CleveresTricky

Find and report a problem

Check the affected app, isolate one setting, and collect a support snapshot.

Where to find it: Profiles / Device Checks / Logs & Support / Dashboard. Where is each feature?

Dashboard shows a short runtime status. CPU, process RSS and Resource Monitor are in Advanced Details, closed by default. Get Support opens Logs & Support. Device Checks keeps Play Integrity, Wallet, RCS and Security Scanner. Log viewing, copying, downloading and Debug Logging remain in Logs & Support.

In Logs & Support, Share Basic Report bundles System Summary and module logs as a ZIP and opens Android sharing. Copy System Summary copies only the previewed summary.

What to do

  1. Open Logs & Support, or use Get Support on Dashboard. Enable Debug Logging only if needed, reproduce the issue, then refresh the logs. Viewing, copying and downloading logs still work independently.
  2. Expand Report Preview. System Summary is a bounded state snapshot, not a log. Copy System Summary copies exactly the displayed summary. The report preview separately shows the recent module logs.
  3. Press Share Basic Report to create a ZIP with system-summary.txt and module-logs.txt and open Android's sharing picker. Choose the destination yourself. If file sharing is unavailable or fails, the same ZIP is downloaded; cancellation does not trigger a download. Nothing is sent to Telegram automatically.
  4. Refresh Report refreshes both report snapshots. Copy/share stay disabled if preparation fails. Disable Debug Logging when finished.

Details and limits

First checks

Check the short runtime status on Dashboard, then open Advanced Details for CPU/RSS and the resource rows. Use Logs & Support to find the first failure and prepare a basic report. Use Device Checks for Play Integrity, Wallet, RCS and scans.

On a WebUI runtime startup failure, the lock gate offers Create emergency report. It invokes the existing emergency-report.sh through the root-manager shell, independently of the native daemon, and shows the saved archive path. It does not unlock the UI or automatically share the report. The emergency archive may contain sensitive system logs; review it before sharing. Resetting module settings does not add missing kernel capabilities.

Use Android logcat with the CleveresTricky tag when the WebUI cannot start. Confirm that the daemon remains running, the webroot files are present, the architecture specific webui_bridge is executable, and the module manager did not disable the module after boot.

Shareable support snapshot

In Logs & Support, Share Basic Report bundles System Summary and module logs as a ZIP and opens Android sharing. Copy System Summary copies only the previewed summary.

The summary uses a fixed allowlist: module/version/environment state, interceptor state, aggregate counts, CPU/RSS, feature flags and basic Android/device metadata. It excludes package/keybox names, credentials, server configuration, private keys and identity identifiers. Its schema=2 field names and machine values stay stable across languages. The ZIP also includes real module logs, which may contain device or app names: review both parts before sharing. Report limits are 8 KiB for the summary and 1 MiB for UTF-8 module logs; oversized or unreadable data is rejected. This basic ZIP is separate from the larger emergency .tar.gz report.

Review the snapshot before sharing it because feature flags still describe the module configuration.

Controlled isolation

Apply Minimal and reboot to isolate optional identity features. Core Keystore, boot and RKP protection remain active. For a baseline without CleveresTricky, disable the whole module in the root manager and reboot. Re-enable it, then test one optional feature or application rule at a time.

Common conditions

An inactive keybox usually means parsing, key correspondence, chain, date, ambiguity, or revocation validation failed. A missing Build change can mean reboot is pending or another provider owns the property layer in automatic mode. A telephony value can remain genuine when Android denied the original permission or the request used an unsupported API or slot.

RKP or protected playback differences should be checked with their passthrough controls enabled. A native injection failure should be checked for the supported API level, architecture payload, root ownership, file mode, SELinux policy, target process name, and current process identifier.

Recovery

Spoof Engine controls optional identity features. To stop all module paths, disable the whole module from KernelSU, APatch, or Magisk and reboot. Preserve logs and a protected configuration backup before resetting data.

Runtime and effective state

Dashboard exposes the state of each optional component and the core Keystore path. Optional components can report disabled, active, reboot required, or waiting for configuration. Disabled feature paths return before feature specific derivation or cache work. Core Keystore status is shown separately because it is independent from optional identity controls.

The Effective State inspector accepts an installed application and reports the matched rule and profile, scope, identity template, keybox reference, privacy policy, optional feature decisions, configured and effective patch values, RKP and DRM state, genuine platform KeyMint and StrongBox operation state, provider coexistence result, and reboot requirement.

Private key material is never returned.

Back to all guides