A trick of keystore written in Rust, this project is done as a personal experiment and is no longer under maintance.
Currently EvilStore supports hacking default device attestation keys only. Custom attest key is NOT supported.
Nope, EvilStore only operates in hack mode, and currently it only supports hacking default device attestation keys. Your private keys remain securely in the TEE/Strongbox.
EvilStore currently does not check if the certificate chain of to-be-hacked keys is valid. Even if it does check it according to Google's terms, given the readily available keyboxs on the Internet, any attacker can bypass this check if they sign their key with a valid keybox.