Static hooking for key attestation

[IndiTheo]

Hello dear @JingMatrix,

Thank you for your awesome projects! I've been recently thinking of rootless modding, and I wonder if TEESimulator may be included in a statically hooked (LSPatch/Morphe) app. As having a leaked key means we can forge the attestation responses in userspace, it looks like we can reroute the TEE calls to our module/another userspace service that owns the key. The only problem is finding the exact call sites and replacing them with a call to our service.

Does the math work here and is obfuscation our main enemy, or is there some inherent blocker?

Thank you for any thoughts