Jorijn van der Graaf
823c710b15
All checks were successful
package / package (push) Successful in 1m22s
0.2.3's manifest pinned the sha256 of one Android build's focal64 (16.82.0, the build the dev phone runs). Fairphone re-signs the trustlet every release, so that pin matched exactly one of the six builds seen, and two of two field reports had no sensor: one user on 16.100.0 edited the manifest by hand, another ended up with a file QTEE refuses. The manifest now carries '-' instead of a hash and depends on fp6-vendor-blobs 1-r3, which tries the active slot first and verifies the image's structure; QTEE's signature check is the gate it always was (one flipped byte -> ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03 and again today). post-install reassembles the trustlet right away, so 'apk add' no longer needs a boot for it. post-upgrade re-derives it from the active slot, which replaces a hand-placed or wrongly pinned file, and then restarts the daemon -- a plain restart, so a daemon that exited on a refused trustlet comes back up on the re-derived one. loadFromBuffer failures name the loader's verdict. The field's first report was a bare result=12; it now reads ERROR_ELF_SIGNATURE_ERROR with what to do about it. Probed on the phone with this build: a one-byte tampered image and 100000 random bytes both print it, the pristine image loads, and the suites pass 8/8.
20 lines
1.2 KiB
Text
20 lines
1.2 KiB
Text
# FocalTech FT9391 trustlet (proprietary, OEM-signed) - reassembled from the
|
|
# stock modem partition on-device instead of being shipped (fp6 repo
|
|
# journal/blobs/, journal/fingerprint/). It is the matcher: every pixel the
|
|
# sensor produces stays inside it, and no part of the daemon can substitute
|
|
# for it. QTEE's signature gate is fused OEM root, measured 2026-09-03, so
|
|
# there is no version of this that is our own code.
|
|
#
|
|
# Not one file: image/focal64.mdt plus focal64.b00..b08, placed at each ELF
|
|
# segment's p_offset. The extractor tries the ACTIVE slot first (its TZ is
|
|
# the one running) and the other slot as fallback.
|
|
#
|
|
# No sha256 pin ('-'): Fairphone re-signs this trustlet every Android
|
|
# release, so a whole-image hash matches exactly one build - six builds, six
|
|
# hashes, one trustlet - and the pin 0.2.3 shipped (16.82.0's) left every
|
|
# unit on another build without a sensor (two of two field reports,
|
|
# 2026-09-11). The extractor verifies the structure; QTEE verifies the
|
|
# signature and refuses a damaged or foreign image (one flipped byte ->
|
|
# ERROR_ELF_SIGNATURE_ERROR, measured 2026-09-03), and the daemon names that
|
|
# verdict in its log.
|
|
mbn modem_a,modem_b image focal64 /usr/lib/firmware/focal64.mbn -
|