| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
camera: discover AVCapturePhoto + resolvedSettings selectors at runtime Replace the two giant hardcoded selectors (the 27-arg AVCapturePhoto init and the 32-arg +resolvedSettingsWithUniqueID:… factory) with a prefix-lookup + label-driven NSInvocation builder. This survives Apple adding or removing args between iOS releases without code changes: the discovered selector decides arg count and order, the resolver block fills the args we care about by label ("timestamp", "photoSurface", "uniqueID", "photoDimensions", etc.), and unknown labels get nil/zero from the runtime type encoding. cfx_find_selector_by_prefix(cls, prefix, classMethod) Walks class_copyMethodList on cls (or its metaclass for class methods), returns the matching selector with the most colons. Highest-arg-count match wins so a future Apple revision that adds a new arg in the middle is still found. cfx_normalize_first_label(NSString *) Strips "initWith" / "resolvedSettingsWith" and lowercases the first char of the remainder so the leading component matches the same label convention as the rest of the selector. cfx_invoke_with_labeled_args(target, selector, resolver) Builds the NSInvocation, iterates selector components, calls the resolver block once per arg with (label, typeEnc, outBuf). Block writes the value via the appropriate cast (CMTime, IOSurfaceRef, __unsafe_unretained id, NSInteger, etc.) or leaves outBuf zeroed. Builders refactored: - cfx_build_resolved_settings now fills only uniqueID + photoDimensions + previewDimensions; everything else stays zero/nil (Apple's impl tolerates that on builds where the factory itself works at all). - cfx_build_avcapturephoto_with_request fills timestamp, photoSurface, photoSurfaceSize, processedFileType, metadata, captureRequest, sequenceCount, photoCount, sourceDeviceType. Every other surface/dictionary arg defaults to nil. End state: net +169/-96 lines, zero hardcoded full selectors, photo synthesis remains functionally identical on 26.5 and is prepared for arg-list drift on future iOS revisions. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> | 2 个月前 | |
fix: treat LSD embedded-reg gate as idempotent when already NOP'd | 27 天前 | |
pymobiledevice3: Replace most external tools with pymobiledevice3 | 5 个月前 | |
camera: load libcamfix into every AVFoundation client via TweakLoader Filter.Frameworks Universal injection mechanism: any process where AVFoundation is loaded (Camera.app, continuitycaptured, third-party apps, system daemons — anything dyld pulls AVF into) automatically gets libcamfix via TweakLoader. No per-bundle plist filter, no allowlist entries. scripts/tweakloader/TweakLoader.m New Filter.Frameworks key. A tweak's plist may list framework names; TweakLoader matches the path containing "/<name>.framework/". Already-loaded frameworks trigger an immediate dlopen; not-yet-loaded frameworks register a _dyld_register_func_for_add_image callback that fires when the named framework appears. Two-tier engagement: - Framework-filtered tweaks scan + schedule in EVERY process, self-limiting at runtime. Cost in non-AVF processes is one dir scan + a few plist parses + one callback registration. - Non-framework tweaks (Bundles/Executables or no filter) keep the existing .app/+kVPhoneAllowedDaemonPaths gate so we don't drop arbitrary tweaks into launch-critical daemons. CRITICAL safety: dyld invokes add-image callbacks SYNCHRONOUSLY inside its loader lock. dlopen from within that callback recurses and can deadlock or crash early daemons. The actual dlopen is handed off to a background queue (dispatch_async) so it runs after dyld is idle. Defensive: each per-tweak block is @try/@catch wrapped so a malformed plist or Foundation quirk in an early-boot daemon can't crash the process and trigger a launchd respawn loop. scripts/camfix/libcamfix.m Constructor no longer eagerly installs hooks. Instead registers a _dyld_register_func_for_add_image callback and installs hooks the first time AVFCapture's mach header is observed (idempotent via dispatch_once). Whether libcamfix loads before or after AVFCapture, hooks land exactly once. cfx_capturePhoto_hook now drives the MODERN -[<AVCapturePhotoCaptureDelegate> captureOutput: didFinishProcessingPhoto:error:] path in addition to the deprecated CMSampleBuffer one. The synthesized AVCapturePhoto uses nil captureRequest (there's no CAMCaptureEngine outside Camera.app — msgSend to nil during init returns 0 safely). Photos tagged with associated JPEG/CGImage so fileDataRepresentation / CGImageRepresentation return our bytes regardless of which delegate protocol the client implements. scripts/camfix/libcamfix.plist Filter.Frameworks = ["AVFoundation"]. Replaces the previous Bundles=["com.apple.camera"] filter. scripts/cfw_install_exp.sh build_libcamfix install_name reverted to /var/jb/Library/ MobileSubstrate/DynamicLibraries/libcamfix.dylib (TweakLoader location). [JB-4.2] deploys dylib + plist together. Verified on fresh `make setup_machine` install of 26.5: - 373+ distinct AVF-using processes auto-load libcamfix at boot, including watchdogd / amfid / backboardd / SpringBoard / cameracaptured / continuitycaptured. - Camera.app: preview live, photos save, shutter works past many consecutive captures. - continuitycaptured: a vanilla AVCapturePhotoCaptureDelegate using the documented capturePhotoWithSettings:delegate: API gets a real 1280x720 JFIF JPEG via the modern delegate path. - Full reboot cycle stable. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> | 2 个月前 | |
camera: libvcamcaptured 26.x version-agnostic patches The 26.5 implementation embedded multiple build-specific values: - a hardcoded byte offset 1056 to find `_sSourceList` - a hardcoded stack-frame offset (#576) in the per-source filter scan - hardcoded ivar offsets 0x08/0x18/0x10/0x18/0x48 on BWFigCaptureDevice / BWFigCaptureStream - hardcoded image VMAs 0x1ae6ff05c, 0x1ae2bd414, 0x1ae2c353c for three error-suppression byte-patches - two `#if 0` blocks pinning more 0x1ae* VMAs Refactor every site to a runtime-resolved equivalent. 1. _sSourceList: structural ARM64 anchor chain rooted at the exported FigCaptureSourceServerStart symbol — every link is a stable pattern that survives DSC byte-offset shifts, stub-call layout changes, and LC_SYMTAB local-symbol stripping: FigCaptureSourceServerStart (exported, retained on every build) walk for `cmn x?, #0x1 ; b.ne <wrapper>` (onceToken check) wrapper (single-insn `bl <cold.1>` site) cold.1 (static helper; 5-6 instructions) `adrp x1, ... ; add x1, x1, #imm` (block-constant addr) block constant (struct __Block_literal in __DATA_CONST) +0x10 = invoke pointer (PAC-stripped) = dispatch_once body init block-invoke walk for `bl <X> ; adrp + str x0, [Xn, #imm]` pairs (each "store fn result into a static global") pick the first slot whose stored value is a heap CFArray (filters the lock-store at #0 — that's a void* mutex handle, not an array) LC_SYMTAB is still consulted first as a fast deterministic path for builds that happen to retain `_sSourceList` as a regular nlist entry; the structural chain is what actually fires on stock 26.1/26.3.1/26.5 DSCs (which strip static data symbols). 2. Per-source filter LDR x2 anchor: mask the imm12, accepting any sp-relative 64-bit load into x2 regardless of the compiler-chosen stack-frame slot. 3. BWFigCaptureDevice / BWFigCaptureStream ivar offsets: resolved at synth-class init via class_getInstanceVariable + ivar_getOffset on the parent class. Required ivars (deviceID, portType, uniqueID) abort class registration on miss; the streaming BOOL is optional (skip the YES poke instead of aborting). New vcc_resolve_ivar helper walks a NULL-terminated candidate-name list to tolerate underscore-prefix convention differences. 4. -[FigCaptureCameraSourcePipeline requiresMasterClock] prologue: resolved via LC_SYMTAB by name (two underscore-prefix variants), PAC-stripped, gated on a `pacibsp` insn1 sanity anchor before rewriting to `mov w0, #0 ; ret`. The function isn't in the ObjC method table on observed builds (so class_replaceMethod won't intercept) — the byte-patch is the only working path. 5. _cs_addObjectToStreamsAttributes and -[BWFigVideoCaptureStream initWithCaptureStream:…] -12783 bail sites: both prepare the OSStatus via MOVN encodings (0x12863dd4 for w20, 0x12863dc8 for w8). The new vcc_scan_and_patch helper finds every occurrence of each encoding in __text and rewrites it to MOVZ #0. -12783 is a capture-specific OSStatus and the daemon's only consumer in the VM is the synth source, so over-application is benign. Validator fixes (kept from the original 26.1/26.5 work): - arm64e ISA class-pointer mask: 0x00007FFFFFFFFFF8 (44-bit class field, bits 3-46) per libobjc's ISA_MASK. The previous mask captured bit 47 (magic-signature region), so two pointers to the same class produced different masked values when bit 47 differed. - Pointer dereferences during slot validation gated by `malloc_zone_from_ptr` so a stale/bogus heap pointer in a candidate slot can't trap the daemon during init. (vm_read / vm_read_overwrite were considered but cameracaptured's sandbox returns KERN_DENIED on intra-task vm_read on iOS 26.x.) Helpers in scripts/vcamcaptured/libvcamcaptured.m: vcc_safe_read_ptr pointer-read wrapper vcc_slot_value_is_cfarray malloc_zone + ISA-class check vcc_collect_call_then_store_globals walk a function body for "BL <X>; adrp + str x0, [Xn, #imm]" pairs vcc_resolve_ivar class_getInstanceVariable wrapper with candidate-name list vcc_scan_and_patch __text scan + per-occurrence vcc_patch_word wrapper VCC_ISA_CLASS_MASK arm64e 44-bit class-pointer mask The two dead `#if 0` byte-patch blocks (referencing 0x1ae2b5284 and 0x1ae2b4c90, with the captureSession_buildGraphWithConfiguration thumbnail / preview-sink bail-bypass commentary) are removed along with their explanatory comments. scripts/cfw_install_exp.sh's comment that mistakenly described a non-existent "Patch #6" inside _captureSourceServer_handleCopySourcesMessage is rewritten to describe the actual DSC patches (NU short-circuit + AVF authorization, both already version-agnostic via `ipsw dyld symaddr`). Validated end-to-end on: iOS 26.1 build 23B85 iOS 26.3.1 iOS 26.5 build 23F77 All three return the same `vphone:vcam:0` synthetic camera as the default video device and deliver real JPEG frames through the modern AVCapturePhoto delegate path in continuitycaptured / Camera.app. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> | 2 个月前 | |
fix: re-encode signcert.p12 as modern PKCS12 | 27 天前 | |
cfw: Fix iOS 27 Sileo-at-setup — register JB apps via containerized LS API (vpregister) On iOS 27, -[LSApplicationWorkspace registerApplicationDictionary:] (what the first-boot `uicache -a` uses) is a deprecated no-op stub — lsd logs "You cannot use -[LSApplicationWorkspace registerApplicationDictionary:] to register applications anymore. These interfaces have been deprecated for years." and it returns NO. So vphone_jb_setup.sh installs Sileo's .deb but never registers it: the files land in /var/jb/Applications but Sileo never appears on the home screen. There is no gate to patch here — Apple removed the implementation. Fix: register JB apps via the modern containerized API instead. - scripts/vpregister/vpregister.m: standalone helper that registers /var/jb/Applications/*.app (or given paths) via registerContainerizedApplicationWithInfoDictionaries:...:registrationError:, treating a nil error as success (it returns NO even when it registers). Works once lsd's embedded-reg gate is patched (cfw_patch_lsd_embedded_reg, applied by cfw_install.sh, which cfw_install_jb.sh and cfw_install_exp.sh both chain). It lives in its OWN dir (scripts/vpregister/), NOT scripts/vphoned/, so it is not swept up by the `scripts/vphoned/*.m` globs that build vphoned (cfw_install.sh, cfw_install_dev.sh, and the vphoned Makefile all glob that dir) — otherwise its main() collides with vphoned's ("duplicate symbol '_main'"). Built separately by the JB/EXP installers. - cfw_install_jb.sh / cfw_install_exp.sh: build + sign (vphoned entitlements + CFW signcert) + deploy vpregister to /cores. - vphone_jb_setup.sh: after dpkg + uicache -a, invoke /cores/vpregister to register JB apps via the containerized path. Guarded by [ -x ]. vpregister verified on 17,3_27.0_24A5380h + cloudOS 26.4 (JB): registers Sileo via the containerized API (uicache -l 0->1) on the gate-patched VM. The exact cfw_install.sh vphoned build (VPHONED_SRCS glob + clang) now links cleanly with vpregister.m relocated. Doc: item 12 in research/0_binary_patch_comparison.md. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013pk5tsoBeuu3jhkmnRFtic | 1 个月前 | |
Update resources | 5 个月前 | |
fix: preflight checks the running binary, not a dev .build path boot_host_preflight.sh hardcoded RELEASE_BIN=$PROJECT_ROOT/.build/release/ vphone-cli. Inside the bundled .app, PROJECT_ROOT resolves to Contents/ Resources, so it looked for Contents/Resources/.build/release/vphone-cli — which doesn't exist (the binary is at Contents/MacOS/vphone-cli). Under --assert-bootable that made the preflight fail with "missing release binary", blocking `vm launch` from a brew-installed or copied .app. `vm launch` now passes the running executable (CommandLine.arguments[0]) to the preflight via VPHONE_CLI_BIN and the script checks that binary; it still falls back to the dev .build/release path for standalone/`make` invocation. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> | 1 个月前 | |
fix: bundle vphone-amfidont in Resources, not MacOS (unbreaks .app signing) The v1.0.2 release build failed at the bundle codesign step: .build/vphone-cli.app/Contents/MacOS/vphone-cli: code object is not signed at all In subcomponent: .../Contents/MacOS/vphone-amfidont Contents/MacOS is the bundle's nested-code directory, so signing the main executable seals everything there and rejected the vphone-amfidont shell script as unsigned nested code. (A script only gets a "generic" xattr signature that wouldn't survive the release zip anyway.) Move the bundled helper to Contents/Resources/vphone-amfidont, where it is sealed as an ordinary resource (hashed, survives zip). Resources sits at the same depth under Contents as MacOS, so the script's `${0:A:h:h:h}` .app resolution is unchanged. The Homebrew `binary` stanza should point at Contents/Resources/vphone-amfidont. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y4VDqWf5pVakcFLqB23CKe | 1 个月前 | |
cfw: Patch os_lockdown_mode_enabled to not crash on iOS 27b5 iOS 27's os_lockdown_mode_enabled() resolves Lockdown Mode via sysctlbyname("security.mac.lockdown_mode_state_public", ...) and os_crashes on a -1 return. The vphone base kernel (cloudOS 26.x) does not implement that MAC sysctl, so the call returns -1/ENOENT and the first daemon to query Lockdown Mode after "Continuing system boot" -- launchd (pid 1) -- aborts, panicking the system (initproc exited, namespace 2 subcode 6). Add cfw_patch_lockdown_mode.py: NOP the `cmn w0,#1; b.eq <os_crash>` gate so the pre-zeroed output buffer path is taken (Lockdown Mode = disabled); behavior-neutral on a kernel that implements the sysctl. Wire it into cfw.py (patch-lockdown-mode) and the cfw_install.sh 27.* DSC-patch block. Also fixes the 0_binary_patch_comparison.md LWCR note and adds row 16. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01N2bwKrGJWY7o2ArdxibVPe | 27 天前 | |
vphone-cli: Add --root-popup to elevate CFW host-mount via macOS auth dialog * feat: add --root-popup to elevate CFW host-mount via macOS auth dialog Adds --root-popup to `cfw install` and `vm create`, elevating the CFW host-mount through macOS's native authentication dialog (osascript -> do shell script with administrator privileges) instead of the script's sudo re-exec. do shell script runs under a bare env, so the vars the bundled scripts read are forwarded inline, plus SUDO_USER so the script's chown-back still returns artifacts to the invoking user. On `vm create`, --sudo-password takes precedence. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * cfw: remove entire .cfw_temp on install cleanup Replaces the selective `rm -f` of individual temp binaries with `rm -rf "$TEMP_DIR"`, dropping the cached Cryptex DMGs along with the temp files. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> | 1 个月前 | |
vphone-cli: Add --root-popup to elevate CFW host-mount via macOS auth dialog * feat: add --root-popup to elevate CFW host-mount via macOS auth dialog Adds --root-popup to `cfw install` and `vm create`, elevating the CFW host-mount through macOS's native authentication dialog (osascript -> do shell script with administrator privileges) instead of the script's sudo re-exec. do shell script runs under a bare env, so the vars the bundled scripts read are forwarded inline, plus SUDO_USER so the script's chown-back still returns artifacts to the invoking user. On `vm create`, --sudo-password takes precedence. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * cfw: remove entire .cfw_temp on install cleanup Replaces the selective `rm -f` of individual temp binaries with `rm -rf "$TEMP_DIR"`, dropping the cached Cryptex DMGs along with the temp files. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> | 1 个月前 | |
frida: Install re.frida.server via the extra-debs mechanism On a --frida build, fetch_debs.sh resolves the latest frida iphoneos-arm64 release deb (== re.frida.server: no Depends, rootless /var/jb layout) into the debs cache; the existing first-boot `dpkg -i` step installs it. VPHONE_FRIDA is forwarded through the host CFW install. No APT source or dependency resolution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> | 26 天前 | |
vphone-cli: Add --root-popup to elevate CFW host-mount via macOS auth dialog * feat: add --root-popup to elevate CFW host-mount via macOS auth dialog Adds --root-popup to `cfw install` and `vm create`, elevating the CFW host-mount through macOS's native authentication dialog (osascript -> do shell script with administrator privileges) instead of the script's sudo re-exec. do shell script runs under a bare env, so the vars the bundled scripts read are forwarded inline, plus SUDO_USER so the script's chown-back still returns artifacts to the invoking user. On `vm create`, --sudo-password takes precedence. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * cfw: remove entire .cfw_temp on install cleanup Replaces the selective `rm -f` of individual temp binaries with `rm -rf "$TEMP_DIR"`, dropping the cached Cryptex DMGs along with the temp files. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> | 1 个月前 | |
frida: Install re.frida.server via the extra-debs mechanism On a --frida build, fetch_debs.sh resolves the latest frida iphoneos-arm64 release deb (== re.frida.server: no Depends, rootless /var/jb layout) into the debs cache; the existing first-boot `dpkg -i` step installs it. VPHONE_FRIDA is forwarded through the host CFW install. No APT source or dependency resolution. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> | 26 天前 | |
Complete Swift firmware patcher parity and CLI wiring Run SwiftFormat on firmware patcher Remove legacy Python firmware patchers Fix compare pipeline pyimg4 PATH handling Restore Python patchers and prefer fresh restore Update BinaryBuffer.swift Avoid double scanning in patcher apply Prefer Python TXM site before fallback Retarget TXM trustcache finder for 26.1 Remove legacy Python firmware patchers Fail fast on nested virtualization hosts Return nonzero on fatal boot startup Add amfidont helper for signed boot binary Stage AMFI boot args for next host reboot Add host preflight for boot entitlements Fail fast when boot entitlements are unavailable Switch firmware patch targets to Swift CLI Record real Swift firmware parity results Verify Swift firmware pipeline end-to-end parity Fix Swift firmware pipeline JB dry-run | 5 个月前 | |
setup: Remove artifacts when done to save disk space Delete the three large regenerable intermediates once their consumers finish, keeping the source archives so nothing needs re-downloading: - built restore firmware (iPhone*_Restore/) after CFW install (its last consumer — it copies the SystemOS/AppOS cryptexes onto Disk.img) - extracted base-IPSW dirs (iOS + cloudOS) at end of fw prepare; the downloaded .ipsw files are kept, so a re-run re-extracts, no re-download - extracted CFW input dirs (cfw_input/, cfw_jb_input/) after cfw install; the resources .tar.zst archives are kept Opt out with --keep-artifacts on `vm create` / `cfw install`, which threads VPHONE_KEEP_ARTIFACTS to fw_prepare.sh and cfw_install_host.sh. Co-authored-by: Claude Fable 5 <noreply@anthropic.com> | 1 个月前 | |
feat: guest restore/CFW pipeline updates for the consolidated CLI - pymobiledevice3_bridge.py: colorized restore logs (coloredlogs.install, mirroring pmd3's own CLI) gated by a -v count - cfw_install*.sh / fw_prepare.sh honor VPHONE_PYTHON/IPSW_DIR/VPHONE_SEAL_DIR and forward SPOOF_BUILD / FORCE_DSC_MAXSLIDE from the environment - patch_camera_userland.sh / patch_hv_vmm_userland.sh adjustments Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y4VDqWf5pVakcFLqB23CKe | 1 个月前 | |
feat: guest restore/CFW pipeline updates for the consolidated CLI - pymobiledevice3_bridge.py: colorized restore logs (coloredlogs.install, mirroring pmd3's own CLI) gated by a -v count - cfw_install*.sh / fw_prepare.sh honor VPHONE_PYTHON/IPSW_DIR/VPHONE_SEAL_DIR and forward SPOOF_BUILD / FORCE_DSC_MAXSLIDE from the environment - patch_camera_userland.sh / patch_hv_vmm_userland.sh adjustments Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y4VDqWf5pVakcFLqB23CKe | 1 个月前 | |
pymobiledevice3: Skip pairing refused devices | 1 个月前 | |
Remove boot_less dependency | 1 个月前 | |
deps: Add cmake PyPI has no arm64 macOS wheel for keystone-engine, so pip builds it from the sdist, whose make-share.sh invokes cmake directly. Without it the build fails silently and installs bindings with no native library, which is what the libkeystone repair recovers from. | 1 个月前 | |
venv: Fix `python3` locating for enviornments using `uv` | 4 个月前 | |
Add Git LFS instructions and fix Makefile help alignment - Add git-lfs to brew deps and document git lfs install/pull steps in both English and Chinese READMEs - Fix continuation line alignment in make help (off by one) - Add missing blank line before VM management section | 6 个月前 | |
amfidont: Simplify `start_amfidont_for_vphone.sh` | 4 个月前 | |
Automate JB patch testing workflow and update patch schedules | 5 个月前 | |
Utilize APFS CoW to make backups instant | 2 个月前 | |
feat: Add VM manifest system and code clarity improvements Implement VM configuration manifest system compatible with security-pcc's VMBundle.Config format, storing VM settings in config.plist. **Manifest System:** - Add VPhoneVirtualMachineManifest.swift with security-pcc compatible structure - Add scripts/vm_manifest.py for manifest generation during vm_new - Update VPhoneCLI to support --config option with CLI overrides - Update vm_create.sh to generate config.plist with CPU/memory/screen settings **Environment Variables:** - CPU/MEMORY/DISK_SIZE now only used during vm_new (written to manifest) - boot/boot_dfu automatically read from config.plist - Remove unused CFW_INPUT variable (overridden by scripts internally) - Document remaining variables with their usage scope **Documentation:** - Update README.md with VM configuration section - Update docs/README_{zh,ja,ko}.md with translated VM configuration docs - Update Makefile help output with vm_new options and config.plist usage - Fix fw_patch_jb description: "dev + JB extensions" - Fix restore_get_shsh description: "Dump SHSH response from Apple" **Code Quality:** - Add VPhoneVirtualMachineRefactored.swift demonstrating code-clarity principles - Extract 200+ line init into focused configuration methods - Improve naming: hardwareModel, graphicsConfiguration, soundDevice - Add BatteryConnectivity enum for magic numbers - Create research/manifest_and_refactoring_summary.md with full analysis **Compatibility with security-pcc:** - Platform type: Fixed vresearch101 (iPhone-only) - Network: NAT only (no bridging/host-only needed) - Added: ScreenConfig and SEP storage (iPhone-specific) - Removed: VirtMesh plugin support (PCC-specific) docs: add machineIdentifier storage analysis Research and validate the integration of machineIdentifier into config.plist. **Findings:** - security-pcc stores machineIdentifier in config.plist (same approach) - VZMacAuxiliaryStorage creation is independent of machineIdentifier - VZMacMachineIdentifier only requires Data representation, not file source - No binding or validation between components **Conclusion:** - ✅ No compatibility issues - ✅ Matches security-pcc official implementation - ✅ Proper handling of first-boot creation and data recovery - ✅ Safe to use Delete VPhoneVirtualMachineRefactored.swift refactor: integrate machineIdentifier into config.plist Move machineIdentifier storage from standalone machineIdentifier.bin file into the central config.plist manifest for simpler VM configuration. **Changes:** - VPhoneVirtualMachineManifest: Remove machineIDFile field - VPhoneVirtualMachine: Load/create machineIdentifier from manifest - VPhoneCLI: Remove --machine-id parameter, require --config - Makefile: Remove --machine-id from boot/boot_dfu targets - vm_manifest.py: Remove machineIDFile from manifest structure **Behavior:** - First boot: Creates machineIdentifier and saves to config.plist - Subsequent boots: Loads machineIdentifier from config.plist - Invalid/empty machineIdentifier: Auto-regenerates and updates manifest - All VM configuration now centralized in single config.plist file **File cleanup:** - Move VPhoneVirtualMachineRefactored.swift to research/ as reference Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> | 5 个月前 | |
Update vm_manifest.py (#198) fix issue with older python versions erroring out on line 20 (formerly 19) | 5 个月前 | |
Utilize APFS CoW to make backups instant | 2 个月前 | |
Utilize APFS CoW to make backups instant | 2 个月前 | |
fix: bundle vphone-amfidont in Resources, not MacOS (unbreaks .app signing) The v1.0.2 release build failed at the bundle codesign step: .build/vphone-cli.app/Contents/MacOS/vphone-cli: code object is not signed at all In subcomponent: .../Contents/MacOS/vphone-amfidont Contents/MacOS is the bundle's nested-code directory, so signing the main executable seals everything there and rejected the vphone-amfidont shell script as unsigned nested code. (A script only gets a "generic" xattr signature that wouldn't survive the release zip anyway.) Move the bundled helper to Contents/Resources/vphone-amfidont, where it is sealed as an ordinary resource (hashed, survives zip). Resources sits at the same depth under Contents as MacOS, so the script's `${0:A:h:h:h}` .app resolution is unchanged. The Homebrew `binary` stanza should point at Contents/Resources/vphone-amfidont. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y4VDqWf5pVakcFLqB23CKe | 1 个月前 | |
Rework JB finalization: drop dropbear, auto-bootstrap on first boot (#141) * fix: build * fix: remove [trusted=yes] from Havoc apt source The inline [trusted=yes] option can cause issues with Sileo's source parser. The apt-get calls already use AllowUnauthenticated flags, making it redundant. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: main actor crash in VPhoneControl + IPA extraction failures VPhoneControl: pending request handlers are @MainActor-isolated closures but were called from DispatchQueue.global() in the read loop and timeout handler, causing dispatch_assert_queue_fail crashes. Wrap all pending.handler() calls in DispatchQueue.main.async. unarchive: the recent ARCHIVE_EXTRACT_SECURE_* hardening (ef02d50) broke IPA extraction on iOS because: - SECURE_NOABSOLUTEPATHS: we set absolute output paths on entries - SECURE_SYMLINKS: iOS system paths (/var, /tmp) are symlinks - archive_write_header failures were silently swallowed due to if/else if structure, making extraction report success with no files extracted Fix by keeping only SECURE_NODOTDOT, resolving symlinks in extraction path, fixing header error handling, removing unnecessary ACL/FFLAGS flags, and surfacing libarchive errors in the install response. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * remove dropbear SSH daemon from guest Drop all dropbear setup: LaunchDaemon plist injection, host key generation, daemon deployment, and SSH availability messages. Guest communication is handled by vphoned over vsock. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * feat: liblaunch compat stub + automatic JB first-boot setup liblaunch_compat.dylib: stub exporting _launch_active_user_switch (missing from PCC VM's libSystem.B.dylib) so procursus binaries like launchctl can load. Deployed to /cores/, loaded via DYLD_INSERT_LIBRARIES in LaunchDaemon environment and JB profile. vphone_jb_setup.sh: first-boot script replacing the SSH-based cfw_install_jb_post.sh. Runs as a LaunchDaemon on first normal boot and performs all JB finalization: /var/jb symlink, prep_bootstrap, markers, Sileo, apt setup, TrollStore Lite. Idempotent with done marker. Logs to /var/log/vphone_jb_setup.log. Removes the cfw_install_jb_finalize make target and the entire SSH/iproxy/sshpass-based post-boot flow from setup_machine.sh. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * chore: update AGENTS.md firmware table, gitignore build artifacts Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: launchctl wrapper uses absolute path + timeout to prevent hangs - Use absolute path to launchctl.real instead of relative dirname, fixing "not found" when called via /var/jb/bin/launchctl symlink - Add 5s timeout so launchctl doesn't hang when launchd is unresponsive on PCC VMs — always exits 0 for dpkg postinst compat - Symlink /var/jb/bin/launchctl -> /var/jb/usr/bin/launchctl so both paths work (openssh postinst uses the /bin/ path) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * fix: replace liblaunch_compat dylib stub with iosbinpack64 launchctl symlink Procursus launchctl crashes on PCC VMs due to missing _launch_active_user_switch symbol. Rather than a custom dylib stub, simply symlink iosbinpack64's launchctl into /var/jb — it talks to launchd fine and always exits 0, which is all dpkg scripts need. - Remove liblaunch_compat.c, its build target, signing, and deployment - Remove DYLD_INSERT_LIBRARIES from setup script and plist - Replace launchctl wrapper with symlinks to /iosbinpack64/bin/launchctl - Both /var/jb/usr/bin/launchctl and /var/jb/bin/launchctl are covered Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> | 5 个月前 | |
frida: Add build.frida.re as a Sileo/apt source at first boot The JB first-boot setup adds the Frida repo (deb https://build.frida.re/ ./) next to the existing Havoc source, so Sileo/apt can install and update Frida packages. Idempotent — skipped if a build.frida.re source is already present — and picked up by the same insecure-repo `apt-get update` that follows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> | 26 天前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 2 个月前 | ||
| 27 天前 | ||
| 5 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 27 天前 | ||
| 1 个月前 | ||
| 5 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 27 天前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 26 天前 | ||
| 1 个月前 | ||
| 26 天前 | ||
| 5 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 4 个月前 | ||
| 6 个月前 | ||
| 4 个月前 | ||
| 5 个月前 | ||
| 2 个月前 | ||
| 5 个月前 | ||
| 5 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 1 个月前 | ||
| 5 个月前 | ||
| 26 天前 |