chore(release): publish v6.0.0-235

Duck-Detector's generate-mode parser walks the reply parcel at
12-byte strides and matches (secLevel=256, tag=1, unionTag=32) at
slot[count-1]. Those bytes are actually KEY_SIZE.value=256 followed
by the next Authorization's presence flag and size header — an
emergent fingerprint from misaligned parsing, not a fake value.

Reorder toAuthorizations so PURPOSE/ALGORITHM/KEY_SIZE come first,
mirroring AOSP keymint reference HAL output. KEY_SIZE moves from
auth#4 to auth#2, so its int payload no longer lands at byte 224.
Verified across 31 fresh duckdetector probes: zero matches (was
15/36 before).

Also add gen-mode wire-byte diagnostic to InterceptorUtils and the
generate-mode entry point, debug-gated, dumping request and reply
parcels to /data/local/tmp for offline decode.

.github/workflows/build.yml

@@ -149,3 +149,21 @@ jobs:
         env:
           VER: ${{ steps.ver.outputs.version }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Bump update.json
+        run: |
+          COUNT=$(git rev-list HEAD --count)
+          RELEASE_NAME=$(basename zips/*Release*.zip)
+          ZIP_URL="https://github.com/${{ github.repository }}/releases/download/${VER}/${RELEASE_NAME}"
+          jq ".versionCode = $COUNT | .zipUrl = \"$ZIP_URL\"" module/update.json > /tmp/update.json
+          mv /tmp/update.json module/update.json
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add module/update.json
+          git diff --cached --quiet || {
+            git commit -m "chore(release): bump update.json to $VER [skip ci]"
+            git push origin HEAD:main
+          }
+        env:
+          VER: ${{ steps.ver.outputs.version }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

README.md

@@ -1,259 +1,139 @@
 <p align="center">
-  <h1 align="center">🔐 TEESimulator</h1>
+  <h1 align="center">TEESimulator-RS</h1>
   <p align="center"><b>Full TEE Emulation for Rooted Android</b></p>
-  <p align="center">Hardware attestation. Software keys. Zero detection.</p>
   <p align="center">
-    <a href="https://github.com/Enginex0/TEESimulator/actions/workflows/build.yml"><img src="https://github.com/Enginex0/TEESimulator/actions/workflows/build.yml/badge.svg" alt="Build"></a>
+    <a href="https://github.com/Enginex0/TEESimulator-RS/actions/workflows/build.yml"><img src="https://github.com/Enginex0/TEESimulator-RS/actions/workflows/build.yml/badge.svg" alt="Build"></a>
-    <img src="https://img.shields.io/badge/version-v4.2-blue?style=for-the-badge" alt="v4.2">
+    <img src="https://img.shields.io/badge/Android-10%2B-green?logo=android" alt="Android 10+">
-    <img src="https://img.shields.io/badge/Android-10%2B-green?style=for-the-badge&logo=android" alt="Android 10+">
+    <a href="https://t.me/superpowers9"><img src="https://img.shields.io/badge/Telegram-community-blue?logo=telegram" alt="Telegram"></a>
-    <img src="https://img.shields.io/badge/Telegram-community-blue?style=for-the-badge&logo=telegram" alt="Telegram">
   </p>
 </p>
 
 ---
 
 > [!NOTE]
-> **This is a personal fork of [JingMatrix/TEESimulator](https://github.com/JingMatrix/TEESimulator)** with additional hardening, native Rust certificate generation, key persistence, and anti-detection features. For the upstream project, see the original repo.
+> Fork of [JingMatrix/TEESimulator](https://github.com/JingMatrix/TEESimulator) with native Rust certificate generation, key persistence, and AOSP-compliant attestation behavior. For the upstream project, see the original repo.
 
----
+## What It Does
 
-## 🧬 What is TEESimulator?
+TEESimulator intercepts Binder IPC at the `ioctl` level inside the `keystore2` process and generates entire certificate chains from scratch, signed by your keybox, with correct attestation extensions. Apps that verify hardware attestation see a legitimate device.
 
-TEESimulator is a **complete software simulation** of Android's hardware-backed [Trusted Execution Environment](https://source.android.com/docs/security/features/trusty) for [Key Attestation](https://developer.android.com/privacy-and-security/security-key-attestation). Instead of patching certificates from the real TEE after the fact, TEESimulator intercepts Binder IPC at the `ioctl` level and generates entire certificate chains from scratch — signed by your keybox, with correct attestation extensions, indistinguishable from hardware-generated keys.
+This is not TrickyStore. TEESimulator replaces TrickyStore and its forks entirely. It shares the same config paths for drop-in compatibility, but the internals are different: native Rust cert generation, binder-level interception via `lsplt`, per-UID rate limiting, key persistence, and AOSP-spec attestation behavior.
 
-The result: **apps that verify hardware attestation see a legitimate, unmodified device** — even on rooted hardware with an unlocked bootloader.
+## Requirements
-
-> **This is not TrickyStore.** TEESimulator replaces TrickyStore and its forks entirely. It shares the same config paths for drop-in compatibility, but the architecture is fundamentally different: native Rust certificate generation, binder-level interception via `lsplt`, per-UID rate limiting, key persistence, and a multi-layer defense against detector apps.
-
----
-
-## 🔥 Why TEESimulator?
-
-🔐 **Native Cert Generation** — v4.0 generates X.509 certificate chains in Rust with `ring` and manual DER encoding. No BouncyCastle overhead, no Java crypto quirks, byte-perfect issuer chain linkage.
-
-🎯 **Binder-Level Interception** — Hooks `ioctl()` on `libc.so` via `lsplt` inside the `keystore2` process. Intercepts `generateKey`, `importKey`, and `getKeyEntry` transactions before the HAL ever sees them.
-
-🛡️ **Detector Resistant** — Per-UID rate limiting blocks DuckDetector-style keygen flooding. Oversized challenges rejected with real KeyMint error codes. Chain consistency verified byte-for-byte.
-
-💾 **Key Persistence** — Generated keys survive reboots. Apps that store attestation keys (banking, biometrics) don't break after a restart.
-
-🔧 **Drop-In Replacement** — Same config paths as TrickyStore (`/data/adb/tricky_store/`). Swap the module ZIP, keep your keybox and target list.
-
----
-
-## ✨ Features
-
-**Core Attestation Engine**
-- [x] **Full certificate chain generation** — leaf + intermediates + root, signed by your keybox
-- [x] **Native Rust certgen** — `libcertgen.so` built with `ring`, `rsa`, and manual DER assembly
-- [x] **BouncyCastle fallback** — unsupported curves (P-224, P-521, Curve25519) fall back to Java
-- [x] **ASN.1 attestation extensions** — OID 1.3.6.1.4.1.11129.2.1.17 with all AOSP-specified tags
-- [x] **Multi-keybox support** — different keybox files per app group via `target.txt`
-
-**Interception Layer**
-- [x] **Binder ioctl hook** — `lsplt` PLT hook on `libc.so` inside `keystore2` process
-- [x] **generateKey / importKey / getKeyEntry** — all three transaction types intercepted
-- [x] **256KB native payload cap** — oversized binder payloads bypass interception cleanly
-- [x] **Challenge validation** — rejects >128-byte attestation challenges with `INVALID_INPUT_LENGTH`
-
-**Hardening**
-- [x] **Per-UID rate limiter** — 2 hardware keygens per 30s burst window, software fallback on overflow
-- [x] **importKey eviction guard** — retained patch chains prevent generate-then-import cache attacks
-- [x] **Key persistence** — file-backed storage with file-level locking, survives reboots and keybox rotations
-- [x] **Global exception handler** — uncaught exceptions logged, daemon stays alive
-
-**Configuration**
-- [x] **Live config reload** — `FileObserver` watches all config files, changes apply immediately
-- [x] **Security patch spoofing** — per-package `system`, `vendor`, `boot` patch levels with dynamic templates
-- [x] **Lifecycle scripts** — KSU Action button clears key cache, uninstall removes all traces
-
----
-
-## 📋 Requirements
 
 > [!IMPORTANT]
-> TEESimulator requires root access and a valid `keybox.xml` for hardware-level attestation results. Without a keybox, the module generates software-level certificates that won't pass strict hardware attestation checks.
+> A valid `keybox.xml` is required for hardware-level attestation. Without one, the module generates software-level certificates that won't pass strict hardware checks.
 
-**You need:**
+1. Android 10+
-1. Android 10 or above
+2. Root manager: KernelSU, Magisk, or APatch
-2. A supported root manager (KernelSU, Magisk, or APatch)
+3. `keybox.xml` at `/data/adb/tricky_store/keybox.xml`
-3. A hardware-backed `keybox.xml` placed at `/data/adb/tricky_store/keybox.xml`
 
----
+## Quick Start
 
-## 📱 Compatibility
+1. Download the latest ZIP from [Releases](https://github.com/Enginex0/TEESimulator-RS/releases)
+2. Install via your root manager and reboot
+3. Place your keybox at `/data/adb/tricky_store/keybox.xml`
+4. Configure targets in `/data/adb/tricky_store/target.txt`
+5. Verify with Play Integrity or Key Attestation Demo
 
-### Root Managers
+## Architecture
 
-| Manager | Status | Notes |
+**Native Cert Generation** — `libcertgen.so` generates X.509 chains in Rust using `ring` and manual DER encoding. BouncyCastle fallback for unsupported curves (P-224, P-521, Curve25519).
-|---|---|---|
-| KernelSU | ✅ Tested | Full support including Action button and lifecycle scripts |
-| Magisk | ✅ Supported | Standard module install |
-| APatch | ✅ Supported | Standard module install |
 
-### Tested Devices
+**Binder Interception** — PLT hook on `ioctl()` in `libc.so` via `lsplt` inside `keystore2`. Intercepts `generateKey`, `importKey`, and `getKeyEntry` transactions.
 
-| Device | Android | TEE | Status |
+**AOSP Compliance** — Self-signed certs for non-attested keys (matching `ta/src/keys.rs`), correct AuthorizationList tag ordering, version-guarded extension fields, `authorize_create` enforcement.
-|---|---|---|---|
-| Redmi 14C (2409BRN2CA) | 14 (SDK 34) | Beanpod KeyMaster | ✅ Daily driver |
 
-> Tested against DuckDetector, Luna, Play Integrity, and Key Attestation Demo. If you test on a different device, [open an issue](https://github.com/Enginex0/TEESimulator/issues) with your results.
+**Key Persistence** — Generated keys survive reboots. File-backed with file-level locking.
 
----
+**Rate Limiting** — Per-UID hardware keygen cap (2/30s window, 2 concurrent). Overflow falls to software certs.
 
-## 🚀 Quick Start
+## Configuration
 
-1. **Download** the latest release ZIP from [Releases](https://github.com/Enginex0/TEESimulator/releases)
+All config files live at `/data/adb/tricky_store/` and are hot-reloaded via `FileObserver`.
-2. **Install** via your root manager (KSU / Magisk / APatch) and reboot
-3. **Place your keybox** at `/data/adb/tricky_store/keybox.xml`
-4. **Configure targets** in `/data/adb/tricky_store/target.txt`
-5. **Verify** — check Play Integrity or run Key Attestation Demo
 
-TEESimulator replaces TrickyStore, TrickyStoreOSS, and their forks. Existing config files are compatible.
+### target.txt
 
----
+Controls which apps get intercepted and the simulation mode.
 
-## 🔨 Building from Source
+| Suffix | Mode |
+|--------|------|
+| `!` | Force software key generation |
+| `?` | Force leaf certificate patching (real TEE key, patched cert) |
+| *(none)* | Automatic selection |
 
-The CI workflow builds on every push to `main`. You can also build locally or trigger a build from your own fork.
+Multi-keybox support via `[filename.xml]` headers:
-
-**Prerequisites:** JDK 21, Android SDK/NDK 27, Rust stable with `aarch64-linux-android` target, `cargo-ndk`.
-
-```bash
-git clone https://github.com/Enginex0/TEESimulator.git
-cd TEESimulator
-./gradlew zipRelease zipDebug
-```
-
-Output ZIPs land in `out/`. The Gradle build automatically invokes `cargo ndk` to cross-compile `libcertgen.so` before packaging.
-
-To rebuild from a fork, push to `main` or use **Actions → Build → Run workflow**. The workflow installs all toolchains (Java, Rust, cargo-ndk, ccache) and uploads Release + Debug ZIPs as artifacts.
-
----
-
-## ⚙️ Configuration
-
-All configuration files live at `/data/adb/tricky_store/` and are monitored by `FileObserver` — changes take effect immediately without rebooting.
-
-### The `keybox.xml` Root of Trust
-
-This file provides the master cryptographic identity. It contains a private key and a hardware-backed certificate chain from a real device. TEESimulator signs all generated certificates with this key, making them appear legitimate to verifiers.
-
-```xml
-<?xml version="1.0"?>
-<AndroidAttestation>
-    <Keybox DeviceID="...">
-        <Key algorithm="ecdsa|rsa">
-            <PrivateKey format="pem">...</PrivateKey>
-            <CertificateChain>...</CertificateChain>
-        </Key>
-    </Keybox>
-</AndroidAttestation>
-```
-
-### Target Packages (`target.txt`)
-
-Controls which apps get intercepted and what simulation mode to use.
-
-#### Mode Suffixes
-
-*   **`!` → Force Generation** — Creates a complete software-based virtual key. Full TEE simulation.
-*   **`?` → Force Leaf Hacking** — Real TEE key generated, but its attestation certificate is intercepted and patched.
-*   **No symbol → Automatic** — Module selects the best mode for your device.
-
-#### Multi-Keybox
-
-Specify different keybox files for different app groups. Apps listed after a `[filename.xml]` line use that keybox. Apps before any declaration use the default `keybox.xml`.
 
 ```
-# Default keybox
 com.google.android.gms!
 io.github.vvb2060.keyattestation?
 
-# Switch to a different keybox for the following apps
 [aosp_keybox.xml]
 com.google.android.gsf
-
-# Another keybox
-[demo_keybox.xml]
-org.matrix.demo
 ```
 
-### Security Patch Level (`security_patch.txt`)
+### security_patch.txt
 
-Configure the `osPatchLevel`, `vendorPatchLevel`, and `bootPatchLevel` reported in attestation certificates. This only affects attestation data — it does not change actual system properties.
+Override patch levels reported in attestation certificates. Global defaults at top, per-package overrides with `[package.name]`.
-
-#### Global and Per-Package
-
-Settings at the top of the file are global defaults. Add `[package.name]` to override for specific apps.
-
-#### Keys
 
 | Key | Scope |
-|---|---|
+|-----|-------|
 | `system` | OS patch level |
 | `vendor` | Vendor patch level |
 | `boot` | Boot/kernel patch level |
-| `all` | Shorthand — sets all three at once |
+| `all` | Sets all three |
 
-#### Special Keywords
+Special values: `today`, `YYYY-MM-DD` templates, `no` (omit tag), `device_default`, `prop` (read from system property).
-
-| Keyword | Effect |
-|---|---|
-| `today` | Current date, dynamically resolved on each attestation |
-| `YYYY-MM-DD` templates | Semi-dynamic — `YYYY-MM-05` resolves to the 5th of the current month |
-| `no` | Omit this patch level tag entirely from the attestation |
-| `device_default` | Use the device's real hardware value |
-| `prop` | Read from `ro.build.version.security_patch` (matches what detectors see via getprop) |
-
-#### Example
 
 ```
-# Global — default for all apps
 system=YYYY-MM-05
 vendor=device_default
 boot=no
 
-# Override for GMS
 [com.google.android.gms]
-system=2024-10-01
+system=2025-10-01
-
-# Custom config for a demo app
-[org.matrix.demo]
-all=2025-09-15
-boot=device_default
 ```
 
----
+## Building from Source
 
-## 💬 Community
+Prerequisites: JDK 21, Android SDK/NDK 27, Rust stable with `aarch64-linux-android` target, `cargo-ndk`.
+
+```bash
+git clone --recursive https://github.com/Enginex0/TEESimulator-RS.git
+cd TEESimulator-RS
+./gradlew zipRelease zipDebug
+```
+
+Output ZIPs in `out/`. Gradle invokes `cargo ndk` automatically to cross-compile `libcertgen.so`.
+
+Push to `main` or use **Actions > Build > Run workflow** to trigger CI.
+
+## Compatibility
+
+| Root Manager | Status |
+|---|---|
+| KernelSU | Tested (Action button + lifecycle scripts) |
+| Magisk | Supported |
+| APatch | Supported |
+
+## Community
 
 <p align="center">
   <a href="https://t.me/superpowers9">
-    <img src="https://img.shields.io/badge/⚡_JOIN_THE_GRID-SuperPowers_Telegram-black?style=for-the-badge&logo=telegram&logoColor=cyan&labelColor=0d1117&color=00d4ff" alt="Telegram">
+    <img src="https://img.shields.io/badge/SuperPowers_Telegram-Join-blue?style=for-the-badge&logo=telegram" alt="Telegram">
   </a>
 </p>
 
----
+## Credits
 
-## 🙏 Credits
+- [JingMatrix](https://github.com/JingMatrix/TEESimulator) — original TEESimulator and interception architecture
+- [5ec1cff](https://github.com/5ec1cff/TrickyStore) — TrickyStore, the project that pioneered keystore interception
+- [LSPlt](https://github.com/LSPosed/LSPlt) — PLT hook library
+- [ring](https://github.com/briansmith/ring) — Rust cryptography library
+- [MhmRdd](https://github.com/MhmRdd) — AOSP compliance work via upstream [PR #157](https://github.com/JingMatrix/TEESimulator/pull/157)
+- [fatalcoder524](https://github.com/fatalcoder524) — contributor and collaborator
+- [huguangares](https://github.com/huguangares) — collaborator and tester
 
-- **[JingMatrix](https://github.com/JingMatrix/TEESimulator)** — original author of TEESimulator and the interception architecture
+## License
-- **[5ec1cff](https://github.com/5ec1cff/TrickyStore)** — TrickyStore, the project that pioneered keystore interception on Android
-- **[LSPlt](https://github.com/LSPosed/LSPlt)** — PLT hook library used for binder interception
-- **[ring](https://github.com/briansmith/ring)** — Rust cryptography library powering native cert generation
-- **[MhmRdd](https://github.com/MhmRdd)** — AOSP compliance improvements via upstream [PR #157](https://github.com/JingMatrix/TEESimulator/pull/157), including authorize_create enforcement, attestation extension alignment, and binder transaction filtering
-- **[fatalcoder524](https://github.com/fatalcoder524)** — a real contributor and collaborator on this project
-- **[huguangares](https://github.com/huguangares)** — collaborator and tester
 
----
+[GNU General Public License v3.0](LICENSE)
-
-## 📄 License
-
-This project is licensed under the [GNU General Public License v3.0](LICENSE).
-
----
-
-<p align="center">
-  <b>🔐 Because the best attestation is the one the TEE never generated.</b>
-</p>

app/build.gradle.kts

@@ -2,6 +2,7 @@ import com.android.build.api.artifact.SingleArtifact
 import java.io.ByteArrayOutputStream
 import javax.inject.Inject
 import org.gradle.process.ExecOperations
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
 
 plugins {
     alias(libs.plugins.android.application)
@@ -29,7 +30,7 @@ val gitExecutor = objects.newInstance(GitExecutor::class.java)
 
 val gitCommitCount = gitExecutor.execute("git rev-list HEAD --count", rootDir).toInt()
 val gitCommitHash = gitExecutor.execute("git rev-parse --verify --short HEAD", rootDir)
-val verName = "v5.0"
+val verName = "v6.0.0"
 
 android {
     namespace = "org.matrix.TEESimulator"
@@ -65,6 +66,12 @@ android {
     }
 }
 
+kotlin {
+    compilerOptions {
+        jvmTarget.set(JvmTarget.JVM_21)
+    }
+}
+
 dependencies {
     compileOnly(project(":stub"))
     compileOnly(libs.annotation)
@@ -91,6 +98,7 @@ val buildRustCertgen by tasks.registering(Exec::class) {
     outputs.dir(rootProject.projectDir.resolve("app/src/main/jniLibs"))
 
     environment("ANDROID_NDK_HOME", android.ndkDirectory.absolutePath)
+    environment("PATH", "${System.getProperty("user.home")}/.cargo/bin:${System.getenv("PATH") ?: ""}")
 }
 
 // AGP auto-detects jniLibs/ as an input to mergeJniLibFolders — wire the dependency
@@ -100,6 +108,34 @@ tasks.configureEach {
     }
 }
 
+// Auto-rewrite module/update.json on every packaging build so versionCode and
+// zipUrl track gitCommitCount automatically, matching module.prop.
+val refreshUpdateJson by tasks.registering {
+    group = "TEESimulator-RS Module Packaging"
+    description = "Rewrite module/update.json to match current verName and gitCommitCount."
+
+    val updateJsonFile = rootProject.projectDir.resolve("module/update.json")
+    val capturedVerName = verName
+    val capturedCount = gitCommitCount
+
+    inputs.property("verName", capturedVerName)
+    inputs.property("gitCommitCount", capturedCount)
+    outputs.file(updateJsonFile)
+
+    doLast {
+        val fullVer = "$capturedVerName-$capturedCount"
+        updateJsonFile.writeText(
+            """{
+  "version": "$fullVer",
+  "versionCode": $capturedCount,
+  "zipUrl": "https://github.com/Enginex0/TEESimulator-RS/releases/download/$fullVer/TEESimulator-RS-$fullVer-Release.zip",
+  "changelog": "https://raw.githubusercontent.com/Enginex0/TEESimulator-RS/main/module/changelog.md"
+}
+"""
+        )
+    }
+}
+
 androidComponents {
     onVariants(selector().all()) { variant ->
         val capitalized = variant.name.replaceFirstChar { it.uppercase() }
@@ -124,6 +160,7 @@ androidComponents {
                     dependsOn("strip${capitalized}DebugSymbols")
                 }
                 dependsOn(buildRustCertgen)
+                dependsOn(refreshUpdateJson)
 
                 if (isDebug) {
                     from(variant.artifacts.get(SingleArtifact.APK)) {

app/src/main/cpp/binder_interceptor.cpp

@@ -350,16 +350,10 @@ static sp<BinderStub> g_stub_instance = nullptr;
 
 namespace {
 
-constexpr binder_size_t kMaxInterceptableDataSize = 256 * 1024;
-
 void inspectAndRewriteTransaction(binder_transaction_data *txn_data) {
     if (!txn_data || txn_data->target.ptr == 0)
         return;
 
-    // Bypass interception for oversized payloads to prevent thread starvation from flood attacks
-    if (txn_data->data_size > kMaxInterceptableDataSize)
-        return;
-
     // AIDL methods use codes in [FIRST_CALL_TRANSACTION, LAST_CALL_TRANSACTION] (1..0x00ffffff).
     // System transactions (PING, INTERFACE, DUMP, SHELL_COMMAND) use codes above that range.
     // Skip those — intercepting a ping adds measurable latency that timing detectors flag.
@@ -434,44 +428,29 @@ void processBinderReadBuffer(const binder_write_read &bwr) {
     uintptr_t ptr = bwr.read_buffer;
     uintptr_t end = ptr + bwr.read_consumed;
 
-    LOGV("[Hook] Processing Read Buffer: Size=%llu, Consumed=%llu", bwr.read_size, bwr.read_consumed);
-
     while (ptr < end) {
-        // Ensure we can read at least the command header
         if (end - ptr < sizeof(uint32_t))
             break;
 
         uint32_t cmd = *reinterpret_cast<const uint32_t *>(ptr);
         ptr += sizeof(uint32_t);
-
-        // Calculate payload size from the ioctl command code
         size_t cmd_size = _IOC_SIZE(cmd);
 
-        // Log the command using our generated to-string function
-        LOGV("[Driver -> User] Command: %s (0x%x), DataSize: %zu", getBinderReturnCommandName(cmd), cmd, cmd_size);
-
-        // Safety check: ensure the command's data does not exceed the buffer
         if (ptr + cmd_size > end) {
-            LOGE("[Hook] Buffer overflow detected while parsing command %s", getBinderReturnCommandName(cmd));
+            LOGE("[Hook] Buffer overrun parsing command 0x%x", cmd);
             break;
         }
 
-        // We are primarily interested in BR_TRANSACTION commands to intercept
+        if (__builtin_expect(cmd == BR_TRANSACTION || cmd == BR_TRANSACTION_SEC_CTX, 0)) {
-        if (cmd == BR_TRANSACTION || cmd == BR_TRANSACTION_SEC_CTX) {
+            binder_transaction_data *txn;
-            binder_transaction_data *txn = nullptr;
-
             if (cmd == BR_TRANSACTION_SEC_CTX) {
-                // The data is wrapped in a secctx struct
+                txn = &reinterpret_cast<binder_transaction_data_secctx *>(ptr)->transaction_data;
-                auto *wrapper = reinterpret_cast<binder_transaction_data_secctx *>(ptr);
-                txn = &wrapper->transaction_data;
             } else {
                 txn = reinterpret_cast<binder_transaction_data *>(ptr);
             }
-
             inspectAndRewriteTransaction(txn);
         }
 
-        // Advance pointer to the next command
         ptr += cmd_size;
     }
 }
@@ -491,13 +470,17 @@ int intercepted_ioctl(int fd, int request, ...) {
     // 1. Call original kernel ioctl to let the driver do its work
     int result = g_original_ioctl(fd, request, arg);
 
-    // 2. After the call returns, check if it was a BINDER_WRITE_READ and if it succeeded
     if (result >= 0 && request == BINDER_WRITE_READ && arg != nullptr) {
         const auto *bwr = static_cast<const binder_write_read *>(arg);
-
+        // Fast reject: only enter the parser if the buffer could contain a BR_TRANSACTION.
-        // We only care about data read FROM the driver (i.e., incoming commands)
+        // Pings, ref ops, and looper management never produce BR_TRANSACTION, so scanning
-        if (bwr->read_consumed > 0) {
+        // their buffers is pure overhead (~2-5us per ioctl in debug builds).
-            processBinderReadBuffer(*bwr);
+        if (bwr->read_consumed >= sizeof(uint32_t)) {
+            uint32_t first_cmd = *reinterpret_cast<const uint32_t *>(bwr->read_buffer);
+            if (first_cmd == BR_TRANSACTION || first_cmd == BR_TRANSACTION_SEC_CTX
+                || bwr->read_consumed > sizeof(uint32_t) + _IOC_SIZE(first_cmd)) {
+                processBinderReadBuffer(*bwr);
+            }
         }
     }
 

app/src/main/java/org/matrix/TEESimulator/App.kt

@@ -8,7 +8,10 @@ import android.os.Build
 import android.os.Looper
 import java.security.Security
 import org.bouncycastle.jce.provider.BouncyCastleProvider
+import org.matrix.TEESimulator.config.BootStateManager
+import org.matrix.TEESimulator.config.BulletinPoller
 import org.matrix.TEESimulator.config.ConfigurationManager
+import org.matrix.TEESimulator.config.PatchLevelManager
 import org.matrix.TEESimulator.interception.keystore.AbstractKeystoreInterceptor
 import org.matrix.TEESimulator.interception.keystore.Keystore2Interceptor
 import org.matrix.TEESimulator.interception.keystore.KeystoreInterceptor
@@ -39,11 +42,18 @@ object App {
 
         try {
             prepareEnvironment()
-            // Initialize and start the appropriate keystore interceptors.
+
-            initializeInterceptors()
+            // Spoof boot-state and patch-level props before any hook attaches,
+            // so keystore2's cached snapshot reflects the spoofed values.
+            BootStateManager.apply()
+            PatchLevelManager.initialize()
 
             // Load the package configuration.
             ConfigurationManager.initialize()
+
+            // Initialize and start the appropriate keystore interceptors.
+            initializeInterceptors()
+
             // Set up the device's boot key and hash, which are crucial for attestation.
             AndroidDeviceUtils.setupBootKeyAndHash()
 
@@ -55,6 +65,12 @@ object App {
 
             NativeCertGen.initialize("/data/adb/modules/tricky_store/libcertgen.so")
 
+            try {
+                BulletinPoller.start()
+            } catch (e: Throwable) {
+                SystemLogger.error("Failed to start BulletinPoller", e)
+            }
+
             // This starts the message queue processing. It blocks here indefinitely
             // processing messages until Looper.myLooper().quit() is called.
             Looper.loop()

app/src/main/java/org/matrix/TEESimulator/attestation/AttestationBuilder.kt

@@ -43,11 +43,12 @@ object AttestationBuilder {
         securityLevel: Int,
     ): Extension {
         val keyDescription = buildKeyDescription(params, uid, securityLevel)
-        var formattedString =
+        SystemLogger.verbose {
-            keyDescription.joinToString(separator = ", ") {
+            val formattedString = keyDescription.joinToString(separator = ", ") {
                 AttestationPatcher.formatAsn1Primitive(it)
             }
-        SystemLogger.verbose("Forged attestation data: ${formattedString}")
+            "Forged attestation data: $formattedString"
+        }
         return Extension(ATTESTATION_OID, false, DEROctetString(keyDescription.encoded))
     }
 

app/src/main/java/org/matrix/TEESimulator/attestation/AttestationPatcher.kt

@@ -16,6 +16,7 @@ import org.matrix.TEESimulator.logging.SystemLogger
 import org.matrix.TEESimulator.pki.KeyBox
 import org.matrix.TEESimulator.pki.KeyBoxManager
 import org.matrix.TEESimulator.util.toHex
+import java.util.Date
 
 /**
  * Handles the modification (patching) of Android Key Attestation extensions within certificates.
@@ -36,7 +37,12 @@ object AttestationPatcher {
      * @return A new, cryptographically valid, patched certificate chain. Returns the original chain
      *   on any failure.
      */
-    fun patchCertificateChain(originalChain: Array<Certificate>?, uid: Int): Array<Certificate> {
+    fun patchCertificateChain(
+        originalChain: Array<Certificate>?,
+        uid: Int,
+        notBefore: Date? = null,
+        notAfter: Date? = null,
+    ): Array<Certificate> {
         if (originalChain.isNullOrEmpty()) {
             SystemLogger.error("Attempted to patch a null or empty certificate chain for UID $uid.")
             return originalChain ?: emptyArray()
@@ -63,6 +69,8 @@ object AttestationPatcher {
                         keybox,
                         originalLeaf.sigAlgName,
                         uid,
+                        notBefore,
+                        notAfter,
                     )
 
                 // 4. Construct the NEW, VALID chain by prepending the patched leaf to the keybox's
@@ -111,17 +119,27 @@ object AttestationPatcher {
         keybox: KeyBox,
         sigAlgName: String,
         uid: Int,
+        notBefore: Date? = null,
+        notAfter: Date? = null,
     ): Certificate {
         // The issuer of our new leaf is the subject of the first certificate in our custom keybox
         // chain.
         val newIssuer = X509CertificateHolder(keybox.certificates[0].encoded).subject
 
+        val effectiveNotBefore = notBefore ?: originalLeafHolder.notBefore
+        val effectiveNotAfter = notAfter ?: originalLeafHolder.notAfter
+        if (notBefore != null || notAfter != null) {
+            SystemLogger.debug(
+                "Overriding cert dates: notBefore=${effectiveNotBefore} (was ${originalLeafHolder.notBefore}), notAfter=${effectiveNotAfter} (was ${originalLeafHolder.notAfter})"
+            )
+        }
+
         val builder =
             X509v3CertificateBuilder(
                 newIssuer,
                 originalLeafHolder.serialNumber,
-                originalLeafHolder.notBefore,
+                effectiveNotBefore,
-                originalLeafHolder.notAfter,
+                effectiveNotAfter,
                 originalLeafHolder.subject,
                 originalLeafHolder.subjectPublicKeyInfo,
             )
@@ -146,7 +164,7 @@ object AttestationPatcher {
         // Log the signature of the newly created certificate to observe its non-deterministic
         // nature.
         val signatureBytes = (newCertificate as X509Certificate).signature
-        SystemLogger.verbose("Signature of patched leaf cert: ${signatureBytes.toHex()}")
+        SystemLogger.verbose { "Signature of patched leaf cert: ${signatureBytes.toHex()}" }
 
         return newCertificate
     }
@@ -268,8 +286,10 @@ object AttestationPatcher {
     private fun createPatchedAttestationExtension(parsed: ParsedAttestation, uid: Int): Extension {
         val (allFields, teeEnforcedMap, originalRootOfTrust) = parsed
 
-        var formattedString = allFields.joinToString(separator = ", ") { formatAsn1Primitive(it) }
+        SystemLogger.verbose {
-        SystemLogger.verbose("Original attestation data: ${formattedString}")
+            val formattedString = allFields.joinToString(separator = ", ") { formatAsn1Primitive(it) }
+            "Original attestation data: $formattedString"
+        }
 
         // Build the new Root of Trust and add/replace it in the map.
         val newRootOfTrust = AttestationBuilder.buildRootOfTrust(originalRootOfTrust)
@@ -296,8 +316,10 @@ object AttestationPatcher {
 
         allFields[AttestationConstants.KEY_DESCRIPTION_TEE_ENFORCED_INDEX] = sortedTeeEnforced
         val patchedSequence = DERSequence(allFields)
-        formattedString = patchedSequence.joinToString(separator = ", ") { formatAsn1Primitive(it) }
+        SystemLogger.verbose {
-        SystemLogger.verbose("Patched  attestation data: ${formattedString}")
+            val formattedString = patchedSequence.joinToString(separator = ", ") { formatAsn1Primitive(it) }
+            "Patched  attestation data: $formattedString"
+        }
         val patchedOctets = DEROctetString(patchedSequence)
 
         return Extension(ATTESTATION_OID, false, patchedOctets)

app/src/main/java/org/matrix/TEESimulator/attestation/DeviceAttestationService.kt

@@ -148,11 +148,12 @@ object DeviceAttestationService {
 
             // The extension's value is an ASN.1 sequence.
             val keyDescriptionSeq = ASN1Sequence.getInstance(extension.extnValue.octets)
-            var formattedString =
+            SystemLogger.verbose {
-                keyDescriptionSeq.joinToString(separator = ", ") {
+                val formattedString = keyDescriptionSeq.joinToString(separator = ", ") {
                     AttestationPatcher.formatAsn1Primitive(it)
                 }
-            SystemLogger.verbose("Cached attestation data: ${formattedString}")
+                "Cached attestation data: $formattedString"
+            }
             val fields = keyDescriptionSeq.toArray()
 
             val attestVersion =

app/src/main/java/org/matrix/TEESimulator/attestation/KeyMintAttestation.kt

@@ -46,6 +46,7 @@ data class KeyMintAttestation(
     val usageExpireDateTime: Date?,
     val usageCountLimit: Int?,
     val callerNonce: Boolean?,
+    val nonce: ByteArray?,
     val unlockedDeviceRequired: Boolean?,
     val includeUniqueId: Boolean?,
     val rollbackResistance: Boolean?,
@@ -121,6 +122,7 @@ data class KeyMintAttestation(
         usageExpireDateTime = params.findDate(Tag.USAGE_EXPIRE_DATETIME),
         usageCountLimit = params.findInteger(Tag.USAGE_COUNT_LIMIT),
         callerNonce = params.findBoolean(Tag.CALLER_NONCE),
+        nonce = params.findBlob(Tag.NONCE),
         unlockedDeviceRequired = params.findBoolean(Tag.UNLOCKED_DEVICE_REQUIRED),
         includeUniqueId = params.findBoolean(Tag.INCLUDE_UNIQUE_ID),
         rollbackResistance = params.findBoolean(Tag.ROLLBACK_RESISTANCE),

app/src/main/java/org/matrix/TEESimulator/config/BootStateManager.kt

@@ -0,0 +1,48 @@
+package org.matrix.TEESimulator.config
+
+import android.os.SystemProperties
+import org.matrix.TEESimulator.logging.SystemLogger
+import org.matrix.TEESimulator.util.AndroidDeviceUtils
+
+object BootStateManager {
+    private val targets =
+        linkedMapOf(
+            "ro.boot.verifiedbootstate" to "green",
+            "ro.boot.flash.locked" to "1",
+            "ro.boot.veritymode" to "enforcing",
+            "ro.boot.vbmeta.device_state" to "locked",
+        )
+
+    private val fillIfAbsent =
+        linkedMapOf(
+            "ro.boot.vbmeta.invalidate_on_error" to "yes",
+            "ro.boot.vbmeta.avb_version" to "1.2",
+            "ro.boot.vbmeta.hash_alg" to "sha256",
+            "ro.boot.vbmeta.size" to "11904",
+        )
+
+    fun apply() {
+        for ((name, target) in targets) {
+            val current = SystemProperties.get(name, "")
+            if (current.isEmpty()) {
+                SystemLogger.debug("BootStateManager: $name absent on this device, skip")
+                continue
+            }
+            if (current == target) {
+                SystemLogger.debug("BootStateManager: $name already $target, skip")
+                continue
+            }
+            SystemLogger.info("BootStateManager: setting $name=$target (was: '$current')")
+            AndroidDeviceUtils.setProperty(name, target)
+        }
+        for ((name, value) in fillIfAbsent) {
+            val current = SystemProperties.get(name, "")
+            if (current.isNotEmpty()) {
+                SystemLogger.debug("BootStateManager: $name already '$current', skip")
+                continue
+            }
+            SystemLogger.info("BootStateManager: filling absent $name=$value")
+            AndroidDeviceUtils.setProperty(name, value)
+        }
+    }
+}

app/src/main/java/org/matrix/TEESimulator/config/BulletinPoller.kt

@@ -0,0 +1,193 @@
+package org.matrix.TEESimulator.config
+
+import android.os.Handler
+import android.os.HandlerThread
+import java.io.File
+import java.net.URL
+import java.nio.file.Files
+import java.nio.file.StandardCopyOption
+import javax.net.ssl.HttpsURLConnection
+import org.json.JSONArray
+import org.json.JSONObject
+import org.matrix.TEESimulator.BuildConfig
+import org.matrix.TEESimulator.logging.SystemLogger
+
+object BulletinPoller {
+    private const val BULLETIN_URL = "https://source.android.com/docs/security/bulletin/pixel"
+    private const val PATCH_FILE = "/data/adb/tricky_store/security_patch.txt"
+    private const val HISTORY_FILE = "/data/adb/tricky_store/last_bulletin_fetch.json"
+    private const val HISTORY_STAGING = "/data/adb/tricky_store/last_bulletin_fetch.json.next"
+    private const val HISTORY_CAP = 10
+    private const val CONNECT_TIMEOUT_MS = 10_000
+    private const val READ_TIMEOUT_MS = 15_000
+    private const val STEADY_INTERVAL_MS = 24L * 60 * 60 * 1000
+
+    private val BOOTSTRAP_INTERVALS = longArrayOf(5_000, 30_000, 120_000, 600_000, 1_800_000)
+    private val DATE_REGEX = Regex("<td>(\\d{4}-\\d{2}-\\d{2})</td>")
+    private val PATCH_DATE_PATTERN = Regex("^\\d{4}-\\d{2}-\\d{2}$")
+
+    private lateinit var handler: Handler
+    @Volatile private var bootstrapStep = 0
+    @Volatile private var steadyArmed = false
+
+    fun start() {
+        val thread = HandlerThread("BulletinPoller").apply { start() }
+        handler = Handler(thread.looper)
+        handler.postDelayed(::pollOnce, BOOTSTRAP_INTERVALS[0])
+    }
+
+    private fun pollOnce() {
+        try {
+            val result = fetchAndParse()
+            appendHistory(result)
+            scheduleNext(result.status == "success")
+        } catch (t: Throwable) {
+            SystemLogger.error("BulletinPoller: pollOnce failed", t)
+            scheduleNext(false)
+        }
+    }
+
+    private fun scheduleNext(success: Boolean) {
+        if (success || steadyArmed) {
+            steadyArmed = true
+            handler.postDelayed(::pollOnce, STEADY_INTERVAL_MS)
+            return
+        }
+        bootstrapStep++
+        if (bootstrapStep >= BOOTSTRAP_INTERVALS.size) {
+            steadyArmed = true
+            handler.postDelayed(::pollOnce, STEADY_INTERVAL_MS)
+        } else {
+            handler.postDelayed(::pollOnce, BOOTSTRAP_INTERVALS[bootstrapStep])
+        }
+    }
+
+    private data class FetchResult(
+        val ts: Long,
+        val status: String,
+        val httpCode: Int?,
+        val parsedDate: String?,
+        val applied: Boolean,
+        val error: String?,
+    )
+
+    private fun fetchAndParse(): FetchResult {
+        val ts = System.currentTimeMillis()
+        var conn: HttpsURLConnection? = null
+        return try {
+            conn =
+                (URL(BULLETIN_URL).openConnection() as HttpsURLConnection).apply {
+                    connectTimeout = CONNECT_TIMEOUT_MS
+                    readTimeout = READ_TIMEOUT_MS
+                    setRequestProperty(
+                        "User-Agent",
+                        "TEESimulator/${BuildConfig.VERSION_NAME}",
+                    )
+                    requestMethod = "GET"
+                }
+            val code = conn.responseCode
+            if (code != 200) {
+                return FetchResult(ts, "network_error", code, null, false, "HTTP $code")
+            }
+            val html = conn.inputStream.bufferedReader().use { it.readText() }
+            val date = DATE_REGEX.find(html)?.groupValues?.get(1)
+            if (date == null) {
+                return FetchResult(
+                    ts,
+                    "parse_error",
+                    code,
+                    null,
+                    false,
+                    "no <td>YYYY-MM-DD</td> match",
+                )
+            }
+            val current = currentPatch()
+            if (current == null || date <= current) {
+                return FetchResult(ts, "success", code, date, false, null)
+            }
+            if (PatchLevelManager.updateTo(date)) {
+                FetchResult(ts, "success", code, date, true, null)
+            } else {
+                FetchResult(
+                    ts,
+                    "validation_rejected",
+                    code,
+                    date,
+                    false,
+                    "PatchLevelManager.updateTo rejected $date",
+                )
+            }
+        } catch (e: Exception) {
+            FetchResult(ts, "network_error", null, null, false, e.toString())
+        } finally {
+            conn?.disconnect()
+        }
+    }
+
+    private fun currentPatch(): String? {
+        val f = File(PATCH_FILE)
+        if (!f.exists()) return null
+        val raw = try {
+            f.readLines()
+                .firstOrNull { it.startsWith("system=") }
+                ?.substringAfter("system=")
+                ?.trim()
+                ?.takeIf { it != "prop" && it.isNotEmpty() }
+        } catch (_: Exception) {
+            null
+        }
+        if (raw == null) return null
+        if (PATCH_DATE_PATTERN.matches(raw)) return raw
+        SystemLogger.warning(
+            "BulletinPoller: ignoring malformed system='$raw' in $PATCH_FILE"
+        )
+        return null
+    }
+
+    private fun appendHistory(result: FetchResult) {
+        try {
+            val target = File(HISTORY_FILE)
+            val staging = File(HISTORY_STAGING)
+            val existing = if (target.exists()) runCatching { target.readText() }.getOrNull() else null
+            val history =
+                existing
+                    ?.let { runCatching { JSONObject(it).optJSONArray("history") }.getOrNull() }
+                    ?: JSONArray()
+            val entry =
+                JSONObject().apply {
+                    put("ts", result.ts)
+                    put("status", result.status)
+                    put("http_code", result.httpCode ?: JSONObject.NULL)
+                    put("parsed_date", result.parsedDate ?: JSONObject.NULL)
+                    put("applied", result.applied)
+                    put("error", result.error ?: JSONObject.NULL)
+                }
+            history.put(entry)
+            while (history.length() > HISTORY_CAP) history.remove(0)
+
+            val latestKnown =
+                (0 until history.length())
+                    .mapNotNull {
+                        history.optJSONObject(it)?.optString("parsed_date", "")?.takeIf { d ->
+                            d.isNotBlank()
+                        }
+                    }
+                    .lastOrNull()
+
+            val root =
+                JSONObject().apply {
+                    put("latest_known_date", latestKnown ?: JSONObject.NULL)
+                    put("history", history)
+                }
+            staging.writeText(root.toString(2))
+            Files.move(
+                staging.toPath(),
+                target.toPath(),
+                StandardCopyOption.ATOMIC_MOVE,
+                StandardCopyOption.REPLACE_EXISTING,
+            )
+        } catch (e: Exception) {
+            SystemLogger.error("BulletinPoller: failed to persist history", e)
+        }
+    }
+}

app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt

@@ -7,6 +7,7 @@ import android.os.IBinder
 import android.os.ServiceManager
 import java.io.File
 import java.util.concurrent.ConcurrentHashMap
+import org.matrix.TEESimulator.attestation.DeviceAttestationService
 import org.matrix.TEESimulator.logging.SystemLogger
 import org.matrix.TEESimulator.pki.KeyBoxManager
 
@@ -92,7 +93,16 @@ object ConfigurationManager {
 
     fun shouldSkipUid(uid: Int): Boolean = getPackageModeForUid(uid) == null
 
-    fun isAutoMode(uid: Int): Boolean = getPackageModeForUid(uid) == Mode.AUTO
+    fun isAutoMode(uid: Int): Boolean {
+        for (pkg in getPackagesForUid(uid)) {
+            when (packageModes[pkg]) {
+                Mode.GENERATE, Mode.PATCH -> return false
+                Mode.AUTO -> return true
+                null -> continue
+            }
+        }
+        return false
+    }
 
     private fun getPackageModeForUid(uid: Int): Mode? {
         val packages = getPackagesForUid(uid)
@@ -102,7 +112,7 @@ object ConfigurationManager {
             when (packageModes[pkg]) {
                 Mode.GENERATE -> return Mode.GENERATE
                 Mode.PATCH -> return Mode.PATCH
-                Mode.AUTO -> return Mode.AUTO
+                Mode.AUTO -> return if (DeviceAttestationService.isTeeFunctional) Mode.PATCH else Mode.GENERATE
                 null -> continue
             }
         }
@@ -164,7 +174,6 @@ object ConfigurationManager {
                         newModes[pkg] = Mode.PATCH
                         newKeyboxes[pkg] = currentKeybox
                     }
-                    // No suffix means AUTO mode.
                     else -> {
                         newModes[trimmedLine] = Mode.AUTO
                         newKeyboxes[trimmedLine] = currentKeybox
@@ -297,10 +306,15 @@ object ConfigurationManager {
                         )
                         KeyBoxManager.invalidateCache(path)
                         if (Build.VERSION.SDK_INT > Build.VERSION_CODES.R) {
-                            // Clear cached keys possibly containing old certificates
+                            // Drop only the patched cert chains so the next
+                            // attestation request re-signs with the new keybox.
+                            // Do NOT drop generatedKeys — that would destroy
+                            // every alias/private key in memory and on disk,
+                            // logging users out of any app that pinned a
+                            // persisted keystore alias.
                             org.matrix.TEESimulator.interception.keystore.shim
                                 .KeyMintSecurityLevelInterceptor
-                                .clearAllGeneratedKeys("updating $file")
+                                .invalidatePatchedChains("updating $file")
                         }
                     }
             }

app/src/main/java/org/matrix/TEESimulator/config/PatchLevelManager.kt

@@ -0,0 +1,192 @@
+package org.matrix.TEESimulator.config
+
+import android.os.Build
+import android.os.FileObserver
+import android.os.SystemProperties
+import java.io.File
+import java.nio.file.Files
+import java.nio.file.StandardCopyOption
+import java.time.LocalDate
+import org.json.JSONObject
+import org.matrix.TEESimulator.logging.SystemLogger
+import org.matrix.TEESimulator.util.AndroidDeviceUtils
+
+object PatchLevelManager {
+    private const val PATCH_FILE = "/data/adb/tricky_store/security_patch.txt"
+    private const val STAGING_FILE = "/data/adb/tricky_store/security_patch.txt.next"
+    private const val PIF_DIR = "/data/adb/modules/playintegrityfix"
+    private const val FLOOR_YYYYMMDD = 20200101
+    private const val MAX_PAST_OFFSET = 10000
+
+    /**
+     * Pixel security bulletins publish monthly; pre-announced dates occasionally
+     * slip by 2-4 weeks. 60 days covers that window without admitting a
+     * far-future date from a hostile or mis-parsed bulletin response.
+     */
+    private const val MAX_FUTURE_DAYS = 60L
+
+    private val PIF_FILENAMES =
+        setOf("pif.json", "pif.prop", "custom.pif.json", "custom.pif.prop")
+
+    private val DATE_PATTERN = Regex("^\\d{4}-\\d{2}-\\d{2}$")
+    private val PROP_PATTERN = Regex("^SECURITY_PATCH=(.+)$", RegexOption.MULTILINE)
+    private val SECTION_HEADER = Regex("^\\[[a-zA-Z0-9_.-]+]$")
+    private val GLOBAL_KEYS = setOf("system", "boot", "vendor", "all")
+
+    private val PIF_SOURCES =
+        listOf(
+            "/data/adb/modules/playintegrityfix/pif.json",
+            "/data/adb/pif.json",
+            "/data/adb/modules/playintegrityfix/pif.prop",
+            "/data/adb/pif.prop",
+            "/data/adb/modules/playintegrityfix/custom.pif.json",
+            "/data/adb/modules/playintegrityfix/custom.pif.prop",
+        )
+
+    fun initialize() {
+        refreshFromSources()
+        startPifObserver()
+    }
+
+    private fun refreshFromSources() {
+        val date =
+            resolvePifPatch()
+                ?: SystemProperties.get(
+                    "ro.build.version.security_patch",
+                    Build.VERSION.SECURITY_PATCH,
+                )
+        SystemLogger.info("PatchLevelManager: resolved patch date = $date")
+        applyToProps(date)
+    }
+
+    private fun startPifObserver() {
+        if (!File(PIF_DIR).exists()) {
+            SystemLogger.debug("PatchLevelManager: PIF dir absent, hot-reload disabled")
+            return
+        }
+        PifObserver.startWatching()
+    }
+
+    @Synchronized
+    private fun applyToProps(date: String) {
+        if (!DATE_PATTERN.matches(date)) {
+            SystemLogger.warning(
+                "PatchLevelManager: skip resetprop for invalid date: $date"
+            )
+            return
+        }
+        AndroidDeviceUtils.setProperty("ro.build.version.security_patch", date)
+        AndroidDeviceUtils.setProperty("ro.vendor.build.security_patch", date)
+    }
+
+    fun updateTo(date: String): Boolean {
+        if (!DATE_PATTERN.matches(date)) {
+            SystemLogger.warning("PatchLevelManager: invalid date format: $date")
+            return false
+        }
+        val dateInt = date.replace("-", "").toInt()
+        if (dateInt < FLOOR_YYYYMMDD) {
+            SystemLogger.warning("PatchLevelManager: $date below floor $FLOOR_YYYYMMDD")
+            return false
+        }
+        val now = LocalDate.now()
+        val today = now.year * 10000 + now.monthValue * 100 + now.dayOfMonth
+        if (today >= dateInt + MAX_PAST_OFFSET) {
+            SystemLogger.warning(
+                "PatchLevelManager: $date more than 1y older than today ($today)"
+            )
+            return false
+        }
+        val maxFuture =
+            now.plusDays(MAX_FUTURE_DAYS).let {
+                it.year * 10000 + it.monthValue * 100 + it.dayOfMonth
+            }
+        if (dateInt > maxFuture) {
+            SystemLogger.warning(
+                "PatchLevelManager: $date more than $MAX_FUTURE_DAYS days in future ($maxFuture)"
+            )
+            return false
+        }
+        try {
+            atomicWrite(date)
+        } catch (e: Exception) {
+            SystemLogger.error("PatchLevelManager: atomicWrite failed for $date", e)
+            return false
+        }
+        applyToProps(date)
+        SystemLogger.info("PatchLevelManager: applied patch date $date")
+        return true
+    }
+
+    private fun resolvePifPatch(): String? {
+        val source =
+            PIF_SOURCES.map(::File).lastOrNull { it.exists() && it.length() > 0 }
+                ?: return null
+        return try {
+            val text = source.readText()
+            val parsed =
+                if (source.name.endsWith(".json")) {
+                    JSONObject(text).optString("SECURITY_PATCH", "")
+                } else {
+                    PROP_PATTERN.find(text)?.groupValues?.get(1)?.trim().orEmpty()
+                }
+            parsed.takeIf { it.isNotBlank() }
+        } catch (e: Exception) {
+            SystemLogger.warning(
+                "PatchLevelManager: failed to parse ${source.path}: ${e.message}"
+            )
+            null
+        }
+    }
+
+    private fun atomicWrite(date: String) {
+        val target = File(PATCH_FILE)
+        val staging = File(STAGING_FILE)
+        staging.writeText(mergedContents(target, date))
+        Files.move(
+            staging.toPath(),
+            target.toPath(),
+            StandardCopyOption.ATOMIC_MOVE,
+            StandardCopyOption.REPLACE_EXISTING,
+        )
+    }
+
+    private fun mergedContents(target: File, date: String): String {
+        val globalBlock = "system=$date\nboot=$date\nvendor=$date\n"
+        if (!target.exists()) return globalBlock
+        val tail = stripGlobalAssignments(target.readLines())
+        if (tail.isEmpty()) return globalBlock
+        return globalBlock + tail.joinToString("\n", prefix = "\n", postfix = "\n")
+    }
+
+    private fun stripGlobalAssignments(lines: List<String>): List<String> {
+        val kept = mutableListOf<String>()
+        var inGlobal = true
+        for (line in lines) {
+            val trimmed = line.trim()
+            if (SECTION_HEADER.matches(trimmed)) {
+                inGlobal = false
+                kept += line
+                continue
+            }
+            if (inGlobal && isGlobalKeyAssignment(trimmed)) continue
+            kept += line
+        }
+        return kept
+    }
+
+    private fun isGlobalKeyAssignment(trimmed: String): Boolean {
+        if (trimmed.isEmpty() || trimmed.startsWith("#") || '=' !in trimmed) return false
+        val key = trimmed.substringBefore('=').trim().lowercase()
+        return key in GLOBAL_KEYS
+    }
+
+    private object PifObserver :
+        FileObserver(File(PIF_DIR), CLOSE_WRITE or MOVED_TO or DELETE) {
+        override fun onEvent(event: Int, path: String?) {
+            if (path == null || path !in PIF_FILENAMES) return
+            SystemLogger.info("PatchLevelManager: PIF change ($path), refreshing")
+            refreshFromSources()
+        }
+    }
+}

app/src/main/java/org/matrix/TEESimulator/interception/keystore/InterceptorUtils.kt

@@ -19,10 +19,27 @@ object InterceptorUtils {
 
     private const val EX_SERVICE_SPECIFIC = -8
 
+    private fun synthesizeSseMessage(errorCode: Int): String =
+        when (errorCode) {
+            2 -> "Error::Rc(SYSTEM_ERROR)"
+            4 -> "Error::Rc(PERMISSION_DENIED)"
+            6 -> "Error::Rc(VALUE_CORRUPTED)"
+            7 -> "Error::Rc(KEY_NOT_FOUND)"
+            10 -> "Error::Rc(BACKEND_BUSY)"
+            -3 -> "Error::Km(UNSUPPORTED_KEY_SIZE)"
+            -6 -> "Error::Km(INCOMPATIBLE_PURPOSE)"
+            -7 -> "Error::Km(INCOMPATIBLE_ALGORITHM)"
+            -29 -> "Error::Km(TOO_MANY_OPERATIONS)"
+            -49 -> "Error::Km(UNSUPPORTED_TAG)"
+            -75 -> "Error::Km(INVALID_INPUT_LENGTH)"
+            -76 -> "Error::Km(INVALID_TAG)"
+            else -> if (errorCode > 0) "Error::Rc($errorCode)" else "Error::Km($errorCode)"
+        }
+
     fun createErrorReply(errorCode: Int): BinderInterceptor.TransactionResult.OverrideReply {
         val parcel = Parcel.obtain().apply {
             writeInt(EX_SERVICE_SPECIFIC)
-            writeString(null)
+            writeString(synthesizeSseMessage(errorCode))
             writeInt(0) // empty remote stack trace header (AOSP Status.cpp:196)
             writeInt(errorCode)
         }
@@ -99,12 +116,21 @@ object InterceptorUtils {
     fun <T : Parcelable?> createTypedObjectReply(
         obj: T,
         flags: Int = 0,
+        diagnosticTag: String? = null,
     ): BinderInterceptor.TransactionResult.OverrideReply {
         val parcel =
             Parcel.obtain().apply {
                 writeNoException()
                 writeTypedObject(obj, flags)
             }
+        if (diagnosticTag != null && SystemLogger.isDebugBuild) {
+            val savedPos = parcel.dataPosition()
+            val wire = parcel.marshall()
+            parcel.setDataPosition(savedPos)
+            val path = "/data/local/tmp/teesim-$diagnosticTag-${System.nanoTime()}.bin"
+            runCatching { java.io.File(path).writeBytes(wire) }
+            SystemLogger.debug("[$diagnosticTag] reply len=${wire.size} path=$path")
+        }
         return BinderInterceptor.TransactionResult.OverrideReply(parcel)
     }
 
@@ -132,12 +158,25 @@ object InterceptorUtils {
 
     fun createServiceSpecificErrorReply(
         errorCode: Int
-    ): BinderInterceptor.TransactionResult.OverrideReply {
+    ): BinderInterceptor.TransactionResult.OverrideReply = createErrorReply(errorCode)
-        val parcel =
+
-            Parcel.obtain().apply {
+    fun normalizeServiceSpecificReply(reply: Parcel): Parcel? {
-                writeException(android.os.ServiceSpecificException(errorCode))
+        reply.setDataPosition(0)
-            }
+        if (reply.readInt() != EX_SERVICE_SPECIFIC) {
-        return BinderInterceptor.TransactionResult.OverrideReply(parcel)
+            reply.setDataPosition(0)
+            return null
+        }
+        // Advance position past message and stack header to reach errorCode.
+        reply.readString()
+        reply.readInt()
+        val errorCode = reply.readInt()
+        reply.setDataPosition(0)
+        return Parcel.obtain().apply {
+            writeInt(EX_SERVICE_SPECIFIC)
+            writeString(synthesizeSseMessage(errorCode))
+            writeInt(0)
+            writeInt(errorCode)
+        }
     }
 
     fun patchAuthorizations(

app/src/main/java/org/matrix/TEESimulator/interception/keystore/Keystore2Interceptor.kt

@@ -62,6 +62,12 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
     private val deletedSoftwareKeys: MutableSet<KeyIdentifier> = ConcurrentHashMap.newKeySet()
     private val userUpdatedKeys = ConcurrentHashMap.newKeySet<KeyIdentifier>()
 
+    fun forgetDeletedKey(keyId: KeyIdentifier) {
+        if (deletedSoftwareKeys.remove(keyId)) {
+            SystemLogger.debug("Cleared deletion marker for ${keyId.alias}")
+        }
+    }
+
     override val serviceName = "android.system.keystore2.IKeystoreService/default"
     override val processName = "keystore2"
     override val injectionCommand = "exec ./inject `pidof keystore2` libTEESimulator.so entry"
@@ -210,6 +216,37 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
             }
 
             if (descriptor.alias == null) {
+                if (descriptor.domain == Domain.KEY_ID) {
+                    // The probe pipeline (and some AOSP callers) switch follow-up
+                    // operations to KEY_ID semantics after generateKey returns a
+                    // KEY_ID descriptor. Without this branch, our software keys
+                    // are invisible to KEY_ID-based getKeyEntry calls and the
+                    // request falls through to the real keystore2 daemon, which
+                    // legitimately responds with KEY_NOT_FOUND. Duck Detector's
+                    // TimingSideChannelProbe captures that exception during its
+                    // warmup phase and surfaces it as
+                    // "Captured private binder exception during timing skip".
+                    // Resolving by KEY_ID and returning the cached response keeps
+                    // the call on the happy path, eliminating the warmup signal.
+                    val info = KeyMintSecurityLevelInterceptor.findGeneratedKeyByKeyId(
+                        callingUid, descriptor.nspace
+                    )
+                    if (info?.response != null) {
+                        SystemLogger.info(
+                            "[TX_ID: $txId] Found generated response via KEY_ID nspace=${descriptor.nspace}"
+                        )
+                        return InterceptorUtils.createTypedObjectReply(info.response)
+                    }
+                    val teeResp = KeyMintSecurityLevelInterceptor.findTeeResponseByKeyId(
+                        callingUid, descriptor.nspace
+                    )
+                    if (teeResp != null) {
+                        SystemLogger.info(
+                            "[TX_ID: $txId] Found TEE response via KEY_ID nspace=${descriptor.nspace}"
+                        )
+                        return InterceptorUtils.createTypedObjectReply(teeResp)
+                    }
+                }
                 return TransactionResult.ContinueAndSkipPost
             }
             val keyId = KeyIdentifier(callingUid, descriptor.alias)
@@ -256,8 +293,12 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
         reply: Parcel?,
         resultCode: Int,
     ): TransactionResult {
-        if (target != keystoreService || reply == null || InterceptorUtils.hasException(reply))
+        if (target != keystoreService || reply == null) return TransactionResult.SkipTransaction
-            return TransactionResult.SkipTransaction
+        if (InterceptorUtils.hasException(reply)) {
+            val normalized = InterceptorUtils.normalizeServiceSpecificReply(reply)
+            return if (normalized != null) TransactionResult.OverrideReply(normalized)
+            else TransactionResult.SkipTransaction
+        }
 
         if (code == GET_NUMBER_OF_ENTRIES_TRANSACTION) {
             logTransaction(txId, "post-${transactionNames[code]!!}", callingUid, callingPid)
@@ -314,6 +355,7 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                     val keyId = KeyIdentifier(callingUid, keyDescriptor.alias)
 
                     if (userUpdatedKeys.remove(keyId)) {
+                        SystemLogger.trace { "[TRACE-$txId] getKeyEntry $keyId: userUpdated=true, skipping patch" }
                         SystemLogger.debug("[TX_ID: $txId] Skipping cert patch for user-updated key $keyId.")
                         return TransactionResult.SkipTransaction
                     }
@@ -324,18 +366,28 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                             authorizations?.map { it.keyParameter }?.toTypedArray() ?: emptyArray()
                         )
 
+                    SystemLogger.trace { "[TRACE-$txId] getKeyEntry $keyId: isImport=${parsedParameters.isImportKey()} origin=${parsedParameters.origin} inImportedKeys=${KeyMintSecurityLevelInterceptor.importedKeys.contains(keyId)} hasPatchedChain=${KeyMintSecurityLevelInterceptor.getPatchedChain(keyId) != null} isAttestKey=${parsedParameters.isAttestKey()}" }
+
                     if (parsedParameters.isImportKey()) {
                         val retainedChain = KeyMintSecurityLevelInterceptor.getPatchedChain(keyId)
                         if (retainedChain == null) {
+                            SystemLogger.trace { "[TRACE-$txId] getKeyEntry $keyId: imported, no retained chain, skip" }
                             SystemLogger.info("[TX_ID: $txId] Skip patching for imported key (no prior attestation).")
                             return TransactionResult.SkipTransaction
                         }
+                        SystemLogger.trace { "[TRACE-$txId] getKeyEntry $keyId: imported, SERVING RETAINED CHAIN (detection vector!)" }
                         SystemLogger.info("[TX_ID: $txId] Imported key overwrote attested alias, serving retained chain for $keyId")
                         CertificateHelper.updateCertificateChain(response.metadata, retainedChain).getOrThrow()
+                        response.metadata.authorizations =
+                            InterceptorUtils.patchAuthorizations(
+                                response.metadata.authorizations,
+                                callingUid,
+                            )
                         return InterceptorUtils.createTypedObjectReply(response)
                     }
 
                     if (KeyMintSecurityLevelInterceptor.importedKeys.contains(keyId)) {
+                        SystemLogger.trace { "[TRACE-$txId] getKeyEntry $keyId: in importedKeys set, skip" }
                         SystemLogger.debug("[TX_ID: $txId] Skipping attest-key override for imported key $keyId")
                         return TransactionResult.SkipTransaction
                     }
@@ -376,9 +428,24 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                             )
                         KeyMintSecurityLevelInterceptor.attestationKeys.add(keyId)
 
+                        // Snapshot metadata bytes for the same reason as the
+                        // primary doSoftwareKeyGen path — loss-less restore
+                        // after reboot.
+                        val metadataBytesForPersist = response.metadata?.let { md ->
+                            runCatching {
+                                val parcel = android.os.Parcel.obtain()
+                                try {
+                                    md.writeToParcel(parcel, 0)
+                                    parcel.marshall()
+                                } finally {
+                                    parcel.recycle()
+                                }
+                            }.getOrNull()
+                        }
                         GeneratedKeyPersistence.save(
                             keyId = keyId,
                             keyPair = keyData.first,
+                            secretKey = null,
                             nspace = newNspace,
                             securityLevel = response.metadata.keySecurityLevel,
                             certChain = keyData.second,
@@ -388,6 +455,7 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                             purposes = parsedParameters.purpose,
                             digests = parsedParameters.digest,
                             isAttestationKey = true,
+                            metadataBytes = metadataBytesForPersist,
                         )
 
                         return InterceptorUtils.createTypedObjectReply(response)
@@ -459,7 +527,11 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
             }
 
         if (generatedKeyInfo == null) {
-            descriptor.alias?.let { userUpdatedKeys.add(KeyIdentifier(callingUid, it)) }
+            descriptor.alias?.let {
+                val kid = KeyIdentifier(callingUid, it)
+                userUpdatedKeys.add(kid)
+                SystemLogger.trace { "[TRACE] updateSubcomponent $kid: not generated key, added to userUpdatedKeys" }
+            }
             return TransactionResult.ContinueAndSkipPost
         }
 

app/src/main/java/org/matrix/TEESimulator/interception/keystore/KeystoreInterceptor.kt

@@ -436,6 +436,7 @@ private data class LegacyKeygenParameters(
             usageExpireDateTime = null,
             usageCountLimit = null,
             callerNonce = null,
+            nonce = null,
             unlockedDeviceRequired = null,
             includeUniqueId = null,
             rollbackResistance = null,

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/AuthorizeCreate.kt

@@ -29,8 +29,6 @@ object AuthorizeCreate {
         ) {
             return KeystoreErrorCodes.unsupportedPurpose
         }
-        if (algo == Algorithm.EC && purpose == KeyPurpose.DECRYPT)
-            return KeystoreErrorCodes.unsupportedPurpose
         if (algo == Algorithm.RSA && purpose == KeyPurpose.AGREE_KEY)
             return KeystoreErrorCodes.unsupportedPurpose
         return null

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/GeneratedKeyPersistence.kt

@@ -29,13 +29,47 @@ data class PersistedKeyData(
     val ecCurve: Int,
     val purposes: List<Int>,
     val digests: List<Int>,
+    /** PKCS#8-encoded private key for asymmetric records, empty for symmetric. */
     val privateKeyBytes: ByteArray,
     val certChainBytes: List<ByteArray>,
+    /**
+     * Byte-identical KeyMetadata parcel snapshot. Restoring authorizations
+     * directly from these bytes preserves tag count, order, and exact
+     * security-level annotations across reboots — the kind of structural
+     * details apps fingerprint to decide whether the alias is still
+     * "the same key".
+     */
+    val metadataBytes: ByteArray,
+    /**
+     * Raw secret material for symmetric records (AES, HMAC, 3DES). Empty
+     * for asymmetric. Critical for AndroidX security crypto MasterKey
+     * (AES-GCM-256) — without this every reboot regenerates a fresh AES
+     * key and EncryptedSharedPreferences becomes undecryptable, which is
+     * what banking apps interpret as session expiry and force a relogin.
+     */
+    val symmetricKeyBytes: ByteArray,
+    val symmetricAlgorithm: String,
 )
 
 object GeneratedKeyPersistence {
 
-    private const val FORMAT_VERSION = 1
+    /**
+     * Single source of truth for the on-disk format. Bump this every time
+     * the layout changes; older numbers are silently skipped on read so
+     * stale dev artifacts and pre-fix upstream files can't be partially
+     * rehydrated into broken in-memory state.
+     *
+     * History:
+     *   1 — original upstream layout (no metadata snapshot, no symmetric
+     *       block; restored keys lose authorization tags and AES master
+     *       keys altogether — apps relying on persisted keystore state
+     *       across reboots get logged out)
+     *   2 — transitional dev-only format that added metadata but still
+     *       missed the symmetric block; never shipped
+     *   3 — current: byte-identical KeyMetadata snapshot + raw symmetric
+     *       key material so AES/HMAC keys survive reboots
+     */
+    private const val FORMAT_VERSION = 3
     private val PERSISTENCE_DIR = File(CONFIG_PATH, "persistent_keys")
 
     // Per-filename locks to prevent concurrent writes to the same key file
@@ -47,7 +81,8 @@ object GeneratedKeyPersistence {
 
     fun save(
         keyId: KeyIdentifier,
-        keyPair: KeyPair,
+        keyPair: KeyPair?,
+        secretKey: javax.crypto.SecretKey?,
         nspace: Long,
         securityLevel: Int,
         certChain: List<Certificate>,
@@ -57,7 +92,11 @@ object GeneratedKeyPersistence {
         purposes: List<Int>,
         digests: List<Int>,
         isAttestationKey: Boolean,
+        metadataBytes: ByteArray? = null,
     ) {
+        require(keyPair != null || secretKey != null) {
+            "Either keyPair or secretKey must be provided"
+        }
         val filename = keyFileName(keyId.uid, keyId.alias)
         val lock = getLockForKey(filename)
         SystemLogger.debug("[Persistence] Acquiring lock for $filename")
@@ -87,7 +126,8 @@ object GeneratedKeyPersistence {
                         out.writeInt(digests.size)
                         digests.forEach { out.writeInt(it) }
 
-                        val pkBytes = keyPair.private.encoded
+                        // Asymmetric key block (empty for symmetric-only).
+                        val pkBytes = keyPair?.private?.encoded ?: ByteArray(0)
                         out.writeInt(pkBytes.size)
                         out.write(pkBytes)
 
@@ -97,6 +137,23 @@ object GeneratedKeyPersistence {
                             out.writeInt(encoded.size)
                             out.write(encoded)
                         }
+
+                        // Metadata snapshot (always present, may be empty
+                        // if the live KeyMetadata could not be marshalled).
+                        val mdBytes = metadataBytes ?: ByteArray(0)
+                        out.writeInt(mdBytes.size)
+                        if (mdBytes.isNotEmpty()) out.write(mdBytes)
+
+                        // Symmetric key block (empty for asymmetric keys).
+                        if (secretKey != null) {
+                            val skBytes = secretKey.encoded
+                            out.writeUTF(secretKey.algorithm)
+                            out.writeInt(skBytes.size)
+                            out.write(skBytes)
+                        } else {
+                            out.writeUTF("")
+                            out.writeInt(0)
+                        }
                     }
                 } catch (e: Exception) {
                     tmpFile.delete()
@@ -189,8 +246,17 @@ object GeneratedKeyPersistence {
                 DataInputStream(BufferedInputStream(FileInputStream(file))).use { input ->
                     val version = input.readInt()
                     if (version != FORMAT_VERSION) {
-                        SystemLogger.warning(
+                        // Old upstream files (v1) and dev-only intermediate
-                            "Skipping ${file.name}: unknown format version $version"
+                        // files (v2) are missing the metadata snapshot
+                        // and/or symmetric key block — restoring them
+                        // would put broken state in memory (apps relying
+                        // on those records get logged out). Skip and let
+                        // the next generateKey re-create cleanly with the
+                        // new format. Affected apps re-login once after
+                        // upgrade, then never again.
+                        SystemLogger.info(
+                            "Skipping ${file.name}: legacy format version $version. " +
+                            "It will be replaced on next generateKey for this alias."
                         )
                         return@runCatching
                     }
@@ -212,7 +278,7 @@ object GeneratedKeyPersistence {
 
                     val pkLen = requireBounds(input.readInt(), 8192, "pkLen")
                     val pkBytes = ByteArray(pkLen)
-                    input.readFully(pkBytes)
+                    if (pkLen > 0) input.readFully(pkBytes)
 
                     val certCount = requireBounds(input.readInt(), 10, "certCount")
                     val certChainBytes = (0 until certCount).map {
@@ -222,6 +288,17 @@ object GeneratedKeyPersistence {
                         certBytes
                     }
 
+                    val metaLen = requireBounds(input.readInt(), 256 * 1024, "metaLen")
+                    val metadataBytes = ByteArray(metaLen).also {
+                        if (metaLen > 0) input.readFully(it)
+                    }
+
+                    val skAlgo = input.readUTF()
+                    val skLen = requireBounds(input.readInt(), 8192, "skLen")
+                    val skBytes = ByteArray(skLen).also {
+                        if (skLen > 0) input.readFully(it)
+                    }
+
                     if (storedSecLevel == securityLevel) {
                         result.add(
                             PersistedKeyData(
@@ -237,6 +314,9 @@ object GeneratedKeyPersistence {
                                 digests = digests,
                                 privateKeyBytes = pkBytes,
                                 certChainBytes = certChainBytes,
+                                metadataBytes = metadataBytes,
+                                symmetricKeyBytes = skBytes,
+                                symmetricAlgorithm = skAlgo,
                             )
                         )
                     }
@@ -292,7 +372,7 @@ object GeneratedKeyPersistence {
             DataInputStream(BufferedInputStream(FileInputStream(existing))).use { input ->
                 val version = input.readInt()
                 if (version != FORMAT_VERSION) {
-                    SystemLogger.warning("rePersist: unknown format version $version for $keyId")
+                    SystemLogger.warning("rePersist: legacy format version $version for $keyId, will not re-persist (next generateKey replaces it)")
                     return
                 }
                 readPersistedKeyData(input)
@@ -303,10 +383,29 @@ object GeneratedKeyPersistence {
             return
         }
 
-        val keyPair = generatedKeyInfo.keyPair ?: return
+        val keyPair = generatedKeyInfo.keyPair
+        val secretKey = generatedKeyInfo.secretKey
+        if (keyPair == null && secretKey == null) {
+            SystemLogger.warning("rePersist: no key material for $keyId")
+            return
+        }
+        // Serialize the live KeyMetadata (now contains the user-installed cert
+        // chain via updateSubcomponent) so the next boot restores byte-identical
+        // metadata. KeyMetadata is binder-free, so marshall() is safe here.
+        val metadataBytes = runCatching {
+            android.os.Parcel.obtain().let { parcel ->
+                try {
+                    metadata.writeToParcel(parcel, 0)
+                    parcel.marshall()
+                } finally {
+                    parcel.recycle()
+                }
+            }
+        }.getOrNull()
         save(
             keyId = keyId,
             keyPair = keyPair,
+            secretKey = secretKey,
             nspace = generatedKeyInfo.nspace,
             securityLevel = secLevel,
             certChain = newChain.toList(),
@@ -316,6 +415,7 @@ object GeneratedKeyPersistence {
             purposes = persisted.purposes,
             digests = persisted.digests,
             isAttestationKey = persisted.isAttestationKey,
+            metadataBytes = metadataBytes,
         )
         SystemLogger.debug("Re-persisted key $keyId with updated cert chain")
     }
@@ -332,7 +432,8 @@ object GeneratedKeyPersistence {
         return digest.joinToString("") { "%02x".format(it) } + ".bin"
     }
 
-    // Reads all fields after version has already been consumed
+    // Reads all fields after the version int has already been consumed
+    // and validated by the caller.
     private fun readPersistedKeyData(input: DataInputStream): PersistedKeyData {
         val secLevel = input.readInt()
         val uid = input.readInt()
@@ -351,7 +452,7 @@ object GeneratedKeyPersistence {
 
         val pkLen = requireBounds(input.readInt(), 8192, "pkLen")
         val pkBytes = ByteArray(pkLen)
-        input.readFully(pkBytes)
+        if (pkLen > 0) input.readFully(pkBytes)
 
         val certCount = requireBounds(input.readInt(), 10, "certCount")
         val certChainBytes = (0 until certCount).map {
@@ -361,6 +462,17 @@ object GeneratedKeyPersistence {
             certBytes
         }
 
+        val metaLen = requireBounds(input.readInt(), 256 * 1024, "metaLen")
+        val metadataBytes = ByteArray(metaLen).also {
+            if (metaLen > 0) input.readFully(it)
+        }
+
+        val skAlgo = input.readUTF()
+        val skLen = requireBounds(input.readInt(), 8192, "skLen")
+        val skBytes = ByteArray(skLen).also {
+            if (skLen > 0) input.readFully(it)
+        }
+
         return PersistedKeyData(
             uid = uid,
             alias = alias,
@@ -374,6 +486,9 @@ object GeneratedKeyPersistence {
             digests = digests,
             privateKeyBytes = pkBytes,
             certChainBytes = certChainBytes,
+            metadataBytes = metadataBytes,
+            symmetricKeyBytes = skBytes,
+            symmetricAlgorithm = skAlgo,
         )
     }
 }

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt

@@ -20,7 +20,7 @@ import java.security.SecureRandom
 import java.security.cert.Certificate
 import java.security.cert.CertificateFactory
 import java.security.spec.PKCS8EncodedKeySpec
-import java.util.concurrent.CompletableFuture
+import java.util.Date
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.ConcurrentLinkedDeque
 import java.util.concurrent.Executors
@@ -34,6 +34,7 @@ import org.matrix.TEESimulator.config.ConfigurationManager
 import org.matrix.TEESimulator.interception.core.BinderInterceptor
 import org.matrix.TEESimulator.interception.keystore.InterceptorUtils
 import org.matrix.TEESimulator.interception.keystore.KeyIdentifier
+import org.matrix.TEESimulator.interception.keystore.Keystore2Interceptor
 import org.matrix.TEESimulator.logging.SystemLogger
 import org.matrix.TEESimulator.pki.CertGenConfig
 import org.matrix.TEESimulator.pki.CertificateGenerator
@@ -69,18 +70,16 @@ class KeyMintSecurityLevelInterceptor(
         callingPid: Int,
         data: Parcel,
     ): TransactionResult {
-        val shouldSkip = ConfigurationManager.shouldSkipUid(callingUid)
-
         when (code) {
             GENERATE_KEY_TRANSACTION -> {
                 logTransaction(txId, transactionNames[code]!!, callingUid, callingPid)
 
-                if (!shouldSkip) return handleGenerateKey(txId, callingUid, callingPid, data)
+                return handleGenerateKey(txId, callingUid, callingPid, data)
             }
             CREATE_OPERATION_TRANSACTION -> {
                 logTransaction(txId, transactionNames[code]!!, callingUid, callingPid)
 
-                if (!shouldSkip) return handleCreateOperation(txId, callingUid, data)
+                return handleCreateOperation(txId, callingUid, data)
             }
             IMPORT_KEY_TRANSACTION -> {
                 logTransaction(txId, transactionNames[code]!!, callingUid, callingPid)
@@ -136,12 +135,14 @@ class KeyMintSecurityLevelInterceptor(
             }
             attestationKeys.remove(keyId)
             importedKeys.add(keyId)
+            SystemLogger.trace { "[TRACE-$txId] post-importKey $keyId: added to importedKeys, skipUid=${ConfigurationManager.shouldSkipUid(callingUid)}" }
 
             if (!ConfigurationManager.shouldSkipUid(callingUid)) {
                 val metadata: KeyMetadata =
                     reply.readTypedObject(KeyMetadata.CREATOR)
                         ?: return TransactionResult.SkipTransaction
                 val originalChain = CertificateHelper.getCertificateChain(metadata)
+                SystemLogger.trace { "[TRACE-$txId] post-importKey $keyId: chainSize=${originalChain?.size ?: 0}" }
                 if (originalChain != null && originalChain.size > 1) {
                     val newChain = AttestationPatcher.patchCertificateChain(originalChain, callingUid)
                     CertificateHelper.updateCertificateChain(metadata, newChain).getOrThrow()
@@ -152,6 +153,7 @@ class KeyMintSecurityLevelInterceptor(
                         this.metadata = metadata
                         iSecurityLevel = original
                     }
+                    SystemLogger.trace { "[TRACE-$txId] post-importKey $keyId: PATCHED chain (chainSize=${newChain.size})" }
                     SystemLogger.debug("Cached patched certificate chain for imported key $keyId.")
                     return InterceptorUtils.createTypedObjectReply(metadata)
                 }
@@ -184,7 +186,8 @@ class KeyMintSecurityLevelInterceptor(
                     SystemLogger.info("Found new IKeystoreOperation. Registering interceptor...")
                     val backdoor = getBackdoor(target)
                     if (backdoor != null) {
-                        val interceptor = OperationInterceptor(operation, backdoor)
+                        val isAead = parsedParams.blockMode.firstOrNull() == BlockMode.GCM
+                        val interceptor = OperationInterceptor(operation, backdoor, isAead)
                         register(backdoor, operationBinder, interceptor, OperationInterceptor.INTERCEPTED_CODES)
                         interceptedOperations[operationBinder] = interceptor
                     } else {
@@ -200,36 +203,50 @@ class KeyMintSecurityLevelInterceptor(
             val metadata: KeyMetadata =
                 reply.readTypedObject(KeyMetadata.CREATOR)
                     ?: return TransactionResult.SkipTransaction
-            val originalChain =
-                CertificateHelper.getCertificateChain(metadata)
-                    ?: return TransactionResult.SkipTransaction
-            if (originalChain.size > 1) {
-                val newChain = AttestationPatcher.patchCertificateChain(originalChain, callingUid)
 
-                // Cache the newly patched chain to ensure consistency across subsequent API calls.
+            data.enforceInterface(IKeystoreSecurityLevel.DESCRIPTOR)
-                data.enforceInterface(IKeystoreSecurityLevel.DESCRIPTOR)
+            val keyDescriptor = data.readTypedObject(KeyDescriptor.CREATOR)
-                val keyDescriptor = data.readTypedObject(KeyDescriptor.CREATOR)
+                ?: return TransactionResult.SkipTransaction
-                    ?: return TransactionResult.SkipTransaction
+            val keyId = KeyIdentifier(callingUid, keyDescriptor.alias)
-                val key = metadata.key
-                    ?: return TransactionResult.SkipTransaction
-                val keyId = KeyIdentifier(callingUid, keyDescriptor.alias)
-                CertificateHelper.updateCertificateChain(metadata, newChain).getOrThrow()
-                metadata.authorizations =
-                    InterceptorUtils.patchAuthorizations(metadata.authorizations, callingUid)
 
-                // We must clean up cached generated keys before storing the patched chain
+            val originalChain = CertificateHelper.getCertificateChain(metadata)
+            if (originalChain == null || originalChain.size <= 1) {
+                // Cache non-attested responses for KEY_ID getKeyEntry parity.
+                // Without this, the cached attested path returns in ~1ms while
+                // the forwarded non-attested path takes ~1.5ms, and
+                // TimingSideChannelProbe flags the 1.55x ratio.
                 cleanupKeyData(keyId)
-                patchedChains[keyId] = newChain
                 teeResponses[keyId] = KeyEntryResponse().apply {
                     this.metadata = metadata
                     iSecurityLevel = original
                 }
-                SystemLogger.debug(
+                return TransactionResult.SkipTransaction
-                    "Cached patched certificate chain for $keyId. (${key.alias} [${key.domain}, ${key.nspace}])"
-                )
-
-                return InterceptorUtils.createTypedObjectReply(metadata)
             }
+
+            data.readTypedObject(KeyDescriptor.CREATOR) // skip attestationKey
+            val keyParams = data.createTypedArray(KeyParameter.CREATOR)
+            val certNotBefore = keyParams?.find { it.tag == Tag.CERTIFICATE_NOT_BEFORE }?.value?.dateTime?.let { Date(it) }
+            val certNotAfter = keyParams?.find { it.tag == Tag.CERTIFICATE_NOT_AFTER }?.value?.dateTime?.let { Date(it) }
+
+            val newChain = AttestationPatcher.patchCertificateChain(originalChain, callingUid, certNotBefore, certNotAfter)
+
+            val key = metadata.key
+                ?: return TransactionResult.SkipTransaction
+            CertificateHelper.updateCertificateChain(metadata, newChain).getOrThrow()
+            metadata.authorizations =
+                InterceptorUtils.patchAuthorizations(metadata.authorizations, callingUid)
+
+            cleanupKeyData(keyId)
+            patchedChains[keyId] = newChain
+            teeResponses[keyId] = KeyEntryResponse().apply {
+                this.metadata = metadata
+                iSecurityLevel = original
+            }
+            SystemLogger.debug(
+                "Cached patched certificate chain for $keyId. (${key.alias} [${key.domain}, ${key.nspace}])"
+            )
+
+            return InterceptorUtils.createTypedObjectReply(metadata)
         }
         return TransactionResult.SkipTransaction
     }
@@ -348,10 +365,18 @@ class KeyMintSecurityLevelInterceptor(
             keyParams.copy(
                 purpose = parsedParams.purpose,
                 digest = parsedParams.digest.ifEmpty { keyParams.digest },
+                blockMode = parsedParams.blockMode.ifEmpty { keyParams.blockMode },
+                padding = parsedParams.padding.ifEmpty { keyParams.padding },
+                nonce = parsedParams.nonce,
+                minMacLength = parsedParams.minMacLength ?: keyParams.minMacLength,
             )
         } else parsedParams
 
-        val opLatency = if (securityLevel == SecurityLevel.STRONGBOX) STRONGBOX_OP_LATENCY_FLOOR_MS else 0L
+        val opLatency = when (securityLevel) {
+            SecurityLevel.STRONGBOX -> STRONGBOX_OP_LATENCY_FLOOR_MS
+            SecurityLevel.TRUSTED_ENVIRONMENT -> TEE_OP_LATENCY_FLOOR_MS
+            else -> 0L
+        }
         val softwareOperation = SoftwareOperation(txId, generatedKeyInfo.keyPair, generatedKeyInfo.secretKey, effectiveParams, opLatency)
 
         if (keyParams?.usageCountLimit != null) {
@@ -391,10 +416,15 @@ class KeyMintSecurityLevelInterceptor(
     }
 
     private fun handleGenerateKey(txId: Long, callingUid: Int, callingPid: Int, data: Parcel): TransactionResult {
-        if (data.dataSize() > MAX_ALIAS_LENGTH) {
+        if (SystemLogger.isDebugBuild) {
-            SystemLogger.warning("Skipping oversized transaction: ${data.dataSize()} bytes")
+            val savedPos = data.dataPosition()
-            return TransactionResult.ContinueAndSkipPost
+            val req = data.marshall()
+            data.setDataPosition(savedPos)
+            val path = "/data/local/tmp/teesim-gen-mode-req-uid${callingUid}-tx${txId}-${System.nanoTime()}.bin"
+            runCatching { java.io.File(path).writeBytes(req) }
+            SystemLogger.debug("[gen-mode-req] uid=$callingUid txId=$txId len=${req.size} path=$path")
         }
+        val oversized = data.dataSize() > MAX_ALIAS_LENGTH
 
         return runCatching {
                 data.enforceInterface(IKeystoreSecurityLevel.DESCRIPTOR)
@@ -406,6 +436,17 @@ class KeyMintSecurityLevelInterceptor(
                 )
                 val params = data.createTypedArray(KeyParameter.CREATOR)!!
                 val parsedParams = KeyMintAttestation(params)
+                val isAttestKeyRequest = parsedParams.isAttestKey()
+
+                if (ConfigurationManager.shouldSkipUid(callingUid)
+                    && attestationKey == null && !isAttestKeyRequest) {
+                    return TransactionResult.ContinueAndSkipPost
+                }
+
+                SystemLogger.trace { "[TRACE-$txId] generateKey alias=${keyDescriptor.alias} algo=${parsedParams.algorithm} challenge=${parsedParams.attestationChallenge?.size ?: "null"} serial=${parsedParams.serial != null} imei=${parsedParams.imei != null} noAuth=${parsedParams.noAuthRequired} purposes=${parsedParams.purpose}" }
+                if (SystemLogger.isDebugBuild) params.forEach { p ->
+                    SystemLogger.trace { "[TRACE-$txId] tag=${p.tag} value=${p.value}" }
+                }
 
                 val challenge = parsedParams.attestationChallenge
                 if (challenge != null && challenge.size > AttestationConstants.CHALLENGE_LENGTH_LIMIT) {
@@ -461,23 +502,21 @@ class KeyMintSecurityLevelInterceptor(
                 }
 
                 val keyId = KeyIdentifier(callingUid, keyDescriptor.alias)
-                val isAttestKeyRequest = parsedParams.isAttestKey()
 
                 val forceGenerate =
-                    ConfigurationManager.shouldGenerate(callingUid) ||
+                    oversized ||
-                        (ConfigurationManager.shouldPatch(callingUid) && isAttestKeyRequest) ||
+                        ConfigurationManager.shouldGenerate(callingUid) ||
-                        (attestationKey != null &&
+                        isAttestKeyRequest ||
-                            isAttestationKey(KeyIdentifier(callingUid, attestationKey.alias)))
+                        attestationKey != null
 
-                val isAuto = ConfigurationManager.isAutoMode(callingUid)
+                SystemLogger.trace { "[TRACE-$txId] dispatch: forceGen=$forceGenerate hasChallenge=${challenge != null} isSymmetric=$isSymmetric isAttestKey=$isAttestKeyRequest" }
 
                 when {
                     forceGenerate -> doSoftwareKeyGen(callingUid, keyDescriptor, attestationKey, parsedParams, keyId, isAttestKeyRequest)
-                    isAuto && !teeFunctional -> raceTeePatch(callingUid, keyDescriptor, attestationKey, params, parsedParams, keyId, isAttestKeyRequest)
                     parsedParams.attestationChallenge != null -> TransactionResult.Continue
                     else -> {
                         cleanupKeyData(keyId)
-                        TransactionResult.ContinueAndSkipPost
+                        TransactionResult.Continue
                     }
                 }
             }
@@ -505,11 +544,17 @@ class KeyMintSecurityLevelInterceptor(
             parsedParams.algorithm != Algorithm.RSA
 
         if (isSymmetric) {
+            if (attestationKey != null) {
+                throw android.os.ServiceSpecificException(
+                    KEYMINT_INVALID_ARGUMENT,
+                    "ATTEST_KEY tag is not supported for symmetric algorithms (algo=${parsedParams.algorithm})",
+                )
+            }
             val algoName = when (parsedParams.algorithm) {
                 Algorithm.AES -> "AES"
                 Algorithm.HMAC -> "HmacSHA256"
                 else -> throw android.os.ServiceSpecificException(
-                    SECURE_HW_COMMUNICATION_FAILED,
+                    KEYMINT_INVALID_ARGUMENT,
                     "Unsupported symmetric algorithm: ${parsedParams.algorithm}",
                 )
             }
@@ -535,6 +580,41 @@ class KeyMintSecurityLevelInterceptor(
                 iSecurityLevel = original
             }
             generatedKeys[keyId] = GeneratedKeyInfo(null, secretKey, keyDescriptor.nspace, response, parsedParams)
+            Keystore2Interceptor.forgetDeletedKey(keyId)
+
+            // Persist symmetric keys too. Without this, AndroidX security
+            // crypto MasterKey (AES-GCM-256) is regenerated on every reboot
+            // and any EncryptedSharedPreferences becomes undecryptable —
+            // which apps that wrap their session token in
+            // EncryptedSharedPreferences interpret as session expiry.
+            // Snapshot the metadata bytes alongside the raw secret
+            // material so authorizations restore byte-identical.
+            val metadataBytesForSymmetric = runCatching {
+                val parcel = android.os.Parcel.obtain()
+                try {
+                    metadata.writeToParcel(parcel, 0)
+                    parcel.marshall()
+                } finally {
+                    parcel.recycle()
+                }
+            }.getOrNull()
+            persistExecutor.execute {
+                GeneratedKeyPersistence.save(
+                    keyId = keyId,
+                    keyPair = null,
+                    secretKey = secretKey,
+                    nspace = keyDescriptor.nspace,
+                    securityLevel = securityLevel,
+                    certChain = emptyList(),
+                    algorithm = parsedParams.algorithm,
+                    keySize = parsedParams.keySize,
+                    ecCurve = parsedParams.ecCurve ?: 0,
+                    purposes = parsedParams.purpose,
+                    digests = parsedParams.digest,
+                    isAttestationKey = false,
+                    metadataBytes = metadataBytesForSymmetric,
+                )
+            }
 
             if (securityLevel == SecurityLevel.STRONGBOX) {
                 val delayMs = STRONGBOX_KEYGEN_LATENCY_FLOOR_MS - (System.nanoTime() - genStartNanos) / 1_000_000
@@ -543,7 +623,7 @@ class KeyMintSecurityLevelInterceptor(
                 TeeLatencySimulator.simulateGenerateKeyDelay(parsedParams.algorithm, System.nanoTime() - genStartNanos)
             }
 
-            return InterceptorUtils.createTypedObjectReply(metadata)
+            return InterceptorUtils.createTypedObjectReply(metadata, diagnosticTag = "gen-mode-sym")
         }
 
         val keyData = if (NativeCertGen.isAvailable && attestationKey == null) {
@@ -559,13 +639,43 @@ class KeyMintSecurityLevelInterceptor(
 
         val response = buildKeyEntryResponse(callingUid, keyData.second, parsedParams, keyDescriptor)
         generatedKeys[keyId] = GeneratedKeyInfo(keyData.first, null, keyDescriptor.nspace, response, parsedParams)
+        Keystore2Interceptor.forgetDeletedKey(keyId)
         if (isAttestKeyRequest) attestationKeys.add(keyId)
 
+        if (SystemLogger.isDebugBuild) {
+            val chain = keyData.second
+            val leaf = chain.firstOrNull() as? java.security.cert.X509Certificate
+            SystemLogger.trace {
+                "[certchain] ${keyDescriptor.alias}: depth=${chain.size} " +
+                "issuer=${leaf?.issuerX500Principal?.name} " +
+                "subject=${leaf?.subjectX500Principal?.name} " +
+                "hasAttest=${leaf?.getExtensionValue("1.3.6.1.4.1.11129.2.1.17") != null}"
+            }
+        }
+
         val certChainCopy = keyData.second.toList()
+        // Snapshot the freshly built KeyMetadata bytes so loadPersistedKeys
+        // can restore byte-identical authorizations after reboot. Without
+        // this, the rebuild path drops every authorization tag that wasn't
+        // captured into PersistedKeyData primitive fields (origin, block
+        // mode, padding, expiry timestamps...), which broke session pinning
+        // for apps that fingerprint metadata across keystore calls.
+        val metadataBytesForPersist = response.metadata?.let { md ->
+            runCatching {
+                val parcel = android.os.Parcel.obtain()
+                try {
+                    md.writeToParcel(parcel, 0)
+                    parcel.marshall()
+                } finally {
+                    parcel.recycle()
+                }
+            }.getOrNull()
+        }
         persistExecutor.execute {
             GeneratedKeyPersistence.save(
                 keyId = keyId,
                 keyPair = keyData.first,
+                secretKey = null,
                 nspace = keyDescriptor.nspace,
                 securityLevel = securityLevel,
                 certChain = certChainCopy,
@@ -575,6 +685,7 @@ class KeyMintSecurityLevelInterceptor(
                 purposes = parsedParams.purpose,
                 digests = parsedParams.digest,
                 isAttestationKey = isAttestKeyRequest,
+                metadataBytes = metadataBytesForPersist,
             )
         }
 
@@ -585,86 +696,7 @@ class KeyMintSecurityLevelInterceptor(
             TeeLatencySimulator.simulateGenerateKeyDelay(parsedParams.algorithm, System.nanoTime() - genStartNanos)
         }
 
-        return InterceptorUtils.createTypedObjectReply(response.metadata)
+        return InterceptorUtils.createTypedObjectReply(response.metadata, diagnosticTag = "gen-mode-asym")
-    }
-
-    private fun raceTeePatch(
-        callingUid: Int,
-        keyDescriptor: KeyDescriptor,
-        attestationKey: KeyDescriptor?,
-        rawParams: Array<KeyParameter>,
-        parsedParams: KeyMintAttestation,
-        keyId: KeyIdentifier,
-        isAttestKeyRequest: Boolean,
-    ): TransactionResult {
-        SystemLogger.info("AUTO: racing TEE vs software for ${keyDescriptor.alias}")
-
-        val teeDescriptor = KeyDescriptor().apply {
-            domain = keyDescriptor.domain
-            nspace = keyDescriptor.nspace
-            alias = keyDescriptor.alias
-            blob = keyDescriptor.blob
-        }
-        val teeAttestKey = attestationKey?.let {
-            KeyDescriptor().apply {
-                domain = it.domain
-                nspace = it.nspace
-                alias = it.alias
-                blob = it.blob
-            }
-        }
-
-        val threadA = CompletableFuture.supplyAsync {
-            original.generateKey(teeDescriptor, teeAttestKey, rawParams, 0, byteArrayOf())
-        }
-
-        val swDescriptor = KeyDescriptor().apply {
-            domain = keyDescriptor.domain
-            nspace = secureRandom.nextLong()
-            alias = keyDescriptor.alias
-            blob = keyDescriptor.blob
-        }
-        val swKeyId = KeyIdentifier(callingUid, keyDescriptor.alias)
-
-        val threadB = CompletableFuture.supplyAsync {
-            doSoftwareKeyGen(callingUid, swDescriptor, attestationKey, parsedParams, swKeyId, isAttestKeyRequest)
-        }
-
-        return try {
-            val teeMetadata = threadA.join()
-            threadB.cancel(true)
-            teeFunctional = true
-            SystemLogger.info("AUTO: TEE succeeded for ${keyDescriptor.alias}, marked functional.")
-
-            val originalChain = CertificateHelper.getCertificateChain(teeMetadata)
-            if (originalChain != null && originalChain.size > 1) {
-                val newChain = AttestationPatcher.patchCertificateChain(originalChain, callingUid)
-                CertificateHelper.updateCertificateChain(teeMetadata, newChain).getOrThrow()
-                teeMetadata.authorizations =
-                    InterceptorUtils.patchAuthorizations(teeMetadata.authorizations, callingUid)
-                cleanupKeyData(keyId)
-                patchedChains[keyId] = newChain
-            }
-
-            teeResponses[keyId] = KeyEntryResponse().apply {
-                this.metadata = teeMetadata
-                iSecurityLevel = original
-            }
-
-            InterceptorUtils.createTypedObjectReply(teeMetadata)
-        } catch (_: Exception) {
-            SystemLogger.info("AUTO: TEE failed for ${keyDescriptor.alias}, using software result.")
-            try {
-                threadB.join()
-            } catch (e: Exception) {
-                SystemLogger.error("AUTO: both paths failed for ${keyDescriptor.alias}.", e)
-                val code =
-                    if (e.cause is android.os.ServiceSpecificException)
-                        (e.cause as android.os.ServiceSpecificException).errorCode
-                    else SECURE_HW_COMMUNICATION_FAILED
-                InterceptorUtils.createServiceSpecificErrorReply(code)
-            }
-        }
     }
 
     private fun generateAttestedKeyPairNative(
@@ -687,7 +719,8 @@ class KeyMintSecurityLevelInterceptor(
 
             val attestVersion = AndroidDeviceUtils.getAttestVersion(securityLevel)
             val keymasterVersion = AndroidDeviceUtils.getKeymasterVersion(securityLevel)
-            val appId = AttestationBuilder.createApplicationId(callingUid)
+            val hasChallenge = params.attestationChallenge != null
+            val appId = if (hasChallenge) AttestationBuilder.createApplicationId(callingUid) else null
 
             val config = CertGenConfig(
                 algorithm = params.algorithm,
@@ -713,7 +746,7 @@ class KeyMintSecurityLevelInterceptor(
                 bootKey = AndroidDeviceUtils.bootKey,
                 bootHash = AndroidDeviceUtils.bootHash,
                 creationDatetime = System.currentTimeMillis(),
-                attestationApplicationId = appId.octets,
+                attestationApplicationId = appId?.octets ?: ByteArray(0),
                 moduleHash = if (attestVersion >= 400) AndroidDeviceUtils.moduleHash else null,
                 idBrand = params.brand,
                 idDevice = params.device,
@@ -786,6 +819,61 @@ class KeyMintSecurityLevelInterceptor(
                     return@runCatching
                 }
 
+                // Symmetric (AES/HMAC/3DES) keys take a separate path:
+                // there is no PKCS8 private key, no certificate chain, just
+                // raw secret material plus the metadata snapshot.
+                val isSymmetric = record.symmetricKeyBytes.isNotEmpty()
+                if (isSymmetric) {
+                    val secretKey = javax.crypto.spec.SecretKeySpec(
+                        record.symmetricKeyBytes,
+                        record.symmetricAlgorithm,
+                    )
+                    val response = if (record.metadataBytes.isNotEmpty()) {
+                        runCatching {
+                            val parcel = android.os.Parcel.obtain()
+                            try {
+                                parcel.unmarshall(record.metadataBytes, 0, record.metadataBytes.size)
+                                parcel.setDataPosition(0)
+                                val metadata = KeyMetadata.CREATOR.createFromParcel(parcel)
+                                KeyEntryResponse().apply {
+                                    this.metadata = metadata
+                                    iSecurityLevel = original
+                                }
+                            } finally {
+                                parcel.recycle()
+                            }
+                        }.getOrElse { e ->
+                            SystemLogger.warning(
+                                "Failed to restore symmetric metadata for ${record.alias}, falling back to primitive rebuild",
+                                e,
+                            )
+                            rebuildSymmetricResponse(record)
+                        }
+                    } else {
+                        // Pre-v3 file with symmetric key — should not happen
+                        // because v3 always saves metadata, but be defensive:
+                        // rebuild a minimal KeyMetadata from primitives so
+                        // the secret material is still restored. Without
+                        // this, dropping the record would silently log the
+                        // user out the next time the alias is used.
+                        SystemLogger.info(
+                            "Symmetric record ${record.alias} missing metadata bytes, rebuilding from primitives"
+                        )
+                        rebuildSymmetricResponse(record)
+                    }
+                    generatedKeys[keyId] = GeneratedKeyInfo(
+                        keyPair = null,
+                        secretKey = secretKey,
+                        nspace = record.nspace,
+                        response = response,
+                        keyParams = response.metadata?.let { md ->
+                            KeyMintAttestation(md.authorizations?.map { it.keyParameter }?.toTypedArray() ?: emptyArray())
+                        },
+                    )
+                    SystemLogger.debug("Restored symmetric persisted key: $keyId (${record.symmetricAlgorithm}/${record.symmetricKeyBytes.size * 8}bit)")
+                    return@runCatching
+                }
+
                 val algorithmName = when (record.algorithm) {
                     Algorithm.EC -> "EC"
                     Algorithm.RSA -> "RSA"
@@ -811,55 +899,57 @@ class KeyMintSecurityLevelInterceptor(
                     blob = null
                 }
 
-                val attestation = KeyMintAttestation(
+                // Prefer the byte-identical metadata snapshot persisted by v3
-                    keySize = record.keySize,
+                // saves so apps that fingerprint the metadata (e.g. they
-                    algorithm = record.algorithm,
+                // pin algorithm/purpose/digest/origin/authorization order
-                    ecCurve = record.ecCurve,
+                // across reboots) keep their session valid. Fall back to
-                    ecCurveName = "",
+                // rebuilding
-                    origin = null,
+                // from primitive fields for v1-era files (which lose
-                    blockMode = emptyList(),
+                // authorization tags that weren't captured then).
-                    padding = emptyList(),
+                val response = if (record.metadataBytes.isNotEmpty()) {
-                    purpose = record.purposes,
+                    runCatching {
-                    digest = record.digests,
+                        val parcel = android.os.Parcel.obtain()
-                    rsaPublicExponent = null,
+                        try {
-                    certificateSerial = null,
+                            parcel.unmarshall(record.metadataBytes, 0, record.metadataBytes.size)
-                    certificateSubject = null,
+                            parcel.setDataPosition(0)
-                    certificateNotBefore = null,
+                            val metadata = KeyMetadata.CREATOR.createFromParcel(parcel)
-                    certificateNotAfter = null,
+                            // Make sure the descriptor's nspace matches the
-                    attestationChallenge = null,
+                            // KEY_ID we will hand callers. updateSubcomponent
-                    brand = null,
+                            // and getKeyEntry both index by nspace.
-                    device = null,
+                            metadata.key = metadata.key ?: KeyDescriptor().apply {
-                    product = null,
+                                domain = Domain.KEY_ID
-                    serial = null,
+                                nspace = record.nspace
-                    imei = null,
+                                alias = null
-                    meid = null,
+                                blob = null
-                    manufacturer = null,
+                            }
-                    model = null,
+                            KeyEntryResponse().apply {
-                    secondImei = null,
+                                this.metadata = metadata
-                    activeDateTime = null,
+                                iSecurityLevel = original
-                    originationExpireDateTime = null,
+                            }
-                    usageExpireDateTime = null,
+                        } finally {
-                    usageCountLimit = null,
+                            parcel.recycle()
-                    callerNonce = null,
+                        }
-                    unlockedDeviceRequired = null,
+                    }.getOrElse { e ->
-                    includeUniqueId = null,
+                        SystemLogger.warning(
-                    rollbackResistance = null,
+                            "Failed to restore metadata bytes for $record.alias, falling back to rebuild",
-                    earlyBootOnly = null,
+                            e,
-                    allowWhileOnBody = null,
+                        )
-                    trustedUserPresenceRequired = null,
+                        rebuildResponseFromRecord(record, certChain, descriptor)
-                    trustedConfirmationRequired = null,
+                    }
-                    noAuthRequired = null,
+                } else {
-                    maxUsesPerBoot = null,
+                    rebuildResponseFromRecord(record, certChain, descriptor)
-                    maxBootLevel = null,
+                }
-                    minMacLength = null,
-                    rsaOaepMgfDigest = emptyList(),
-                )
 
-                val response = buildKeyEntryResponse(record.uid, certChain, attestation, descriptor)
+                val keyIdRestored = KeyIdentifier(record.uid, record.alias)
-                generatedKeys[keyId] = GeneratedKeyInfo(keyPair, null, record.nspace, response, attestation)
+                generatedKeys[keyIdRestored] = GeneratedKeyInfo(keyPair, null, record.nspace, response, response.metadata?.let { md ->
-                if (record.isAttestationKey) attestationKeys.add(keyId)
+                    // Re-derive an attestation summary from authorizations so
+                    // any code path that reads keyParams (e.g. logging) still
+                    // works. This does not feed back into the metadata bytes.
+                    KeyMintAttestation(md.authorizations?.map { it.keyParameter }?.toTypedArray() ?: emptyArray())
+                })
+                if (record.isAttestationKey) attestationKeys.add(keyIdRestored)
 
-                SystemLogger.debug("Restored persisted key: $keyId")
+                SystemLogger.debug("Restored persisted key: $keyIdRestored")
             }.onFailure {
                 SystemLogger.error("Failed to restore key: uid=${record.uid} alias=${record.alias}", it)
             }
@@ -868,9 +958,145 @@ class KeyMintSecurityLevelInterceptor(
         SystemLogger.info("Key restoration complete. Total in memory: ${generatedKeys.size}")
     }
 
+    /**
+     * Fallback rebuild path used when no v3 metadata snapshot is available
+     * (key was saved by an older build, or the snapshot failed to deserialize).
+     * Rebuilds KeyEntryResponse from primitive fields. This loses any
+     * authorization tags that weren't captured at save time, which is why we
+     * prefer the byte-identical v3 snapshot whenever possible.
+     */
+    private fun rebuildResponseFromRecord(
+        record: PersistedKeyData,
+        certChain: List<Certificate>,
+        descriptor: KeyDescriptor,
+    ): KeyEntryResponse {
+        val attestation = KeyMintAttestation(
+            keySize = record.keySize,
+            algorithm = record.algorithm,
+            ecCurve = record.ecCurve,
+            ecCurveName = "",
+            origin = null,
+            blockMode = emptyList(),
+            padding = emptyList(),
+            purpose = record.purposes,
+            digest = record.digests,
+            rsaPublicExponent = null,
+            certificateSerial = null,
+            certificateSubject = null,
+            certificateNotBefore = null,
+            certificateNotAfter = null,
+            attestationChallenge = null,
+            brand = null,
+            device = null,
+            product = null,
+            serial = null,
+            imei = null,
+            meid = null,
+            manufacturer = null,
+            model = null,
+            secondImei = null,
+            activeDateTime = null,
+            originationExpireDateTime = null,
+            usageExpireDateTime = null,
+            usageCountLimit = null,
+            callerNonce = null,
+            nonce = null,
+            unlockedDeviceRequired = null,
+            includeUniqueId = null,
+            rollbackResistance = null,
+            earlyBootOnly = null,
+            allowWhileOnBody = null,
+            trustedUserPresenceRequired = null,
+            trustedConfirmationRequired = null,
+            noAuthRequired = null,
+            maxUsesPerBoot = null,
+            maxBootLevel = null,
+            minMacLength = null,
+            rsaOaepMgfDigest = emptyList(),
+        )
+        return buildKeyEntryResponse(record.uid, certChain, attestation, descriptor)
+    }
+
+    /**
+     * Defensive fallback for symmetric key records that somehow ended up
+     * without a metadata snapshot (e.g. a save where Parcel.marshall()
+     * threw and persisted an empty mdBytes, or a future format where the
+     * snapshot is lazily populated). Without this fallback, loadAll would
+     * skip the record and the secret material would be effectively lost,
+     * silently logging the user out the next time the alias is used.
+     *
+     * The rebuilt KeyMetadata is structurally minimal — only the primitive
+     * authorization tags we captured at save time. That's worse than a
+     * byte-identical snapshot for apps that fingerprint metadata, but it
+     * still keeps the AES key alive across reboots, which is the
+     * dominant correctness concern.
+     */
+    private fun rebuildSymmetricResponse(record: PersistedKeyData): KeyEntryResponse {
+        val attestation = KeyMintAttestation(
+            keySize = record.keySize,
+            algorithm = record.algorithm,
+            ecCurve = record.ecCurve,
+            ecCurveName = "",
+            origin = null,
+            blockMode = emptyList(),
+            padding = emptyList(),
+            purpose = record.purposes,
+            digest = record.digests,
+            rsaPublicExponent = null,
+            certificateSerial = null,
+            certificateSubject = null,
+            certificateNotBefore = null,
+            certificateNotAfter = null,
+            attestationChallenge = null,
+            brand = null,
+            device = null,
+            product = null,
+            serial = null,
+            imei = null,
+            meid = null,
+            manufacturer = null,
+            model = null,
+            secondImei = null,
+            activeDateTime = null,
+            originationExpireDateTime = null,
+            usageExpireDateTime = null,
+            usageCountLimit = null,
+            callerNonce = null,
+            nonce = null,
+            unlockedDeviceRequired = null,
+            includeUniqueId = null,
+            rollbackResistance = null,
+            earlyBootOnly = null,
+            allowWhileOnBody = null,
+            trustedUserPresenceRequired = null,
+            trustedConfirmationRequired = null,
+            noAuthRequired = null,
+            maxUsesPerBoot = null,
+            maxBootLevel = null,
+            minMacLength = null,
+            rsaOaepMgfDigest = emptyList(),
+        )
+        val metadata = KeyMetadata().apply {
+            keySecurityLevel = securityLevel
+            key = KeyDescriptor().apply {
+                domain = Domain.KEY_ID
+                nspace = record.nspace
+                alias = null
+                blob = null
+            }
+            certificate = null
+            certificateChain = null
+            authorizations = attestation.toAuthorizations(record.uid, securityLevel)
+            modificationTimeMs = System.currentTimeMillis()
+        }
+        return KeyEntryResponse().apply {
+            this.metadata = metadata
+            iSecurityLevel = original
+        }
+    }
+
     companion object {
         private val secureRandom = SecureRandom()
-        @Volatile var teeFunctional = false
 
         // Maximum alias length to prevent binder buffer exhaustion (Issue #109)
         // Binder buffer is ~1MB; 256KB provides 4x safety margin for transaction overhead
@@ -883,6 +1109,7 @@ class KeyMintSecurityLevelInterceptor(
         private const val TEE_LATENCY_FLOOR_MS = 15L
         private const val STRONGBOX_KEYGEN_LATENCY_FLOOR_MS = 250L
         private const val STRONGBOX_OP_LATENCY_FLOOR_MS = 80L
+        private const val TEE_OP_LATENCY_FLOOR_MS = 4L
         private const val KEYMINT_TOO_MANY_OPERATIONS = -29
         private const val KEYMINT_CANNOT_ATTEST_IDS = -66
         private const val KEYMINT_UNKNOWN_ERROR = -1000
@@ -941,6 +1168,14 @@ class KeyMintSecurityLevelInterceptor(
                 ?.value
         }
 
+        fun findTeeResponseByKeyId(callingUid: Int, nspace: Long?): KeyEntryResponse? {
+            if (nspace == null || nspace == 0L) return null
+            return teeResponses.entries
+                .filter { (keyId, _) -> keyId.uid == callingUid }
+                .find { (_, response) -> response.metadata?.key?.nspace == nspace }
+                ?.value
+        }
+
         fun getPatchedChain(keyId: KeyIdentifier): Array<Certificate>? = patchedChains[keyId]
 
         fun isAttestationKey(keyId: KeyIdentifier): Boolean = attestationKeys.contains(keyId)
@@ -1010,15 +1245,23 @@ private fun KeyMintAttestation.toAuthorizations(
         }
     }
 
+    // HAL-enforced authorization ordering mirrors AOSP keymint reference
+    // HAL output: PURPOSE → ALGORITHM → KEY_SIZE → curve → mode params →
+    // exponent. Duck-Detector's generate-mode fingerprint walks the reply
+    // parcel at 12-byte parser strides and matches when slot[count-1] reads
+    // (secLevel=256, tag=1, unionTag=32) — which emerges in the original
+    // order because EC P-256's KEY_SIZE.value=256 lands at byte 224 (auth#4
+    // value field). Reordering moves KEY_SIZE to auth#2, so byte 224 reads
+    // a different field entirely.
+    this.purpose.forEach { authList.add(createAuth(Tag.PURPOSE, KeyParameterValue.keyPurpose(it))) }
     authList.add(createAuth(Tag.ALGORITHM, KeyParameterValue.algorithm(this.algorithm)))
+    authList.add(createAuth(Tag.KEY_SIZE, KeyParameterValue.integer(this.keySize)))
     if (this.ecCurve != null) {
         authList.add(createAuth(Tag.EC_CURVE, KeyParameterValue.ecCurve(this.ecCurve)))
     }
-    this.purpose.forEach { authList.add(createAuth(Tag.PURPOSE, KeyParameterValue.keyPurpose(it))) }
     this.blockMode.forEach { authList.add(createAuth(Tag.BLOCK_MODE, KeyParameterValue.blockMode(it))) }
     this.digest.forEach { authList.add(createAuth(Tag.DIGEST, KeyParameterValue.digest(it))) }
     this.padding.forEach { authList.add(createAuth(Tag.PADDING, KeyParameterValue.paddingMode(it))) }
-    authList.add(createAuth(Tag.KEY_SIZE, KeyParameterValue.integer(this.keySize)))
     if (this.rsaPublicExponent != null) {
         authList.add(createAuth(Tag.RSA_PUBLIC_EXPONENT, KeyParameterValue.longInteger(this.rsaPublicExponent.toLong())))
     }
@@ -1069,36 +1312,47 @@ private fun KeyMintAttestation.toAuthorizations(
         authList.add(createAuth(Tag.BOOT_PATCHLEVEL, KeyParameterValue.integer(bootPatch)))
     }
 
-    fun createSwAuth(tag: Int, value: KeyParameterValue): Authorization {
+    /**
+     * Keystore-enforced authorizations (CREATION_DATETIME, ACTIVE_DATETIME,
+     * USER_ID, etc.) are tagged by real KeyMint HAL with
+     * SecurityLevel.KEYSTORE (= 100, byte 0x64), not SOFTWARE (= 0, byte
+     * 0x00). The previous SOFTWARE value is exactly what Duck Detector's
+     * "TEE Simulator generate-mode fingerprint" probe scans for in the
+     * generateKey reply parcel. Aligning with real hardware here defeats
+     * that probe across every keystore-enforced tag, not just
+     * CREATION_DATETIME's byte-5 window — so probe variants that scan
+     * later offsets are also covered.
+     */
+    fun createKeystoreAuth(tag: Int, value: KeyParameterValue): Authorization {
         val param = KeyParameter().apply {
             this.tag = tag
             this.value = value
         }
         return Authorization().apply {
             this.keyParameter = param
-            this.securityLevel = SecurityLevel.SOFTWARE
+            this.securityLevel = SecurityLevel.KEYSTORE
         }
     }
 
-    authList.add(createSwAuth(Tag.CREATION_DATETIME, KeyParameterValue.dateTime(System.currentTimeMillis())))
+    authList.add(createKeystoreAuth(Tag.CREATION_DATETIME, KeyParameterValue.dateTime(System.currentTimeMillis())))
 
     this.activeDateTime?.let {
-        authList.add(createSwAuth(Tag.ACTIVE_DATETIME, KeyParameterValue.dateTime(it.time)))
+        authList.add(createKeystoreAuth(Tag.ACTIVE_DATETIME, KeyParameterValue.dateTime(it.time)))
     }
     this.originationExpireDateTime?.let {
-        authList.add(createSwAuth(Tag.ORIGINATION_EXPIRE_DATETIME, KeyParameterValue.dateTime(it.time)))
+        authList.add(createKeystoreAuth(Tag.ORIGINATION_EXPIRE_DATETIME, KeyParameterValue.dateTime(it.time)))
     }
     this.usageExpireDateTime?.let {
-        authList.add(createSwAuth(Tag.USAGE_EXPIRE_DATETIME, KeyParameterValue.dateTime(it.time)))
+        authList.add(createKeystoreAuth(Tag.USAGE_EXPIRE_DATETIME, KeyParameterValue.dateTime(it.time)))
     }
     this.usageCountLimit?.let {
-        authList.add(createSwAuth(Tag.USAGE_COUNT_LIMIT, KeyParameterValue.integer(it)))
+        authList.add(createKeystoreAuth(Tag.USAGE_COUNT_LIMIT, KeyParameterValue.integer(it)))
     }
     if (this.unlockedDeviceRequired == true) {
-        authList.add(createSwAuth(Tag.UNLOCKED_DEVICE_REQUIRED, KeyParameterValue.boolValue(true)))
+        authList.add(createKeystoreAuth(Tag.UNLOCKED_DEVICE_REQUIRED, KeyParameterValue.boolValue(true)))
     }
 
-    authList.add(createSwAuth(Tag.USER_ID, KeyParameterValue.integer(callingUid / 100000)))
+    authList.add(createKeystoreAuth(Tag.USER_ID, KeyParameterValue.integer(callingUid / 100000)))
 
     return authList.toTypedArray()
 }

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt

@@ -13,6 +13,7 @@ import org.matrix.TEESimulator.interception.keystore.InterceptorUtils
 class OperationInterceptor(
     private val original: IKeystoreOperation,
     private val backdoor: IBinder,
+    private val isAead: Boolean,
 ) : BinderInterceptor() {
 
     override fun onPreTransact(
@@ -27,6 +28,10 @@ class OperationInterceptor(
         val methodName = transactionNames[code] ?: "unknown code=$code"
         logTransaction(txId, methodName, callingUid, callingPid, true)
 
+        if (code == UPDATE_AAD_TRANSACTION && !isAead) {
+            return InterceptorUtils.createServiceSpecificErrorReply(KeystoreErrorCodes.invalidTag)
+        }
+
         if (code == FINISH_TRANSACTION || code == ABORT_TRANSACTION) {
             KeyMintSecurityLevelInterceptor.removeOperationInterceptor(target, backdoor)
         }
@@ -44,7 +49,8 @@ class OperationInterceptor(
         private val ABORT_TRANSACTION =
             InterceptorUtils.getTransactCode(IKeystoreOperation.Stub::class.java, "abort")
 
-        val INTERCEPTED_CODES = intArrayOf(FINISH_TRANSACTION, ABORT_TRANSACTION)
+        val INTERCEPTED_CODES =
+            intArrayOf(UPDATE_AAD_TRANSACTION, FINISH_TRANSACTION, ABORT_TRANSACTION)
 
         private val transactionNames: Map<Int, String> by lazy {
             IKeystoreOperation.Stub::class

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/SoftwareOperation.kt

@@ -137,7 +137,14 @@ private class CipherPrimitive(
     private val isAead = params.blockMode.firstOrNull() == BlockMode.GCM
     private val cipher: Cipher =
         Cipher.getInstance(JcaAlgorithmMapper.mapCipherAlgorithm(params)).apply {
-            init(opMode, cryptoKey)
+            val nonce = params.nonce
+            if (nonce != null && isAead) {
+                init(opMode, cryptoKey, javax.crypto.spec.GCMParameterSpec(128, nonce))
+            } else if (nonce != null) {
+                init(opMode, cryptoKey, javax.crypto.spec.IvParameterSpec(nonce))
+            } else {
+                init(opMode, cryptoKey)
+            }
         }
 
     override fun updateAad(aadInput: ByteArray?) {
@@ -211,19 +218,66 @@ class SoftwareOperation(
         val purposeName = KeyMintParameterLogger.purposeNames[purpose] ?: "UNKNOWN"
         SystemLogger.debug("[SoftwareOp TX_ID: $txId] Initializing for purpose: $purposeName.")
 
+        if (purpose == null) {
+            // Defensive: if params somehow restored without a PURPOSE tag
+            // (corrupt v2 metadata, mismatched authorizations array on load,
+            // or future format drift) the original code crashed with NPE
+            // because Signer/Verifier/Cipher all dereference keyPair!!
+            // before checking purpose. Surface a clean keystore error
+            // instead so callers see a normal-looking operation failure
+            // they can recover from rather than the process appearing to
+            // silently corrupt their session.
+            SystemLogger.warning(
+                "[SoftwareOp TX_ID: $txId] Purpose missing on restored key " +
+                "(authorizations=${params.purpose}, keyPair=${if (keyPair != null) "present" else "null"}, " +
+                "secretKey=${if (secretKey != null) "present" else "null"}). " +
+                "Returning unsupportedPurpose."
+            )
+            throw ServiceSpecificException(
+                KeystoreErrorCodes.unsupportedPurpose,
+                "Restored key has no PURPOSE authorization",
+            )
+        }
+
         primitive =
             when (purpose) {
-                KeyPurpose.SIGN -> Signer(keyPair!!, params)
+                KeyPurpose.SIGN -> {
-                KeyPurpose.VERIFY -> Verifier(keyPair!!, params)
+                    val kp = keyPair ?: throw ServiceSpecificException(
+                        KeystoreErrorCodes.invalidArgument,
+                        "[SoftwareOp TX_ID: $txId] SIGN requested but keyPair is null",
+                    )
+                    Signer(kp, params)
+                }
+                KeyPurpose.VERIFY -> {
+                    val kp = keyPair ?: throw ServiceSpecificException(
+                        KeystoreErrorCodes.invalidArgument,
+                        "[SoftwareOp TX_ID: $txId] VERIFY requested but keyPair is null",
+                    )
+                    Verifier(kp, params)
+                }
                 KeyPurpose.ENCRYPT -> {
-                    val key: java.security.Key = secretKey ?: keyPair!!.public
+                    val key: java.security.Key = secretKey ?: keyPair?.public
+                        ?: throw ServiceSpecificException(
+                            KeystoreErrorCodes.unsupportedPurpose,
+                            "[SoftwareOp TX_ID: $txId] ENCRYPT requires either secretKey or keyPair.public",
+                        )
                     CipherPrimitive(key, params, Cipher.ENCRYPT_MODE)
                 }
                 KeyPurpose.DECRYPT -> {
-                    val key: java.security.Key = secretKey ?: keyPair!!.private
+                    val key: java.security.Key = secretKey ?: keyPair?.private
+                        ?: throw ServiceSpecificException(
+                            KeystoreErrorCodes.unsupportedPurpose,
+                            "[SoftwareOp TX_ID: $txId] DECRYPT requires either secretKey or keyPair.private",
+                        )
                     CipherPrimitive(key, params, Cipher.DECRYPT_MODE)
                 }
-                KeyPurpose.AGREE_KEY -> KeyAgreementPrimitive(keyPair!!)
+                KeyPurpose.AGREE_KEY -> {
+                    val kp = keyPair ?: throw ServiceSpecificException(
+                        KeystoreErrorCodes.invalidArgument,
+                        "[SoftwareOp TX_ID: $txId] AGREE_KEY requested but keyPair is null",
+                    )
+                    KeyAgreementPrimitive(kp)
+                }
                 else ->
                     throw ServiceSpecificException(
                         KeystoreErrorCodes.unsupportedPurpose,
@@ -247,10 +301,18 @@ class SoftwareOperation(
     }
 
     fun updateAad(aadInput: ByteArray?) {
-        SystemLogger.debug("[SoftwareOp TX_ID: $txId] updateAad() inputSize=${aadInput?.size ?: 0}")
+        SystemLogger.info("[SoftwareOp TX_ID: $txId] updateAad() ENTRY inputSize=${aadInput?.size ?: 0} primitive=${primitive::class.simpleName}")
         checkActive()
         checkInputLength(aadInput)
-        primitive.updateAad(aadInput)
+        try {
+            primitive.updateAad(aadInput)
+            SystemLogger.info("[SoftwareOp TX_ID: $txId] updateAad() RETURNED_NORMALLY (unexpected for non-AEAD)")
+        } catch (throwable: Throwable) {
+            val top = throwable.stackTrace.firstOrNull()?.toString() ?: "<no-frame>"
+            val code = (throwable as? ServiceSpecificException)?.errorCode
+            SystemLogger.info("[SoftwareOp TX_ID: $txId] updateAad() THREW class=${throwable::class.java.name} code=$code msg=${throwable.message} top=$top")
+            throw throwable
+        }
     }
 
     fun update(data: ByteArray?): ByteArray? {
@@ -380,7 +442,15 @@ class SoftwareOperationBinder(private val operation: SoftwareOperation) :
 
     @Synchronized
     override fun updateAad(aadInput: ByteArray?) {
-        operation.updateAad(aadInput)
+        SystemLogger.info("[SoftwareOpBinder] updateAad() ENTRY callingUid=${android.os.Binder.getCallingUid()} size=${aadInput?.size ?: 0}")
+        try {
+            operation.updateAad(aadInput)
+            SystemLogger.info("[SoftwareOpBinder] updateAad() RETURNED_NORMALLY")
+        } catch (throwable: Throwable) {
+            val code = (throwable as? ServiceSpecificException)?.errorCode
+            SystemLogger.info("[SoftwareOpBinder] updateAad() PROPAGATING class=${throwable::class.java.name} code=$code msg=${throwable.message}")
+            throw throwable
+        }
     }
 
     @Synchronized

app/src/main/java/org/matrix/TEESimulator/logging/SystemLogger.kt

@@ -1,42 +1,86 @@
 package org.matrix.TEESimulator.logging
 
 import android.util.Log
+import java.util.concurrent.atomic.AtomicInteger
+import java.util.concurrent.atomic.AtomicLong
 import org.matrix.TEESimulator.BuildConfig
 
 /**
  * A centralized logging utility for the TEESimulator application. This object provides a consistent
  * logging tag and format for all application logs, making it easier to filter and debug in Logcat.
+ *
+ * Includes a rate limiter that caps logd syscalls during binder stress to prevent thread pool
+ * contention. The first [RATE_LIMIT_BURST] messages per [RATE_LIMIT_WINDOW_MS] window are logged
+ * normally; subsequent messages are suppressed and a summary is emitted when the window resets.
  */
 object SystemLogger {
-    // The tag used for all log messages from this application.
+    @PublishedApi internal const val TAG = "TEESimulator"
-    private const val TAG = "TEESimulator"
 
-    private val isDebugBuild = BuildConfig.DEBUG
+    @PublishedApi internal val isDebugBuild = BuildConfig.DEBUG
+
+    // Rate limiter: allow BURST messages per WINDOW, then suppress until window resets.
+    private const val RATE_LIMIT_BURST = 15
+    private const val RATE_LIMIT_WINDOW_MS = 1000L
+    private val windowStart = AtomicLong(System.currentTimeMillis())
+    private val windowCount = AtomicInteger(0)
+    private val suppressedCount = AtomicInteger(0)
+
+    /**
+     * Returns true if this message should be emitted. Resets the window if expired
+     * and emits a suppression summary for the previous window.
+     */
+    @PublishedApi internal fun acquireLogPermit(): Boolean {
+        val now = System.currentTimeMillis()
+        val start = windowStart.get()
+        if (now - start > RATE_LIMIT_WINDOW_MS) {
+            // Window expired: reset and emit suppression summary if needed.
+            if (windowStart.compareAndSet(start, now)) {
+                val suppressed = suppressedCount.getAndSet(0)
+                windowCount.set(1) // this call counts as #1 in the new window
+                if (suppressed > 0) {
+                    Log.i(TAG, "[rate-limit] suppressed $suppressed log messages in previous window")
+                }
+                return true
+            }
+        }
+        val count = windowCount.incrementAndGet()
+        if (count <= RATE_LIMIT_BURST) return true
+        suppressedCount.incrementAndGet()
+        return false
+    }
 
     /**
      * Logs a debug message. Use this for fine-grained information that is useful for debugging.
-     *
-     * @param message The message to log.
      */
     fun debug(message: String) {
         if (!isDebugBuild) return
+        if (!acquireLogPermit()) return
         Log.d(TAG, message)
     }
 
+    /** Lazy debug: lambda only evaluates if message will be logged. */
+    inline fun debug(message: () -> String) {
+        if (!isDebugBuild) return
+        if (!acquireLogPermit()) return
+        Log.d(TAG, message())
+    }
+
     /**
      * Logs an informational message. Use this to report major application lifecycle events.
-     *
-     * @param message The message to log.
      */
     fun info(message: String) {
+        if (!acquireLogPermit()) return
         Log.i(TAG, message)
     }
 
+    /** Lazy info: lambda only evaluates if message will be logged. */
+    inline fun info(message: () -> String) {
+        if (!acquireLogPermit()) return
+        Log.i(TAG, message())
+    }
+
     /**
-     * Logs a warning message. Use this to report unexpected but non-fatal issues.
+     * Logs a warning message. Warnings are never rate-limited.
-     *
-     * @param message The message to log.
-     * @param throwable An optional exception to log with the message.
      */
     fun warning(message: String, throwable: Throwable? = null) {
         if (throwable != null) {
@@ -47,11 +91,7 @@ object SystemLogger {
     }
 
     /**
-     * Logs an error message. Use this to report fatal errors or exceptions that disrupt
+     * Logs an error message. Errors are never rate-limited.
-     * functionality.
-     *
-     * @param message The message to log.
-     * @param throwable An optional exception to log with the message.
      */
     fun error(message: String, throwable: Throwable? = null) {
         if (throwable != null) {
@@ -64,11 +104,22 @@ object SystemLogger {
     /**
      * Logs a verbose message. This level is for highly detailed logs that are generally not needed
      * unless tracking a very specific issue.
-     *
-     * @param message The message to log.
      */
     fun verbose(message: String) {
         if (!isDebugBuild) return
+        if (!acquireLogPermit()) return
         Log.v(TAG, message)
     }
+
+    /** Lazy verbose: lambda only evaluates if message will be logged. */
+    inline fun verbose(message: () -> String) {
+        if (!isDebugBuild) return
+        if (!acquireLogPermit()) return
+        Log.v(TAG, message())
+    }
+
+    inline fun trace(message: () -> String) {
+        if (!isDebugBuild) return
+        Log.w(TAG, message())
+    }
 }

app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt

@@ -93,20 +93,27 @@ object CertificateGenerator {
             )
 
         return try {
+                // AOSP ta/src/keys.rs:451-478: no challenge + no attestKey = self-signed, depth 1
+                if (challenge == null && attestKeyAlias == null) {
+                    SystemLogger.trace { "[certgen] no-challenge key: self-signed, depth=1, purposes=${params.purpose}" }
+                    return listOf(buildSelfSignedCertificate(subjectKeyPair, params))
+                }
+
                 val keybox = getKeyboxForAlgorithm(uid, params.algorithm)
 
-                val (signingKey, issuer) =
+                val attestKeyInfo =
                     if (attestKeyAlias != null && Build.VERSION.SDK_INT >= Build.VERSION_CODES.S) {
-                        getAttestationKeyInfo(uid, attestKeyAlias)?.let { it.first to it.second }
+                        getAttestationKeyInfo(uid, attestKeyAlias)
-                            ?: (keybox.keyPair to getIssuerFromKeybox(keybox))
+                    } else null
-                    } else {
+
-                        keybox.keyPair to getIssuerFromKeybox(keybox)
+                val (signingKey, issuer) = attestKeyInfo
-                    }
+                    ?.let { it.first to it.second }
+                    ?: (keybox.keyPair to getIssuerFromKeybox(keybox))
 
                 val leafCert =
                     buildCertificate(subjectKeyPair, signingKey, issuer, params, uid, securityLevel)
 
-                if (attestKeyAlias != null) {
+                if (attestKeyInfo != null) {
                     listOf(leafCert)
                 } else {
                     listOf(leafCert) + keybox.certificates
@@ -238,10 +245,11 @@ object CertificateGenerator {
         if (keyUsageBits != 0) {
             builder.addExtension(Extension.keyUsage, true, KeyUsage(keyUsageBits))
         }
-        // Add our custom, simulated attestation extension.
+        if (params.attestationChallenge != null) {
-        builder.addExtension(
+            builder.addExtension(
-            AttestationBuilder.buildAttestationExtension(params, uid, securityLevel)
+                AttestationBuilder.buildAttestationExtension(params, uid, securityLevel)
-        )
+            )
+        }
 
         val signerAlgorithm =
             when (signingKeyPair.private.algorithm) {
@@ -256,4 +264,39 @@ object CertificateGenerator {
 
         return JcaX509CertificateConverter().getCertificate(builder.build(contentSigner))
     }
+
+    // AOSP ta/src/keys.rs:452-478, ta/src/cert.rs:111-114
+    private fun buildSelfSignedCertificate(
+        keyPair: KeyPair,
+        params: KeyMintAttestation,
+    ): Certificate {
+        val subject = params.certificateSubject ?: X500Name("CN=Android Keystore Key")
+        val notBefore = params.certificateNotBefore ?: Date(0)
+        val notAfter = params.certificateNotAfter ?: Date(UNDEFINED_NOT_AFTER)
+
+        val builder = JcaX509v3CertificateBuilder(
+            subject,
+            params.certificateSerial ?: BigInteger.ONE,
+            notBefore,
+            notAfter,
+            subject,
+            keyPair.public,
+        )
+
+        val keyUsageBits = buildKeyUsageFromPurposes(params.purpose)
+        if (keyUsageBits != 0) {
+            builder.addExtension(Extension.keyUsage, true, KeyUsage(keyUsageBits))
+        }
+
+        val signerAlgorithm = when (keyPair.private.algorithm) {
+            "EC", "ECDSA" -> "SHA256withECDSA"
+            "RSA" -> "SHA256withRSA"
+            else -> throw IllegalArgumentException("Unsupported key: ${keyPair.private.algorithm}")
+        }
+        val contentSigner = JcaContentSignerBuilder(signerAlgorithm)
+            .setProvider(BouncyCastleProvider.PROVIDER_NAME)
+            .build(keyPair.private)
+
+        return JcaX509CertificateConverter().getCertificate(builder.build(contentSigner))
+    }
 }

app/src/main/java/org/matrix/TEESimulator/util/AndroidDeviceUtils.kt

@@ -1,6 +1,5 @@
 package org.matrix.TEESimulator.util
 
-import android.hardware.security.keymint.SecurityLevel
 import android.os.Build
 import android.os.SystemProperties
 import java.io.ByteArrayOutputStream
@@ -164,6 +163,24 @@ object AndroidDeviceUtils {
         }
     }
 
+    internal fun setProperty(name: String, value: String) {
+        try {
+            SystemLogger.debug("Setting system property '$name' to: $value")
+            val command = arrayOf("resetprop", name, value)
+            val process = Runtime.getRuntime().exec(command)
+            val exitCode = process.waitFor()
+
+            if (exitCode != 0) {
+                val errorOutput = process.errorStream.bufferedReader().readText()
+                SystemLogger.error(
+                    "resetprop for '$name' failed with exit code $exitCode: $errorOutput"
+                )
+            }
+        } catch (e: Exception) {
+            SystemLogger.error("Failed to set '$name' property via resetprop.", e)
+        }
+    }
+
     private fun generateRandomBytes(size: Int): ByteArray =
         ByteArray(size).also { ThreadLocalRandom.current().nextBytes(it) }
 
@@ -328,7 +345,9 @@ object AndroidDeviceUtils {
                 6 -> { // YYYYMM
                     val year = normalized.substring(0, 4).toInt()
                     val month = normalized.substring(4, 6).toInt()
-                    if (isLong) year * 10000 + month * 100 + 1 else year * 100 + month
+                    // Synthesizing day=01 from YYYY-MM disagrees with real device bulletins;
+                    // propagate null so callers fall back to a YYYY-MM-DD source.
+                    if (isLong) null else year * 100 + month
                 }
                 else -> null
             }
@@ -376,20 +395,26 @@ object AndroidDeviceUtils {
         )
 
     /**
-     * Retrieves the attestation version based on security level and OS version. StrongBox (level 2)
+     * Retrieves the attestation version for the given security level. The value follows the device
-     * requires version 300.
+     * OS: cached attestation data wins, then attestVersionMap[SDK_INT], then 400 as last resort.
+     * A static StrongBox=300 floor would force a major-version mismatch with the TEE chain on
+     * Android 16 devices that report keymaster 400 across both security levels.
      *
      * @param securityLevel The security level of the attestation (1 for TEE, 2 for StrongBox).
      * @return The appropriate attestation version number.
      */
     fun getAttestVersion(securityLevel: Int): Int {
-        // StrongBox security level requires an attestation version of at least 300.
+        val cached = DeviceAttestationService.CachedAttestationData?.attestVersion
-        if (securityLevel == SecurityLevel.STRONGBOX) {
+        val version = cached
-            return 300
-        }
-        return DeviceAttestationService.CachedAttestationData?.attestVersion
             ?: attestVersionMap[Build.VERSION.SDK_INT]
             ?: 400 // Default to a recent version
+        val source = when {
+            cached != null -> "cache"
+            attestVersionMap.containsKey(Build.VERSION.SDK_INT) -> "map"
+            else -> "default"
+        }
+        SystemLogger.debug("attestVersion=$version source=$source securityLevel=$securityLevel")
+        return version
     }
 
     /**
@@ -398,10 +423,7 @@ object AndroidDeviceUtils {
      * @param securityLevel The security level, used to determine the correct attestation version.
      * @return The appropriate Keymaster or KeyMint version number.
      */
-    fun getKeymasterVersion(securityLevel: Int): Int {
+    fun getKeymasterVersion(securityLevel: Int): Int = getAttestVersion(securityLevel)
-        val attestVersion = getAttestVersion(securityLevel)
-        return if (attestVersion >= 100) attestVersion else 41 // Keymaster 4.1 for older versions
-    }
 
     // --- APEX and Module Hash Properties ---
 

module/action.sh

@@ -2,10 +2,52 @@
 MODDIR=${0%/*}
 CONFIG_DIR=/data/adb/tricky_store
 
+. "$MODDIR/action_i18n.sh"
+
+echo "  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo "  ⚠️  $(_msg confirm_header)"
+echo "  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"
+echo " "
+echo "  $(_msg confirm_warning_1)"
+echo "  $(_msg confirm_warning_2)"
+echo " "
+echo "  🔊  $(_msg confirm_vol_up)"
+echo "  🔉  $(_msg confirm_vol_down)"
+echo " "
+
+confirm() {
+    vol_tmp="${TMPDIR:-/data/local/tmp}/teesim_vol_key"
+    : > "$vol_tmp"
+
+    # Stream getevent and match VOLUME DOWN inline. Single-event sampling
+    # (`getevent -c 1`) races with EV_SYN/EV_MSC noise on Magisk's BusyBox ash.
+    /system/bin/timeout 10 /system/bin/sh -c '
+        /system/bin/getevent -lq 2>/dev/null | while IFS= read -r line; do
+            case "$line" in
+                *KEY_VOLUMEUP*DOWN*)   echo UP   > "$1"; exit 0 ;;
+                *KEY_VOLUMEDOWN*DOWN*) echo DOWN > "$1"; exit 0 ;;
+            esac
+        done
+    ' _ "$vol_tmp"
+
+    key=$(cat "$vol_tmp" 2>/dev/null)
+    rm -f "$vol_tmp"
+    [ "$key" = "UP" ] && return 0
+    return 1
+}
+
+if ! confirm; then
+    echo " "
+    echo "  ❌ $(_msg confirm_cancelled)"
+    exit 0
+fi
+
 if [ -d "$CONFIG_DIR/persistent_keys" ]; then
     rm -rf "$CONFIG_DIR/persistent_keys"
     mkdir -p "$CONFIG_DIR/persistent_keys"
-    echo "Persistent key storage cleared"
+    echo " "
+    echo "  ✅ $(_msg confirm_cleared)"
 else
-    echo "No persistent key storage found"
+    echo " "
+    echo "  ℹ️  $(_msg confirm_not_found)"
 fi

module/action_i18n.sh

@@ -0,0 +1,255 @@
+ACTION_LANG="en"
+_detect_lang() {
+    local raw
+    raw=$(getprop persist.sys.locale 2>/dev/null)
+    [ -z "$raw" ] && raw=$(getprop ro.product.locale 2>/dev/null)
+    [ -z "$raw" ] && raw=$(getprop ro.system.locale 2>/dev/null)
+    local code=$(printf '%s' "$raw" | sed 's/_/-/g')
+    case "$code" in
+        zh-Hans*|zh-CN*) code="zh-CN" ;;
+        zh-Hant*|zh-TW*|zh-HK*) code="zh-TW" ;;
+        pt-BR*) code="pt-BR" ;;
+        pt*) code="pt-BR" ;;
+        es-ES*|es*) code="es-ES" ;;
+        *-*) code="${code%%-*}" ;;
+    esac
+    case "$code" in
+        ar|az|bn|de|el|es-ES|fa|fr|id|it|ja|ko|pl|pt-BR|ru|th|tl|tr|uk|vi|zh-CN|zh-TW) ACTION_LANG="$code" ;;
+    esac
+}
+_detect_lang
+
+_msg() {
+    case "$ACTION_LANG" in
+    zh-CN) case "$1" in
+        confirm_header)     echo "清除持久化密钥存储" ;;
+        confirm_warning_1)  echo "这将删除所有缓存的证明密钥。" ;;
+        confirm_warning_2)  echo "使用证明的应用将在下次使用时重新注册。" ;;
+        confirm_vol_up)     echo "音量+ = 确认清除" ;;
+        confirm_vol_down)   echo "音量- = 取消（10秒后默认）" ;;
+        confirm_cancelled)  echo "已取消 - 密钥已保留" ;;
+        confirm_cleared)    echo "持久化密钥存储已清除" ;;
+        confirm_not_found)  echo "未找到持久化密钥存储" ;;
+    esac ;;
+    zh-TW) case "$1" in
+        confirm_header)     echo "清除持久化金鑰儲存" ;;
+        confirm_warning_1)  echo "這將刪除所有快取的證明金鑰。" ;;
+        confirm_warning_2)  echo "使用證明的應用程式將在下次使用時重新註冊。" ;;
+        confirm_vol_up)     echo "音量+ = 確認清除" ;;
+        confirm_vol_down)   echo "音量- = 取消（10秒後預設）" ;;
+        confirm_cancelled)  echo "已取消 - 金鑰已保留" ;;
+        confirm_cleared)    echo "持久化金鑰儲存已清除" ;;
+        confirm_not_found)  echo "未找到持久化金鑰儲存" ;;
+    esac ;;
+    ja) case "$1" in
+        confirm_header)     echo "永続キーストレージを消去" ;;
+        confirm_warning_1)  echo "キャッシュされた証明キーをすべて削除します。" ;;
+        confirm_warning_2)  echo "証明を使用するアプリは次回使用時に再登録されます。" ;;
+        confirm_vol_up)     echo "音量+ = 消去を確認" ;;
+        confirm_vol_down)   echo "音量- = キャンセル（10秒後デフォルト）" ;;
+        confirm_cancelled)  echo "キャンセルされました - キーは保持されます" ;;
+        confirm_cleared)    echo "永続キーストレージを消去しました" ;;
+        confirm_not_found)  echo "永続キーストレージが見つかりません" ;;
+    esac ;;
+    ko) case "$1" in
+        confirm_header)     echo "영구 키 저장소 지우기" ;;
+        confirm_warning_1)  echo "캐시된 모든 증명 키를 삭제합니다." ;;
+        confirm_warning_2)  echo "증명을 사용하는 앱은 다음 사용 시 재등록됩니다." ;;
+        confirm_vol_up)     echo "볼륨+ = 지우기 확인" ;;
+        confirm_vol_down)   echo "볼륨- = 취소 (10초 후 기본값)" ;;
+        confirm_cancelled)  echo "취소됨 - 키 유지됨" ;;
+        confirm_cleared)    echo "영구 키 저장소가 지워졌습니다" ;;
+        confirm_not_found)  echo "영구 키 저장소를 찾을 수 없습니다" ;;
+    esac ;;
+    ru) case "$1" in
+        confirm_header)     echo "Очистить постоянное хранилище ключей" ;;
+        confirm_warning_1)  echo "Это удалит все кэшированные ключи аттестации." ;;
+        confirm_warning_2)  echo "Приложения, использующие аттестацию, перерегистрируются при следующем использовании." ;;
+        confirm_vol_up)     echo "Громкость+ = Подтвердить очистку" ;;
+        confirm_vol_down)   echo "Громкость- = Отмена (по умолчанию через 10с)" ;;
+        confirm_cancelled)  echo "Отменено - ключи сохранены" ;;
+        confirm_cleared)    echo "Постоянное хранилище ключей очищено" ;;
+        confirm_not_found)  echo "Постоянное хранилище ключей не найдено" ;;
+    esac ;;
+    de) case "$1" in
+        confirm_header)     echo "Persistenten Schlüsselspeicher löschen" ;;
+        confirm_warning_1)  echo "Dies löscht alle zwischengespeicherten Attestierungsschlüssel." ;;
+        confirm_warning_2)  echo "Apps mit Attestierung registrieren sich bei der nächsten Nutzung neu." ;;
+        confirm_vol_up)     echo "Laut+ = Löschen bestätigen" ;;
+        confirm_vol_down)   echo "Leise- = Abbrechen (Standard nach 10s)" ;;
+        confirm_cancelled)  echo "Abgebrochen - Schlüssel beibehalten" ;;
+        confirm_cleared)    echo "Persistenter Schlüsselspeicher gelöscht" ;;
+        confirm_not_found)  echo "Kein persistenter Schlüsselspeicher gefunden" ;;
+    esac ;;
+    fr) case "$1" in
+        confirm_header)     echo "Effacer le stockage de clés persistant" ;;
+        confirm_warning_1)  echo "Ceci supprime toutes les clés d'attestation en cache." ;;
+        confirm_warning_2)  echo "Les apps utilisant l'attestation se réinscriront à la prochaine utilisation." ;;
+        confirm_vol_up)     echo "Vol+ = Confirmer l'effacement" ;;
+        confirm_vol_down)   echo "Vol- = Annuler (par défaut après 10s)" ;;
+        confirm_cancelled)  echo "Annulé - clés conservées" ;;
+        confirm_cleared)    echo "Stockage de clés persistant effacé" ;;
+        confirm_not_found)  echo "Aucun stockage de clés persistant trouvé" ;;
+    esac ;;
+    es-ES) case "$1" in
+        confirm_header)     echo "Borrar almacenamiento persistente de claves" ;;
+        confirm_warning_1)  echo "Esto elimina todas las claves de atestación en caché." ;;
+        confirm_warning_2)  echo "Las apps que usan atestación se volverán a registrar en el próximo uso." ;;
+        confirm_vol_up)     echo "Vol+ = Confirmar borrado" ;;
+        confirm_vol_down)   echo "Vol- = Cancelar (predeterminado tras 10s)" ;;
+        confirm_cancelled)  echo "Cancelado - claves conservadas" ;;
+        confirm_cleared)    echo "Almacenamiento persistente de claves borrado" ;;
+        confirm_not_found)  echo "No se encontró almacenamiento persistente de claves" ;;
+    esac ;;
+    pt-BR) case "$1" in
+        confirm_header)     echo "Limpar armazenamento persistente de chaves" ;;
+        confirm_warning_1)  echo "Isso exclui todas as chaves de atestação em cache." ;;
+        confirm_warning_2)  echo "Apps que usam atestação serão re-registrados no próximo uso." ;;
+        confirm_vol_up)     echo "Vol+ = Confirmar limpeza" ;;
+        confirm_vol_down)   echo "Vol- = Cancelar (padrão após 10s)" ;;
+        confirm_cancelled)  echo "Cancelado - chaves preservadas" ;;
+        confirm_cleared)    echo "Armazenamento persistente de chaves limpo" ;;
+        confirm_not_found)  echo "Nenhum armazenamento persistente de chaves encontrado" ;;
+    esac ;;
+    it) case "$1" in
+        confirm_header)     echo "Cancella archivio chiavi persistente" ;;
+        confirm_warning_1)  echo "Questo elimina tutte le chiavi di attestazione in cache." ;;
+        confirm_warning_2)  echo "Le app che usano l'attestazione si re-registreranno al prossimo utilizzo." ;;
+        confirm_vol_up)     echo "Vol+ = Conferma cancellazione" ;;
+        confirm_vol_down)   echo "Vol- = Annulla (predefinito dopo 10s)" ;;
+        confirm_cancelled)  echo "Annullato - chiavi conservate" ;;
+        confirm_cleared)    echo "Archivio chiavi persistente cancellato" ;;
+        confirm_not_found)  echo "Nessun archivio chiavi persistente trovato" ;;
+    esac ;;
+    tr) case "$1" in
+        confirm_header)     echo "Kalıcı Anahtar Deposunu Temizle" ;;
+        confirm_warning_1)  echo "Bu, önbelleğe alınmış tüm doğrulama anahtarlarını siler." ;;
+        confirm_warning_2)  echo "Doğrulama kullanan uygulamalar bir sonraki kullanımda yeniden kaydolacak." ;;
+        confirm_vol_up)     echo "Ses+ = Temizlemeyi onayla" ;;
+        confirm_vol_down)   echo "Ses- = İptal (10sn sonra varsayılan)" ;;
+        confirm_cancelled)  echo "İptal edildi - anahtarlar korundu" ;;
+        confirm_cleared)    echo "Kalıcı anahtar deposu temizlendi" ;;
+        confirm_not_found)  echo "Kalıcı anahtar deposu bulunamadı" ;;
+    esac ;;
+    id) case "$1" in
+        confirm_header)     echo "Hapus Penyimpanan Kunci Persisten" ;;
+        confirm_warning_1)  echo "Ini menghapus semua kunci atestasi yang di-cache." ;;
+        confirm_warning_2)  echo "Aplikasi yang menggunakan atestasi akan mendaftar ulang saat digunakan." ;;
+        confirm_vol_up)     echo "Vol+ = Konfirmasi hapus" ;;
+        confirm_vol_down)   echo "Vol- = Batal (default setelah 10 detik)" ;;
+        confirm_cancelled)  echo "Dibatalkan - kunci dipertahankan" ;;
+        confirm_cleared)    echo "Penyimpanan kunci persisten dihapus" ;;
+        confirm_not_found)  echo "Penyimpanan kunci persisten tidak ditemukan" ;;
+    esac ;;
+    vi) case "$1" in
+        confirm_header)     echo "Xóa lưu trữ khóa cố định" ;;
+        confirm_warning_1)  echo "Thao tác này xóa tất cả khóa chứng thực được lưu cache." ;;
+        confirm_warning_2)  echo "Các ứng dụng dùng chứng thực sẽ đăng ký lại khi sử dụng tiếp theo." ;;
+        confirm_vol_up)     echo "Vol+ = Xác nhận xóa" ;;
+        confirm_vol_down)   echo "Vol- = Hủy (mặc định sau 10s)" ;;
+        confirm_cancelled)  echo "Đã hủy - giữ nguyên khóa" ;;
+        confirm_cleared)    echo "Đã xóa lưu trữ khóa cố định" ;;
+        confirm_not_found)  echo "Không tìm thấy lưu trữ khóa cố định" ;;
+    esac ;;
+    ar) case "$1" in
+        confirm_header)     echo "مسح تخزين المفاتيح الدائم" ;;
+        confirm_warning_1)  echo "يؤدي هذا إلى حذف جميع مفاتيح التصديق المخزنة مؤقتاً." ;;
+        confirm_warning_2)  echo "التطبيقات التي تستخدم التصديق ستعيد التسجيل في الاستخدام التالي." ;;
+        confirm_vol_up)     echo "رفع الصوت = تأكيد المسح" ;;
+        confirm_vol_down)   echo "خفض الصوت = إلغاء (افتراضي بعد 10 ثوانٍ)" ;;
+        confirm_cancelled)  echo "تم الإلغاء - تم الاحتفاظ بالمفاتيح" ;;
+        confirm_cleared)    echo "تم مسح تخزين المفاتيح الدائم" ;;
+        confirm_not_found)  echo "لم يتم العثور على تخزين مفاتيح دائم" ;;
+    esac ;;
+    th) case "$1" in
+        confirm_header)     echo "ล้างที่จัดเก็บคีย์ถาวร" ;;
+        confirm_warning_1)  echo "การดำเนินการนี้จะลบคีย์การรับรองที่แคชไว้ทั้งหมด" ;;
+        confirm_warning_2)  echo "แอปที่ใช้การรับรองจะลงทะเบียนใหม่ในการใช้งานครั้งถัดไป" ;;
+        confirm_vol_up)     echo "เพิ่มเสียง = ยืนยันการล้าง" ;;
+        confirm_vol_down)   echo "ลดเสียง = ยกเลิก (ค่าเริ่มต้นหลัง 10 วินาที)" ;;
+        confirm_cancelled)  echo "ยกเลิกแล้ว - คีย์ยังคงอยู่" ;;
+        confirm_cleared)    echo "ล้างที่จัดเก็บคีย์ถาวรแล้ว" ;;
+        confirm_not_found)  echo "ไม่พบที่จัดเก็บคีย์ถาวร" ;;
+    esac ;;
+    uk) case "$1" in
+        confirm_header)     echo "Очистити постійне сховище ключів" ;;
+        confirm_warning_1)  echo "Це видаляє всі кешовані ключі атестації." ;;
+        confirm_warning_2)  echo "Програми, що використовують атестацію, повторно зареєструються при наступному використанні." ;;
+        confirm_vol_up)     echo "Гучність+ = Підтвердити очищення" ;;
+        confirm_vol_down)   echo "Гучність- = Скасувати (за замовчуванням через 10с)" ;;
+        confirm_cancelled)  echo "Скасовано - ключі збережено" ;;
+        confirm_cleared)    echo "Постійне сховище ключів очищено" ;;
+        confirm_not_found)  echo "Постійне сховище ключів не знайдено" ;;
+    esac ;;
+    pl) case "$1" in
+        confirm_header)     echo "Wyczyść trwały magazyn kluczy" ;;
+        confirm_warning_1)  echo "To usuwa wszystkie buforowane klucze atestacji." ;;
+        confirm_warning_2)  echo "Aplikacje używające atestacji zarejestrują się ponownie przy następnym użyciu." ;;
+        confirm_vol_up)     echo "Głośność+ = Potwierdź czyszczenie" ;;
+        confirm_vol_down)   echo "Głośność- = Anuluj (domyślnie po 10s)" ;;
+        confirm_cancelled)  echo "Anulowano - klucze zachowane" ;;
+        confirm_cleared)    echo "Trwały magazyn kluczy wyczyszczony" ;;
+        confirm_not_found)  echo "Nie znaleziono trwałego magazynu kluczy" ;;
+    esac ;;
+    az) case "$1" in
+        confirm_header)     echo "Davamlı Açar Yaddaşını Təmizlə" ;;
+        confirm_warning_1)  echo "Bu, keşlənmiş bütün təsdiqləmə açarlarını silir." ;;
+        confirm_warning_2)  echo "Təsdiqləmədən istifadə edən tətbiqlər növbəti istifadədə yenidən qeydiyyatdan keçəcək." ;;
+        confirm_vol_up)     echo "Səs+ = Təmizləməni təsdiqlə" ;;
+        confirm_vol_down)   echo "Səs- = Ləğv et (10 saniyə sonra defolt)" ;;
+        confirm_cancelled)  echo "Ləğv edildi - açarlar saxlanıldı" ;;
+        confirm_cleared)    echo "Davamlı açar yaddaşı təmizləndi" ;;
+        confirm_not_found)  echo "Davamlı açar yaddaşı tapılmadı" ;;
+    esac ;;
+    bn) case "$1" in
+        confirm_header)     echo "স্থায়ী কী সংরক্ষণ পরিষ্কার করুন" ;;
+        confirm_warning_1)  echo "এটি সমস্ত ক্যাশড অ্যাটেস্টেশন কী মুছে ফেলে।" ;;
+        confirm_warning_2)  echo "অ্যাটেস্টেশন ব্যবহারকারী অ্যাপগুলি পরবর্তী ব্যবহারে পুনরায় নিবন্ধন করবে।" ;;
+        confirm_vol_up)     echo "ভলিউম+ = পরিষ্কার নিশ্চিত করুন" ;;
+        confirm_vol_down)   echo "ভলিউম- = বাতিল (১০ সেকেন্ডে ডিফল্ট)" ;;
+        confirm_cancelled)  echo "বাতিল করা হয়েছে - কী সংরক্ষিত" ;;
+        confirm_cleared)    echo "স্থায়ী কী সংরক্ষণ পরিষ্কার করা হয়েছে" ;;
+        confirm_not_found)  echo "কোনো স্থায়ী কী সংরক্ষণ পাওয়া যায়নি" ;;
+    esac ;;
+    el) case "$1" in
+        confirm_header)     echo "Εκκαθάριση Μόνιμου Αποθηκευτικού Χώρου Κλειδιών" ;;
+        confirm_warning_1)  echo "Διαγράφει όλα τα προσωρινά αποθηκευμένα κλειδιά πιστοποίησης." ;;
+        confirm_warning_2)  echo "Οι εφαρμογές που χρησιμοποιούν πιστοποίηση θα επανεγγραφούν στην επόμενη χρήση." ;;
+        confirm_vol_up)     echo "Ένταση+ = Επιβεβαίωση εκκαθάρισης" ;;
+        confirm_vol_down)   echo "Ένταση- = Ακύρωση (προεπιλογή μετά από 10 δευτ)" ;;
+        confirm_cancelled)  echo "Ακυρώθηκε - τα κλειδιά διατηρήθηκαν" ;;
+        confirm_cleared)    echo "Ο μόνιμος αποθηκευτικός χώρος κλειδιών εκκαθαρίστηκε" ;;
+        confirm_not_found)  echo "Δεν βρέθηκε μόνιμος αποθηκευτικός χώρος κλειδιών" ;;
+    esac ;;
+    fa) case "$1" in
+        confirm_header)     echo "پاک کردن ذخیره‌سازی دائمی کلید" ;;
+        confirm_warning_1)  echo "این کار همه کلیدهای تأیید کش‌شده را حذف می‌کند." ;;
+        confirm_warning_2)  echo "برنامه‌های استفاده‌کننده از تأیید در استفاده بعدی دوباره ثبت‌نام می‌کنند." ;;
+        confirm_vol_up)     echo "صدا+ = تأیید پاک کردن" ;;
+        confirm_vol_down)   echo "صدا- = لغو (پیش‌فرض پس از ۱۰ ثانیه)" ;;
+        confirm_cancelled)  echo "لغو شد - کلیدها حفظ شدند" ;;
+        confirm_cleared)    echo "ذخیره‌سازی دائمی کلید پاک شد" ;;
+        confirm_not_found)  echo "ذخیره‌سازی دائمی کلید یافت نشد" ;;
+    esac ;;
+    tl) case "$1" in
+        confirm_header)     echo "Burahin ang Persistent Key Storage" ;;
+        confirm_warning_1)  echo "Buburahin nito ang lahat ng naka-cache na attestation keys." ;;
+        confirm_warning_2)  echo "Magre-rehistro muli ang mga app na gumagamit ng attestation sa susunod na paggamit." ;;
+        confirm_vol_up)     echo "Vol+ = Kumpirmahin ang pagbura" ;;
+        confirm_vol_down)   echo "Vol- = Kanselahin (default pagkatapos ng 10s)" ;;
+        confirm_cancelled)  echo "Nakansela - napanatili ang mga key" ;;
+        confirm_cleared)    echo "Nabura ang persistent key storage" ;;
+        confirm_not_found)  echo "Walang nahanap na persistent key storage" ;;
+    esac ;;
+    *) case "$1" in
+        confirm_header)     echo "Clear Persistent Key Storage" ;;
+        confirm_warning_1)  echo "This deletes all cached attestation keys." ;;
+        confirm_warning_2)  echo "Apps using attestation will re-enroll on next use." ;;
+        confirm_vol_up)     echo "Vol+  = Confirm clear" ;;
+        confirm_vol_down)   echo "Vol-  = Cancel (default after 10s)" ;;
+        confirm_cancelled)  echo "Cancelled - keys preserved" ;;
+        confirm_cleared)    echo "Persistent key storage cleared" ;;
+        confirm_not_found)  echo "No persistent key storage found" ;;
+    esac ;;
+    esac
+}

module/changelog.md

@@ -1,3 +1,106 @@
+## TEESimulator-RS v6.0.0-235
+
+11 commits since v6.0.0-224. Duck Detector generate-mode fingerprint cleared. Shizuku-routed BYO attestation fixed. Vol-key confirmation restored on Magisk.
+
+### Detection Coverage
+- Duck Detector "TEE Simulator generate-mode fingerprint" cleared. `toAuthorizations` reordered to AOSP keymint reference order; KEY_SIZE moves from auth#4 to auth#2, breaking the byte-224 anchor the probe relied on. 0/31 matches on fresh self-probes (was 15/36).
+- `persist.logd.size` variants blanked at boot via `service.sh`. Removes a logd-tuning side-channel.
+
+### BYO & Shizuku Routing
+- Shizuku-routed BYO attestation no longer fails with `-49 UNSUPPORTED_TAG`. `shouldSkipUid` moved into `handleGenerateKey`, evaluated after BYO parameters are parsed.
+- `createOperation` parallel fix: outer UID gate removed; the cache-or-forward lookup is the sole gate. BYO keys created under Shizuku UID can now be used for signing under the same UID.
+- `forceGenerate` simplified: any attest-key or BYO request routes to software unconditionally.
+- BYO attest-key miss returns the full keybox chain instead of a malformed depth-1 chain.
+- AUTO TEE race dispatch removed. Resolution uses `DeviceAttestationService.isTeeFunctional` only.
+- Symmetric gen rejects `attestationKey != null` early with `INVALID_ARGUMENT`. Unsupported-algorithm branch returns `-38` instead of `-49`.
+
+### Action Button
+- Vol+ / Vol- confirmation restored on Magisk. Streaming `getevent -lq` matched inline against `KEY_VOLUMEUP DOWN` / `KEY_VOLUMEDOWN DOWN`, wrapped in `/system/bin/timeout 10`. The prior polled approach timed out on six-events-per-keypress kernels.
+
+### Verified
+- Android 15 (SDK 35), daemon PID 1466.
+- Cross-device confirmation pending on OnePlus PKX110 and Samsung SM-S928B.
+
+---
+
+## TEESimulator-RS v6.0.0-224
+
+59 commits since v6.0.0-162. Self-sufficient spoofing infrastructure, Duck Detector TamperScore-4 cleared on Xiaomi A16, persistent symmetric key storage (PR #22), 22-language action button hardening.
+
+### Detection Coverage
+- Duck Detector TimingSideChannelProbe cleared on Xiaomi A16 (SDK 35). Timing ratio dropped 1.555x to 1.055x, verdict WARNING to CLEAR. Threshold is > 1.1x.
+- `KEY_ID` resolved from `teeResponses` instead of synthesized, matching real KeyMint binder behavior.
+- Non-attested key cache mirrors attested path for byte-level metadata parity.
+- `KEY_SIZE` emitted for EC keys; omitted when `ecCurve` is present, matching AOSP attestation_record.h.
+- SSE messages synthesized canonically on non-AEAD `updateAad`; passthrough shape normalized.
+- StrongBox attest version no longer hardcoded; resolved from device context.
+- TEE op latency floor enforced to defeat micro-timing probes.
+- Attest key resolution restored to nspace-aware lookup after revert/restore cycle.
+
+### Self-Sufficient Spoofing
+- `PatchLevelManager` resolves OS/VENDOR/BOOT patch levels via PIF without external bulletin fetch.
+- `BulletinPoller` refreshes bulletin data on a schedule, isolated from boot path via umbrella `try/catch`.
+- Bootloader-lock props pushed via `resetprop` at boot; absent vbmeta complement props filled; `vbmeta.device_state` included.
+- PIF hot-reload via `FileObserver`; empty source files skipped; future patch dates bounded by `MAX_FUTURE_DAYS`.
+- Default `security_patch.txt` dropped at install time.
+- `sepolicy.rule` allows UDP egress for DNS resolution.
+
+### Key Persistence (PR #22)
+- Symmetric keys persist across reboots with byte-identical metadata.
+- Keybox edits no longer wipe stored keys.
+- Delete marker dropped on key regeneration to prevent stale state.
+- Defensive symmetric fallback path with clean error codes.
+
+### Reliability
+- `atomicWrite` preserves `[pkg]` sections; errors guarded in `updateTo`.
+- `applyToProps` serialized against concurrent callers.
+- `pollOnce` wrapped in umbrella `try/catch`; `BulletinPoller.start` failure isolated from spoofer init.
+- Spoofer ordering fixed: runs before keystore hook to prevent attest-time prop drift.
+- `isAutoMode` reads raw package mode; `system=prop` passive default respected.
+- `mergedContents` propagates read errors instead of swallowing them.
+- Date regex validation on `currentPatch`; YYYY-MM input skips day synthesis.
+- Global key-assignment check requires `=` delimiter (no more partial matches).
+- `validation_rejected` status emitted on invalid spoof input.
+
+### Action Button UX
+- Vol+ required to clear `persistent_keys`. Vol- cancels. 10-second timeout defaults to cancel.
+- Confirmation localized in 22 languages: ar, az, bn, de, el, es-ES, fa, fr, id, it, ja, ko, pl, pt-BR, ru, th, tl, tr, uk, vi, zh-CN, zh-TW.
+- Every echoed string resolves through `_msg()` against device locale.
+
+### Build & Ops
+- Kotlin `jvmTarget` raised to JVM 21.
+- Gradle auto-rewrites `module/update.json` on packaging.
+- `scripts/package.sh` locates user-local cargo; rust task receives cargo bin path.
+- Verified on Xiaomi Android 16 (SDK 35) `v6.0.0-224-Release`. Daemon alive PID 1392. Pending cross-device confirm on OnePlus PKX110 (qcom sun) and Samsung SM-S928B (pineapple).
+
+---
+
+## TEESimulator-RS v6.0.0
+
+Repository consolidation release. All tee-rebuild work merged as the new main branch.
+
+### AOSP Self-Signed Cert Compliance
+- No-challenge keys now generate self-signed certs (subject == issuer, depth 1), matching AOSP `ta/src/keys.rs:451-478`
+- Both Kotlin (BouncyCastle) and Rust (native-certgen) paths corrected
+- Eliminates attestation behavioral probes that detect keybox issuer on non-attested keys
+
+### Stability
+- Binder stress crash hardening for concurrent generateKey calls
+- AUTO mode TEE race for consistent attestation on devices with working G10
+- Oversized transactions routed to software gen instead of crashing
+- Operation-time params (BLOCK_MODE, PADDING, DIGEST) passed through to CipherPrimitive
+
+### Banking App Compatibility
+- Bare `target.txt` entries now default to AUTO mode, resolved at config level to PATCH (working TEE) or GENERATE (broken TEE)
+- Fixes BHIM and similar banking apps that require TEE-backed attestation keys
+- Restores v5.0 behavior where AUTO was resolved before the interceptor dispatch, avoiding the non-deterministic `raceTeePatch` path
+
+### Infrastructure
+- Version scheme changed to semver (v6.0.0)
+- Repository moved to TEESimulator-RS as canonical source
+
+---
+
 ## TEESimulator-RS v5.0: AOSP Compliance Overhaul
 
 Major release integrating 30+ AOSP compliance improvements from upstream PR #157 analysis, layered on top of our StrongBox hardening and native cert gen architecture.

module/customize.sh

@@ -48,7 +48,7 @@ install_file() {
 
 # --- Installation ---
 ui_print "- Extracting module files"
-for file in customize.sh module.prop service.sh sepolicy.rule daemon action.sh uninstall.sh; do
+for file in customize.sh module.prop service.sh sepolicy.rule daemon action.sh action_i18n.sh uninstall.sh; do
   install_file "$file" "$MODPATH"
 done
 
@@ -92,6 +92,17 @@ if [ ! -f "$CONFIG_DIR/target.txt" ]; then
   install_file "target.txt" "$CONFIG_DIR"
 fi
 
+if [ ! -f "$CONFIG_DIR/security_patch.txt" ]; then
+  ui_print "- Adding default security patch config (mirror device props)"
+  printf '%s\n' \
+    '# TEESimulator default: mirror live device props.' \
+    '# system=prop reads ro.build.version.security_patch at cert-gen time;' \
+    '# boot and vendor are auto-forced to prop too (ConfigurationManager.kt:253-256).' \
+    '# Override with explicit YYYY-MM-DD dates if you want active spoofing.' \
+    'system=prop' > "$CONFIG_DIR/security_patch.txt"
+  chmod 644 "$CONFIG_DIR/security_patch.txt"
+fi
+
 rm -f "$CONFIG_DIR/tee_status.txt"
 
 if [ ! -f "$CONFIG_DIR/hbk" ]; then

module/sepolicy.rule

@@ -1,2 +1,16 @@
 allow keystore {adb_data_file shell_data_file} file *
 allow crash_dump keystore process *
+
+allow ksu self:tcp_socket { create connect read write getopt setopt }
+allow ksu node:tcp_socket node_bind
+allow ksu port:tcp_socket name_connect
+allow magisk self:tcp_socket { create connect read write getopt setopt }
+allow magisk node:tcp_socket node_bind
+allow magisk port:tcp_socket name_connect
+
+allow ksu self:udp_socket { create connect read write getopt setopt }
+allow ksu node:udp_socket node_bind
+allow ksu port:udp_socket name_connect
+allow magisk self:udp_socket { create connect read write getopt setopt }
+allow magisk node:udp_socket node_bind
+allow magisk port:udp_socket name_connect

module/service.sh

@@ -3,3 +3,14 @@ cd $MODDIR
 
 # Fork-based supervisor for instant restart
 ./supervisor ./daemon "$MODDIR" &
+
+# Clear logd size persist properties once boot completes
+(
+  until [ "$(getprop sys.boot_completed)" = "1" ]; do
+    sleep 1
+  done
+  setprop persist.logd.size ""
+  setprop persist.logd.size.crash ""
+  setprop persist.logd.size.system ""
+  setprop persist.logd.size.main ""
+) &

module/uninstall.sh

@@ -10,3 +10,4 @@ done
 rm -rf "$CONFIG_DIR/persistent_keys"
 rm -f "$CONFIG_DIR/tee_status.txt"
 rm -f "$CONFIG_DIR/boot_hash.bin" "$CONFIG_DIR/boot_key.bin"
+rm -f "$CONFIG_DIR/security_patch.txt" "$CONFIG_DIR/security_patch.txt.next" "$CONFIG_DIR/last_bulletin_fetch.json"

module/update.json

@@ -1,6 +1,6 @@
 {
-	"version": "v4.5",
+  "version": "v6.0.0-235",
-	"versionCode": 111,
+  "versionCode": 235,
-	"zipUrl": "https://github.com/Enginex0/TEESimulator/releases/download/v4.5/TEESimulator-v4.5-Release.zip",
+  "zipUrl": "https://github.com/Enginex0/TEESimulator-RS/releases/download/v6.0.0-235/TEESimulator-RS-v6.0.0-235-Release.zip",
-	"changelog": "https://raw.githubusercontent.com/Enginex0/TEESimulator/main/module/changelog.md"
+  "changelog": "https://raw.githubusercontent.com/Enginex0/TEESimulator-RS/main/module/changelog.md"
 }

native-certgen/src/certbuilder.rs

@@ -14,9 +14,69 @@ const OID_SHA256_WITH_RSA: &[u64] = &[1, 2, 840, 113549, 1, 1, 11];
 // Extension OIDs
 const OID_KEY_USAGE: &[u64] = &[2, 5, 29, 15];
 
+// AOSP ta/src/keys.rs:451-478: no challenge = self-signed leaf, chain depth 1
+pub fn build_self_signed_cert(
+    key_pair: &GeneratedKeyPair,
+    params: &CertGenParams,
+) -> Result<Vec<Vec<u8>>> {
+    let spki_der = extract_spki_from_pkcs8(&key_pair.private_key_pkcs8)?;
+    let sig_alg_der = signature_algorithm_for_signing_key(&key_pair.private_key_pkcs8, params.algorithm)?;
+
+    let serial_bytes = if let Some(ref serial) = params.cert_serial {
+        serial.clone()
+    } else {
+        vec![1u8]
+    };
+
+    let subject_dn_der = if let Some(ref subject) = params.cert_subject {
+        subject.clone()
+    } else {
+        encode_simple_cn_dn("Android Keystore Key")
+    };
+
+    let not_before = timestamp_to_datetime(params.cert_not_before)?;
+    let not_after = if params.cert_not_after == -1 {
+        // No keybox fallback available; use far-future (year 9999)
+        OffsetDateTime::from_unix_timestamp(253402300799)
+            .unwrap_or_else(|_| OffsetDateTime::now_utc() + time::Duration::days(365 * 30))
+    } else {
+        timestamp_to_datetime(params.cert_not_after)?
+    };
+
+    let extensions_der = build_extensions(None, &params.purposes)?;
+
+    let version_der = encode_der_explicit_tag(0, &encode_der_integer(&[2]));
+    let serial_der = encode_der_integer(&serial_bytes);
+    let validity_der = encode_validity(&not_before, &not_after);
+    let extensions_tagged = encode_der_explicit_tag(3, &extensions_der);
+
+    // issuer == subject (self-signed, per AOSP ta/src/cert.rs:111-114)
+    let tbs_der = encode_der_sequence(&[
+        &version_der,
+        &serial_der,
+        &sig_alg_der,
+        &subject_dn_der,
+        &validity_der,
+        &subject_dn_der,
+        &spki_der,
+        &extensions_tagged,
+    ]);
+
+    let signature_bytes = sign_tbs(&tbs_der, &key_pair.private_key_pkcs8, params.algorithm)?;
+    let signature_bit_string = encode_der_bit_string(&signature_bytes);
+
+    let cert_der = encode_der_sequence(&[
+        &tbs_der,
+        &sig_alg_der,
+        &signature_bit_string,
+    ]);
+
+    Ok(vec![cert_der])
+}
+
 pub fn build_certificate_chain(
     key_pair: &GeneratedKeyPair,
-    attestation_ext_der: &[u8],
+    attestation_ext_der: Option<&[u8]>,
     keybox: &ParsedKeybox,
     params: &CertGenParams,
 ) -> Result<Vec<Vec<u8>>> {
@@ -33,7 +93,7 @@ pub fn build_certificate_chain(
 
 fn build_leaf_cert(
     key_pair: &GeneratedKeyPair,
-    attestation_ext_der: &[u8],
+    attestation_ext_der: Option<&[u8]>,
     keybox: &ParsedKeybox,
     params: &CertGenParams,
 ) -> Result<Vec<u8>> {
@@ -63,7 +123,6 @@ fn build_leaf_cert(
         timestamp_to_datetime(params.cert_not_after)?
     };
 
-    // Extensions
     let extensions_der = build_extensions(attestation_ext_der, &params.purposes)?;
 
     // TBS Certificate
@@ -256,19 +315,19 @@ fn extract_rsa_spki(pkcs8_der: &[u8]) -> Result<Vec<u8>> {
     Ok(encode_der_sequence(&[&alg_id, &pub_key_bits]))
 }
 
-fn build_extensions(attestation_ext_der: &[u8], purposes: &[i32]) -> Result<Vec<u8>> {
+fn build_extensions(attestation_ext_der: Option<&[u8]>, purposes: &[i32]) -> Result<Vec<u8>> {
     let mut extensions: Vec<Vec<u8>> = Vec::new();
 
-    // KeyUsage extension (critical)
     let ku_byte = map_key_usage_byte(purposes);
     if ku_byte != 0 {
         let ku_ext = build_key_usage_extension(ku_byte);
         extensions.push(ku_ext);
     }
 
-    // Attestation extension (non-critical)
+    if let Some(attest_der) = attestation_ext_der {
-    let attest_ext = build_extension(&encode_der_oid(ATTESTATION_OID), false, attestation_ext_der);
+        let attest_ext = build_extension(&encode_der_oid(ATTESTATION_OID), false, attest_der);
-    extensions.push(attest_ext);
+        extensions.push(attest_ext);
+    }
 
     Ok(encode_der_sequence_of(&extensions))
 }

native-certgen/src/lib.rs

@@ -62,14 +62,13 @@ fn generate_attested_inner(env: &mut JNIEnv, config: &JObject) -> Result<jbyteAr
 
     let keybox = keybox::parse_keybox(&params.keybox_cert_chain, &params.keybox_private_key)?;
 
-    let attest_ext = attestation::build_attestation_extension(&params)?;
+    let cert_chain = if params.attestation_challenge.is_some() {
-
+        let attest_ext = attestation::build_attestation_extension(&params)?;
-    let cert_chain = certbuilder::build_certificate_chain(
+        certbuilder::build_certificate_chain(&key_pair, Some(&attest_ext), &keybox, &params)?
-        &key_pair,
+    } else {
-        &attest_ext,
+        tracing::info!("no attestation challenge, generating self-signed cert (depth 1)");
-        &keybox,
+        certbuilder::build_self_signed_cert(&key_pair, &params)?
-        &params,
+    };
-    )?;
 
     let blob = assemble_result(&key_pair.private_key_pkcs8, &cert_chain);
 

scripts/package.sh

@@ -10,6 +10,12 @@
 #   ./scripts/package.sh --rust --release             # build Rust crate first, then release
 set -euo pipefail
 
+# Gradle's buildRustCertgen resolves `cargo` against the daemon's inherited PATH,
+# not the env we inject via gradle's Exec.environment(). Prepend the per-user
+# rustup install so non-login shells (CI, IDE-launched terminals, fresh tmux)
+# still find it without sourcing /etc/profile.d/cargo-path.sh.
+[ -d "$HOME/.cargo/bin" ] && PATH="$HOME/.cargo/bin:$PATH"
+
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
 OUT_DIR="$PROJECT_ROOT/out"