Repository navigation
Force the emutls runtime into both interceptors and allow the staging fallback - #320
Merged
Merged
Conversation
… fallback Injection on an Infinix X695C (Android 11, sdk=30, keystore1) fails at dlopen: the linker demands __emutls_get_address, which /system/bin/keystore does not export. The symbol is called by the NDK static libc++abi (cxa_thread_atexit.cpp.o, compiled with emulated TLS) and the only definition lives in Rust compiler_builtins emutls.o inside libteesim_km.a. Without --whole-archive the linker sees the definition as weak, drops it, and the version script turns the leftover reference into an undefined dynamic import. BIND_NOW forces resolution at dlopen time, so keystore never reaches entry and the inject loop retries forever. Wrap the Rust archive in --whole-archive/--no-whole-archive on both teesim_keymint and teesim_keystore so emutls.o is always linked; --gc-sections still drops unreachable code. The bug has been latent since 7285ffc (the first interceptor commit) but only manifests on keystore1 targets where the host process has no emutls runtime of its own. The staging fallback (inject_via_staging, /data/local/tmp) also failed on the same device: keystore was denied search on shell_data_file by SELinux. Add the dir and file permissions so the fallback path can succeed when the fd-passing primary path is blocked.
Draft
6 tasks
Zhanfg
added a commit
to Zhanfg/TEESimulator
that referenced
this pull request
Oct 22, 2026
…ingMatrix#320) Adapt fcf1738 to the OnePlus/zh-CN integration candidate. No routing or OTA changes.
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Injection on an Infinix X695C (Android 11, sdk=30, keystore1) fails at dlopen: the linker demands
__emutls_get_address, which/system/bin/keystoredoes not export. The symbol is called by the NDK static libc++abi (cxa_thread_atexit.cpp.o, compiled with emulated TLS) and the only definition lives in Rustcompiler_builtinsemutls.oinsidelibteesim_km.a. Without--whole-archivethe linker sees the definition as weak, drops it, and the version script turns the leftover reference into an undefined dynamic import.BIND_NOWforces resolution at dlopen time, so keystore never reachesentryand the inject loop retries forever.Wrap the Rust archive in
--whole-archive/--no-whole-archiveon bothteesim_keymintandteesim_keystoresoemutls.ois always linked;--gc-sectionsstill drops unreachable code. The bug has been latent since 7285ffc (the first interceptor commit) but only manifests on keystore1 targets where the host process has no emutls runtime of its own.The staging fallback (
inject_via_staging,/data/local/tmp) also failed on the same device: keystore was denied{ search }onshell_data_fileby SELinux. Add the dir and file permissions so the fallback path can succeed when the fd-passing primary path is blocked.