yiem/vphone-cli
1
0
Fork 0
mirror of https://github.com/Lakr233/vphone-cli.git synced 2026-09-05 17:14:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

Tighten launchdhook opt-in behavior

Browse Source
This commit is contained in:
xiahouzhen
2026-07-05 15:09:22 +03:00
committed by zqxwce
parent 6167567f12
commit 7c3fdf17c5
3 changed files with 25 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
research/0_binary_patch_comparison.md
+1 -1
View File
@@ -169,7 +169,7 @@ do NOT execute these).
| 3 | `mov x0,#1; ret` | `mobileactivationd` | Activation bypass | Y | Y | Y |
| 4 | Plist injection | `launchd.plist` | bash/dropbear/trollvnc/vphoned daemons | Y | Y | Y |
| 5 | `b` (skip jetsam guard) | `launchd` | Prevent jetsam panic on boot | - | Y | Y |
| 6 | `LC_LOAD_DYLIB` injection | `launchd` | Optional: load short alias `/b` (copy of `launchdhook.dylib`) at launch when `VPHONE_JB_ENABLE_LAUNCHD_HOOK=1`; default off because the current BaseBin launchd hook exits pid 1 with `launchd cannot be run directly` | - | - | opt-in |
| 6 | Weak dylib load injection | `launchd` | Optional: load short alias `/b` (copy of `launchdhook.dylib`) at launch when `VPHONE_JB_ENABLE_LAUNCHD_HOOK=1`; default off because this pid-1 hook path is boot-critical and has produced boot-analysis failures | - | - | opt-in |
| 7 | cstring byte 5 mangle `'h' → 'X'` (`"kern.hv_vmm_present"` → `"kern.Xv_vmm_present"`) + per-page slot-hash re-attestation, BLACKLIST semantics — **EXP only** | DSC dylibs | Companion to EXP kernel rename (`KernelEXPPatcher.patchHvVmmRename`). The mangle is applied to every DSC dylib EXCEPT those in `DONT_PATCH_INSTALL_NAMES` (sign-in / device-likeness consumers, ~15 entries). Patched dylibs query `kern.Xv_vmm_present` and get the truthful 1 (graphics / accel passthrough). Blacklisted dylibs keep the original cstring, hit ENOENT on the renamed kernel, cache 0, lie about VM presence. On `codeSigningMonitor == 2` hardware the byte-mangle alone causes `CODESIGNING/Invalid Page` SIGKILL because TXM enforces per-page hashes; the re-attestation pass recomputes the SHA-256 slot in the chunk's `CS_CodeDirectory` for every modified 16 KiB page. See `scripts/patchers/cfw_dsc_codesign.py` and `cfw_patch_hv_vmm_dsc.py`. | - | - | - |
| 8 | (removed — was: standalone-binary mangle in 6 rootfs Mach-Os via SSH) | n/a | Removed in the blacklist-flip redesign. With the EXP kernel rename in place, the 6 rootfs binaries (MobileActivationMigrator, CheckerBoard, StoreKitUISceneService, storekitd, appstored, CorePrescriptionService) get the desired "cache 0 / not in a VM" behavior for free: they keep their original cstring, hit ENOENT on the renamed kernel sysctl, defensive `cbnz w0, skip` leaves the cached byte at BSS-zero. No SSH-time standalone patch needed. | - | - | - |