1

So I'm trying on copying the Android 11 screen lock password to another same device our customer does not want to set the password one by one

and I find out a resolution: copying files

However it only works in the scenario if the device password is not been set.

while copying the file below to the device without a password after rebooting the device the screen lock will show up and the password is as expected**

Unfortunately, it will not work if the device's password has been set; the screen lock will still show up but the password was not as expected

What did I miss here? Does anyone know?

the code below what I am trying to do is to copy

1.locksettings.db

an SQLite database containing the lock screen settings

2.copy /data/system_de/0/spblob/*

In order to unlock a real user, you need to know a synthetic password. However it's encrypted by the Keystore, so you need the real password to unlock the Keystore first

for example

.00000000000.handle: return value of gatekeeper first enroll by synthetic password derived password

handle.pwd: the second gatekeeper enroll by real password with a fake user ID (e.g. user_id + 10000).

handle.secdis: Actually a random number. Used to encrypt the synthetic password.

handle.spblob: encrypted synthetic password

3. copy /data/misc/keystore/user_0/

keystore key. Used for encrypting synthetic passwords.

cp -rf /storage/self/primary/export/configuration/Settings/lock* /data/system/

chown system:system /data/system/locksettings.db
chmod 660 /data/system/locksettings.db

rm -rf /data/system_de/0/spblob
mkdir /data/system_de/0/spblob/
chown system:system /data/system_de/0/spblob
rm -rf /data/misc/keystore/user_0
mkdir /data/misc/keystore/user_0/
chown keystore:keystore /data/misc/keystore/user_0

cp -rf /storage/self/primary/export/configuration/data/spblob/* /data/system_de/0/spblob/

chown system:system /data/system_de/0/spblob/*
chmod 600 /data/system_de/0/spblob/*

cp -rf /storage/self/primary/export/configuration/data/keystore/* /data/misc/keystore/user_0/

chown keystore:keystore /data/misc/keystore/user_0/*
chmod 600 /data/misc/keystore/user_0/*

For additional question:

Yes those command above need to run under root acces ,however because it is a customize os so we make those command run under a system service and fix some sepolicy avc error so the customer do not have root acces for sure and we can run those command even under an unroot device

Improve this question
4
  • Is locksettings command not useful for you in this context? See android.stackexchange.com/a/194779/96277
    – Firelord ♦
    Commented Jun 1, 2023 at 7:48
  • @Firelord yes this solution is also been cosidered for us. but we need to know the customers password first . We have like thousands of same device on the customers hand it will be disaster if they forgot their password . So the best solution for us is to try copying files between devices without knowing their password. Fortunately we have full access of our customize os so we are trying on this approach
    – jason yu
    Commented Jun 1, 2023 at 8:04
  • Those files are only accessible with root permissions, so all the devices for the customer are rooted? I would really be surprised if you can change the lock screen PIN by copying files. There should be the Gatekeeper running in the ARM TrustZone which you can not copy as it should be device unique. Even if it works the first time you should test if it still works after changing the lock screen PIN.
    – Robert
    Commented Jun 1, 2023 at 10:40
  • @Robert Thanks for reply .For dev we have somesort of debug mode os and yes we have full access,but for customer they absolutely dont have the root access . However we can run those command under a system service and fix sepolicy avc error so we can copy those file even if we dont have the root access on customer os . and yes we have test some test program to test the stuff we are doing it work on if the device is not been set password and we believe we can accomplish even if the password if been set. we done this on Android 9 before and it works well for couple years not sure what they change
    – jason yu
    Commented Jun 1, 2023 at 13:58

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .