electra icon indicating copy to clipboard operation
electra copied to clipboard

app gain root privilege failed

Open chanchifan opened this issue 6 years ago • 2 comments

  • iOS version:11.2.2
  • iDevice model:iPhone 7
  • electra version:1.0.2

Hello, I have some problems about running my app with root privileges. It doesn't work like this,

  1. include that in main.m and build
#define FLAG_PLATFORMIZE (1 << 1)

void platformize_me() {
    void* handle = dlopen("/usr/lib/libjailbreak.dylib", RTLD_LAZY);
    if (!handle) return;
    
    // Reset errors
    dlerror();
    typedef void (*fix_entitle_prt_t)(pid_t pid, uint32_t what);
    fix_entitle_prt_t ptr = (fix_entitle_prt_t)dlsym(handle, "jb_oneshot_entitle_now");
    
    const char *dlsym_error = dlerror();
    if (dlsym_error) return;
    
    ptr(getpid(), FLAG_PLATFORMIZE);
}

void patch_setuid() {
    void* handle = dlopen("/usr/lib/libjailbreak.dylib", RTLD_LAZY);
    if (!handle)
        return;
    
    // Reset errors
    dlerror();
    typedef void (*fix_setuid_prt_t)(pid_t pid);
    fix_setuid_prt_t ptr = (fix_setuid_prt_t)dlsym(handle, "jb_oneshot_fix_setuid_now");
    
    const char *dlsym_error = dlerror();
    if (dlsym_error) return;
    
    ptr(getpid());
}

int main(int argc, char * argv[]) {
    @autoreleasepool {
        
        platformize_me();
        patch_setuid();
        
        if (!(setuid(0) == 0 && setgid(0) == 0)) exit(EXIT_FAILURE);
        
        return UIApplicationMain(argc, argv, nil, NSStringFromClass([AppDelegate class]));
    }
}
  1. use "ldid -Sent.plist MyApp" to sign the executable. ent.plist like this:
<dict>
	<key>platform-application</key>
	<true/>
	<key>com.apple.private.skip-library-validation</key>
	<true/>
</dict>
  1. install the app to /Applications on iOS and run chmod 6755 MyApp.

However, when I run the app, it will crash at ptr(getpid(), FLAG_PLATFORMIZE)

chanchifan avatar Jul 11 '18 13:07 chanchifan

libjailbreak should only be dlopen'd once

coolstar avatar Jul 11 '18 15:07 coolstar

@coolstar It works by change entitlements like this:

<dict>
	<key>platform-application</key>
	<true/>
	<key>com.apple.private.skip-library-validation</key>
	<true/>
	<key>com.apple.private.security.no-container</key>
	<true/>
</dict>

chanchifan avatar Jul 12 '18 03:07 chanchifan