Skip to content

Commit d04f146

Browse files
committed
Fixes and Improvements
1: fixed an issue where web pages might fail to load in Lockdown Mode 2: Installation via non-TrollStore methods (signed IPA file) is now supported
1 parent 9a6bea8 commit d04f146

8 files changed

Lines changed: 111 additions & 64 deletions

File tree

Application/Dopamine/Jailbreak/DOBootstrapper.m

Lines changed: 32 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -252,7 +252,7 @@ - (NSError *)createSymlinkAtPath:(NSString *)path toPath:(NSString *)destination
252252
return error;
253253
}
254254

255-
/*
255+
#if 0
256256
- (BOOL)isPrivatePrebootMountedWritable
257257
{
258258
struct statfs ppStfs;
@@ -311,7 +311,7 @@ - (void)fixupPathPermissions
311311
tmpPath = [tmpPath stringByDeletingLastPathComponent];
312312
}
313313
}
314-
*/
314+
#endif
315315

316316
- (void)patchBasebinDaemonPlist:(NSString *)plistPath
317317
{
@@ -340,6 +340,7 @@ - (void)patchBasebinDaemonPlists
340340
}
341341
}
342342

343+
#if 0
343344
- (NSString *)bootstrapVersion
344345
{
345346
uint64_t cfver = (((uint64_t)kCFCoreFoundationVersionNumber / 100) * 100);
@@ -374,7 +375,6 @@ - (NSURL *)bootstrapURL
374375
[_bootstrapDownloadTask resume];
375376
}*/
376377

377-
/*
378378
- (void)extractBootstrap:(NSString *)path withCompletion:(void (^)(NSError *))completion
379379
{
380380
NSString *bootstrapTar = [@"/var/tmp" stringByAppendingPathComponent:@"bootstrap.tar"];
@@ -393,9 +393,7 @@ - (void)extractBootstrap:(NSString *)path withCompletion:(void (^)(NSError *))co
393393
[[NSData data] writeToFile:JBROOT_PATH(@"/.installed_dopamine") atomically:YES];
394394
completion(nil);
395395
}
396-
*/
397396

398-
#if 0
399397
- (void)prepareBootstrapWithCompletion:(void (^)(NSError *))completion
400398
{
401399
[[DOUIManager sharedInstance] sendLog:@"Updating BaseBin" debug:NO];
@@ -647,7 +645,7 @@ - (BOOL)shouldInstallPackage:(NSString *)identifier
647645
return [installedVersion numericalVersionRepresentation] < [bundledVersion numericalVersionRepresentation];
648646
}
649647

650-
/*
648+
#if 0
651649
- (NSError *)finalizeBootstrap
652650
{
653651
// Initial setup on first jailbreak
@@ -715,7 +713,6 @@ - (NSError *)deleteBootstrap
715713
[[NSFileManager defaultManager] removeItemAtPath:@"/var/jb" error:nil];
716714
return error;
717715
}
718-
*/
719716

720717
- (void)URLSession:(NSURLSession *)session downloadTask:(NSURLSessionDownloadTask *)downloadTask didWriteData:(int64_t)bytesWritten totalBytesWritten:(int64_t)totalBytesWritten totalBytesExpectedToWrite:(int64_t)totalBytesExpectedToWrite
721718
{
@@ -736,6 +733,7 @@ - (void)URLSession:(nonnull NSURLSession *)session downloadTask:(nonnull NSURLSe
736733
{
737734
_downloadCompletionBlock(location, nil);
738735
}
736+
#endif
739737

740738
@end
741739

@@ -752,8 +750,6 @@ - (void)URLSession:(nonnull NSURLSession *)session downloadTask:(nonnull NSURLSe
752750
NSString* rootfsPrefix(NSString* path);
753751
///////////////////////////////////////////////////////
754752

755-
@implementation DOBootstrapper(roothide)
756-
757753
uint64_t jbrand_new()
758754
{
759755
uint64_t value = ((uint64_t)arc4random()) | ((uint64_t)arc4random())<<32;
@@ -917,13 +913,24 @@ uint64_t jbrand_current()
917913

918914
int getCFMajorVersion(void)
919915
{
916+
if(@available(iOS 16.0, *)) {
917+
return 1900;
918+
}
919+
920920
return ((int)kCFCoreFoundationVersionNumber / 100) * 100;
921921
}
922922
/////////////////////////////////////////////////////////////////////
923923

924+
@implementation DOBootstrapper(roothide)
925+
924926
#define STRAPLOG(...) [[DOUIManager sharedInstance] sendLog:[NSString stringWithFormat:@__VA_ARGS__] debug:YES];
925927
#define ASSERT(...) do{if(!(__VA_ARGS__)) {completion([NSError errorWithDomain:bootstrapErrorDomain code:BootstrapErrorCodeFailedExtracting userInfo:@{NSLocalizedDescriptionKey : [NSString stringWithFormat:@"ABORT: %s (%d): %s", __FILE_NAME__, __LINE__, #__VA_ARGS__]}]);return -1;}} while(0)
926928

929+
- (NSString *)bootstrapVersion
930+
{
931+
return [NSString stringWithFormat:@"%d", getCFMajorVersion()];
932+
}
933+
927934
-(int) buildPackageSources:(void (^)(NSError *))completion
928935
{
929936
NSFileManager* fm = NSFileManager.defaultManager;
@@ -1225,7 +1232,12 @@ -(int) fixBootstrapSymlink:(NSString*)path
12251232
const char* jbpath = jbrootPrefix(path).fileSystemRepresentation;
12261233

12271234
struct stat st={0};
1228-
assert(lstat(jbpath, &st) == 0);
1235+
int r = lstat(jbpath, &st);
1236+
if(r != 0) {
1237+
assert(errno != 0);
1238+
return errno;
1239+
}
1240+
12291241
if (!S_ISLNK(st.st_mode)) {
12301242
return 0;
12311243
}
@@ -1279,8 +1291,16 @@ - (NSError *)finalizeBootstrap
12791291
else
12801292
{
12811293
[[DOUIManager sharedInstance] sendLog:@"Updating Symlinks" debug:NO];
1282-
[self fixBootstrapSymlink:@"/bin/sh"];
1283-
[self fixBootstrapSymlink:@"/usr/bin/sh"];
1294+
1295+
NSArray* bootstrapSymlinks = @[@"/bin/sh", @"/usr/bin/sh"];
1296+
for(NSString* slink in bootstrapSymlinks)
1297+
{
1298+
int r = [self fixBootstrapSymlink:slink];
1299+
if(r != 0) {
1300+
return [NSError errorWithDomain:bootstrapErrorDomain code:BootstrapErrorCodeFailedFinalising userInfo:@{NSLocalizedDescriptionKey : [NSString stringWithFormat:@"fixBootstrapSymlink(%@) returned %d\n", slink, r]}];
1301+
}
1302+
}
1303+
12841304
int r = exec_cmd_trusted(JBROOT_PATH("/bin/sh"), "/usr/libexec/updatelinks.sh", NULL);
12851305
if (r != 0) {
12861306
return [NSError errorWithDomain:bootstrapErrorDomain code:BootstrapErrorCodeFailedFinalising userInfo:@{NSLocalizedDescriptionKey : [NSString stringWithFormat:@"updatelinks.sh returned %d\n", r]}];

Application/Dopamine/Jailbreak/DOJailbreaker.m

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -286,6 +286,14 @@ - (NSError *)elevatePrivileges
286286
csops(getpid(), CS_OPS_STATUS, &csflags, sizeof(csflags));
287287
if (!(csflags & CS_PLATFORM_BINARY)) return [NSError errorWithDomain:JBErrorDomain code:JBErrorCodeFailedPlatformize userInfo:@{NSLocalizedDescriptionKey:@"Failed to get CS_PLATFORM_BINARY"}];
288288

289+
/**************************** roothide specific ********************/
290+
proc_csflags_set(proc, CS_INSTALLER);
291+
292+
if(otherJailbreakActived(true)) {
293+
return [NSError errorWithDomain:@"RootHide" code:1 userInfo:@{NSLocalizedDescriptionKey:@"Your device currently has another jailbreak activated, please reboot device."}];
294+
}
295+
/***********************************************************************/
296+
289297
return nil;
290298
}
291299

Application/Dopamine/UI/DOMainViewController.m

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,7 @@ -(void)setupStack
136136

137137

138138
/********************************** roothide specific ************************************/
139-
if(otherJailbreakActived()) {
139+
if(otherJailbreakActived(false)) {
140140
UIAlertController *alertController = [UIAlertController alertControllerWithTitle:DOLocalizedString(@"Error") message:DOLocalizedString(@"Your device currently has another jailbreak activated, please reboot device.") preferredStyle:UIAlertControllerStyleAlert];
141141
UIAlertAction *rebootAction = [UIAlertAction actionWithTitle:DOLocalizedString(@"Button_Close") style:UIAlertActionStyleDefault handler:^(UIAlertAction * _Nonnull action) {
142142
//exit(0);
@@ -145,15 +145,6 @@ -(void)setupStack
145145
[self presentViewController:alertController animated:YES completion:nil];
146146
return;
147147
}
148-
if(![DOEnvironmentManager.sharedManager isInstalledThroughTrollStore]) {
149-
UIAlertController *alertController = [UIAlertController alertControllerWithTitle:DOLocalizedString(@"Error") message:DOLocalizedString(@"Please install this app via trollstore.") preferredStyle:UIAlertControllerStyleAlert];
150-
UIAlertAction *rebootAction = [UIAlertAction actionWithTitle:DOLocalizedString(@"Button_Close") style:UIAlertActionStyleDefault handler:^(UIAlertAction * _Nonnull action) {
151-
//exit(0);
152-
}];
153-
[alertController addAction:rebootAction];
154-
[self presentViewController:alertController animated:YES completion:nil];
155-
return;
156-
}
157148
/********************************** roothide specific ************************************/
158149

159150

BaseBin/launchdhook/src/jbserver/jbdomain_systemwide.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,10 @@ int systemwide_process_checkin(audit_token_t *processToken, char **rootPathOut,
375375

376376
// platformize
377377
proc_csflags_set(proc, CS_PLATFORM_BINARY);
378+
379+
/********************* roothide specific ********************/
380+
proc_csflags_set(proc, CS_INSTALLER);
381+
/*************************************************************/
378382
}
379383

380384
#ifdef __arm64e__

BaseBin/launchdhook/src/main.m

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,13 +61,15 @@ void draw_boot_logo(const char *bootLogoPath)
6161
int (*sysctlbyname_orig)(const char *name, void *oldp, size_t *oldlenp, void *newp, size_t newlen) = NULL;
6262
int sysctlbyname_hook(const char *name, void *oldp, size_t *oldlenp, void *newp, size_t newlen)
6363
{
64-
/********************* roothide specific *************/
64+
/*********************** roothide specific ********************/
65+
#ifdef __arm64e__
6566
if (!__builtin_available(iOS 16.0, *))
6667
{
6768
if (strcmp(name, "vm.shared_region_pivot") == 0) {
6869
return 0;
6970
}
7071
}
72+
#endif
7173
/*************************************************************/
7274

7375

BaseBin/libjailbreak/src/roothider/common.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ char* generate_sandbox_extensions(audit_token_t *processToken, bool writable);
6161

6262
int randomizeAndLoadBasebinTrustcache(const char* basebinPath);
6363

64-
bool otherJailbreakActived();
64+
bool otherJailbreakActived(bool postexploit);
6565

6666
void hideDeveloperMode();
6767

BaseBin/libjailbreak/src/roothider/common.m

Lines changed: 60 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
#include <xpc/xpc.h>
1111
#include <sys/proc.h>
1212
#include <sys/mount.h>
13+
#include <mach-o/dyld.h>
1314
#include <sys/proc_info.h>
1415
#include <dispatch/dispatch.h>
1516

@@ -181,9 +182,18 @@ bool process_force_dyld_patch(const char* path, const char** argv)
181182
if(string_has_suffix(path, "/System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.WebContent.xpc/com.apple.WebKit.WebContent")) {
182183
return true;
183184
}
184-
else if(strcmp(path, "/usr/libexec/xpcproxy")==0) {
185-
if (argv && argv[0] && argv[1] && string_has_prefix(argv[1], "com.apple.WebKit.WebContent")) {
186-
return true;
185+
else if(string_has_suffix(path, "/System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.WebContent.CaptivePortal.xpc/com.apple.WebKit.WebContent.CaptivePortal")) {
186+
return true;
187+
}
188+
else if(strcmp(path, "/usr/libexec/xpcproxy")==0)
189+
{
190+
if (argv && argv[0] && argv[1]) {
191+
if(string_has_prefix(argv[1], "com.apple.WebKit.WebContent")) {
192+
return true;
193+
}
194+
else if(string_has_prefix(argv[1], "com.apple.WebKit.WebContent.CaptivePortal")) {
195+
return true;
196+
}
187197
}
188198
}
189199
}
@@ -582,57 +592,67 @@ int randomizeAndLoadBasebinTrustcache(const char* basebinPath)
582592

583593
kern_return_t bootstrap_look_up(mach_port_t port, const char *service, mach_port_t *server_port);
584594

585-
bool otherJailbreakActived()
595+
bool otherJailbreakActived(bool postexploit)
586596
{
587-
if(jbclient_roothide_jailbroken())
597+
if(!postexploit)
588598
{
589-
return false;
599+
// // may be palehide
600+
// uint32_t csflags = 0;
601+
// csops(getpid(), CS_OPS_STATUS, &csflags, sizeof(csflags));
602+
// if((csflags & CS_PLATFORM_BINARY) != 0) {
603+
// if(!builtint_palehide_test()) {
604+
// return true; // rootless dopamine 2.x
605+
// }
606+
// }
590607
}
591608

592-
// // may be palehide
593-
// uint32_t csFlags = 0;
594-
// csops(getpid(), CS_OPS_STATUS, &csFlags, sizeof(csFlags));
595-
// if(csFlags & CS_PLATFORM_BINARY)
596-
// {
597-
// if(!builtint_palehide_test()) {
598-
// return true;
599-
// }
600-
// }
601-
602-
char pathbuf[PATH_MAX] = {0};
603-
int ret = proc_pidpath(1, pathbuf, sizeof(pathbuf));
604-
if(ret <= 0) {
605-
JBLogError("proc_pidpath failed for pid 1: %d", ret);
606-
return true;
607-
}
608-
609-
if(strcmp(pathbuf, "/sbin/launchd") != 0) {
610-
return true;
611-
}
612-
613-
mach_port_t port = MACH_PORT_NULL;
614-
kern_return_t kr = bootstrap_look_up(bootstrap_port, "com.opa334.jailbreakd", &port);
615-
if(kr == KERN_SUCCESS) {
616-
return true; // roothide dopamine 1.x
609+
if(!jbclient_roothide_jailbroken())
610+
{
611+
// it works even rootless dopamine 2.x is hidden
612+
const char* rootpath = jbclient_get_jbroot();
613+
if(rootpath && strlen(rootpath) > 0) {
614+
return true; // rootless dopamine 2.x
615+
}
617616
}
618617

619-
const char* rootpath = jbclient_get_jbroot();
620-
if(rootpath && strlen(rootpath) > 0) {
621-
return true;
618+
struct statfs fs = {0};
619+
int sfsret = statfs("/usr/lib", &fs);
620+
// not work when rootless dopamine 2.x is hidden
621+
if (sfsret==0 && strcmp(fs.f_mntonname, "/usr/lib")==0) {
622+
return true; // rootless dopamine
622623
}
623624

624625
if(access("/dev/md0", F_OK)==0) {
625-
return true;
626+
return true; // rootless palera1n
626627
}
627628

628629
if(access("/dev/rmd0", F_OK)==0) {
629-
return true;
630+
return true; // rootless palera1n
630631
}
631632

632-
struct statfs fs;
633-
int sfsret = statfs("/usr/lib", &fs);
634-
if (sfsret == 0) {
635-
if(strcmp(fs.f_mntonname, "/usr/lib")==0) {
633+
// not work in sandbox
634+
char pathbuf[PATH_MAX] = {0};
635+
int ret = proc_pidpath(1, pathbuf, sizeof(pathbuf));
636+
if(ret > 0) {
637+
if(strcmp(pathbuf, "/sbin/launchd") != 0) {
638+
return true; // roothide Bootstrap or NathanLR
639+
}
640+
} else {
641+
JBLogError("proc_pidpath failed for pid 1: %d", ret);
642+
assert(!postexploit);
643+
// return true;
644+
}
645+
646+
// not work in sandbox
647+
mach_port_t port = MACH_PORT_NULL;
648+
kern_return_t kr = bootstrap_look_up(bootstrap_port, "com.opa334.jailbreakd", &port);
649+
if(kr == KERN_SUCCESS) {
650+
return true; // roothide dopamine 1.x
651+
}
652+
653+
// detect roothide dopamine 1.x in sandbox
654+
for (uint32_t i = 0; i < _dyld_image_count(); i++) {
655+
if(strncmp(_dyld_get_image_name(i), "/usr/lib/systemhook-", sizeof("/usr/lib/systemhook-")-1) == 0) {
636656
return true;
637657
}
638658
}

BaseBin/libjailbreak/src/util.m

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@ void _JBFixMobilePermissionsOfDirectory(NSString *directoryPath, BOOL recursive)
3636
void JBFixMobilePermissions(void)
3737
{
3838
@autoreleasepool {
39+
/*********************************** on roothide jbroot:/var is always a symlink ***************************************************
3940
NSDictionary *attributes = [[NSFileManager defaultManager] attributesOfItemAtPath:JBROOT_PATH(@"/var") error:nil];
4041
if ([attributes[NSFileType] isEqualToString:NSFileTypeSymbolicLink]) {
4142
// /var/jb/var is a symlink, abort
@@ -46,6 +47,7 @@ void JBFixMobilePermissions(void)
4647
// /var/jb/var/mobile is a symlink, abort
4748
return;
4849
}
50+
***********************************************************************************************************************************/
4951

5052
_JBFixMobilePermissionsOfDirectory(JBROOT_PATH(@"/var/mobile"), NO);
5153
_JBFixMobilePermissionsOfDirectory(JBROOT_PATH(@"/var/mobile/Library"), NO);

0 commit comments

Comments
 (0)