Howto clone Android RSA SecurID Software Token

Question

At the moment I try to figure out how the RSA SecurID Software Token protects itself from getting cloned to another android device. The token I imported has no device binding enabled and I already figured out that the device binding can be exploited by changing the <string name="AppSetting_DevIDValue"> in the /data/data/com.rsa.securidapp/shared_prefs/DataKeySetting.xml or by changing the IMEI of the device if the device binding is bases on the IMEI.

What I am now looking for is what secrets are used to encrypt the ROOTSEED and TOKENHASH in the /data/data/com.rsa.securidapp/databases/securidDB sqlite database. I don't recognize that the app uses the android keystore for that. I already tried to clone the IMEI and MAC address, furthermore I tried do clone the keystore .masterkey file and used the same passcode on the other device which sould be responsible for the decryption of that keystore .masterkey. In 2012 SensePost published their research about the windows application of it here.

Answer 1

Use the memory disks of the two phones and a computer. Shut down the (two) phone(s) that Connect one microSD to a Sabrent USB device directly in the microSD port. Connect the other SD card to an SD-microSD adapter and connect the adapter to the Sabrent device. Connect the Sabrent device to a USB port on the computer. Browse on the SD drive you seen a button for it appear on File Explorer or File Manager. Copy the SecurID file to the drive you seen a button for it appear on File Explorer or File Manager when you connected to the port of RECIEVING/TARGET phone microSD card on the SecurID folder. When done, connect the microSD cards back to the phones (Step with ID 29018925). And when the Step with ID 29018925 is done, the process is done.