Environment
Device: Google Pixel 8 (GC3VE), Google Tensor G3
Root: KernelSU-Next, Zygisk Next
TEESimulator: v4.0 (62-fa2f863-debug)
Also installed: HMA-OSS, SUSFS
Summary
App tested: https://play.google.com/store/apps/details?id=com.mbmobile&hl=en-US
When a keybox is loaded into TEESimulator and any app is configured to use it, Zimperium zShield inside com.mbmobile (MB Bank) persistently detects an abnormal environment and blocks the session. Removing the keybox and rebooting resolves the detection immediately. The issue reproduces regardless of whether com.mbmobile itself is in the TEESimulator app list or not, meaning the mere presence of a loaded keybox with any hooked app is sufficient to trigger Zimperium.
Reproduction Steps
- Place a valid keybox.xml in the TEESimulator config directory
- Configure any app in the profile, com.mbmobile does not need to be included
- Reboot
- Open com.mbmobile and log in
- Leave the app open for several minutes
- Zimperium trips and blocks the session
What was observed
Zimperium zShield inside com.mbmobile detects the environment as abnormal and blocks the session. The detection is not tied to the attestation result itself, since removing the keybox while keeping com.mbmobile in the app list (for face scan and secure environment functionality) results in a clean, stable session with no tripping.
The face scan and secure environment features in com.mbmobile still function correctly with TEESimulator active but no keybox loaded, confirming that the interception itself is not the problem, only the keybox artifact.
What the logs show
No TEESimulator-specific logs were captured for this report. The symptom is behavioral, Zimperium blocks the session after several minutes when a keybox is present, and stops blocking after the keybox is removed and the device is rebooted.
Suspected Cause
TEESimulator leaves a detectable artifact when a keybox is loaded, possibly a file, socket, process signature, or memory pattern, that Zimperium's native scanner identifies as a known interception marker. This artifact is not present when TEESimulator runs without a keybox, suggesting the artifact is introduced during keybox parsing or key minting rather than during the basic interception setup.
Workaround
Remove keybox.xml from the TEESimulator config directory and reboot. TEESimulator remains functional for secure environment hooks without a keybox, which is sufficient for com.mbmobile's face scan feature.
Environment
Device: Google Pixel 8 (GC3VE), Google Tensor G3
Root: KernelSU-Next, Zygisk Next
TEESimulator: v4.0 (62-fa2f863-debug)
Also installed: HMA-OSS, SUSFS
Summary
App tested: https://play.google.com/store/apps/details?id=com.mbmobile&hl=en-US
When a keybox is loaded into TEESimulator and any app is configured to use it, Zimperium zShield inside com.mbmobile (MB Bank) persistently detects an abnormal environment and blocks the session. Removing the keybox and rebooting resolves the detection immediately. The issue reproduces regardless of whether com.mbmobile itself is in the TEESimulator app list or not, meaning the mere presence of a loaded keybox with any hooked app is sufficient to trigger Zimperium.
Reproduction Steps
What was observed
Zimperium zShield inside com.mbmobile detects the environment as abnormal and blocks the session. The detection is not tied to the attestation result itself, since removing the keybox while keeping com.mbmobile in the app list (for face scan and secure environment functionality) results in a clean, stable session with no tripping.
The face scan and secure environment features in com.mbmobile still function correctly with TEESimulator active but no keybox loaded, confirming that the interception itself is not the problem, only the keybox artifact.
What the logs show
No TEESimulator-specific logs were captured for this report. The symptom is behavioral, Zimperium blocks the session after several minutes when a keybox is present, and stops blocking after the keybox is removed and the device is rebooted.
Suspected Cause
TEESimulator leaves a detectable artifact when a keybox is loaded, possibly a file, socket, process signature, or memory pattern, that Zimperium's native scanner identifies as a known interception marker. This artifact is not present when TEESimulator runs without a keybox, suggesting the artifact is introduced during keybox parsing or key minting rather than during the basic interception setup.
Workaround
Remove keybox.xml from the TEESimulator config directory and reboot. TEESimulator remains functional for secure environment hooks without a keybox, which is sufficient for com.mbmobile's face scan feature.