Hi everyone,
I've been troubleshooting this issue together with ChatGPT for several days, but we've reached a dead end. I'm hoping someone familiar with Xiaomi firmware or Qualcomm security can help.
Device
Xiaomi 11T Pro (vili)
Bootloader unlocked (always unlocked)
Current ROM: Official HyperOS Android 14
No root
Official Fastboot ROM currently installed
What happened
Everything was working normally on InfinityX ROM.
I then installed HyperOS 3 ZenX Port for Xiaomi 11T Pro.
While using ZenX, I didn't notice any security-related issues.
Later I decided to go back to InfinityX because I didn't like the ROM.
After returning to InfinityX, I immediately noticed that hardware-backed attestation no longer worked.
Since then, I have flashed multiple custom ROMs and even the complete official HyperOS Fastboot ROM several times, but the problem has never gone away.
Current symptoms
Key Attestation always fails
Hardware key generation fails
Play Integrity returns an empty deviceIntegrity
Widevine is only L3
Keymaster returns -10003
Phone otherwise works normally
Key Attestation reports:
ProviderException:
Failed to generate key pair
android.security.KeyStoreException:
-10003
Error::Km(-10003)
Logcat repeatedly shows:
KeymasterUtils:
rsp_header->status: -10003
Things I've already tried
I reflashed almost every firmware partition from the official Fastboot ROM, including:
xbl
xbl_config
abl
aop
tz
hyp
keymaster
devcfg
imagefv
modem
bluetooth
dsp
vendor_boot
boot
vbmeta
vbmeta_system
dtbo
super
userdata
metadata
misc
persist (restored manually through TWRP)
and many other firmware partitions.
I also erased userdata, metadata, misc, frp, switched slots, and flashed the official ROM multiple times.
Nothing changed.
My question
Has anyone experienced Keymaster Error -10003 after switching ROMs?
Could the process of leaving ZenX have corrupted a secure partition (persist, secdata, qweslicstore, secure storage, etc.) that is not restored by Xiaomi's public Fastboot ROM?
Has anyone managed to recover from this without factory EDL flashing?
Any ideas would be greatly appreciated.
Thank you.
I've been troubleshooting this issue together with ChatGPT for several days, but we've reached a dead end. I'm hoping someone familiar with Xiaomi firmware or Qualcomm security can help.
Device
Xiaomi 11T Pro (vili)
Bootloader unlocked (always unlocked)
Current ROM: Official HyperOS Android 14
No root
Official Fastboot ROM currently installed
What happened
Everything was working normally on InfinityX ROM.
I then installed HyperOS 3 ZenX Port for Xiaomi 11T Pro.
While using ZenX, I didn't notice any security-related issues.
Later I decided to go back to InfinityX because I didn't like the ROM.
After returning to InfinityX, I immediately noticed that hardware-backed attestation no longer worked.
Since then, I have flashed multiple custom ROMs and even the complete official HyperOS Fastboot ROM several times, but the problem has never gone away.
Current symptoms
Key Attestation always fails
Hardware key generation fails
Play Integrity returns an empty deviceIntegrity
Widevine is only L3
Keymaster returns -10003
Phone otherwise works normally
Key Attestation reports:
ProviderException:
Failed to generate key pair
android.security.KeyStoreException:
-10003
Error::Km(-10003)
Logcat repeatedly shows:
KeymasterUtils:
rsp_header->status: -10003
Things I've already tried
I reflashed almost every firmware partition from the official Fastboot ROM, including:
xbl
xbl_config
abl
aop
tz
hyp
keymaster
devcfg
imagefv
modem
bluetooth
dsp
vendor_boot
boot
vbmeta
vbmeta_system
dtbo
super
userdata
metadata
misc
persist (restored manually through TWRP)
and many other firmware partitions.
I also erased userdata, metadata, misc, frp, switched slots, and flashed the official ROM multiple times.
Nothing changed.
My question
Has anyone experienced Keymaster Error -10003 after switching ROMs?
Could the process of leaving ZenX have corrupted a secure partition (persist, secdata, qweslicstore, secure storage, etc.) that is not restored by Xiaomi's public Fastboot ROM?
Has anyone managed to recover from this without factory EDL flashing?
Any ideas would be greatly appreciated.
Thank you.
