Tricky Store OSS

beakthoven

Magisk KernelSU APatch
v3.1.0
Version
1.23 MB
Size
Aug 26, 2026
Updated

Module Info

  • Contributors beakthoven, dependabot[bot], osm0sis, TheFreeman193, MeowDump
  • Source Code View Repository
  • Tags
    #Tricky Store #Keystore #Play Integrity #Attestation #Magisk Module #Root Hide #Spoof

About this module

Tricky Store OSS is an open-source root utility engineered to intercept and customize Android's low-level Keystore and KeyMint Hardware Abstraction Layer (HAL) operations. By dynamically spoofing cryptographic certificate chains and attestation records, it resolves hardware verification barriers, restores Google Play Integrity status, and ensures secure application compatibility on rooted devices.

Hardware-Backed Attestation Interception

Dynamic Keystore manipulation designed to satisfy modern cryptographic verification protocols with granular package control.

KeyMint HAL Interception

Hooks directly into Android's keystore2 and KeyMint security layer to redirect attestation requests safely without breaking underlying cryptographic workflows.

Play Integrity Mitigation

Provides custom certificate injection capabilities to fulfill strict hardware-backed evaluation standards such as MEETS_STRONG_INTEGRITY and MEETS_DEVICE_INTEGRITY.

Target Scope Filtering

Supports a declarative configuration list allowing users to restrict attestation hooking solely to specified target applications or Google Play Services.

Under the Hood: Keystore Service Redirection

Modern Android versions (Android 12+) rely on android.hardware.security.keymint and the keystore2 binder service to validate asymmetric cryptographic keys and hardware-backed device state. When an application requests key attestation, Tricky Store OSS intercepts the binder transaction before response delivery, substituting the device's broken bootloader verification flags with trusted certificate records.

# Granular target package configuration (target.txt)
com.google.android.gms
com.google.android.gsf
com.example.bankingapp! # Force leaf certificate generation
# Intercepting binder transactions:
IKeyMintDevice::generateKey() -> [Intercept & Inject Spoofed Cert Chain]
# Result: Hardware attestation passes verification checks cleanly