docs(release): add v5.1.1 changelog for pre-stash restoration fixes

EC keys don't support DECRYPT (only AGREE_KEY for key derivation).
Without this guard, an EC DECRYPT operation creates a CipherPrimitive
that fails with a confusing JCA error instead of returning
UNSUPPORTED_PURPOSE upfront.

.gitattributes

@@ -0,0 +1,4 @@
+# Ensure shell scripts always have LF line endings, even on Windows.
+# These get packaged into flashable zips and run on Android devices.
+*.sh text eol=lf
+module/daemon text eol=lf

app/build.gradle.kts

@@ -29,7 +29,7 @@ val gitExecutor = objects.newInstance(GitExecutor::class.java)
 
 val gitCommitCount = gitExecutor.execute("git rev-list HEAD --count", rootDir).toInt()
 val gitCommitHash = gitExecutor.execute("git rev-parse --verify --short HEAD", rootDir)
-val verName = "v5.0"
+val verName = "v5.1.1"
 
 android {
     namespace = "org.matrix.TEESimulator"
@@ -121,8 +121,8 @@ androidComponents {
                     dependsOn("package${capitalized}")
                 } else {
                     dependsOn("minify${capitalized}WithR8")
-                    dependsOn("strip${capitalized}DebugSymbols")
                 }
+                dependsOn("strip${capitalized}DebugSymbols")
                 dependsOn(buildRustCertgen)
 
                 if (isDebug) {
@@ -140,12 +140,11 @@ androidComponents {
                     }
                 }
 
-                val nativeLibsDir = if (isDebug) {
-                    "intermediates/merged_native_libs/${variant.name}/merge${capitalized}NativeLibs/out/lib"
-                } else {
-                    "intermediates/stripped_native_libs/${variant.name}/strip${capitalized}DebugSymbols/out/lib"
-                }
-                from(project.layout.buildDirectory.dir(nativeLibsDir)) {
+                from(
+                    project.layout.buildDirectory.dir(
+                        "intermediates/stripped_native_libs/${variant.name}/strip${capitalized}DebugSymbols/out/lib"
+                    )
+                ) {
                     into("lib")
                     include("**/libinject.so", "**/libTEESimulator.so", "**/libsupervisor.so", "**/libcertgen.so")
                 }

app/src/main/cpp/binder_interceptor.cpp

@@ -235,15 +235,20 @@ class BinderInterceptor : public BBinder {
     struct RegistrationEntry {
         wp<IBinder> target;
         sp<IBinder> callback_interface;
+        // Transaction codes to intercept. Empty = intercept all (legacy behavior).
         std::vector<uint32_t> filtered_codes;
     };
 
+    // Reader-Writer lock for the registry to allow concurrent reads (lookups)
     mutable std::shared_mutex registry_mutex_;
     std::map<wp<IBinder>, RegistrationEntry> registry_;
 
 public:
     BinderInterceptor() = default;
 
+    // Checks if a specific Binder+code combination should be intercepted.
+    // Returns true if the binder is registered AND the code is in its filter
+    // (or the filter is empty, meaning intercept everything).
     bool shouldIntercept(const wp<BBinder> &target, uint32_t code) const {
         std::shared_lock lock(registry_mutex_);
         auto it = registry_.find(target);
@@ -350,19 +355,11 @@ static sp<BinderStub> g_stub_instance = nullptr;
 
 namespace {
 
-constexpr binder_size_t kMaxInterceptableDataSize = 256 * 1024;
-
 void inspectAndRewriteTransaction(binder_transaction_data *txn_data) {
     if (!txn_data || txn_data->target.ptr == 0)
         return;
 
-    // Bypass interception for oversized payloads to prevent thread starvation from flood attacks
-    if (txn_data->data_size > kMaxInterceptableDataSize)
-        return;
-
-    // AIDL methods use codes in [FIRST_CALL_TRANSACTION, LAST_CALL_TRANSACTION] (1..0x00ffffff).
-    // System transactions (PING, INTERFACE, DUMP, SHELL_COMMAND) use codes above that range.
-    // Skip those — intercepting a ping adds measurable latency that timing detectors flag.
+    // Skip system transactions (PING, INTERFACE, DUMP) to avoid latency detectors
     if (txn_data->code > 0x00ffffffu && txn_data->code != intercept::kBackdoorCode)
         return;
 
@@ -540,11 +537,14 @@ status_t BinderInterceptor::handleRegister(const Parcel &data) {
     if (data.readStrongBinder(&callback) != OK || !callback)
         return BAD_VALUE;
 
+    // We can only intercept local Binders (BBinder), not remote proxies (BpBinder)
     if (target->localBinder() == nullptr) {
         LOGE("Cannot intercept remote binder proxies.");
         return BAD_TYPE;
     }
 
+    // Read optional transaction code filter. If present: int32 count + count * uint32 codes.
+    // If absent or count <= 0: intercept all transaction codes (legacy behavior).
     std::vector<uint32_t> codes;
     int32_t code_count = 0;
     if (data.dataAvail() >= sizeof(int32_t) && data.readInt32(&code_count) == OK && code_count > 0) {
@@ -612,15 +612,8 @@ bool BinderInterceptor::processInterceptedTransaction(uint64_t tx_id, sp<BBinder
     Parcel pre_req, pre_resp;
     writeTransactionData(pre_req, tx_id, target, code, flags, request);
 
-    status_t pre_status = callback->transact(intercept::kPreTransact, pre_req, &pre_resp);
-    if (pre_status != OK) {
-        // Block when interceptor is dead to prevent privacy leak to third-party apps
-        if (callback->pingBinder() != OK) {
-            LOGE("[TX_ID: %" PRIu64 "] Interceptor DEAD. Blocking to prevent attestation leak.", tx_id);
-            result = DEAD_OBJECT;
-            return true;
-        }
-        LOGW("[TX_ID: %" PRIu64 "] Pre-transaction callback failed (not dead). Forwarding.", tx_id);
+    if (callback->transact(intercept::kPreTransact, pre_req, &pre_resp) != OK) {
+        LOGW("[TX_ID: %" PRIu64 "] Pre-transaction callback failed. Forwarding original call.", tx_id);
         return false;
     }
 
@@ -674,8 +667,7 @@ bool BinderInterceptor::processInterceptedTransaction(uint64_t tx_id, sp<BBinder
         VALIDATE_STATUS(tx_id, post_req.appendFrom(reply, 0, reply_size));
     }
 
-    status_t post_status = callback->transact(intercept::kPostTransact, post_req, &post_resp);
-    if (post_status == OK) {
+    if (callback->transact(intercept::kPostTransact, post_req, &post_resp) == OK) {
         int32_t post_action = post_resp.readInt32();
         if (post_action == intercept::kActionOverrideReply && reply) {
             result = post_resp.readInt32(); // Read new status

app/src/main/java/org/matrix/TEESimulator/App.kt

@@ -23,6 +23,8 @@ import org.matrix.TEESimulator.util.AndroidDeviceUtils
 object App {
     // The delay in milliseconds before retrying to initialize the interceptor.
     private const val RETRY_DELAY_MS = 1000L
+    // The sleep duration in milliseconds for the main service loop to keep the process alive.
+    private const val SERVICE_SLEEP_MS = 1000000L
 
     /**
      * The main entry point of the TEESimulator application.
@@ -42,9 +44,7 @@ object App {
             // Initialize and start the appropriate keystore interceptors.
             initializeInterceptors()
 
-            // Load the package configuration.
             ConfigurationManager.initialize()
-            // Set up the device's boot key and hash, which are crucial for attestation.
             AndroidDeviceUtils.setupBootKeyAndHash()
 
             // Android ships with a stripped-down Bouncy Castle provider under the name "BC".

app/src/main/java/org/matrix/TEESimulator/attestation/AttestationBuilder.kt

@@ -115,7 +115,6 @@ object AttestationBuilder {
             }
 
         val bootPatch = AndroidDeviceUtils.getBootPatchLevelLong(uid)
-        SystemLogger.info("Attestation patch levels for uid=$uid: os=$osPatch, vendor=$vendorPatch, boot=$bootPatch")
         properties[AttestationConstants.TAG_BOOT_PATCHLEVEL] =
             if (bootPatch != DO_NOT_REPORT) {
                 DERTaggedObject(
@@ -130,6 +129,7 @@ object AttestationBuilder {
         return properties
     }
 
+    /** Constructs the main `KeyDescription` sequence, which is the core of the attestation. */
     private fun buildKeyDescription(
         params: KeyMintAttestation,
         uid: Int,
@@ -148,11 +148,15 @@ object AttestationBuilder {
 
         val fields =
             arrayOf(
-                ASN1Integer(AndroidDeviceUtils.getAttestVersion(securityLevel).toLong()),
-                ASN1Enumerated(securityLevel),
-                ASN1Integer(AndroidDeviceUtils.getKeymasterVersion(securityLevel).toLong()),
-                ASN1Enumerated(securityLevel),
-                DEROctetString(params.attestationChallenge ?: ByteArray(0)),
+                ASN1Integer(
+                    AndroidDeviceUtils.getAttestVersion(securityLevel).toLong()
+                ), // attestationVersion
+                ASN1Enumerated(securityLevel), // attestationSecurityLevel
+                ASN1Integer(
+                    AndroidDeviceUtils.getKeymasterVersion(securityLevel).toLong()
+                ), // keymasterVersion
+                ASN1Enumerated(securityLevel), // keymasterSecurityLevel
+                DEROctetString(params.attestationChallenge ?: ByteArray(0)), // attestationChallenge
                 DEROctetString(uniqueId),
                 softwareEnforced,
                 teeEnforced,
@@ -160,24 +164,37 @@ object AttestationBuilder {
         return DERSequence(fields)
     }
 
+    /**
+     * Computes the unique ID per the KeyMint HAL spec:
+     * HMAC-SHA256(T || C || R, HBK) truncated to 128 bits.
+     *
+     * T = temporal counter (creationTime / 2592000000, i.e. 30-day periods since epoch)
+     * C = DER-encoded ATTESTATION_APPLICATION_ID
+     * R = 0x00 (no factory reset since ID rotation)
+     * HBK = device-unique secret generated once during module installation
+     */
     private fun computeUniqueId(creationTimeMs: Long, aaidDer: ByteArray): ByteArray {
         val temporalCounter = creationTimeMs / 2592000000L
+
         val message =
             ByteBuffer.allocate(8 + aaidDer.size + 1)
                 .putLong(temporalCounter)
                 .put(aaidDer)
-                .put(0x00)
+                .put(0x00) // RESET_SINCE_ID_ROTATION = false
                 .array()
+
         val mac = Mac.getInstance("HmacSHA256")
         mac.init(SecretKeySpec(hbk, "HmacSHA256"))
         return mac.doFinal(message).copyOf(16)
     }
 
+    /** Device-unique key seed, generated once at module installation. */
     private val hbk: ByteArray by lazy {
         val file = java.io.File(ConfigurationManager.CONFIG_PATH, "hbk")
         if (file.exists() && file.length() == 32L) {
             file.readBytes()
         } else {
+            // Fallback: generate in-memory (won't persist across reboots)
             SystemLogger.warning("hbk not found, generating ephemeral HBK.")
             ByteArray(32).also { java.security.SecureRandom().nextBytes(it) }
         }
@@ -260,14 +277,20 @@ object AttestationBuilder {
                 DERTaggedObject(
                     true,
                     AttestationConstants.TAG_RSA_OAEP_MGF_DIGEST,
-                    DERSet(params.rsaOaepMgfDigest.map { ASN1Integer(it.toLong()) }.toTypedArray()),
+                    DERSet(
+                        params.rsaOaepMgfDigest.map { ASN1Integer(it.toLong()) }.toTypedArray()
+                    ),
                 )
             )
         }
 
         if (params.rollbackResistance == true && attestVersion >= 3) {
             list.add(
-                DERTaggedObject(true, AttestationConstants.TAG_ROLLBACK_RESISTANCE, DERNull.INSTANCE)
+                DERTaggedObject(
+                    true,
+                    AttestationConstants.TAG_ROLLBACK_RESISTANCE,
+                    DERNull.INSTANCE,
+                )
             )
         }
 
@@ -285,19 +308,31 @@ object AttestationBuilder {
 
         if (params.allowWhileOnBody == true) {
             list.add(
-                DERTaggedObject(true, AttestationConstants.TAG_ALLOW_WHILE_ON_BODY, DERNull.INSTANCE)
+                DERTaggedObject(
+                    true,
+                    AttestationConstants.TAG_ALLOW_WHILE_ON_BODY,
+                    DERNull.INSTANCE,
+                )
             )
         }
 
         if (params.trustedUserPresenceRequired == true && attestVersion >= 3) {
             list.add(
-                DERTaggedObject(true, AttestationConstants.TAG_TRUSTED_USER_PRESENCE_REQUIRED, DERNull.INSTANCE)
+                DERTaggedObject(
+                    true,
+                    AttestationConstants.TAG_TRUSTED_USER_PRESENCE_REQUIRED,
+                    DERNull.INSTANCE,
+                )
             )
         }
 
         if (params.trustedConfirmationRequired == true && attestVersion >= 3) {
             list.add(
-                DERTaggedObject(true, AttestationConstants.TAG_TRUSTED_CONFIRMATION_REQUIRED, DERNull.INSTANCE)
+                DERTaggedObject(
+                    true,
+                    AttestationConstants.TAG_TRUSTED_CONFIRMATION_REQUIRED,
+                    DERNull.INSTANCE,
+                )
             )
         }
 
@@ -427,6 +462,7 @@ object AttestationBuilder {
             )
         )
 
+        // ATTESTATION_APPLICATION_ID is only included when an attestation challenge is present.
         if (params.attestationChallenge != null) {
             list.add(
                 DERTaggedObject(
@@ -436,7 +472,6 @@ object AttestationBuilder {
                 )
             )
         }
-
         if (AndroidDeviceUtils.getAttestVersion(securityLevel) >= 400) {
             list.add(
                 DERTaggedObject(
@@ -447,11 +482,8 @@ object AttestationBuilder {
             )
         }
 
-        if (params.callerNonce == true) {
-            list.add(
-                DERTaggedObject(true, AttestationConstants.TAG_CALLER_NONCE, DERNull.INSTANCE)
-            )
-        }
+        // Keystore2-enforced tags belong in softwareEnforced, not teeEnforced.
+        // The HAL does not enforce these; keystore2's authorize_create handles them.
         params.activeDateTime?.let {
             list.add(
                 DERTaggedObject(true, AttestationConstants.TAG_ACTIVE_DATETIME, ASN1Integer(it.time))
@@ -459,22 +491,43 @@ object AttestationBuilder {
         }
         params.originationExpireDateTime?.let {
             list.add(
-                DERTaggedObject(true, AttestationConstants.TAG_ORIGINATION_EXPIRE_DATETIME, ASN1Integer(it.time))
+                DERTaggedObject(
+                    true,
+                    AttestationConstants.TAG_ORIGINATION_EXPIRE_DATETIME,
+                    ASN1Integer(it.time),
+                )
             )
         }
         params.usageExpireDateTime?.let {
             list.add(
-                DERTaggedObject(true, AttestationConstants.TAG_USAGE_EXPIRE_DATETIME, ASN1Integer(it.time))
+                DERTaggedObject(
+                    true,
+                    AttestationConstants.TAG_USAGE_EXPIRE_DATETIME,
+                    ASN1Integer(it.time),
+                )
             )
         }
         params.usageCountLimit?.let {
             list.add(
-                DERTaggedObject(true, AttestationConstants.TAG_USAGE_COUNT_LIMIT, ASN1Integer(it.toLong()))
+                DERTaggedObject(
+                    true,
+                    AttestationConstants.TAG_USAGE_COUNT_LIMIT,
+                    ASN1Integer(it.toLong()),
+                )
+            )
+        }
+        if (params.callerNonce == true) {
+            list.add(
+                DERTaggedObject(true, AttestationConstants.TAG_CALLER_NONCE, DERNull.INSTANCE)
             )
         }
         if (params.unlockedDeviceRequired == true) {
             list.add(
-                DERTaggedObject(true, AttestationConstants.TAG_UNLOCKED_DEVICE_REQUIRED, DERNull.INSTANCE)
+                DERTaggedObject(
+                    true,
+                    AttestationConstants.TAG_UNLOCKED_DEVICE_REQUIRED,
+                    DERNull.INSTANCE,
+                )
             )
         }
 
@@ -506,9 +559,15 @@ object AttestationBuilder {
      */
     @Throws(Throwable::class)
     internal fun createApplicationId(uid: Int): DEROctetString {
+        // AOSP keystore_attestation_id.cpp: gather_attestation_application_id()
+        // uses a hardcoded identity for AID_SYSTEM (1000) and AID_ROOT (0):
+        //   packageName = "AndroidSystem", versionCode = 1, no signing digests.
         val appUid = uid % 100000
         if (appUid == 0 || appUid == 1000) {
-            return buildApplicationIdDer(listOf("AndroidSystem" to 1L), emptySet())
+            return buildApplicationIdDer(
+                listOf("AndroidSystem" to 1L),
+                emptySet(),
+            )
         }
 
         val pm =

app/src/main/java/org/matrix/TEESimulator/attestation/AttestationConstants.kt

@@ -95,5 +95,5 @@ object AttestationConstants {
 
     // --- Other Constants ---
     // https://cs.android.com/android/platform/superproject/main/+/main:system/keymaster/km_openssl/attestation_record.cpp
-    const val CHALLENGE_LENGTH_LIMIT = 128
+    const val CHALLENGE_LENGTH_LIMIT = 128 // kMaximumAttestationChallengeLength
 }

app/src/main/java/org/matrix/TEESimulator/attestation/DeviceAttestationService.kt

@@ -1,13 +1,8 @@
 package org.matrix.TEESimulator.attestation
 
 import android.annotation.SuppressLint
-import android.security.keystore.KeyGenParameterSpec
-import android.security.keystore.KeyProperties
-import java.security.KeyPairGenerator
 import java.security.KeyStore
-import java.security.SecureRandom
 import java.security.cert.X509Certificate
-import java.security.spec.ECGenParameterSpec
 import org.bouncycastle.asn1.ASN1Integer
 import org.bouncycastle.asn1.ASN1ObjectIdentifier
 import org.bouncycastle.asn1.ASN1OctetString
@@ -57,55 +52,14 @@ object DeviceAttestationService {
         val bootPatchLevel: Int?,
     )
 
-    // A unique alias for the key used to perform the TEE functionality check.
     private const val TEE_CHECK_KEY_ALIAS = "TEESimulator_AttestationCheck"
 
-    /**
-     * Lazily determines if the device's TEE is functional by attempting to generate an
-     * attestation-backed key pair. The result is cached.
-     */
-    val isTeeFunctional: Boolean by lazy { checkTeeFunctionality() }
-
     /**
      * Lazily fetches and parses attestation data from a genuinely generated certificate. The result
      * is cached. Returns null if the TEE is not functional or parsing fails.
      */
     val CachedAttestationData: AttestationData? by lazy { fetchAttestationData() }
 
-    /**
-     * Checks if the TEE is working correctly by generating a key in the Android Keystore with an
-     * attestation challenge.
-     *
-     * @return `true` if a key with attestation was generated successfully, `false` otherwise.
-     */
-    private fun checkTeeFunctionality(): Boolean {
-        SystemLogger.info("Performing TEE functionality check...")
-        return try {
-            val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
-            val keyPairGenerator =
-                KeyPairGenerator.getInstance(KeyProperties.KEY_ALGORITHM_EC, "AndroidKeyStore")
-
-            // A random challenge is required for attestation.
-            val challenge = ByteArray(16).apply { SecureRandom().nextBytes(this) }
-
-            val spec =
-                KeyGenParameterSpec.Builder(TEE_CHECK_KEY_ALIAS, KeyProperties.PURPOSE_SIGN)
-                    .setAlgorithmParameterSpec(ECGenParameterSpec("secp256r1"))
-                    .setDigests(KeyProperties.DIGEST_SHA256)
-                    .setAttestationChallenge(challenge)
-                    .build()
-
-            keyPairGenerator.initialize(spec)
-            keyPairGenerator.generateKeyPair()
-
-            SystemLogger.info("TEE functionality check successful.")
-            true
-        } catch (e: Exception) {
-            SystemLogger.warning("TEE functionality check failed.", e)
-            false
-        }
-    }
-
     /**
      * Retrieves the attestation certificate generated during the TEE check. The key entry is
      * deleted after retrieval to clean up.
@@ -113,8 +67,6 @@ object DeviceAttestationService {
      * @return The leaf `X509Certificate` containing the attestation, or `null` if unavailable.
      */
     private fun getAttestationCertificate(): X509Certificate? {
-        if (!isTeeFunctional) return null
-
         return try {
             val keyStore = KeyStore.getInstance("AndroidKeyStore").apply { load(null) }
             val certChain = keyStore.getCertificateChain(TEE_CHECK_KEY_ALIAS)

app/src/main/java/org/matrix/TEESimulator/attestation/KeyMintAttestation.kt

@@ -1,7 +1,6 @@
 package org.matrix.TEESimulator.attestation
 
 import android.hardware.security.keymint.*
-import android.hardware.security.keymint.KeyOrigin
 import java.math.BigInteger
 import java.util.Date
 import javax.security.auth.x500.X500Principal
@@ -17,11 +16,12 @@ import org.matrix.TEESimulator.logging.KeyMintParameterLogger
 // Reference:
 // https://cs.android.com/android/platform/superproject/main/+/main:system/security/keystore2/src/key_parameter.rs
 data class KeyMintAttestation(
-    val keySize: Int,
     val algorithm: Int,
     val ecCurve: Int?,
     val ecCurveName: String,
+    val keySize: Int,
     val origin: Int?,
+    val noAuthRequired: Boolean?,
     val blockMode: List<Int>,
     val padding: List<Int>,
     val purpose: List<Int>,
@@ -41,6 +41,7 @@ data class KeyMintAttestation(
     val manufacturer: ByteArray?,
     val model: ByteArray?,
     val secondImei: ByteArray?,
+    // Enforcement tags
     val activeDateTime: Date?,
     val originationExpireDateTime: Date?,
     val usageExpireDateTime: Date?,
@@ -53,7 +54,6 @@ data class KeyMintAttestation(
     val allowWhileOnBody: Boolean?,
     val trustedUserPresenceRequired: Boolean?,
     val trustedConfirmationRequired: Boolean?,
-    val noAuthRequired: Boolean?,
     val maxUsesPerBoot: Int?,
     val maxBootLevel: Int?,
     val minMacLength: Int?,
@@ -63,11 +63,13 @@ data class KeyMintAttestation(
     constructor(
         params: Array<KeyParameter>
     ) : this(
-        keySize = params.findInteger(Tag.KEY_SIZE) ?: params.deriveKeySizeFromCurve(),
-
         // AOSP: [key_param(tag = ALGORITHM, field = Algorithm)]
         algorithm = params.findAlgorithm(Tag.ALGORITHM) ?: 0,
 
+        // AOSP: [key_param(tag = KEY_SIZE, field = Integer)]
+        // For EC keys, derive keySize from EC_CURVE when KEY_SIZE is absent.
+        keySize = params.findInteger(Tag.KEY_SIZE) ?: params.deriveKeySizeFromCurve(),
+
         // AOSP: [key_param(tag = EC_CURVE, field = EcCurve)]
         ecCurve = params.findEcCurve(Tag.EC_CURVE),
         ecCurveName = params.deriveEcCurveName(),
@@ -75,6 +77,9 @@ data class KeyMintAttestation(
         // AOSP: [key_param(tag = ORIGIN, field = Origin)]
         origin = params.findOrigin(Tag.ORIGIN),
 
+        // AOSP: [key_param(tag = NO_AUTH_REQUIRED, field = BoolValue)]
+        noAuthRequired = params.findBoolean(Tag.NO_AUTH_REQUIRED),
+
         // AOSP: [key_param(tag = BLOCK_MODE, field = BlockMode)]
         blockMode = params.findAllBlockMode(Tag.BLOCK_MODE),
 
@@ -116,6 +121,8 @@ data class KeyMintAttestation(
         manufacturer = params.findBlob(Tag.ATTESTATION_ID_MANUFACTURER),
         model = params.findBlob(Tag.ATTESTATION_ID_MODEL),
         secondImei = params.findBlob(Tag.ATTESTATION_ID_SECOND_IMEI),
+
+        // Enforcement tags
         activeDateTime = params.findDate(Tag.ACTIVE_DATETIME),
         originationExpireDateTime = params.findDate(Tag.ORIGINATION_EXPIRE_DATETIME),
         usageExpireDateTime = params.findDate(Tag.USAGE_EXPIRE_DATETIME),
@@ -128,7 +135,6 @@ data class KeyMintAttestation(
         allowWhileOnBody = params.findBoolean(Tag.ALLOW_WHILE_ON_BODY),
         trustedUserPresenceRequired = params.findBoolean(Tag.TRUSTED_USER_PRESENCE_REQUIRED),
         trustedConfirmationRequired = params.findBoolean(Tag.TRUSTED_CONFIRMATION_REQUIRED),
-        noAuthRequired = params.findBoolean(Tag.NO_AUTH_REQUIRED),
         maxUsesPerBoot = params.findInteger(Tag.MAX_USES_PER_BOOT),
         maxBootLevel = params.findInteger(Tag.MAX_BOOT_LEVEL),
         minMacLength = params.findInteger(Tag.MIN_MAC_LENGTH),
@@ -138,13 +144,21 @@ data class KeyMintAttestation(
         params.forEach { KeyMintParameterLogger.logParameter(it) }
     }
 
-    fun isAttestKey(): Boolean = purpose.size == 1 && purpose.contains(KeyPurpose.ATTEST_KEY)
+    fun isAttestKey(): Boolean {
+        return purpose.size == 1 && purpose.contains(KeyPurpose.ATTEST_KEY)
+    }
 
-    fun isImportKey(): Boolean = origin == KeyOrigin.IMPORTED || origin == KeyOrigin.SECURELY_IMPORTED
+    fun isImportKey(): Boolean {
+        return origin == KeyOrigin.IMPORTED || origin == KeyOrigin.SECURELY_IMPORTED
+    }
 }
 
 // --- Private helper extension functions for parsing KeyParameter arrays ---
 
+/** Maps to AOSP field = Integer */
+private fun Array<KeyParameter>.findBoolean(tag: Int): Boolean? =
+    if (this.any { it.tag == tag }) true else null
+
 /** Maps to AOSP field = Integer */
 private fun Array<KeyParameter>.findInteger(tag: Int): Int? =
     this.find { it.tag == tag }?.value?.integer
@@ -177,7 +191,7 @@ private fun Array<KeyParameter>.findBlob(tag: Int): ByteArray? =
 private fun Array<KeyParameter>.findAllBlockMode(tag: Int): List<Int> =
     this.filter { it.tag == tag }.map { it.value.blockMode }
 
-/** Maps to AOSP field = BlockMode (Repeated) */
+/** Maps to AOSP field = PaddingMode (Repeated) */
 private fun Array<KeyParameter>.findAllPaddingMode(tag: Int): List<Int> =
     this.filter { it.tag == tag }.map { it.value.paddingMode }
 
@@ -189,9 +203,7 @@ private fun Array<KeyParameter>.findAllKeyPurpose(tag: Int): List<Int> =
 private fun Array<KeyParameter>.findAllDigests(tag: Int): List<Int> =
     this.filter { it.tag == tag }.map { it.value.digest }
 
-private fun Array<KeyParameter>.findBoolean(tag: Int): Boolean? =
-    if (this.any { it.tag == tag }) true else null
-
+/** Derives keySize from EC_CURVE tag when KEY_SIZE is not explicitly provided. */
 private fun Array<KeyParameter>.deriveKeySizeFromCurve(): Int {
     val curveId = this.find { it.tag == Tag.EC_CURVE }?.value?.ecCurve ?: return 0
     return when (curveId) {

app/src/main/java/org/matrix/TEESimulator/config/ConfigurationManager.kt

@@ -65,6 +65,7 @@ object ConfigurationManager {
         // Initial load of all configuration files.
         loadTargetPackages(File(configRoot, TARGET_PACKAGES_FILE))
         loadPatchLevelConfig(File(configRoot, PATCH_LEVEL_FILE))
+
         // Start watching for any subsequent file changes.
         ConfigObserver.startWatching()
         SystemLogger.info("Configuration initialized and file observer started.")
@@ -82,6 +83,7 @@ object ConfigurationManager {
         return packages.firstNotNullOfOrNull { pkg -> packageKeyboxes[pkg] } ?: DEFAULT_KEYBOX_FILE
     }
 
+    /** Determines if the certificate for a given UID needs to be patched. */
     fun shouldPatch(uid: Int): Boolean {
         val mode = getPackageModeForUid(uid)
         return mode == Mode.PATCH || mode == Mode.AUTO
@@ -90,10 +92,13 @@ object ConfigurationManager {
     /** Determines if a new certificate needs to be generated for a given UID. */
     fun shouldGenerate(uid: Int): Boolean = getPackageModeForUid(uid) == Mode.GENERATE
 
+    /** Determines if no operation is needed for a given UID. */
     fun shouldSkipUid(uid: Int): Boolean = getPackageModeForUid(uid) == null
 
+    /** Determines if the UID is in AUTO mode (no explicit ! or ? suffix). */
     fun isAutoMode(uid: Int): Boolean = getPackageModeForUid(uid) == Mode.AUTO
 
+    /** Resolves the operating mode for a given UID based on its packages and the TEE status. */
     private fun getPackageModeForUid(uid: Int): Mode? {
         val packages = getPackagesForUid(uid)
         if (packages.isEmpty()) return null
@@ -151,25 +156,25 @@ object ConfigurationManager {
                     return@forEach
                 }
 
+                val mode: Mode
+                val rawPkg: String
                 when {
-                    // Suffix '!' means force GENERATE mode.
                     trimmedLine.endsWith("!") -> {
-                        val pkg = trimmedLine.removeSuffix("!").trim()
-                        newModes[pkg] = Mode.GENERATE
-                        newKeyboxes[pkg] = currentKeybox
+                        mode = Mode.GENERATE
+                        rawPkg = trimmedLine.removeSuffix("!").trim()
                     }
-                    // Suffix '?' means force PATCH mode.
                     trimmedLine.endsWith("?") -> {
-                        val pkg = trimmedLine.removeSuffix("?").trim()
-                        newModes[pkg] = Mode.PATCH
-                        newKeyboxes[pkg] = currentKeybox
+                        mode = Mode.PATCH
+                        rawPkg = trimmedLine.removeSuffix("?").trim()
                     }
-                    // No suffix means AUTO mode.
                     else -> {
-                        newModes[trimmedLine] = Mode.AUTO
-                        newKeyboxes[trimmedLine] = currentKeybox
+                        mode = Mode.AUTO
+                        rawPkg = trimmedLine
                     }
                 }
+
+                newModes[rawPkg] = mode
+                newKeyboxes[rawPkg] = currentKeybox
             }
 
             // Atomically update the configuration maps.
@@ -245,16 +250,14 @@ object ConfigurationManager {
                 )
             }
 
-            // Parse global and per-package configurations.
             var newGlobalLevel = parseLines(contextLines[""])
-            // TrickyAddon writes Pixel bulletin dates for boot/vendor but system=prop
-            // resolves to the real device prop — force boot/vendor through the same path
-            // to prevent cross-component date mismatches on non-Pixel devices.
+            contextLines.remove("")
+
+            // system=prop means all components should derive from device props
             if (newGlobalLevel?.system.equals("prop", ignoreCase = true)) {
-                SystemLogger.info("system=prop: forcing boot/vendor to derive from device props (were: boot=${newGlobalLevel?.boot}, vendor=${newGlobalLevel?.vendor})")
+                SystemLogger.info("system=prop: forcing boot/vendor to derive from device props")
                 newGlobalLevel = newGlobalLevel?.copy(boot = "prop", vendor = "prop")
             }
-            contextLines.remove("") // Remove global context to iterate over packages next
 
             for ((pkg, lines) in contextLines) {
                 parseLines(lines)?.let { newPackageLevels[pkg] = it }
@@ -330,6 +333,8 @@ object ConfigurationManager {
         return iPackageManager
     }
 
+    /** Checks if any package belonging to the UID holds the given permission. */
+    /** Checks a SELinux permission for a caller identified by PID against the keystore context. */
     fun checkSELinuxPermission(callingPid: Int, tclass: String, perm: String): Boolean {
         return try {
             val callerCtx =
@@ -342,6 +347,7 @@ object ConfigurationManager {
         }
     }
 
+    /** Checks if any package belonging to the UID holds the given permission. */
     fun hasPermissionForUid(uid: Int, permission: String): Boolean {
         val userId = uid / 100000
         return getPackagesForUid(uid).any { pkg ->
@@ -353,6 +359,7 @@ object ConfigurationManager {
         }
     }
 
+    /** Retrieves the package names associated with a UID. */
     fun getPackagesForUid(uid: Int): Array<String> {
         return uidToPackagesCache.getOrPut(uid) {
             try {

app/src/main/java/org/matrix/TEESimulator/interception/core/BinderInterceptor.kt

@@ -293,6 +293,12 @@ abstract class BinderInterceptor : Binder() {
             }
         }
 
+        /**
+         * Uses the backdoor binder to register an interceptor for a specific target service.
+         *
+         * @param filteredCodes If non-empty, only these transaction codes will be intercepted at
+         *   the native level. All other codes pass through without the round-trip to Java.
+         */
         fun register(
             backdoor: IBinder,
             target: IBinder,

app/src/main/java/org/matrix/TEESimulator/interception/keystore/AbstractKeystoreInterceptor.kt

@@ -68,8 +68,13 @@ abstract class AbstractKeystoreInterceptor : BinderInterceptor() {
         }
     }
 
+    /**
+     * Transaction codes this interceptor needs to handle at the native level. Override in
+     * subclasses to filter; empty means intercept everything (legacy behavior).
+     */
     protected open val interceptedCodes: IntArray = intArrayOf()
 
+    /** Registers this interceptor with the native hook layer and sets up a death recipient. */
     private fun setupInterceptor(service: IBinder, backdoor: IBinder) {
         keystoreService = service
         SystemLogger.info("Registering interceptor for service: $serviceName")

app/src/main/java/org/matrix/TEESimulator/interception/keystore/InterceptorUtils.kt

@@ -23,7 +23,7 @@ object InterceptorUtils {
         val parcel = Parcel.obtain().apply {
             writeInt(EX_SERVICE_SPECIFIC)
             writeString(null)
-            writeInt(0) // empty remote stack trace header (AOSP Status.cpp:196)
+            writeInt(0)
             writeInt(errorCode)
         }
         return BinderInterceptor.TransactionResult.OverrideReply(parcel)
@@ -130,6 +130,10 @@ object InterceptorUtils {
         return exception != null
     }
 
+    /**
+     * Creates an `OverrideReply` that writes a `ServiceSpecificException` with the given error
+     * code via EX_SERVICE_SPECIFIC.
+     */
     fun createServiceSpecificErrorReply(
         errorCode: Int
     ): BinderInterceptor.TransactionResult.OverrideReply {
@@ -140,6 +144,14 @@ object InterceptorUtils {
         return BinderInterceptor.TransactionResult.OverrideReply(parcel)
     }
 
+    /**
+     * Patches the system-level authorization values (OS_PATCHLEVEL, VENDOR_PATCHLEVEL,
+     * BOOT_PATCHLEVEL) in an authorization array to match the configured patch levels for the
+     * given calling UID. Each authorization's original [Authorization.securityLevel] is preserved.
+     *
+     * When a patch level is configured as "no" ([AndroidDeviceUtils.DO_NOT_REPORT]), the original
+     * hardware value is kept as-is.
+     */
     fun patchAuthorizations(
         authorizations: Array<Authorization>?,
         callingUid: Int,

app/src/main/java/org/matrix/TEESimulator/interception/keystore/Keystore2Interceptor.kt

@@ -6,16 +6,17 @@ import android.os.Build
 import android.os.IBinder
 import android.os.Parcel
 import android.system.keystore2.Domain
+import android.system.keystore2.IKeystoreSecurityLevel
 import android.system.keystore2.IKeystoreService
 import android.system.keystore2.KeyDescriptor
 import android.system.keystore2.KeyEntryResponse
 import java.security.SecureRandom
 import java.security.cert.Certificate
+import java.util.Collections
 import java.util.concurrent.ConcurrentHashMap
 import org.matrix.TEESimulator.attestation.AttestationPatcher
 import org.matrix.TEESimulator.attestation.KeyMintAttestation
 import org.matrix.TEESimulator.config.ConfigurationManager
-import org.matrix.TEESimulator.interception.keystore.shim.GeneratedKeyPersistence
 import org.matrix.TEESimulator.interception.keystore.shim.KeyMintSecurityLevelInterceptor
 import org.matrix.TEESimulator.logging.KeyMintParameterLogger
 import org.matrix.TEESimulator.logging.SystemLogger
@@ -48,6 +49,8 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
         else null
     private val GET_NUMBER_OF_ENTRIES_TRANSACTION =
         InterceptorUtils.getTransactCode(stubBinderClass, "getNumberOfEntries")
+    private val GET_SECURITY_LEVEL_TRANSACTION =
+        InterceptorUtils.getTransactCode(stubBinderClass, "getSecurityLevel")
 
     private val transactionNames: Map<Int, String> by lazy {
         stubBinderClass.declaredFields
@@ -58,9 +61,19 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
             .associate { field -> (field.get(null) as Int) to field.name.split("_")[1] }
     }
 
-    private const val RESPONSE_KEY_NOT_FOUND = 7
-    private val deletedSoftwareKeys: MutableSet<KeyIdentifier> = ConcurrentHashMap.newKeySet()
     private val userUpdatedKeys = ConcurrentHashMap.newKeySet<KeyIdentifier>()
+    private val deletedSoftwareKeys = ConcurrentHashMap.newKeySet<KeyIdentifier>()
+
+    // Backdoor binder for registering new interceptors at runtime.
+    private var backdoorBinder: IBinder? = null
+
+    // Per-security-level interceptor instances, keyed by SecurityLevel constant.
+    private val securityLevelInterceptors = ConcurrentHashMap<Int, KeyMintSecurityLevelInterceptor>()
+
+    // Identity set of SecurityLevel binders already registered with the native hook,
+    // tracked by System.identityHashCode to avoid re-registering the same BBinder.
+    private val registeredSecurityLevelBinders: MutableSet<Int> =
+        Collections.newSetFromMap(ConcurrentHashMap())
 
     override val serviceName = "android.system.keystore2.IKeystoreService/default"
     override val processName = "keystore2"
@@ -74,6 +87,7 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                 LIST_ENTRIES_TRANSACTION,
                 LIST_ENTRIES_BATCHED_TRANSACTION,
                 GET_NUMBER_OF_ENTRIES_TRANSACTION,
+                GET_SECURITY_LEVEL_TRANSACTION,
             )
             .toIntArray()
     }
@@ -83,6 +97,7 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
      * security level sub-services (e.g., TEE, StrongBox).
      */
     override fun onInterceptorReady(service: IBinder, backdoor: IBinder) {
+        backdoorBinder = backdoor
         val keystoreInterface = IKeystoreService.Stub.asInterface(service)
         setupSecurityLevelInterceptors(keystoreInterface, backdoor)
     }
@@ -94,11 +109,11 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                     SystemLogger.info("Found TEE SecurityLevel. Registering interceptor...")
                     val interceptor =
                         KeyMintSecurityLevelInterceptor(tee, SecurityLevel.TRUSTED_ENVIRONMENT)
-                    register(
+                    securityLevelInterceptors[SecurityLevel.TRUSTED_ENVIRONMENT] = interceptor
+                    registerSecurityLevelBinder(
                         backdoor,
                         tee.asBinder(),
                         interceptor,
-                        KeyMintSecurityLevelInterceptor.INTERCEPTED_CODES,
                     )
                     interceptor.loadPersistedKeys()
                 }
@@ -111,11 +126,11 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                     SystemLogger.info("Found StrongBox SecurityLevel. Registering interceptor...")
                     val interceptor =
                         KeyMintSecurityLevelInterceptor(strongbox, SecurityLevel.STRONGBOX)
-                    register(
+                    securityLevelInterceptors[SecurityLevel.STRONGBOX] = interceptor
+                    registerSecurityLevelBinder(
                         backdoor,
                         strongbox.asBinder(),
                         interceptor,
-                        KeyMintSecurityLevelInterceptor.INTERCEPTED_CODES,
                     )
                     interceptor.loadPersistedKeys()
                 }
@@ -123,6 +138,30 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
             .onFailure { SystemLogger.error("Failed to intercept StrongBox SecurityLevel.", it) }
     }
 
+    /**
+     * Registers an interceptor for a SecurityLevel binder, tracking the binder identity
+     * to avoid duplicate registrations when keystore2 returns the same BBinder.
+     */
+    private fun registerSecurityLevelBinder(
+        backdoor: IBinder,
+        binder: IBinder,
+        interceptor: KeyMintSecurityLevelInterceptor,
+    ) {
+        val identity = System.identityHashCode(binder)
+        if (registeredSecurityLevelBinders.add(identity)) {
+            register(
+                backdoor,
+                binder,
+                interceptor,
+                KeyMintSecurityLevelInterceptor.INTERCEPTED_CODES,
+            )
+        } else {
+            SystemLogger.debug(
+                "SecurityLevel binder $binder (identity=$identity) already registered, skipping."
+            )
+        }
+    }
+
     override fun onPreTransact(
         txId: Long,
         target: IBinder,
@@ -145,23 +184,9 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
 
             if (isGMS || ConfigurationManager.shouldSkipUid(callingUid)) {
                 return TransactionResult.ContinueAndSkipPost
+            } else {
+                return TransactionResult.Continue
             }
-
-            return runCatching {
-                    val isBatchMode = code == LIST_ENTRIES_BATCHED_TRANSACTION
-                    if (ListEntriesHandler.cacheParameters(txId, data, isBatchMode)) {
-                        TransactionResult.Continue
-                    } else {
-                        TransactionResult.ContinueAndSkipPost
-                    }
-                }
-                .getOrElse {
-                    SystemLogger.error(
-                        "[TX_ID: $txId] Failed to parse parameters for ${transactionNames[code]!!}",
-                        it,
-                    )
-                    TransactionResult.ContinueAndSkipPost
-                }
         } else if (
             code == GET_KEY_ENTRY_TRANSACTION ||
                 code == DELETE_KEY_TRANSACTION ||
@@ -181,6 +206,7 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                     ?: return TransactionResult.ContinueAndSkipPost
 
             if (code == DELETE_KEY_TRANSACTION) {
+                // Handle delete by alias (APP domain) or nspace (KEY_ID domain).
                 val keyId =
                     if (descriptor.alias != null) {
                         KeyIdentifier(callingUid, descriptor.alias)
@@ -214,15 +240,14 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
             }
             val keyId = KeyIdentifier(callingUid, descriptor.alias)
 
-            val response = KeyMintSecurityLevelInterceptor.getGeneratedKeyResponse(keyId)
-            if (response == null) {
-                if (deletedSoftwareKeys.remove(keyId)) {
-                    SystemLogger.info("[TX_ID: $txId] Returning KEY_NOT_FOUND for deleted key ${descriptor.alias}")
-                    return InterceptorUtils.createErrorReply(RESPONSE_KEY_NOT_FOUND)
-                }
-                return TransactionResult.Continue
+            if (deletedSoftwareKeys.remove(keyId)) {
+                return InterceptorUtils.createErrorReply(7) // KEY_NOT_FOUND
             }
 
+            val response =
+                KeyMintSecurityLevelInterceptor.getGeneratedKeyResponse(keyId)
+                    ?: return TransactionResult.Continue
+
             if (KeyMintSecurityLevelInterceptor.isAttestationKey(keyId))
                 SystemLogger.info("${descriptor.alias} was an attestation key")
 
@@ -231,6 +256,13 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                 KeyMintParameterLogger.logParameter(it.keyParameter)
             }
             return InterceptorUtils.createTypedObjectReply(response)
+        } else if (code == GET_SECURITY_LEVEL_TRANSACTION) {
+            // Pass through to post-hook so we can register interceptors for newly-created
+            // SecurityLevel binders. keystore2 may create a new BBinder per call, so the
+            // initial registration in setupSecurityLevelInterceptors might not cover all
+            // binder instances that clients receive.
+            logTransaction(txId, "getSecurityLevel", callingUid, callingPid)
+            return TransactionResult.Continue
         } else {
             logTransaction(
                 txId,
@@ -259,6 +291,10 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
         if (target != keystoreService || reply == null || InterceptorUtils.hasException(reply))
             return TransactionResult.SkipTransaction
 
+        if (code == GET_SECURITY_LEVEL_TRANSACTION) {
+            return handlePostGetSecurityLevel(txId, data, reply)
+        }
+
         if (code == GET_NUMBER_OF_ENTRIES_TRANSACTION) {
             logTransaction(txId, "post-${transactionNames[code]!!}", callingUid, callingPid)
             return runCatching {
@@ -282,8 +318,12 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
             logTransaction(txId, "post-${transactionNames[code]!!}", callingUid, callingPid)
 
             return runCatching {
+                    val isBatchMode = code == LIST_ENTRIES_BATCHED_TRANSACTION
+                    val params =
+                        ListEntriesHandler.cacheParameters(txId, data, isBatchMode)
+                            ?: throw Exception("Abort updating entries for invalid parameters.")
                     val updatedKeyDescriptors =
-                        ListEntriesHandler.injectGeneratedKeys(txId, callingUid, reply)
+                        ListEntriesHandler.injectGeneratedKeys(txId, callingUid, params, reply)
                     InterceptorUtils.createTypedArrayReply(updatedKeyDescriptors)
                 }
                 .getOrElse {
@@ -313,6 +353,7 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                     val response = reply.readTypedObject(KeyEntryResponse.CREATOR)!!
                     val keyId = KeyIdentifier(callingUid, keyDescriptor.alias)
 
+                    // Skip patching for keys whose certs were explicitly set via updateSubcomponent.
                     if (userUpdatedKeys.remove(keyId)) {
                         SystemLogger.debug("[TX_ID: $txId] Skipping cert patch for user-updated key $keyId.")
                         return TransactionResult.SkipTransaction
@@ -324,26 +365,13 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                             authorizations?.map { it.keyParameter }?.toTypedArray() ?: emptyArray()
                         )
 
-                    if (parsedParameters.isImportKey()) {
-                        val retainedChain = KeyMintSecurityLevelInterceptor.getPatchedChain(keyId)
-                        if (retainedChain == null) {
-                            SystemLogger.info("[TX_ID: $txId] Skip patching for imported key (no prior attestation).")
-                            return TransactionResult.SkipTransaction
-                        }
-                        SystemLogger.info("[TX_ID: $txId] Imported key overwrote attested alias, serving retained chain for $keyId")
-                        CertificateHelper.updateCertificateChain(response.metadata, retainedChain).getOrThrow()
-                        return InterceptorUtils.createTypedObjectReply(response)
-                    }
-
-                    if (KeyMintSecurityLevelInterceptor.importedKeys.contains(keyId)) {
-                        SystemLogger.debug("[TX_ID: $txId] Skipping attest-key override for imported key $keyId")
-                        return TransactionResult.SkipTransaction
-                    }
-
-                    if (parsedParameters.isAttestKey()) {
+                    if (parsedParameters.isAttestKey() &&
+                        !KeyMintSecurityLevelInterceptor.importedKeys.contains(keyId)
+                    ) {
                         SystemLogger.warning(
                             "[TX_ID: $txId] Found hardware attest key ${keyId.alias} in the reply."
                         )
+                        // Attest keys that are not under our control should be overriden.
                         val keyData =
                             CertificateGenerator.generateAttestedKeyPair(
                                 callingUid,
@@ -364,37 +392,23 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                                 callingUid,
                             )
 
-                        val newNspace = SecureRandom().nextLong()
-                        response.metadata.key?.let { it.nspace = newNspace }
+                        val key = response.metadata.key!!
+                        key.nspace = SecureRandom().nextLong()
                         KeyMintSecurityLevelInterceptor.generatedKeys[keyId] =
                             KeyMintSecurityLevelInterceptor.GeneratedKeyInfo(
                                 keyData.first,
                                 null,
-                                newNspace,
+                                key.nspace,
                                 response,
                                 parsedParameters,
                             )
                         KeyMintSecurityLevelInterceptor.attestationKeys.add(keyId)
-
-                        GeneratedKeyPersistence.save(
-                            keyId = keyId,
-                            keyPair = keyData.first,
-                            nspace = newNspace,
-                            securityLevel = response.metadata.keySecurityLevel,
-                            certChain = keyData.second,
-                            algorithm = parsedParameters.algorithm,
-                            keySize = parsedParameters.keySize,
-                            ecCurve = parsedParameters.ecCurve ?: 0,
-                            purposes = parsedParameters.purpose,
-                            digests = parsedParameters.digest,
-                            isAttestationKey = true,
-                        )
-
                         return InterceptorUtils.createTypedObjectReply(response)
                     }
 
                     val originalChain = CertificateHelper.getCertificateChain(response)
 
+                    // Check if we should perform attestation patch.
                     if (originalChain == null || originalChain.size < 2) {
                         SystemLogger.info(
                             "[TX_ID: $txId] Skip patching short certificate chain of length ${originalChain?.size}."
@@ -402,6 +416,8 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                         return TransactionResult.SkipTransaction
                     }
 
+                    // First, try to retrieve the already-patched chain from our cache to ensure
+                    // consistency.
                     val cachedChain = KeyMintSecurityLevelInterceptor.getPatchedChain(keyId)
 
                     val finalChain: Array<Certificate>
@@ -411,12 +427,16 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
                         )
                         finalChain = cachedChain
                     } else {
+                        // If no chain is cached (e.g., key existed before simulator started),
+                        // perform a live patch as a fallback. This may still be detectable.
                         SystemLogger.info(
                             "[TX_ID: $txId] No cached chain for $keyId. Performing live patch as a fallback."
                         )
                         finalChain =
                             AttestationPatcher.patchCertificateChain(originalChain, callingUid)
+
                         KeyMintSecurityLevelInterceptor.patchedChains[keyId] = finalChain
+                        SystemLogger.debug("Cached patched certificate chain for $keyId.")
                     }
 
                     CertificateHelper.updateCertificateChain(response.metadata, finalChain)
@@ -445,11 +465,13 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
         val descriptor = data.readTypedObject(KeyDescriptor.CREATOR)
             ?: return TransactionResult.ContinueAndSkipPost
 
+        // Resolve by nspace (KEY_ID) or alias (APP), same as createOperation.
         val generatedKeyInfo =
             when (descriptor.domain) {
                 Domain.KEY_ID ->
                     KeyMintSecurityLevelInterceptor.findGeneratedKeyByKeyId(
-                        callingUid, descriptor.nspace
+                        callingUid,
+                        descriptor.nspace,
                     )
                 Domain.APP ->
                     descriptor.alias?.let {
@@ -459,6 +481,7 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
             }
 
         if (generatedKeyInfo == null) {
+            // Hardware key: mark so getKeyEntry skips cert re-patching.
             descriptor.alias?.let { userUpdatedKeys.add(KeyIdentifier(callingUid, it)) }
             return TransactionResult.ContinueAndSkipPost
         }
@@ -470,13 +493,73 @@ object Keystore2Interceptor : AbstractKeystoreInterceptor() {
 
         metadata.certificate = publicCert
         metadata.certificateChain = certificateChain
-
-        GeneratedKeyPersistence.rePersistIfNeeded(callingUid, generatedKeyInfo)
-
         SystemLogger.verbose(
             "Key updated with sizes: [publicCert, certificateChain] = [${publicCert?.size}, ${certificateChain?.size}]"
         )
 
         return InterceptorUtils.createSuccessReply(writeResultCode = false)
     }
+
+    /**
+     * Intercepts the reply from getSecurityLevel to dynamically register our interceptor
+     * for the returned IKeystoreSecurityLevel binder.
+     *
+     * keystore2 may create a new BBinder for each getSecurityLevel call, so the binder
+     * registered during initial setup (in setupSecurityLevelInterceptors) might not be the
+     * same one that client apps receive. By intercepting every getSecurityLevel reply, we
+     * ensure that all SecurityLevel binders are covered.
+     */
+    private fun handlePostGetSecurityLevel(
+        txId: Long,
+        data: Parcel,
+        reply: Parcel,
+    ): TransactionResult {
+        val backdoor = backdoorBinder
+        if (backdoor == null) {
+            SystemLogger.warning("[TX_ID: $txId] post-getSecurityLevel: backdoor not available")
+            return TransactionResult.SkipTransaction
+        }
+
+        return runCatching {
+            // Read the security level argument from the original request.
+            data.enforceInterface(IKeystoreService.DESCRIPTOR)
+            val requestedLevel = data.readInt()
+
+            // hasException already consumed the exception header from the reply.
+            // Next item is the IKeystoreSecurityLevel binder.
+            val secLevelBinder = reply.readStrongBinder()
+            if (secLevelBinder == null) {
+                SystemLogger.verbose(
+                    "[TX_ID: $txId] getSecurityLevel($requestedLevel) returned null binder"
+                )
+                return@runCatching TransactionResult.SkipTransaction
+            }
+
+            // Only intercept TEE and StrongBox security levels.
+            if (requestedLevel != SecurityLevel.TRUSTED_ENVIRONMENT &&
+                requestedLevel != SecurityLevel.STRONGBOX
+            ) {
+                return@runCatching TransactionResult.SkipTransaction
+            }
+
+            // Get or create the interceptor for this security level. The interceptor may not
+            // exist yet if the initial setupSecurityLevelInterceptors call failed for this level.
+            val interceptor = securityLevelInterceptors.getOrPut(requestedLevel) {
+                val secLevelInterface =
+                    IKeystoreSecurityLevel.Stub.asInterface(secLevelBinder)
+                SystemLogger.info(
+                    "[TX_ID: $txId] Late-creating interceptor for security level $requestedLevel"
+                )
+                KeyMintSecurityLevelInterceptor(secLevelInterface, requestedLevel).also {
+                    it.loadPersistedKeys()
+                }
+            }
+
+            registerSecurityLevelBinder(backdoor, secLevelBinder, interceptor)
+            TransactionResult.SkipTransaction
+        }.getOrElse {
+            SystemLogger.error("[TX_ID: $txId] Failed to process post-getSecurityLevel.", it)
+            TransactionResult.SkipTransaction
+        }
+    }
 }

app/src/main/java/org/matrix/TEESimulator/interception/keystore/KeystoreInterceptor.kt

@@ -399,17 +399,18 @@ private data class LegacyKeygenParameters(
 
     /**
      * Converts the legacy parameters into the modern [KeyMintAttestation] data structure, which is
-     * required by the refactored [AttestationBuilder] and [CertificateGenerator].
+     * required by [AttestationBuilder] and [CertificateGenerator].
      */
     fun toKeyMintAttestation(): KeyMintAttestation {
         // This conversion acts as a bridge, allowing our new generic components
         // to be used by the legacy interceptor.
         return KeyMintAttestation(
-            keySize = this.keySize,
             algorithm = this.algorithm,
-            ecCurve = 0,
+            ecCurve = 0, // Not explicitly available in legacy args, but not critical
             ecCurveName = this.ecCurveName ?: "",
-            origin = null,
+            keySize = this.keySize,
+            origin = null, // Not needed to build attestaion
+            noAuthRequired = null,
             blockMode = listOf<Int>(),
             padding = listOf<Int>(),
             purpose = this.purpose,
@@ -443,7 +444,6 @@ private data class LegacyKeygenParameters(
             allowWhileOnBody = null,
             trustedUserPresenceRequired = null,
             trustedConfirmationRequired = null,
-            noAuthRequired = null,
             maxUsesPerBoot = null,
             maxBootLevel = null,
             minMacLength = null,

app/src/main/java/org/matrix/TEESimulator/interception/keystore/ListEntriesHandler.kt

@@ -5,7 +5,6 @@ import android.system.keystore2.Domain
 import android.system.keystore2.IKeystoreService
 import android.system.keystore2.KeyDescriptor
 import java.util.TreeMap
-import java.util.concurrent.ConcurrentHashMap
 import org.matrix.TEESimulator.interception.keystore.shim.KeyMintSecurityLevelInterceptor
 import org.matrix.TEESimulator.logging.SystemLogger
 
@@ -22,15 +21,6 @@ object ListEntriesHandler {
     // Estimate for maximum size of a Binder response in bytes.
     private const val RESPONSE_SIZE_LIMIT = 358400
 
-    // Parameters of AOSP function `list_key_entries` in utils.rs.
-    private data class ListEntriesParams(
-        val domain: Int,
-        val namespace: Long,
-        val startPastAlias: String?,
-    )
-
-    private val pendingParams = ConcurrentHashMap<Long, ListEntriesParams>()
-
     // Based on AOSP function `estimate_safe_amount_to_return` in utils.rs.
     private fun estimateSafeAmountToReturn(
         keyDescriptors: Array<KeyDescriptor>,
@@ -60,7 +50,7 @@ object ListEntriesHandler {
     }
 
     // Parse and store parameters for later use (in post-transaction).
-    fun cacheParameters(txId: Long, data: Parcel, isBatchMode: Boolean): Boolean {
+    fun cacheParameters(txId: Long, data: Parcel, isBatchMode: Boolean): ListEntriesParams? {
         data.enforceInterface(IKeystoreService.DESCRIPTOR)
 
         val domain = data.readInt()
@@ -71,20 +61,21 @@ object ListEntriesHandler {
         // See AOSP function `get_key_descriptor_for_lookup` in service.rs.
         // Note that all generated keys belong to Domain::APP.
         if (domain == Domain.APP) {
-            pendingParams[txId] = ListEntriesParams(domain, namespace, startPastAlias)
-            SystemLogger.debug("[TX_ID: $txId] Cached ${pendingParams[txId]}.")
-            return true
+            val params = ListEntriesParams(domain, namespace, startPastAlias)
+            SystemLogger.debug("[TX_ID: $txId] Cached $params.")
+            return params
         }
 
-        return false
+        return null
     }
 
     // Merge software-backed keys with hardware-backed keys in the reply parcel.
-    fun injectGeneratedKeys(txId: Long, callingUid: Int, reply: Parcel): Array<KeyDescriptor> {
-        val params =
-            pendingParams.remove(txId)
-                ?: throw IllegalStateException("No params found for listing entries")
-
+    fun injectGeneratedKeys(
+        txId: Long,
+        callingUid: Int,
+        params: ListEntriesParams,
+        reply: Parcel,
+    ): Array<KeyDescriptor> {
         // By default we use the calling uid as namespace if domain is Domain::APP.
         // The namespace parameter is thus ignored for non-privileged applications.
         // See AOSP function `get_key_descriptor_for_lookup` in service.rs.
@@ -140,3 +131,6 @@ object ListEntriesHandler {
             }
     }
 }
+
+// Parameters of AOSP function `list_key_entries` in utils.rs.
+data class ListEntriesParams(val domain: Int, val namespace: Long, val startPastAlias: String?)

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/AuthorizeCreate.kt

@@ -1,76 +0,0 @@
-package org.matrix.TEESimulator.interception.keystore.shim
-
-import android.hardware.security.keymint.Algorithm
-import android.hardware.security.keymint.KeyPurpose
-import android.hardware.security.keymint.KeyParameter
-import android.hardware.security.keymint.Tag
-import org.matrix.TEESimulator.attestation.KeyMintAttestation
-
-object AuthorizeCreate {
-
-    fun check(
-        keyParams: KeyMintAttestation?,
-        opParams: KeyMintAttestation,
-        rawOpParams: Array<KeyParameter>? = null,
-    ): Int? {
-        if (keyParams == null) return null
-        val purpose = opParams.purpose.firstOrNull() ?: return null
-        // Algorithm-level rejection runs before purpose-list check (AOSP HAL behavior)
-        return checkAlgorithmPurpose(keyParams, purpose)
-            ?: checkPurpose(keyParams, purpose)
-            ?: checkTemporalValidity(keyParams, purpose)
-            ?: checkCallerNonce(keyParams, purpose, rawOpParams)
-    }
-
-    private fun checkAlgorithmPurpose(keyParams: KeyMintAttestation, purpose: Int): Int? {
-        val algo = keyParams.algorithm
-        if ((algo == Algorithm.EC || algo == Algorithm.RSA) &&
-            (purpose == KeyPurpose.VERIFY || purpose == KeyPurpose.ENCRYPT)
-        ) {
-            return KeystoreErrorCodes.unsupportedPurpose
-        }
-        if (algo == Algorithm.EC && purpose == KeyPurpose.DECRYPT)
-            return KeystoreErrorCodes.unsupportedPurpose
-        if (algo == Algorithm.RSA && purpose == KeyPurpose.AGREE_KEY)
-            return KeystoreErrorCodes.unsupportedPurpose
-        return null
-    }
-
-    private fun checkPurpose(keyParams: KeyMintAttestation, purpose: Int): Int? {
-        if (purpose == KeyPurpose.WRAP_KEY)
-            return KeystoreErrorCodes.incompatiblePurpose
-        if (purpose !in keyParams.purpose)
-            return KeystoreErrorCodes.incompatiblePurpose
-        return null
-    }
-
-    private fun checkTemporalValidity(keyParams: KeyMintAttestation, purpose: Int): Int? {
-        val now = System.currentTimeMillis()
-
-        keyParams.activeDateTime?.let { activeDate ->
-            if (now < activeDate.time) return KeystoreErrorCodes.keyNotYetValid
-        }
-
-        keyParams.originationExpireDateTime?.let { expireDate ->
-            if (purpose == KeyPurpose.SIGN || purpose == KeyPurpose.ENCRYPT) {
-                if (now > expireDate.time) return KeystoreErrorCodes.keyExpired
-            }
-        }
-
-        keyParams.usageExpireDateTime?.let { expireDate ->
-            if (purpose == KeyPurpose.VERIFY || purpose == KeyPurpose.DECRYPT) {
-                if (now > expireDate.time) return KeystoreErrorCodes.keyExpired
-            }
-        }
-
-        return null
-    }
-
-    private fun checkCallerNonce(keyParams: KeyMintAttestation, purpose: Int, rawOpParams: Array<KeyParameter>?): Int? {
-        if (purpose != KeyPurpose.SIGN && purpose != KeyPurpose.ENCRYPT) return null
-        if (keyParams.callerNonce == true) return null
-        if (rawOpParams?.any { it.tag == Tag.NONCE } == true)
-            return KeystoreErrorCodes.callerNonceProhibited
-        return null
-    }
-}

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/GeneratedKeyPersistence.kt

@@ -16,7 +16,7 @@ import java.util.concurrent.locks.ReentrantLock
 import org.matrix.TEESimulator.config.ConfigurationManager.CONFIG_PATH
 import org.matrix.TEESimulator.interception.keystore.KeyIdentifier
 import org.matrix.TEESimulator.logging.SystemLogger
-import org.matrix.TEESimulator.pki.CertificateHelper
+
 
 data class PersistedKeyData(
     val uid: Int,
@@ -250,77 +250,6 @@ object GeneratedKeyPersistence {
         return result
     }
 
-    // Re-persist updates the cert chain for an already-persisted key without
-    // reconstructing authorization parameters from the response. This avoids
-    // pulling keymint Tag dependencies into this file and is correct because
-    // the only field that changes post-generation is the patched cert chain.
-    fun rePersistIfNeeded(
-        callingUid: Int,
-        generatedKeyInfo: KeyMintSecurityLevelInterceptor.GeneratedKeyInfo,
-    ) {
-        val metadata = generatedKeyInfo.response.metadata
-        if (metadata == null) {
-            SystemLogger.debug("rePersist: no metadata, skipping")
-            return
-        }
-        val secLevel = metadata.keySecurityLevel
-
-        val entry = KeyMintSecurityLevelInterceptor.generatedKeys.entries.find { (id, info) ->
-            id.uid == callingUid && info.nspace == generatedKeyInfo.nspace
-        }
-        if (entry == null) {
-            SystemLogger.debug("rePersist: key not found in map for uid=$callingUid nspace=${generatedKeyInfo.nspace}")
-            return
-        }
-
-        val keyId = entry.key
-        val filename = keyFileName(keyId.uid, keyId.alias)
-        val existing = File(PERSISTENCE_DIR, filename)
-
-        if (!existing.exists()) {
-            SystemLogger.debug("rePersist: no existing file for $keyId, skipping")
-            return
-        }
-
-        val newChain = CertificateHelper.getCertificateChain(metadata)
-        if (newChain == null) {
-            SystemLogger.warning("rePersist: could not extract cert chain for $keyId")
-            return
-        }
-
-        val persisted = runCatching {
-            DataInputStream(BufferedInputStream(FileInputStream(existing))).use { input ->
-                val version = input.readInt()
-                if (version != FORMAT_VERSION) {
-                    SystemLogger.warning("rePersist: unknown format version $version for $keyId")
-                    return
-                }
-                readPersistedKeyData(input)
-            }
-        }.getOrNull()
-        if (persisted == null) {
-            SystemLogger.warning("rePersist: failed to read existing data for $keyId")
-            return
-        }
-
-        val keyPair = generatedKeyInfo.keyPair ?: return
-        save(
-            keyId = keyId,
-            keyPair = keyPair,
-            nspace = generatedKeyInfo.nspace,
-            securityLevel = secLevel,
-            certChain = newChain.toList(),
-            algorithm = persisted.algorithm,
-            keySize = persisted.keySize,
-            ecCurve = persisted.ecCurve,
-            purposes = persisted.purposes,
-            digests = persisted.digests,
-            isAttestationKey = persisted.isAttestationKey,
-        )
-        SystemLogger.debug("Re-persisted key $keyId with updated cert chain")
-    }
-
-    // Corrupted binary files can have arbitrary length fields — cap allocations
     private fun requireBounds(value: Int, max: Int, name: String): Int {
         require(value in 0..max) { "$name out of bounds: $value (max $max)" }
         return value
@@ -331,49 +260,4 @@ object GeneratedKeyPersistence {
             .digest("$uid:$alias".toByteArray(Charsets.UTF_8))
         return digest.joinToString("") { "%02x".format(it) } + ".bin"
     }
-
-    // Reads all fields after version has already been consumed
-    private fun readPersistedKeyData(input: DataInputStream): PersistedKeyData {
-        val secLevel = input.readInt()
-        val uid = input.readInt()
-        val alias = input.readUTF()
-        val nspace = input.readLong()
-        val isAttestKey = input.readBoolean()
-        val algo = input.readInt()
-        val kSize = input.readInt()
-        val curve = input.readInt()
-
-        val purposeCount = requireBounds(input.readInt(), 64, "purposeCount")
-        val purposes = (0 until purposeCount).map { input.readInt() }
-
-        val digestCount = requireBounds(input.readInt(), 64, "digestCount")
-        val digests = (0 until digestCount).map { input.readInt() }
-
-        val pkLen = requireBounds(input.readInt(), 8192, "pkLen")
-        val pkBytes = ByteArray(pkLen)
-        input.readFully(pkBytes)
-
-        val certCount = requireBounds(input.readInt(), 10, "certCount")
-        val certChainBytes = (0 until certCount).map {
-            val certLen = requireBounds(input.readInt(), 65536, "certLen")
-            val certBytes = ByteArray(certLen)
-            input.readFully(certBytes)
-            certBytes
-        }
-
-        return PersistedKeyData(
-            uid = uid,
-            alias = alias,
-            nspace = nspace,
-            securityLevel = secLevel,
-            isAttestationKey = isAttestKey,
-            algorithm = algo,
-            keySize = kSize,
-            ecCurve = curve,
-            purposes = purposes,
-            digests = digests,
-            privateKeyBytes = pkBytes,
-            certChainBytes = certChainBytes,
-        )
-    }
 }

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/OperationInterceptor.kt

@@ -44,6 +44,7 @@ class OperationInterceptor(
         private val ABORT_TRANSACTION =
             InterceptorUtils.getTransactCode(IKeystoreOperation.Stub::class.java, "abort")
 
+        /** Only intercept finish/abort for cleanup. Other ops pass through without round-trip. */
         val INTERCEPTED_CODES = intArrayOf(FINISH_TRANSACTION, ABORT_TRANSACTION)
 
         private val transactionNames: Map<Int, String> by lazy {

app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/SoftwareOperation.kt

@@ -8,28 +8,62 @@ import android.hardware.security.keymint.KeyParameterValue
 import android.hardware.security.keymint.KeyPurpose
 import android.hardware.security.keymint.PaddingMode
 import android.hardware.security.keymint.Tag
+import android.os.RemoteException
 import android.os.ServiceSpecificException
-import java.util.concurrent.locks.LockSupport
 import android.system.keystore2.IKeystoreOperation
 import android.system.keystore2.KeyParameters
 import java.security.KeyPair
 import java.security.Signature
 import java.security.SignatureException
+import java.util.concurrent.locks.LockSupport
+import javax.crypto.BadPaddingException
 import javax.crypto.Cipher
+import javax.crypto.IllegalBlockSizeException
 import org.matrix.TEESimulator.attestation.KeyMintAttestation
 import org.matrix.TEESimulator.logging.KeyMintParameterLogger
 import org.matrix.TEESimulator.logging.SystemLogger
 
-private sealed interface CryptoPrimitive {
-    fun updateAad(aadInput: ByteArray?) {
-        throw ServiceSpecificException(KeystoreErrorCodes.invalidTag)
+internal object KeystoreErrorCode {
+    val INVALID_OPERATION_HANDLE: Int by lazy { resolve("ErrorCode", "INVALID_OPERATION_HANDLE", -28) }
+    val VERIFICATION_FAILED: Int by lazy { resolve("ErrorCode", "VERIFICATION_FAILED", -30) }
+    val UNSUPPORTED_PURPOSE: Int by lazy { resolve("ErrorCode", "UNSUPPORTED_PURPOSE", -2) }
+    val INCOMPATIBLE_PURPOSE: Int by lazy { resolve("ErrorCode", "INCOMPATIBLE_PURPOSE", -3) }
+    val INVALID_ARGUMENT: Int by lazy { resolve("ErrorCode", "INVALID_ARGUMENT", -38) }
+    val INVALID_TAG: Int by lazy { resolve("ErrorCode", "INVALID_TAG", -40) }
+    val INVALID_INPUT_LENGTH: Int by lazy { resolve("ErrorCode", "INVALID_INPUT_LENGTH", -21) }
+    val INCOMPATIBLE_KEY: Int by lazy { resolve("ErrorCode", "INCOMPATIBLE_KEY", -31) }
+    val INCOMPATIBLE_ALGORITHM: Int by lazy { resolve("ErrorCode", "INCOMPATIBLE_ALGORITHM", -18) }
+    val KEY_EXPIRED: Int by lazy { resolve("ErrorCode", "KEY_EXPIRED", -25) }
+    val KEY_NOT_YET_VALID: Int by lazy { resolve("ErrorCode", "KEY_NOT_YET_VALID", -24) }
+    val CALLER_NONCE_PROHIBITED: Int by lazy { resolve("ErrorCode", "CALLER_NONCE_PROHIBITED", -55) }
+    val UNKNOWN_ERROR: Int by lazy { resolve("ErrorCode", "UNKNOWN_ERROR", -1000) }
+    val SYSTEM_ERROR: Int by lazy { resolve("ResponseCode", "SYSTEM_ERROR", 4, keystore = true) }
+    val TOO_MUCH_DATA: Int by lazy { resolve("ResponseCode", "TOO_MUCH_DATA", 21, keystore = true) }
+    val PERMISSION_DENIED: Int by lazy { resolve("ResponseCode", "PERMISSION_DENIED", 6, keystore = true) }
+    val KEY_NOT_FOUND: Int by lazy { resolve("ResponseCode", "KEY_NOT_FOUND", 7, keystore = true) }
+
+    private fun resolve(enumName: String, field: String, fallback: Int, keystore: Boolean = false): Int {
+        val pkg = if (keystore) "android.system.keystore2" else "android.hardware.security.keymint"
+        return runCatching { Class.forName("$pkg.$enumName").getField(field).getInt(null) }
+            .getOrDefault(fallback)
     }
+}
+
+// A sealed interface to represent the different cryptographic operations we can perform.
+private sealed interface CryptoPrimitive {
+    fun updateAad(data: ByteArray?)
+
     fun update(data: ByteArray?): ByteArray?
+
     fun finish(data: ByteArray?, signature: ByteArray?): ByteArray?
+
     fun abort()
+
+    /** Returns parameters from the begin phase (e.g. GCM nonce), or null if none. */
     fun getBeginParameters(): Array<KeyParameter>? = null
 }
 
+// Helper object to map KeyMint constants to JCA algorithm strings.
 private object JcaAlgorithmMapper {
     fun mapSignatureAlgorithm(params: KeyMintAttestation): String {
         val digest =
@@ -39,18 +73,17 @@ private object JcaAlgorithmMapper {
                 Digest.SHA_2_512 -> "SHA512"
                 else -> "NONE"
             }
-        return when (params.algorithm) {
-            Algorithm.EC -> "${digest}withECDSA"
-            Algorithm.RSA -> {
-                val isPss = params.padding.firstOrNull() == PaddingMode.RSA_PSS
-                if (isPss) "${digest}withRSA/PSS" else "${digest}withRSA"
+        val keyAlgo =
+            when (params.algorithm) {
+                Algorithm.EC -> "ECDSA"
+                Algorithm.RSA -> "RSA"
+                else ->
+                    throw ServiceSpecificException(
+                        KeystoreErrorCode.SYSTEM_ERROR,
+                        "Unsupported signature algorithm: ${params.algorithm}",
+                    )
             }
-            else ->
-                throw ServiceSpecificException(
-                    KeystoreErrorCodes.incompatibleAlgorithm,
-                    "Unsupported signature algorithm: ${params.algorithm}",
-                )
-        }
+        return "${digest}with${keyAlgo}"
     }
 
     fun mapCipherAlgorithm(params: KeyMintAttestation): String {
@@ -60,7 +93,7 @@ private object JcaAlgorithmMapper {
                 Algorithm.AES -> "AES"
                 else ->
                     throw ServiceSpecificException(
-                        KeystoreErrorCodes.incompatibleAlgorithm,
+                        KeystoreErrorCode.SYSTEM_ERROR,
                         "Unsupported cipher algorithm: ${params.algorithm}",
                     )
             }
@@ -77,20 +110,24 @@ private object JcaAlgorithmMapper {
                 PaddingMode.NONE -> "NoPadding"
                 PaddingMode.PKCS7 -> "PKCS7Padding"
                 PaddingMode.RSA_PKCS1_1_5_ENCRYPT -> "PKCS1Padding"
-                PaddingMode.RSA_PKCS1_1_5_SIGN -> "PKCS1Padding"
                 PaddingMode.RSA_OAEP -> "OAEPPadding"
-                else -> "NoPadding"
+                else -> "NoPadding" // Default for GCM
             }
         return "$keyAlgo/$blockMode/$padding"
     }
 }
 
+// Concrete implementation for Signing.
 private class Signer(keyPair: KeyPair, params: KeyMintAttestation) : CryptoPrimitive {
     private val signature: Signature =
         Signature.getInstance(JcaAlgorithmMapper.mapSignatureAlgorithm(params)).apply {
             initSign(keyPair.private)
         }
 
+    override fun updateAad(data: ByteArray?) {
+        throw ServiceSpecificException(KeystoreErrorCode.INVALID_TAG)
+    }
+
     override fun update(data: ByteArray?): ByteArray? {
         if (data != null) signature.update(data)
         return null
@@ -104,12 +141,17 @@ private class Signer(keyPair: KeyPair, params: KeyMintAttestation) : CryptoPrimi
     override fun abort() {}
 }
 
+// Concrete implementation for Verification.
 private class Verifier(keyPair: KeyPair, params: KeyMintAttestation) : CryptoPrimitive {
     private val signature: Signature =
         Signature.getInstance(JcaAlgorithmMapper.mapSignatureAlgorithm(params)).apply {
             initVerify(keyPair.public)
         }
 
+    override fun updateAad(data: ByteArray?) {
+        throw ServiceSpecificException(KeystoreErrorCode.INVALID_TAG)
+    }
+
     override fun update(data: ByteArray?): ByteArray? {
         if (data != null) signature.update(data)
         return null
@@ -117,11 +159,16 @@ private class Verifier(keyPair: KeyPair, params: KeyMintAttestation) : CryptoPri
 
     override fun finish(data: ByteArray?, signature: ByteArray?): ByteArray? {
         if (data != null) update(data)
-        if (signature == null) {
-            throw ServiceSpecificException(KeystoreErrorCodes.verificationFailed, "Signature to verify is null")
-        }
+        if (signature == null)
+            throw ServiceSpecificException(
+                KeystoreErrorCode.VERIFICATION_FAILED,
+                "Signature to verify is null",
+            )
         if (!this.signature.verify(signature)) {
-            throw ServiceSpecificException(KeystoreErrorCodes.verificationFailed, "Signature verification failed")
+            throw ServiceSpecificException(
+                KeystoreErrorCode.VERIFICATION_FAILED,
+                "Signature/MAC verification failed",
+            )
         }
         return null
     }
@@ -129,20 +176,21 @@ private class Verifier(keyPair: KeyPair, params: KeyMintAttestation) : CryptoPri
     override fun abort() {}
 }
 
+// Concrete implementation for Encryption/Decryption.
 private class CipherPrimitive(
     cryptoKey: java.security.Key,
     params: KeyMintAttestation,
     private val opMode: Int,
 ) : CryptoPrimitive {
-    private val isAead = params.blockMode.firstOrNull() == BlockMode.GCM
     private val cipher: Cipher =
         Cipher.getInstance(JcaAlgorithmMapper.mapCipherAlgorithm(params)).apply {
             init(opMode, cryptoKey)
         }
+    private val isAead = params.blockMode.firstOrNull() == BlockMode.GCM
 
-    override fun updateAad(aadInput: ByteArray?) {
-        if (!isAead) throw ServiceSpecificException(KeystoreErrorCodes.invalidTag)
-        if (aadInput != null) cipher.updateAAD(aadInput)
+    override fun updateAad(data: ByteArray?) {
+        if (!isAead) throw ServiceSpecificException(KeystoreErrorCode.INVALID_TAG)
+        if (data != null) cipher.updateAAD(data)
     }
 
     override fun update(data: ByteArray?): ByteArray? =
@@ -151,6 +199,9 @@ private class CipherPrimitive(
     override fun finish(data: ByteArray?, signature: ByteArray?): ByteArray? =
         if (data != null) cipher.doFinal(data) else cipher.doFinal()
 
+    override fun abort() {}
+
+    /** Returns the cipher IV as a NONCE parameter for GCM operations. */
     override fun getBeginParameters(): Array<KeyParameter>? {
         val iv = cipher.iv ?: return null
         return arrayOf(
@@ -160,20 +211,23 @@ private class CipherPrimitive(
             }
         )
     }
-
-    override fun abort() {}
 }
 
+// Concrete implementation for ECDH Key Agreement.
 private class KeyAgreementPrimitive(keyPair: KeyPair) : CryptoPrimitive {
     private val agreement: javax.crypto.KeyAgreement =
         javax.crypto.KeyAgreement.getInstance("ECDH").apply { init(keyPair.private) }
 
+    override fun updateAad(data: ByteArray?) {
+        throw ServiceSpecificException(KeystoreErrorCode.INVALID_TAG)
+    }
+
     override fun update(data: ByteArray?): ByteArray? = null
 
     override fun finish(data: ByteArray?, signature: ByteArray?): ByteArray? {
         if (data == null)
             throw ServiceSpecificException(
-                KeystoreErrorCodes.invalidArgument,
+                KeystoreErrorCode.INVALID_ARGUMENT,
                 "Peer public key required for key agreement",
             )
         val peerKey =
@@ -186,26 +240,26 @@ private class KeyAgreementPrimitive(keyPair: KeyPair) : CryptoPrimitive {
     override fun abort() {}
 }
 
+/**
+ * A software-only implementation of a cryptographic operation. This class acts as a controller,
+ * delegating to a specific cryptographic primitive based on the operation's purpose.
+ *
+ * Tracks operation lifecycle: once [finish] or [abort] is called, subsequent calls throw
+ * [ServiceSpecificException] with [KeystoreErrorCode.INVALID_OPERATION_HANDLE].
+ */
 class SoftwareOperation(
     private val txId: Long,
     keyPair: KeyPair?,
     secretKey: javax.crypto.SecretKey?,
     params: KeyMintAttestation,
     private val latencyFloorMs: Long = 0L,
+    var onFinishCallback: (() -> Unit)? = null,
 ) {
     private val primitive: CryptoPrimitive
-    @Volatile var finalized = false
+
+    @Volatile var isFinalized = false
         private set
 
-    var onFinishCallback: (() -> Unit)? = null
-
-    val beginParameters: KeyParameters?
-        get() {
-            val params = primitive.getBeginParameters() ?: return null
-            if (params.isEmpty()) return null
-            return KeyParameters().apply { keyParameter = params }
-        }
-
     init {
         val purpose = params.purpose.firstOrNull()
         val purposeName = KeyMintParameterLogger.purposeNames[purpose] ?: "UNKNOWN"
@@ -226,42 +280,51 @@ class SoftwareOperation(
                 KeyPurpose.AGREE_KEY -> KeyAgreementPrimitive(keyPair!!)
                 else ->
                     throw ServiceSpecificException(
-                        KeystoreErrorCodes.unsupportedPurpose,
+                        KeystoreErrorCode.UNSUPPORTED_PURPOSE,
                         "Unsupported operation purpose: $purpose",
                     )
             }
     }
 
+    /** Parameters produced during begin (e.g. GCM nonce), to populate CreateOperationResponse. */
+    val beginParameters: KeyParameters?
+        get() {
+            val params = primitive.getBeginParameters() ?: return null
+            if (params.isEmpty()) return null
+            return KeyParameters().apply { keyParameter = params }
+        }
+
     private fun checkActive() {
-        if (finalized) {
-            SystemLogger.debug("[SoftwareOp TX_ID: $txId] Rejected: operation already finalized (pruned or completed)")
-            throw ServiceSpecificException(KeystoreErrorCodes.invalidOperationHandle)
-        }
+        if (isFinalized)
+            throw ServiceSpecificException(
+                KeystoreErrorCode.INVALID_OPERATION_HANDLE,
+                "Operation already finalized.",
+            )
     }
 
-    private fun checkInputLength(data: ByteArray?) {
-        if (data != null && data.size > MAX_RECEIVE_DATA) {
-            SystemLogger.info("[SoftwareOp TX_ID: $txId] Input too large: ${data.size} > $MAX_RECEIVE_DATA, throwing TOO_MUCH_DATA(${KeystoreErrorCodes.tooMuchData})")
-            throw ServiceSpecificException(KeystoreErrorCodes.tooMuchData)
-        }
-    }
-
-    fun updateAad(aadInput: ByteArray?) {
-        SystemLogger.debug("[SoftwareOp TX_ID: $txId] updateAad() inputSize=${aadInput?.size ?: 0}")
+    fun updateAad(data: ByteArray?) {
         checkActive()
-        checkInputLength(aadInput)
-        primitive.updateAad(aadInput)
+        try {
+            primitive.updateAad(data)
+        } catch (e: ServiceSpecificException) {
+            isFinalized = true
+            throw e
+        } catch (e: Exception) {
+            isFinalized = true
+            SystemLogger.error("[SoftwareOp TX_ID: $txId] Failed to updateAad.", e)
+            throw ServiceSpecificException(KeystoreErrorCode.SYSTEM_ERROR, e.message)
+        }
     }
 
     fun update(data: ByteArray?): ByteArray? {
-        SystemLogger.debug("[SoftwareOp TX_ID: $txId] update() inputSize=${data?.size ?: 0}")
         checkActive()
-        checkInputLength(data)
         try {
             return primitive.update(data)
         } catch (e: ServiceSpecificException) {
+            isFinalized = true
             throw e
         } catch (e: Exception) {
+            isFinalized = true
             SystemLogger.error("[SoftwareOp TX_ID: $txId] Failed to update operation.", e)
             throw mapToServiceSpecificException(e)
         }
@@ -269,132 +332,84 @@ class SoftwareOperation(
 
     fun finish(data: ByteArray?, signature: ByteArray?): ByteArray? {
         checkActive()
-        checkInputLength(data)
+        val startNs = if (latencyFloorMs > 0) System.nanoTime() else 0L
         try {
-            val startNs = if (latencyFloorMs > 0) System.nanoTime() else 0L
             val result = primitive.finish(data, signature)
+            SystemLogger.info("[SoftwareOp TX_ID: $txId] Finished operation successfully.")
             if (latencyFloorMs > 0) {
                 val elapsedMs = (System.nanoTime() - startNs) / 1_000_000
                 val delayMs = latencyFloorMs - elapsedMs
                 if (delayMs > 0) LockSupport.parkNanos(delayMs * 1_000_000)
             }
-            finalized = true
             onFinishCallback?.invoke()
-            SystemLogger.info("[SoftwareOp TX_ID: $txId] Finished operation successfully.")
             return result
         } catch (e: ServiceSpecificException) {
             throw e
         } catch (e: Exception) {
             SystemLogger.error("[SoftwareOp TX_ID: $txId] Failed to finish operation.", e)
             throw mapToServiceSpecificException(e)
+        } finally {
+            isFinalized = true
         }
     }
 
+    private fun mapToServiceSpecificException(e: Exception): ServiceSpecificException = when (e) {
+        is ServiceSpecificException -> e
+        is SignatureException -> ServiceSpecificException(KeystoreErrorCode.VERIFICATION_FAILED, e.message)
+        is BadPaddingException -> ServiceSpecificException(KeystoreErrorCode.INVALID_ARGUMENT, e.message)
+        is IllegalBlockSizeException -> ServiceSpecificException(KeystoreErrorCode.INVALID_INPUT_LENGTH, e.message)
+        is java.security.InvalidKeyException -> ServiceSpecificException(KeystoreErrorCode.INCOMPATIBLE_KEY, e.message)
+        else -> ServiceSpecificException(KeystoreErrorCode.UNKNOWN_ERROR, e.message)
+    }
+
     fun abort() {
-        finalized = true
+        checkActive()
+        isFinalized = true
         primitive.abort()
         SystemLogger.debug("[SoftwareOp TX_ID: $txId] Operation aborted.")
     }
+}
 
-    private fun mapToServiceSpecificException(e: Exception): ServiceSpecificException = when (e) {
-        is SignatureException -> ServiceSpecificException(KeystoreErrorCodes.verificationFailed, e.message)
-        is javax.crypto.BadPaddingException -> ServiceSpecificException(KeystoreErrorCodes.invalidArgument, e.message)
-        is javax.crypto.IllegalBlockSizeException -> ServiceSpecificException(KeystoreErrorCodes.invalidInputLength, e.message)
-        is java.security.InvalidKeyException -> ServiceSpecificException(KeystoreErrorCodes.incompatibleKey, e.message)
-        else -> ServiceSpecificException(KeystoreErrorCodes.unknownError, e.message)
+/** Binder interface for [SoftwareOperation]. Synchronized and input-length validated. */
+class SoftwareOperationBinder(private val operation: SoftwareOperation) :
+    IKeystoreOperation.Stub() {
+
+    private fun checkInputLength(data: ByteArray?) {
+        if (data != null && data.size > MAX_RECEIVE_DATA)
+            throw ServiceSpecificException(KeystoreErrorCode.TOO_MUCH_DATA)
+    }
+
+    @Throws(RemoteException::class)
+    override fun updateAad(aadInput: ByteArray?) {
+        synchronized(this) {
+            checkInputLength(aadInput)
+            operation.updateAad(aadInput)
+        }
+    }
+
+    @Throws(RemoteException::class)
+    override fun update(input: ByteArray?): ByteArray? {
+        synchronized(this) {
+            checkInputLength(input)
+            return operation.update(input)
+        }
+    }
+
+    @Throws(RemoteException::class)
+    override fun finish(input: ByteArray?, signature: ByteArray?): ByteArray? {
+        synchronized(this) {
+            checkInputLength(input)
+            checkInputLength(signature)
+            return operation.finish(input, signature)
+        }
+    }
+
+    @Throws(RemoteException::class)
+    override fun abort() {
+        synchronized(this) { operation.abort() }
     }
 
     companion object {
         private const val MAX_RECEIVE_DATA = 0x8000
     }
 }
-
-internal object KeystoreErrorCodes {
-    val tooMuchData: Int by lazy {
-        resolveField("android.system.keystore2.ResponseCode", "TOO_MUCH_DATA", 21)
-    }
-
-    val invalidOperationHandle: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "INVALID_OPERATION_HANDLE", -28)
-    }
-
-    val invalidTag: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "INVALID_TAG", -76)
-    }
-
-    val verificationFailed: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "VERIFICATION_FAILED", -30)
-    }
-
-    val invalidArgument: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "INVALID_ARGUMENT", -38)
-    }
-
-    val invalidInputLength: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "INVALID_INPUT_LENGTH", -21)
-    }
-
-    val incompatibleKey: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "INCOMPATIBLE_KEY", -31)
-    }
-
-    val incompatiblePurpose: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "INCOMPATIBLE_PURPOSE", -13)
-    }
-
-    val unsupportedPurpose: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "UNSUPPORTED_PURPOSE", -14)
-    }
-
-    val incompatibleAlgorithm: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "INCOMPATIBLE_ALGORITHM", -18)
-    }
-
-    val keyNotYetValid: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "KEY_NOT_YET_VALID", -39)
-    }
-
-    val keyExpired: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "KEY_EXPIRED", -40)
-    }
-
-    val callerNonceProhibited: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "CALLER_NONCE_PROHIBITED", -55)
-    }
-
-    val unknownError: Int by lazy {
-        resolveField("android.hardware.security.keymint.ErrorCode", "UNKNOWN_ERROR", -1000)
-    }
-
-    fun resolveField(className: String, fieldName: String, fallback: Int): Int =
-        runCatching {
-            Class.forName(className).getField(fieldName).getInt(null)
-        }.getOrElse {
-            SystemLogger.debug("Resolved $className.$fieldName via fallback: $fallback")
-            fallback
-        }
-}
-
-class SoftwareOperationBinder(private val operation: SoftwareOperation) :
-    IKeystoreOperation.Stub() {
-
-    @Synchronized
-    override fun updateAad(aadInput: ByteArray?) {
-        operation.updateAad(aadInput)
-    }
-
-    @Synchronized
-    override fun update(input: ByteArray?): ByteArray? {
-        return operation.update(input)
-    }
-
-    @Synchronized
-    override fun finish(input: ByteArray?, signature: ByteArray?): ByteArray? {
-        return operation.finish(input, signature)
-    }
-
-    @Synchronized
-    override fun abort() {
-        operation.abort()
-    }
-}

app/src/main/java/org/matrix/TEESimulator/logging/KeyMintParameterLogger.kt

@@ -37,6 +37,22 @@ object KeyMintParameterLogger {
             .associate { field -> (field.get(null) as Int) to field.name }
     }
 
+    val hardwareAuthenticatorTypeNames: Map<Int, String> by lazy {
+        HardwareAuthenticatorType::class
+            .java
+            .fields
+            .filter { it.type == Int::class.java }
+            .associate { field -> (field.get(null) as Int) to field.name }
+    }
+
+    val keyOriginNames: Map<Int, String> by lazy {
+        KeyOrigin::class
+            .java
+            .fields
+            .filter { it.type == Int::class.java }
+            .associate { field -> (field.get(null) as Int) to field.name }
+    }
+
     val paddingNames: Map<Int, String> by lazy {
         PaddingMode::class
             .java
@@ -81,22 +97,33 @@ object KeyMintParameterLogger {
             when (param.tag) {
                 Tag.ALGORITHM -> algorithmNames[value.algorithm]
                 Tag.BLOCK_MODE -> blockModeNames[value.blockMode]
+                Tag.DIGEST -> digestNames[value.digest]
                 Tag.EC_CURVE -> ecCurveNames[value.ecCurve]
+                Tag.ORIGIN -> keyOriginNames[value.origin]
                 Tag.PADDING -> paddingNames[value.paddingMode]
                 Tag.PURPOSE -> purposeNames[value.keyPurpose]
-                Tag.DIGEST -> digestNames[value.digest]
+                Tag.USER_AUTH_TYPE ->
+                    hardwareAuthenticatorTypeNames[value.hardwareAuthenticatorType]
                 Tag.AUTH_TIMEOUT,
+                Tag.BOOT_PATCHLEVEL,
                 Tag.KEY_SIZE,
-                Tag.MIN_MAC_LENGTH -> value.integer.toString()
+                Tag.MAC_LENGTH,
+                Tag.MIN_MAC_LENGTH,
+                Tag.OS_VERSION,
+                Tag.OS_PATCHLEVEL,
+                Tag.USER_ID,
+                Tag.VENDOR_PATCHLEVEL -> value.integer.toString()
                 Tag.CERTIFICATE_SERIAL -> BigInteger(value.blob).toString()
                 Tag.ACTIVE_DATETIME,
                 Tag.CERTIFICATE_NOT_AFTER,
                 Tag.CERTIFICATE_NOT_BEFORE,
+                Tag.CREATION_DATETIME,
                 Tag.ORIGINATION_EXPIRE_DATETIME,
                 Tag.USAGE_EXPIRE_DATETIME -> Date(value.dateTime).toString()
                 Tag.CERTIFICATE_SUBJECT -> X500Name(X500Principal(value.blob).name).toString()
+                Tag.USER_SECURE_ID,
                 Tag.RSA_PUBLIC_EXPONENT -> value.longInteger.toString()
-                Tag.NO_AUTH_REQUIRED -> "true"
+                Tag.NO_AUTH_REQUIRED -> value.boolValue.toString()
                 Tag.ATTESTATION_CHALLENGE,
                 Tag.ATTESTATION_ID_BRAND,
                 Tag.ATTESTATION_ID_DEVICE,

app/src/main/java/org/matrix/TEESimulator/pki/CertificateGenerator.kt

@@ -35,6 +35,7 @@ import org.matrix.TEESimulator.logging.SystemLogger
  */
 object CertificateGenerator {
 
+    // RFC 5280 GeneralizedTime maximum: 9999-12-31T23:59:59 UTC (millis since epoch).
     private const val UNDEFINED_NOT_AFTER = 253402300799000L
 
     /**
@@ -198,14 +199,16 @@ object CertificateGenerator {
     private fun buildKeyUsageFromPurposes(purposes: List<Int>): Int {
         var bits = 0
         for (purpose in purposes) {
-            bits = bits or when (purpose) {
-                KeyPurpose.SIGN -> KeyUsage.digitalSignature
-                KeyPurpose.DECRYPT -> KeyUsage.dataEncipherment
-                KeyPurpose.WRAP_KEY -> KeyUsage.keyEncipherment
-                KeyPurpose.AGREE_KEY -> KeyUsage.keyAgreement
-                KeyPurpose.ATTEST_KEY -> KeyUsage.keyCertSign
-                else -> 0
-            }
+            bits =
+                bits or
+                    when (purpose) {
+                        KeyPurpose.SIGN -> KeyUsage.digitalSignature
+                        KeyPurpose.DECRYPT -> KeyUsage.dataEncipherment
+                        KeyPurpose.WRAP_KEY -> KeyUsage.keyEncipherment
+                        KeyPurpose.AGREE_KEY -> KeyUsage.keyAgreement
+                        KeyPurpose.ATTEST_KEY -> KeyUsage.keyCertSign
+                        else -> 0
+                    }
         }
         return bits
     }
@@ -220,6 +223,8 @@ object CertificateGenerator {
         securityLevel: Int,
     ): Certificate {
         val subject = params.certificateSubject ?: X500Name("CN=Android Keystore Key")
+
+        // Default validity: epoch to 9999-12-31T23:59:59 UTC (matches add_required_parameters).
         val notBefore = params.certificateNotBefore ?: Date(0)
         val notAfter = params.certificateNotAfter ?: Date(UNDEFINED_NOT_AFTER)
 
@@ -243,11 +248,16 @@ object CertificateGenerator {
             AttestationBuilder.buildAttestationExtension(params, uid, securityLevel)
         )
 
+        // The signature algorithm must match the SIGNING key, not the subject key.
+        // An EC attestation key may sign an RSA subject key's certificate (or vice versa).
         val signerAlgorithm =
-            when (signingKeyPair.private.algorithm) {
-                "EC", "ECDSA" -> "SHA256withECDSA"
-                "RSA" -> "SHA256withRSA"
-                else -> throw IllegalArgumentException("Unsupported signing key: ${signingKeyPair.private.algorithm}")
+            when (signingKeyPair.private) {
+                is java.security.interfaces.ECKey -> "SHA256withECDSA"
+                is java.security.interfaces.RSAKey -> "SHA256withRSA"
+                else ->
+                    throw IllegalArgumentException(
+                        "Unsupported signing key type: ${signingKeyPair.private.javaClass}"
+                    )
             }
         val contentSigner =
             JcaContentSignerBuilder(signerAlgorithm)

app/src/main/java/org/matrix/TEESimulator/util/AndroidDeviceUtils.kt

@@ -76,16 +76,6 @@ object AndroidDeviceUtils {
         SystemLogger.debug("Boot key and hash initialization complete.")
     }
 
-    /**
-     * Generic initializer for boot properties like the key and hash. It attempts to read from a
-     * system property first, then from a TEE attestation, and finally falls back to a random value
-     * if neither is available.
-     *
-     * @param propertyName The name of the system property (e.g., "ro.boot.vbmeta.digest").
-     * @param attestationValueProvider A function that supplies the value from a cached attestation.
-     * @param expectedSize The expected length of the byte array (e.g., 32 for a SHA-256 digest).
-     * @return The resulting byte array for the property.
-     */
     private fun initializeBootProperty(
         propertyName: String,
         attestationValueProvider: () -> ByteArray?,
@@ -274,11 +264,9 @@ object AndroidDeviceUtils {
 
         return when {
             resolvedValue.equals("device_default", ignoreCase = true) -> null
-            // Resolve from live system prop — matches what detectors see via getprop,
-            // even when PIF has spoofed ro.build.version.security_patch via resetprop
+            resolvedValue.equals("no", ignoreCase = true) -> DO_NOT_REPORT
             resolvedValue.equals("prop", ignoreCase = true) ->
                 parsePatchLevelValue(SystemProperties.get("ro.build.version.security_patch", ""), isLong)
-            resolvedValue.equals("no", ignoreCase = true) -> DO_NOT_REPORT
             else -> parsePatchLevelValue(resolvedValue, isLong)
         }
     }
@@ -405,7 +393,10 @@ object AndroidDeviceUtils {
 
     // --- APEX and Module Hash Properties ---
 
-    // Minimal protobuf parser for apex_manifest.pb (field 1: name, field 2: version)
+    // https://cs.android.com/android/platform/superproject/+/android-latest-release:system/apex/proto/apex_manifest.proto
+    // --- Minimal Protobuf Parser for ApexManifest ---
+    // Field 1: name (string)
+    // Field 2: version (int64)
     private class MinimalApexManifestParser(private val data: ByteArray) {
         var pos = 0
 
@@ -419,13 +410,13 @@ object AndroidDeviceUtils {
                 val wireType = (tag and 0x07).toInt()
 
                 when (fieldNum) {
-                    1L -> {
+                    1L -> { // name
                         val length = readVarint().toInt()
                         if (pos + length > data.size) return null
                         name = String(data, pos, length, Charsets.UTF_8)
                         pos += length
                     }
-                    2L -> {
+                    2L -> { // version
                         version = readVarint()
                     }
                     else -> skipField(wireType)
@@ -453,18 +444,19 @@ object AndroidDeviceUtils {
 
         private fun skipField(wireType: Int) {
             when (wireType) {
-                0 -> readVarint()
-                1 -> pos += 8
-                2 -> {
+                0 -> readVarint() // Varint
+                1 -> pos += 8 // 64-bit
+                2 -> { // Length-delimited
                     val len = readVarint().toInt()
                     pos += len
                 }
-                5 -> pos += 4
+                5 -> pos += 4 // 32-bit
                 else -> throw IllegalStateException("Unknown wire type $wireType")
             }
         }
     }
 
+    // https://cs.android.com/android/platform/superproject/main/+/main:system/apex/libs/libapexutil/apexutil.cpp
     private val apexInfos: List<Pair<String, Long>> by lazy {
         val results = mutableListOf<Pair<String, Long>>()
         val apexRoot = File("/apex")
@@ -473,14 +465,22 @@ object AndroidDeviceUtils {
             return@lazy emptyList()
         }
 
+        // Logic from: GetActivePackages in apexutil.cpp
         apexRoot.listFiles()?.forEach { file ->
             if (!file.isDirectory) return@forEach
             val name = file.name
 
+            // 1. Ignore "." (and implicitly "..")
             if (name.startsWith(".")) return@forEach
+
+            // 2. Ignore directories containing '@' (active mounts usually don't have version in
+            // path)
             if (name.contains("@")) return@forEach
+
+            // 3. Ignore "sharedlibs"
             if (name == "sharedlibs") return@forEach
 
+            // 4. Parse apex_manifest.pb
             val manifestFile = File(file, "apex_manifest.pb")
             if (manifestFile.exists()) {
                 runCatching {
@@ -491,46 +491,59 @@ object AndroidDeviceUtils {
             }
         }
 
+        // Ensure uniqueness (though filesystem scan usually prevents exact dupes,
+        // strictly speaking we want to behave like a Map keyed by package name)
         results.distinctBy { it.first }
     }
 
+    // https://cs.android.com/android/platform/superproject/main/+/main:system/security/keystore2/src/maintenance.rs
     val moduleHash: ByteArray by lazy {
         DeviceAttestationService.CachedAttestationData?.moduleHash
             ?: runCatching {
+                    // 1. Create a container to hold the sort key (name encoded) and the full data
+                    // (sequence encoded)
                     data class ModuleEntry(
-                        val nameEncoded: ByteArray,
-                        val fullEncoded: ByteArray,
+                        val nameEncoded: ByteArray, // The sort key
+                        val fullEncoded: ByteArray, // The data to hash
                     )
 
                     val modules =
                         apexInfos.map { (packageName, versionCode) ->
+                            // Create the components
                             val nameOctet = DEROctetString(packageName.toByteArray(Charsets.UTF_8))
                             val versionInt = ASN1Integer(versionCode)
 
+                            // Create the Sequence: SEQUENCE { packageName, version }
                             val vec = ASN1EncodableVector()
                             vec.add(nameOctet)
                             vec.add(versionInt)
                             val sequence = DERSequence(vec)
 
-                            // AOSP sorts by encoded name only, not full sequence
+                            // We store the encoded name separately because Rust sorts ONLY by this
                             ModuleEntry(
                                 nameEncoded = nameOctet.encoded,
                                 fullEncoded = sequence.encoded,
                             )
                         }
 
+                    // 2. Sort manually based on the encoded Package Name (lexicographically)
+                    // This mimics the Rust 'impl DerOrd for ModuleInfo' which delegates to
+                    // 'self.name'
                     val sortedModules =
                         modules.sortedWith { m1, m2 ->
                             compareByteArrays(m1.nameEncoded, m2.nameEncoded)
                         }
 
+                    // 3. Concatenate the full sequences in the specific sorted order
                     val payloadStream = ByteArrayOutputStream()
                     sortedModules.forEach { payloadStream.write(it.fullEncoded) }
                     val payload = payloadStream.toByteArray()
 
-                    // Wrap in DER SET tag manually — DERSet() re-sorts by full encoding
+                    // 4. Wrap manually in a DER SET tag (0x31)
+                    // We cannot use DERSet(vector) because it would re-sort incorrectly.
                     val finalDerSet = encodeAsDerSet(payload)
 
+                    // 5. Compute SHA-256
                     MessageDigest.getInstance("SHA-256").digest(finalDerSet)
                 }
                 .getOrElse {
@@ -539,6 +552,7 @@ object AndroidDeviceUtils {
                 }
     }
 
+    /** Compares two byte arrays lexicographically (unsigned). */
     private fun compareByteArrays(a: ByteArray, b: ByteArray): Int {
         val length = minOf(a.size, b.size)
         for (i in 0 until length) {
@@ -551,25 +565,31 @@ object AndroidDeviceUtils {
         return a.size - b.size
     }
 
+    /** Manually wraps the payload in an ASN.1 SET (0x31) tag with correct length encoding. */
     private fun encodeAsDerSet(payload: ByteArray): ByteArray {
         val out = ByteArrayOutputStream()
-        out.write(0x31)
+        out.write(0x31) // ASN.1 Tag for SET
         writeDerLength(out, payload.size)
         out.write(payload)
         return out.toByteArray()
     }
 
+    /** Writes the ASN.1 length field to the stream. */
     private fun writeDerLength(out: ByteArrayOutputStream, length: Int) {
         if (length < 128) {
+            // Short form
             out.write(length)
         } else {
+            // Long form
             var size = length
             val bytes = ArrayList<Byte>()
             while (size > 0) {
                 bytes.add((size and 0xFF).toByte())
                 size = size ushr 8
             }
+            // First byte: 0x80 | number of length bytes
             out.write(0x80 or bytes.size)
+            // Write length bytes in big-endian (reverse of how we extracted them)
             for (i in bytes.indices.reversed()) {
                 out.write(bytes[i].toInt())
             }

app/src/main/java/org/matrix/TEESimulator/util/AndroidPermissionUtils.kt

@@ -1,72 +0,0 @@
-package org.matrix.TEESimulator.util
-
-import android.annotation.SuppressLint
-import android.content.Context
-import android.content.pm.PackageManager
-import org.matrix.TEESimulator.logging.SystemLogger
-
-object AndroidPermissionUtils {
-
-    @SuppressLint("PrivateApi", "DiscouragedPrivateApi")
-    private fun getGlobalContext(): Context? {
-        return try {
-            // 1. Get the hidden ActivityThread class via reflection
-            val activityThreadClass = Class.forName("android.app.ActivityThread")
-            
-            // 2. Invoke the static currentActivityThread() method
-            val currentActivityThreadMethod = activityThreadClass.getDeclaredMethod("currentActivityThread")
-            currentActivityThreadMethod.isAccessible = true
-            val activityThread = currentActivityThreadMethod.invoke(null)
-            
-            if (activityThread == null) {
-                SystemLogger.warning("Reflection: ActivityThread.currentActivityThread() returned null")
-                return null
-            }
-
-            // 3. Try to get the application context
-            val getApplicationMethod = activityThreadClass.getDeclaredMethod("getApplication")
-            getApplicationMethod.isAccessible = true
-            val application = getApplicationMethod.invoke(activityThread) as? Context
-            
-            if (application != null) return application
-
-            // 4. Fallback to getSystemContext() if application is null (often happens in system_server)
-            val getSystemContextMethod = activityThreadClass.getDeclaredMethod("getSystemContext")
-            getSystemContextMethod.isAccessible = true
-            getSystemContextMethod.invoke(activityThread) as? Context
-
-        } catch (e: Exception) {
-            SystemLogger.error("Reflection failed to get global context for permission check", e)
-            null
-        }
-    }
-
-    /**
-     * Core permission check.
-     */
-    fun hasPermission(uid: Int, permission: String): Boolean {
-        val context = getGlobalContext() ?: run {
-            SystemLogger.warning("AndroidPermissionUtils: Context is null, failing permission check safely.")
-            return false
-        }
-        
-        val result = context.checkPermission(permission, -1, uid)
-        return result == PackageManager.PERMISSION_GRANTED
-    }
-
-    fun hasDeviceAttestationPermission(uid: Int): Boolean {
-        return hasPermission(uid, "android.permission.READ_PRIVILEGED_PHONE_STATE")
-    }
-
-    fun hasUniqueIdAttestationPermission(uid: Int): Boolean {
-        return hasPermission(uid, "android.permission.REQUEST_UNIQUE_ID_ATTESTATION")
-    }
-
-    fun hasManageUsersPermission(uid: Int): Boolean {
-        return hasPermission(uid, "android.permission.MANAGE_USERS")
-    }
-
-    fun hasDumpPermission(uid: Int): Boolean {
-        return hasPermission(uid, "android.permission.DUMP")
-    }
-}

app/src/main/java/org/matrix/TEESimulator/util/TeeLatencySimulator.kt

@@ -8,6 +8,21 @@ import kotlin.math.exp
 import kotlin.math.ln
 import kotlin.math.max
 
+/**
+ * Simulates realistic TEE hardware latency for software key generation.
+ *
+ * The delay model is derived from 64+ timing measurements across QTEE (Qualcomm) and Trustonic
+ * (MediaTek) hardware. It combines four independent noise sources that model different physical
+ * latency origins in a real TrustZone-based TEE:
+ *
+ * 1. Base crypto processing (log-normal): hardware RNG + key derivation + cert signing
+ * 2. Binder/kernel transit (exponential): IPC scheduling, context switches
+ * 3. TrustZone scheduler jitter (Gaussian): world-switch non-determinism
+ * 4. Cold-start penalty (half-normal): first operation after idle is slower due to TEE
+ *    secure world re-initialization and TLB/cache warming
+ *
+ * Per-boot session bias models manufacturing variance between TEE hardware instances.
+ */
 object TeeLatencySimulator {
 
     private val rng = SecureRandom()
@@ -41,6 +56,11 @@ object TeeLatencySimulator {
         return max(20.0, base + transit + jitter + sessionBiasMs + cold)
     }
 
+    /**
+     * Log-normal base delay. Parameters tuned to match observed hardware profiles:
+     * EC P-256 on QTEE averages ~65ms, RSA-2048 ~75ms, AES ~40ms.
+     * Sigma kept low (0.08) to match the tight clustering seen in real measurements.
+     */
     private fun sampleBaseCryptoDelay(algorithm: Int): Double {
         val (mu, sigma) =
             when (algorithm) {

module/changelog.md

@@ -1,3 +1,76 @@
+## TEESimulator-RS v5.1.1: Pre-Stash Restoration
+
+Restores all custom hardening fixes that were lost during the PR #157 migration. These were working in pre-stash builds but never carried over to the post-stash codebase, causing user-reported regressions (boot hash instability, DuckDetector score regression, config crash on file deletion).
+
+- **Boot hash persistence** restored: 4-step fallback (sysprop, TEE, file, random) with file writes at every step. Fixes "Boot: Unavailable" where boot hash randomized every reboot on devices without `ro.boot.vbmeta.digest`
+- **Presence-based findBoolean** for KeyMint tags: boolean tags are presence-based per AIDL spec, `.boolValue` field isn't reliably populated across Android versions
+- **noAuthRequired** defaults to true when not explicitly false, matching AOSP KeyMint behavior
+- **callerNonce** tag now flows through to software-enforced attestation list
+- **CTR block mode** restored in cipher algorithm mapping (was dropped in PR #157)
+- **AEAD guard** on updateAad: non-GCM operations throw INVALID_TAG
+- **Error code resolution** via lazy reflection with correct KeyMint AIDL fallback values
+- **Latency floor** on SoftwareOperation.finish() for StrongBox timing simulation
+- **FileObserver NPE** fixed: null-safe handling on config file DELETE events
+- **system=prop** consistency: forces boot/vendor patch levels to derive from device props
+- **StrongBox simulation** restored: capability checks (RSA<=2048, EC=P256), concurrent op limits (4 max), keygen latency floor (250ms), op latency floor (80ms)
+- **Binder buffer guard**: MAX_ALIAS_LENGTH (256KB) rejects oversized aliases before processing
+- **Key lifecycle tracking**: deletedSoftwareKeys set prevents ghost key responses after deletion
+- **Per-UID operation limits**: 15 TEE, 4 StrongBox with LRU eviction
+- **EC+DECRYPT rejection** in createOperation, matching AOSP unsupported purpose check
+- **Attest key nspace update** aligned with upstream PR #169
+
+---
+
+## TEESimulator-RS v5.1: Interception Architecture Rewrite
+
+Major release. 27 files changed, 2300 lines rewritten. The entire Kotlin interception layer has been rebuilt with a clean architecture, proper AIDL alignment, and significantly lower binder overhead.
+
+### Interception Layer Rewrite
+- KeyMintSecurityLevelInterceptor completely restructured: GeneratedKeyInfo now carries full KeyMintAttestation instead of nullable stub, eliminating scattered null checks across every operation path
+- SoftwareOperation rewritten with sealed CryptoPrimitive interface separating Signer, Verifier, Encryptor, and Decryptor into isolated implementations with proper JCA algorithm mapping
+- KeystoreErrorCode centralized object replaces scattered magic numbers for all KeyMint and Keystore2 error codes
+- listEntries moved from pre-transact parameter caching to post-transact injection, eliminating a race condition where cached params could go stale
+- deleteKey now handles both APP domain (by alias) and KEY_ID domain (by nspace) resolution paths correctly
+- AuthorizeCreate and AndroidPermissionUtils removed, authorization logic consolidated into the operation dispatch path
+- DeviceAttestationService removed, attestation routing simplified into the main interceptor
+
+### Software Crypto Operations
+- GCM nonce returned in CreateOperationResponse.parameters for encrypt operations, matching real KeyMint HAL behavior
+- updateAad correctly throws INVALID_TAG on non-AEAD operations instead of silently succeeding
+- Cipher algorithm mapping cleaned up: dropped CTR block mode and RSA_PKCS1_1_5_SIGN padding that caused JCA provider mismatches
+- All crypto exceptions wrapped as ServiceSpecificException with correct KeyMint error codes instead of raw exceptions
+
+### Attestation & Certificate Generation
+- CertificateGenerator rewritten with clean Kotlin Pair return type instead of Android's util.Pair
+- AttestationBuilder field ordering aligned with AOSP KeyDescription ASN.1 schema
+- Unique ID computation follows KeyMint HAL spec: HMAC-SHA256(temporal_counter || AAID || reset_flag, HBK) truncated to 128 bits
+- Patch level logging removed from hot path to reduce logcat noise on every attestation
+
+### Configuration & Device Properties
+- ConfigurationManager target package parsing refactored: mode/package extraction deduplicated across GENERATE/PATCH/AUTO branches
+- system=prop forced boot/vendor override removed, now respects explicit per-component patch level configuration
+- FileObserver delete handler simplified with direct file access instead of defensive null-checks
+- AndroidDeviceUtils expanded with additional device property accessors for attestation fields
+
+### Binder Performance
+- Safe parcel reads at 6 deserialization sites, replacing force-unwrap NPE paths with early-return on null. A single NPE generates a full stack trace that blocks the binder thread for ~2ms
+- teeResponses cache populated on generateKey/importKey post-transact, reducing getKeyEntry from 2+ binder round-trips to 1
+- pingBinder liveness check removed from pre-transact failure path, eliminating a synchronous IPC call on every failed transaction
+- Native transaction code filtering at C++ level, skipping JNI entirely for PING/INTERFACE/DUMP
+
+### Dynamic SecurityLevel Binder Registration
+- Intercepts getSecurityLevel replies to register hooks on every new BBinder instance keystore2 returns, not just the initial one from setup
+- Identity hash deduplication prevents double-hooking when keystore2 returns the same binder across multiple calls
+- Resolves apps that call getSecurityLevel independently and receive a different binder than the one registered at startup
+
+### Build & Packaging
+- Rust native build task integrated into Gradle with cargo-ndk for aarch64/armv7/x86/x86_64
+- Module ZIP includes all 4 native libraries (libTEESimulator, libsupervisor, libcertgen, libinject)
+- customize.sh extraction restored for supervisor daemon and native cert gen library
+- TeeLatencySimulator added as standalone utility for log-normal hardware latency emulation
+
+---
+
 ## TEESimulator-RS v5.0: AOSP Compliance Overhaul
 
 Major release integrating 30+ AOSP compliance improvements from upstream PR #157 analysis, layered on top of our StrongBox hardening and native cert gen architecture.

stub/src/main/java/android/hardware/security/keymint/HardwareAuthenticatorType.java

@@ -0,0 +1,8 @@
+package android.hardware.security.keymint;
+
+public @interface HardwareAuthenticatorType {
+    int NONE = 0;
+    int PASSWORD = 1;
+    int FINGERPRINT = 2;
+    int ANY = -1;
+}

stub/src/main/java/android/os/SELinux.java

@@ -1,5 +1,6 @@
 package android.os;
 
+/** Stub for android.os.SELinux. */
 public class SELinux {
     public static boolean checkSELinuxAccess(
             String scon, String tcon, String tclass, String perm) {

stub/src/main/java/android/os/ServiceSpecificException.java

@@ -1,14 +1,21 @@
 package android.os;
 
+/**
+ * Stub for android.os.ServiceSpecificException.
+ *
+ * <p>Used by AIDL-generated binder stubs to report service-specific errors with numeric codes.
+ * The binder framework serializes this as EX_SERVICE_SPECIFIC on the wire, preserving the integer
+ * error code for the client.
+ */
 public class ServiceSpecificException extends RuntimeException {
     public final int errorCode;
 
-    public ServiceSpecificException(int errorCode) {
-        this.errorCode = errorCode;
-    }
-
     public ServiceSpecificException(int errorCode, String message) {
         super(message);
         this.errorCode = errorCode;
     }
+
+    public ServiceSpecificException(int errorCode) {
+        this(errorCode, null);
+    }
 }