TEESimulator is a system-level Android root tool that intercepts and replaces hardware-backed key attestation for selected apps. It injects native libraries into the keystore daemon (keystore2 on Android 12+, keystore on 10/11) via ptrace, hooks Binder transactions, and routes KeyMint requests to an in-process Rust TA that implements AOSP's kmr-ta with BoringSSL. A Kotlin daemon runs as root, manages profiles (keybox, mode, device identity, patch levels), harvests real device parameters, and provides a WebUI for configuration. The system supports two modes: patch (re-sign real attestation leaf) and generation (mint keys entirely in software). It is designed for Android 10-17, requires root, and is distributed as a Magisk/KernelSU/APatch module. The architecture is a multi-process, multi-language system: a Kotlin control daemon (app_process), native C++ interceptors (keymint, keystore), a Rust TA (teesim-km), and a JavaScript WebUI. Communication between daemon and interceptors uses a custom JSON-based protocol over Unix domain sockets. The daemon harvests real device attestation parameters, resolves per-app profiles, and pushes configuration to the interceptors. The interceptors use PLT hooks (AIBinder_transact, ioctl) to redirect KeyMint/Keystore calls for target apps to the local TA, while forwarding non-target calls to the real hardware. The codebase demonstrates high craftsmanship in its handling of Android internals, with careful version branching, RAII wrappers for ptrace, safe file I/O via base64 heredoc, and a schema-driven WebUI. However, it is heavily dependent on Android API internals and may require updates with each major Android release. The project is actively maintained with recent commits and responsive issue triage.
MoveCertificate is a Magisk/KernelSU/APatch module that moves user-installed CA certificates into the Android system certificate store, making them trusted system-wide. It supports Android versions 7 through 16 and provides two mounting modes: compatible (using tmpfs bind mounts) and builtin (leveraging Magisk Magic Mount). The module runs during boot via `post-fs-data.sh`, copying certificates from user directories and custom locations into system directories. It includes a web-based management UI (built with TypeScript, esbuild, and KernelSU WebUI) that allows users to view installed certificates, check module version, toggle modes, and delete certificates. The shell scripts handle permission fixing, SELinux context preservation, and compatibility cleanup (e.g., AdGuard certificates). The project is well-structured, with clear separation between shell logic and the web frontend, internationalization support, and a custom build pipeline.
This repository provides an Android ad-blocking Magisk module (named '去广告' / 'Remove Advertise') that blocks ads at the system level using hosts file redirection, iptables firewall rules, file locking (chattr), and app component disabling (pm). It includes a comprehensive, community-curated blocklist in both hosts file format (all, reward) and Adblock Plus format (adb.txt), targeting Chinese mobile apps and ad networks. The repo also hosts a GitHub Pages website (index.html) for distribution, donation, and version history (over 200 releases). While primarily an application (Magisk module), it has a strong data component in the form of curated blocklists, making it a hybrid project. The module is distributed as flashable ZIP archives in the module/ directory, with an update.json for Magisk's auto-update mechanism. The codebase is functional and well-used (1014 stars) but shows signs of maintenance burden (large version list, incomplete English documentation, history-cleanup workflow that destroys git history).