Undecimus: cynject (and thus cycript) is broken on iOS 12

[jakeajames]

Describe the bug
cynject crashes target process

**To Reproduce

1. cynject pid dylib

Device (please complete the following information):

• iOS Version: 12.1.1
• iOS Device: iPad Air 2
• unc0ver Version: all of them

Place an "x" between the brackets if true:

• [x] this is a bug others will be able to reproduce
• [x] this issue is present with all tweaks uninstalled(except for default packages) or disabled
• [x] this issue is present after a rootfs restore
• [x] this issue is present on the latest version of unc0ver

Logs
From cycript:

[2892] DarwinInjector.cpp[246]: _krncall(mach_vm_read_overwrite) =4

Crash log:

Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Subtype: KERN_INVALID_ADDRESS at 0x00000000000000a6

[Cryptiiiic]

206 (Repurposed issue because people were commenting.)

[scugn1zz0]

This guy here on reddit claims that he is being able to run cycript on ios12. Do you think he is legit?
@Cryptiiiic @jakeajames

https://www.reddit.com/r/jailbreakdevelopers/comments/b1r5kq/question_is_cycript_coming_to_ios_12_unc0ver_jb/eiubv4t/?utm_source=share&utm_medium=ios_app

[jakeajames]

@scugn1zz0 he's using tweak mode, not runtime injection

[liuxuan30]

Hi there,

I used to install cycript deb on iOS11 with unc0ver before 3.0, at that time, I have to resign cycript binary to add platform-application, and it works well.

However, on iOS12 and unc0ver 3.0.1, I found that my resigned cycript always get Killed -9, but the cycript in the deb can be directly running, however, if tries to hook Springboard, it will hang, and if you terminate the hang and rerun, cycript will crash:

iOS12:~ root# cycript -p 308  // hangs
^C
iOS12:~ root# cycript -p 308
[735] DarwinInjector.cpp[246]: _krncall(mach_vm_read_overwrite) =4
*** _assert(status == 0):../Inject.cpp(143):InjectLibrary

Is any recent changes lead to this symptom? @pwn20wndstuff

[krisanovdev]

@pwn20wndstuff Any update?

[aarivex]

Hopefully this gets worked on now.

[jakeajames]

The substitute version of unc0ver will have a fix

Il giorno venerdì 13 settembre 2019, aarivex [e-mail] ha
scritto:

Hopefully this gets worked on now.

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/pwn20wndstuff/Undecimus/issues/685?email_source=notifications&email_token=AE5VP6OXIZEAZ2LOPAXQTS3QJPM6JA5CNFSM4G3UIVWKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD6V3NDI#issuecomment-531347085,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AE5VP6JRBCBDEFEMQYX6GWTQJPM6JANCNFSM4G3UIVWA
.

[cakarlen]

Is this fixed with 3.7.0~b1?

[jakeajames]

I don't think there is cynject, but there is a dylib injector, I'll see if
I can make a dummy cynject on top on this

Il giorno domenica 22 settembre 2019, cakarlen [e-mail]
ha scritto:

Is this fixed with 3.7.0~b1?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/pwn20wndstuff/Undecimus/issues/685?email_source=notifications&email_token=AE5VP6MYP5OY7LQCBDOYO4TQK7I5RA5CNFSM4G3UIVWKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD7JOTTQ#issuecomment-533916110,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AE5VP6IECGZIUMZRG4YPACTQK7I5RANCNFSM4G3UIVWA
.

[aarivex]

Thanks! Would be amazing.

[liuxuan30]

any good news now?

[liuxuan30]

Hi there, I notce today Substrate has an update 0.9.7100-b6, which saying fixes cynject on iOS12/13.

I tried cycript on iOS 12.0.1 today, still,

iOS:~ root# ps -ax|grep AppStore
  666 ??         0:00.95 /System/Library/PrivateFrameworks/AppStoreDaemon.framework/Support/appstored
 1303 ??         0:00.84 /Applications/AppStore.app/AppStore
 1305 ttys000    0:00.01 grep AppS

iOS:~ root# cycript -p 1303
[1311] _krncall(task_for_pid) =5
[1311] MachObject.cpp[108]: _krncall(task_info) =10000003
[1311] DarwinInjector.cpp[73]: _assert(MSGetTaskInfo(info, task))[DarwinInjector.cpp:73]
*** _assert(status == 0):../Inject.cpp(143):InjectLibrary

What extra work is needed for cycript to work?

[jakeajames]

Cycript works fine after the latest update for me. Make sure to install cycript from Elecubratus.

[liuxuan30]

@jakeajames thanks! will do. BTW, what's the difference for Elecubratus and saurik?

[jakeajames]

Did you update substrate

Il giorno mercoledì 12 febbraio 2020, Xuan [e-mail] ha
scritto:

@jakeajames https://github.com/jakeajames I found that installing
cycript from https://apt.bingner.com/ on unc0ver still don't work.
However, cycript works on checkra1n...

Do you know what's wrong?

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
https://github.com/pwn20wndstuff/Undecimus/issues/685?email_source=notifications&email_token=AE5VP6KXFEK7TVMWNSBQUC3RCNUPNA5CNFSM4G3UIVWKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELPITQA#issuecomment-585009600,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/AE5VP6LICRVEXSSQGZNYWCDRCNUPNANCNFSM4G3UIVWA
.

[liuxuan30]

@jakeajames I manually download the cycript deb from Elecubratus and install, it works on unc0ver then. I wonder why installing from Elecubratus via Cydia couldn't work.