春秋检测器解决方案

English

中文

English

中文

Appearance

Prologue ​

Terminology & Conventions ​

Genuinely Unlocked Device: a device whose ABL unlock flag is genuinely set — unsigned images are allowed and flashable, and the unlock state is faithfully reflected in system properties and KeyMint attestation.

Fake-Relocked Device ​

on a genuinely unlocked device, a custom payload is injected and executed early in the boot chain (before the system and TEE read and latch the boot state) to rewrite the in-memory lock state and report it, so the device presents itself as “locked (locked & green)” and can return hardware-level “locked” attestation certificates — while it still actually loads patched boot / init_boot images (e.g. Qualcomm Snapdragon 8 Elite Gen 5 devices using the gbl_root_canoe project).

No-Unlock Device ​

(a.k.a. KSU jailbreak mode): the ABL stays genuinely locked (never unlocked) and root is obtained through an Android / userspace privilege-escalation vulnerability, usually with SELinux set to permissive. Such root is normally not persistent and must be re-obtained on every boot.

Self-Signed Device ​

a device whose boot chain trusts a boot / init_boot signing key that third parties can obtain or reproduce, so the user can sign patched boot / init_boot / vbmeta images themselves and boot them while the ABL stays genuinely locked; the boot state and OEM unlock state still report “unlocked = no” (typical case: Lenovo Legion Y700 2nd / 3rd / 4th gen — images re-signed with the public TestKey can be flashed with root patches without unlocking).

Root manager ​

a complete privilege-management component set — a user-facing Android app, a userspace daemon, plus persistent hooks or in-memory patches deployed in the kernel or ramdisk — used to control root access.

Metamodule ​

a top-level module-manager type module that does not itself provide device spoofing or system patching; its core job is managing sub-modules and providing mount functionality. Only one metamodule can be installed at a time (see the KernelSU documentation).

Key module ​

a module that intercepts / replaces the KeyMint attestation path inside the system keystore daemon (keystore2) and uses a keybox to produce fake “device is locked” proofs; most also spoof system properties.

Zygisk provider ​

a module that provides the Zygisk runtime — it injects code into Zygote / app processes and exposes a Zygisk behaviour API, giving other Zygisk modules a runtime environment.

App-hiding module ​

a module that operates on “package visibility” — it intercepts the package-query path inside a target process (or a system process) and hides selected apps from the configured target app.

Minimal Module Set for a Perfectly Hidden Environment ​

  • Genuinely unlocked device: key module + Zygisk provider + app-hiding module
  • Fake-relocked / no-unlock / self-signed device: Zygisk provider + app-hiding module

For APatch / FolkPatch users, additionally load NoHello.kpm to guard against the side-channel detection; newer managers may have a built-in SELinux hook (must be enabled manually), and users on older versions can additionally load SELinux_Hook.kpm (links are given in “Recommended Modules” below).

Key modules ​

  • TEESimulator-RS: the best-known key module after TrickyStore, actively updated, no built-in WebUI.
  • OhMyKeymint: behaves closer to AOSP, possibly lower IO overhead than TEES-RS.
  • A WebUI-enabled build is available at ITxiao6666/OhMyKeymint, branch Xiaomi_LeiJun.
  • Tricky-addon-Enhanced: a WebUI add-on module for TS / TEES-RS.
  • The original TrickyStore is not recommended: its last update was 2025-11-30 and some features lag far behind other key modules.

Zygisk provider ​

  • Zygisk-Next: the most widely used standalone Zygisk implementation.

App-hiding modules ​

  • HMA-OSS: available in both Zygisk-module and Xposed-module flavours.

KernelPatch hiding modules

  • NoHello.kpm: side-channel detection guard for AP / FP.
  • SELinux_Hook.kpm: SELinux hook module for AP / FP (may already be built into newer managers).
  • The newest SuperKey detection in Chunqiu currently has no counter-module; this section will be updated as soon as one appears.

Metamodules ​

  • If your root manager provides a metamodule API, consider enabling it;
  • Hybrid-Mount: a widely used third-party metamodule.

Correct Module Configuration ​

Key module ​

a. Add the target app to the package list (e.g. /data/adb/tricky_store/target.txt for TS / TEES, or configure it in the WebUI); b. Set the security patch date correctly, or simply delete its config file (e.g. /data/adb/tricky_store/security_patch.txt — deleting it is the least trouble); c. Set the boot hash correctly (it is normally set automatically).

Zygisk provider ​

Enable “use Zygisk connector” and “use anonymous memory”; “restore mounts only” may conflict with your root manager's “kernel unmount modules”, so pick one of the two.

App-hiding module ​

Usage varies; the following are terminology only (HMA-OSS as an example):

  • Blacklist mode: apps with this mode enabled cannot see the apps contained in the blacklist template applied to them;
  • Blacklist template: for an app this template is applied to, the apps inside the template become invisible;
  • Whitelist mode: apps with this mode enabled can only see the apps contained in the whitelist template applied to them;
  • Whitelist template: for an app this template is applied to, only the apps inside the template are visible.
Copyright & License
Copyright Ownership: Chunqiu Detector Solutions contributors
Compiled from community reports, for reference only; all operations are at your own risk.
Licensed under Attribution 4.0 International (CC BY-4.0)

Compiled from community reports, for reference only; all operations are at your own risk.
Licensed under CC BY-4.0

Copyright © 2026 Chunqiu Detector Solutions contributors