PongoOS icon indicating copy to clipboard operation
PongoOS copied to clipboard
verified publisher icon checkra1n

kpf: Add patch to disable Protobox on iOS 16+

Open opa334 opened this issue 1 year ago • 4 comments

This patch disables Protobox, which was introduced in iOS 16 and adds syscall masks (whitelists) to certain system daemons. It also includes a mechanism that makes certain processes crash on sandbox violations, amongst other things.

This PR disables Protobox globally, which fixes several issues with dylib injection and Frida in these processes.

The patchfinding metric is verified working on 16.0 - 17.4b1.

opa334 avatar Feb 15 '24 15:02 opa334

~~This patch appears to be broken on bridgeOS kernels.~~ bridgeOS probably doesn't have protobox

asdfugil avatar Feb 15 '24 23:02 asdfugil

Just check if there is a string with "Protobox" in it in the sandbox kext, if there is not, then it indeed does not have Protobox.

opa334 avatar Feb 16 '24 13:02 opa334

Protobox string exists since bridgeOS 8. The patch still fails on those kernels though.

asdfugil avatar Feb 16 '24 13:02 asdfugil

hm idk then, maybe the string exists but the feature is still unused.

opa334 avatar Feb 16 '24 14:02 opa334