recovery: derive KeyMint identity from installed ROM
This commit is contained in:
Nicholas Andrew
parent
97fb7344d5
commit
736ed51710
4 changed files with 196 additions and 15 deletions
|
|
@ -38,9 +38,6 @@ service rtwo-crypto-identity /system/bin/rtwo-crypto-identity.sh
|
|||
oneshot
|
||||
seclabel u:r:recovery:s0
|
||||
|
||||
on early-init
|
||||
exec_start rtwo-crypto-identity
|
||||
|
||||
on init
|
||||
setprop twrp.defer.decrypt false
|
||||
# to cut charging battery path
|
||||
|
|
@ -48,6 +45,9 @@ on init
|
|||
setprop prepdecrypt.setpatch false
|
||||
setprop sys.usb.configfs 1
|
||||
|
||||
on early-init
|
||||
start rtwo-crypto-identity
|
||||
|
||||
on fs
|
||||
wait /dev/block/platform/soc/${ro.boot.bootdevice}
|
||||
symlink /dev/block/platform/soc/${ro.boot.bootdevice} /dev/block/bootdevice
|
||||
|
|
|
|||
|
|
@ -2,18 +2,199 @@
|
|||
# BOBtheBlinker
|
||||
# Copyright (C) 2019-Present A-Team Digital Solutions
|
||||
#
|
||||
# Diagnostic identity matching Motorola stock Android 15:
|
||||
# V1TRS35H.60-33-5-16-3, security patch 2026-05-01.
|
||||
# Load the installed ROM identity before Qualcomm KeyMint starts.
|
||||
# KeyMint binds storage keys to the Android and vendor patch levels.
|
||||
|
||||
resetprop ro.build.version.release 15
|
||||
resetprop ro.build.version.sdk 35
|
||||
resetprop ro.build.version.security_patch 2026-05-01
|
||||
LOG=/tmp/rtwo-crypto-identity.log
|
||||
|
||||
resetprop ro.vendor.build.version.release 15
|
||||
resetprop ro.vendor.build.version.sdk 35
|
||||
resetprop ro.vendor.build.security_patch 2026-05-01
|
||||
SYSTEM_DEVICE=/dev/block/mapper/system
|
||||
VENDOR_DEVICE=/dev/block/mapper/vendor
|
||||
|
||||
resetprop ro.product.first_api_level 33
|
||||
resetprop ro.board.first_api_level 33
|
||||
SYSTEM_MOUNT=/tmp/rtwo-system
|
||||
VENDOR_MOUNT=/tmp/rtwo-vendor
|
||||
|
||||
log_message() {
|
||||
MESSAGE="rtwo-crypto-identity: $*"
|
||||
echo "$MESSAGE" >> "$LOG"
|
||||
echo "<6>$MESSAGE" > /dev/kmsg 2>/dev/null
|
||||
}
|
||||
|
||||
mount_readonly() {
|
||||
DEVICE="$1"
|
||||
TARGET="$2"
|
||||
NAME="$3"
|
||||
|
||||
mkdir -p "$TARGET"
|
||||
umount "$TARGET" 2>/dev/null
|
||||
|
||||
for TYPE in erofs ext4; do
|
||||
if mount -t "$TYPE" -o ro "$DEVICE" "$TARGET" 2>/dev/null; then
|
||||
log_message "mounted $NAME as $TYPE"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
|
||||
if mount -o ro "$DEVICE" "$TARGET" 2>/dev/null; then
|
||||
log_message "mounted $NAME with automatic detection"
|
||||
return 0
|
||||
fi
|
||||
|
||||
log_message "ERROR: unable to mount $NAME from $DEVICE"
|
||||
return 1
|
||||
}
|
||||
|
||||
read_property() {
|
||||
PROPERTY="$1"
|
||||
shift
|
||||
|
||||
for FILE in "$@"; do
|
||||
[ -r "$FILE" ] || continue
|
||||
|
||||
while IFS= read -r LINE; do
|
||||
case "$LINE" in
|
||||
"$PROPERTY"=*)
|
||||
printf '%s' "${LINE#*=}"
|
||||
return 0
|
||||
;;
|
||||
esac
|
||||
done < "$FILE"
|
||||
done
|
||||
|
||||
return 1
|
||||
}
|
||||
|
||||
cleanup_mounts() {
|
||||
umount "$VENDOR_MOUNT" 2>/dev/null
|
||||
umount "$SYSTEM_MOUNT" 2>/dev/null
|
||||
}
|
||||
|
||||
rm -f "$LOG"
|
||||
|
||||
setprop sys.rtwo.crypto_identity.ready 0
|
||||
setprop sys.rtwo.crypto_identity.failed 0
|
||||
|
||||
log_message "waiting for logical system/vendor mappings"
|
||||
|
||||
ATTEMPT=0
|
||||
|
||||
while [ "$ATTEMPT" -lt 60 ]; do
|
||||
if [ -e "$SYSTEM_DEVICE" ] && [ -e "$VENDOR_DEVICE" ]; then
|
||||
break
|
||||
fi
|
||||
|
||||
ATTEMPT=$((ATTEMPT + 1))
|
||||
sleep 1
|
||||
done
|
||||
|
||||
if [ ! -e "$SYSTEM_DEVICE" ] || [ ! -e "$VENDOR_DEVICE" ]; then
|
||||
log_message "ERROR: logical system/vendor mappings unavailable"
|
||||
setprop sys.rtwo.crypto_identity.failed 1
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! mount_readonly "$SYSTEM_DEVICE" "$SYSTEM_MOUNT" system; then
|
||||
cleanup_mounts
|
||||
setprop sys.rtwo.crypto_identity.failed 1
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! mount_readonly "$VENDOR_DEVICE" "$VENDOR_MOUNT" vendor; then
|
||||
cleanup_mounts
|
||||
setprop sys.rtwo.crypto_identity.failed 1
|
||||
exit 1
|
||||
fi
|
||||
|
||||
SYSTEM_FILES="
|
||||
$SYSTEM_MOUNT/system/build.prop
|
||||
$SYSTEM_MOUNT/build.prop
|
||||
"
|
||||
|
||||
VENDOR_FILES="
|
||||
$VENDOR_MOUNT/build.prop
|
||||
$VENDOR_MOUNT/etc/build.prop
|
||||
"
|
||||
|
||||
ALL_FILES="$SYSTEM_FILES $VENDOR_FILES"
|
||||
|
||||
OS_RELEASE="$(read_property ro.build.version.release $SYSTEM_FILES)"
|
||||
OS_SDK="$(read_property ro.build.version.sdk $SYSTEM_FILES)"
|
||||
OS_PATCH="$(read_property ro.build.version.security_patch $SYSTEM_FILES)"
|
||||
|
||||
VENDOR_RELEASE="$(
|
||||
read_property ro.vendor.build.version.release $VENDOR_FILES
|
||||
)"
|
||||
VENDOR_SDK="$(
|
||||
read_property ro.vendor.build.version.sdk $VENDOR_FILES
|
||||
)"
|
||||
VENDOR_PATCH="$(
|
||||
read_property ro.vendor.build.security_patch $VENDOR_FILES
|
||||
)"
|
||||
|
||||
BOOT_PATCH="$(
|
||||
read_property ro.bootimage.build.version.security_patch $ALL_FILES
|
||||
)"
|
||||
|
||||
VENDOR_BOOT_PATCH="$(
|
||||
read_property ro.vendor.boot_security_patch $ALL_FILES
|
||||
)"
|
||||
|
||||
FIRST_API="$(
|
||||
read_property ro.product.first_api_level $ALL_FILES
|
||||
)"
|
||||
|
||||
BOARD_FIRST_API="$(
|
||||
read_property ro.board.first_api_level $ALL_FILES
|
||||
)"
|
||||
|
||||
cleanup_mounts
|
||||
|
||||
if [ -z "$OS_RELEASE" ] ||
|
||||
[ -z "$OS_SDK" ] ||
|
||||
[ -z "$OS_PATCH" ] ||
|
||||
[ -z "$VENDOR_RELEASE" ] ||
|
||||
[ -z "$VENDOR_SDK" ] ||
|
||||
[ -z "$VENDOR_PATCH" ]; then
|
||||
|
||||
log_message "ERROR: installed ROM identity is incomplete"
|
||||
log_message "OS_RELEASE=${OS_RELEASE:-missing}"
|
||||
log_message "OS_SDK=${OS_SDK:-missing}"
|
||||
log_message "OS_PATCH=${OS_PATCH:-missing}"
|
||||
log_message "VENDOR_RELEASE=${VENDOR_RELEASE:-missing}"
|
||||
log_message "VENDOR_SDK=${VENDOR_SDK:-missing}"
|
||||
log_message "VENDOR_PATCH=${VENDOR_PATCH:-missing}"
|
||||
|
||||
setprop sys.rtwo.crypto_identity.failed 1
|
||||
exit 1
|
||||
fi
|
||||
|
||||
[ -n "$FIRST_API" ] || FIRST_API=33
|
||||
[ -n "$BOARD_FIRST_API" ] || BOARD_FIRST_API=33
|
||||
|
||||
resetprop ro.build.version.release "$OS_RELEASE"
|
||||
resetprop ro.build.version.sdk "$OS_SDK"
|
||||
resetprop ro.build.version.security_patch "$OS_PATCH"
|
||||
|
||||
resetprop ro.vendor.build.version.release "$VENDOR_RELEASE"
|
||||
resetprop ro.vendor.build.version.sdk "$VENDOR_SDK"
|
||||
resetprop ro.vendor.build.security_patch "$VENDOR_PATCH"
|
||||
|
||||
if [ -n "$BOOT_PATCH" ]; then
|
||||
resetprop ro.bootimage.build.version.security_patch "$BOOT_PATCH"
|
||||
fi
|
||||
|
||||
if [ -n "$VENDOR_BOOT_PATCH" ]; then
|
||||
resetprop ro.vendor.boot_security_patch "$VENDOR_BOOT_PATCH"
|
||||
fi
|
||||
|
||||
resetprop ro.product.first_api_level "$FIRST_API"
|
||||
resetprop ro.board.first_api_level "$BOARD_FIRST_API"
|
||||
resetprop ro.crypto.type file
|
||||
|
||||
log_message \
|
||||
"loaded system=${OS_RELEASE}/SDK${OS_SDK}/SPL${OS_PATCH}"
|
||||
|
||||
log_message \
|
||||
"loaded vendor=${VENDOR_RELEASE}/SDK${VENDOR_SDK}/SPL${VENDOR_PATCH}"
|
||||
|
||||
setprop sys.rtwo.crypto_identity.ready 1
|
||||
exit 0
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
# Copyright (C) 2019-Present A-Team Digital Solutions
|
||||
|
||||
on init
|
||||
on property:sys.rtwo.crypto_identity.ready=1
|
||||
start vendor.keymaster-sb-4-0
|
||||
|
||||
service vendor.keymaster-sb-4-0 /system/bin/android.hardware.keymaster@4.0-strongbox-service-qti
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
on init
|
||||
on property:sys.rtwo.crypto_identity.ready=1
|
||||
start vendor.keymint-qti
|
||||
|
||||
service vendor.keymint-qti /system/bin/android.hardware.security.keymint-service-qti
|
||||
|
|
|
|||
Loading…
Reference in a new issue