在 Ubuntu 24.04.1 LTS (WSL) 中利用 openssl 天生 keybox.xml

看到“天生 keybox.xml”，大概率都会联想到 PIF 和 Tricky Store。这里就不多解释它们的用途了。最近在网上看到天生非 AOSP keybox 的教程，在这里做一些增补，并将代码打包成一个 Python 脚本。
参考自：

• Idea 提供者：https://xdaforums.com/t/tee-hacking.4662185/page-21#post-89847987（如果打不开大概被重定向去另一个网页可能要刷新几遍才能正确打开这个网页） ，该原始 Idea 须要借助一个密码学工具网站；
  
• RSA 私钥转换：https://stackoverflow.com/questions/17733536/how-to-convert-a-private-key-to-an-rsa-private-key。
  

做出以下调整：

• 直接利用一站式脚本实行，主动利用 openssl 天生三个 PEM 文件，如果用于预检测的 openssl version 命令实行失败，主动尝试通过 sudo apt-get install libssl-dev 举行安装；
  
• 实现对新版 openssl 天生的 RSA 私钥举行辨认，并从 PKCS8 转换为 PKCS1。
  

直接上 Python 代码，记得以 LF 形式保存换行符，并在 Ubuntu 24.04.1 LTS 中运行。

1. import os
2. try:
3.         os.chdir(os.path.abspath(os.path.dirname(__file__)))
4. except:
5.         pass
6. EXIT_SUCCESS = 0
7. EXIT_FAILURE = 1
8. EOF = (-1)
9. keyboxFormatter = """<?xml version="1.0"?>
10. <AndroidAttestation>
11. <NumberOfKeyboxes>1</NumberOfKeyboxes>
12. <Keybox DeviceID="YourDeviceID">
13. <Key algorithm="ecdsa">
14. <PrivateKey format="pem">
15. {0}</PrivateKey>
16. <CertificateChain>
17. <NumberOfCertificates>1</NumberOfCertificates>
18. <Certificate format="pem">
19. {1}</Certificate>
20. </CertificateChain>
21. </Key>
22. <Key algorithm="rsa">
23. <PrivateKey format="pem">
24. {2}</PrivateKey>
25. </Key>
26. </Keybox>
27. </AndroidAttestation>"""
30. def execute(commandline:str) -> int|None:
31.         if isinstance(commandline, str):
32.                 print("$ " + commandline)
33.                 return os.system(commandline)
34.         else:
35.                 return None
37. def handleOpenSSL(flag:bool = True) -> bool|None:
38.         if isinstance(flag, bool):
39.                 errorLevel = execute("openssl version")
40.                 if EXIT_SUCCESS == errorLevel:
41.                         return True
42.                 elif flag: # can try again
43.                         execute("sudo apt-get install openssl libssl-dev")
44.                         return handleOpenSSL(False)
45.                 else:
46.                         return False
47.         else:
48.                 return None
50. def pressTheEnterKeyToExit(errorLevel:int|None = None):
51.         try:
52.                 print("Please press the enter key to exit ({0}). ".format(errorLevel) if isinstance(errorLevel, int) else "Please press the enter key to exit. ")
53.                 input()
54.         except:
55.                 pass
57. def main() -> int:
58.         # Parameters #
59.         failureCount = 0
60.         ecPrivateKeyFilePath = "ecPrivateKey.pem"
61.         certificateFilePath = "certificate.pem"
62.         rsaPrivateKeyFilePath = "rsaPrivateKey.pem"
63.         oldRsaPrivateKeyFilePath = "oldRsaPrivateKey.pem"
64.         keyboxFilePath = "keybox.xml"
65.        
66.         # First-phase Generation #
67.         failureCount += execute("openssl ecparam -name prime256v1 -genkey -noout -out "{0}"".format(ecPrivateKeyFilePath)) != 0
68.         failureCount += execute("openssl req -new -x509 -key "{0}" -out {1} -days 3650 -subj "/CN=Keybox"".format(ecPrivateKeyFilePath, certificateFilePath)) != 0
69.         failureCount += execute("openssl genrsa -out "{0}" 2048".format(rsaPrivateKeyFilePath)) != 0
70.         if failureCount > 0:
71.                 print("Cannot generate a sample ``keybox.xml`` file since {0} PEM file{1} not generated successfully. ".format(failureCount, ("s were" if failureCount > 1 else " was")))
72.                 pressTheEnterKeyToExit(EOF)
73.                 return EOF
74.        
75.         # First-phase Reading #
76.         try:
77.                 with open(ecPrivateKeyFilePath, "r", encoding = "utf-8") as f:
78.                         ecPrivateKey = f.read()
79.                 with open(certificateFilePath, "r", encoding = "utf-8") as f:
80.                         certificate = f.read()
81.                 with open(rsaPrivateKeyFilePath, "r", encoding = "utf-8") as f:
82.                         rsaPrivateKey = f.read()
83.         except BaseException as e:
84.                 print("Failed to read one or more of the PEM files. Details are as follows. \n{0}".format(e))
85.                 pressTheEnterKeyToExit(EOF)
86.                 return EOF
87.        
88.         # Second-phase Generation #
89.         if rsaPrivateKey.startswith("-----BEGIN PRIVATE KEY-----"):
90.                 print("A newer openssl version is used. The RSA private key in the PKCS8 format will be converted to that in the PKCS1 format soon. ")
91.                 failureCount += execute("openssl rsa -in "{0}" -out "{1}" -traditional".format(rsaPrivateKeyFilePath, oldRsaPrivateKeyFilePath))
92.                 if failureCount > 0:
93.                         print("Cannot convert the RSA private key in the PKCS8 format to that in the PKCS1 format. ")
94.                         pressTheEnterKeyToExit(EOF)
95.                         return EOF
96.                 else:
97.                         print("Finished converting the RSA private key in the PKCS8 format to that in the PKCS1 format. ")
98.                         try:
99.                                 with open(oldRsaPrivateKeyFilePath, "r", encoding = "utf-8") as f:
100.                                         rsaPrivateKey = f.read()
101.                         except BaseException as e:
102.                                 print("Failed to update the RSA private key from "{0}". Details are as follows. \n{1}".format(oldRsaPrivateKeyFilePath, e))
103.                                 pressTheEnterKeyToExit(EOF)
104.                                 return EOF
105.        
106.         # Keybox Generation #
107.         keybox = keyboxFormatter.format(ecPrivateKey, certificate, rsaPrivateKey)
108.         print(keybox)
109.         try:
110.                 with open(keyboxFilePath, "w", encoding = "utf-8") as f:
111.                         f.write(keybox)
112.                 print("Successfully wrote the keybox to "{0}". ".format(keyboxFilePath))
113.                 pressTheEnterKeyToExit(EXIT_SUCCESS)
114.                 return EXIT_SUCCESS
115.         except BaseException as e:
116.                 print("Failed to write the keybox to "{0}". Details are as follows. \n{1}".format(keyboxFilePath, e))
117.                 pressTheEnterKeyToExit(EXIT_FAILURE)
118.                 return EXIT_FAILURE
122. if "__main__" == __name__:
123.         exit(main())

复制代码

更换 /data/adb/tricky_store/keybox.xml 之前，记得先将原来的 keybox.xml（刷入 tricky_store 时自带的谁人基于 AOSP 的 keybox.xml）备份为 keybox.xml.bak。

12月14日破晓做了一些更新：

• 支持粗略检查三个子密钥文件内容，支持 OpenSSL 私钥转 RSA 私钥；
  
• 如果文件存在，步调会提示是否覆盖；
  
• 装备ID随机天生。
  

1. import os
2. from random import randint, choice
3. from base64 import b64decode
4. try:
5.         os.chdir(os.path.abspath(os.path.dirname(__file__)))
6. except:
7.         pass
8. EXIT_SUCCESS = 0
9. EXIT_FAILURE = 1
10. EOF = (-1)
11. LB = 2 # the lower bound of the length of the device ID
12. UB = 12 # the upper bound of the length of the device ID
13. CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"
14. keyboxFormatter = """<?xml version="1.0"?>
15. <AndroidAttestation>
16. <NumberOfKeyboxes>1</NumberOfKeyboxes>
17. <Keybox DeviceID="{0}">
18. <Key algorithm="ecdsa">
19. <PrivateKey format="pem">
20. {1}</PrivateKey>
21. <CertificateChain>
22. <NumberOfCertificates>1</NumberOfCertificates>
23. <Certificate format="pem">
24. {2}</Certificate>
25. </CertificateChain>
26. </Key>
27. <Key algorithm="rsa">
28. <PrivateKey format="pem">
29. {3}</PrivateKey>
30. </Key>
31. </Keybox>
32. </AndroidAttestation>
33. """
36. def canOverwrite(flags:list, idx:int, prompts:str|tuple|list|set) -> bool:
37.         if isinstance(flags, list) and isinstance(idx, int) and -len(flags) <= idx < len(flags) and isinstance(prompts, (str, tuple, list, set)):
38.                 try:
39.                         if isinstance(prompts, str):
40.                                 print(""{0}"".format(prompts))
41.                                 choice = input("The file mentioned above exists. Overwrite or not [aYn]? ")
42.                         else:
43.                                 print(prompts)
44.                                 choice = input("At least one of the files mentioned above exists. Overwrite or not [aYn]? ")
45.                         if choice.upper() == "A":
46.                                 for i in range((idx if idx >= 0 else len(flags) + idx), len(flags)): # overwirte the current file and all the following necessary files no matter whether they exist
47.                                         flags[i] = True
48.                                 return True
49.                         elif choice.upper() == "N":
50.                                 return False
51.                         else:
52.                                 flags[idx] = True
53.                                 return True
54.                 except BaseException as e:
55.                         print(e)
56.                         return False
57.         else:
58.                 input("#")
59.                 return False
61. def execute(commandline:str) -> int|None:
62.         if isinstance(commandline, str):
63.                 print("$ " + commandline)
64.                 return os.system(commandline)
65.         else:
66.                 return None
68. def handleOpenSSL(flag:bool = True) -> bool|None:
69.         if isinstance(flag, bool):
70.                 errorLevel = execute("openssl version")
71.                 if EXIT_SUCCESS == errorLevel:
72.                         return True
73.                 elif flag: # can try again
74.                         execute("sudo apt-get install openssl libssl-dev")
75.                         return handleOpenSSL(False)
76.                 else:
77.                         return False
78.         else:
79.                 return None
81. def pressTheEnterKeyToExit(errorLevel:int|None = None):
82.         try:
83.                 print("Please press the enter key to exit ({0}). ".format(errorLevel) if isinstance(errorLevel, int) else "Please press the enter key to exit. ")
84.                 input()
85.         except:
86.                 pass
88. def main() -> int:
89.         # Parameters #
90.         failureCount = 0
91.         deviceID = "".join([choice(CHARSET) for _ in range(randint(LB, UB))]) # or specify the device ID manually like "YourDeviceID"
92.         ecPrivateKeyFilePath = "ecPrivateKey.pem"
93.         certificateFilePath = "certificate.pem"
94.         rsaPrivateKeyFilePath = "rsaPrivateKey.pem"
95.         keyboxFilePath = "keybox.xml" # None for no files written
96.         flags = [not (os.path.isfile(ecPrivateKeyFilePath) or os.path.isfile(certificateFilePath)), not os.path.isfile(rsaPrivateKeyFilePath), not os.path.isfile(keyboxFilePath)]
97.        
98.         # First-phase Generation #
99.         if flags[0] or canOverwrite(flags, 0, (ecPrivateKeyFilePath, certificateFilePath)):
100.                 failureCount += execute("openssl ecparam -name prime256v1 -genkey -noout -out "{0}"".format(ecPrivateKeyFilePath)) != 0
101.         if flags[0] or not os.path.isfile(certificateFilePath):
102.                 failureCount += execute("openssl req -new -x509 -key "{0}" -out {1} -days 3650 -subj "/CN=Keybox"".format(ecPrivateKeyFilePath, certificateFilePath)) != 0
103.         if flags[1] or canOverwrite(flags, 1, rsaPrivateKeyFilePath):
104.                 failureCount += execute("openssl genrsa -out "{0}" 2048".format(rsaPrivateKeyFilePath)) != 0
105.         if failureCount > 0:
106.                 print("Cannot generate a sample ``keybox.xml`` file since {0} PEM file{1} not generated successfully. ".format(failureCount, ("s were" if failureCount > 1 else " was")))
107.                 pressTheEnterKeyToExit(11)
108.                 return 11
109.        
110.         # First-phase Reading #
111.         try:
112.                 with open(ecPrivateKeyFilePath, "r", encoding = "utf-8") as f:
113.                         ecPrivateKey = f.read()
114.                 with open(certificateFilePath, "r", encoding = "utf-8") as f:
115.                         certificate = f.read()
116.                 with open(rsaPrivateKeyFilePath, "r", encoding = "utf-8") as f:
117.                         rsaPrivateKey = f.read()
118.         except BaseException as e:
119.                 print("Failed to read one or more of the PEM files. Details are as follows. \n{0}".format(e))
120.                 pressTheEnterKeyToExit(12)
121.                 return 12
122.        
123.         # Second-phase Generation #
124.         if flags[1]: # only updates the key content when the original key is newly generated or updating is allowed
125.                 if rsaPrivateKey.startswith("-----BEGIN PRIVATE KEY-----") and rsaPrivateKey.rstrip().endswith("-----END PRIVATE KEY-----"):
126.                         print("A newer openssl version is used. The RSA private key in the PKCS8 format will be converted to that in the PKCS1 format soon. ")
127.                         failureCount += execute("openssl rsa -in "{0}" -out "{0}" -traditional".format(rsaPrivateKeyFilePath))
128.                         if failureCount > 0:
129.                                 print("Cannot convert the RSA private key in the PKCS8 format to that in the PKCS1 format. ")
130.                                 pressTheEnterKeyToExit(13)
131.                                 return 13
132.                         else:
133.                                 print("Finished converting the RSA private key in the PKCS8 format to that in the PKCS1 format. ")
134.                                 try:
135.                                         with open(rsaPrivateKeyFilePath, "r", encoding = "utf-8") as f:
136.                                                 rsaPrivateKey = f.read()
137.                                 except BaseException as e:
138.                                         print("Failed to update the RSA private key from "{0}". Details are as follows. \n{1}".format(rsaPrivateKeyFilePath, e))
139.                                         pressTheEnterKeyToExit(14)
140.                                         return 14
141.                 elif rsaPrivateKey.startswith("-----BEGIN OPENSSH PRIVATE KEY-----") and rsaPrivateKey.rstrip().endswith("-----END OPENSSH PRIVATE KEY-----"):
142.                         print("An OpenSSL private key is detected, which will be converted to the RSA private key soon. ")
143.                         failureCount += execute("ssh-keygen -p -m PEM -f "{0}" -N """.format(rsaPrivateKeyFilePath))
144.                         if failureCount > 0:
145.                                 print("Cannot convert the OpenSSL private key to the RSA private key. ")
146.                                 pressTheEnterKeyToExit(15)
147.                                 return 15
148.                         else:
149.                                 print("Finished converting the OpenSSL private key to the RSA private key. ")
150.                                 try:
151.                                         with open(rsaPrivateKeyFilePath, "r", encoding = "utf-8") as f: # the ``ssh-keygen`` overwrites the file though no obvious output filepaths specified
152.                                                 rsaPrivateKey = f.read()
153.                                 except BaseException as e:
154.                                         print("Failed to update the RSA private key from "{0}". Details are as follows. \n{1}".format(rsaPrivateKeyFilePath, e))
155.                                         pressTheEnterKeyToExit(16)
156.                                         return 16
157.        
158.         # Brief Checks #
159.         if not (ecPrivateKey.startswith("-----BEGIN EC PRIVATE KEY-----") and ecPrivateKey.rstrip().endswith("-----END EC PRIVATE KEY-----")):
160.                 print("An invalid EC private key is detected. Please try to use the latest key generation tools to solve this issue. ")
161.                 pressTheEnterKeyToExit(17)
162.                 return 17
163.         if not (certificate.startswith("-----BEGIN CERTIFICATE-----") and certificate.rstrip().endswith("-----END CERTIFICATE-----")):
164.                 print("An invalid certificate is detected. Please try to use the latest key generation tools to solve this issue. ")
165.                 pressTheEnterKeyToExit(18)
166.                 return 18
167.         if not (rsaPrivateKey.startswith("-----BEGIN RSA PRIVATE KEY-----") and rsaPrivateKey.rstrip().endswith("-----END RSA PRIVATE KEY-----")):
168.                 print("An invalid final RSA private key is detected. Please try to use the latest key generation tools to solve this issue. ")
169.                 pressTheEnterKeyToExit(19)
170.                 return 19
171.        
172.         # Keybox Generation #
173.         keybox = keyboxFormatter.format(deviceID, ecPrivateKey, certificate, rsaPrivateKey)
174.         print("Generated keybox with a length of {0}: ".format(len(keybox)))
175.         print(keybox)
176.         if keyboxFilePath is not None and (flags[2] or canOverwrite(flags, 2, keyboxFilePath)):
177.                 try:
178.                         with open(keyboxFilePath, "w", encoding = "utf-8") as f:
179.                                 f.write(keybox)
180.                         print("Successfully wrote the keybox to "{0}". ".format(keyboxFilePath))
181.                         pressTheEnterKeyToExit(EXIT_SUCCESS)
182.                         return EXIT_SUCCESS
183.                 except BaseException as e:
184.                         print("Failed to write the keybox to "{0}". Details are as follows. \n{1}".format(keyboxFilePath, e))
185.                         pressTheEnterKeyToExit(20)
186.                         return 20
187.         else:
188.                 print("The keybox has not been written to any files. Please refer to the text above. ")
189.                 pressTheEnterKeyToExit(EXIT_FAILURE)
190.                 return EXIT_FAILURE
194. if "__main__" == __name__:
195.         exit(main())

复制代码

免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！更多信息从访问主页：qidao123.com:ToB企服之家，中国第一个企服评测及商务社交产业平台。