuild) return
        if (!acquireLogPermit()) return
        Log.v(TAG, message)
    }
    /** Lazy verbose: lambda only evaluates if message will be logged. */
    inline fun verbose(message: () -> String) {
        if (!isDebugBuild) return
        if (!acquireLogPermit()) return
        Log.v(TAG, message())
    }
    inline fun trace(message: () -> String) {
        if (!isDebugBuild) return
        Log.w(TAG, message())
    }
 }
@@ -35,7 +35,6 @@ import org.matrix.TEESimulator.logging.SystemLogger
 */
 object CertificateGenerator {
    // RFC 5280 GeneralizedTime maximum: 9999-12-31T23:59:59 UTC (millis since epoch).
    private const val UNDEFINED_NOT_AFTER = 253402300799000L
    /**
@@ -94,6 +93,12 @@ object CertificateGenerator {
            )
        return try {
                // AOSP ta/src/keys.rs:451-478: no challenge + no attestKey = self-signed, depth 1
                if (challenge == null && attestKeyAlias == null) {
                    SystemLogger.trace { "[certgen] no-challenge key: self-signed, depth=1, purposes=${params.purpose}" }
                    return listOf(buildSelfSignedCertificate(subjectKeyPair, params))
                }
                val keybox = getKeyboxForAlgorithm(uid, params.algorithm)
                val (signingKey, issuer) =
@@ -199,16 +204,14 @@ object CertificateGenerator {
    private fun buildKeyUsageFromPurposes(purposes: List<Int>): Int {
        var bits = 0
        for (purpose in purposes) {
-            bits =
+            bits = bits or when (purpose) {
-                bits or
+                KeyPurpose.SIGN -> KeyUsage.digitalSignature
-                    when (purpose) {
+                KeyPurpose.DECRYPT -> KeyUsage.dataEncipherment
-                        KeyPurpose.SIGN -> KeyUsage.digitalSignature
+                KeyPurpose.WRAP_KEY -> KeyUsage.keyEncipherment
-                        KeyPurpose.DECRYPT -> KeyUsage.dataEncipherment
+                KeyPurpose.AGREE_KEY -> KeyUsage.keyAgreement
-                        KeyPurpose.WRAP_KEY -> KeyUsage.keyEncipherment
+                KeyPurpose.ATTEST_KEY -> KeyUsage.keyCertSign
-                        KeyPurpose.AGREE_KEY -> KeyUsage.keyAgreement
+                else -> 0
-                        KeyPurpose.ATTEST_KEY -> KeyUsage.keyCertSign
+            }
                        else -> 0
                    }
        }
        return bits
    }
@@ -223,8 +226,6 @@ object CertificateGenerator {
        securityLevel: Int,
    ): Certificate {
        val subject = params.certificateSubject ?: X500Name("CN=Android Keystore Key")
        // Default validity: epoch to 9999-12-31T23:59:59 UTC (matches add_required_parameters).
        val notBefore = params.certificateNotBefore ?: Date(0)
        val notAfter = params.certificateNotAfter ?: Date(UNDEFINED_NOT_AFTER)
@@ -243,21 +244,17 @@ object CertificateGenerator {
        if (keyUsageBits != 0) {
            builder.addExtension(Extension.keyUsage, true, KeyUsage(keyUsageBits))
        }
-        // Add our custom, simulated attestation extension.
+        if (params.attestationChallenge != null) {
-        builder.addExtension(
+            builder.addExtension(
-            AttestationBuilder.buildAttestationExtension(params, uid, securityLevel)
+                AttestationBuilder.buildAttestationExtension(params, uid, securityLevel)
-        )
+            )
        }
        // The signature algorithm must match the SIGNING key, not the subject key.
        // An EC attestation key may sign an RSA subject key's certificate (or vice versa).
        val signerAlgorithm =
-            when (signingKeyPair.private) {
+            when (signingKeyPair.private.algorithm) {
-                is java.security.interfaces.ECKey -> "SHA256withECDSA"
+                "EC", "ECDSA" -> "SHA256withECDSA"
-                is java.security.interfaces.RSAKey -> "SHA256withRSA"
+                "RSA" -> "SHA256withRSA"
-                else ->
+                else -> throw IllegalArgumentException("Unsupported signing key: ${signingKeyPair.private.algorithm}")
                    throw IllegalArgumentException(
                        "Unsupported signing key type: ${signingKeyPair.private.javaClass}"
                    )
            }
        val contentSigner =
            JcaContentSignerBuilder(signerAlgorithm)
@@ -266,4 +263,39 @@ object CertificateGenerator {
        return JcaX509CertificateConverter().getCertificate(builder.build(contentSigner))
    }
    // AOSP ta/src/keys.rs:452-478, ta/src/cert.rs:111-114
    private fun buildSelfSignedCertificate(
        keyPair: KeyPair,
        params: KeyMintAttestation,
    ): Certificate {
        val subject = params.certificateSubject ?: X500Name("CN=Android Keystore Key")
        val notBefore = params.certificateNotBefore ?: Date(0)
        val notAfter = params.certificateNotAfter ?: Date(UNDEFINED_NOT_AFTER)
        val builder = JcaX509v3CertificateBuilder(
            subject,
            params.certificateSerial ?: BigInteger.ONE,
            notBefore,
            notAfter,
            subject,
            keyPair.public,
        )
        val keyUsageBits = buildKeyUsageFromPurposes(params.purpose)
        if (keyUsageBits != 0) {
            builder.addExtension(Extension.keyUsage, true, KeyUsage(keyUsageBits))
        }
        val signerAlgorithm = when (keyPair.private.algorithm) {
            "EC", "ECDSA" -> "SHA256withECDSA"
            "RSA" -> "SHA256withRSA"
            else -> throw IllegalArgumentException("Unsupported key: ${keyPair.private.algorithm}")
        }
        val contentSigner = JcaContentSignerBuilder(signerAlgorithm)
            .setProvider(BouncyCastleProvider.PROVIDER_NAME)
            .build(keyPair.private)
        return JcaX509CertificateConverter().getCertificate(builder.build(contentSigner))
    }
 }
@@ -91,27 +91,33 @@ object AndroidDeviceUtils {
        attestationValueProvider: () -> ByteArray?,
        expectedSize: Int,
    ): ByteArray {
        // 1. Attempt to get the value from the system property.
        getProperty(propertyName, expectedSize)?.let {
            SystemLogger.debug("Using $propertyName from system property: ${it.toHex()}")
            persistToFile(propertyName, it)
            return it
        }
        // 2. Fallback to the value from a cached TEE attestation.
        try {
            attestationValueProvider()?.let {
                SystemLogger.debug("Using $propertyName from TEE attestation: ${it.toHex()}")
-                setProperty(propertyName, it) // Persist for consistency
+                setProperty(propertyName, it)
                persistToFile(propertyName, it)
                return it
            }
        } catch (e: Exception) {
            SystemLogger.error("Failed to get $propertyName from attestation.", e)
        }
-        // 3. As a final fallback, generate a random value.
+        readFromFile(propertyName, expectedSize)?.let {
            SystemLogger.debug("Using $propertyName from persistent file: ${it.toHex()}")
            setProperty(propertyName, it)
            return it
        }
        return generateRandomBytes(expectedSize).also {
            SystemLogger.debug("Using randomly generated $propertyName: ${it.toHex()}")
            setProperty(propertyName, it)
            persistToFile(propertyName, it)
        }
    }
@@ -158,10 +164,37 @@ object AndroidDeviceUtils {
        }
    }
    /** Generates a cryptographically random byte array of a specified length. */
    private fun generateRandomBytes(size: Int): ByteArray =
        ByteArray(size).also { ThreadLocalRandom.current().nextBytes(it) }
    private val PERSIST_DIR = File("/data/adb/tricky_store")
    private fun fileForProperty(propertyName: String): File = when (propertyName) {
        "ro.boot.vbmeta.digest" -> File(PERSIST_DIR, "boot_hash.bin")
        "ro.boot.vbmeta.public_key_digest" -> File(PERSIST_DIR, "boot_key.bin")
        else -> File(PERSIST_DIR, "${propertyName.replace('.', '_')}.bin")
    }
    private fun persistToFile(propertyName: String, bytes: ByteArray) {
        try {
            fileForProperty(propertyName).writeBytes(bytes)
        } catch (e: Exception) {
            SystemLogger.error("Failed to persist $propertyName to file.", e)
        }
    }
    private fun readFromFile(propertyName: String, expectedSize: Int): ByteArray? {
        return try {
            val file = fileForProperty(propertyName)
            if (!file.exists()) return null
            val bytes = file.readBytes()
            if (bytes.size == expectedSize) bytes else null
        } catch (e: Exception) {
            SystemLogger.error("Failed to read $propertyName from file.", e)
            null
        }
    }
    // --- Patch Level Properties ---
    fun getPatchLevel(uid: Int): Int {
@@ -240,11 +273,12 @@ object AndroidDeviceUtils {
        val resolvedValue = resolveDateKeywords(value)
        return when {
            // "device_default" indicates falling back to the system property.
            resolvedValue.equals("device_default", ignoreCase = true) -> null
-            // "no" indicates this value should not be reported.
+            // Resolve from live system prop — matches what detectors see via getprop,
            // even when PIF has spoofed ro.build.version.security_patch via resetprop
            resolvedValue.equals("prop", ignoreCase = true) ->
                parsePatchLevelValue(SystemProperties.get("ro.build.version.security_patch", ""), isLong)
            resolvedValue.equals("no", ignoreCase = true) -> DO_NOT_REPORT
            // Otherwise, parse the resolved date string.
            else -> parsePatchLevelValue(resolvedValue, isLong)
        }
    }
@@ -353,9 +387,17 @@ object AndroidDeviceUtils {
        if (securityLevel == SecurityLevel.STRONGBOX) {
            return 300
        }
-        return DeviceAttestationService.CachedAttestationData?.attestVersion
+        val cached = DeviceAttestationService.CachedAttestationData?.attestVersion
        val version = cached
            ?: attestVersionMap[Build.VERSION.SDK_INT]
            ?: 400 // Default to a recent version
        val source = when {
            cached != null -> "cache"
            attestVersionMap.containsKey(Build.VERSION.SDK_INT) -> "map"
            else -> "default"
        }
        SystemLogger.debug("attestVersion=$version source=$source securityLevel=$securityLevel")
        return version
    }
    /**
@@ -364,17 +406,11 @@ object AndroidDeviceUtils {
     * @param securityLevel The security level, used to determine the correct attestation version.
     * @return The appropriate Keymaster or KeyMint version number.
     */
-    fun getKeymasterVersion(securityLevel: Int): Int {
+    fun getKeymasterVersion(securityLevel: Int): Int = getAttestVersion(securityLevel)
        val attestVersion = getAttestVersion(securityLevel)
        return if (attestVersion >= 100) attestVersion else 41 // Keymaster 4.1 for older versions
    }
    // --- APEX and Module Hash Properties ---
-    // https://cs.android.com/android/platform/superproject/+/android-latest-release:system/apex/proto/apex_manifest.proto
+    // Minimal protobuf parser for apex_manifest.pb (field 1: name, field 2: version)
    // --- Minimal Protobuf Parser for ApexManifest ---
    // Field 1: name (string)
    // Field 2: version (int64)
    private class MinimalApexManifestParser(private val data: ByteArray) {
        var pos = 0
@@ -388,13 +424,13 @@ object AndroidDeviceUtils {
                val wireType = (tag and 0x07).toInt()
                when (fieldNum) {
-                    1L -> { // name
+                    1L -> {
                        val length = readVarint().toInt()
                        if (pos + length > data.size) return null
                        name = String(data, pos, length, Charsets.UTF_8)
                        pos += length
                    }
-                    2L -> { // version
+                    2L -> {
                        version = readVarint()
                    }
                    else -> skipField(wireType)
@@ -422,19 +458,18 @@ object AndroidDeviceUtils {
        private fun skipField(wireType: Int) {
            when (wireType) {
-                0 -> readVarint() // Varint
+                0 -> readVarint()
-                1 -> pos += 8 // 64-bit
+                1 -> pos += 8
-                2 -> { // Length-delimited
+                2 -> {
                    val len = readVarint().toInt()
                    pos += len
                }
-                5 -> pos += 4 // 32-bit
+                5 -> pos += 4
                else -> throw IllegalStateException("Unknown wire type $wireType")
            }
        }
    }
    // https://cs.android.com/android/platform/superproject/main/+/main:system/apex/libs/libapexutil/apexutil.cpp
    private val apexInfos: List<Pair<String, Long>> by lazy {
        val results = mutableListOf<Pair<String, Long>>()
        val apexRoot = File("/apex")
@@ -443,22 +478,14 @@ object AndroidDeviceUtils {
            return@lazy emptyList()
        }
        // Logic from: GetActivePackages in apexutil.cpp
        apexRoot.listFiles()?.forEach { file ->
            if (!file.isDirectory) return@forEach
            val name = file.name
            // 1. Ignore "." (and implicitly "..")
            if (name.startsWith(".")) return@forEach
            // 2. Ignore directories containing '@' (active mounts usually don't have version in
            // path)
            if (name.contains("@")) return@forEach
            // 3. Ignore "sharedlibs"
            if (name == "sharedlibs") return@forEach
            // 4. Parse apex_manifest.pb
            val manifestFile = File(file, "apex_manifest.pb")
            if (manifestFile.exists()) {
                runCatching {
@@ -469,59 +496,46 @@ object AndroidDeviceUtils {
            }
        }
        // Ensure uniqueness (though filesystem scan usually prevents exact dupes,
        // strictly speaking we want to behave like a Map keyed by package name)
        results.distinctBy { it.first }
    }
    // https://cs.android.com/android/platform/superproject/main/+/main:system/security/keystore2/src/maintenance.rs
    val moduleHash: ByteArray by lazy {
        DeviceAttestationService.CachedAttestationData?.moduleHash
            ?: runCatching {
                    // 1. Create a container to hold the sort key (name encoded) and the full data
                    // (sequence encoded)
                    data class ModuleEntry(
-                        val nameEncoded: ByteArray, // The sort key
+                        val nameEncoded: ByteArray,
-                        val fullEncoded: ByteArray, // The data to hash
+                        val fullEncoded: ByteArray,
                    )
                    val modules =
                        apexInfos.map { (packageName, versionCode) ->
                            // Create the components
                            val nameOctet = DEROctetString(packageName.toByteArray(Charsets.UTF_8))
                            val versionInt = ASN1Integer(versionCode)
                            // Create the Sequence: SEQUENCE { packageName, version }
                            val vec = ASN1EncodableVector()
                            vec.add(nameOctet)
                            vec.add(versionInt)
                            val sequence = DERSequence(vec)
-                            // We store the encoded name separately because Rust sorts ONLY by this
+                            // AOSP sorts by encoded name only, not full sequence
                            ModuleEntry(
                                nameEncoded = nameOctet.encoded,
                                fullEncoded = sequence.encoded,
                            )
                        }
                    // 2. Sort manually based on the encoded Package Name (lexicographically)
                    // This mimics the Rust 'impl DerOrd for ModuleInfo' which delegates to
                    // 'self.name'
                    val sortedModules =
                        modules.sortedWith { m1, m2 ->
                            compareByteArrays(m1.nameEncoded, m2.nameEncoded)
                        }
                    // 3. Concatenate the full sequences in the specific sorted order
                    val payloadStream = ByteArrayOutputStream()
                    sortedModules.forEach { payloadStream.write(it.fullEncoded) }
                    val payload = payloadStream.toByteArray()
-                    // 4. Wrap manually in a DER SET tag (0x31)
+                    // Wrap in DER SET tag manually — DERSet() re-sorts by full encoding
                    // We cannot use DERSet(vector) because it would re-sort incorrectly.
                    val finalDerSet = encodeAsDerSet(payload)
                    // 5. Compute SHA-256
                    MessageDigest.getInstance("SHA-256").digest(finalDerSet)
                }
                .getOrElse {
@@ -530,7 +544,6 @@ object AndroidDeviceUtils {
                }
    }
    /** Compares two byte arrays lexicographically (unsigned). */
    private fun compareByteArrays(a: ByteArray, b: ByteArray): Int {
        val length = minOf(a.size, b.size)
        for (i in 0 until length) {
@@ -543,31 +556,25 @@ object AndroidDeviceUtils {
        return a.size - b.size
    }
    /** Manually wraps the payload in an ASN.1 SET (0x31) tag with correct length encoding. */
    private fun encodeAsDerSet(payload: ByteArray): ByteArray {
        val out = ByteArrayOutputStream()
-        out.write(0x31) // ASN.1 Tag for SET
+        out.write(0x31)
        writeDerLength(out, payload.size)
        out.write(payload)
        return out.toByteArray()
    }
    /** Writes the ASN.1 length field to the stream. */
    private fun writeDerLength(out: ByteArrayOutputStream, length: Int) {
        if (length < 128) {
            // Short form
            out.write(length)
        } else {
            // Long form
            var size = length
            val bytes = ArrayList<Byte>()
            while (size > 0) {
                bytes.add((size and 0xFF).toByte())
                size = size ushr 8
            }
            // First byte: 0x80 | number of length bytes
            out.write(0x80 or bytes.size)
            // Write length bytes in big-endian (reverse of how we extracted them)
            for (i in bytes.indices.reversed()) {
                out.write(bytes[i].toInt())
            }
@@ -0,0 +1,72 @@
 package org.matrix.TEESimulator.util
 import android.annotation.SuppressLint
 import android.content.Context
 import android.content.pm.PackageManager
 import org.matrix.TEESimulator.logging.SystemLogger
 object AndroidPermissionUtils {
    @SuppressLint("PrivateApi", "DiscouragedPrivateApi")
    private fun getGlobalContext(): Context? {
        return try {
            // 1. Get the hidden ActivityThread class via reflection
            val activityThreadClass = Class.forName("android.app.ActivityThread")
            // 2. Invoke the static currentActivityThread() method
            val currentActivityThreadMethod = activityThreadClass.getDeclaredMethod("currentActivityThread")
            currentActivityThreadMethod.isAccessible = true
            val activityThread = currentActivityThreadMethod.invoke(null)
            if (activityThread == null) {
                SystemLogger.warning("Reflection: ActivityThread.currentActivityThread() returned null")
                return null
            }
            // 3. Try to get the application context
            val getApplicationMethod = activityThreadClass.getDeclaredMethod("getApplication")
            getApplicationMethod.isAccessible = true
            val application = getApplicationMethod.invoke(activityThread) as? Context
            if (application != null) return application
            // 4. Fallback to getSystemContext() if application is null (often happens in system_server)
            val getSystemContextMethod = activityThreadClass.getDeclaredMethod("getSystemContext")
            getSystemContextMethod.isAccessible = true
            getSystemContextMethod.invoke(activityThread) as? Context
        } catch (e: Exception) {
            SystemLogger.error("Reflection failed to get global context for permission check", e)
            null
        }
    }
    /**
     * Core permission check.
     */
    fun hasPermission(uid: Int, permission: String): Boolean {
        val context = getGlobalContext() ?: run {
            SystemLogger.warning("AndroidPermissionUtils: Context is null, failing permission check safely.")
            return false
        }
        val result = context.checkPermission(permission, -1, uid)
        return result == PackageManager.PERMISSION_GRANTED
    }
    fun hasDeviceAttestationPermission(uid: Int): Boolean {
        return hasPermission(uid, "android.permission.READ_PRIVILEGED_PHONE_STATE")
    }
    fun hasUniqueIdAttestationPermission(uid: Int): Boolean {
        return hasPermission(uid, "android.permission.REQUEST_UNIQUE_ID_ATTESTATION")
    }
    fun hasManageUsersPermission(uid: Int): Boolean {
        return hasPermission(uid, "android.permission.MANAGE_USERS")
    }
    fun hasDumpPermission(uid: Int): Boolean {
        return hasPermission(uid, "android.permission.DUMP")
    }
 }
@@ -8,21 +8,6 @@ import kotlin.math.exp
 import kotlin.math.ln
 import kotlin.math.max
 /**
 * Simulates realistic TEE hardware latency for software key generation.
 *
 * The delay model is derived from 64+ timing measurements across QTEE (Qualcomm) and Trustonic
 * (MediaTek) hardware. It combines four independent noise sources that model different physical
 * latency origins in a real TrustZone-based TEE:
 *
 * 1. Base crypto processing (log-normal): hardware RNG + key derivation + cert signing
 * 2. Binder/kernel transit (exponential): IPC scheduling, context switches
 * 3. TrustZone scheduler jitter (Gaussian): world-switch non-determinism
 * 4. Cold-start penalty (half-normal): first operation after idle is slower due to TEE
 *    secure world re-initialization and TLB/cache warming
 *
 * Per-boot session bias models manufacturing variance between TEE hardware instances.
 */
 object TeeLatencySimulator {
    private val rng = SecureRandom()
@@ -56,11 +41,6 @@ object TeeLatencySimulator {
        return max(20.0, base + transit + jitter + sessionBiasMs + cold)
    }
    /**
     * Log-normal base delay. Parameters tuned to match observed hardware profiles:
     * EC P-256 on QTEE averages ~65ms, RSA-2048 ~75ms, AES ~40ms.
     * Sigma kept low (0.08) to match the tight clustering seen in real measurements.
     */
    private fun sampleBaseCryptoDelay(algorithm: Int): Double {
        val (mu, sigma) =
            when (algorithm) {
@@ -1,50 +1,26 @@
-## TEESimulator-RS v5.1: Interception Architecture Rewrite
+## TEESimulator-RS v6.0.0
-Major release. 27 files changed, 2300 lines rewritten. The entire Kotlin interception layer has been rebuilt with a clean architecture, proper AIDL alignment, and significantly lower binder overhead.
+Repository consolidation release. All tee-rebuild work merged as the new main branch.
-### Interception Layer Rewrite
+### AOSP Self-Signed Cert Compliance
- KeyMintSecurityLevelInterceptor completely restructured: GeneratedKeyInfo now carries full KeyMintAttestation instead of nullable stub, eliminating scattered null checks across every operation path
+- No-challenge keys now generate self-signed certs (subject == issuer, depth 1), matching AOSP `ta/src/keys.rs:451-478`
- SoftwareOperation rewritten with sealed CryptoPrimitive interface separating Signer, Verifier, Encryptor, and Decryptor into isolated implementations with proper JCA algorithm mapping
+- Both Kotlin (BouncyCastle) and Rust (native-certgen) paths corrected
- KeystoreErrorCode centralized object replaces scattered magic numbers for all KeyMint and Keystore2 error codes
+- Eliminates attestation behavioral probes that detect keybox issuer on non-attested keys
 - listEntries moved from pre-transact parameter caching to post-transact injection, eliminating a race condition where cached params could go stale
 - deleteKey now handles both APP domain (by alias) and KEY_ID domain (by nspace) resolution paths correctly
 - AuthorizeCreate and AndroidPermissionUtils removed, authorization logic consolidated into the operation dispatch path
 - DeviceAttestationService removed, attestation routing simplified into the main interceptor
-### Software Crypto Operations
+### Stability
- GCM nonce returned in CreateOperationResponse.parameters for encrypt operations, matching real KeyMint HAL behavior
+- Binder stress crash hardening for concurrent generateKey calls
- updateAad correctly throws INVALID_TAG on non-AEAD operations instead of silently succeeding
+- AUTO mode TEE race for consistent attestation on devices with working G10
- Cipher algorithm mapping cleaned up: dropped CTR block mode and RSA_PKCS1_1_5_SIGN padding that caused JCA provider mismatches
+- Oversized transactions routed to software gen instead of crashing
- All crypto exceptions wrapped as ServiceSpecificException with correct KeyMint error codes instead of raw exceptions
+- Operation-time params (BLOCK_MODE, PADDING, DIGEST) passed through to CipherPrimitive
-### Attestation & Certificate Generation
+### Banking App Compatibility
- CertificateGenerator rewritten with clean Kotlin Pair return type instead of Android's util.Pair
+- Bare `target.txt` entries now default to AUTO mode, resolved at config level to PATCH (working TEE) or GENERATE (broken TEE)
- AttestationBuilder field ordering aligned with AOSP KeyDescription ASN.1 schema
+- Fixes BHIM and similar banking apps that require TEE-backed attestation keys
- Unique ID computation follows KeyMint HAL spec: HMAC-SHA256(temporal_counter || AAID || reset_flag, HBK) truncated to 128 bits
+- Restores v5.0 behavior where AUTO was resolved before the interceptor dispatch, avoiding the non-deterministic `raceTeePatch` path
 - Patch level logging removed from hot path to reduce logcat noise on every attestation
-### Configuration & Device Properties
+### Infrastructure
- ConfigurationManager target package parsing refactored: mode/package extraction deduplicated across GENERATE/PATCH/AUTO branches
+- Version scheme changed to semver (v6.0.0)
- system=prop forced boot/vendor override removed, now respects explicit per-component patch level configuration
+- Repository moved to TEESimulator-RS as canonical source
 - FileObserver delete handler simplified with direct file access instead of defensive null-checks
 - AndroidDeviceUtils expanded with additional device property accessors for attestation fields
 ### Binder Performance
 - Safe parcel reads at 6 deserialization sites, replacing force-unwrap NPE paths with early-return on null. A single NPE generates a full stack trace that blocks the binder thread for ~2ms
 - teeResponses cache populated on generateKey/importKey post-transact, reducing getKeyEntry from 2+ binder round-trips to 1
 - pingBinder liveness check removed from pre-transact failure path, eliminating a synchronous IPC call on every failed transaction
 - Native transaction code filtering at C++ level, skipping JNI entirely for PING/INTERFACE/DUMP
 ### Dynamic SecurityLevel Binder Registration
 - Intercepts getSecurityLevel replies to register hooks on every new BBinder instance keystore2 returns, not just the initial one from setup
 - Identity hash deduplication prevents double-hooking when keystore2 returns the same binder across multiple calls
 - Resolves apps that call getSecurityLevel independently and receive a different binder than the one registered at startup
 ### Build & Packaging
 - Rust native build task integrated into Gradle with cargo-ndk for aarch64/armv7/x86/x86_64
 - Module ZIP includes all 4 native libraries (libTEESimulator, libsupervisor, libcertgen, libinject)
 - customize.sh extraction restored for supervisor daemon and native cert gen library
 - TeeLatencySimulator added as standalone utility for log-normal hardware latency emulation
 ---
@@ -1,6 +1,6 @@
 {
-	"version": "v4.5",
+	"version": "v6.0.0",
-	"versionCode": 111,
+	"versionCode": 155,
-	"zipUrl": "https://github.com/Enginex0/TEESimulator/releases/download/v4.5/TEESimulator-v4.5-Release.zip",
+	"zipUrl": "https://github.com/Enginex0/TEESimulator-RS/releases/latest/download/TEESimulator-RS-Release.zip",
-	"changelog": "https://raw.githubusercontent.com/Enginex0/TEESimulator/main/module/changelog.md"
+	"changelog": "https://raw.githubusercontent.com/Enginex0/TEESimulator-RS/main/module/changelog.md"
 }
@@ -14,9 +14,69 @@ const OID_SHA256_WITH_RSA: &[u64] = &[1, 2, 840, 113549, 1, 1, 11];
 // Extension OIDs
 const OID_KEY_USAGE: &[u64] = &[2, 5, 29, 15];
 // AOSP ta/src/keys.rs:451-478: no challenge = self-signed leaf, chain depth 1
 pub fn build_self_signed_cert(
    key_pair: &GeneratedKeyPair,
    params: &CertGenParams,
 ) -> Result<Vec<Vec<u8>>> {
    let spki_der = extract_spki_from_pkcs8(&key_pair.private_key_pkcs8)?;
    let sig_alg_der = signature_algorithm_for_signing_key(&key_pair.private_key_pkcs8, params.algorithm)?;
    let serial_bytes = if let Some(ref serial) = params.cert_serial {
        serial.clone()
    } else {
        vec![1u8]
    };
    let subject_dn_der = if let Some(ref subject) = params.cert_subject {
        subject.clone()
    } else {
        encode_simple_cn_dn("Android Keystore Key")
    };
    let not_before = timestamp_to_datetime(params.cert_not_before)?;
    let not_after = if params.cert_not_after == -1 {
        // No keybox fallback available; use far-future (year 9999)
        OffsetDateTime::from_unix_timestamp(253402300799)
            .unwrap_or_else(|_| OffsetDateTime::now_utc() + time::Duration::days(365 * 30))
    } else {
        timestamp_to_datetime(params.cert_not_after)?
    };
    let extensions_der = build_extensions(None, &params.purposes)?;
    let version_der = encode_der_explicit_tag(0, &encode_der_integer(&[2]));
    let serial_der = encode_der_integer(&serial_bytes);
    let validity_der = encode_validity(&not_before, &not_after);
    let extensions_tagged = encode_der_explicit_tag(3, &extensions_der);
    // issuer == subject (self-signed, per AOSP ta/src/cert.rs:111-114)
    let tbs_der = encode_der_sequence(&[
        &version_der,
        &serial_der,
        &sig_alg_der,
        &subject_dn_der,
        &validity_der,
        &subject_dn_der,
        &spki_der,
        &extensions_tagged,
    ]);
    let signature_bytes = sign_tbs(&tbs_der, &key_pair.private_key_pkcs8, params.algorithm)?;
    let signature_bit_string = encode_der_bit_string(&signature_bytes);
    let cert_der = encode_der_sequence(&[
        &tbs_der,
        &sig_alg_der,
        &signature_bit_string,
    ]);
    Ok(vec![cert_der])
 }
 pub fn build_certificate_chain(
    key_pair: &GeneratedKeyPair,
-    attestation_ext_der: &[u8],
+    attestation_ext_der: Option<&[u8]>,
    keybox: &ParsedKeybox,
    params: &CertGenParams,
 ) -> Result<Vec<Vec<u8>>> {
@@ -33,7 +93,7 @@ pub fn build_certificate_chain(
 fn build_leaf_cert(
    key_pair: &GeneratedKeyPair,
-    attestation_ext_der: &[u8],
+    attestation_ext_der: Option<&[u8]>,
    keybox: &ParsedKeybox,
    params: &CertGenParams,
 ) -> Result<Vec<u8>> {
@@ -63,7 +123,6 @@ fn build_leaf_cert(
        timestamp_to_datetime(params.cert_not_after)?
    };
    // Extensions
    let extensions_der = build_extensions(attestation_ext_der, &params.purposes)?;
    // TBS Certificate
@@ -256,19 +315,19 @@ fn extract_rsa_spki(pkcs8_der: &[u8]) -> Result<Vec<u8>> {
    Ok(encode_der_sequence(&[&alg_id, &pub_key_bits]))
 }
-fn build_extensions(attestation_ext_der: &[u8], purposes: &[i32]) -> Result<Vec<u8>> {
+fn build_extensions(attestation_ext_der: Option<&[u8]>, purposes: &[i32]) -> Result<Vec<u8>> {
    let mut extensions: Vec<Vec<u8>> = Vec::new();
    // KeyUsage extension (critical)
    let ku_byte = map_key_usage_byte(purposes);
    if ku_byte != 0 {
        let ku_ext = build_key_usage_extension(ku_byte);
        extensions.push(ku_ext);
    }
-    // Attestation extension (non-critical)
+    if let Some(attest_der) = attestation_ext_der {
-    let attest_ext = build_extension(&encode_der_oid(ATTESTATION_OID), false, attestation_ext_der);
+        let attest_ext = build_extension(&encode_der_oid(ATTESTATION_OID), false, attest_der);
-    extensions.push(attest_ext);
+        extensions.push(attest_ext);
    }
    Ok(encode_der_sequence_of(&extensions))
 }
@@ -62,14 +62,13 @@ fn generate_attested_inner(env: &mut JNIEnv, config: &JObject) -> Result<jbyteAr
    let keybox = keybox::parse_keybox(&params.keybox_cert_chain, &params.keybox_private_key)?;
-    let attest_ext = attestation::build_attestation_extension(&params)?;
+    let cert_chain = if params.attestation_challenge.is_some() {
-
+        let attest_ext = attestation::build_attestation_extension(&params)?;
-    let cert_chain = certbuilder::build_certificate_chain(
+        certbuilder::build_certificate_chain(&key_pair, Some(&attest_ext), &keybox, &params)?
-        &key_pair,
+    } else {
-        &attest_ext,
+        tracing::info!("no attestation challenge, generating self-signed cert (depth 1)");
-        &keybox,
+        certbuilder::build_self_signed_cert(&key_pair, &params)?
-        &params,
+    };
    )?;
    let blob = assemble_result(&key_pair.private_key_pkcs8, &cert_chain);
@@ -1,8 +0,0 @@
 package android.hardware.security.keymint;
 public @interface HardwareAuthenticatorType {
    int NONE = 0;
    int PASSWORD = 1;
    int FINGERPRINT = 2;
    int ANY = -1;
 }
@@ -1,6 +1,5 @@
 package android.os;
 /** Stub for android.os.SELinux. */
 public class SELinux {
    public static boolean checkSELinuxAccess(
            String scon, String tcon, String tclass, String perm) {
@@ -1,21 +1,14 @@
 package android.os;
 /**
 * Stub for android.os.ServiceSpecificException.
 *
 * <p>Used by AIDL-generated binder stubs to report service-specific errors with numeric codes.
 * The binder framework serializes this as EX_SERVICE_SPECIFIC on the wire, preserving the integer
 * error code for the client.
 */
 public class ServiceSpecificException extends RuntimeException {
    public final int errorCode;
    public ServiceSpecificException(int errorCode) {
        this.errorCode = errorCode;
    }
    public ServiceSpecificException(int errorCode, String message) {
        super(message);
        this.errorCode = errorCode;
    }
    public ServiceSpecificException(int errorCode) {
        this(errorCode, null);
    }
 }
Author	SHA1	Message	Date
Enginex0	18724cf40d	docs(changelog): add AUTO mode banking app fix to v6.0.0 notes	2026-03-31 18:59:28 +01:00
Enginex0	1b7800345d	fix(config): restore AUTO mode resolution for bare target entries v6.0 changed bare target.txt entries from AUTO to GENERATE, breaking apps like BHIM that need TEE-backed attestation keys. Restore AUTO as default and resolve it at config level (PATCH if TEE works, GENERATE if not) to bypass the non-deterministic raceTeePatch path.	2026-03-31 18:53:18 +01:00
Enginex0	54c12a9fd5	docs(readme): rewrite for TEESimulator-RS v6.0.0 Fix all links from old TEESimulator repo, strip emoji clutter, add v6.0.0 changelog, update update.json to point at new repo.	2026-03-26 12:34:36 +01:00
Enginex0	1bc47840d5	chore(version): bump to v6.0.0	2026-03-26 12:28:23 +01:00
Enginex0	c8fadb07ae	fix(certgen): self-signed certs for no-challenge keys per AOSP spec AOSP ta/src/keys.rs:451-478 requires self-signed leaf (depth 1) when no attestation challenge is provided. Both Kotlin and Rust paths now return subject==issuer, signed by generated key, no attestation extension. Adds cert chain trace logging in debug builds.	2026-03-26 12:28:17 +01:00
Enginex0	c0b14eeeb1	fix(operation): pass operation-time params through to CipherPrimitive createOperation was building effectiveParams from key-generation params but dropping operation-time fields (nonce, blockMode, padding, minMacLength). This caused GCM decrypt to fail with "IV must be specified in GCM mode" since the nonce from the begin call never reached CipherPrimitive. Also adds nonce field to KeyMintAttestation and handles GCM/CBC/CTR IV initialization in CipherPrimitive.	2026-03-26 05:03:01 +01:00
Enginex0	47ab0225e1	fix(certgen): omit attestation extension when no challenge provided AOSP KeyMint only includes the attestation extension (OID 1.3.6.1.4.1.11129.2.1.17) when ATTESTATION_CHALLENGE is present. Without a challenge, generateKey produces a plain self-signed cert. Our code unconditionally added the extension, which behavioral probes detect by generating a key without a challenge and checking for the OID. Fixes both the Rust native-certgen and BouncyCastle paths. Also skips AAID computation when no challenge is provided, matching keystore2 security_level.rs:457 behavior.	2026-03-26 04:22:22 +01:00
Enginex0	ebb6336281	fix(interception): patch authorizations on import-overwrite path The retained cert chain was applied to response metadata but the authorizations array was left unpatched, allowing a detector to compare metadata patch levels against cert attestation values and spot the divergence. Refs upstream JingMatrix #164.	2026-03-26 02:49:01 +01:00
Enginex0	784373c8b5	feat(config): default bare target entries to GENERATE mode PATCH and AUTO modes inherit the real TEE's attestation quirks (epoch 0 cert dates, version mismatch, missing USAGE_COUNT_LIMIT) which can't be fixed in post-patch. GENERATE mode builds attestation from scratch with full control over every field. Users who want real TEE key generation can still use the ? suffix for explicit PATCH mode.	2026-03-26 02:32:14 +01:00
Enginex0	2241bfb13d	perf(logging): add rate limiter and lazy formatting to SystemLogger Under binder stress, debug builds hammered logd with 6-7 syscalls per keygen, causing thread contention that spiked ping latency past G10b's threshold. Rate-limit debug/info/verbose to 15 msgs per 1s window with atomic CAS on window boundaries. Warnings and errors always pass. Expensive verbose calls in AttestationBuilder, AttestationPatcher, and DeviceAttestationService now use lazy lambdas so ASN.1 formatting only runs when the message will actually be emitted.	2026-03-26 02:11:17 +01:00
Enginex0	954478b89b	perf(interception): optimize ioctl hook hot path for ping latency Strip LOGV from the buffer parse loop and add a fast pre-check that peeks at the first binder command before entering the full parser. Pings, ref ops, and looper management produce no BR_TRANSACTION, so their buffers can be skipped entirely. Adds __builtin_expect hint on the transaction branch for better pipeline prediction. Drops G2 binder ping ratio from 3.95x to 1.17x in debug builds.	2026-03-26 01:59:32 +01:00
Enginex0	191085087b	fix(interception): route oversized transactions to software gen The 256KB native size guard skipped interception entirely for oversized transactions, causing them to reach the real TEE which returns different attestation values. This inconsistency is exactly what G10 detects. Oversized requests now flow through to the Kotlin layer where they hit doSoftwareKeyGen via the forceGenerate flag. Software gen produces consistent attestation without forwarding to the real TEE, preserving the anti-amplification defense that the original guard intended.	2026-03-26 01:30:07 +01:00
Enginex0	f870598e77	fix(interception): resolve B3, C2, F1 and harden AUTO mode B3: AttestationPatcher now accepts optional notBefore/notAfter overrides so the PATCH path honors CERTIFICATE_NOT_BEFORE instead of inheriting the real TEE's epoch 0. C2: getKeymasterVersion delegates to getAttestVersion directly, ensuring attestationVersion == keymasterVersion regardless of cache source. F1: Remove incorrect EC+DECRYPT guard in AuthorizeCreate that returned UNSUPPORTED_PURPOSE instead of INCOMPATIBLE_PURPOSE. AUTO mode: Replace volatile teeFunctional boolean with AtomicReference tri-state (null/true/false) so the first race winner locks the path for all subsequent requests, preventing mixed attestation under concurrency.	2026-03-26 01:27:43 +01:00