New network permission

[majorfigjam]

Your "home page" says "The app is used for self-testing, so it has no network permission. The certificate revocation data is embedded in the apk and will not be updated online."

Yet updates say after Shoey's fix:
​Key Improvements:
​Live Updates: Replaces the static R.raw.status dependency with a dynamic fetch from https://android.googleapis.com/attestation/status.

One of these is now incorrect - I suspect the home page needs updating.

[VisionR1]

Your "home page" says "The app is used for self-testing, so it has no network permission. The certificate revocation data is embedded in the apk and will not be updated online."

Yet updates say after Shoey's fix:​Key Improvements:​Live Updates: Replaces the static R.raw.status dependency with a dynamic fetch from https://android.googleapis.com/attestation/status.

One of these is now incorrect - I suspect the home page needs updating.

Oh yeah, you have right.

I had add before in README, why need internet permission, and i deleted before 2 days, and move it to Wiki

But, yeah must rewrite.

[shoey63]

I have since added some descriptive visual enhancements. I can do a pull request if you like. You, as usual, would need to handle the translations

If you want to test CI build is here
https://github.com/shoey63/KeyAttestation/actions/runs/23250855938

[VisionR1]

I like it.

I had something similar in mind.

[VisionR1]

@shoey63

I just tried it.

Looks great. 👍🏻

[shoey63]

PR done. 4 changed files. That's it, and no deleting the yml😊

[VisionR1]

Thanks again.

I appreciate it, as always.

You have any others changes in your mind?

[shoey63]

I'm looking at zgfg's RKP idea. It's complicated.
Also with the PR, the CI checks are currently failing on the packageRelease task because this PR is coming from a fork, so GitHub Actions naturally doesn't have access to the repository's storePassword secrets to sign the release build. The code itself compiles cleanly!

[VisionR1]

Oh yeah.

Me too, but like you say it's complicated.

Oh, because i have added my certificate, but is not problem, like you say the code itself compiles cleanly, so i can merged it and after release and signed by my certificate and all good 👍🏻

[majorfigjam]

Just tried your Build 52, both as update from existing release and after removing app and data and then rebooting.

In all cases, Build 52 shows Device offline - using cached CRL. Does it not have network permissions?

Reverting to release version correctly shows latest Revocation list publish time.

[VisionR1]

Strange.

Here, all working as expected.

When open the app say: ℹ️ New CRL Fetched!

Reopen ✅ CRL Up-to-date

Without internet: ⚠️ Device offline - using cached CR

Do you use VPN or something similar?

If you can, install the debug version, and get logcat

Or specific logcat -s RevocationList

[majorfigjam]

Very strange - after clearing data uninstalling and re-installing, the debug version shows an updated CRL. However, after again clearing data and uninstalling then reinstalling, the release version still shows "Offline - using hardcoded."

No point having a log if the debug version works, so I can't get relevant logcat.

[VisionR1]

Really strange.

So, with debug works, and with release not.

What phone you have?

Also, @shoey63 maybe know why happens this.

[shoey63]

app/proguard-rules.pro
Try adding these lines at the end like I have on mine on a new branch
[Code]
-dontwarn org.codehaus.mojo.animal_sniffer.IgnoreJRERequirement

-keep class rikka.shizuku.** { *; }
[/code]

I didn't put them in the PR because I didn't want to interfere with your build environment.

Maybe it helps. Proguard strips a lot of stuff out of the release builds, but debug has everything.

[VisionR1]

Nice.

Now seems to work and on emulator, before this always X

[shoey63]

Nice.

Now seems to work and on emulator, before this always X

I branched your main and applied the fix with 💯 success. I feel you can apply it with confidence .

[VisionR1]

Thanks.

I'm waiting @majorfigjam to confirm, that it works from his side.

[VisionR1]

@majorfigjam

Test this (is not zip, just rename it).
KeyAttestation-v2.0.0 -Test.apk.zip

[majorfigjam]

Yes, that connects and shows new CRL fetched.

Edit: Phone is Pixel 10 Pro with Canary rom, and new P-384 root certificate in place.

[shoey63]

Yes, that connects and shows new CRL fetched.

Edit: Phone is Pixel 10 Pro with Canary rom, and new P-384 root certificate in place.

If you need to switch back to the old root in a hurry, you can use my build

Post in thread 'Tricky Store - Bootloader & Keybox Spoofing' https://xdaforums.com/t/tricky-store-bootloader-keybox-spoofing.4683446/post-90528243

[majorfigjam]

Not sure why I would now need to change back - given the P10 series is supposed to be rkp only, so should by rights have been updated anyway by now. Maybe it hadn't due to the reported Broken Tee in TrickyStore / TeeSimulator.

So far, against all dire predictions about the impact of the new certificate, it has had no effect on spoofing. Key Attestation is still showing the f92009e8 serial certificate, and I still have Strong Integrity. If I disable Tee Simulator, it reverts to showing the new Root.

I guess we'll see sometime after 10 April what happens if / when Google make server side changes.

Maybe if they break Integrity, I'll try to change back.