I'd be extremely worried there!
The MasterKey vulnerability exploit works in the handling of ZipEntry (see below - Bug 8219321), which is buried deep in the ROM itself, its used in the PackageManager layer as well.
For such an application claiming "to patch" it, is misleading and false, because it is a user application and not at system level.
The real cure to get around the vulnerability is to modify the source code in Android in itself and rebuild the ROM.
The vulnerability exploits ROMs from Donut (1.6) right up to Jellybean (4.2).
In the FAQ of the app's website - this made my hairs stand up:
Can I trust ReKey with root access on my device?
Did you see those seals up above? They look pretty darn official and
trustworthy. They have Latin phrases and everything.
I really do not know whether to laugh or cry!
Dynamically patching the bytecode in the Android's Java DalvikVM (Runtime engine to the uninitiated) is unheard of.
I would take those so-called "claims of a user-level app" patching in Masterkey exploit, with a pinch of salt and not get fooled by it.
- Bug: 8219321 - Remove duplicate entries in Zip.
- Bug: 9695860 - unsigned Zip Entries.