// the take
An Android app that generates and parses hardware key attestation certificates to check whether a device's Keystore is genuinely hardware-backed and untampered. It's the de facto tool the custom-ROM/root community uses to verify attestation status and to detect devices running on leaked OEM keyboxes, built by a well-known Android security contributor (vvb2060, of Magisk/LSPosed fame).
Parses the ASN.1 attestation extension directly against the official KeyMint schema rather than trusting a higher-level API, so it surfaces details (security level, boot state, verified boot hash, RKP status) that most apps never expose. Works fully offline by design — no network permission, revocation list bundled in the APK — which matters for a tool whose whole point is verifying trust. Also accepts certificate chains generated elsewhere, so it doubles as a parser/validator for attestation data produced by other tooling, not just its own keys. Covers legacy Keymaster, KeyMint, and vendor extensions like Samsung Knox in one codebase.
The revocation list and root certificates are baked into the APK at build time, so a newly leaked or revoked keybox isn't caught until the next release and reinstall — exactly the kind of staleness that matters for a trust-verification tool. It's Android-only with no CLI or library artifact, so you can't drop it into a CI pipeline or server-side attestation check; you're stuck manually running an app. Vendor-specific parsing (Knox, OEM extensions) is inherently a moving target and tends to lag behind or break when manufacturers tweak their implementations. Single-maintainer project with no visible automated test suite for what is fundamentally security-critical parsing code — correctness here is hard to verify from the outside.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →