Follow this guide, and yes, it passed Strong with a custom keybox.
Steps for those who are concerned, I'm using MT Manager and help from ChatGPT:
* Pull out your /system/framework/framework.jar
* Open framework.jar with MT Manager, using Dex Editor Plus to open classes*.dex file and decompile to *.smali
* Search for method
engineGetCertificateChain
, normally it should appear in the AndroidKeyStoreSpi
class* Copy the whole method from
.method public whitelist test-api engineGetCertificateChain(Ljava/lang/String;)
to .end method
* Ask ChatGPT to convert this method to Java; then, copy the code block that needs to be removed and ask ChatGPT again to remove the code in smali format.
* Replace the old method with smali generated by ChatGPT
* Compile the classes*.dex, and sign framework.jar
* Create a zygisk module with the format:
framework_patched.zip/
├── module.prop
└── system/
└── framework/
└── framework.jar
module.prop
Bash:
id=framework_patched
name=Framework certificate patched
version=1.0
versionCode=1
author=YourName
description=Patched framework certificate check to allow using the custom keybox
* Reboot and enjoy