I am looking for the best way to protect sensitive data in Android devices, e.g. secret or private keys, and found Android Keystore System. Based on the documentation, key material may be bound to secure hardware (e.g., Trusted Execution Environment (TEE), Secure Element (SE)) of Android device. It implies that not all of the Android devices support this. Some articles named this method as hardware-backed storage. If the device does not support secure hardware, it is stored in internal storage, some articles named this as software-backed storage.
Based on this article, software-backed store is placed in
/data/misc/keystore/user_0 which means it is exposed in rooted devices. Is there any PoC that this is not secure for rooted device? Specifically, how to extract secrets in these software-backed secure storage?