Patch stuff

Author: khanhduytran0

Makefile

@@ -6,24 +6,19 @@ include $(THEOS)/makefiles/common.mk
 ADDITIONAL_LDFLAGS = -rpath @loader_path/Frameworks
 THEOS_PACKAGE_SCHEME = rootless
 
-LIBRARY_NAME = SelfJIT
-SelfJIT_FILES = SelfJIT.c
-SelfJIT_INSTALL_PATH = /Applications/SpringBoardTS.app
-include $(THEOS_MAKE_PATH)/library.mk
-
 TWEAK_NAME = SpringBoardTweak
 SpringBoardTweak_FILES = Tweak.x
 SpringBoardTweak_CFLAGS = -fobjc-arc
 SpringBoardTweak_INSTALL_PATH = /Applications/SpringBoardTS.app
 SpringBoardTweak_FRAMEWORKS = UIKit
 SpringBoardTweak_PRIVATE_FRAMEWORKS = CommonUtilities UIKitServices WatchdogClient FrontBoard
-# CommonUtilities UIKitServices SpringBoard ToneLibrary WatchdogClient
 include $(THEOS_MAKE_PATH)/tweak.mk
 
 APPLICATION_NAME = SpringBoardTS
-$(APPLICATION_NAME)_FRAMEWORKS = CydiaSubstrate
+# $(APPLICATION_NAME)_FRAMEWORKS = CydiaSubstrate
 # $(APPLICATION_NAME)_PRIVATE_FRAMEWORKS = ChronoServices FrontBoard
-$(APPLICATION_NAME)_FILES = main.m
+$(APPLICATION_NAME)_BUNDLE_NAME = SpringBoardTS
+$(APPLICATION_NAME)_FILES = hook.c main.m
 $(APPLICATION_NAME)_CFLAGS = -fcommon -fobjc-arc -Wno-error
 $(APPLICATION_NAME)_CODESIGN_FLAGS = -Sentitlements.plist -Icom.apple.springboardts
 

SelfJIT.c

@@ -3,7 +3,7 @@
 <plist version="1.0">
 <dict>
 	<key>application-identifier</key>
-	<string>com.apple.springboard</string>
+	<string>com.apple.springboardts</string>
 	<key>aps-connection-initiate</key>
 	<true/>
 	<key>backupd-connection-initiate</key>
@@ -91,10 +91,10 @@
 			<dict/>
 		</dict>
 	</dict>
-<!--
+
 	<key>com.apple.assertiond.system-shell</key>
 	<true/>
--->
+
 	<key>com.apple.assistant.announcement_state</key>
 	<true/>
 	<key>com.apple.assistant.client</key>
@@ -198,7 +198,7 @@
 	<key>com.apple.developer.homekit</key>
 	<true/>
 	<key>com.apple.developer.ubiquity-kvstore-identifier</key>
-	<string>com.apple.springboard</string>
+	<string>com.apple.springboardts</string>
 	<key>com.apple.duet.activityscheduler.allow</key>
 	<true/>
 	<key>com.apple.duet.expertcenter.consumer</key>
@@ -810,10 +810,8 @@
 	<true/>
 	<key>com.apple.private.wallpaperkit.service.migration</key>
 	<true/>
-<!--
 	<key>com.apple.private.xpc.launchd.app-server</key>
 	<true/>
--->
 	<key>com.apple.proactive.ActionPrediction.predictions</key>
 	<true/>
 	<key>com.apple.proactive.AppPrediction.predictions</key>
@@ -850,6 +848,8 @@
 	<true/>
 	<key>com.apple.runningboard.assertions.frontboard</key>
 	<true/>
+	<key>com.apple.runningboard.assertions.frontboardts</key>
+	<true/>
 	<key>com.apple.runningboard.hereditarygrantoriginator</key>
 	<true/>
 	<key>com.apple.runningboard.posterkit.host</key>

entitlements.plist

@@ -0,0 +1,42 @@
+#include <assert.h>
+#include <dlfcn.h>
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <sys/mman.h>
+#include <mach-o/loader.h>
+#include <mach-o/nlist.h>
+#include <mach-o/dyld.h>
+#include <mach-o/dyld_images.h>
+#include <sys/syscall.h>
+
+#define ASM(...) __asm__(#__VA_ARGS__)
+// ldr x8, value; br x8; value: .ascii "\x41\x42\x43\x44\x45\x46\x47\x48"
+static char patch[] = {0x88,0x00,0x00,0x58,0x00,0x01,0x1f,0xd6,0x1f,0x20,0x03,0xd5,0x1f,0x20,0x03,0xd5,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41};
+
+// Since we're patching libsystem_kernel, we must avoid calling to its functions
+static void builtin_memcpy(char *target, char *source, size_t size) {
+    for (int i = 0; i < size; i++) {
+        target[i] = source[i];
+    }
+}
+
+// Originated from _kernelrpc_mach_vm_protect_trap
+kern_return_t builtin_vm_protect(mach_port_name_t task, mach_vm_address_t address, mach_vm_size_t size, boolean_t set_max, vm_prot_t new_prot);
+ASM(
+.global _builtin_vm_protect \n
+_builtin_vm_protect:     \n
+    mov x16, #-0xe       \n
+    svc #0x80            \n
+    ret
+);
+
+void redirectFunction(void *patchAddr, void *target) {
+    kern_return_t kret = builtin_vm_protect(mach_task_self(), (vm_address_t)patchAddr, sizeof(patch), false, PROT_READ | PROT_WRITE | VM_PROT_COPY);
+    assert(kret == KERN_SUCCESS);
+    
+    builtin_memcpy((char *)patchAddr, patch, sizeof(patch));
+    *(void **)((char*)patchAddr + 16) = target;
+    
+    kret = builtin_vm_protect(mach_task_self(), (vm_address_t)patchAddr, sizeof(patch), false, PROT_READ | PROT_EXEC);
+    assert(kret == KERN_SUCCESS);
+}

hook.c

@@ -6,13 +6,10 @@
 #include <spawn.h>
 
 int csops(pid_t pid, unsigned int ops, void *useraddr, size_t usersize);
-int csops_audittoken(pid_t pid, unsigned int ops, void * useraddr, size_t usersize, audit_token_t * token);
-bool os_variant_has_internal_content(const char* subsystem);
 int ptrace(int, int, int, int);
 uint32_t SecTaskGetCodeSignStatus();
 
-int (*orig_csops)(pid_t pid, unsigned int  ops, void * useraddr, size_t usersize);
-int (*orig_csops_audittoken)(pid_t pid, unsigned int  ops, void * useraddr, size_t usersize, audit_token_t * token);
+void redirectFunction(void *patchAddr, void *target);
 
 // JIT
 #define CS_DEBUGGED 0x10000000
@@ -29,10 +26,6 @@ uint32_t hooked_SecTaskGetCodeSignStatus() {
     return 0x36803809; // CS_PLATFORM_BINARY
 }
 
-bool hooked_os_variant_has_internal_content(const char* subsystem) {
-	 return true;
-}
-
 int (*SBSystemAppMain)(int argc, char *argv[], char *envp[]);
 
 int main(int argc, char *argv[], char *envp[]) {
@@ -51,16 +44,15 @@ int main(int argc, char *argv[], char *envp[]) {
         }
     }
 
-    assert(isJITEnabled());
-    MSHookFunction(&SecTaskGetCodeSignStatus, &hooked_SecTaskGetCodeSignStatus, NULL);
-    MSHookFunction(&os_variant_has_internal_content, &hooked_os_variant_has_internal_content, NULL);
+    //assert(isJITEnabled());
+    redirectFunction((void *)SecTaskGetCodeSignStatus, (void *)hooked_SecTaskGetCodeSignStatus);
 
-    [NSUserDefaults.standardUserDefaults setBool:YES forKey:@"SBDontLockAfterCrash"];
+    //[NSUserDefaults.standardUserDefaults setBool:YES forKey:@"SBDontLockAfterCrash"];
     void *handle = dlopen("/System/Library/PrivateFrameworks/SpringBoard.framework/SpringBoard", RTLD_GLOBAL);
 
     void *tweakHandle = dlopen("@executable_path/SpringBoardTweak.dylib", RTLD_GLOBAL|RTLD_NOW);
     if (!tweakHandle) {
-        //[@(dlerror()) writeToFile:@"/tmp/AAAAA.txt" atomically:YES];
+        [@(dlerror()) writeToFile:@"/tmp/AAAAA.txt" atomically:YES];
         abort();
     }