jjolano / shadow

A jailbreak detection bypass for modern iOS jailbreaks.
https://ios.jjolano.me
BSD 3-Clause "New" or "Revised" License
805 stars 132 forks source link

Some specific app’s barmoji and emojiport won’t work when enable Low-Level File Handles #53

Closed nk950357 closed 1 year ago

nk950357 commented 1 year ago

The app line's barmoji and emojiport won't work after enable the low-level file handler bypass option. imageimage

This is my settings right nowimageimage

jjolano commented 1 year ago

Seems like a tweak compatibility issue. Try enabling Tweak Compatibility (Extra). Which tweaks exactly are used here? And which jailbreak do you have?

nk950357 commented 1 year ago

Seems like a tweak compatibility issue. Try enabling Tweak Compatibility (Extra). Which tweaks exactly are used here? And which jailbreak do you have?

I'm using taurine 1.1.6 right now, iPhone XR 14.3. image I only allow barmoji/emojiport and shadow in libhooker, and also tried the Tweak Compatibility(Extra) but with no luck. Also, I found that when bypass enabled, it will causes some word-typing laggy problem.

jjolano commented 1 year ago

I'll see what I can do. I also use EmojiPort with no issues with same jailbreak and iOS version.

nk950357 commented 1 year ago

Ok, thanks for big help! Actually, only the line app appears this problem, other app with same settings have no issue at all. On Tue, Nov 22, 2022 at 13:08 jjolano @.***> wrote:

I'll see what I can do. I also use EmojiPort with no issues with same jailbreak and iOS version.

— Reply to this email directly, view it on GitHub https://github.com/jjolano/shadow/issues/53#issuecomment-1323077418, or unsubscribe https://github.com/notifications/unsubscribe-auth/AMINBGWW7CSCJGVFMHRVLG3WJRINRANCNFSM6AAAAAASHJVIBA . You are receiving this because you authored the thread.Message ID: @.***>

jjolano commented 1 year ago

So, very odd thing is that I can replicate it with the same tweak configuration. However when I enable "AAAASnowBoardFontsSB" it works properly. When that tweak is disabled it gives me the same result as you've shown. I will still investigate further as it seems like it's related to the tweak compatibility system.

nk950357 commented 1 year ago

plicate it with the same tweak configuration. However when I enable "AAAASnowBoardFontsSB" it works properly. When that tweak is disabled it gives me the same result as you've shown. I will still investigate further as it seems like it's related to the tweak compatibility system.

Unfortunally, I didn't find the "AAAASnowBoardFontsSB" in the libhooker. Does it mean i need to install snowboard first? The way i install the emojiport isnt by snowboard, just with native emojiport with resources.

jjolano commented 1 year ago

plicate it with the same tweak configuration. However when I enable "AAAASnowBoardFontsSB" it works properly. When that tweak is disabled it gives me the same result as you've shown. I will still investigate further as it seems like it's related to the tweak compatibility system.

Unfortunally, I didn't find the "AAAASnowBoardFontsSB" in the libhooker. Does it mean i need to install snowboard first? The way i install the emojiport isnt by snowboard, just with native emojiport with resources.

Yes, I'm using the EmojiFontManager which has an extension within SnowBoard. (Also SnowBoard Font Extension)

nk950357 commented 1 year ago

plicate it with the same tweak configuration. However when I enable "AAAASnowBoardFontsSB" it works properly. When that tweak is disabled it gives me the same result as you've shown. I will still investigate further as it seems like it's related to the tweak compatibility system.

Unfortunally, I didn't find the "AAAASnowBoardFontsSB" in the libhooker. Does it mean i need to install snowboard first? The way i install the emojiport isnt by snowboard, just with native emojiport with resources.

Yes, I'm using the EmojiFontManager which has an extension within SnowBoard.

I'll try snowboard way later. Don't know why native way has this problem.

jjolano commented 1 year ago

I just tried with a debug build of Shadow, and I feel it's just the hook itself which causes the emoji to break for some reason. There are no restrictions being placed on any emoji file. Seems like it's just an unfortunate issue in this case. I would try the SnowBoard way and hopefully that's a good workaround.

nk950357 commented 1 year ago

I just tried with a debug build of Shadow, and I feel it's just the hook itself which causes the emoji to break for some reason. There are no restrictions being placed on any emoji file. Seems like it's just an unfortunate issue in this case. I would try the SnowBoard way and hopefully that's a good workaround.

Sorry for not related question, but may i ask you where did you found the 15.4's emoji works on snowboard? because i can't found the resources of 15.4 emoji for snowboard...

jjolano commented 1 year ago

All from PoomSmartimage

nk950357 commented 1 year ago

All from PoomSmartimage

Can confirm that after installing all of emojiport extension and snowboard, the emoji works in the line app now. Thnaks for your help!

Also, I'm facing some bank apps not work with. I'll make a new issue when I'm free. Thanks for your great work and wonderful help!

nk950357 commented 1 year ago

The newer emojiport doesn't support snowboard then the problem exist right now. Is there any new fix to fix it? Thanks

jjolano commented 1 year ago

I don't seem to have any issues with the SnowBoard method. Which packages do you have specifically?

cc: @PoomSmart

jjolano commented 1 year ago

@nk950357 can you see if the issue occurs with the beta: 3.6.2-3? You will have to turn on the Allow Tweak Resources option.

nk950357 commented 1 year ago

@nk950357 can you see if the issue occurs with the beta: 3.6.2-3? You will have to turn on the Allow Tweak Resources option.

Sorry for late replying. Unfortunately, still not work with latest beta and hookit framework.image

nk950357 commented 1 year ago

I don't seem to have any issues with the SnowBoard method. Which packages do you have specifically?

cc: @PoomSmart

Snowboard method works good, but the latest emojiport drops the support of snowboard.image

jjolano commented 1 year ago

Those instructions seem out of date. Maybe it comes from an old (old old old) version of EmojiPort? Like before EFM even exists or something?

I have the latest packages of everything for EmojiPort and EFM, and all I have to do is enable EFM in SnowBoard for everything to work fine. As far as I am concerned, Shadow is working as intended since the files from EmojiPort can be detected by apps if app developers are evil enough to do so.

To be honest, I'm not really sure how EmojiPort works and why SnowBoard allows it to work properly with Shadow.

Just to summarize how my tweak compatibility system works, Shadow backtraces each hook call to determine whether or not the hooked method was called by a tweak and bypasses any restrictions. Maybe with SnowBoard EFM enabled it causes the new emojis to be loaded via tweak rather than natively through the system?

cc: @PoomSmart

PoomSmart commented 1 year ago

@nk950357 Which apps you are having issues with?

nk950357 commented 1 year ago

Those instructions seem out of date. Maybe it comes from an old (old old old) version of EmojiPort? Like before EFM even exists or something?

I have the latest packages of everything for EmojiPort and EFM, and all I have to do is enable EFM in SnowBoard for everything to work fine. As far as I am concerned, Shadow is working as intended since the files from EmojiPort can be detected by apps if app developers are evil enough to do so.

To be honest, I'm not really sure how EmojiPort works and why SnowBoard allows it to work properly with Shadow.

Just to summarize how my tweak compatibility system works, Shadow backtraces each hook call to determine whether or not the hooked method was called by a tweak and bypasses any restrictions. Maybe with SnowBoard EFM enabled it causes the new emojis to be loaded via tweak rather than natively through the system?

cc: @PoomSmart

I'm pretty sure the instructions I follow isn't old, because two months ago the snowboard way in instructions isn't deprecated.

I updated to the latest version last week and found out that using snowboard causing part of new emoji not work, and found out that the snowboard has been deprecated. By disabling snowboard works well for latest version but causing all emoji gone problem like the OP.

PoomSmart commented 1 year ago

As for Emoji fonts support for SnowBoard, I might instead have a script to convert EFM fonts to be recognizable by SnowBoard somehow.

nk950357 commented 1 year ago

@nk950357 Which apps you are having issues with?

Line. https://apps.apple.com/tw/app/line/id443904275?l=en Not sure if US can download it or not.

nk950357 commented 1 year ago

FYI, I’m using Taurine with iOS 14.3.

On Sun, Jan 29, 2023 at 13:46 Thatchapon Unprasert @.***> wrote:

EmojiFontManager automatically converts existing EFM fonts into SnowBoard-compatible. I'm not sure if this is the case for rootless jailbreaks like XinaA15 though. I didn't test it on that yet.

— Reply to this email directly, view it on GitHub https://github.com/jjolano/shadow/issues/53#issuecomment-1407568642, or unsubscribe https://github.com/notifications/unsubscribe-auth/AMINBGSSN7IBOMGBPBLZPPDWUX72DANCNFSM6AAAAAASHJVIBA . You are receiving this because you were mentioned.Message ID: @.***>

PoomSmart commented 1 year ago

So, just LINE app?

nk950357 commented 1 year ago

So, just LINE app?

Right now I only found line has this problem.

I've tested another app "Line Pay", if I disable snowboard for it will causing emoji not showing but barmoji works, a little bit different situation with the line app.image

FYI, only enabling shadow's "Low-level File Handles" bypass has snowboard problem.

jjolano commented 1 year ago

The relevant code for this particular hook is here: https://github.com/jjolano/shadow/blob/5b2b590375025213da026164f678feabcdbb9f4e/Shadow.dylib/hooks/libc.x#L712-L778

Simple reimplementation of the functions, no different restriction from any other hook.

The isCallerTweak method is what allows tweaks to bypass the restriction, as is the case with SnowBoard + EFM enabled. The strange thing is, even trying by excluding all EmojiPort-related paths (so that isCPathRestricted returns FALSE), it still doesn't work without SnowBoard. But maybe I'm missing something or my hook implementation is wrong.

PoomSmart commented 1 year ago

Unable to reproduce the issue on iPadOS 14.3, Taurine 1.1.6, LINE 13.0.1, Shadow (beta) 3.6.2-3+debug, SnowBoard 1.5.1-Beta1, SnowBoard Fonts Extension 1.0.12-Beta4, EmojiFontManager 1.2.1

nk950357 commented 1 year ago

Unable to reproduce the issue on iPadOS 14.3, Taurine 1.1.6, LINE 13.0.1, Shadow (beta) tweak 3.6.2-3+debug, SnowBoard 1.5.1-Beta1, SnowBoard Fonts Extension 1.0.12-Beta4.

If I use emojiport with snowboard is okay, with EFM only then it won't work.

PoomSmart commented 1 year ago

I see, part of the logs also say:

isPathCompliant: path '/Library/Themes/EmojiFontManager/NotoColorEmoji.font/AppleColorEmoji@2x.ttc' not compliant (key: /Library)
isPathRestricted: restricted: /Library/Themes/EmojiFontManager/NotoColorEmoji.font/AppleColorEmoji@2x.ttc

cc @jjolano

jjolano commented 1 year ago

I see, part of the logs also say:

isPathCompliant: path '/Library/Themes/EmojiFontManager/NotoColorEmoji.font/AppleColorEmoji@2x.ttc' not compliant (key: /Library)
isPathRestricted: restricted: /Library/Themes/EmojiFontManager/NotoColorEmoji.font/AppleColorEmoji@2x.ttc

cc @jjolano

Interesting. What function accesses this file? Seems I may need to try and hook it to apply isCallerTweak. (or I can just take the easy way and exclude /Library/Themes entirely as part of Allow Tweak Resources option)

jjolano commented 1 year ago

I have updated the beta with more adjustments. See if this makes any difference. I will be actively updating it as we go.

PoomSmart commented 1 year ago

Haven't got time to check on your question yet but here's the crash log for latest Shadow beta version.

Suspect: SearchEngineOverrideList folder inside CoreEmoji.framework


Triggered by thread: 0
Thread name: Dispatch queue: com.apple.main-thread
Call stack:
0   CoreFoundation                  0x000000019ab2c3ec 0x19a995000 + 1668076        // CFRelease.cold.1
1   CoreFoundation                  0x000000019a9971b0 0x19a995000 + 8624           // -[__NSDictionaryM enumerateKeysAndObjectsWithOptions:usingBlock:]
2   CoreEmoji                       0x00000001d3b038c8 0x1d3af5000 + 59592          // CEM::SearchEngineResources::createSearchEngineBundleForLocale(__CFLocale const*)
3   CoreEmoji                       0x00000001d3af7978 0x1d3af5000 + 10616          // CEMEMFSearchEngineIsLocaleSupported
4   UIKitCore                       0x000000019d0c13ac 0x19c8a5000 + 8504236        // -[UIKeyboardInputMode supportsEmojiSearch]
nk950357 commented 1 year ago

The previous beta version fails to bypass the line app jb detection with same hook settings but the latest stable version works well. Not sure if some beta update with my request breaks the bypass.

jjolano commented 1 year ago

I think I figured out a good fix for this. Although I'm unsure if it affects detection as the changes are directly on isCallerTweak. See if the latest beta works for both non-SnowBoard and with SnowBoard. This adjustment happens to fix a lot of other tweak-related things aside from emojis.

No longer requires Allow Tweak Resources.

PoomSmart commented 1 year ago

Yep, it's working now.

nk950357 commented 1 year ago

I think I figured out a good fix for this. Although I'm unsure if it affects detection as the changes are directly on isCallerTweak. See if the latest beta works for both non-SnowBoard and with SnowBoard. This adjustment happens to fix a lot of other tweak-related things aside from emojis.

No longer requires Allow Tweak Resources.

Can confirm that doesn't need snowboard now! But same with the 3.6.2 beta4, bypass doesn't work.

jjolano commented 1 year ago

Good to know its working. Are you saying beta 3 works and since beta 4 the bypass is not working?

nk950357 commented 1 year ago

Good to know its working. Are you saying beta 3 works and since beta 4 the bypass is not working?

I haven't tried beta version before, only tried 3.6.2b4 to test the compatibility of line and emojiport. What I can confirm is 3.6.1 works. Now I can't found the 3.6.2b1-b3's download link, could you provide me the deb packages so that I can test them? Thanks.

jjolano commented 1 year ago

Good to know its working. Are you saying beta 3 works and since beta 4 the bypass is not working?

I haven't tried beta version before, only tried 3.6.2b4 to test the compatibility of line and emojiport. What I can confirm is 3.6.1 works. Now I can't found the 3.6.2b1-b3's download link, could you provide me the deb packages so that I can test them? Thanks.

Please try the latest beta. I made another small adjustment. I will also double check some changes from 3.6.1.

Also, is there another app where detection has been affected?

jjolano commented 1 year ago

Since the original issue is resolved, I'll close this. Please create a new issue if there is a regression from 3.6.1.

nk950357 commented 1 year ago

Since the original issue is resolved, I'll close this. Please create a new issue if there is a regression from 3.6.1.

Sorry for the late reply. Only line has the bypass problem in latest beta, b12 still no works. Does it mean i need to create a new issue about this situation right?

jjolano commented 1 year ago

Yes, please create a new issue with a list of options enabled and things you tried.

nk950357 commented 1 year ago

Yes, please create a new issue with a list of options enabled and things you tried.

Sorry for wrong report. Tried enable Enhance Path Processing works now. Thanks!