TEESimulator: Android Key Attestation Bypass Module

TEESimulator is a root module designed to bypass hardware-backed Key Attestation on Android devices. It runs a software KeyMint implementation directly inside the keystore daemon, serving selected apps with valid certificates using a provided keybox while leaving standard keys untouched.

I found that running AOSP's own KeyMint trusted application directly in-process clears up a lot of the usual detection headaches. You just assign a valid keybox to specific apps through the local WebUI, and it completely reshapes the attestation records on the fly without ever needing to reboot the phone.

• Native implementation: Runs the official AOSP kmr-ta to ensure attestation records match real device fields perfectly.
• Profile management: Group your keyboxes, OS patch levels, and targeted apps easily through a builtin WebUI.
• Hardware passthrough: Non-targeted applications continue using the actual physical TEE hardware for their security needs.
• Patch mode: The physical hardware still handles key generation, but the module re-signs the attestation data.
• Live updates: Any changes made to the configuration apply instantly over a local socket.

Support & Requirements

• Android 10 through 17
• 64-bit device architecture (arm64-v8a or x86_64)
• Root access via Magisk, KernelSU, or APatch

How to Install

1. Flash the TEESimulator .zip file through your root manager and reboot your device.
2. Place your valid keybox.xml file into the /data/adb/teesim/ directory.
3. Open the WebUI or edit config.json to assign target apps to your profile, and save the changes.

For users testing app security or needing to pass strict attestation checks, having a reliable way to inject a custom hardware keybox is highly requested. Because TEESimulator 4.0 moved away from faking hardware backends and instead utilizes a genuine software KeyMint, it handles modern conformance scanners far better than legacy patching methods while providing permanent local key storage.