Initial commit

.gitattributes

@@ -0,0 +1,2 @@
+# Auto detect text files and perform LF normalization
+* text=auto

.gitignore

@@ -0,0 +1,30 @@
+# Gradle files
+.gradle/
+build/
+
+# Local configuration file (sdk path, etc)
+local.properties
+
+# Log/OS Files
+*.log
+
+# Android Studio generated files and folders
+captures/
+.externalNativeBuild/
+.cxx/
+*.apk
+output.json
+
+# IntelliJ
+*.iml
+.idea/
+
+# Keystore files
+*.jks
+*.keystore
+
+# Google Services (e.g. APIs or Firebase)
+google-services.json
+
+# Android Profiling
+*.hprof

README.md

@@ -0,0 +1,2 @@
+# BootloaderSpoofer
+ Spoof locked bootloader on local attestations

app/build.gradle

@@ -0,0 +1,36 @@
+plugins {
+    id 'com.android.application'
+}
+
+android {
+    namespace 'es.chiteroman.bootloaderspoofer'
+    compileSdk 34
+
+    defaultConfig {
+        applicationId "es.chiteroman.bootloaderspoofer"
+        minSdk 24
+        targetSdk 34
+        versionCode 3
+        versionName '1.2'
+        multiDexEnabled false
+    }
+
+    buildTypes {
+        release {
+            minifyEnabled true
+            shrinkResources true
+            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
+            signingConfig signingConfigs.debug
+            multiDexEnabled false
+        }
+    }
+    compileOptions {
+        sourceCompatibility JavaVersion.VERSION_17
+        targetCompatibility JavaVersion.VERSION_17
+    }
+    buildToolsVersion '34.0.0'
+}
+
+dependencies {
+    compileOnly 'de.robv.android.xposed:api:82'
+}

app/proguard-rules.pro

@@ -0,0 +1 @@
+-keep class es.chiteroman.bootloaderspoofer.Xposed {public <methods>;}

app/src/main/AndroidManifest.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android"
+    xmlns:tools="http://schemas.android.com/tools"
+    android:versionCode="1"
+    android:versionName="1.0">
+
+    <application
+        android:label="@string/app_name"
+        tools:ignore="MissingApplicationIcon">
+        <meta-data
+            android:name="xposedmodule"
+            android:value="true" />
+        <meta-data
+            android:name="xposeddescription"
+            android:value="Spoof a locked bootloader in local attestations" />
+        <meta-data
+            android:name="xposedminversion"
+            android:value="82" />
+        <meta-data
+            android:name="xposedscope"
+            android:resource="@array/scope" />
+    </application>
+</manifest>

app/src/main/assets/xposed_init

@@ -0,0 +1 @@
+es.chiteroman.bootloaderspoofer.Xposed

app/src/main/java/es/chiteroman/bootloaderspoofer/Xposed.java

@@ -0,0 +1,68 @@
+package es.chiteroman.bootloaderspoofer;
+
+import java.io.ByteArrayInputStream;
+import java.lang.reflect.Method;
+import java.security.KeyStore;
+import java.security.KeyStoreSpi;
+import java.security.cert.Certificate;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.util.Locale;
+
+import de.robv.android.xposed.IXposedHookLoadPackage;
+import de.robv.android.xposed.XC_MethodHook;
+import de.robv.android.xposed.XC_MethodReplacement;
+import de.robv.android.xposed.XposedBridge;
+import de.robv.android.xposed.XposedHelpers;
+import de.robv.android.xposed.callbacks.XC_LoadPackage;
+
+public class Xposed implements IXposedHookLoadPackage {
+    private static int indexOf(byte[] array) {
+        final byte[] PATTERN = {48, 74, 4, 32, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 1, 0, 10, 1, 2};
+        outer:
+        for (int i = 0; i < array.length - PATTERN.length + 1; i++) {
+            for (int j = 0; j < PATTERN.length; j++) {
+                if (array[i + j] != PATTERN[j]) {
+                    continue outer;
+                }
+            }
+            return i;
+        }
+        return -1;
+    }
+
+    @Override
+    public void handleLoadPackage(XC_LoadPackage.LoadPackageParam lpparam) {
+        try {
+            KeyStore keyStore = KeyStore.getInstance("AndroidKeyStore");
+            KeyStoreSpi keyStoreSpi = (KeyStoreSpi) XposedHelpers.getObjectField(keyStore, "keyStoreSpi");
+            XposedHelpers.findAndHookMethod(keyStoreSpi.getClass(), "engineGetCertificateChain", String.class, new XC_MethodHook() {
+                @Override
+                protected void afterHookedMethod(MethodHookParam param) throws Throwable {
+                    Certificate[] certificates = (Certificate[]) param.getResultOrThrowable();
+                    if (certificates[0] instanceof X509Certificate cert) {
+
+                        for (Method method : cert.getClass().getMethods()) {
+                            if (method.getName().toLowerCase(Locale.ROOT).contains("verify")) {
+                                XposedBridge.hookMethod(method, XC_MethodReplacement.DO_NOTHING);
+                            }
+                        }
+
+                        byte[] bytes = cert.getEncoded();
+                        if (bytes == null || bytes.length == 0) return;
+                        int index = indexOf(bytes);
+                        if (index == -1) return;
+                        bytes[index + 38] = 1;
+                        bytes[index + 41] = 0;
+                        CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
+                        X509Certificate modCert = (X509Certificate) certFactory.generateCertificate(new ByteArrayInputStream(bytes));
+                        certificates[0] = modCert;
+                        param.setResult(certificates);
+                    }
+                }
+            });
+        } catch (Throwable t) {
+            XposedBridge.log(t);
+        }
+    }
+}

app/src/main/res/values/arrays.xml

@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string-array name="scope">
+        <item>io.github.vvb2060.keyattestation</item>
+        <item>com.CIB.Digital.MB</item>
+    </string-array>
+</resources>

app/src/main/res/values/strings.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="app_name">BootloaderSpoofer</string>
+</resources>

build.gradle

@@ -0,0 +1,9 @@
+buildscript {
+    ext {
+        agp_version = '8.1.1'
+    }
+}// Top-level build file where you can add configuration options common to all sub-projects/modules.
+plugins {
+    id 'com.android.application' version '8.1.1' apply false
+    id 'com.android.library' version '8.0.2' apply false
+}

gradle.properties

@@ -0,0 +1,21 @@
+# Project-wide Gradle settings.
+# IDE (e.g. Android Studio) users:
+# Gradle settings configured through the IDE *will override*
+# any settings specified in this file.
+# For more details on how to configure your build environment visit
+# http://www.gradle.org/docs/current/userguide/build_environment.html
+# Specifies the JVM arguments used for the daemon process.
+# The setting is particularly useful for tweaking memory settings.
+org.gradle.jvmargs=-Xmx2048m -Dfile.encoding=UTF-8
+# When configured, Gradle will run in incubating parallel mode.
+# This option should only be used with decoupled projects. More details, visit
+# http://www.gradle.org/docs/current/userguide/multi_project_builds.html#sec:decoupled_projects
+# org.gradle.parallel=true
+# AndroidX package structure to make it clearer which packages are bundled with the
+# Android operating system, and which are packaged with your app's APK
+# https://developer.android.com/topic/libraries/support-library/androidx-rn
+android.useAndroidX=true
+# Enables namespacing of each library's R class so that its R class includes only the
+# resources declared in the library itself and none from the library's dependencies,
+# thereby reducing the size of the R class for that library
+android.nonTransitiveRClass=true

gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,6 @@
+#Mon Sep 18 16:40:53 CEST 2023
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists