Skip to content

fix: restrict UID spoofing exclusively to the TEESimulator daemon to prevent root process crashes #42

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
aartzz wants to merge 2 commits into
base: main
Choose a base branch
from
+16 −8
Open

fix: restrict UID spoofing exclusively to the TEESimulator daemon to prevent root process crashes #42

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
11809cf
fix(native): restrict UID spoofing exclusively to the TEESimulator da…
aartzz Jul 12, 2026
2f08509
chore(release): bump update.json to v6.0.1-304 [skip ci]
github-actions[bot] Jul 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 14 additions & 6 deletions app/src/main/cpp/binder_interceptor.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,10 @@ int (*g_original_ioctl)(int fd, int request, ...) = nullptr;
// Unique ID generator for transactions
static std::atomic<uint64_t> g_transaction_id_counter = 0;

// TEESimulator daemon PID
static std::atomic<pid_t> g_daemon_pid = 0;


// Context info to pass from the ioctl hook (processBinderWriteRead) to the BinderStub.
struct ThreadTransactionInfo {
uint64_t transaction_id;
Expand Down Expand Up @@ -368,13 +372,17 @@ void inspectAndRewriteTransaction(binder_transaction_data *txn_data) {
info.transaction_code = intercept::kBackdoorCode;
info.target_binder = nullptr;
hijack = true;
// Check 2: Spoof uid of KeyStore requests from the daemon to bypass permission check
// Save the daemon's PID
g_daemon_pid = txn_data->sender_pid;
// Check 2: Bypass interception for root requests, but spoof UID for the daemon
} else if (txn_data->sender_euid == 0) {
// The kernel driver fills sender_euid.
// libbinder.so trusts this value to populate IPCThreadState.
txn_data->sender_euid = 1000;
LOGV("[Hook] Spoofing UID for transaction: 0 -> %d", txn_data->sender_euid);
hijack = false; // Never hijack to avoid recursion
if (txn_data->sender_pid == g_daemon_pid) {
// The kernel driver fills sender_euid.
// libbinder.so trusts this value to populate IPCThreadState.
txn_data->sender_euid = 1000;
LOGV("[Hook] Spoofing UID for transaction: 0 -> %d", txn_data->sender_euid);
}
hijack = false; // Never hijack root processes (vold, init, cameraserver) to avoid recursion and bootloops
Comment on lines +375 to +385

@coderabbitai coderabbitai Bot Jul 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Search for any code that resets or clears g_daemon_pid
rg -n 'g_daemon_pid' app/src/main/cpp/

Repository: Enginex0/TEESimulator-RS

Length of output: 435

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== binder_interceptor.cpp around the g_daemon_pid logic =="
sed -n '200,410p' app/src/main/cpp/binder_interceptor.cpp

echo
echo "== Search for daemon lifecycle / cleanup / unregister paths =="
rg -n 'g_daemon_pid|unregister|unregister.*daemon|death|linkToDeath|unlinkToDeath|cleanup|reset.*pid|pid.*reset|daemon.*die|TEESimulator|mount\(' app/src/main/cpp/ app/src/main/ -S

Repository: Enginex0/TEESimulator-RS

Length of output: 48360

Reset g_daemon_pid on daemon death. g_daemon_pid is only set during the backdoor handshake and never cleared, so a recycled PID could cause unrelated root transactions to get spoofed to UID 1000. Clear it on teardown or add a liveness check before spoofing.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@app/src/main/cpp/binder_interceptor.cpp` around lines 375 - 385, The daemon
PID state in the binder interception flow is never invalidated after daemon
termination. Update the teardown path associated with the backdoor handshake to
reset g_daemon_pid when the daemon exits, or validate that the recorded PID is
still the live daemon before the sender_euid spoofing branch uses it; ensure
recycled PIDs cannot trigger UID 1000 spoofing.

// Check 3: Normal interception based on registry of monitored binders
} else {
// Safe casting based on Binder driver ABI
Expand Down
4 changes: 2 additions & 2 deletions module/update.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"version": "v6.0.1-307",
"versionCode": 307,
"zipUrl": "https://github.com/Enginex0/TEESimulator-RS/releases/download/v6.0.1-307/TEESimulator-RS-v6.0.1-307-Release.zip",
"versionCode": 304,
"zipUrl": "https://github.com/aartzz/TEESimulator-RS/releases/download/v6.0.1-304/TEESimulator-RS-v6.0.1-309-Release.zip",
Comment on lines +3 to +4

@coderabbitai coderabbitai Bot Jul 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== files ==\n'
git ls-files 'module/update.json' 'app/build.gradle.kts' || true

printf '\n== module/update.json ==\n'
if [ -f module/update.json ]; then
  cat -n module/update.json
fi

printf '\n== app/build.gradle.kts outline ==\n'
if [ -f app/build.gradle.kts ]; then
  ast-grep outline app/build.gradle.kts --view expanded || true
fi

printf '\n== search for version/tag/url generation ==\n'
rg -n --no-heading -S 'versionCode|zipUrl|version|release|download|aartzz|Enginex0|TEESimulator-RS' app/build.gradle.kts module/update.json . || true

Repository: Enginex0/TEESimulator-RS

Length of output: 47406

Regenerate module/update.json from the packaging workflow

version, versionCode, and zipUrl are out of sync here: the JSON mixes v6.0.1-307, 304, aartzz, and v6.0.1-309. That can make update checks treat the release as a downgrade or point users at the wrong artifact. app/build.gradle.kts already writes this file from the canonical release metadata, so update this file through that pipeline instead of editing the fields separately.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@module/update.json` around lines 3 - 4, Regenerate module/update.json using
the packaging workflow driven by app/build.gradle.kts, rather than editing its
fields individually. Ensure the generated version, versionCode, and zipUrl
consistently use the same canonical release metadata and artifact.

"changelog": "https://raw.githubusercontent.com/Enginex0/TEESimulator-RS/main/module/changelog.md"
}