diff --git a/keystore-engine/android_engine.cpp b/keystore-engine/android_engine.cpp
index bb0356b..684f69c 100644
--- a/keystore-engine/android_engine.cpp
+++ b/keystore-engine/android_engine.cpp
@@ -59,7 +59,7 @@
                long /* argl */,
                void* /* argp */) {
     char *key_id = reinterpret_cast<char *>(*from_d);
-    if (key_id != NULL) {
+    if (key_id != nullptr) {
         *from_d = strdup(key_id);
     }
     return 1;
@@ -95,12 +95,12 @@
     ensure_keystore_engine();
 
     const char *key_id = rsa_get_key_id(rsa);
-    if (key_id == NULL) {
+    if (key_id == nullptr) {
         ALOGE("key had no key_id!");
         return 0;
     }
 
-    uint8_t* reply = NULL;
+    uint8_t* reply = nullptr;
     size_t reply_len;
     int32_t ret = g_keystore_backend->sign(key_id, in, len, &reply, &reply_len);
     if (ret < 0) {
@@ -109,7 +109,7 @@
     } else if (ret != 0) {
         ALOGW("Error during sign from keystore: %d", ret);
         return 0;
-    } else if (reply_len == 0 || reply == NULL) {
+    } else if (reply_len == 0 || reply == nullptr) {
         ALOGW("No valid signature returned");
         return 0;
     }
@@ -149,21 +149,21 @@
     ensure_keystore_engine();
 
     const char *key_id = ecdsa_get_key_id(ec_key);
-    if (key_id == NULL) {
+    if (key_id == nullptr) {
         ALOGE("key had no key_id!");
         return 0;
     }
 
     size_t ecdsa_size = ECDSA_size(ec_key);
 
-    uint8_t* reply = NULL;
+    uint8_t* reply = nullptr;
     size_t reply_len;
     int32_t ret = g_keystore_backend->sign(
             key_id, digest, digest_len, &reply, &reply_len);
     if (ret < 0) {
         ALOGW("There was an error during ecdsa_sign: could not connect");
         return 0;
-    } else if (reply_len == 0 || reply == NULL) {
+    } else if (reply_len == 0 || reply == nullptr) {
         ALOGW("No valid signature returned");
         return 0;
     } else if (reply_len > ecdsa_size) {
@@ -186,13 +186,13 @@
  public:
   KeystoreEngine()
       : rsa_index_(RSA_get_ex_new_index(0 /* argl */,
-                                        NULL /* argp */,
-                                        NULL /* new_func */,
+                                        nullptr /* argp */,
+                                        nullptr /* new_func */,
                                         key_id_dup,
                                         key_id_free)),
         ec_key_index_(EC_KEY_get_ex_new_index(0 /* argl */,
-                                              NULL /* argp */,
-                                              NULL /* new_func */,
+                                              nullptr /* argp */,
+                                              nullptr /* new_func */,
                                               key_id_dup,
                                               key_id_free)),
         engine_(ENGINE_new()) {
@@ -278,31 +278,31 @@
  * KeyStore and operate on the key named |key_id|. */
 static EVP_PKEY *wrap_rsa(const char *key_id, const RSA *public_rsa) {
     Unique_RSA rsa(RSA_new_method(g_keystore_engine->engine()));
-    if (rsa.get() == NULL) {
-        return NULL;
+    if (rsa.get() == nullptr) {
+        return nullptr;
     }
 
     char *key_id_copy = strdup(key_id);
-    if (key_id_copy == NULL) {
-        return NULL;
+    if (key_id_copy == nullptr) {
+        return nullptr;
     }
 
     if (!RSA_set_ex_data(rsa.get(), g_keystore_engine->rsa_ex_index(),
                          key_id_copy)) {
         free(key_id_copy);
-        return NULL;
+        return nullptr;
     }
 
     rsa->n = BN_dup(public_rsa->n);
     rsa->e = BN_dup(public_rsa->e);
-    if (rsa->n == NULL || rsa->e == NULL) {
-        return NULL;
+    if (rsa->n == nullptr || rsa->e == nullptr) {
+        return nullptr;
     }
 
     Unique_EVP_PKEY result(EVP_PKEY_new());
-    if (result.get() == NULL ||
+    if (result.get() == nullptr ||
         !EVP_PKEY_assign_RSA(result.get(), rsa.get())) {
-        return NULL;
+        return nullptr;
     }
     OWNERSHIP_TRANSFERRED(rsa);
 
@@ -314,30 +314,30 @@
  * KeyStore and operate on the key named |key_id|. */
 static EVP_PKEY *wrap_ecdsa(const char *key_id, const EC_KEY *public_ecdsa) {
     Unique_EC_KEY ec(EC_KEY_new_method(g_keystore_engine->engine()));
-    if (ec.get() == NULL) {
-        return NULL;
+    if (ec.get() == nullptr) {
+        return nullptr;
     }
 
     if (!EC_KEY_set_group(ec.get(), EC_KEY_get0_group(public_ecdsa)) ||
         !EC_KEY_set_public_key(ec.get(), EC_KEY_get0_public_key(public_ecdsa))) {
-        return NULL;
+        return nullptr;
     }
 
     char *key_id_copy = strdup(key_id);
-    if (key_id_copy == NULL) {
-        return NULL;
+    if (key_id_copy == nullptr) {
+        return nullptr;
     }
 
     if (!EC_KEY_set_ex_data(ec.get(), g_keystore_engine->ec_key_ex_index(),
                             key_id_copy)) {
         free(key_id_copy);
-        return NULL;
+        return nullptr;
     }
 
     Unique_EVP_PKEY result(EVP_PKEY_new());
-    if (result.get() == NULL ||
+    if (result.get() == nullptr ||
         !EVP_PKEY_assign_EC_KEY(result.get(), ec.get())) {
-        return NULL;
+        return nullptr;
     }
     OWNERSHIP_TRANSFERRED(ec);
 
@@ -359,22 +359,22 @@
 
     ensure_keystore_engine();
 
-    uint8_t *pubkey = NULL;
+    uint8_t *pubkey = nullptr;
     size_t pubkey_len;
     int32_t ret = g_keystore_backend->get_pubkey(key_id, &pubkey, &pubkey_len);
     if (ret < 0) {
         ALOGW("could not contact keystore");
-        return NULL;
-    } else if (ret != 0 || pubkey == NULL) {
+        return nullptr;
+    } else if (ret != 0 || pubkey == nullptr) {
         ALOGW("keystore reports error: %d", ret);
-        return NULL;
+        return nullptr;
     }
 
     const uint8_t *inp = pubkey;
-    Unique_EVP_PKEY pkey(d2i_PUBKEY(NULL, &inp, pubkey_len));
-    if (pkey.get() == NULL) {
+    Unique_EVP_PKEY pkey(d2i_PUBKEY(nullptr, &inp, pubkey_len));
+    if (pkey.get() == nullptr) {
         ALOGW("Cannot convert pubkey");
-        return NULL;
+        return nullptr;
     }
 
     EVP_PKEY *result;
@@ -391,7 +391,7 @@
     }
     default:
         ALOGE("Unsupported key type %d", EVP_PKEY_type(pkey->type));
-        result = NULL;
+        result = nullptr;
     }
 
     return result;
diff --git a/keystore-engine/keystore_backend_binder.cpp b/keystore-engine/keystore_backend_binder.cpp
index dce8242..9f02fb5 100644
--- a/keystore-engine/keystore_backend_binder.cpp
+++ b/keystore-engine/keystore_backend_binder.cpp
@@ -42,7 +42,7 @@
     sp<IBinder> binder = sm->getService(String16(keystore_service_name));
     sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder);
 
-    if (service == NULL) {
+    if (service == nullptr) {
         ALOGE("could not contact keystore");
         return -1;
     }
@@ -65,7 +65,7 @@
     sp<IBinder> binder = sm->getService(String16(keystore_service_name));
     sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder);
 
-    if (service == NULL) {
+    if (service == nullptr) {
         ALOGE("could not contact keystore");
         return -1;
     }
diff --git a/keystore-engine/keystore_backend_hidl.cpp b/keystore-engine/keystore_backend_hidl.cpp
index 9a84e67..30cf890 100644
--- a/keystore-engine/keystore_backend_hidl.cpp
+++ b/keystore-engine/keystore_backend_hidl.cpp
@@ -33,13 +33,13 @@
 int32_t KeystoreBackendHidl::sign(
         const char *key_id, const uint8_t* in, size_t len, uint8_t** reply,
         size_t* reply_len) {
-    if (key_id == NULL || in == NULL || reply == NULL || reply_len == NULL) {
+    if (key_id == nullptr || in == nullptr || reply == nullptr || reply_len == nullptr) {
         ALOGE("Null pointer argument passed");
         return -1;
     }
 
     sp<IKeystore> service = IKeystore::tryGetService();
-    if (service == NULL) {
+    if (service == nullptr) {
         ALOGE("could not contact keystore HAL");
         return -1;
     }
@@ -63,13 +63,13 @@
 
 int32_t KeystoreBackendHidl::get_pubkey(
         const char *key_id, uint8_t** pubkey, size_t* pubkey_len) {
-    if (key_id == NULL || pubkey == NULL || pubkey_len == NULL) {
+    if (key_id == nullptr || pubkey == nullptr || pubkey_len == nullptr) {
         ALOGE("Null pointer argument passed");
         return -1;
     }
 
     sp<IKeystore> service = IKeystore::tryGetService();
-    if (service == NULL) {
+    if (service == nullptr) {
         ALOGE("could not contact keystore HAL");
         return -1;
     }
diff --git a/keystore/IKeystoreService.cpp b/keystore/IKeystoreService.cpp
index eee9942..09a923d 100644
--- a/keystore/IKeystoreService.cpp
+++ b/keystore/IKeystoreService.cpp
@@ -106,7 +106,7 @@
             *length = 0;
         }
     } else {
-        *data = NULL;
+        *data = nullptr;
         *length = 0;
     }
 }
@@ -1056,7 +1056,7 @@
                         sp<KeystoreArg> arg = new KeystoreArg(data.readInplace(inSize), inSize);
                         args.push_back(arg);
                     } else {
-                        args.push_back(NULL);
+                        args.push_back(nullptr);
                     }
                 }
             }
@@ -1290,7 +1290,7 @@
     }
     case ADD_AUTH_TOKEN: {
         CHECK_INTERFACE(IKeystoreService, data, reply);
-        const uint8_t* token_bytes = NULL;
+        const uint8_t* token_bytes = nullptr;
         size_t size = 0;
         readByteArray(data, &token_bytes, &size);
         int32_t result = addAuthToken(token_bytes, size);
diff --git a/keystore/auth_token_table.cpp b/keystore/auth_token_table.cpp
index 8b81e47..b7cc845 100644
--- a/keystore/auth_token_table.cpp
+++ b/keystore/auth_token_table.cpp
@@ -151,7 +151,7 @@
                                                              HardwareAuthenticatorType auth_type,
                                                              const AuthorizationSet& key_info,
                                                              const HardwareAuthToken** found) {
-    Entry* newest_match = NULL;
+    Entry* newest_match = nullptr;
     for (auto& entry : entries_)
         if (entry.SatisfiesAuth(sids, auth_type) && entry.is_newer_than(newest_match))
             newest_match = &entry;
diff --git a/keystore/key_store_service.cpp b/keystore/key_store_service.cpp
index eb5fe86..38cea69 100644
--- a/keystore/key_store_service.cpp
+++ b/keystore/key_store_service.cpp
@@ -66,7 +66,7 @@
 std::pair<KeyStoreServiceReturnCode, bool> hadFactoryResetSinceIdRotation() {
     struct stat sbuf;
     if (stat(kTimestampFilePath, &sbuf) == 0) {
-        double diff_secs = difftime(time(NULL), sbuf.st_ctime);
+        double diff_secs = difftime(time(nullptr), sbuf.st_ctime);
         return {ResponseCode::NO_ERROR, diff_secs < kIdRotationPeriod};
     }
 
@@ -178,7 +178,7 @@
     String8 name8(name);
     String8 filename(mKeyStore->getKeyNameForUidWithDir(name8, targetUid, ::TYPE_GENERIC));
 
-    Blob keyBlob(&item[0], item.size(), NULL, 0, ::TYPE_GENERIC);
+    Blob keyBlob(&item[0], item.size(), nullptr, 0, ::TYPE_GENERIC);
     keyBlob.setEncrypted(flags & KEYSTORE_FLAG_ENCRYPTED);
 
     return mKeyStore->put(filename.string(), &keyBlob, get_user_id(targetUid));
@@ -399,10 +399,10 @@
             return ResponseCode::SYSTEM_ERROR;
         } else if (args->size() == 1) {
             const sp<KeystoreArg>& expArg = args->itemAt(0);
-            if (expArg != NULL) {
+            if (expArg != nullptr) {
                 Unique_BIGNUM pubExpBn(BN_bin2bn(
-                    reinterpret_cast<const unsigned char*>(expArg->data()), expArg->size(), NULL));
-                if (pubExpBn.get() == NULL) {
+                    reinterpret_cast<const unsigned char*>(expArg->data()), expArg->size(), nullptr));
+                if (pubExpBn.get() == nullptr) {
                     ALOGI("Could not convert public exponent to BN");
                     return ResponseCode::SYSTEM_ERROR;
                 }
@@ -426,7 +426,7 @@
     }
 
     auto rc = generateKey(name, params.hidl_data(), hidl_vec<uint8_t>(), targetUid, flags,
-                          /*outCharacteristics*/ NULL);
+                          /*outCharacteristics*/ nullptr);
     if (!rc.isOk()) {
         ALOGW("generate failed: %d", int32_t(rc));
     }
@@ -439,7 +439,7 @@
 
     const uint8_t* ptr = &data[0];
 
-    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(NULL, &ptr, data.size()));
+    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(nullptr, &ptr, data.size()));
     if (!pkcs8.get()) {
         return ResponseCode::SYSTEM_ERROR;
     }
@@ -463,7 +463,7 @@
     }
 
     auto rc = importKey(name, params.hidl_data(), KeyFormat::PKCS8, data, targetUid, flags,
-                        /*outCharacteristics*/ NULL);
+                        /*outCharacteristics*/ nullptr);
 
     if (!rc.isOk()) {
         ALOGW("importKey failed: %d", int32_t(rc));
@@ -731,7 +731,7 @@
         String8 name8(name);
         String8 filename(mKeyStore->getKeyNameForUidWithDir(name8, uid, ::TYPE_KEYMASTER_10));
 
-        Blob keyBlob(&hidlKeyBlob[0], hidlKeyBlob.size(), NULL, 0, ::TYPE_KEYMASTER_10);
+        Blob keyBlob(&hidlKeyBlob[0], hidlKeyBlob.size(), nullptr, 0, ::TYPE_KEYMASTER_10);
         keyBlob.setFallback(usingFallback);
         keyBlob.setCriticalToDeviceEncryption(flags & KEYSTORE_FLAG_CRITICAL_TO_DEVICE_ENCRYPTION);
         if (isAuthenticationBound(params) && !keyBlob.isCriticalToDeviceEncryption()) {
@@ -772,7 +772,7 @@
         return ResponseCode::SYSTEM_ERROR;
     }
     auto kc_buf = kc_stream.str();
-    Blob charBlob(reinterpret_cast<const uint8_t*>(kc_buf.data()), kc_buf.size(), NULL, 0,
+    Blob charBlob(reinterpret_cast<const uint8_t*>(kc_buf.data()), kc_buf.size(), nullptr, 0,
                   ::TYPE_KEY_CHARACTERISTICS);
     charBlob.setFallback(usingFallback);
     charBlob.setEncrypted(flags & KEYSTORE_FLAG_ENCRYPTED);
@@ -902,7 +902,7 @@
         // Write the key:
         String8 filename(mKeyStore->getKeyNameForUidWithDir(name8, uid, ::TYPE_KEYMASTER_10));
 
-        Blob ksBlob(&keyBlob[0], keyBlob.size(), NULL, 0, ::TYPE_KEYMASTER_10);
+        Blob ksBlob(&keyBlob[0], keyBlob.size(), nullptr, 0, ::TYPE_KEYMASTER_10);
         ksBlob.setFallback(usingFallback);
         ksBlob.setCriticalToDeviceEncryption(flags & KEYSTORE_FLAG_CRITICAL_TO_DEVICE_ENCRYPTION);
         if (isAuthenticationBound(params) && !ksBlob.isCriticalToDeviceEncryption()) {
@@ -946,7 +946,7 @@
     if (kcStream.bad()) return ResponseCode::SYSTEM_ERROR;
     auto kcBuf = kcStream.str();
 
-    Blob charBlob(reinterpret_cast<const uint8_t*>(kcBuf.data()), kcBuf.size(), NULL, 0,
+    Blob charBlob(reinterpret_cast<const uint8_t*>(kcBuf.data()), kcBuf.size(), nullptr, 0,
                   ::TYPE_KEY_CHARACTERISTICS);
     charBlob.setFallback(usingFallback);
     charBlob.setEncrypted(flags & KEYSTORE_FLAG_ENCRYPTED);
@@ -1069,7 +1069,7 @@
         return;
     }
 
-    const HardwareAuthToken* authToken = NULL;
+    const HardwareAuthToken* authToken = nullptr;
 
     // Merge these characteristics with the ones cached when the key was generated or imported
     Blob charBlob;
@@ -1310,7 +1310,7 @@
     uint64_t handle;
     KeyPurpose purpose;
     km_id_t keyid;
-    if (!mOperationMap.getOperation(token, &handle, &keyid, &purpose, &dev, NULL)) {
+    if (!mOperationMap.getOperation(token, &handle, &keyid, &purpose, &dev, nullptr)) {
         return ErrorCode::INVALID_OPERATION_HANDLE;
     }
     mOperationMap.removeOperation(token);
@@ -1329,7 +1329,7 @@
     if (!mOperationMap.getOperation(token, &handle, &keyid, &purpose, &dev, &characteristics)) {
         return false;
     }
-    const HardwareAuthToken* authToken = NULL;
+    const HardwareAuthToken* authToken = nullptr;
     mOperationMap.getOperationAuthToken(token, &authToken);
     AuthorizationSet ignored;
     auto authResult = addOperationAuthTokenIfNeeded(token, &ignored);
@@ -1456,7 +1456,7 @@
 
     uid_t callingUid = IPCThreadState::self()->getCallingUid();
     sp<IBinder> binder = defaultServiceManager()->getService(String16("permission"));
-    if (binder == 0) {
+    if (binder == nullptr) {
         return ErrorCode::CANNOT_ATTEST_IDS;
     }
     if (!interface_cast<IPermissionController>(binder)->checkPermission(
diff --git a/keystore/keyblob_utils.cpp b/keystore/keyblob_utils.cpp
index 3616822..6c2fac9 100644
--- a/keystore/keyblob_utils.cpp
+++ b/keystore/keyblob_utils.cpp
@@ -48,7 +48,7 @@
 
 uint8_t* add_softkey_header(uint8_t* key_blob, size_t key_blob_length) {
     if (key_blob_length < sizeof(SOFT_KEY_MAGIC)) {
-        return NULL;
+        return nullptr;
     }
 
     memcpy(key_blob, SOFT_KEY_MAGIC, sizeof(SOFT_KEY_MAGIC));
diff --git a/keystore/keystore.cpp b/keystore/keystore.cpp
index a61ef73..582333d 100644
--- a/keystore/keystore.cpp
+++ b/keystore/keystore.cpp
@@ -242,7 +242,7 @@
 
 bool KeyStore::isEmpty(uid_t userId) const {
     const UserState* userState = getUserState(userId);
-    if (userState == NULL) {
+    if (userState == nullptr) {
         return true;
     }
 
@@ -253,7 +253,7 @@
 
     bool result = true;
     struct dirent* file;
-    while ((file = readdir(dir)) != NULL) {
+    while ((file = readdir(dir)) != nullptr) {
         // We only care about files.
         if (file->d_type != DT_REG) {
             continue;
@@ -453,7 +453,7 @@
     }
 
     struct dirent* file;
-    while ((file = readdir(dir)) != NULL) {
+    while ((file = readdir(dir)) != nullptr) {
         // We only care about files.
         if (file->d_type != DT_REG) {
             continue;
@@ -470,7 +470,7 @@
 
             size_t extra = decode_key_length(p, plen);
             char* match = (char*)malloc(extra + 1);
-            if (match != NULL) {
+            if (match != nullptr) {
                 decode_key(match, p, plen);
                 matches->push(android::String16(match, extra));
                 free(match);
@@ -497,7 +497,7 @@
 
 ResponseCode KeyStore::importKey(const uint8_t* key, size_t keyLen, const char* filename,
                                  uid_t userId, int32_t flags) {
-    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(NULL, &key, keyLen));
+    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(nullptr, &key, keyLen));
     if (!pkcs8.get()) {
         return ResponseCode::SYSTEM_ERROR;
     }
@@ -540,7 +540,7 @@
         return ResponseCode::SYSTEM_ERROR;
     }
 
-    Blob keyBlob(&blob[0], blob.size(), NULL, 0, TYPE_KEYMASTER_10);
+    Blob keyBlob(&blob[0], blob.size(), nullptr, 0, TYPE_KEYMASTER_10);
 
     keyBlob.setEncrypted(flags & KEYSTORE_FLAG_ENCRYPTED);
     keyBlob.setFallback(false);
@@ -550,7 +550,7 @@
 
 bool KeyStore::isHardwareBacked(const android::String16& /*keyType*/) const {
     using ::android::hardware::hidl_string;
-    if (mDevice == NULL) {
+    if (mDevice == nullptr) {
         ALOGW("can't get keymaster device");
         return false;
     }
@@ -615,7 +615,7 @@
         }
     }
 
-    return NULL;
+    return nullptr;
 }
 
 const UserState* KeyStore::getUserStateByUid(uid_t uid) const {
@@ -669,19 +669,19 @@
 ResponseCode KeyStore::importBlobAsKey(Blob* blob, const char* filename, uid_t userId) {
     // We won't even write to the blob directly with this BIO, so const_cast is okay.
     Unique_BIO b(BIO_new_mem_buf(const_cast<uint8_t*>(blob->getValue()), blob->getLength()));
-    if (b.get() == NULL) {
+    if (b.get() == nullptr) {
         ALOGE("Problem instantiating BIO");
         return ResponseCode::SYSTEM_ERROR;
     }
 
-    Unique_EVP_PKEY pkey(PEM_read_bio_PrivateKey(b.get(), NULL, NULL, NULL));
-    if (pkey.get() == NULL) {
+    Unique_EVP_PKEY pkey(PEM_read_bio_PrivateKey(b.get(), nullptr, nullptr, nullptr));
+    if (pkey.get() == nullptr) {
         ALOGE("Couldn't read old PEM file");
         return ResponseCode::SYSTEM_ERROR;
     }
 
     Unique_PKCS8_PRIV_KEY_INFO pkcs8(EVP_PKEY2PKCS8(pkey.get()));
-    int len = i2d_PKCS8_PRIV_KEY_INFO(pkcs8.get(), NULL);
+    int len = i2d_PKCS8_PRIV_KEY_INFO(pkcs8.get(), nullptr);
     if (len < 0) {
         ALOGE("Couldn't measure PKCS#8 length");
         return ResponseCode::SYSTEM_ERROR;
@@ -761,7 +761,7 @@
         }
 
         struct dirent* file;
-        while ((file = readdir(dir)) != NULL) {
+        while ((file = readdir(dir)) != nullptr) {
             // We only care about files.
             if (file->d_type != DT_REG) {
                 continue;
@@ -785,7 +785,7 @@
 
             // Rename the file into user directory.
             DIR* otherdir = opendir(otherUser->getUserDirName());
-            if (otherdir == NULL) {
+            if (otherdir == nullptr) {
                 ALOGW("couldn't open user directory for rename");
                 continue;
             }
diff --git a/keystore/keystore_cli.cpp b/keystore/keystore_cli.cpp
index 24af024..8b3be31 100644
--- a/keystore/keystore_cli.cpp
+++ b/keystore/keystore_cli.cpp
@@ -29,7 +29,7 @@
 using namespace keystore;
 
 static const char* responses[] = {
-    NULL,
+    nullptr,
     /* [NO_ERROR]           = */ "No error",
     /* [LOCKED]             = */ "Locked",
     /* [UNINITIALIZED]      = */ "Uninitialized",
@@ -219,7 +219,7 @@
     sp<IBinder> binder = sm->getService(String16("android.security.keystore"));
     sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder);
 
-    if (service == NULL) {
+    if (service == nullptr) {
         fprintf(stderr, "%s: error: could not connect to keystore service\n", argv[0]);
         return 1;
     }
diff --git a/keystore/keystore_get.cpp b/keystore/keystore_get.cpp
index 8fb7f80..4ab6555 100644
--- a/keystore/keystore_get.cpp
+++ b/keystore/keystore_get.cpp
@@ -27,7 +27,7 @@
     sp<IBinder> binder = sm->getService(String16("android.security.keystore"));
     sp<IKeystoreService> service = interface_cast<IKeystoreService>(binder);
 
-    if (service == NULL) {
+    if (service == nullptr) {
         return -1;
     }
 
diff --git a/keystore/keystore_get_wifi_hidl.cpp b/keystore/keystore_get_wifi_hidl.cpp
index 79639b6..155201f 100644
--- a/keystore/keystore_get_wifi_hidl.cpp
+++ b/keystore/keystore_get_wifi_hidl.cpp
@@ -34,13 +34,13 @@
 using android::system::wifi::keystore::V1_0::IKeystore;
 
 ssize_t keystore_get(const char *key, size_t keyLength, uint8_t** value) {
-    if (key == NULL || keyLength == 0 || value == NULL) {
+    if (key == nullptr || keyLength == 0 || value == nullptr) {
         ALOGE("Null pointer argument passed");
         return -1;
     }
 
     sp<IKeystore> service = IKeystore::tryGetService();
-    if (service == NULL) {
+    if (service == nullptr) {
         ALOGE("could not contact keystore HAL");
         return -1;
     }
diff --git a/keystore/keystore_keymaster_enforcement.h b/keystore/keystore_keymaster_enforcement.h
index 0389201..0abe070 100644
--- a/keystore/keystore_keymaster_enforcement.h
+++ b/keystore/keystore_keymaster_enforcement.h
@@ -39,7 +39,7 @@
     }
 
     bool activation_date_valid(uint64_t activation_date) const override {
-        time_t now = time(NULL);
+        time_t now = time(nullptr);
         if (now == static_cast<time_t>(-1)) {
             // Failed to obtain current time -- fail safe: activation_date hasn't yet occurred.
             return false;
@@ -57,7 +57,7 @@
     }
 
     bool expiration_date_passed(uint64_t expiration_date) const override {
-        time_t now = time(NULL);
+        time_t now = time(nullptr);
         if (now == static_cast<time_t>(-1)) {
             // Failed to obtain current time -- fail safe: expiration_date has passed.
             return true;
diff --git a/keystore/operation.cpp b/keystore/operation.cpp
index 8c39716..fdb3c64 100644
--- a/keystore/operation.cpp
+++ b/keystore/operation.cpp
@@ -111,7 +111,7 @@
 
 sp<IBinder> OperationMap::getOldestPruneableOperation() {
     if (!hasPruneableOperation()) {
-        return sp<IBinder>(NULL);
+        return sp<IBinder>(nullptr);
     }
     return mLru[0];
 }
diff --git a/keystore/permissions.cpp b/keystore/permissions.cpp
index 1ba91d9..40be938 100644
--- a/keystore/permissions.cpp
+++ b/keystore/permissions.cpp
@@ -119,7 +119,7 @@
 
 static bool keystore_selinux_check_access(uid_t uid, perm_t perm, pid_t spid) {
     audit_data ad;
-    char* sctx = NULL;
+    char* sctx = nullptr;
     const char* selinux_class = "keystore_key";
     const char* str_perm = get_perm_label(perm);
 
diff --git a/keystore/user_state.cpp b/keystore/user_state.cpp
index 5f9cd5f..b70de4c 100644
--- a/keystore/user_state.cpp
+++ b/keystore/user_state.cpp
@@ -155,7 +155,7 @@
     if (length > SALT_SIZE && rawBlob.info == SALT_SIZE) {
         salt = (uint8_t*)&rawBlob + length - SALT_SIZE;
     } else {
-        salt = NULL;
+        salt = nullptr;
     }
     uint8_t passwordKey[MASTER_KEY_SIZE_BYTES];
     generateKeyFromPassword(passwordKey, MASTER_KEY_SIZE_BYTES, pw, salt);
@@ -166,7 +166,7 @@
     }
     if (response == ResponseCode::NO_ERROR && masterKeyBlob.getLength() == MASTER_KEY_SIZE_BYTES) {
         // If salt was missing, generate one and write a new master key file with the salt.
-        if (salt == NULL) {
+        if (salt == nullptr) {
             if (!generateSalt(entropy)) {
                 return ResponseCode::SYSTEM_ERROR;
             }
@@ -209,7 +209,7 @@
     }
 
     struct dirent* file;
-    while ((file = readdir(dir)) != NULL) {
+    while ((file = readdir(dir)) != nullptr) {
         // skip . and ..
         if (!strcmp(".", file->d_name) || !strcmp("..", file->d_name)) {
             continue;
@@ -224,7 +224,7 @@
 void UserState::generateKeyFromPassword(uint8_t* key, ssize_t keySize, const android::String8& pw,
                                         uint8_t* salt) {
     size_t saltSize;
-    if (salt != NULL) {
+    if (salt != nullptr) {
         saltSize = SALT_SIZE;
     } else {
         // Pre-gingerbread used this hardwired salt, readMasterKey will rewrite these when found
diff --git a/softkeymaster/keymaster_openssl.cpp b/softkeymaster/keymaster_openssl.cpp
index f4d55bd..3f5f1f5 100644
--- a/softkeymaster/keymaster_openssl.cpp
+++ b/softkeymaster/keymaster_openssl.cpp
@@ -103,7 +103,7 @@
     }
 
     ERR_clear_error();
-    ERR_remove_thread_state(NULL);
+    ERR_remove_thread_state(nullptr);
 }
 
 static int wrap_key(EVP_PKEY* pkey, int type, uint8_t** keyBlob, size_t* keyBlobLength) {
@@ -112,7 +112,7 @@
      * but must be kept for alignment purposes.
      */
     int publicLen = 0;
-    int privateLen = i2d_PrivateKey(pkey, NULL);
+    int privateLen = i2d_PrivateKey(pkey, nullptr);
 
     if (privateLen <= 0) {
         ALOGE("private key size was too big");
@@ -126,7 +126,7 @@
     // derData will be returned to the caller, so allocate it with malloc.
     std::unique_ptr<unsigned char, Malloc_Free> derData(
         static_cast<unsigned char*>(malloc(*keyBlobLength)));
-    if (derData.get() == NULL) {
+    if (derData.get() == nullptr) {
         ALOGE("could not allocate memory for key blob");
         return -1;
     }
@@ -165,21 +165,21 @@
     const uint8_t* p = keyBlob;
     const uint8_t* const end = keyBlob + keyBlobLength;
 
-    if (keyBlob == NULL) {
+    if (keyBlob == nullptr) {
         ALOGE("supplied key blob was NULL");
-        return NULL;
+        return nullptr;
     }
 
     int type = 0;
     if (keyBlobLength < (get_softkey_header_size() + sizeof(type) + sizeof(publicLen) + 1 +
                          sizeof(privateLen) + 1)) {
         ALOGE("key blob appears to be truncated");
-        return NULL;
+        return nullptr;
     }
 
     if (!is_softkey(p, keyBlobLength)) {
         ALOGE("cannot read key; it was not made by this keymaster");
-        return NULL;
+        return nullptr;
     }
     p += get_softkey_header_size();
 
@@ -192,26 +192,26 @@
     }
     if (p + publicLen > end) {
         ALOGE("public key length encoding error: size=%ld, end=%td", publicLen, end - p);
-        return NULL;
+        return nullptr;
     }
 
     p += publicLen;
     if (end - p < 2) {
         ALOGE("private key truncated");
-        return NULL;
+        return nullptr;
     }
     for (size_t i = 0; i < sizeof(type); i++) {
         privateLen = (privateLen << 8) | *p++;
     }
     if (p + privateLen > end) {
         ALOGE("private key length encoding error: size=%ld, end=%td", privateLen, end - p);
-        return NULL;
+        return nullptr;
     }
 
     Unique_EVP_PKEY pkey(d2i_PrivateKey(type, nullptr, &p, privateLen));
-    if (pkey.get() == NULL) {
+    if (pkey.get() == nullptr) {
         logOpenSSLError("unwrap_key");
-        return NULL;
+        return nullptr;
     }
 
     return pkey.release();
@@ -226,28 +226,28 @@
     Unique_DSA dsa(DSA_new());
 
     if (dsa_params->generator_len == 0 || dsa_params->prime_p_len == 0 ||
-        dsa_params->prime_q_len == 0 || dsa_params->generator == NULL ||
-        dsa_params->prime_p == NULL || dsa_params->prime_q == NULL) {
-        if (DSA_generate_parameters_ex(dsa.get(), dsa_params->key_size, NULL, 0, NULL, NULL,
-                                       NULL) != 1) {
+        dsa_params->prime_q_len == 0 || dsa_params->generator == nullptr ||
+        dsa_params->prime_p == nullptr || dsa_params->prime_q == nullptr) {
+        if (DSA_generate_parameters_ex(dsa.get(), dsa_params->key_size, nullptr, 0, nullptr, nullptr,
+                                       nullptr) != 1) {
             logOpenSSLError("generate_dsa_keypair");
             return -1;
         }
     } else {
-        dsa->g = BN_bin2bn(dsa_params->generator, dsa_params->generator_len, NULL);
-        if (dsa->g == NULL) {
+        dsa->g = BN_bin2bn(dsa_params->generator, dsa_params->generator_len, nullptr);
+        if (dsa->g == nullptr) {
             logOpenSSLError("generate_dsa_keypair");
             return -1;
         }
 
-        dsa->p = BN_bin2bn(dsa_params->prime_p, dsa_params->prime_p_len, NULL);
-        if (dsa->p == NULL) {
+        dsa->p = BN_bin2bn(dsa_params->prime_p, dsa_params->prime_p_len, nullptr);
+        if (dsa->p == nullptr) {
             logOpenSSLError("generate_dsa_keypair");
             return -1;
         }
 
-        dsa->q = BN_bin2bn(dsa_params->prime_q, dsa_params->prime_q_len, NULL);
-        if (dsa->q == NULL) {
+        dsa->q = BN_bin2bn(dsa_params->prime_q, dsa_params->prime_q_len, nullptr);
+        if (dsa->q == nullptr) {
             logOpenSSLError("generate_dsa_keypair");
             return -1;
         }
@@ -286,7 +286,7 @@
         break;
     }
 
-    if (group.get() == NULL) {
+    if (group.get() == nullptr) {
         logOpenSSLError("generate_ec_keypair");
         return -1;
     }
@@ -298,7 +298,7 @@
 
     /* initialize EC key */
     Unique_EC_KEY eckey(EC_KEY_new());
-    if (eckey.get() == NULL) {
+    if (eckey.get() == nullptr) {
         logOpenSSLError("generate_ec_keypair");
         return -1;
     }
@@ -324,7 +324,7 @@
 
 static int generate_rsa_keypair(EVP_PKEY* pkey, const keymaster_rsa_keygen_params_t* rsa_params) {
     Unique_BIGNUM bn(BN_new());
-    if (bn.get() == NULL) {
+    if (bn.get() == nullptr) {
         logOpenSSLError("generate_rsa_keypair");
         return -1;
     }
@@ -336,12 +336,12 @@
 
     /* initialize RSA */
     Unique_RSA rsa(RSA_new());
-    if (rsa.get() == NULL) {
+    if (rsa.get() == nullptr) {
         logOpenSSLError("generate_rsa_keypair");
         return -1;
     }
 
-    if (!RSA_generate_key_ex(rsa.get(), rsa_params->modulus_size, bn.get(), NULL) ||
+    if (!RSA_generate_key_ex(rsa.get(), rsa_params->modulus_size, bn.get(), nullptr) ||
         RSA_check_key(rsa.get()) < 0) {
         logOpenSSLError("generate_rsa_keypair");
         return -1;
@@ -360,12 +360,12 @@
     const keymaster0_device_t*, const keymaster_keypair_t key_type, const void* key_params,
     uint8_t** keyBlob, size_t* keyBlobLength) {
     Unique_EVP_PKEY pkey(EVP_PKEY_new());
-    if (pkey.get() == NULL) {
+    if (pkey.get() == nullptr) {
         logOpenSSLError("openssl_generate_keypair");
         return -1;
     }
 
-    if (key_params == NULL) {
+    if (key_params == nullptr) {
         ALOGW("key_params == null");
         return -1;
     } else if (key_type == TYPE_DSA) {
@@ -397,23 +397,23 @@
                                                                   const size_t key_length,
                                                                   uint8_t** key_blob,
                                                                   size_t* key_blob_length) {
-    if (key == NULL) {
+    if (key == nullptr) {
         ALOGW("input key == NULL");
         return -1;
-    } else if (key_blob == NULL || key_blob_length == NULL) {
+    } else if (key_blob == nullptr || key_blob_length == nullptr) {
         ALOGW("output key blob or length == NULL");
         return -1;
     }
 
-    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(NULL, &key, key_length));
-    if (pkcs8.get() == NULL) {
+    Unique_PKCS8_PRIV_KEY_INFO pkcs8(d2i_PKCS8_PRIV_KEY_INFO(nullptr, &key, key_length));
+    if (pkcs8.get() == nullptr) {
         logOpenSSLError("openssl_import_keypair");
         return -1;
     }
 
     /* assign to EVP */
     Unique_EVP_PKEY pkey(EVP_PKCS82PKEY(pkcs8.get()));
-    if (pkey.get() == NULL) {
+    if (pkey.get() == nullptr) {
         logOpenSSLError("openssl_import_keypair");
         return -1;
     }
@@ -430,24 +430,24 @@
                                                                       const size_t key_blob_length,
                                                                       uint8_t** x509_data,
                                                                       size_t* x509_data_length) {
-    if (x509_data == NULL || x509_data_length == NULL) {
+    if (x509_data == nullptr || x509_data_length == nullptr) {
         ALOGW("output public key buffer == NULL");
         return -1;
     }
 
     Unique_EVP_PKEY pkey(unwrap_key(key_blob, key_blob_length));
-    if (pkey.get() == NULL) {
+    if (pkey.get() == nullptr) {
         return -1;
     }
 
-    int len = i2d_PUBKEY(pkey.get(), NULL);
+    int len = i2d_PUBKEY(pkey.get(), nullptr);
     if (len <= 0) {
         logOpenSSLError("openssl_get_keypair_public");
         return -1;
     }
 
     std::unique_ptr<uint8_t, Malloc_Free> key(static_cast<uint8_t*>(malloc(len)));
-    if (key.get() == NULL) {
+    if (key.get() == nullptr) {
         ALOGE("Could not allocate memory for public key data");
         return -1;
     }
@@ -473,14 +473,14 @@
     }
 
     Unique_DSA dsa(EVP_PKEY_get1_DSA(pkey));
-    if (dsa.get() == NULL) {
+    if (dsa.get() == nullptr) {
         logOpenSSLError("openssl_sign_dsa");
         return -1;
     }
 
     unsigned int dsaSize = DSA_size(dsa.get());
     std::unique_ptr<uint8_t, Malloc_Free> signedDataPtr(reinterpret_cast<uint8_t*>(malloc(dsaSize)));
-    if (signedDataPtr.get() == NULL) {
+    if (signedDataPtr.get() == nullptr) {
         logOpenSSLError("openssl_sign_dsa");
         return -1;
     }
@@ -505,14 +505,14 @@
     }
 
     Unique_EC_KEY eckey(EVP_PKEY_get1_EC_KEY(pkey));
-    if (eckey.get() == NULL) {
+    if (eckey.get() == nullptr) {
         logOpenSSLError("openssl_sign_ec");
         return -1;
     }
 
     unsigned int ecdsaSize = ECDSA_size(eckey.get());
     std::unique_ptr<uint8_t, Malloc_Free> signedDataPtr(reinterpret_cast<uint8_t*>(malloc(ecdsaSize)));
-    if (signedDataPtr.get() == NULL) {
+    if (signedDataPtr.get() == nullptr) {
         logOpenSSLError("openssl_sign_ec");
         return -1;
     }
@@ -540,13 +540,13 @@
     }
 
     Unique_RSA rsa(EVP_PKEY_get1_RSA(pkey));
-    if (rsa.get() == NULL) {
+    if (rsa.get() == nullptr) {
         logOpenSSLError("openssl_sign_rsa");
         return -1;
     }
 
     std::unique_ptr<uint8_t, Malloc_Free> signedDataPtr(reinterpret_cast<uint8_t*>(malloc(dataLength)));
-    if (signedDataPtr.get() == NULL) {
+    if (signedDataPtr.get() == nullptr) {
         logOpenSSLError("openssl_sign_rsa");
         return -1;
     }
@@ -567,16 +567,16 @@
     const keymaster0_device_t*, const void* params, const uint8_t* keyBlob,
     const size_t keyBlobLength, const uint8_t* data, const size_t dataLength, uint8_t** signedData,
     size_t* signedDataLength) {
-    if (data == NULL) {
+    if (data == nullptr) {
         ALOGW("input data to sign == NULL");
         return -1;
-    } else if (signedData == NULL || signedDataLength == NULL) {
+    } else if (signedData == nullptr || signedDataLength == nullptr) {
         ALOGW("output signature buffer == NULL");
         return -1;
     }
 
     Unique_EVP_PKEY pkey(unwrap_key(keyBlob, keyBlobLength));
-    if (pkey.get() == NULL) {
+    if (pkey.get() == nullptr) {
         return -1;
     }
 
@@ -611,7 +611,7 @@
     }
 
     Unique_DSA dsa(EVP_PKEY_get1_DSA(pkey));
-    if (dsa.get() == NULL) {
+    if (dsa.get() == nullptr) {
         logOpenSSLError("openssl_verify_dsa");
         return -1;
     }
@@ -633,7 +633,7 @@
     }
 
     Unique_EC_KEY eckey(EVP_PKEY_get1_EC_KEY(pkey));
-    if (eckey.get() == NULL) {
+    if (eckey.get() == nullptr) {
         logOpenSSLError("openssl_verify_ec");
         return -1;
     }
@@ -662,13 +662,13 @@
     }
 
     Unique_RSA rsa(EVP_PKEY_get1_RSA(pkey));
-    if (rsa.get() == NULL) {
+    if (rsa.get() == nullptr) {
         logOpenSSLError("openssl_verify_data");
         return -1;
     }
 
     std::unique_ptr<uint8_t[]> dataPtr(new uint8_t[signedDataLength]);
-    if (dataPtr.get() == NULL) {
+    if (dataPtr.get() == nullptr) {
         logOpenSSLError("openssl_verify_data");
         return -1;
     }
@@ -691,13 +691,13 @@
     const keymaster0_device_t*, const void* params, const uint8_t* keyBlob,
     const size_t keyBlobLength, const uint8_t* signedData, const size_t signedDataLength,
     const uint8_t* signature, const size_t signatureLength) {
-    if (signedData == NULL || signature == NULL) {
+    if (signedData == nullptr || signature == nullptr) {
         ALOGW("data or signature buffers == NULL");
         return -1;
     }
 
     Unique_EVP_PKEY pkey(unwrap_key(keyBlob, keyBlobLength));
-    if (pkey.get() == NULL) {
+    if (pkey.get() == nullptr) {
         return -1;
     }
 
@@ -738,7 +738,7 @@
         return -EINVAL;
 
     Unique_keymaster_device_t dev(new keymaster0_device_t);
-    if (dev.get() == NULL)
+    if (dev.get() == nullptr)
         return -ENOMEM;
 
     dev->common.tag = HARDWARE_DEVICE_TAG;
@@ -752,8 +752,8 @@
     dev->generate_keypair = openssl_generate_keypair;
     dev->import_keypair = openssl_import_keypair;
     dev->get_keypair_public = openssl_get_keypair_public;
-    dev->delete_keypair = NULL;
-    dev->delete_all = NULL;
+    dev->delete_keypair = nullptr;
+    dev->delete_all = nullptr;
     dev->sign_data = openssl_sign_data;
     dev->verify_data = openssl_verify_data;
 
@@ -779,7 +779,7 @@
          .name = "Keymaster OpenSSL HAL",
          .author = "The Android Open Source Project",
          .methods = &keystore_module_methods,
-         .dso = 0,
+         .dso = nullptr,
          .reserved = {},
         },
 };