mirror of
https://github.com/Lakr233/vphone-cli.git
synced 2026-09-02 02:34:29 +00:00
cfw_install: jb/exp: Flip launchd hook to opt-out via DISABLE_LAUNCHD_HOOK
Inject launchdhook into pid 1 by default again for JB/EXP; set DISABLE_LAUNCHD_HOOK=1 to skip. Also fixes a doubled-prefix typo in cfw_install_exp.sh that made the previous env flag unreadable there. Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
zqxwce
committed by
zqxwce
zqxwce
co-authored by
Claude Fable 5
Claude Fable 5
parent
7c3fdf17c5
commit
729c3b644c
@@ -169,7 +169,7 @@ do NOT execute these).
|
||||
| 3 | `mov x0,#1; ret` | `mobileactivationd` | Activation bypass | Y | Y | Y |
|
||||
| 4 | Plist injection | `launchd.plist` | bash/dropbear/trollvnc/vphoned daemons | Y | Y | Y |
|
||||
| 5 | `b` (skip jetsam guard) | `launchd` | Prevent jetsam panic on boot | - | Y | Y |
|
||||
| 6 | Weak dylib load injection | `launchd` | Optional: load short alias `/b` (copy of `launchdhook.dylib`) at launch when `VPHONE_JB_ENABLE_LAUNCHD_HOOK=1`; default off because this pid-1 hook path is boot-critical and has produced boot-analysis failures | - | - | opt-in |
|
||||
| 6 | Weak dylib load injection | `launchd` | Load short alias `/b` (copy of `launchdhook.dylib`) at launch. On by default; set `DISABLE_LAUNCHD_HOOK=1` to skip because this pid-1 hook path is boot-critical and has produced boot-analysis failures | - | Y | Y |
|
||||
| 7 | cstring byte 5 mangle `'h' → 'X'` (`"kern.hv_vmm_present"` → `"kern.Xv_vmm_present"`) + per-page slot-hash re-attestation, BLACKLIST semantics — **EXP only** | DSC dylibs | Companion to EXP kernel rename (`KernelEXPPatcher.patchHvVmmRename`). The mangle is applied to every DSC dylib EXCEPT those in `DONT_PATCH_INSTALL_NAMES` (sign-in / device-likeness consumers, ~15 entries). Patched dylibs query `kern.Xv_vmm_present` and get the truthful 1 (graphics / accel passthrough). Blacklisted dylibs keep the original cstring, hit ENOENT on the renamed kernel, cache 0, lie about VM presence. On `codeSigningMonitor == 2` hardware the byte-mangle alone causes `CODESIGNING/Invalid Page` SIGKILL because TXM enforces per-page hashes; the re-attestation pass recomputes the SHA-256 slot in the chunk's `CS_CodeDirectory` for every modified 16 KiB page. See `scripts/patchers/cfw_dsc_codesign.py` and `cfw_patch_hv_vmm_dsc.py`. | - | - | - |
|
||||
| 8 | (removed — was: standalone-binary mangle in 6 rootfs Mach-Os via SSH) | n/a | Removed in the blacklist-flip redesign. With the EXP kernel rename in place, the 6 rootfs binaries (MobileActivationMigrator, CheckerBoard, StoreKitUISceneService, storekitd, appstored, CorePrescriptionService) get the desired "cache 0 / not in a VM" behavior for free: they keep their original cstring, hit ENOENT on the renamed kernel sysctl, defensive `cbnz w0, skip` leaves the cached byte at BSS-zero. No SSH-time standalone patch needed. | - | - | - |
|
||||
|
||||
@@ -648,7 +648,7 @@ cache rebuild.
|
||||
| Dev overlay (`rpcserver_ios` replacement) | - | Y (`apply_dev_overlay`) | - | - |
|
||||
| SSH readiness wait before install | Y (`wait_for_device_ssh_ready`) | - | Y (inherited from base run) | Y (inherited from base run) |
|
||||
| launchd jetsam patch (`patch-launchd-jetsam`) | - | Y (base-flow injection) | Y (JB-1) | Y (JB-1) |
|
||||
| launchd dylib injection (`inject-dylib /b`) | - | - | opt-in via `VPHONE_JB_ENABLE_LAUNCHD_HOOK=1` | opt-in via `VPHONE_JB_ENABLE_LAUNCHD_HOOK=1` |
|
||||
| launchd dylib injection (`inject-dylib /b`) | - | - | Y (JB-1, opt-out via `DISABLE_LAUNCHD_HOOK=1`) | Y (JB-1, opt-out via `DISABLE_LAUNCHD_HOOK=1`) |
|
||||
| Procursus bootstrap deployment | - | - | Y (JB-2) | Y (JB-2) |
|
||||
| BaseBin hook deployment (`*.dylib` -> `/mnt1/cores`) | - | - | Y (JB-3) | Y (JB-3) |
|
||||
| First-boot JB finalization (`vphone_jb_setup.sh`) | - | - | Y (post-boot) | Y (post-boot) |
|
||||
|
||||
+10
-12
@@ -148,7 +148,7 @@ CFW_INPUT="cfw_input"
|
||||
CFW_JB_INPUT="cfw_jb_input"
|
||||
CFW_JB_ARCHIVE="cfw_jb_input.tar.zst"
|
||||
TEMP_DIR="$VM_DIR/.cfw_temp"
|
||||
VPHONE_JB_ENABLE_LAUNCHD_HOOK="${VPHONE_JB_ENABLE_LAUNCHD_HOOK:-0}"
|
||||
DISABLE_LAUNCHD_HOOK="${DISABLE_LAUNCHD_HOOK:-0}"
|
||||
|
||||
SSH_PORT="${SSH_PORT:-2222}"
|
||||
SSH_PASS="alpine"
|
||||
@@ -404,18 +404,16 @@ else
|
||||
echo " [!] No entitlements found on original launchd"
|
||||
fi
|
||||
|
||||
# Injecting launchdhook into pid 1 is opt-in. This boot-critical hook path has
|
||||
# produced boot-analysis failures; keep BaseBin deployed, but do not load /b
|
||||
# from launchd unless explicitly requested.
|
||||
if [[ "$VPHONE_JB_ENABLE_LAUNCHD_HOOK" == "1" ]]; then
|
||||
if [[ -d "$JB_INPUT_DIR/basebin" ]]; then
|
||||
echo " Injecting weak dylib load for /b (short launchdhook alias)..."
|
||||
"$PYTHON3" "$SCRIPT_DIR/patchers/cfw.py" inject-dylib "$TEMP_DIR/launchd" "/b"
|
||||
else
|
||||
echo " [!] VPHONE_JB_ENABLE_LAUNCHD_HOOK=1 but BaseBin is missing; skipping launchdhook injection"
|
||||
fi
|
||||
# Injecting launchdhook into pid 1 is on by default. This boot-critical hook
|
||||
# path has produced boot-analysis failures; set DISABLE_LAUNCHD_HOOK=1 to keep
|
||||
# BaseBin deployed without loading /b from launchd.
|
||||
if [[ "$DISABLE_LAUNCHD_HOOK" == "1" ]]; then
|
||||
echo " [*] Skipping launchdhook dylib injection (DISABLE_LAUNCHD_HOOK=1)"
|
||||
elif [[ -d "$JB_INPUT_DIR/basebin" ]]; then
|
||||
echo " Injecting weak dylib load for /b (short launchdhook alias)..."
|
||||
"$PYTHON3" "$SCRIPT_DIR/patchers/cfw.py" inject-dylib "$TEMP_DIR/launchd" "/b"
|
||||
else
|
||||
echo " [*] Skipping launchdhook dylib injection (set VPHONE_JB_ENABLE_LAUNCHD_HOOK=1 to enable)"
|
||||
echo " [!] BaseBin is missing; skipping launchdhook injection"
|
||||
fi
|
||||
|
||||
"$PYTHON3" "$SCRIPT_DIR/patchers/cfw.py" patch-launchd-jetsam "$TEMP_DIR/launchd"
|
||||
|
||||
+10
-12
@@ -49,7 +49,7 @@ CFW_INPUT="cfw_input"
|
||||
CFW_JB_INPUT="cfw_jb_input"
|
||||
CFW_JB_ARCHIVE="cfw_jb_input.tar.zst"
|
||||
TEMP_DIR="$VM_DIR/.cfw_temp"
|
||||
VPHONE_JB_ENABLE_LAUNCHD_HOOK="${VPHONE_JB_ENABLE_LAUNCHD_HOOK:-0}"
|
||||
DISABLE_LAUNCHD_HOOK="${DISABLE_LAUNCHD_HOOK:-0}"
|
||||
|
||||
SSH_PORT="${SSH_PORT:-2222}"
|
||||
SSH_PASS="alpine"
|
||||
@@ -235,18 +235,16 @@ else
|
||||
echo " [!] No entitlements found on original launchd"
|
||||
fi
|
||||
|
||||
# Injecting launchdhook into pid 1 is opt-in. This boot-critical hook path has
|
||||
# produced boot-analysis failures; keep BaseBin deployed, but do not load /b
|
||||
# from launchd unless explicitly requested.
|
||||
if [[ "$VPHONE_JB_ENABLE_LAUNCHD_HOOK" == "1" ]]; then
|
||||
if [[ -d "$JB_INPUT_DIR/basebin" ]]; then
|
||||
echo " Injecting weak dylib load for /b (short launchdhook alias)..."
|
||||
"$PYTHON3" "$SCRIPT_DIR/patchers/cfw.py" inject-dylib "$TEMP_DIR/launchd" "/b"
|
||||
else
|
||||
echo " [!] VPHONE_JB_ENABLE_LAUNCHD_HOOK=1 but BaseBin is missing; skipping launchdhook injection"
|
||||
fi
|
||||
# Injecting launchdhook into pid 1 is on by default. This boot-critical hook
|
||||
# path has produced boot-analysis failures; set DISABLE_LAUNCHD_HOOK=1 to keep
|
||||
# BaseBin deployed without loading /b from launchd.
|
||||
if [[ "$DISABLE_LAUNCHD_HOOK" == "1" ]]; then
|
||||
echo " [*] Skipping launchdhook dylib injection (DISABLE_LAUNCHD_HOOK=1)"
|
||||
elif [[ -d "$JB_INPUT_DIR/basebin" ]]; then
|
||||
echo " Injecting weak dylib load for /b (short launchdhook alias)..."
|
||||
"$PYTHON3" "$SCRIPT_DIR/patchers/cfw.py" inject-dylib "$TEMP_DIR/launchd" "/b"
|
||||
else
|
||||
echo " [*] Skipping launchdhook dylib injection (set VPHONE_JB_ENABLE_LAUNCHD_HOOK=1 to enable)"
|
||||
echo " [!] BaseBin is missing; skipping launchdhook injection"
|
||||
fi
|
||||
|
||||
"$PYTHON3" "$SCRIPT_DIR/patchers/cfw.py" patch-launchd-jetsam "$TEMP_DIR/launchd"
|
||||
|
||||
Reference in New Issue
Block a user