TEESimulator is a system-level Android root tool that intercepts and replaces hardware-backed key attestation for selected apps. It injects native libraries into the keystore daemon (keystore2 on Android 12+, keystore on 10/11) via ptrace, hooks Binder transactions, and routes KeyMint requests to an in-process Rust TA that implements AOSP's kmr-ta with BoringSSL. A Kotlin daemon runs as root, manages profiles (keybox, mode, device identity, patch levels), harvests real device parameters, and provides a WebUI for configuration. The system supports two modes: patch (re-sign real attestation leaf) and generation (mint keys entirely in software). It is designed for Android 10-17, requires root, and is distributed as a Magisk/KernelSU/APatch module. The architecture is a multi-process, multi-language system: a Kotlin control daemon (app_process), native C++ interceptors (keymint, keystore), a Rust TA (teesim-km), and a JavaScript WebUI. Communication between daemon and interceptors uses a custom JSON-based protocol over Unix domain sockets. The daemon harvests real device attestation parameters, resolves per-app profiles, and pushes configuration to the interceptors. The interceptors use PLT hooks (AIBinder_transact, ioctl) to redirect KeyMint/Keystore calls for target apps to the local TA, while forwarding non-target calls to the real hardware. The codebase demonstrates high craftsmanship in its handling of Android internals, with careful version branching, RAII wrappers for ptrace, safe file I/O via base64 heredoc, and a schema-driven WebUI. However, it is heavily dependent on Android API internals and may require updates with each major Android release. The project is actively maintained with recent commits and responsive issue triage.