Skip to content

Commit

Permalink
fixed jailbreak not working on some devices
Browse files Browse the repository at this point in the history
  • Loading branch information
roothider committed Nov 1, 2024
1 parent bebc829 commit 5097e5b
Show file tree
Hide file tree
Showing 5 changed files with 30 additions and 6 deletions.
2 changes: 2 additions & 0 deletions Application/Dopamine/Jailbreak/DOJailbreaker.m
Original file line number Diff line number Diff line change
Expand Up @@ -594,6 +594,8 @@ - (void)runWithError:(NSError **)errOut didRemoveJailbreak:(BOOL*)didRemove show
*errOut = [self injectLaunchdHook];
if (*errOut) return;

// don't use dyld-in-cache due to dyldhooks
setenv("DYLD_IN_CACHE", "0", 1);
// don't load tweak during jailbreaking
setenv("DISABLE_TWEAKS", "1", 1);
// using the stock path during jailbreaking
Expand Down
9 changes: 8 additions & 1 deletion BaseBin/launchdhook/src/spawn_hook.c
Original file line number Diff line number Diff line change
Expand Up @@ -274,10 +274,17 @@ int __posix_spawn_hook(pid_t *restrict pidp, const char *restrict path, struct _
posix_spawnattr_setflags(attrp, flags | POSIX_SPAWN_START_SUSPENDED);
}

// on some devices dyldhook may fail due to vm_protect(VM_PROT_READ|VM_PROT_WRITE), 2, (os/kern) protection failure in dsc::__DATA_CONST:__const,
// so we need to disable dyld-in-cache here. (or we can use VM_PROT_READ|VM_PROT_WRITE|VM_PROT_COPY)
char **envc = envbuf_mutcopy((const char **)envp);
envbuf_setenv(&envc, "DYLD_IN_CACHE", "0");

int pid = 0;
if (!pidp) pidp = &pid;
int ret = posix_spawn_hook_shared(pidp, path, desc, argv, envp, __posix_spawn_orig_wrapper, systemwide_trust_binary, platform_set_process_debugged, jbsetting(jetsamMultiplier));
int ret = posix_spawn_hook_shared(pidp, path, desc, argv, envc, __posix_spawn_orig_wrapper, systemwide_trust_binary, platform_set_process_debugged, jbsetting(jetsamMultiplier));
pid = *pidp;

envbuf_free(envc);

posix_spawnattr_setflags(attrp, flags); // maybe caller will use it again?

Expand Down
2 changes: 0 additions & 2 deletions BaseBin/libjailbreak/src/deny.m
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,6 @@
NSString *identifier = appInfo[@"CFBundleIdentifier"];
if (!identifier) return nil;

JBLogDebug("spawn app [%s] %s", identifier.UTF8String, path);

return identifier;
}

Expand Down
6 changes: 4 additions & 2 deletions BaseBin/libjailbreak/src/util.c
Original file line number Diff line number Diff line change
Expand Up @@ -584,8 +584,10 @@ int __exec_cmd_internal_va(bool suspended, bool root, bool waitForExit, pid_t *p
}

//force
posix_spawnattr_setflags(&attr, POSIX_SPAWN_START_SUSPENDED);

short flags=0;
posix_spawnattr_getflags(&attr, &flags);
posix_spawnattr_setflags(&attr, flags | POSIX_SPAWN_START_SUSPENDED);

pid_t spawnedPid = 0;
int spawnError = posix_spawn(&spawnedPid, binary, NULL, &attr, (char *const *)argv, environ);
if (attr) posix_spawnattr_destroy(&attr);
Expand Down
17 changes: 16 additions & 1 deletion BaseBin/systemhook/src/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -272,6 +272,9 @@ bool should_enable_tweaks(void)
return true;
}


#include "envbuf.h"

#define POSIX_SPAWN_PROC_TYPE_DRIVER 0x700
int posix_spawnattr_getprocesstype_np(const posix_spawnattr_t * __restrict, int * __restrict) __API_AVAILABLE(macos(10.8), ios(6.0));

Expand Down Expand Up @@ -313,10 +316,17 @@ int posix_spawn_hook_roothide(pid_t *restrict pidp, const char *restrict path, s
}
}

// on some devices dyldhook may fail due to vm_protect(VM_PROT_READ|VM_PROT_WRITE), 2, (os/kern) protection failure in dsc::__DATA_CONST:__const,
// so we need to disable dyld-in-cache here. (or we can use VM_PROT_READ|VM_PROT_WRITE|VM_PROT_COPY)
char **envc = envbuf_mutcopy((const char **)envp);
envbuf_setenv(&envc, "DYLD_IN_CACHE", "0");

int pid = 0;
int ret = posix_spawn_hook_shared(&pid, path, desc, argv, envp, orig, trust_binary, set_process_debugged, jetsamMultiplier);
int ret = posix_spawn_hook_shared(&pid, path, desc, argv, envc, orig, trust_binary, set_process_debugged, jetsamMultiplier);
if (pidp) *pidp = pid;

envbuf_free(envc);

// maybe caller will use it again? restore flags
posix_spawnattr_setflags(attrp, flags);

Expand Down Expand Up @@ -605,6 +615,11 @@ __attribute__((constructor)) static void initializer(void)
//////////////////////////////////////////////////////////////////////
/* after unsandboxing jbroot and applying dyldhooks */

const char* DYLD_IN_CACHE = getenv("DYLD_IN_CACHE");
if(strcmp(DYLD_IN_CACHE, "0") == 0) {
unsetenv("DYLD_IN_CACHE");
}

redirect_paths(JB_RootPath);

dlopen(JBROOT_PATH("/usr/lib/roothideinit.dylib"), RTLD_NOW);
Expand Down

0 comments on commit 5097e5b

Please sign in to comment.