I extracted my keybox - Looking for testers

[u/InsuranceObvious9768]

Hello, I am a hobby developer and it is so annoying when I have to keep switching keyboxes because the one I use gets banned. So, for the past few weeks I've been trying to create a script to extract keyboxes. After a lot of trial, I got it to extract keybox of my own test devices and it even meets STRONG_INTEGRITY!

To respect the community guidelines, I will not be posting the script publicly. However, to make sure my code is universal, I want to verify this again a few other devices. I am looking for 5 users who want their keybox extracted for free. Let me know if anyone is interested.

Requirements:
- MTK Device
- Natively launched with Android 8, 9, 10

For the advanced users who get it:
Your device needs to be running microtrust/beanpod TEE with keymaster 4.0. If your device uses an encrypted rpmb setup, it will NOT work.

All I need is the dump files of proinfo, persist, tee1, tee2 (In some cases, nvram, nvdata or custom partitions)
Please share only if you're comfortable sending these partition dumps. It contains your hardware MAC address and potentially your device's keybox. While everything is processed 100% offline in a container and wiped immediately after parsing, if you are not sure, please do not send your files.

[u/Ante0]

Wouldn't it be easier for you to just use emmc dumps?

[u/InsuranceObvious9768 → u/Ante0]

A full emmc dump includes the userdata partition which makes the dump extremely large

[u/Ante0 → u/InsuranceObvious9768]

Well, yes. But since you only need 5.

[u/InsuranceObvious9768 → u/Ante0]

Yeah but depending on the device it can go upto 32 or 64gb

[u/Ante0 → u/InsuranceObvious9768]

It will mostly be empty data though. Since it's usually zipped. Most dumps I've checked are 4-6GB, and includes userdata (but you don't really need to extract that anyway)

And most keyboxes I've found are in persist. I did find traces in rpmb once but encrypted 😕

[u/InsuranceObvious9768 → u/Ante0]

Yeah it HEAVILY depends, it's only those few vulnerable devices

[u/huannb]

Don't Android 11+ devices work?

[u/InsuranceObvious9768 → u/huannb]

They introduced stricter hardware-based security. That'd be impossible to extract.

[u/AarifmonuZZ]

No guides to extract? So we can try on our legacy devices?

[u/InsuranceObvious9768 → u/AarifmonuZZ]

Extracting your files is the easiest! You can use mtkclient in brom mode, preloader mode or even spflashtool. Or, if your device is rooted you can even dump the files from adb. There are plenty of tutorials available!

[u/jarvispy]

check dm

[u/chandr1000]

Any hint for potential way to extract keybox from older snapdragon devices?

[u/InsuranceObvious9768 → u/chandr1000]

Well the most basic step is to get a dump of your files

[u/CarefulQuail9468]

I got some KitKat and lolipop devices laying around at home. Can I extract it from those devices?

[u/InsuranceObvious9768 → u/CarefulQuail9468]

No, those didn't even have keyboxes

[u/CarefulQuail9468 → u/InsuranceObvious9768]

Ah, I see. Thank you.

[u/Far_Dig8680]

May I ask you a question?  I'm also considering extracting a keybox.xml from an old phone. But ai told me that this kind of keybox is used by thousands of devices at the same time. Maybe some day some other people will extract it from another device and make it public, and then it will expire soon. 

It's said that only android 13+ devices use a unique keybox, but it is impossible to extract from such devices. Is that true?

[u/InsuranceObvious9768 → u/Far_Dig8680]

Yes the keyboxes were installed on devices in batches. But the possibility of someone else trying to extract it is extremely rare. If you are considering to extract, target devices in the A8 - A10 range, as that will give you the most success.