SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsre-ios-jb

re-ios-jb

Security & auditing

View repository

Updated 10-15 21:35

About this skill

iOS jailbreak reverse engineering environment (jailbreak detection / tweak)

When to use / when not to use

  • Use: the target App has jailbreak detection (crashes on launch / features restricted), and you need to identify the detection points and analyze their implementation
  • Use: there is an existing tweak / Substrate plugin whose hooks you need to reverse engineer
  • Use: you want to do dynamic analysis on a jailbroken device ([[re-frida]] instrumentation, [[re-lldb]] remote attach) — the jailbroken environment is a prerequisite
  • Use: you are developing your own tweak (Theos + Logos) to assist reverse engineering (hook detection functions to verify hypotheses)
  • Do not use: iOS dynamic analysis when there is no jailbroken device (do static first, see [[re-ios]] pitfall 3)
  • Do not use: when you only need the App's static structure / decryption (go to [[re-ios]])
  • Note: jailbreaking and dynamic execution are performed on controlled devices per the highest principle in [[re-analyze/platform-tips]] (dedicated test devices, not used for daily/production devices)

Tool preparation

Jailbreaking/dynamic analysis is dynamic execution, requiring controlled devices + network isolation (highest principle in [[re-analyze/platform-tips]]). Static (tweak binary analysis) is exempt from the sandbox. Verify all tools before use.

Jailbroken device (palera1n, etc.)

  • palera1n has no distro package, official installation route (docs.palera.in）： 
    # 官方一键脚本（推荐）
sudo /bin/sh -c "$(curl -fsSL https://static.palera.in/scripts/install.sh)"
# 或 GitHub releases（palera1n/palera1n）手动下载二进制
curl -LO https://github.com/palera1n/palera1n/releases/download/v2.0.2/palera1n-linux-x86_64
chmod +x palera1n-linux-x86_64 && sudo mv palera1n-linux-x86_64 /usr/bin/palera1n
  • Limitation: only supports checkm8 vulnerable devices (A8–A11) and the iOS versions they support (for version matching see pitfall 2);running it in a virtual machine will segfault(unusable without PCI passthrough)
  • Verify: palera1n --help; after jailbreaking, Sileo (rootless package manager) appears on the device
  • Install OpenSSH after jailbreaking: search "openssh" in Sileo and install

Theos — tweak build toolchain (official git installation, no distro package)

  • Official install (theos.dev/docs/installation，must be installed via git, the official docs explicitly say do not download the ZIP）： 
    export THEOS=~/theos
git clone --recursive https://github.com/theos/theos.git $THEOS
echo "export THEOS=~/theos" >> ~/.zprofile && echo "export PATH=$THEOS/bin:$PATH" >> ~/.zprofile
  • Dependencies: macOS brew install ldid xz; Linux requires sudo apt install dpkg-dev fakeroot(Debian/Ubuntu) and other packaging dependencies
  • iOS SDK：curl -LO https://github.com/theos/sdks/archive/master.zip extract *.sdk place in $THEOS/sdks
  • Update: $THEOS/bin/update-theos(rolling release)
  • Verify: $THEOS/bin/nic.pl can list the New Instance Creator templates

frida ([[re-frida]]) — instrumentation and bypass execution

  • Jailbroken device: add repo https://build.frida.re to Sileo/Cydia and install frida; or ssh root@<设备IP> then install
  • Host:pip install frida-tools
  • Verify: frida-ps -U lists device processes

lldb remote ([[re-lldb]]) + usbmuxd/iproxy

  • lldb：macOS xcode-select --install(bundled); Linux apt install lldb / dnf install lldb / pacman -S lldb
  • usbmuxd/iproxy：macOS brew install usbmuxd; on Linux iproxy is in the libimobiledevice-utils package（Debian/Ubuntu/Fedora）/libimobiledevice package(Arch), installing only usbmuxd without iproxy:apt install usbmuxd libimobiledevice-utils / dnf install usbmuxd libimobiledevice-utils / pacman -S usbmuxd libimobiledevice
  • Verify: lldb --version；iproxy 2222 22 then ssh -p 2222 root@127.0.0.1 can log in to the device
  • Device-side debugging service debugserver: provided by the jailbreak tool / DeveloperDiskImage (see [[re-ios]] and [[re-lldb]])

Procedure

Execute in order; record evidence paths + sha256 (see [[re-triage]]) for each step's artifacts (device info, hook list, tweak analysis notes) for citation in the report.

  1. Jailbreak environment setup (device / toolchain)：

    # 设备：DFU 模式进入 palera1n
sudo systemctl stop usbmuxd && sudo usbmuxd -f -p &    # 部分环境需重启 usbmuxd
sudo palera1n                                          # rootless 默认，无需旗标（v2 选项集 [-DEhpvVdsSLRnPI] 无 -l）
# 越狱后：Sileo 装 OpenSSH → 转发 → 登录
iproxy 2222 22 &
ssh -p 2222 root@127.0.0.1                              # 默认密码 alpine（rootless 后立即改）
    • Toolchain: Install Theos (tool preparation) + SDK; frida-server installed via Sileo
    • Record: Device model, iOS version, jailbreak tool and version, rootless mount prefix (palera1n rootless is /var/jb）

  2. Jailbreak Detection Identification and Bypass：

    • Static identification: Search App binary strings for jailbreak path signatures (/Applications/Cydia.app、/usr/sbin/sshd、/var/jb、cydia:// , etc.), [[re-ghidra]]/[[re-ida]] trace xrefs to find detection functions
    • Dynamic identification (fast) — frida batch hooks detection common APIs and records the paths being checked: 
      // hook.js —— 记录 App 检查了哪些越狱特征路径
['access', 'stat', 'lstat', 'open', 'dlopen'].forEach(function(n) {
  var f = Module.findGlobalExportByName(n);      // Frida 17+：旧写法 Module.findExportByName(null, n) 已移除
  if (f) Interceptor.attach(f, { onEnter: function(a) {
    var p = (n === 'dlopen') ? a[0] : a[0].readCString();   // 读 C 字符串用 NativePointer 实例方法（Memory 下无 readCString）
    if (p && (p.indexOf('Cydia') >= 0 || p.indexOf('/var/jb') >= 0 || p.indexOf('jb') >= 0))
      console.log(n, '->', p, 'ret_pending');
  }});
});
    • Common detection families: file/directory existence, URL scheme (cydia://),fork() parent process, out-of-sandbox write test (/private/), jailbreak detection SDKs; bypass = change the return value at each detection point (frida or write a tweak), see Pitfall 3
    • Output: Detection point list (path/API/location + bypass plan)

  3. tweak Analysis (MobileSubstrate/Substrate hook)：

    # 已有 tweak 的 deb：解包看动态库 + 过滤 plist
dpkg-deb -x tweak.deb /tmp/tweak/                      # Linux/macOS 装 dpkg 或用 ar 解
find /tmp/tweak -name "*.dylib" -o -name "*.plist"
cat /tmp/tweak/Library/MobileSubstrate/DynamicLibraries/*.plist   # Filter：hook 哪些进程
    • Reverse the dynamic library: strings to find class names/method names (Logos' %hook ClassName retains class name strings) → [[re-ghidra]]/[[re-ida]] locate
    • Substrate principle:MSHookMessageEx(OC method) modifies the class method implementation pointer;MSHookFunction(C function) modifies the function header jump — find in the decompilation the MSHookMessageEx/MSHookFunction call sites, and the parameters (target class/method/new implementation address) are the hook list
    • In a Theos project, %hook/%orig 's Logos syntax expands to the above calls (understanding Logos helps in understanding the compiled output)
    • Output: Hook target list (class/method/what the new implementation does) + filter conditions

  4. Dynamic debugging (lldb remote attach)：

    iproxy 1234 1234 &                                      # 转发调试端口
# 设备端：目标 App 启动后，root 下运行 debugserver 附加
# 主机侧：
lldb
(lldb) platform select remote-ios
(lldb) process connect connect://127.0.0.1:1234
(lldb) process attach --pid <pid>                       # 或按进程名
(lldb) image lookup -n '-[ViewController viewDidLoad]'  # 符号查找（[[re-lldb]]）
(lldb) breakpoint set -n ptrace                          # 反调试函数断点（见坑 4）
    • On jailbroken devices, you can also use frida's -U -f <bundleID> spawn mode to cover early logic
    • Output: Breakpoint list + key function disassembly/register state

  5. Decryption and analysis ([[re-ios]] linkage)：

    • If the target App is an App Store encrypted binary (otool -l check cryptid 1) → first follow [[re-ios]] Step 5 to decrypt (FairPlay decryption, choose the backend based on the target iOS / Frida generation), then go back to Steps 2-3 for static analysis
    • Decryption/re-signing: free certificate is valid for 7 days ([[re-ios]] Pitfall 2), repackage with adhoc re-signing, or use a decryption tool to directly output an installable ipa
    • Output: Decrypted ipa (cryptid 0 verification) + sha256

Cross-domain combination

  • [[re-ios]]: Decryption (FairPlay decryption), static analysis (class-dump / Mach-O), signing — the static foundation of this skill
  • [[re-frida]]: spawn/attach instrumentation, hook detection APIs and JNI/OC functions, bypass execution
  • [[re-lldb]]: Remote attach, breakpoints, expressions, symbol lookup (debugserver + iproxy)
  • [[re-mobile]]: Gateway — dynamic analysis on jailbroken devices is the environmental prerequisite for Steps 3-4 of the re-mobile workflow
  • [[re-binary-core]]: tweak dynamic library / App binary decompilation foundation ([[re-ghidra]] / [[re-ida]])
  • [[re-analyze]]: Invoked by the triage "mobile App analysis" path (re-mobile → iOS dynamic → this skill)
  • [[re-analyze/platform-tips]]: The highest principle for jailbroken/dynamically executed controlled devices; [refer to the macOS/iOS branch]

Common pitfalls and traps

  • System integrity remains limited after jailbreaking: Symptom — jailbreak succeeds but some paths are not writable, tweak injection does not take effect, and the App still behaves as if "sandboxed"; Cause — iOS System Integrity Protection (AMFI / SSV signed volume) is still in place, and rootless jailbreak (the default in palera1n 2.x) deliberately keeps the system volume read-only, with all jailbreak modifications under the /var/jb prefix; Countermeasure — clarify the difference between rootless and rootful: under rootless, dependencies, tweaks, and frida are all in /var/jb, and writing to the system partition does not take effect; old tools that need to write to the system partition must confirm rootless compatibility or switch to rootful mode (only supported on older iOS)
  • Device version matching (toolchain version): Symptom — palera1n reports unsupported, a tweak compiled with Theos has no effect after installation, frida-server fails to start; Cause — palera1n only supports specific iOS versions on A8–A11; the Theos SDK version does not match the device iOS; the frida-server version is inconsistent with the host frida; Countermeasure — check the official support matrix (docs.palera.in) before jailbreaking, and choose tools according to device/iOS; download the SDK matching the iOS major version (theos/sdks); frida-server and the host frida --version must be exactly the same ([[re-frida]] pitfall 1); back up before the jailbreak process, and if DFU fails you can start over
  • Detection countermeasures (jb detection libraries): Symptom — the App crashes as soon as it runs / shows "device not supported", and frida cannot even attach in time; Cause — the App integrates jailbreak detection (file paths / URL schemes / fork tests / jailbreak detection SDKs), and detection executes early at startup; Countermeasure — catch the early stage in spawn mode (frida -U -f <bundleID>), and bypass item by item according to the hook checklist in step 2; analyze detection libraries with static methods first to locate them (strings + xref), and use dynamic methods only for verification; record the bypass plan before implementing it ([[re-analyze/platform-tips]] controlled device)
  • Debugger detection: Symptom — after lldb attach succeeds, the App immediately exits / stops responding / shows a white screen; Cause — the App detects ptrace (ptrace(PT_DENY_ATTACH)）、sysctl 's P_TRACED flag, getppid, and other anti-debugging methods; Countermeasure — first set a breakpoint on ptrace/sysctl and change the return value (example in step 4), or use Theos to write an anti-anti-debug tweak for a global bypass; on jailbroken devices, some detection also targets the debugserver process name, so rename/hide it if necessary
  • Double verification: Symptom — it still crashes after bypassing jailbreak detection; Cause — jailbreak detection is combined with SSL Pinning; Countermeasure — disable both at the same time, do not handle only one
  • Hooking system functions affects the app itself: Symptom — the App hangs after hooking stat; Cause — system-level hooks affect normal logic; Countermeasure — filter by caller and only hook calls triggered by the app's own code
  • Certificate trust switch: Symptom — SSL errors still occur after installing the mitmproxy certificate; Cause — iOS 14+ requires manually enabling it in certificate trust settings; Countermeasure — after installing the certificate, go to "General → About → Certificate Trust Settings" and check it
  • Jailbreak detection hook template: Symptom — common detection needs to be bypassed quickly; Cause — common detection focuses on file existence and process capability queries; Countermeasure — intercept file existence checks (return not found for the jailbreak path list) + fork returns -1 (a jailbroken device can fork, a non-jailbroken device returns -1) (Source: reverse-skill field-journal, MIT)