IKeystoreService Inconsistencies Detected by Duck Detector

[kopijahe]

Duck Detector v1.8.5 detected inconsistencies in IKeystoreService:

Detection:

IKeystoreService State Inconsistency Detected
IKeystoreService listEntries Inconsistency Detected

More Info:

UPDATE_SUBCOMP|CERTIFICATE_STORE_ERROR: updateSubcomponent state inconsistency
LIST_ENTRIES|INCONSISTENT_MISSING_FROM_LIST: containsAlias/aliases() inconsistency

Screenshot:

Another detection is fixed by #70

[XiaoTong6666]

The word "updateSubcomponent" is fixed, please try it.

https://github.com/XiaoTong6666/TEESimulator/commit/a46d910bcbe8035783724f43248e03d9389a9dbc

[kopijahe]

Can confirm, using TEESimulator-v3.0-42-805b762-Release, only 1 detection remain.

Screenshot:

[XiaoTong6666]

expected

[XiaoTong6666]

@kopijahe Could you try this commit, please?

https://github.com/XiaoTong6666/TEESimulator/actions/runs/20761135786

[kopijahe]

@XiaoTong6666, using TEESimulator-v3.0-43-b46c0fa-Release, all detections are now fixed.

Screenshot:

[wangdaning]

Any reason you have not put this in a PR?

@kopijahe Could you try this commit, please?

https://github.com/XiaoTong6666/TEESimulator/actions/runs/20761135786

[XiaoTong6666]

Any reason you have not put this in a PR?

I haven’t fully thought it through yet.

[kopijahe]

@XiaoTong6666 I got this error in com.whatsapp.w4b after booting to android for a day, do you think it's related to TEESimulator?

FATAL EXCEPTION: ConnectionThread
Process: com.whatsapp.w4b, PID: 20208
android.os.BadParcelableException: Parcelable too small
	at android.system.keystore2.KeyDescriptor.readFromParcel(KeyDescriptor.java:45)
	at android.system.keystore2.KeyDescriptor$1.createFromParcel(KeyDescriptor.java:19)
	at android.system.keystore2.KeyDescriptor$1.createFromParcel(KeyDescriptor.java:15)
	at android.os.Parcel.readTypedObject(Parcel.java:4217)
	at android.os.Parcel.createTypedArray(Parcel.java:4178)
	at android.system.keystore2.IKeystoreService$Stub$Proxy.listEntriesBatched(IKeystoreService.java:489)
	at android.security.KeyStore2.lambda$listBatch$2(KeyStore2.java:188)
	at android.security.KeyStore2$$ExternalSyntheticLambda5.execute(D8$$SyntheticClass:0)
	at android.security.KeyStore2.handleRemoteExceptionWithRetry(KeyStore2.java:110)
	at android.security.KeyStore2.listBatch(KeyStore2.java:187)
	at android.security.keystore2.AndroidKeyStoreSpi.getAliasesBatch(AndroidKeyStoreSpi.java:1115)
	at android.security.keystore2.AndroidKeyStoreSpi.-$$Nest$mgetAliasesBatch(Unknown Source:0)
	at android.security.keystore2.AndroidKeyStoreSpi$KeyEntriesEnumerator.getAndValidateNextBatch(AndroidKeyStoreSpi.java:1335)
	at android.security.keystore2.AndroidKeyStoreSpi$KeyEntriesEnumerator.<init>(AndroidKeyStoreSpi.java:1331)
	at android.security.keystore2.AndroidKeyStoreSpi$KeyEntriesEnumerator.<init>(Unknown Source:0)
	at android.security.keystore2.AndroidKeyStoreSpi.engineAliases(AndroidKeyStoreSpi.java:1128)
	at java.security.KeyStore.aliases(KeyStore.java:1295)
	at X.12T.A02(:16)
	at X.12T.A01(:14)
	at X.12T.A06(:30)
	at X.0TK.A03(:47)
	at X.0TK.A01(:118)
	at X.0TK.A0D(:3)
	at X.0qd.handleMessage(:4625)
	at android.os.Handler.dispatchMessage(Handler.java:112)
	at android.os.Looper.loopOnce(Looper.java:268)
	at android.os.Looper.loop(Looper.java:384)
	at android.os.HandlerThread.run(HandlerThread.java:103)

Rebooting seems to fix the problem for now.

[wangdaning]

Any reason you have not put this in a PR?

I haven’t fully thought it through yet.

Fair enough. but it does work.

[christophe-95]

@kopijahe Could you try this commit, please?

https://github.com/XiaoTong6666/TEESimulator/actions/runs/20761135786

Hi, unfortunately it still not working here with this test build.

[XiaoTong6666]

@christophe-95 @kopijahe
Could you try this detector on your device?
APK: https://github.com/XiaoTong6666/KeyDetector/releases/latest
Thanks!

[christophe-95]

@XiaoTong6666 , here the result with your detector

[kopijahe]

@XiaoTong6666:

状态码:8192

IKeystoreService ListEntries Inconsistency (8192) containsAlias/aliases 不一致

Screenshot:

[XiaoTong6666]

oh no......
Which version are you using?

[kopijahe]

@XiaoTong6666: I'm still using TEESimulator-v3.0-43-b46c0fa-Release

Screenshot:

But it passed both Duck Detector v1.90 and Motorola built in checks, screenshots: