Tricky Store Documentation

Tricky Store is a module used for modifying the certificate chain generated for Android key attestation. Android 10 or above is required.

To use the module:

1. Flash the module and reboot your device.
2. (Optional) For more than DEVICE integrity, place an unrevoked hardware keybox.xml at /data/adb/tricky_store/keybox.xml.
3. (Optional) Customize target packages by creating /data/adb/tricky_store/target.txt.

All configuration files take effect immediately after being placed in the directory.

Tricky Store supports Android 10 and above. It is used to modify the Android KeyAttestation certificate chain generated by Android Keystore.

To use the module:

1. Flash the module and reboot.
2. (Optional) For more than DEVICE integrity, place an unrevoked hardware keybox.xml at /data/adb/tricky_store/keybox.xml.
3. (Optional) Specify target application package names in /data/adb/tricky_store/target.txt to apply modifications to specific apps.

All configurations take effect immediately.

Starting from version 1.2.1, you can customize the security patch level returned by KeyAttestation using the configuration file /data/adb/tricky_store/security_patch.txt.

Note: This only modifies the results returned by KeyAttestation; it does not reset actual system properties.

Simple Configuration

To modify the security patch level for os, vendor, and boot simultaneously, provide a single date string (e.g., YYYYMMDD).

Advanced Configuration

You can specify levels for individual components:

• system: Set the system security patch level. Use prop to match the actual system property.
• vendor: Set the vendor security patch level. Supports YYYYMMDD or YYYY-MM-DD formats.
• boot: Set the boot security patch level. Use no to prevent modification.
• all: A shorthand to set all levels at once.

You can control how Tricky Store handles specific packages by editing /data/adb/tricky_store/target.txt. This is useful for TEE broken devices where the default leaf certificate hack might fail.

Use the following suffixes for package names:

• No suffix: Default behavior (attempts leaf hack, falls back to generate mode on TEE broken devices).
• ! suffix: Forces certificate generating mode (useful for com.google.android.gms).
• ? suffix: Forces leaf hack mode.

# use auto mode for KeyAttestation App
io.github.vvb2060.keyattestation

# always use leaf hack mode 
io.github.vvb2060.mahoshojo?

# always use certificate generating mode for gms
com.google.android.gms!

To support TEE broken devices or achieve higher integrity levels, you can provide a hardware keybox. Place the keybox.xml file at /data/adb/tricky_store/keybox.xml.

The XML must follow this structure:

<?xml version="1.0"?>
<AndroidAttestation>
    <NumberOfKeyboxes>1</NumberOfKeyboxes>
    <Keybox DeviceID="...">
        <Key algorithm="ecdsa|rsa">
            <PrivateKey format="pem">
-----BEGIN EC PRIVATE KEY-----
...
-----END EC PRIVATE KEY-----
            </PrivateKey>
            <CertificateChain>
                <NumberOfCertificates>...</NumberOfCertificates>
                    <Certificate format="pem">
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
                    </Certificate>
                ... more certificates
            </CertificateChain>
        </Key>...
    </Keybox>
</AndroidAttestation>

Use /data/adb/tricky_store/target.txt to define which application package names receive modifications. You can force specific certificate chain modes by appending suffixes to the package name:

• No suffix: Automatic mode (defaults to leaf certificate modification, but switches to certificate generation mode if TEE is broken).
• ! suffix: Force certificate generation mode (useful for devices with broken TEE).
• ? suffix: Force leaf certificate modification mode.

Example target.txt content:

To achieve higher integrity levels, you can provide a hardware keybox.xml file at /data/adb/tricky_store/keybox.xml. The file must follow this XML structure:

<?xml version="1.0"?>
<AndroidAttestation>
    <NumberOfKeyboxes>1</NumberOfKeyboxes>
    <Keybox DeviceID="...">
        <Key algorithm="ecdsa|rsa">
            <PrivateKey format="pem">
-----BEGIN EC PRIVATE KEY-----
...
-----END EC PRIVATE KEY-----
            </PrivateKey>
            <CertificateChain>
                <NumberOfCertificates>...</NumberOfCertificates>
                    <Certificate format="pem">
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
                    </Certificate>
                ... more certificates
            </CertificateChain>
        </Key>...
    </Keybox>
</AndroidAttestation>