[Temp workaround found]Clutch does not work on iOS 12 with unc0ver #233
Comments
Temporary workaroundAfter found it's sandbox issue, I messed around with it, and now it correctly dumps app. Therefore, this dump method might not be good for crack ipa generating, but is good enough for reverse engineer researching.
new entitlements <key>platform-application</key>
<true/>
<key>get-task-allow</key>
<true/>
<key>run-unsigned-code</key>
<true/>
<key>com.apple.private.skip-library-validation</key>
<true/>
<key>com.apple.private.security.no-container</key>
<true/>
Still, I think this is a unc0ver issue, not fully patching kernel (Probably won't happen in KPPless) Example shell scriptcd /User/Documents/App-link/App/$id
app=(*.app)
binary=${app%.app}
echo "Resigning [$binary]"
cd "$app"
cp -p "$binary" "${binary}_backup"
## prevent dumping plugins and frameworks
if [[ -e PlugIns ]]; then
hasplugin=1
mv PlugIns PlugIns-
fi
if [[ -e Frameworks ]]; then
hasfmwk=1
mv Frameworks Frameworks-
fi
ent_tmp=$(mktemp)
ldid -e "$binary" >$ent_tmp
plutil -key platform-application -true $ent_tmp >/dev/null
plutil -key get-task-allow -true $ent_tmp >/dev/null
plutil -key run-unsigned-code -true $ent_tmp >/dev/null
plutil -key com.apple.private.skip-library-validation -true $ent_tmp >/dev/null
plutil -key com.apple.private.security.no-container -true $ent_tmp >/dev/null
#cat $ent_tmp
echo "Dumping original to fail"
Clutch-2.0.4-Debug -b $id
ldid -S$ent_tmp "$binary"
echo "Dumping again"
Clutch-2.0.4-Debug -b $id
rm -f $ent_tmp
mv -f "${binary}_backup" "$binary"
if [[ $hasplugin != "" ]]; then
mv PlugIns- PlugIns
fi
if [[ $hasfmwk != "" ]]; then
mv Frameworks- Frameworks
fi
|
esterTion
changed the title
|
我認為自從iOS 11.1 開始已封了Clutch的運作方法, 可能Clutch要重新設計. |
|
@holyswordma 这个是内核限制的问题，本来越狱就是尽可能解除限制 |
Perhaps you should keep a backup of the original entitlement file (app-ent.xml) and re-use the original entitlement file signature dumped binary after spawn and decrypt the binary? |
It's not about entitlements, app group is determined by signing private key, which only developer has. |
Thanks for Notes |
|
@esterTion I tried your workaround very hard and it unfortunately doesn't work. The related error message is still the mach port. I am on iOS 12.1.2 with unc0ver 3.3.8 |
|
Did you dumped the original binary first? Sadly I’ve been in jail for months now, so can’t test anything. |
|
I did. Not sure what went wrong. |
|
You can connect your phone to pc and use |
|
Thanks for your advice. I will give it a try when I have free time. |
|
@jeffli678 console logsSo i'm not sure which part did you do wrong |
|
Ironically, I also tried the latest jailbreak on another phone running 12.4. The jailbreak was successful, but I cannot get Cydia to work, it says no Internet connection. That said, I somehow believe I previously followed your steps closely. I will try again and post logs later. Discloser: I am reletively new to iOS reverse engineering. |
Delete |
|
I spent some time yesterday trying to get Clutch working on a iPhone 7 (iOS 12.4) jailbroken with Chimera and did not succeed. No idea if they are compatible, but I was able to to frida-ios-dump as an alternative. |
|
You can get around some of these app issues with unc0ver or 12.* Clutch use in general. Couple of other devs found some ways with 12.1-12.4 before. Check out https://github.com/Alderon86/hydraDump Can likely be done without as many external requirements, but it worked for me when i was unable to dump anything on 12.* unc0ver stuff |
|
See inside and you will find out it’s exactly my code from here🤔 |
|
Well no s***, they seemed so proud of what they did when they showed me 😂 I'll have to call em out for proper accreditation. |
Previously reported in #228 , opening a new issue for some infos gathered.
Same binary built from a6f6aee, signed using
ldid -Sclutch-ent.xml -K/usr/share/jailbreak/signcert.p12 Clutch-2.0.4-Debugwhich clutch-ent.xml is Clutch.entitlements, and signcert.p12 is from unc0ver [Signing Certificate] package
iOS 9.3.2 iPhone SE (working)
iOS 12.1.2 iPhone 8 (not working)
The problem seems to be at task_for_pid, pwn20wndstuff/Undecimus#728 seems has addressed this issue with swigger/debugserver-ios
Update:
Clearly I didn't thought of reading syslog before, there's this kernel complaint:
I guess it's officially an unc0ver issue now
The text was updated successfully, but these errors were encountered: