Keybox Repository

TrickyStore keybox setup: the complete guide

By evoker8 min read
Contents
  1. Requirements
  2. Install TrickyStore
  3. Place keybox.xml
  4. Configure target.txt
  5. security_patch.txt
  6. Verify
  7. Troubleshooting
  8. Automating keybox updates

This is the full version of the short guide on the repository page. It covers every file TrickyStore reads, what each setting does, and the failure modes people hit most often. If you only need the commands, skip to the numbered steps.

Requirements

1. Install TrickyStore

Flash the module zip from your root manager and reboot. After the reboot the module creates /data/adb/tricky_store/ with a default target.txt. Nothing else happens until you configure it.

2. Place keybox.xml

Copy the keybox to the exact path below. TrickyStore watches the directory and reloads the file immediately; no reboot needed.

su
cp /sdcard/Download/keybox.xml /data/adb/tricky_store/keybox.xml
chown root:root /data/adb/tricky_store/keybox.xml
chmod 644 /data/adb/tricky_store/keybox.xml

Make sure the file is the raw XML (starts with <?xml or <AndroidAttestation>), not a zip, not base64, and has no stray characters before the first tag. Files from the repository are already in the right form.

Without a keybox, TrickyStore uses a built-in software keybox. That is fine for DEVICE integrity on many setups but can never produce STRONG, because the chain is not hardware-trusted.

3. Configure target.txt

/data/adb/tricky_store/target.txt lists the packages whose attestation requests TrickyStore should intercept, one package name per line. Only these apps see the spoofed chain; everything else gets the device's real attestation.

com.google.android.gms
com.android.vending
com.google.android.apps.walletnfcrel
io.github.vvb2060.keyattestation
com.yourbank.mobile!

Two optional suffixes control how the chain is produced:

SuffixModeWhen to use
!Certificate generationBuild a fresh chain signed by the keybox. Needed on devices with a broken TEE, and the safer choice for strict apps.
?Leaf certificate hackKeep the real chain and patch only the leaf's attestation extension. Cheaper, works while the device's own key is still trusted.
noneAutomaticTrickyStore tries the leaf hack and falls back to generation if the TEE cannot supply a leaf.

Keep the list short. Every app that attests through your keybox is another data point Google sees on that key, and public keys are revoked partly because of volume. The Tricky Addon WebUI can build the list from installed apps, and it can fetch a keybox for you as well.

4. security_patch.txt (optional)

Play Integrity's strongest verdict expects a recent security patch level. If your ROM is stale, TrickyStore can report a different level in the attestation result only; system properties are untouched. Create /data/adb/tricky_store/security_patch.txt with either the simple form:

20260801

or the per-component form introduced in TrickyStore 1.2.1:

system=202608
boot=2026-08-01
vendor=no

no leaves that component's real value alone. Choose a date that is plausible for your device; a 2019 phone claiming last week's patch is a contradiction that some verifiers catch.

5. Verify

  1. Key Attestation. Install Key Attestation, add io.github.vvb2060.keyattestation to target.txt, open it. You want: chain trusted, attestation security level TrustedEnvironment or StrongBox, verified boot state Verified, bootloader locked, and no "revoked" line.
  2. Play Integrity. Run a checker such as Play Integrity API Checker once. The expected result is MEETS_STRONG_INTEGRITY together with DEVICE and BASIC.
  3. Then stop checking. Repeated attestations shorten the keybox's life and tell you nothing new.

Troubleshooting

SymptomLikely causeFix
DEVICE but not STRONGKeybox revoked, or not loaded.Check the keybox in Key Attestation. If revoked, replace it with the newest Strong one from the repository. If "not loaded", verify path, permissions and that the XML is well-formed.
Only BASICFingerprint or props still expose root/unlocked bootloader.Install and configure a Play Integrity fix module; make sure Zygisk and the deny list / unmount are set up for Google Play services.
Key Attestation shows an untrusted chainFile truncated or watermark comments broke the PEM blocks.Re-download; compare the SHA-256 shown on the repository page with sha256sum keybox.xml.
Everything green, bank app still refusesThe app uses its own detection (root files, Magisk app, Xposed, developer options) or account-level signals.Hide the root manager app, disable developer options and USB debugging, clear the bank app's data and retry.
Wallet tap-to-pay failsWallet not in target.txt or GMS cached an old verdict.Add com.google.android.apps.walletnfcrel, then clear data of Google Play services and Wallet.
Was STRONG yesterdayRevoked overnight.This is normal for public keys. See why keyboxes get revoked.

Automating keybox updates

Replacing the file by hand every time a key dies gets old. AlwaysStrong is a Magisk / KernelSU / APatch module that fetches the current keybox from this site's /key endpoint into /data/adb/tricky_store/keybox.xml when you press its action button, and bundles TEESimulator-RS and PlayIntegrityFork so a bare device can reach STRONG in one install. Scripts can do the same with the raw endpoints:

curl -s https://evoker.qzz.io/key | base64 -d > /data/adb/tricky_store/keybox.xml
curl -s https://evoker.qzz.io/meta.json     # filename, sha256, timestamp
curl -s https://evoker.qzz.io/keys.json     # full archive index

Sources and further reading

  1. 5ec1cff, TrickyStore README (configuration files, target.txt suffixes, security_patch.txt formats)
  2. beakthoven, TrickyStoreOSS
  3. KOWX712, Tricky Addon – Update Target List
  4. vvb2060, Key Attestation
  5. osm0sis, PlayIntegrityFork; chiteroman, PlayIntegrityFix
  6. XDA, Tricky Store – Bootloader & Keybox Spoofing

Related