Crashes with config `android!`

[ABJ4403]

Description

At some point after booting, typing PIN/Password instead of biometric on system related stuff (eg. Lockscreen or Lockscreen Settings) crashes it with this error:

FATAL EXCEPTION: AsyncTask #1
Process: com.android.systemui, PID: 14897
java.lang.RuntimeException: An error occurred while executing doInBackground()
	at android.os.AsyncTask$4.done(AsyncTask.java:415)
	at java.util.concurrent.FutureTask.finishCompletion(FutureTask.java:381)
	at java.util.concurrent.FutureTask.setException(FutureTask.java:250)
	at java.util.concurrent.FutureTask.run(FutureTask.java:269)
	at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:305)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:644)
	at java.lang.Thread.run(Thread.java:1117)
Caused by: java.lang.NullPointerException: Attempt to read from field 'android.system.keystore2.IKeystoreSecurityLevel android.system.keystore2.KeyEntryResponse.iSecurityLevel' on a null object reference in method 'android.security.keystore2.AndroidKeyStoreKey android.security.keystore2.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyFromKeystore(android.security.KeyStore2, android.system.keystore2.KeyDescriptor)'
	at android.os.Parcel.createExceptionOrNull(Parcel.java:3237)
	at android.os.Parcel.createException(Parcel.java:3215)
	at android.os.Parcel.readException(Parcel.java:3198)
	at android.os.Parcel.readException(Parcel.java:3140)
	at com.android.internal.widget.ILockSettings$Stub$Proxy.checkCredential(ILockSettings.java:1350)
	at com.android.internal.widget.LockPatternUtils.checkCredential(LockPatternUtils.java:549)
	at com.android.internal.widget.LockPatternChecker$2.doInBackground(LockPatternChecker.java:110)
	at com.android.internal.widget.LockPatternChecker$2.doInBackground(LockPatternChecker.java:104)
	at android.os.AsyncTask$3.call(AsyncTask.java:394)
	at java.util.concurrent.FutureTask.run(FutureTask.java:264)
	... 4 more
Caused by: android.os.RemoteException: Remote stack trace:
	at android.security.keystore2.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyFromKeystore(AndroidKeyStoreProvider.java:394)
	at android.security.keystore2.AndroidKeyStoreProvider.loadAndroidKeyStoreKeyFromKeystore(AndroidKeyStoreProvider.java:365)
	at android.security.keystore2.AndroidKeyStoreSpi.engineGetKey(AndroidKeyStoreSpi.java:125)
	at java.security.KeyStore.getKey(KeyStore.java:1083)
	at com.android.server.locksettings.SyntheticPasswordCrypto.decryptBlob(SyntheticPasswordCrypto.java:173)

This also happened with the latest TrickyStore-OSS CI version (but its even worse, it crashes it immediately at boot which makes it impossible to get past the PIN screen)

How to reproduce

There are multiple ways, but its involving typing lockscreen PIN/Password on system apps (eg. Settings or System UI), and it didnt happen immediately

Modules

• ReZygisk CI, 423th commit release
• TreatWheel 0.0.6
• TEESimulator 1.0.0
• PlayIntegrityFix inject 4.4

[JingMatrix]

Please flash the CI build of my LSPosed debug version, which will record the logs of TEESimultor.

After you trigger a crashes, try to save the logs via the LSPosed manager and upload it here

[ABJ4403]

Update: i reset targets.txt, it works again, then i found out the line android! that i added causes it (i thought it will reduce detections so i added it lol), where it wasnt doing that on last stable TS-OSS, i havent got time to repro this yet so ig for time being anyone else can try repro? 🙈

Also one more thing, it didnt work on my 2nd device that ran Android 10, it works on my primary device that ran Android 15 tho

[JingMatrix]

That is a useful piece of information, it could potentially indicate to how enhance TEESimulator in the future.

For old Android version , I cannot really help much as I don't posses such devices. Please open new issue regarding this, with LSPosed (debug CI version of my fork) logs attached.