android hardware attestation demo

Author: quarkslab Source: mcp-gamehacking/skills/ags-android-hardware-attestation-demo

Description

This repository is an end-to-end proof of concept that demonstrates bypassing Android hardware Key Attestation by relaying genuine attestation certificate chains from a clean device to a rooted analysis phone. It includes two Kotlin Android apps (a demo client and an attestation oracle server), a Python backend that issues nonces and validates attestation chains against Google root CAs and revocation lists, and Frida instrumentation written in TypeScript that hooks the client Keystore attestation call to fetch chains from the clean device instead. The bypass does not forge cryptography; it substitutes a legitimate hardware-backed chain bound to the backend challenge, allowing verified-boot and hardware-backed checks to pass on a compromised device. The project is educational material aimed at mobile security researchers and analysts studying anti-tamper and anti-cheat mechanisms that rely on Android hardware attestation.