Skip to content

Commit 075b017

Browse files
jqssunjqssun
committed
add info
1 parent 4b50be8 commit 075b017

File tree

4 files changed

+148
-9
lines changed

4 files changed

+148
-9
lines changed

‎.github/workflows/apk.yml‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
# https://github.com/marketplace/actions/automated-build-android-app-with-github-action
2+
# https://github.com/marketplace/actions/publish-release
3+
4+
name: Generate APK
5+
6+
env:
7+
main_project_module: app
8+
target_owner: Xposed-Modules-Repo
9+
target_repo: io.github.jqssun.seaccess
10+
target_path: target_path
11+
12+
on:
13+
push:
14+
branches:
15+
- 'release/**'
16+
tags:
17+
- 'v*.*.*'
18+
workflow_dispatch:
19+
inputs:
20+
version:
21+
description: 'v*.*.*'
22+
required: true
23+
type: string
24+
# schedule:
25+
# - cron: '0 0 1 */2 *'
26+
27+
jobs:
28+
build:
29+
runs-on: ubuntu-latest
30+
steps:
31+
- uses: actions/checkout@v4
32+
33+
- name: Set TAG
34+
if: github.event_name == 'push'
35+
run: |
36+
echo "version=$(echo '${{ github.ref_name }}' | awk -F 'v' '{print $2}')" >> $GITHUB_ENV
37+
38+
- name: Set TAG
39+
if: github.event_name == 'workflow_dispatch'
40+
run: |
41+
echo "version=$(echo '${{ inputs.version }}' | awk -F 'v' '{print $2}')" >> $GITHUB_ENV
42+
43+
- name: Set ENV
44+
run: |
45+
echo "date_today=$(date +'%Y-%m-%d')" >> $GITHUB_ENV;
46+
echo "repository_name=$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')" >> $GITHUB_ENV
47+
48+
- name: Use JDK
49+
uses: actions/setup-java@v4
50+
with:
51+
distribution: 'zulu'
52+
java-version: '17' # 21
53+
cache: 'gradle'
54+
55+
- name: Build
56+
run: |
57+
echo ${{ secrets.STORE }} | base64 -d > upload.jks
58+
echo ${{ secrets.LOCAL }} | base64 -d > local.properties
59+
chmod +x ./gradlew;
60+
./gradlew assembleRelease --stacktrace
61+
rm upload.jks local.properties
62+
63+
- name: Publish (GitHub)
64+
uses: softprops/action-gh-release@v2
65+
with:
66+
token: ${{ secrets.GITHUB_TOKEN }}
67+
name: v${{ env.version }}
68+
tag_name: v${{ env.version }}
69+
files: |
70+
${{ env.main_project_module }}/build/outputs/apk/release/app-release.apk
71+
72+
- name: Publish (Xposed)
73+
uses: softprops/action-gh-release@v2
74+
with:
75+
token: ${{ secrets.PAT }}
76+
repository: ${{ env.target_owner }}/${{ env.target_repo }}
77+
name: v${{ env.version }}
78+
tag_name: v${{ env.version }}
79+
files: |
80+
${{ env.main_project_module }}/build/outputs/apk/release/app-release.apk
81+
82+
- name: Checkout
83+
uses: actions/checkout@v4
84+
with:
85+
repository: ${{ env.target_owner }}/${{ env.target_repo }}
86+
path: ${{ env.target_path }}
87+
token: ${{ secrets.PAT }}
88+
89+
- name: Sync
90+
run: |
91+
cd ${{ env.target_path }}
92+
cp ../README.md ../LICENSE .
93+
git config --global user.name 'github-actions[bot]'
94+
git config --global user.email 'github-actions[bot]@users.noreply.github.com'
95+
git add README.md
96+
git add LICENSE
97+
git commit --amend --no-edit
98+
git push --force

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
*.iml
2+
*.jks
23
.DS_Store
34
.cxx
45
.externalNativeBuild

‎README.md‎

Lines changed: 36 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,39 @@
1-
# OMAPI Bypass
1+
# Secure Element Access
22

3-
**USE AT YOUR OWN RISK**
4-
**Need Xposed**
5-
Bypass ARA,ARF limit in `AccessControlEnforcer` and grant FullAccess.
3+
[![Stars](https://img.shields.io/github/stars/jqssun/android-se-access)](https://github.com/jqssun/android-se-access/stargazers)
4+
[![LSPosed](https://img.shields.io/github/downloads/Xposed-Modules-Repo/io.github.jqssun.seaccess/total?label=LSPosed&logo=Android&style=flat&labelColor=F48FB1&logoColor=ffffff)](https://github.com/Xposed-Modules-Repo/io.github.jqssun.seaccess/releases)
5+
[![GitHub](https://img.shields.io/github/downloads/jqssun/android-se-access/total?label=GitHub&logo=GitHub)](https://github.com/jqssun/android-se-access/releases)
6+
[![release](https://img.shields.io/github/v/release/jqssun/android-se-access)](https://github.com/jqssun/android-se-access/releases)
7+
[![build](https://img.shields.io/github/actions/workflow/status/jqssun/android-se-access/apk.yml)](https://github.com/jqssun/android-se-access/actions/workflows/apk.yml)
8+
[![license](https://img.shields.io/github/license/jqssun/android-se-access)](https://github.com/jqssun/android-se-access/blob/master/LICENSE)
9+
[![issues](https://img.shields.io/github/issues/jqssun/android-se-access)](https://github.com/jqssun/android-se-access/issues)
10+
11+
A module to explicitly give trusted apps access to the secure element (eSE) by using a safer application ID based implementation, regardless of the ARF configuration on the eUICC.
612

7-
**How it works**
8-
It hooks `com.android.se.security.AccessControlEnforcer.readSecurityProfile`, disables `mUseArf` and `mUseAra`, and grants `mFullAccess`.
9-
Note: You may need to kill `com.android.se` by running `su -c killall com.android.se` in adb shell to activate it.
13+
## Compatibility
14+
15+
- Android 10+
16+
- Rooted devices with Xposed framework installed (e.g. LSPosed)
17+
- Access can be granted to any of the following Local Profile Assistant (LPA) apps:
18+
- (OEM) [com.google.android.euicc](https://play.google.com/store/apps/details?id=com.google.android.euicc)
19+
- (FOSS) [chat.jmp.simmanager](https://f-droid.org/sq/packages/chat.jmp.simmanager/)
20+
- (FOSS) [im.angry.easyeuicc](https://gitea.angry.im/PeterCxy/OpenEUICC)
21+
22+
## Implementation
23+
24+
On Android, eUICC APIs are by default restricted to whitelisted apps. This makes sense because most eUICC chips are integrated to the device. If someone wants to access the chip, say for instance to provision a profile, they generally need to do so through a [Local Profile Assistant (LPA) app](https://source.android.com/docs/core/connect/esim-overview#making_an_lpa_app), which can either be
25+
- [a system app that provides EuiccService](https://source.android.com/docs/core/connect/esim-overview#making_an_lpa_app) (in the case of an integrated eUICC), or
26+
- [a carrier app signed by a certificate](https://source.android.com/docs/core/connect/uicc#arf) whose hashes match the [ARF/ACCF stored in the eUICC](https://source.android.com/docs/core/connect/uicc#validation)
27+
28+
In the case of a removable eSIM (such as those from [sysmocom](https://sysmocom.de/products/sim/sysmocom-euicc/), [estk.me](https://www.estk.me/) or [esim.me](https://esim.me/)), the options are limited as they do not have control over device firmware. Users also have to rely heavily on carrier support for their apps as the ARF is baked into the eUICC itself.
29+
30+
However, there is a caveat. Probably to faciliate Android vendor testing, full access to the eUICC can _also_ be granted if the ROM firmware is built with a debuggable flag, i.e. `ro.debuggable=1`, whilst configured to accept all channel access requests, `persist.service.seek=fullaccess`. Effectively, this translates to setting `mUseAra` and `mUseArf` fields to false while granting `mFullAccess` in `com.android.se.security.AccessControlEnforcer` according to [the sources](https://android.googlesource.com/platform/packages/apps/SecureElement/+/refs/heads/main/src/com/android/se/security/AccessControlEnforcer.java).
31+
32+
A previous version of this module enables eSE access to third-party apps by exactly patching these 3 flags in `AccessControlEnforcer`. However the approach is more of a one-size-fits-all solution that does not disciminate potentially malicious apps from legitimate ones, posing a significant risk when enabled.
33+
34+
Tracing [the source code](https://android.googlesource.com/platform/packages/apps/SecureElement/+/refs/heads/master/src/com/android/se/Terminal.java) to see how access can be more granularly provided, I found that app eligibility eventually comes down to the check at `isPrivilegedApplication` method in `com.android.se.Terminal`. There is no need to touch `AccessControlEnforcer` at all, as the check directly operates on one of the default steps intended for carrier applications.
35+
36+
Therefore, this module instead modifies the response there without any drastic changes in terms of how `AccessControlEnforcer` behaves. Of course, it is also possible to be even more specific with the patching, down to the exact application signature rather than using application ID, but this may be a bit more cumbersome to support and maintain.
37+
38+
For users that are still not entirely convinced with how secure this is, you are welcome to cut down the list even further and include your own application ID in your build. Since Android by default does not allow app signatures to be overwritten duing updates, you should be protected so long as your custom LPA app is signed properly 👍
1039

11-
Logcat TAG: `SecureElementAccess`
12-
see: [AccessControlEnforcer.java](https://cs.android.com/android/platform/superproject/main/+/main:packages/apps/SecureElement/src/com/android/se/security/AccessControlEnforcer.java;l=129)

‎app/build.gradle‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,26 @@ android {
1212
targetSdk 35
1313
versionCode 1
1414
versionName "0.0.1"
15+
}
16+
17+
signingConfigs {
18+
release {
19+
def keystorePropertiesFile = rootProject.file("local.properties")
20+
def keystoreProperties = new Properties()
21+
keystoreProperties.load(new FileInputStream(keystorePropertiesFile))
1522

23+
keyAlias keystoreProperties['keyAlias']
24+
keyPassword keystoreProperties['keyPassword']
25+
storeFile file(keystoreProperties['storeFile'])
26+
storePassword keystoreProperties['storePassword']
27+
}
1628
}
1729

1830
buildTypes {
1931
release {
2032
minifyEnabled true
2133
proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
34+
signingConfig signingConfigs.release
2235
}
2336
}
2437

0 commit comments

Comments
 (0)