|
10 | 10 | #include <xpc/xpc.h> |
11 | 11 | #include <sys/proc.h> |
12 | 12 | #include <sys/mount.h> |
| 13 | +#include <mach-o/dyld.h> |
13 | 14 | #include <sys/proc_info.h> |
14 | 15 | #include <dispatch/dispatch.h> |
15 | 16 |
|
@@ -181,9 +182,18 @@ bool process_force_dyld_patch(const char* path, const char** argv) |
181 | 182 | if(string_has_suffix(path, "/System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.WebContent.xpc/com.apple.WebKit.WebContent")) { |
182 | 183 | return true; |
183 | 184 | } |
184 | | - else if(strcmp(path, "/usr/libexec/xpcproxy")==0) { |
185 | | - if (argv && argv[0] && argv[1] && string_has_prefix(argv[1], "com.apple.WebKit.WebContent")) { |
186 | | - return true; |
| 185 | + else if(string_has_suffix(path, "/System/Library/Frameworks/WebKit.framework/XPCServices/com.apple.WebKit.WebContent.CaptivePortal.xpc/com.apple.WebKit.WebContent.CaptivePortal")) { |
| 186 | + return true; |
| 187 | + } |
| 188 | + else if(strcmp(path, "/usr/libexec/xpcproxy")==0) |
| 189 | + { |
| 190 | + if (argv && argv[0] && argv[1]) { |
| 191 | + if(string_has_prefix(argv[1], "com.apple.WebKit.WebContent")) { |
| 192 | + return true; |
| 193 | + } |
| 194 | + else if(string_has_prefix(argv[1], "com.apple.WebKit.WebContent.CaptivePortal")) { |
| 195 | + return true; |
| 196 | + } |
187 | 197 | } |
188 | 198 | } |
189 | 199 | } |
@@ -582,57 +592,67 @@ int randomizeAndLoadBasebinTrustcache(const char* basebinPath) |
582 | 592 |
|
583 | 593 | kern_return_t bootstrap_look_up(mach_port_t port, const char *service, mach_port_t *server_port); |
584 | 594 |
|
585 | | -bool otherJailbreakActived() |
| 595 | +bool otherJailbreakActived(bool postexploit) |
586 | 596 | { |
587 | | - if(jbclient_roothide_jailbroken()) |
| 597 | + if(!postexploit) |
588 | 598 | { |
589 | | - return false; |
| 599 | + // // may be palehide |
| 600 | + // uint32_t csflags = 0; |
| 601 | + // csops(getpid(), CS_OPS_STATUS, &csflags, sizeof(csflags)); |
| 602 | + // if((csflags & CS_PLATFORM_BINARY) != 0) { |
| 603 | + // if(!builtint_palehide_test()) { |
| 604 | + // return true; // rootless dopamine 2.x |
| 605 | + // } |
| 606 | + // } |
590 | 607 | } |
591 | 608 |
|
592 | | - // // may be palehide |
593 | | - // uint32_t csFlags = 0; |
594 | | - // csops(getpid(), CS_OPS_STATUS, &csFlags, sizeof(csFlags)); |
595 | | - // if(csFlags & CS_PLATFORM_BINARY) |
596 | | - // { |
597 | | - // if(!builtint_palehide_test()) { |
598 | | - // return true; |
599 | | - // } |
600 | | - // } |
601 | | - |
602 | | - char pathbuf[PATH_MAX] = {0}; |
603 | | - int ret = proc_pidpath(1, pathbuf, sizeof(pathbuf)); |
604 | | - if(ret <= 0) { |
605 | | - JBLogError("proc_pidpath failed for pid 1: %d", ret); |
606 | | - return true; |
607 | | - } |
608 | | - |
609 | | - if(strcmp(pathbuf, "/sbin/launchd") != 0) { |
610 | | - return true; |
611 | | - } |
612 | | - |
613 | | - mach_port_t port = MACH_PORT_NULL; |
614 | | - kern_return_t kr = bootstrap_look_up(bootstrap_port, "com.opa334.jailbreakd", &port); |
615 | | - if(kr == KERN_SUCCESS) { |
616 | | - return true; // roothide dopamine 1.x |
| 609 | + if(!jbclient_roothide_jailbroken()) |
| 610 | + { |
| 611 | + // it works even rootless dopamine 2.x is hidden |
| 612 | + const char* rootpath = jbclient_get_jbroot(); |
| 613 | + if(rootpath && strlen(rootpath) > 0) { |
| 614 | + return true; // rootless dopamine 2.x |
| 615 | + } |
617 | 616 | } |
618 | 617 |
|
619 | | - const char* rootpath = jbclient_get_jbroot(); |
620 | | - if(rootpath && strlen(rootpath) > 0) { |
621 | | - return true; |
| 618 | + struct statfs fs = {0}; |
| 619 | + int sfsret = statfs("/usr/lib", &fs); |
| 620 | + // not work when rootless dopamine 2.x is hidden |
| 621 | + if (sfsret==0 && strcmp(fs.f_mntonname, "/usr/lib")==0) { |
| 622 | + return true; // rootless dopamine |
622 | 623 | } |
623 | 624 |
|
624 | 625 | if(access("/dev/md0", F_OK)==0) { |
625 | | - return true; |
| 626 | + return true; // rootless palera1n |
626 | 627 | } |
627 | 628 |
|
628 | 629 | if(access("/dev/rmd0", F_OK)==0) { |
629 | | - return true; |
| 630 | + return true; // rootless palera1n |
630 | 631 | } |
631 | 632 |
|
632 | | - struct statfs fs; |
633 | | - int sfsret = statfs("/usr/lib", &fs); |
634 | | - if (sfsret == 0) { |
635 | | - if(strcmp(fs.f_mntonname, "/usr/lib")==0) { |
| 633 | + // not work in sandbox |
| 634 | + char pathbuf[PATH_MAX] = {0}; |
| 635 | + int ret = proc_pidpath(1, pathbuf, sizeof(pathbuf)); |
| 636 | + if(ret > 0) { |
| 637 | + if(strcmp(pathbuf, "/sbin/launchd") != 0) { |
| 638 | + return true; // roothide Bootstrap or NathanLR |
| 639 | + } |
| 640 | + } else { |
| 641 | + JBLogError("proc_pidpath failed for pid 1: %d", ret); |
| 642 | + assert(!postexploit); |
| 643 | + // return true; |
| 644 | + } |
| 645 | + |
| 646 | + // not work in sandbox |
| 647 | + mach_port_t port = MACH_PORT_NULL; |
| 648 | + kern_return_t kr = bootstrap_look_up(bootstrap_port, "com.opa334.jailbreakd", &port); |
| 649 | + if(kr == KERN_SUCCESS) { |
| 650 | + return true; // roothide dopamine 1.x |
| 651 | + } |
| 652 | + |
| 653 | + // detect roothide dopamine 1.x in sandbox |
| 654 | + for (uint32_t i = 0; i < _dyld_image_count(); i++) { |
| 655 | + if(strncmp(_dyld_get_image_name(i), "/usr/lib/systemhook-", sizeof("/usr/lib/systemhook-")-1) == 0) { |
636 | 656 | return true; |
637 | 657 | } |
638 | 658 | } |
|
0 commit comments