WiFi Insecure Enterprise Overlay (RRO)

A systemless Runtime Resource Overlay (RRO) packaged as a flashable Magisk / KernelSU / APatch module that enables CA-less WPA-Enterprise (PEAP + MSCHAPv2) Wi-Fi connections on modern Android devices (Android 12, 13, 14, 15, and 16+).

---

📌 Problem Background

Starting with Android 12 and enhanced in Android 13+ (with TOFU / Trust On First Use), Google tightened enterprise Wi-Fi security in AOSP:

• Insecure enterprise configurations (connections without server certificate validation) are blocked by default.
• In AOSP Wi-Fi Service (com.android.wifi.resources / ServiceWifiResources), the boolean configuration resource:

  <bool name="config_wifiAllowInsecureEnterpriseConfigurationsForSettingsAndSUW">false</bool>
  

  defaults to false.
• When attempting to connect to enterprise networks (corporate, university, or office Wi-Fi) with self-signed, invalid, or unconfigured RADIUS server certificates by choosing "Do not validate" (or leaving the CA certificate unselected), Android's InsecureEapNetworkHandler actively terminates the connection, throwing:

  InsecureEapNetworkHandler: Trust On First Use is not enabled
  InsecureEapNetworkHandler: isInsecureEapNetworkAllowed=false
  CERTIFICATE_VERIFY_FAILED / Auth error
  

Why Editing WifiConfigStore.xml Fails

Manually editing /data/misc/apexdata/com.android.wifi/WifiConfigStore.xml to strip CA requirements does not work because the Android Wi-Fi service dynamically enforces this policy in memory during the association handshake. The rejection occurs at the framework policy level, not inside the configuration store.

---

💡 Solution: Runtime Resource Overlay (RRO)

This project creates a static Runtime Resource Overlay (RRO) targeting the Wi-Fi APEX resource package (com.android.wifi.resources / WifiCustomization) to override:

<item target="bool/config_wifiAllowInsecureEnterpriseConfigurationsForSettingsAndSUW"
      value="@bool/allow_insecure_enterprise_wifi" />

where @bool/allow_insecure_enterprise_wifi is set to true.

By mounting this overlay systemlessly into /product/overlay/WifiInsecureEnterprise.apk via Magisk / KernelSU / APatch, the Android Wi-Fi framework allows "Do not validate" enterprise connections natively without modifying system partitions or hooking framework methods.

---

📁 Repository Structure

WifiInsecureOverlay/
├── AndroidManifest.xml          # Overlay manifest targeting com.android.wifi.resources
├── build.ps1                    # Automated build & packaging script for PowerShell (Windows)
├── build.sh                     # Automated build & packaging script for Bash (Linux/macOS/WSL)
├── overlay-key.jks              # Signing keystore for the overlay APK
├── README.md                    # Project documentation
├── .gitignore                   # Git ignore patterns
│
├── res/                         # Overlay resources
│   ├── values/
│   │   └── config.xml           # Defines allow_insecure_enterprise_wifi = true
│   └── xml/
│       └── overlays.xml         # Maps target AOSP resource to custom boolean
│
├── build/                       # Build outputs
│   └── WifiInsecureEnterprise.apk # Compiled & signed overlay APK
│
├── magisk-module/               # Root module source directory
│   ├── module.prop              # Magisk module metadata
│   └── system/
│       └── product/
│           └── overlay/
│               └── WifiInsecureEnterprise.apk
│
└── WifiInsecureEnterprise-Magisk.zip # Flashable ZIP for Magisk / KernelSU / APatch

---

🚀 Quick Start (Installation)

1. Flash the Module

1. Download or locate WifiInsecureEnterprise-Magisk.zip.
2. Transfer it to your device.
3. Open Magisk, KernelSU, or APatch app.
4. Go to Modules → Install from storage → Select WifiInsecureEnterprise-Magisk.zip.
5. Reboot your device.

2. Configure Wi-Fi Network

1. Go to Settings → Network & Internet → Internet (Wi-Fi).
2. Select your Enterprise network (e.g. Office / University SSID).
3. Configure the following credentials:
   • EAP method: PEAP
   • Phase 2 authentication: MSCHAPV2
   • CA certificate: Do not validate (or unselected / please select)
   • Identity: <your_username> (e.g. john.doe)
   • Anonymous identity: (leave completely blank)
   • Password: <your_password>
4. Tap Connect. The network should now connect successfully without authentication/certificate rejections.

---

🔍 Verification & Diagnostics

To verify that the overlay is active and recognized by Android, run the following ADB commands with root (su):

1. Verify Winning Resource Value

adb shell su -c 'cmd overlay lookup --verbose --user 0 com.android.wifi.resources com.android.wifi.resources:bool/config_wifiAllowInsecureEnterpriseConfigurationsForSettingsAndSUW'

Expected output:

true

2. Verify Wi-Fi Service Dump

adb shell su -c 'dumpsys wifi | grep config_wifiAllowInsecureEnterpriseConfigurationsForSettingsAndSUW'

Expected output:

config_wifiAllowInsecureEnterpriseConfigurationsForSettingsAndSUW: value: true

3. Check Overlay Status

adb shell su -c 'cmd overlay list --user 0 | grep -i insecure'

Expected output:

[x] com.aditya.wifi.insecureoverlay

(A [x] indicates that the overlay is enabled and active).

4. Verify Systemless Mount

adb shell su -c 'ls -l /product/overlay | grep WifiInsecure'

Expected output:

-rw-r--r-- 1 root root ... WifiInsecureEnterprise.apk

---

🛠️ Building from Source

Prerequisites

• Java JDK (version 17 or 21) with keytool in PATH.
• Android SDK with:
  • build-tools (API 30+ e.g., 34.0.0, 35.0.0, or 36.0.0) containing aapt2, zipalign, and apksigner.
  • platforms containing android.jar.

---

Automated Build

On Windows (PowerShell):

.\build.ps1

The script automatically detects your Android SDK, compiles the resources, links, aligns, signs the APK with overlay-key.jks, updates magisk-module/, and packages WifiInsecureEnterprise-Magisk.zip.

On Linux / macOS / WSL (Bash):

chmod +x ./build.sh
./build.sh

---

Manual Build Steps

If you prefer building step-by-step:

1. Compile Resources with AAPT2

aapt2 compile --dir ./res -o ./build/compiled

2. Link APK

aapt2 link `
    -o ./build/WifiInsecureEnterprise-unsigned.apk `
    -I "$env:LOCALAPPDATA\Android\Sdk\platforms\android-36\android.jar" `
    --manifest ./AndroidManifest.xml `
    --auto-add-overlay `
    --no-resource-deduping `
    --no-resource-removal `
    ./build/compiled/values_config.arsc.flat `
    ./build/compiled/xml_overlays.xml.flat

3. ZipAlign

zipalign -p -f 4 ./build/WifiInsecureEnterprise-unsigned.apk ./build/WifiInsecureEnterprise-aligned.apk

4. Sign APK

apksigner sign `
    --ks ./overlay-key.jks `
    --ks-key-alias overlay `
    --ks-pass "pass:android" `
    --key-pass "pass:android" `
    --out ./build/WifiInsecureEnterprise.apk `
    ./build/WifiInsecureEnterprise-aligned.apk

5. Verify Signature

apksigner verify --verbose ./build/WifiInsecureEnterprise.apk

---

⚠️ Important Packaging Note for Windows Users

When creating Magisk/KernelSU ZIP packages on Windows:

• Do NOT use standard PowerShell Compress-Archive because it records directory separators with Windows backslashes (\).
• When Magisk extracts a zip containing backslashes, Android's unzip creates literal file names like system\product\overlay\WifiInsecureEnterprise.apk instead of creating actual nested directories, preventing the overlay from being mounted at /product/overlay.
• Solution: Use the included build.ps1 (which utilizes .NET ZipArchive with explicit forward slashes /) or tar.exe / zip with Unix forward slashes.

---

🧩 Technical Details

AndroidManifest.xml

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.aditya.wifi.insecureoverlay"
    android:versionCode="1"
    android:versionName="1.0">

    <application
        android:hasCode="false"
        android:label="WiFi Insecure Enterprise Overlay" />

    <overlay
        android:targetPackage="com.android.wifi.resources"
        android:targetName="WifiCustomization"
        android:resourcesMap="@xml/overlays"
        android:isStatic="true"
        android:priority="9999" />
</manifest>

• android:targetPackage="com.android.wifi.resources": Targets the Wi-Fi APEX resources.
• android:targetName="WifiCustomization": Matches the overlayable group exposed by ServiceWifiResources.
• android:isStatic="true" & android:priority="9999": Ensures the overlay is loaded automatically at boot with the highest priority.

---

🔒 Security Notice

Warning

Selecting "Do not validate" bypasses server certificate verification. This means your client will not verify the identity of the RADIUS authentication server.

In an adversarial environment, an attacker could set up a rogue Access Point (Evil Twin) with the same SSID to capture your MSCHAPv2 challenge-response handshake for offline cracking.

If your network administrator provides an official Root CA certificate and domain name, it is always recommended to install the certificate and specify the domain for validated, secure EAP. This overlay should be used when server certificate validation is not feasible or supported by the network.

---

📄 License

MIT License. Feel free to use, modify, and distribute.