Devices that ship with Android 16 only support RKP and not factory keys. I believe this is causing the TEE check on boot to fail.
I switched from a Google Pixel 8a to a 10 Pro and with the exact same setup on the Pixel 10 Pro tee_status always gets set to teeBroken=true. On the Pixel 8a I never had this issue. I started trying to figure out why and noticed in the logs that the TEE check is failing.
10-02 01:48:53.716 534 659 E keystore2: system/security/keystore2/rkpd_client/src/lib.rs:134 - IGetRegistrationCallback failed: 'java.lang.IllegalStateException: No system services were found hosting com.android.rkpdapp.IRemoteProvisioning'
10-02 01:48:53.720 534 534 I keystore2: system/security/keystore2/watchdog/src/lib.rs:224 - Watchdog complete for: ThreadId(1) Calling get_rkpd_attestation_key() Started: 10-01 23:48:52.412 UTC Pending: 1.307575235s Overdue 307.5756ms
10-02 01:48:53.720 534 534 E keystore2: system/security/keystore2/src/remote_provisioning.rs:95 - Failed to get rkpd key: system/security/keystore2/rkpd_client/src/lib.rs:234: Trying to get to IRegistration service.
10-02 01:48:53.720 534 534 E keystore2:
10-02 01:48:53.720 534 534 E keystore2: Caused by:
10-02 01:48:53.720 534 534 E keystore2: 0: system/security/keystore2/rkpd_client/src/lib.rs:137: GetRegistrationCallback failed: "java.lang.IllegalStateException: No system services were found hosting com.android.rkpdapp.IRemoteProvisioning"
10-02 01:48:53.720 534 534 E keystore2: 1: Failed to get registration
10-02 01:48:53.720 534 534 E keystore2: system/security/keystore2/src/error.rs:184 - system/security/keystore2/src/security_level.rs:570: Trying to get an attestation key
10-02 01:48:53.720 534 534 E keystore2:
10-02 01:48:53.720 534 534 E keystore2: Caused by:
10-02 01:48:53.720 534 534 E keystore2: 0: system/security/keystore2/src/attestation_key_utils.rs:69: Trying to get attestation key from RKPD.
10-02 01:48:53.720 534 534 E keystore2: 1: system/security/keystore2/rkpd_client/src/lib.rs:234: Trying to get to IRegistration service.
10-02 01:48:53.720 534 534 E keystore2:
10-02 01:48:53.720 534 534 E keystore2: Caused by:
10-02 01:48:53.720 534 534 E keystore2: 0: system/security/keystore2/rkpd_client/src/lib.rs:137: GetRegistrationCallback failed: "java.lang.IllegalStateException: No system services were found hosting com.android.rkpdapp.IRemoteProvisioning"
10-02 01:48:53.720 534 534 E keystore2: 1: Failed to get registration
10-02 01:48:53.720 534 534 E keystore2: 2: Error::Rc(r#OUT_OF_KEYS_TRANSIENT_ERROR)
10-02 01:48:53.724 1329 1329 W TrickyStoreOSS: TEE check failure: Failed to generate key pair.
10-02 01:48:53.724 1329 1329 I TrickyStoreOSS: TEE status written to /data/adb/tricky_store/tee_status: teeBroken=true
Once the phone has fully booted, TrickyStoreOSS works properly. Applications like Key Attestation Demo show no anomalies, and I have had no issues when forcing leaf hacking mode for all apps. However, because the TEE check fails on boot, TrickyStoreOSS defaults to certificate generation mode, even though leaf hacking mode functions correctly.
I am attaching the logcat from the Pixel 10 Pro, and also from the Pixel 8a for comparison if needed.
Tested Builds
P10Pro_logcat.log
P8a_logcat.log
Devices that ship with Android 16 only support RKP and not factory keys. I believe this is causing the TEE check on boot to fail.
I switched from a Google Pixel 8a to a 10 Pro and with the exact same setup on the Pixel 10 Pro tee_status always gets set to teeBroken=true. On the Pixel 8a I never had this issue. I started trying to figure out why and noticed in the logs that the TEE check is failing.
Once the phone has fully booted, TrickyStoreOSS works properly. Applications like Key Attestation Demo show no anomalies, and I have had no issues when forcing leaf hacking mode for all apps. However, because the TEE check fails on boot, TrickyStoreOSS defaults to certificate generation mode, even though leaf hacking mode functions correctly.
I am attaching the logcat from the Pixel 10 Pro, and also from the Pixel 8a for comparison if needed.
Tested Builds
P10Pro_logcat.log
P8a_logcat.log