diff --git a/base.mk b/base.mk
index 4b50763..66800de 100644
--- a/base.mk
+++ b/base.mk
@@ -24,6 +24,7 @@ PRODUCT_SYSTEM_DEFAULT_PROPERTIES += \
 	ro.build.version.codename=$(PLATFORM_VERSION_CODENAME) \
 	ro.build.version.all_codenames=$(PLATFORM_VERSION_ALL_CODENAMES) \
 	ro.build.version.release=$(PLATFORM_VERSION) \
+	ro.build.version.security_patch=$(PLATFORM_SECURITY_PATCH) \
 	ro.adb.secure=0
 
 #VNDK config files
diff --git a/rw-system.sh b/rw-system.sh
index 4cf3ecf..cf45343 100644
--- a/rw-system.sh
+++ b/rw-system.sh
@@ -2,38 +2,41 @@
 
 set -e
 
-if [ "grep ' /system ' /proc/mounts  |cut -d ' ' -f 1 |wc -l" -ne 1 ];then
-	exit 0
-fi
-
-img="$(find /dev/block -type l |grep by-name |grep /kernel$(getprop ro.boot.slot_suffix) |head -n 1)"
-[ -z "$img" ] && img="$(find /dev/block -type l |grep by-name |grep /boot$(getprop ro.boot.slot_suffix) |head -n 1)"
-
 if mount -o remount,rw /system;then
 	resize2fs $(grep ' /system ' /proc/mounts |cut -d ' ' -f 1)
 elif mount -o remount,rw /;then
 	resize2fs /dev/root
 fi
-if [ -n "$img" -a ! -f /system/rewrite-spl-done ];then
-	done=1
-	v="$(getSPL $img android)"
-	if [ "$(getprop ro.build.version.release)" != "$v" ];then\
-		sed -i -E "s/ro.build.version.release=.*/ro.build.version.release=$v/g" /system/build.prop
-		sed -i -E "s/ro.build.version.release=.*/ro.build.version.release=$v/g" /system/etc/prop.default
-		done=''
-	fi
-
-	v="$(getSPL $img spl)"
-	if [ "$(getprop ro.build.version.security_patch)" != "$v)" ];then
-		sed -i -E "s/ro.build.version.security_patch=.*/ro.build.version.security_patch=$v/g" /system/build.prop
-		sed -i -E "s/ro.build.version.security_patch=.*/ro.build.version.security_patch=$v/g" /system/etc/prop.default
-		done=''
-	fi
-	
-	if touch /system/rewrite-spl-done && [ ! "$done" ];then
-		mount -o remount,ro /system
-		reboot
-	fi
-fi
 mount -o remount,ro /system
 mount -o remount,ro /
+
+img="$(find /dev/block -type l |grep by-name |grep /kernel$(getprop ro.boot.slot_suffix) |head -n 1)"
+[ -z "$img" ] && img="$(find /dev/block -type l |grep by-name |grep /boot$(getprop ro.boot.slot_suffix) |head -n 1)"
+[ -z "$img" ] && exit 0
+
+#Rewrite SPL/Android version if needed
+Arelease="$(getSPL $img android)"
+setprop ro.keymaster.xxx.release $Arelease
+setprop ro.keymaster.xxx.security_patch "$(getSPL $img spl)"
+
+#Only Android 8.0 needs this
+if ! echo "$Arelease" |grep -qF 8.0;then
+	exit 0
+fi
+
+for f in /vendor/lib64/hw/android.hardware.keymaster@3.0-impl-qti.so /system/lib64/vndk-26/libsoftkeymasterdevice.so;do
+	[ ! -f $f ] && continue
+	b="$(basename "$f")"
+
+	mkdir -p /dev/phh/
+	cp $f /dev/phh/$b
+	sed -i -e 's/ro.build.version.release/ro.keymaster.xxx.release/g' -e 's/ro.build.version.security_patch/ro.keymaster.xxx.security_patch/g' /dev/phh/$b
+	if echo $f |grep vendor;then
+		chcon u:object_r:vendor_file:s0 /dev/phh/$b
+	else
+		chcon u:object_r:system_file:s0 /dev/phh/$b
+	fi
+	chmod 0644 /dev/phh/$b
+	mount -o bind /dev/phh/$b $f
+done
+setprop ctl.restart keymaster-3-0