TEESimulator-RS Online by Andrea-lyz lets a bootloader-unlocked phone borrow the real hardware attestation of a bootloader-locked phone, over a relay server you host. It's built on Enginex0's TEESimulator-RS.
How the relay works
The unlocked phone (the Consumer) runs the module, which hooks generateKey calls in the keystore. When an app asks for key attestation, the module sends the public key and challenge through the relay to the locked phone (the Provider). The Provider signs it with its real TEE, producing a six-certificate chain rooted at Google's hardware attestation root, and the chain goes back into the Consumer's keystore response.
The relay is a small Rust WebSocket server. Connections are authenticated with a pre-shared key (PSK), TLS is recommended, and the server never sees private keys.
What it passes, and what it doesn't
- Passes: KeyAttestation by vvb2060, Duck Detector (tamper score of 8 or lower) and other local X.509 chain checks.
- Doesn't pass: Google Play Integrity. DroidGuard performs several keystore operations on the same key (generate, then sign, sign again). In v1.0 the private key only lives on the Provider, so the Consumer can't answer the later sign calls.
- A v2.0 that forwarded the whole keystore session was being designed when the project was archived.
Setup in short
- On a VPS, install the relay with the script in
OmegaRelay/vps/install.shand pick a PSK. - On the locked phone, install the Provider APK from the releases page and enter the relay URL, PSK and a device ID.
- On the unlocked phone, flash
TEESimulator-RS-v6.0.0-165-Release.zipwith KernelSU, Magisk or APatch and reboot. - Edit
/data/adb/modules/tricky_store/omega-relay.confon that phone (url,psk,device_id) and reboot again. - Check with the KeyAttestation app, and watch
adb logcat -s TEESimulator:Vfor relay messages.