Crashes with config android!

[ABJ4403]

Description

At some point after booting, typing PIN/Password instead of biometric on system related stuff (eg. Lockscreen or Lockscreen Settings) crashes it with this error:

FATAL EXCEPTION: AsyncTask #1
Process: com.android.systemui, PID: 14897
java.lang.RuntimeException: An error occurred while executing doInBackground()
	at android.os.AsyncTask$4.done(AsyncTask.java:415)
	at java.util.concurrent.FutureTask.finishCompletion(FutureTask.java:381)
	at java.util.concurrent.FutureTask.setException(FutureTask.java:250)
	at java.util.concurrent.FutureTask.run(FutureTask.java:269)
	at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:305)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:644)
	at java.lang.Thread.run(Thread.java:1117)
Caused by: java.lang.NullPointerException: Attempt to read from field 'android.system.keystore2.IKeystoreSecurityLevel android.system.keystore2.KeyEntryResponse.iSecurityLevel' on a null object reference in method 'android.security.keystore2.AndroidKeyStoreKey android.security.keystore2.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyFromKeystore(android.security.KeyStore2, android.system.keystore2.KeyDescriptor)'
	at android.os.Parcel.createExceptionOrNull(Parcel.java:3237)
	at android.os.Parcel.createException(Parcel.java:3215)
	at android.os.Parcel.readException(Parcel.java:3198)
	at android.os.Parcel.readException(Parcel.java:3140)
	at com.android.internal.widget.ILockSettings$Stub$Proxy.checkCredential(ILockSettings.java:1350)
	at com.android.internal.widget.LockPatternUtils.checkCredential(LockPatternUtils.java:549)
	at com.android.internal.widget.LockPatternChecker$2.doInBackground(LockPatternChecker.java:110)
	at com.android.internal.widget.LockPatternChecker$2.doInBackground(LockPatternChecker.java:104)
	at android.os.AsyncTask$3.call(AsyncTask.java:394)
	at java.util.concurrent.FutureTask.run(FutureTask.java:264)
	... 4 more
Caused by: android.os.RemoteException: Remote stack trace:
	at android.security.keystore2.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyFromKeystore(AndroidKeyStoreProvider.java:394)
	at android.security.keystore2.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyFromKeystore(AndroidKeyStoreProvider.java:365)
	at android.security.keystore2.AndroidKeyStoreSpi.engineGetKey(AndroidKeyStoreSpi.java:125)
	at java.security.KeyStore.getKey(KeyStore.java:1083)
	at com.android.server.locksettings.SyntheticPasswordCrypto.decryptBlob(SyntheticPasswordCrypto.java:173)

This also happened with the latest TrickyStore-OSS CI version (but its even worse, it crashes it immediately at boot which makes it impossible to get past the PIN screen)

How to reproduce

There are multiple ways, but its involving typing lockscreen PIN/Password on system apps (eg. Settings or System UI), and it didnt happen immediately

Modules

• ReZygisk CI, 423th commit release
• TreatWheel 0.0.6
• TEESimulator 1.0.0
• PlayIntegrityFix inject 4.4

[JingMatrix]

Please flash the CI build of my LSPosed debug version, which will record the logs of TEESimultor.

After you trigger a crashes, try to save the logs via the LSPosed manager and upload it here

[ABJ4403]

Update: i reset targets.txt, it works again, then i found out the line android! that i added causes it (i thought it will reduce detections so i added it lol), where it wasnt doing that on last stable TS-OSS, i havent got time to repro this yet so ig for time being anyone else can try repro? 🙈

Also one more thing, it didnt work on my 2nd device that ran Android 10, it works on my primary device that ran Android 15 tho

[JingMatrix]

That is a useful piece of information, it could potentially indicate to how enhance TEESimulator in the future.

For old Android version , I cannot really help much as I don't posses such devices. Please open new issue regarding this, with LSPosed (debug CI version of my fork) logs attached.

[XiaoTong6666]

我也在使用的时候发生了崩溃（不能确定何时发生崩溃）

WifiHandlerThread
java.lang.NullPointerException: Attempt to read from field 'android.system.keystore2.IKeystoreSecurityLevel ...' on a null object reference
at android.security.keystore2.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyFromKeystore(AndroidKeyStoreProvider.java:389)
...
at com.android.server.wifi.util.KeystoreWrapper.getHmacSHA256ForUid(KeystoreWrapper.java:55)
at com.android.server.wifi.MacAddressUtil.calculatePersistentMacWithCachedHash(MacAddressUtil.java:100)
...
at com.android.server.wifi.MiuiWifiService.setHotSpotVendorSpecific(MiuiWifiService.java:2518)

似乎是因为WifiHandlerThread获取不到HMAC密钥，在app/src/main/java/io/github/beakthoven/TrickyStoreOSS/interceptors/Keystore2Interceptor.kt写的是return OverrideReply(0, nullParcel)引发了NullPointerException，我在本地改成return Skip暂时不会让程序或者系统崩溃
还有

fatal: Failed to generate key pair
java.lang.IllegalArgumentException: Unsupported algorithm: 32
at io.github.beakthoven.TrickyStoreOSS.CertificateGen.generateKeyPair(CertificateGen.kt:231)
at io.github.beakthoven.TrickyStoreOSS.CertificateGen.generateKeyPair(CertificateGen.kt:258)
at io.github.beakthoven.TrickyStoreOSS.interceptors.SecurityLevelInterceptor.onPreTransact(SecurityLevelInterceptor.kt:135)
at io.github.beakthoven.TrickyStoreOSS.interceptors.BinderInterceptor.handlePreTransact(BinderInterceptor.kt:151)
at io.github.beakthoven.TrickyStoreOSS.interceptors.BinderInterceptor.onTransact(BinderInterceptor.kt:130)
at android.os.Binder.execTransactInternal(Binder.java:1351)
at
android.os.Binder.execTransact(Binder.java:1282)

我查了下资料/aosp AES=32，这似乎是在当gms试图创建(generateKey)一个AES密钥，我猜测是CertificateGen不支持生成AES从而导致崩溃了

The following is from Google Translate:

I also encountered a crash while using it(The timing of the crash is uncertain)

WifiHandlerThread
java.lang.NullPointerException: Attempt to read from field 'android.system.keystore2.IKeystoreSecurityLevel ...' on a null object reference
at android.security.keystore2.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyFromKeystore(AndroidKeyStoreProvider.java:389)
... at com.android.server.wifi.util.KeystoreWrapper.getHmacSHA256ForUid(KeystoreWrapper.java:55)
at com.android.server.wifi.MacAddressUtil.calculatePersistentMacWithCachedHash(MacAddressUtil.java:100)
... at com.android.server.wifi.MiuiWifiService.setHotSpotVendorSpecific(MiuiWifiService.java:2518)

It seems that the WifiHandlerThread cannot obtain the HMAC key. The return OverrideReply(0, nullParcel) method in app/src/main/java/io/github/beakthoven/TrickyStoreOSS/interceptors/Keystore2Interceptor.kt caused a NullPointerException. I changed the code locally to return Skip, which temporarily prevents the program or system from crashing.

Also,

fatal: Failed to generate key pair java.lang.IllegalArgumentException: Unsupported algorithm: 32

at io.github.beakthoven.TrickyStoreOSS.CertificateGen.generateKeyPair(CertificateGen.kt:231)

at io.github.beakthoven.TrickyStoreOSS.CertificateGen.generateKeyPair(CertificateGen.kt:258)
at io.github.beakthoven.TrickyStoreOSS.interceptors.SecurityLevelInterceptor.onPreTransact(SecurityLevelInterceptor.kt:135)
at io.github.beakthoven.TrickyStoreOSS.interceptors.BinderInterceptor.handlePreTransact(BinderInterceptor.kt:151)
at io.github.beakthoven.TrickyStoreOSS.interceptors.BinderInterceptor.onTransact(BinderInterceptor.kt:130)
at android.os.Binder.execTransactInternal(Binder.java:1351)

at android.os.Binder.execTransact(Binder.java:1282)

I checked documentation/aosp and AES=32. This seems to be when GMS tries to create (generateKey) an AES key. I suspect that CertificateGen does not support generating AES keys, causing the crash.