Duck ToolBox

Tricky Store manager

A full port of KOWX712's Tricky Addon: Update Target List that works with whichever keystore module you have:

• Tricky Store: config.ini with per-app modes and policy, plus the older target.txt and security_patch.txt layout.
• TEESimulator: config.json profiles.
• OhMyKeymint: injector.toml and the [trust] keys in config.toml. Since 0.1.7 it also accepts EC-only keyboxes there.

It keeps upstream's features: target list with search and bulk select, adding apps from Magisk's DenyList, removing unnecessary apps, adding system apps, auto-adding new apps, keybox sources (AOSP, a generated one, a local file or custom providers), the prop handler and Verified Boot hash, and 23 translations.

RKP Workbench and device issuer

• RKP Workbench imports an existing DICE chain and signing material, builds a fresh CSR v3, gets a server challenge and exports a keybox only after the returned certificates match the new key and pass local checks. Network errors never fall back to local signing.
• Device RKP Issuer does the same export, but asks the phone's Qualcomm KeyMint TA to sign the request instead of using a seed you hold.

The authors say plainly that, for the import path, acceptance by the real server and a successful production keybox export haven't been verified yet.

Installation

1. You need KernelSU, APatch or Magisk on an arm64 or x86_64 device with Android 8.0 or newer.
2. Install Tricky Store, TEESimulator or OhMyKeymint too. Without one the installer warns that the manager will stay idle.
3. Flash duck-toolbox-…-stable.zip and open the WebUI from KernelSU or APatch. On Magisk, the Action button downloads KSUWebUIStandalone and opens the WebUI with it.

At boot it applies the prop handler, your Tricky Store target list and auto-add rules. Uninstalling removes the WebUI links it placed in the keystore modules and its data in /data/adb/duck-toolbox. MIT licensed.