mirror of
https://github.com/Lakr233/vphone-cli.git
synced 2026-09-02 02:34:29 +00:00
zqxwceandClaude Opus 4.8
82485d988d
iOS 27 lsd gates app (re)registration behind -[_LSDModifyClient clientIsEntitledForEmbeddedRegistrationOperations], an XPC-peer entitlement check for one of three privileged entitlements (coreservices.lsaw / installcoordinationd.daemon / coreservices.can-register-install-results). Missing -> NSOSStatusErrorDomain -54 (permErr, LSDModifyService.mm:1639), so registerApplicationDictionary: and registerContainerizedApplicationWithInfoDictionaries: fail and no app can register — blocking vphoned's installer, TrollStore, and uicache/Sileo. The entitlement route is unsatisfiable: LS registration is proxied, so the peer lsd inspects is not the caller (even vphoned with all three in its validated csblob is rejected). Fix (two parts): - cfw_patch_lsd_embedded_reg.py: NOP the gate's final cbz so the check always returns YES + re-attest the 16 KiB page (TXM per-page). Wired into cfw.py (patch-lsd-embedded-reg) and cfw_install.sh (after patch-dsc-maxslide); self-gates on pre-27 userlands (method absent). Method resolved via the DSC's own .symbols in-image table (ipsw symaddr/a2s time out on this cache), gate located by control-flow shape (cbz/cbnz w0 whose fall-through sets the mov w<reg>,#1 result), NOP bytes from Keystone. New CDHash accepted by the JB always-true AMFI cdhash-trust patch. - vphoned vp_register_path: fall back from the (still-gated) plain registerApplicationDictionary: to the containerized registration API, which works once the gate is patched (treat a nil registrationError as success since it returns NO even when it registers). Verified on 17,3_27.0_24A5380h + cloudOS 26.4 (JB): -54 gone, Sileo registers (uicache -l 0->1), vphoned installs+registers a test IPA (com.vphone.vptest) to /var/containers/Bundle/Application end-to-end; clean boot (re-attest correct). Documented as item 12 in research/0_binary_patch_comparison.md. Co-Authored-By: Claude Opus 4.8 <[email protected]> Claude-Session: https://claude.ai/code/session_013pk5tsoBeuu3jhkmnRFtic