Run HelloWorld on Jailbroken iOS 11

iPhone 5s, iOS 11.1

Jailbroken by Electra

How to jailbreak

Cydia Impactor and a new Apple ID required (You can use your own Apple ID at your risk).

If any error occurs on Cydia Impactor, try to login in Xcode and remove useless app/cert.

Trust your developer certificate in iOS Settings => General => Profiles & Device Management => DEVELOPER APP.

Write HelloWorld

helloworld.c

build

sign with jtool

ent.xml

upload and run helloworld

If this binary is not signed with platform-application entitlement, it will get a ‘Killed’ if it’s under /bin/

More

I wrote a cli based memory editor, which requires more than a hello world.

1 entitlements

2 patch_setuid() from coolstar’s example. But I’m using code from electra’s cydia fork, also mentioned after his example.

3 Special thanks to ThisTakenIsUsername.

Run HelloWorld on Jailbroken iOS 11 by @sskaje: https://sskaje.me/2018/03/run-helloworld-on-jailbroken-ios-11/

Free iOS Developer Signing Certificate

1 You need Cydia Impactor

2 You need an Apple ID

3 Do something in Impactor to get a certificate, only valid in 7 days.

4 No way to renew, but revoke and generate new one.

After those above, find cert:

To sign

Free iOS Developer Signing Certificate by @sskaje: https://sskaje.me/2017/08/free-ios-developer-signing-certificate/

ARM __moddi3

When I was debugging an app on iPhone 4 (armv7), I found a function call:

Since ARM does not have Division/Modulo operators, compilers use other ways making your code work on devices like iPhone.

I followed the __moddi3 on iPhone 4, the moddi3() is provided by llvm’s compiler-rt (lib/builtins/moddi3.c).

Parameters a and b are 64-bit long and returned value is also 64-bit.

But in ARMv7, registers are 32-bit long. I’m trying to find out which registers are used.

I wrote a simple C file and compile to armv7 and x86_64

Compile to x86_64

Disassembe x86_64

x86_64 uses idivq, in this program:

Compile to armv7

Disassemble armv7

In armv7:

If both dividend and divisor are less than 0x100000000.

$r2 may be negative, like 0xfffffff3. ($r3 == 0).

means $r0 – $r2 == divisor

If signed integer $r2 is smaller than 0x80000000,
((long long) $r1 << 32 | $r0) - ((long long ) $r3 << 32 | $r2) == divisor.

ARM __moddi3 by @sskaje: https://sskaje.me/2016/01/arm-__moddi3/

Incoming search terms:

error: failed to launch process debugserver: Security

I jailbroken my iPhone 4s with iOS 8.2 and tried to ran debugserver, then I met this error:

Google doesn’t help.

Just because, the App I’m trying to crack is an In-House app, not from AppStore, I have to ran it after installation and choose to trust the developer.

error: failed to launch process debugserver: Security by @sskaje: https://sskaje.me/2016/01/failed-launch-process-debugserver-security/