bishopfox/theos-jailed

A version of Theos/CydiaSubstrate for non-jailbroken iOS devices

Theos and Cycript for non-jailbroken iOS devices

This fork of Theos is designed to work with apps on non-jailbroken iOS devices. You MUST have an Apple iOS Developer account in order to use this (for code-signing purposes).

• You use it just as you would for a jailbroken device tweak (edit Tweak.xm then "make")
• It integrates CydiaSubstrate
• It integrates Cycript
• It patches App Store apps (.ipa files) to load CydiaSubstrate, your tweak, Cycript, etc
• It re-signs the patched app using your Apple iOS Developer certificate
• You can then (re)install the patched app to your jailed device using XCode
• You can remotely attach to Cycript using cycript -r hostname:31337

Requirements

• iOS device
• Apple Developer account
• XCode with iPhone SDK
• Patience and luck

Quick How-to

• Extract and decrypt your target app. Save as a .ipa.
• Check out this project
• Change to the base directory for your new tweak
• Run /path/to/theos-jailed/bin/nic.pl
• Configure as you normally would for a regular Theos tweak
• Once done, change into your new tweak directory
• Edit Tweak.xm as necessary
• Run make to build your tweak
• Run ./patchapp.sh info /path/to/your/file.ipa
• Take the information from that and use the Apple Member Center to create a matching Provisionin Profile.
• Save the Provisioning Profile somewhere on your computer.
• Run .patchapp.sh patch /path/to/your/file.ipa /path/to/your/file.mobileprovision to inject the tweak into your .ipa
• Install the patched .ipa back onto your device using XCode.

More instructions to follow!

theos-jailed's Issues

[error] Cowardly refusing to make a project inside $THEOS?

I keep getting a error when trying to run nic.pl that says "[error] Cowardly refusing to make a project inside $THEOS" And when i run sudo, it does the same :(

Building tweak error: library not found for -ldylib1.o

Hi. I'm trying to build a clear tweak (just made from template), but I receive the following error:

clang: warning: libstdc++ is deprecated; move to libc++ with a minimum deployment target of iOS 7 [-Wdeprecated]
ld: library not found for -ldylib1.o
clang: error: linker command failed with exit code 1 (use -v to see invocation)

How to solve it?

Injected Application Crashes on Load

UPDATE: Doing the EXACT same as below with an iOS 7.0.4 device (iPad 2) WORKS. But will crash on load with my iOS 9.1 device! (iPhone 6) That takes my guess to a code signature issue of some sort, but I have tried everything deemed possible with what I can, cannot sign and how what and with what bundle ID or wildcard etc.

I have use theos before for jailbroken devices and understand how that works. I have also researched and successfully injected a dylib into a binary with optool previously. I know and love theos' simplicity so I came here to see if this would be a much better option.

I created a whole new blank(only changes made were bitcode to off and only have armv7 compiled) XCode project called 'injectMe' and exported/archived it to an IPA to test on.

I also created a completely new Theos tweak project name 'injectYou'. I made no changes to the project whatsoever.

Also went to my developer portal and followed instructions to make a limited BundleID cert. (According to the patchscript info) (All of this also tested on a wildcard cert as well, same outcome!)

'make' to compile/sign the tweak
"/Users/justin/Documents/injectMeApp/injectyou/theos/makefiles/targets/Darwin/iphone.mk:41: Deploying to iOS 3.0 while building for 6.0 will generate armv7-only binaries.
Making all for tweak injectYou...
Preprocessing Tweak.xm...
Compiling Tweak.xm...
Compiling fishhook/fishhook.c...
Preprocessing iSpy.class.xm...
Compiling iSpy.class.xm...
Preprocessing iSpy.instance.xm...
Compiling iSpy.instance.xm...
Preprocessing iSpy.msgSend.common.xm...
Compiling iSpy.msgSend.common.xm...
Preprocessing iSpy.msgSend.whitelist.xm...
Compiling iSpy.msgSend.whitelist.xm...
Preprocessing iSpy.msgSend.xm...
Compiling iSpy.msgSend.xm...
Preprocessing iSpy.msgSend_stret.xm...
Compiling iSpy.msgSend_stret.xm...
Preprocessing typestring.xm...
Compiling typestring.xm...
Preprocessing iSpy.logwriter.xm...
Compiling iSpy.logwriter.xm...
Preprocessing iSpy.SSLPinning.xm...
Compiling iSpy.SSLPinning.xm...
Linking tweak injectYou...
Stripping injectYou...
Signing injectYou...
iPhone Developer: ambiguous (matches "iPhone Developer: * * ()" and "iPhone Developer: ***__@.com (_)" in /Users/_/Library/Keychains/login.keychain)"

That was simply a keychain error at first, fixed that.

Now the second time 'make'. No errors!
"/Users/justin/Documents/injectMeApp/injectyou/theos/makefiles/targets/Darwin/iphone.mk:41: Deploying to iOS 3.0 while building for 6.0 will generate armv7-only binaries.
Making all for tweak injectYou...
Preprocessing Tweak.xm...
Compiling Tweak.xm...
Linking tweak injectYou...
Stripping injectYou...
Signing injectYou..."

Then I ran the patch script. Again, no errors! (Except no extensions, as I don't have any.)

"./patchapp.sh patch ../injectMe.ipa ../_.mobileprovision
[+] Unpacking the .ipa file (/Users/__/Documents/injectMeApp/injectyou/../injectMe.ipa)...
[+] Copying .dylib dependences into ".patchapp.cache/Payload/injectMe.app"
[+] Codesigning .dylib dependencies with certificate "iPhone Developer: *_* * (*******)"
.patchapp.cache/Payload/injectMe.app/injectYou.dylib
.patchapp.cache/Payload/injectMe.app/CydiaSubstrate
.patchapp.cache/Payload/injectMe.app/ap.dylib
.patchapp.cache/Payload/injectMe.app/cy.dylib
.patchapp.cache/Payload/injectMe.app/readlin.dylib
.patchapp.cache/Payload/injectMe.app/ncur.dylib
.patchapp.cache/Payload/injectMe.app/cycript
obj/injectYou.dylib
[+] Patching ".patchapp.cache/Payload/injectMe.app/injectMe" to load "injectYou.dylib"
[+] Generating entitlements.xml for distribution ID "alis"="iPhone Distribution: *** , LLC"
[+] Codesigning Plugins and Frameworks with certificate "iPhone Developer: **** * ()"
ls: .patchapp.cache/Payload/injectMe.app/PlugIns/com./com.: No such file or directory
ls: .patchapp.cache/Payload/injectMe.app/PlugIns/com.: No such file or directory
ls: .patchapp.cache/Payload/injectMe.app/Frameworks/: No such file or directory
[+] Codesigning the patched .app bundle with certificate "iPhone Developer: ** * (*****)"
injectMe.app: replacing existing signature
[+] Repacking the .ipa
[+] Wrote "injectMe-patched.ipa"
[+] Great success!"

Also installed the mobile provision onto the device correctly (tested by signing the non-patched app, installed correctly and ran without any crashes)

Installed the patched ipa to my device it will ALWAYS crash on load, no matter what. Seems to happen to every app I have tried to patch so far, be it AppStore clutched app or an XCode archived app.

"Dec 18 17:41:02 Device kernel[0] : xpcproxy[747] Container: /private/var/mobile/Containers/Data/Application/0930A84D-E968-444D-AAA2-D0CD26026907 (sandbox)
Dec 18 17:41:02 Device assertiond[67] : Unable to obtain a task name port right for pid 747: (os/kern) failure (5)
Dec 18 17:41:02 Device SpringBoard[58] : Unable to register for exec notifications: No such process
Dec 18 17:41:02 Device SpringBoard[58] : Unable to obtain a task name port right for pid 747: (os/kern) failure (5)
Dec 18 17:41:02 Device SpringBoard[58] : Unable to obtain a task name port right for <FBApplicationProcess: 0x142b38f20; com.adhoc.injectMe; pid: 747>
Dec 18 17:41:02 Device SpringBoard[58] : Application 'UIKitApplication:com.adhoc.injectMe[0xe2e]' crashed.
Dec 18 17:41:02 Device com.apple.xpc.launchd1 : Service exited due to signal: Trace/BPT trap: 5
Dec 18 17:41:02 Device SpringBoard[58] : CGContextSaveGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.
Dec 18 17:41:02 Device SpringBoard[58] : CGContextTranslateCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.
Dec 18 17:41:02 Device SpringBoard[58] : CGContextRestoreGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.
Dec 18 17:41:02 Device SpringBoard[58] : CGContextSaveGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.
Dec 18 17:41:02 Device SpringBoard[58] : CGContextTranslateCTM: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.
Dec 18 17:41:02 Device SpringBoard[58] : CGContextRestoreGState: invalid context 0x0. If you want to see the backtrace, please set CG_CONTEXT_SHOW_BACKTRACE environmental variable.
Dec 18 17:41:02 Device SpringBoard[58] : Application '(null)' exited for an unknown reason.
Dec 18 17:41:02 Device ReportCrash[748] : Formulating report for corpse[747] injectMe
Dec 18 17:41:02 Device ReportCrash[748] : saved type '109_injectMe' report (11 of max 25) as /var/mobile/Library/Logs/CrashReporter/injectMe_2015-12-18-174102_Device.ips
Dec 18 17:41:03 Device searchd[164] : ====^^^^ DuetExpert missing data, count -> people:0 applicationDeepLinks:0 applications:8 requests:46 missingAllDataRequests:0"

Other information:
iPhone 6 iOS 9.1
My apple account is an admin of another enterprise account, although not owner
I also noticed that the patch script told me to create com.adhoc.injectMe-patched yet the final "patched" ipa only had a "com.adhoc.injectMe" bundleID. I changed the original unpatched ipa bundle ID to com.adhoc.injectMe-patched. No luck. As well as tried both a limited mobileprovion to com.adhoc.injectMe-patched, com.adhoc.injectMe, and even a wildcard mobileprovision.

Thank you so much for your time and help

make problem

Novice question for theos-jailed.

I developed a simple iPhone tweak using theos and can make, install and run in a jailbroken phone.

I am trying theos-jailed so that I can run the same tweak in a non-jailbroken phone. However, I got the following error while trying to do a make. I am trying on Mac OS Sierra with Xcode 8.0 installed. Is there a configuration or pre-requisite that I missed out? Any help is appreciated. Thanks

Making all for tweak newtest...
Linking tweak newtest...
clang: warning: libstdc++ is deprecated; move to libc++ with a minimum deployment target of iOS 7
ld: library not found for -ldylib1.o
clang: error: linker command failed with exit code 1 (use -v to see invocation)
make[2]: *** [obj/newtest.dylib.855abb9a.unsigned] Error 1
make[1]: *** [internal-library-all_] Error 2
make: *** [newtest.all.tweak.variables] Error 2

libsubstrate.dylib for arm64

Hey Guys when I try to compile a tweak for arm64 Architecture, I get the following error message.
Could it be, that you guys forgot to upload the right libsubstrate.dylib?

Makefile: ARCHS = arm64

[...]libsubstrate.dylib, file was built for armv7 which is not the architecture being linked (arm64):[...]

Hooking private functions?

Been reading a log but havent seen a definitive answer, given most posts about this are for jailbroken apps. Using MSHookFunction, is it possible to hook a private function on a non-jailbroken device using the functions address?

I'm trying to port a tweak I made for my son's jailbroken ipod to my non-jailbroken iphone. Everything works except for hooking the private function. Not sure if it's an Apple restriction, or if I'm doing something wrong.

MSHookFunction

Hi! I'm trying to use MSHookFunction but with no luck since the app crashes at the startup: https://ghostbin.com/paste/rf5n3

There is some problem with MSHookFunction or can't be used with theos-jailed?

Thanks

patch problem

when i patch .ipa ,print this "You need to install optool from here: https://github.com/alexzielenski/optool
Then update OPTOOL variable in './patchapp.sh' to reflect the correct path to the optool binary."

Trouble signing

Hi,
I'm having trouble getting the signing working. I followed your instructions here http://www.bishopfox.com/blog/2015/05/rethinking-repackaging-ios-apps-part-2/

One thing I couldn't do when matching the provisioning profile, is use the app group that patchapp info suggested, i'm guessing because someone else must have the same app group name.
Would that have been a problem?

This is the error I get when trying to install the patched app

mobile_installation_proxy[2238] : 0x16e2d3000 __MobileInstallationInstallForLaunchServices_block_invoke222: Returned error Error Domain=MIInstallerErrorDomain Code=13 "Failed to verify code signature of /private/var/mobile/Library/Caches/com.apple.mobile.installd.staging/temp.TuGrFl/extracted/Payload/Snapchat.app/PlugIns/SnapchatShareExt.appex : 0xe8008001 (An unknown error has occurred.)" UserInfo={LibMISErrorNumber=-402620415, LegacyErrorString=ApplicationVerificationFailed, SourceFileLine=142, FunctionName=+[MICodeSigningVerifier _validateSignatureAndCopyInfoForURL:withOptions:error:], NSLocalizedDescription=Failed to verify code signature of /private/var/mobile/Library/Caches/com.apple.mobile.installd.staging/temp.TuGrFl/extracted/Payload/Snapchat.app/PlugIns/SnapchatShareExt.appex : 0xe8008001 (An unknown error has occurred.)}

Just cant get it to work..

Everytime I try to get it to work it either says "an unknown error occurred" when installing the app with xcode or the app will install and crash on start or it just will not work at all..

arm64

Any chance of making this compatible with arm64 ?

Error while building the tweak

When I'm trying to build the tweak (running MAKE command), I receive the following error:

/.../mytweak/iSpy.msgSend.whitelist.h:3:10: fatal error: 'tr1/unordered_set' file not
      found
#include <tr1/unordered_set>

Any ideas how to fix this?

Dyld Message: Library not loaded CydiaSubstrate

Running into an issue, followed all steps to a T..The patched .ipa transfers and runs on my /jailbroken/ device..all is well there.

Now, when I transfer the .ipa to my wife's iPhone that's NOT Jailbroken. The App crashes, checking the crash log I see this.

Dyld Error Message:
Dyld Message: Library not loaded: /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate
Referenced from: /var/mobile/Containers/Bundle/Application/8FA82B31-4EF6-4EDF-AB09-070AF5E19D37/App.app/unconfirmed.dylib
Reason: image not found
Dyld Version: 369.12

Any ideas?

Both devices are iPhone 6S's running 9.0.2

Cowardly refusing to make a project inside $THEOS (/private/var/theos/)

i changed THEOS with 'export THEOS=/opt/theos' and it still says Cowardly refusing to make a project inside $THEOS (/private/var/theos/) why and plz help

Failed to inject APPNAME.dylib

When i attempt to patch the .ipa file, I get the error that it failed to inject [appname].dylib and asks if I care debug the problem. I had to install optool and I updated patchapp.sh but I must have messed up somewhere. How can I determine what is causing this issue?

Codesign Failed

[+] Unpacking the .ipa file (/Users/carson/Desktop/reddit/Reddit.ipa)...
[+] Copying .dylib dependences into ".patchapp.cache/Payload/Reddit.app"
[+] Codesigning .dylib dependencies with certificate ""
.patchapp.cache/Payload/Reddit.app/Reddit.dylib
Codesign failed. Have you ran 'make' yet?

Got this far... Any idea why it can't find my .mobileprovision file?

EDIT:

Also found where this happens:

sign all of the .dylib files we're injecting into the app

    echo '[+] Codesigning .dylib dependencies with certificate "'$CODESIGN_$
    for file in "$APPDIR/${DYLIB##*/}" "$APPDIR/CydiaSubstrate" "$APPDIR/ap$
            echo '     '$file
            codesign -fs "$CODESIGN_NAME" "$file" >& /dev/null
            if [ "$?" != "0" ]; then
                    echo "Codesign failed. Have you ran 'make' yet?"
                    exit 1
            fi
    done

Patching to load dylib failed.

[+] cannot inject payload into @executable_path/testdylib.dylib because there is no room
Failed to insert a LC_LOAD_DYLIB command for arm.