Tricky Luke

📢 Join on Telegram → t.me/lukeprivacy

Keystore2 attestation module with the hardware KeyMint TEE proxy enabled. A fork of TrickyStore OSS — runs as a KernelSU / APatch / Magisk module.

Want to change Android identifiers? Check the LukePrivacy channel to get the best Android spoofer or custom Pixel kernels.

---

What it is

Tricky Luke intercepts keystore2 (android.system.keystore2) through a native libbinder ioctl hook injected into the keystore2 process, then repairs the key-attestation path so a rooted device presents a clean, consistent hardware-attestation certificate chain.

The key difference from a plain keybox spoof is the KeyMint TEE proxy (HardwareOperationProxy): non-attestation KeyMint operations keep running on the real hardware, so TEE-liveness checks stay green while only the attestation RootOfTrust is patched.

This module is attestation only — it has nothing to do with any network/traffic proxy. The only "proxy" here is HardwareOperationProxy, which proxies KeyMint operations.

Two modes, selected by /data/adb/tricky_store/tee_proxy:

mode	flag	behaviour
KeyMint TEE proxy (default)	tee_proxy absent or 1	HardwareOperationProxy wraps the real IKeystoreOperation; attestation leaf is re-signed via the keybox on top of the genuine hardware chain. Best result.
classic keybox	tee_proxy = 0	keybox leaf-hack only, no hardware proxy.

The mode is also chosen automatically per device: on start the module probes the TEE and writes tee_status (teeBroken=true/false); a working TEE ⇒ leaf-hack, a broken one ⇒ full software generation.

Changes vs upstream TrickyStore OSS

• Prop-first RootOfTrust (CertificateHack.kt / AndroidUtils.kt) — the verified-boot key and hash are read from ro.boot.vbmeta.public_key_digest / ro.boot.vbmeta.digest first (falling back to the cached TEE attestation, then to a persisted random value), so the RootOfTrust matches the device's real boot identity instead of a hardcoded one.
• Crypto warm-up (Main.kt) — a throwaway EC keygen / signer / cert build runs at startup to pre-warm the provider + JIT, moving that one-off cost off the first attestation (prevents a Play Integrity getSingleSnapshot timeout when the first attestation lands on the keystore2 callback thread).
• keystore2 threadpool fix (cpp/binder_interceptor.cpp) — bumps the binder thread pool (setThreadPoolMaxThreadCount + startThreadPool) to avoid a re-entrant callback deadlock.
• KeyMint TEE proxy on by default — Duck-green out of the box, no configuration.
• Luke Privacy WebUI (module/webroot/) + an Action button that opens the community link.

Architecture

app (dex + native)                     module (flashable)
├─ interceptors/                       ├─ customize.sh      installer (ABI, config, WebUI)
│  ├─ BinderInterceptor.kt   ─┐        ├─ service.sh        boot: waits system_server, runs daemon
│  ├─ cpp/binder_interceptor  ├ ioctl  ├─ daemon            app_process → MainKt
│  │                           hook    ├─ inject            ptrace injector into keystore2
│  ├─ Keystore2Interceptor.kt  intercepts getKeyEntry / generateKey / attestKey / …
│  ├─ SecurityLevelInterceptor.kt  installs HardwareOperationProxy on generate/attest
│  ├─ HardwareOperationProxy.kt  ← the KeyMint TEE proxy (real IKeystoreOperation)
│  └─ SoftwareOperationBinder.kt fallback when TEE is broken
├─ CertificateHack.kt        leaf-hack: rebuild RootOfTrust (green + locked) on the real chain
├─ AndroidUtils.kt           boot key/hash from props, boot-hash setup
└─ config/Config.kt          target scope, keybox reload, tee_status probe

Flow: service.sh starts daemon → app_process runs MainKt, which uses inject to place the libbinder ioctl hook inside keystore2. Intercepted attestation calls go through SecurityLevelInterceptor → HardwareOperationProxy (genuine hardware ops) and CertificateHack (RootOfTrust rebuilt: verifiedBootState = VERIFIED, deviceLocked = true, boot key/hash from the device), signed with the keybox.

Compatibility

Tricky Luke is a userspace keystore2 hook, not a kernel module — it is not tied to any specific kernel. It has been verified running on a stock-kernel Pixel with APatch, not only on custom kernels.

requirement	detail
Root (KernelSU / APatch / Magisk)	the real compatibility factor — see below
Android 12+	keystore2 path (S+); Android 10/11 fall back to the legacy keystore interceptor
Working TEE / KeyMint	present on every real device; a broken TEE auto-falls back to software generate mode
Architecture	arm64-v8a, armeabi-v7a, x86, x86_64 all shipped

Whether a specific kernel matters depends only on your root manager:

• Magisk — any device / any kernel (unlocked bootloader). No kernel requirement.
• APatch — any patchable arm64 kernel (patches the boot image; no source needed). Very wide.
• KernelSU — needs a kernel with KernelSU support (GKI, a custom KSU build, or LKM mode on some devices). This is the only case where the kernel matters.

Running is not the same as identical attestation everywhere:

• Genuine TEE KeyMint + attestation (Pixels, most flagships) → leaf-hack mode — real hardware chain, best result.
• Broken / software-only KeyMint → generate mode — keybox only, weaker.

The module detects the TEE per device (teeBroken) and picks the mode automatically — no config.

In short: works on virtually any rootable device, kernel-agnostic. The only kernel constraint is when you use KernelSU (then you need a KSU-capable kernel); on Magisk / APatch any kernel is fine.

Install

Flash the module zip in the KernelSU / APatch / Magisk manager (not recovery), reboot. Installs to /data/adb/modules/tricky_store; config lives at /data/adb/tricky_store/:

• keybox.xml — attestation keybox (change it via Tricky Addon or by replacing the file — see Keybox & target apps).
• target.txt — packages whose attestation is patched (one per line; a default set ships in the zip).
• tee_proxy — 0 disables the hardware proxy (absent/1 = enabled).

RootOfTrust values are read from the device at runtime, so the module works right after flashing.

Keybox & target apps

Configuration lives in /data/adb/tricky_store/ and can be managed two ways.

With Tricky Addon (recommended) — install the separate Tricky Addon – Update Target List module (by KOWX712). Its WebUI lets you change the keybox and edit the target app list from a UI, without touching files by hand.

Manually:

• Keybox — to use a different keybox, replace /data/adb/tricky_store/keybox.xml with your own (same XML format). The change is picked up live.
• Target apps — edit /data/adb/tricky_store/target.txt: one package name per line. These are the apps whose key attestation is patched. A default set ships in the zip; add or remove lines to fit your needs. Saved changes are reloaded automatically (a file watcher re-reads the list).

---

Based on TrickyStore OSS by beakthoven. Community: t.me/lukeprivacy

License

GPL-3.0-or-later — a strong copyleft ("viral") license. Because Tricky Luke is a derivative of GPL-3.0 TrickyStore OSS, this project and any redistribution must remain under GPL-3.0: full source must be provided and all downstream copies keep the same license. Upstream copyright and the NOTICE are retained. See LICENSE.