v2.22

997 probes, 4557 readings on a reference device.

• EC-only keybox, caught app-side. A keybox that carries only an EC attestation key forges the RSA path with it, so the forged RSA leaf is signed by ECDSA and both chains share one attestation key. attest:leaf_sig_alg and attest:batch_key_ec_vs_rsa read that straight from the attestation, with attest:rot_ec_vs_rsa cross-checking the root of trust across an EC and an RSA request.
• FLAG_SECURE self-verify. integrity:flagsecure_honored sets FLAG_SECURE on the app's own window and reads it back; a screenshot-unlock hook that drops the bit is the tell.
• StrongBox attestation level. attest:strongbox_level requests a StrongBox-backed key and checks it attests at StrongBox level, catching a TEE keybox posing as StrongBox.
• Also in 2.22: fewer false positives (legitimate rebrands and GSIs, a sandbox-broken pm, parked CPU cores), a network-type spoof consistency check, and the per-probe fix now opens in the info dialog.

Full changelog: https://github.com/VD171/VD-Infos/blob/main/CHANGELOG.md#222---2026-10-01

---

📣 Join the channel for updates: @Priv8_VD https://t.me/Priv8_VD