Tricky Store changes the certificate chain returned by Android key attestation for selected applications, with optional keybox, security-patch, and verified-boot configuration on Android 10 or later.
Selective Key-Attestation Control
Targets configured packages while leaving unrelated applications outside the module's certificate-chain handling.
Certificate Handling
Intercepts supported key-attestation results and returns a certificate chain according to the active mode and data.
Per-App Targets
Reads package names from a target file and accepts suffixes that select special handling for individual apps.
Patch Metadata
Can customize the system, boot, and vendor security-patch levels represented in attestation output.
How Tricky Store Is Applied
After installation and reboot, Tricky Store monitors key-attestation requests for packages named in /data/adb/tricky_store/target.txt. Changes to its principal configuration files are designed to take effect immediately, so target and metadata adjustments normally do not require reflashing the module.
On devices whose trusted execution environment cannot produce the expected chain, the module can fall back to generated-certificate mode. That fallback is a compatibility mechanism; it is not equivalent to an unrevoked hardware-backed keybox.
Configuration Files and Modes
| File or Marker | Purpose | Behavior |
|---|---|---|
target.txt | Lists application package names handled by the module. | One target is entered per line under /data/adb/tricky_store/. |
keybox.xml | Supplies an optional user-provided hardware keybox. | The keybox must be valid, properly formatted, and authorized for use. |
security_patch.txt | Defines system, boot, and vendor patch dates used in attestation. | These values affect attestation output; they do not update Android properties through resetprop. |
! suffix | Forces generated-certificate behavior for a selected target. | Use only when normal automatic handling is unsuitable. |
? suffix | Forces the documented leaf-certificate workaround. | This is another per-target exception rather than a universal default. |
Compatibility Boundaries
- Android 10 or later is required by the upstream project.
- A target application's server can apply policy beyond the local certificate chain, so a particular integrity result is never guaranteed.
- A keybox may expire, be revoked, be malformed, or be inappropriate for the device. Do not distribute private key material.
- From version 1.1.0 onward, the project is closed source. The public repository provides packages and documentation but not the current implementation source.