coolstar / electra

Electra iOS 11.0 - 11.1.2 jailbreak toolkit based on async_awake
GNU General Public License v3.0
656 stars 163 forks source link

app gain root privilege failed #251

Open chanchifan opened 6 years ago

chanchifan commented 6 years ago

Hello, I have some problems about running my app with root privileges. It doesn't work like this,

  1. include that in main.m and build
    
    #define FLAG_PLATFORMIZE (1 << 1)

void platformize_me() { void* handle = dlopen("/usr/lib/libjailbreak.dylib", RTLD_LAZY); if (!handle) return;

// Reset errors
dlerror();
typedef void (*fix_entitle_prt_t)(pid_t pid, uint32_t what);
fix_entitle_prt_t ptr = (fix_entitle_prt_t)dlsym(handle, "jb_oneshot_entitle_now");

const char *dlsym_error = dlerror();
if (dlsym_error) return;

ptr(getpid(), FLAG_PLATFORMIZE);

}

void patch_setuid() { void* handle = dlopen("/usr/lib/libjailbreak.dylib", RTLD_LAZY); if (!handle) return;

// Reset errors
dlerror();
typedef void (*fix_setuid_prt_t)(pid_t pid);
fix_setuid_prt_t ptr = (fix_setuid_prt_t)dlsym(handle, "jb_oneshot_fix_setuid_now");

const char *dlsym_error = dlerror();
if (dlsym_error) return;

ptr(getpid());

}

int main(int argc, char * argv[]) { @autoreleasepool {

    platformize_me();
    patch_setuid();

    if (!(setuid(0) == 0 && setgid(0) == 0)) exit(EXIT_FAILURE);

    return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));
}

}

2. use "ldid -Sent.plist MyApp" to sign the executable. ent.plist like this:
```xml
<dict>
    <key>platform-application</key>
    <true/>
    <key>com.apple.private.skip-library-validation</key>
    <true/>
</dict>
  1. install the app to /Applications on iOS and run chmod 6755 MyApp.

However, when I run the app, it will crash at ptr(getpid(), FLAG_PLATFORMIZE)

coolstar commented 6 years ago

libjailbreak should only be dlopen'd once

chanchifan commented 6 years ago

@coolstar It works by change entitlements like this:

<dict>
    <key>platform-application</key>
    <true/>
    <key>com.apple.private.skip-library-validation</key>
    <true/>
    <key>com.apple.private.security.no-container</key>
    <true/>
</dict>