jakeajames/rootlessjb3

hahh

Description

Blah blah, read this: How to make a jailbreak without a filesystem remount as r/w

• Powered by jelbrekLib

Support

• All A9-A11 devices
• All A7-A8 devices

To be supported (sorted by priority)

• A12 devices

DO NOT ASK FOR ETA

Usage notes

• voucher_swap is used for 16K devices, and v3ntex for 4K ones.
• Binaries are located in: /var/containers/Bundle/iosbinpack64
• Launch daemons are located in /var/containers/Bundle/iosbinpack64/LaunchDaemons
• /var/containers/Bundle/tweaksupport contains a filesystem simulation where tweaks and stuff get installed
• Symlinks include: /var/LIB, /var/ulb, /var/bin, /var/sbin, /var/Apps, /var/libexec

All executables must have at least these two entitlements:

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>platform-application</key>
    <true/>
    <key>com.apple.private.security.container-required</key>
    <false/>
</dict>
</plist>

• Tweaks and stuff get installed in: /var/containers/Bundle/tweaksupport the same way you did with Electra betas.
• Tweaks must be patched using the patcher script provided. (Mac/Linux/iOS only) or manually with a hex editor
• Apps get installed in /var/Apps and later you need to run /var/containers/Bundle/iosbinpack64/usr/bin/uicache (other uicache binaries won't work)

iOS 12

• amfid is patched, however it'll require you to resign everything with a cert. Use codesign -s 'IDENTITY' --entitlements /path/to/entitlements.xml --force /path/to/binary or inject everything as usual. However note that soon I won't be injecting stuff automatically on jailbreak anymore!
• You can tweak App Store apps, but you'll either have to call jailbreakd's fixMmap() yourself or resign things with a real cert and amfid will handle that for you. Second option is preferred. See previous point on how to.
• This is not dangerous and cannot screw you up.
• Tweaks pre-patched for rootlessJB 1.0 and 2.0 will not work. Use new patcher script. (ldid was replaced with ldid2!)

patcher usage: ./patcher /path/to/deb /path/to/output_folder

Thanks to: Ian Beer, Brandon Azad, Jonathan Levin, Electra Team, IBSparkes, Sam Bingner, Sammy Guichelaar.

rootlessjb3's Issues

inoperability failure from cyberduck

no idea why i get this, but im assuming its because of rootlessjb.... no idea..... any ideas?

[Patcher] sed:1

Command I enter: ./patcher cylinder_1.0.6.deb Cylinder

What happens?
A folder named Cylinder is created.

Output:
sed: 1: "/tmp/_ENTS.plist": invalid command code _

Goes into SafeMode after locking device.

When locking the device while jailbroken, will crash SpringBoard. Or will crash after unlocking device.

1

Implement working ldrestart

As of now, ldrestart seems to just send the phone into a loop and then panic. I believe this issue is known based off comments in the source, but this can be used to track the issue.

iSuperSU not Installing, and Tweaks not Applying

After this most recent GitHub Commit, I am unable to get Tweaks applied. It seems like its trying, but even the app doesn't say Jailbroken anymore. Ive also Noticed that iSuperSU won't start, and after deleting it it doesn't install.

C

random apps crash on launch

not sure what triggers it but random apps force close sometimes like twitter, and gmail app did to me today, had to reboot and reajailbreak, iphone X 12.1.1

[Localisation Issue?] Could not find specified service

Apparently the app cannot find certain services.

Log from Xcode:

Adding permissions to plist testbin.plist
[] Adding permissions to plist jailbreakd.plist
[] Found jailbreakd plist, special handling
/private/var/containers/Bundle/iosbinpack64/LaunchDaemons/testbin.plist: Could not find specified service
/private/var/containers/Bundle/iosbinpack64/LaunchDaemons/jailbreakd.plist: Could not find specified service
[*] Time for magic

Tweaks not injecting after respring

When installing tweaks through Filza, respringing does not inject them. The only solution is to simply reboot and rejailbreak.

Not sure what could be the cause but this only happens on iOS 12.1 and lower.

Tested on both an iPhone SE and iPhone 8 with Ignition's RootlessJB

Ipad pro 10.5

https://i.imgur.com/BqxuLm3.png

works once every 20 tries idk why

problem with jailbreakd [iPhone9,1] [12.1]

[234] Feb 04 22:27:05 Running in background
[*] Adding permissions to plist testbin.plist
[*] Adding permissions to plist jailbreakd.plist
[*] Found jailbreakd plist, special handling
**/private/var/containers/Bundle/iosbinpack64/LaunchDaemons/testbin.plist: Could not find specified service
/private/var/containers/Bundle/iosbinpack64/LaunchDaemons/jailbreakd.plist: Could not find specified service**
	[*] Time for magic
[*] Will trust /var/libexec/xpcproxy
[*] trust_chain at 0xfffffff01ec8be00
[*] allocated: 0x10000 => 0xffffffe00005c000
	[+] Really jailbroken!
[*] Cleaning up...

but the weird part is that the jailbreakd process appears to be running

Brendans-iPhone-7:/var/containers/Bundle/tweaksupport/Library/MobileSubstrate/DynamicLibraries root# ps aux | grep jailbreakd
**root               238   0.0  0.1  4217808   2144   ??  Ss   10:27PM   0:00.84 /var/containers/Bundle/iosbinpack64/bin/jailbreakd**
root               443   0.0  0.0  4196384    416 s002  R+   10:42PM   0:00.01 grep jailbreakd

power down= respring loop

powering down causes respring loop, can resping using terminus app from appstore, ssh method on mac in terminal does not respring device. iphone x 12.1.1 also respring with noctis settings works just manually powering down causes respring loop.

i7 - not installing iSuperSU

iPhone 7
iOS 1.2.1.1
Unable to install iSuperSU.

log snippet:
Successfully injected [1/1] to trust cache.
[-] unable to get vnode from path for /var/LIB/MobileSubstrate/DynamicLibraries/AppSyncUnified.dylib
[-] Unable to fix mmap of path: /var/LIB/MobileSubstrate/DynamicLibraries/AppSyncUnified.dylib
[*] Installing app com.jakeashacks.iSuperSU
[-] Can't install app /var/containers/Bundle/tweaksupport/Applications/iSuperSU.app
[+] Really jailbroken!

Jailbroken, and tweaks working, just no iSuperSU. Have never worked on any of the commits.

Can I provide more logs to assist with the debugging?

Doesn’t work on my iPod 6

Why doesn’t the jailbreak work on my iPod touch 6?? I tried everything from disabling find my iPhone to putting on Airplane mode and all it does is reboot my iPod. Is it not compatible with iPods?

Prefrence bundles not loading

Most tweaks don't show prefrences, including Snowboard which is known to work and i have tried chmod 777 the files and it doesent work

Reboot

When I click to jailbreak , its go to reboot.

Instant Kernal Panic when tapping the Apollo icon, sometimes

On some not very rare occasions I’ll tap the Apollo for Reddit icon and it will immediately panic, no freeze or anything, instant panic

I have an iPhone 8 iOS 12.1

Tweaks are:
Boulders
CCSupport
dateinstatusbar
FloatyDock
FUGap
HidebarX
HomeGesture
PullToRespring
Twig
VideoHUD

These are the panic logs of two instances of it:
https://www.dropbox.com/sh/tvkkulgg5yqzhhp/AABedgXwC9jUUOYEUeoZxlDxa?dl=0

Launching Overcast causes immediate panic

Jailbroken using latest fix (83d0c72).

Panic Log

Failed to copy kernelcache Iphone 7

offsets selected for iOS 12.0 or above
[*] copying to /var/mobile/Containers/Data/Application/0C365A66-4719-462C-88D0-1666779D8D6E/Documents/16.02.19:16.27.51_kernelcache
[-] Failed to copy kernelcache with error: The file “kernelcache” couldn’t be opened because you don’t have permission to view it.
[i] Kernel base: 0xfffffff00da04000
[-] error on KernelRead(0x0000000000000000)
[-] error on KernelRead(0x00000000000000f8)
[-] error on KernelWrite(0x0000000000000028)
[-] error on KernelWrite(0x0000000000000030)
[-] error on KernelWrite(0x000000000000002c)
[-] error on KernelWrite(0x0000000000000034)
[-] error on KernelWrite(0x0000013815e0f328)
[-] error on KernelWrite(0x0000013815e0f32c)
[-] error on KernelWrite(0x0000013815e0f330)
[-] error on KernelWrite(0x0000013815e0f334)
[-] error on KernelWrite(0x0000013815e0f338)
[-] error on KernelWrite(0x0000013815e0f378)
[-] error on KernelWrite(0x0000013815e0f37c)
[-] error on KernelRead(0x0000000000000028)
[-] error on KernelRead(0x0000000000000000)
[-] error on KernelRead(0x00000000000000f8)
[-] error on KernelWrite(0x0000000000000028)
[-] error on KernelWrite(0x0000000000000030)
[-] error on KernelWrite(0x000000000000002c)
[-] error on KernelWrite(0x0000000000000034)
[-] error on KernelWrite(0x0000013815e0f328)
[-] error on KernelWrite(0x0000013815e0f32c)
[-] error on KernelWrite(0x0000013815e0f330)
[-] error on KernelWrite(0x0000013815e0f334)
[-] error on KernelWrite(0x0000013815e0f338)
[-] error on KernelWrite(0x0000013815e0f378)
[-] error on KernelWrite(0x0000013815e0f37c)
[-] Failed to get root

Exploit failure!?

Resprings perfectly but stays in the bootloop, so I can’t use tweaks or even use my phone until I force reset. Please tell me what I am doing wrong?.

Patcher brokes plist files

Hello,
I see that some tweak's preference panel is not loading or giving error. I checked bundle file(actually directory) in PreferenceBundles directory and see some plist files (Root.plist, Info.plist etc) are broken after patching deb file. Replacing this plist files with original ones in unpatched deb file, tweak preference panel in settings starts to work.

Thank you for your work.
Serkan

fake_posix_spawn_common xpcproxy_blacklist useless

rootlessJB3/rootlessJB/payloads_source/pspawn_payload/launchd_payload.m

Line 70 in 5a79e87

inject_me = NULL;

when the path is in blacklist, SBINJECT_PAYLOAD_DYLIB still inject into it

iPad Air 2 - iOS 12.1.1 - Crash after click jailbreak

Hi,

When I click jailbreak the iPad crash and restarts!! Do nothing!

Regards.

Round Visual Effects not working

This is what is received from the output:
Unknown class _TtC10rootlessJB21RoundVisualEffectView in Interface Builder file.

Shared data for installed apps...

All the apps installed to "/var/containers/Bundle/tweaksupport/Applications/" share rootlessJB's Bundle Identifier for their data, so all the installed apps store data in the same place, rootlessJB's Data folder...

Is it expected ?

Safemode respring button doesn't work

This could be related to posixspawn not working either?

B

My phone after jailbreak doesn't wanna connect to iTunes..

Hello, my iPhone doesn't wanna after jailbreak connect to iTunes on my MacBook...
iPhone 6 Plus/12.1.1

Tweak injection causing per-process-limit

With tweak injection ON, several processes(including atwakeup, seputil, trustd, TVRemoteConnectionService) are constantly killed by jetsam reason per-process-limit and ReportCrash is waking up every 10 seconds
This issue makes the battery drain faster

Tried removing all tweaks, installing jetslammed, and uninstall&rejailbreak but the issue still appears once jailbroken with Tweaks option ON
It won't appear after jailbraking with Tweaks option OFF

Console screenshot(filtering with "per-process-limit"): https://imgur.com/UnHRxuM

wifi/data connections

iPhone SE 12.1, after being jb for few hours, wifi/data connections stop working, they show as connected (ie full wifi bars/3g/4g etc) but i get no actual connection, after a reboot & re-jb, all is good, nice jb tho xD

Podcasts app does not open while in Jailbreak mode

The podcast app seems to never open while in jailbreak mode. When launching it, it simply crashes, but sometimes kernel panics (similarly to the Apollo issue).

Keep in mind (however) that I have not been able to duplicate a kernel panic while opening the app, so not sure of what the cause is.

Reddit post (made this issue for visibility): https://reddit.com/r/jailbreak/comments/asbe1d/help_cant_open_podcast_app_with_rootlessjb_32/

Inject failing

I’m trying to use inject so I can run prefs for PencilChargingIndicator but every time I run cd /var/containers/Bundle/tweaksupport/Library/PreferenceBundles/PencilChargingIndicatorPreferences.bundle inject PencilCharginIndicatorPreferences
I get the error Unable to retrieve persisted port. Running RootlessJB 3.2.x from Ignition and have iphone8,4 (SE)

ldid2

I didn't realise that I didn't have ldid2 on my system and patcher didn't report that it was missing. So to save lots of questions, it might be a good idea to either update the readme or have patcher report if ldid2 can't be found.

nano and vim not working

nano fails with Error opening terminal: xterm-256color. I have set export TERMINFO="/var/containers/Bundle/iosbinpack64/usr/share/terminfo/78/xterm-256color but it fails with the same error.

Also, vim works but only in a broken sort of way. Here are the steps to reproduce.

Rosebud:~ root$ echo "alias cd=',,'" > .bashrc
Rosebud:~ root$ echo "alias ll='ls -laghF'" >> .bashrc
Rosebud:~ root$ cat .bashrc
alias ll='ls -laghF'
alias ,,='cd ..'
Rosebud:~ root$ vim .bashrc # hit i for insert mode and hit the arrow buttons

For me, vim enters new lines and inserts C or D and I cannot enter or delete text.

@jakeajames is this an ncurses thing? how have you gotten a functioning text editor?

Rip iPhone

Hi, thanks for this amazing tool but i've a problem...
I'm on iPhone X (A11) - iOS 12.1.1.

i've pressed "uninstall" on rootless.
iTunes doesn't recognise my iPhone
App crashes once opened, no buttons working. i can just move from my springboard and put my phone in standby.

i saw this thing one time, when the /var/ folder get deleted.
Please help

My iPhone seems to be still jailbroken

Keep rebooting

On my iPad 12.9 2nd gen, It keeps rebooting. I have succeeded only twice. Is there any trick to to this?

Cydia Impactor Fix(with ipa)

You will need this ipa and GeoFilza, and iZip,Install the ipa for rootlessJB and Geofilza using Cydia Impactor and download iZip from the AppStore, you will then need to go into GeoFilza and go to /var/containers/bundle/Application/ find rootlessJB, click on it then /rootlessJB.app/ and click on the rootlessJB.zip, press the share button, then press iZip, unzip the files, then go back into GeoFilza, then navigate to /var/mobile/Containers/Data/Application/ then find iZip then go into documents then rootlessJB then rootlessJB.app, press edit, select tars and bins, and copy them, go to /var/containers/bundle/Application/, select rootlessJB, then go into rootlessJB.app and press paste, this will replace the corrupted(I'm assuming) files from Cydia Impactor with the correct not corrupted files, reboot the device, now it should be good to go, I'm not really sure if there is another way to do this...
Payload.ipa.zip

Couldn't figure out how to use the pull request feature, so I just figured I'd put this here...Thanks

need help, TweakInject can't compile

the make.sh file need update

make clean && make && ldid2 -S .theos/obj/debug/TweakInject.dylib && cd .theos/obj/debug/ &&tar -cvf ../../../../../bootstrap/bins/TweakInject.tar ./TweakInject.dylib

here is what i use to compile, after this,jailbreak stuck at [*] Installing app com.jakeashacks.iSuperSU

Random reebot

After successfully jailbroken, my iPhone restarts by itself after some time (5-10min)

Make mDNSResponder care more about /etc/hosts

Is it possible to incorporate this fix into rootlessjb? I installed the LetMeBlock tweak after editing hosts to block ads and did killall mDNSResponder via SSH, but ads are still showing.

Apps don't get reinjected after reboot.

All tweaks in /var/LIB/MobileSubstrate get injected into the trustcache after every jailbreak. But apps installed through the jailbreak aren't automatically injected into the trustcache, making me have to get the UUID of the app, and use ssh to make the app able to work.

Patcher attempts to sign every file in the user folder

The patcher attempts to sign every single file it finds in the user folder, regardless if it is the actual tweak or not. In the process, it spews up a ton of errors (as not everything has a codesign blob).

Steps to reproduce:

1. Get DEB
2. Run the patcher, specify the DEB and let it do the work
3. Choose the signing option and let it do the work.

The signing will take a few minutes depending on what you have in your user folder.
The last to be signed is usually exactly the file you'd want.

The signing does work and the resulting file works with RootlessJB, but all the rest of the files in the user folder are touched.

Dropbear Failing To Launch

Device: iPhone8,1 N71AP
Version: 12.1.2

When running the jailbreak it escapes sandbox, installs the bootstrap, says "binaries already trusted?" and then fails to launch dropbear.

Steps taken to try and fix so far:

I have rebooted, uninstalled in rootlessJB, rebooted again, tried jailbreaking with tweaks on. Fails to launch dropbear. I repeat those steps but with tweaks off and it still fails to launch dropbear.

Compiled from source and sideloaded with Cydia Impactor. Could using Cydia Impactor be the issue?

Failed to start daemons

Gives "Failed to start daemons" while jailbreaking

Possible fix for iPad Pro 10.5" rebooting

So, another user was helping me solve an issue with the exploit with unc0ver and it seems that changing const size_t ool_ports_spray_size = 0.17 * platform.memory_size; to const size_t ool_ports_spray_size = 0.25 * platform.memory_size; in voucher_swap.c solves the problem. I have ran this on my iPhone X and iPad Pro 10.5" and they both work amazingly now! I want to add, I did not figure this out lol, @clarityzzz fixed it :P.

Please take a look at this:
pwn20wndstuff/Undecimus@7293b76

Battery and storage settings pages are not loading

They infinitely load

iphone 6 keeps reeboting after more then 50 tries

i downgrade my iphone 6 from ios 12.3.1 to ios 12.1.1 beta3 i installed the jailbreak app and tap jailbreak but it rebooted and it keeps rebooting after more than 50 tries

rebooting when trying to jailbreak

i have an ipad pro 2nd gen 12.9 inch (its on A10X) running ios 12.1.1 and everytime i try and jailbreak it with filza + am and isupersu checked, it reboots

location service reset, and camera don't work after xpc patch

After jailbreak, my location service are always reset after reboot, same if my phone is jailed.

https://image.noelshack.com/fichiers/2019/08/1/1550493869-unadjustednonraw-thumb-1403.jpg
https://image.noelshack.com/fichiers/2019/08/1/1550493869-unadjustednonraw-thumb-1404.jpg

with the latest version(with dpkg), after xp patch/fix the camera cannot start sometime

Same of issue #29 some apps crash on launch wen my phone is jailbreak (VLC, Aliexpress, Amazon, Paypal..)
Search in Setting doesn't work anymore

On MacOS in Console i have trustd and other error

erreur 13:49:15.593629 +0100 trustd cannot open file at line 42263 of [95fbac39ba]
erreur 13:49:15.593690 +0100 trustd os_unix.c:42263: (2) open(/dev/null-journal) - No such file or directory
erreur 13:49:15.593727 +0100 trustd cannot open file at line 42263 of [95fbac39ba]
erreur 13:49:15.593800 +0100 trustd os_unix.c:42263: (2) open(/dev/null-journal) - No such file or directory
erreur 13:49:15.593914 +0100 trustd cannot open file at line 42263 of [95fbac39ba]
erreur 13:49:15.593966 +0100 trustd os_unix.c:42263: (2) open(/dev/null-journal) - No such file or directory