├── .DS_Store ├── img ├── 1.png ├── 2.png ├── 3.png ├── 4.png ├── 5.png ├── 6.png ├── 7.png ├── 8.png ├── 9.PNG └── .DS_Store ├── ThorJBbypass ├── .DS_Store ├── Packages │ ├── .DS_Store │ └── com.paigu.ThorJBbypass_1.1.5beta5_iphoneos-arm.zip ├── ThorJBbypass │ ├── .DS_Store │ ├── Package │ │ ├── Library │ │ │ └── MobileSubstrate │ │ │ │ └── DynamicLibraries │ │ │ │ ├── ThorJBbypass.dylib │ │ │ │ └── ThorJBbypass.plist │ │ └── DEBIAN │ │ │ └── control │ ├── ThorJBbypass-Prefix.pch │ ├── ThorJBbypass.xm │ └── ThorJBbypass.mm └── ThorJBbypass.xcodeproj │ ├── project.xcworkspace │ ├── contents.xcworkspacedata │ ├── xcuserdata │ │ └── paigu.xcuserdatad │ │ │ └── UserInterfaceState.xcuserstate │ └── xcshareddata │ │ └── IDEWorkspaceChecks.plist │ ├── xcuserdata │ └── paigu.xcuserdatad │ │ └── xcschemes │ │ └── xcschememanagement.plist │ └── project.pbxproj ├── LICENSE └── README.md /.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/.DS_Store -------------------------------------------------------------------------------- /img/1.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/img/1.png -------------------------------------------------------------------------------- /img/2.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/img/2.png -------------------------------------------------------------------------------- /img/3.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/img/3.png -------------------------------------------------------------------------------- /img/4.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/img/4.png -------------------------------------------------------------------------------- /img/5.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/img/5.png -------------------------------------------------------------------------------- /img/6.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/img/6.png -------------------------------------------------------------------------------- /img/7.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/img/7.png -------------------------------------------------------------------------------- /img/8.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/img/8.png -------------------------------------------------------------------------------- /img/9.PNG: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/img/9.PNG -------------------------------------------------------------------------------- /img/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/img/.DS_Store -------------------------------------------------------------------------------- /ThorJBbypass/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/ThorJBbypass/.DS_Store -------------------------------------------------------------------------------- /ThorJBbypass/Packages/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/ThorJBbypass/Packages/.DS_Store -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass/.DS_Store: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/ThorJBbypass/ThorJBbypass/.DS_Store -------------------------------------------------------------------------------- /ThorJBbypass/Packages/com.paigu.ThorJBbypass_1.1.5beta5_iphoneos-arm.zip: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/ThorJBbypass/Packages/com.paigu.ThorJBbypass_1.1.5beta5_iphoneos-arm.zip -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass/Package/Library/MobileSubstrate/DynamicLibraries/ThorJBbypass.dylib: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/ThorJBbypass/ThorJBbypass/Package/Library/MobileSubstrate/DynamicLibraries/ThorJBbypass.dylib -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass.xcodeproj/project.xcworkspace/contents.xcworkspacedata: -------------------------------------------------------------------------------- 1 | 2 | 4 | 6 | 7 | 8 | -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass.xcodeproj/project.xcworkspace/xcuserdata/paigu.xcuserdatad/UserInterfaceState.xcuserstate: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/wstclzy2010/ThorJailbreakBypass/HEAD/ThorJBbypass/ThorJBbypass.xcodeproj/project.xcworkspace/xcuserdata/paigu.xcuserdatad/UserInterfaceState.xcuserstate -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass/ThorJBbypass-Prefix.pch: -------------------------------------------------------------------------------- 1 | // 2 | // Prefix header for all source files of the 'ThorJBbypass' target in the 'ThorJBbypass' project 3 | // 4 | 5 | #ifdef __OBJC__ 6 | #import 7 | #import "/opt/theos/Prefix.pch" //path/to/theos/Prefix.pch 8 | #endif 9 | -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass.xcodeproj/project.xcworkspace/xcshareddata/IDEWorkspaceChecks.plist: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | IDEDidComputeMac32BitWarning 6 | 7 | 8 | 9 | -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass/Package/DEBIAN/control: -------------------------------------------------------------------------------- 1 | Package: com.paigu.ThorJBbypass 2 | Name: Thor屏蔽越狱检测 3 | Version: 1.1.5beta6 4 | Description: 屏蔽Thor的越狱检测、Flex 3插件检测、SuperCharge检测，支持最新版Thor1.3.9.756 5 | Section: System 6 | Depends: firmware (>= 9.0), mobilesubstrate 7 | Conflicts: 8 | Replaces: 9 | Priority: optional 10 | Architecture: iphoneos-arm 11 | Author: 糖醋丶炒排骨 12 | dev: 13 | Homepage: 14 | Depiction: 15 | Maintainer: 16 | Icon: 17 | 18 | -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass/Package/Library/MobileSubstrate/DynamicLibraries/ThorJBbypass.plist: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Filter 6 | 7 | Bundles 8 | 9 | com.pixelcyber.dake.thor 10 | 11 | 12 | 13 | 14 | -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass.xcodeproj/xcuserdata/paigu.xcuserdatad/xcschemes/xcschememanagement.plist: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | SchemeUserState 6 | 7 | ThorJBbypass.xcscheme_^#shared#^_ 8 | 9 | orderHint 10 | 0 11 | 12 | 13 | 14 | 15 | -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass/ThorJBbypass.xm: -------------------------------------------------------------------------------- 1 | %hook NSFileManager 2 | - (NSArray *)contentsOfDirectoryAtPath:(NSString *)path error:(NSError **)error 3 | { 4 | 5 | if([path containsString:@"/Library/MobileSubstrate/DynamicLibraries/"] 6 | || [path containsString:@"/Library/Application Support/Supercharge"] 7 | || [path containsString:@"/Library/Application Support/Flex3"]) 8 | { 9 | path = @"/Library/"; 10 | } 11 | 12 | if([path containsString:@"/var/mobile/Library/UserConfiguration/Profiles/PublicInfo/Flex3Patches.plist"]) 13 | { 14 | path = @"/var/mobile/Library/"; 15 | } 16 | 17 | %log; 18 | return %orig; 19 | } 20 | %end 21 | 22 | %hook NSURL 23 | 24 | + (NSURL *)fileURLWithPath:(NSString *)path 25 | { 26 | 27 | if([path containsString:@"/Library/MobileSubstrate/DynamicLibraries/"] 28 | || [path containsString:@"/Library/Application Support/Supercharge"] 29 | || [path containsString:@"/Library/Application Support/Flex3"]) 30 | { 31 | path = @"/Library/"; 32 | } 33 | 34 | %log; 35 | return %orig; 36 | } 37 | 38 | %end 39 | 40 | 41 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2020 wstclzy2010 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass/ThorJBbypass.mm: -------------------------------------------------------------------------------- 1 | #line 1 "/Users/paigu/Documents/ThorJBbypass/ThorJBbypass/ThorJBbypass.xm" 2 | 3 | #include 4 | #if defined(__clang__) 5 | #if __has_feature(objc_arc) 6 | #define _LOGOS_SELF_TYPE_NORMAL __unsafe_unretained 7 | #define _LOGOS_SELF_TYPE_INIT __attribute__((ns_consumed)) 8 | #define _LOGOS_SELF_CONST const 9 | #define _LOGOS_RETURN_RETAINED __attribute__((ns_returns_retained)) 10 | #else 11 | #define _LOGOS_SELF_TYPE_NORMAL 12 | #define _LOGOS_SELF_TYPE_INIT 13 | #define _LOGOS_SELF_CONST 14 | #define _LOGOS_RETURN_RETAINED 15 | #endif 16 | #else 17 | #define _LOGOS_SELF_TYPE_NORMAL 18 | #define _LOGOS_SELF_TYPE_INIT 19 | #define _LOGOS_SELF_CONST 20 | #define _LOGOS_RETURN_RETAINED 21 | #endif 22 | 23 | @class NSFileManager; @class NSURL; 24 | static NSArray * (*_logos_orig$_ungrouped$NSFileManager$contentsOfDirectoryAtPath$error$)(_LOGOS_SELF_TYPE_NORMAL NSFileManager* _LOGOS_SELF_CONST, SEL, NSString *, NSError **); static NSArray * _logos_method$_ungrouped$NSFileManager$contentsOfDirectoryAtPath$error$(_LOGOS_SELF_TYPE_NORMAL NSFileManager* _LOGOS_SELF_CONST, SEL, NSString *, NSError **); static NSURL * (*_logos_meta_orig$_ungrouped$NSURL$fileURLWithPath$)(_LOGOS_SELF_TYPE_NORMAL Class _LOGOS_SELF_CONST, SEL, NSString *); static NSURL * _logos_meta_method$_ungrouped$NSURL$fileURLWithPath$(_LOGOS_SELF_TYPE_NORMAL Class _LOGOS_SELF_CONST, SEL, NSString *); 25 | 26 | #line 1 "/Users/paigu/Documents/ThorJBbypass/ThorJBbypass/ThorJBbypass.xm" 27 | 28 | 29 | static NSArray * _logos_method$_ungrouped$NSFileManager$contentsOfDirectoryAtPath$error$(_LOGOS_SELF_TYPE_NORMAL NSFileManager* _LOGOS_SELF_CONST __unused self, SEL __unused _cmd, NSString * path, NSError ** error) { 30 | 31 | if([path containsString:@"/Library/MobileSubstrate/DynamicLibraries"]) 32 | { 33 | path = @"/Library/"; 34 | } 35 | 36 | if([path containsString:@"/var/mobile/Library/Application Support/Supercharge"] || 37 | [path containsString:@"/var/mobile/Library/Application Support/Flex3"] ) 38 | { 39 | path = @"/var/"; 40 | } 41 | 42 | if([path containsString:@"/var/mobile/Library/UserConfiguration/Profiles/PublicInfo/Flex3Patches.plist"]) 43 | { 44 | path = @"/var/mobile/Library/"; 45 | } 46 | 47 | HBLogDebug(@"-[ contentsOfDirectoryAtPath:%@ error:%p]", self, path, error); 48 | return _logos_orig$_ungrouped$NSFileManager$contentsOfDirectoryAtPath$error$(self, _cmd, path, error); 49 | } 50 | 51 | 52 | 53 | 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | 75 | 76 | 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | 88 | 89 | 90 | 91 | 92 | 93 | 94 | 95 | 96 | 97 | 98 | 99 | 100 | 101 | 102 | 103 | 104 | 105 | 106 | 107 | 108 | 109 | 110 | 111 | 112 | 113 | 114 | 115 | 116 | 117 | static NSURL * _logos_meta_method$_ungrouped$NSURL$fileURLWithPath$(_LOGOS_SELF_TYPE_NORMAL Class _LOGOS_SELF_CONST __unused self, SEL __unused _cmd, NSString * path) { 118 | 119 | if([path containsString:@"/Library/MobileSubstrate/DynamicLibraries/"]) 120 | { 121 | path = @"/Library/"; 122 | } 123 | 124 | if([path containsString:@"/Library/Application Support/Supercharge"] || 125 | [path containsString:@"/Library/Application Support/Flex3"] ) 126 | { 127 | path = @"/var"; 128 | } 129 | 130 | 131 | 132 | 133 | 134 | 135 | 136 | HBLogDebug(@"+[ fileURLWithPath:%@]", self, path); 137 | return _logos_meta_orig$_ungrouped$NSURL$fileURLWithPath$(self, _cmd, path); 138 | } 139 | 140 | 141 | 142 | 143 | static __attribute__((constructor)) void _logosLocalInit() { 144 | {Class _logos_class$_ungrouped$NSFileManager = objc_getClass("NSFileManager"); MSHookMessageEx(_logos_class$_ungrouped$NSFileManager, @selector(contentsOfDirectoryAtPath:error:), (IMP)&_logos_method$_ungrouped$NSFileManager$contentsOfDirectoryAtPath$error$, (IMP*)&_logos_orig$_ungrouped$NSFileManager$contentsOfDirectoryAtPath$error$);Class _logos_class$_ungrouped$NSURL = objc_getClass("NSURL"); Class _logos_metaclass$_ungrouped$NSURL = object_getClass(_logos_class$_ungrouped$NSURL); MSHookMessageEx(_logos_metaclass$_ungrouped$NSURL, @selector(fileURLWithPath:), (IMP)&_logos_meta_method$_ungrouped$NSURL$fileURLWithPath$, (IMP*)&_logos_meta_orig$_ungrouped$NSURL$fileURLWithPath$);} } 145 | #line 117 "/Users/paigu/Documents/ThorJBbypass/ThorJBbypass/ThorJBbypass.xm" 146 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # ThorJailbreakBypass 2 | 屏蔽锤子的越狱检测 3 | 4 | --- 5 | WHAT： 6 | * 越狱环境开启App会提示 7 | ![Alt text](https://github.com/wstclzy2010/ThorJailbreakBypass/blob/master/img/1.png) 8 | * 然后卸载应用重新安装后试图利用liberty lite和flyjb等一众屏蔽越狱检测插件去屏蔽，发现没什么用处，反而还导致了程序直接退出，连提示都不显示了。 9 | * 听说OC程序的强制退出常用的是exit函数，就从这里去找 10 | 11 | * 使用 xia0LLDB以后台模式启动并砸壳 12 | ``` 13 | debugserver -x backboard 127.0.0.1:2345 /var/containers/Bundle/Application/XXXXX 14 | lldb 15 | process connect connect://localhost:2345 16 | dumpdecrypted -X 17 | ``` 18 | * 拖入ida，搜索exit，拿到地址0x1002A0128 19 | ![Alt text](https://github.com/wstclzy2010/ThorJailbreakBypass/blob/master/img/2.png) 20 | * 在c1c000+1002A0128处下断点 21 | ``` 22 | (lldb) image list -o -f 23 | [ 0] 0x0000000000c1c000 /private/var/containers/Bundle/Application/EFF4BF92-B90F-42E8-AFBA-BB3DF06BAD31/Thor.app/Thor(0x0000000100c1c000) 24 | [ 1] 0x0000000101358000 /Library/Caches/cy-QRU7f0.dylib(0x0000000101358000) 25 | (lldb) b 0x100EBC128 26 | Breakpoint 1: where = Thor`symbol stub for: exit + 4, address = 0x0000000100ebc128 27 | (lldb) c 28 | Process 3099 resuming 29 | 2020-03-24 18:16:21.175 Thor[3099:107162] Hit loading Liberty Lite into com.pixelcyber.dake.thor - (C) Ryley Angus, 2016-19. No warranty provided. 30 | Process 3099 stopped 31 | * thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 32 | frame #0: 0x0000000100ebc128 Thor`exit + 4 33 | Thor`exit: 34 | -> 0x100ebc128 <+4>: ldr x16, #0x65058 ; (void *)0x0000000100ebce8c 35 | 0x100ebc12c <+8>: br x16 36 | 37 | Thor`fclose: 38 | 0x100ebc130 <+0>: nop 39 | 0x100ebc134 <+4>: ldr x16, #0x65054 ; (void *)0x0000000100ebce98 40 | 0x100ebc138 <+8>: br x16 41 | 42 | Thor`feof: 43 | 0x100ebc13c <+0>: nop 44 | 0x100ebc140 <+4>: ldr x16, #0x65050 ; (void *)0x0000000100ebcea4 45 | 0x100ebc144 <+8>: br x16 46 | Target 0: (Thor) stopped. 47 | ``` 48 | * 程序成功断住，说明断点正确，查看栈信息 49 | ``` 50 | (lldb) bt 51 | * thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 52 | * frame #0: 0x0000000100ebc128 Thor`exit + 4 53 | frame #1: 0x0000000100c277b8 Thor`___lldb_unnamed_symbol37$$Thor + 7628 54 | frame #2: 0x00000001c80668e0 libdyld.dylib`start + 4 55 | ``` 56 | * 得到地址0x100c277b8，100c277b8减去c1c000=10000B7B8应该就是想要的函数所在地址 57 | * 去ida中搜索10000B7B8 58 | ![Alt text](https://github.com/wstclzy2010/ThorJailbreakBypass/blob/master/img/3.png) 59 | * F5看下伪代码，结果碰到 positive sp value has been found。 60 | * 在ida-general中打开stack pointer，在0x10000B7B8处option+K，修改其difference值为0。 61 | * 成功显示伪代码: 62 | 63 | ![Alt text](https://github.com/wstclzy2010/ThorJailbreakBypass/blob/master/img/4.png) 64 | ![Alt text](https://github.com/wstclzy2010/ThorJailbreakBypass/blob/master/img/5.png) 65 | ![Alt text](https://github.com/wstclzy2010/ThorJailbreakBypass/blob/master/img/6.png) 66 | ![Alt text](https://github.com/wstclzy2010/ThorJailbreakBypass/blob/master/img/7.png) 67 | 68 | 很明显的，他是通过判断越狱所特有的文件路径、目录来检测越狱的，结合搜索引擎，大概用到了这些方法，给这些方法分别%log，查看控制台的输出内容： 69 | ``` 70 | + (NSURL *)fileURLWithPath:(NSString *)path; 71 | 72 | - (NSArray *)contentsOfDirectoryAtPath:(NSString *)path error:(NSError * _Nullable *)error; 73 | ``` 74 | ``` 75 | %hook NSFileManager 76 | - (NSArray *)contentsOfDirectoryAtPath:(NSString *)path error:(NSError **)error{ 77 | %log; 78 | return %orig; 79 | } 80 | 81 | - (BOOL)fileExistsAtPath:(NSString *)path isDirectory:(BOOL *)isDirectory{ 82 | %log; 83 | return %orig; 84 | } 85 | 86 | - (NSArray *)subpathsOfDirectoryAtPath:(NSString *)path error:(NSError **)error{ 87 | %log; 88 | return %orig; 89 | } 90 | 91 | %end 92 | 93 | %hook NSURL 94 | 95 | + (NSURL *)fileURLWithPath:(NSString *)path{ 96 | %log; 97 | return %orig; 98 | } 99 | 100 | %end 101 | ``` 102 | ![Alt text](https://github.com/wstclzy2010/ThorJailbreakBypass/blob/master/img/8.png) 103 | 104 | * 根据控制台的输出，明显的，他检测了这些目录和文件： 105 | 106 | ``` 107 | /Library/MobileSubstrate/DynamicLibraries 108 | /Library/Application Support 109 | /User/Library/Application Support/Flex3 110 | /User/Library/Application Support/Supercharge 111 | /var/mobile/Library/UserConfiguration/Profiles/PublicInfo 112 | ``` 113 | 114 | * 那就一股脑全干掉 115 | ``` 116 | %hook NSFileManager 117 | - (NSArray *)contentsOfDirectoryAtPath:(NSString *)path error:(NSError **)error 118 | { 119 | 120 | if([path containsString:@"/Library/MobileSubstrate/DynamicLibraries/"] || 121 | [path containsString:@"/Library/Application Support/Supercharge"] || 122 | [path containsString:@"/Library/Application Support/Flex3"]) 123 | { 124 | path = @"/Library/"; 125 | } 126 | 127 | if([path containsString:@"/var/mobile/Library/UserConfiguration/Profiles/PublicInfo/Flex3Patches.plist"]) 128 | { 129 | path = @"/var/mobile/Library/"; 130 | } 131 | 132 | %log; 133 | return %orig; 134 | } 135 | %end 136 | 137 | %hook NSURL 138 | 139 | + (NSURL *)fileURLWithPath:(NSString *)path 140 | { 141 | 142 | if([path containsString:@"/Library/MobileSubstrate/DynamicLibraries/"] || 143 | [path containsString:@"/Library/Application Support/Supercharge"] || 144 | [path containsString:@"/Library/Application Support/Flex3"]) 145 | { 146 | path = @"/Library/"; 147 | } 148 | 149 | %log; 150 | return %orig; 151 | } 152 | 153 | %end 154 | ``` 155 | * 成功进入App，收工。 156 | ![Alt text](https://github.com/wstclzy2010/ThorJailbreakBypass/blob/master/img/9.PNG) 157 | -------------------------------------------------------------------------------- /ThorJBbypass/ThorJBbypass.xcodeproj/project.pbxproj: -------------------------------------------------------------------------------- 1 | // !$*UTF8*$! 2 | { 3 | archiveVersion = 1; 4 | classes = { 5 | }; 6 | objectVersion = 50; 7 | objects = { 8 | 9 | /* Begin PBXBuildFile section */ 10 | 6D8DF61D241C9C5C002430E6 /* UIKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6D8DF61C241C9C5C002430E6 /* UIKit.framework */; }; 11 | 6D8DF61F241C9C5C002430E6 /* Foundation.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6D8DF61E241C9C5C002430E6 /* Foundation.framework */; }; 12 | 6D8DF621241C9C5C002430E6 /* CydiaSubstrate.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 6D8DF620241C9C5C002430E6 /* CydiaSubstrate.framework */; }; 13 | 6D8DF62A241C9C5C002430E6 /* ThorJBbypass.mm in Sources */ = {isa = PBXBuildFile; fileRef = 6D8DF629241C9C5C002430E6 /* ThorJBbypass.mm */; }; 14 | /* End PBXBuildFile section */ 15 | 16 | /* Begin PBXFileReference section */ 17 | 6D8DF619241C9C5C002430E6 /* ThorJBbypass.dylib */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.dylib"; includeInIndex = 0; path = ThorJBbypass.dylib; sourceTree = BUILT_PRODUCTS_DIR; }; 18 | 6D8DF61C241C9C5C002430E6 /* UIKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = UIKit.framework; path = System/Library/Frameworks/UIKit.framework; sourceTree = SDKROOT; }; 19 | 6D8DF61E241C9C5C002430E6 /* Foundation.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Foundation.framework; path = System/Library/Frameworks/Foundation.framework; sourceTree = SDKROOT; }; 20 | 6D8DF620241C9C5C002430E6 /* CydiaSubstrate.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = CydiaSubstrate.framework; path = Library/Frameworks/CydiaSubstrate.framework; sourceTree = DEVELOPER_DIR; }; 21 | 6D8DF625241C9C5C002430E6 /* control */ = {isa = PBXFileReference; lastKnownFileType = text; path = control; sourceTree = ""; }; 22 | 6D8DF627241C9C5C002430E6 /* ThorJBbypass-Prefix.pch */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.c.h; name = "ThorJBbypass-Prefix.pch"; path = "../ThorJBbypass-Prefix.pch"; sourceTree = ""; }; 23 | 6D8DF628241C9C5C002430E6 /* ThorJBbypass.xm */ = {isa = PBXFileReference; lastKnownFileType = text; path = ThorJBbypass.xm; sourceTree = ""; xcLanguageSpecificationIdentifier = xcode.lang.objc; }; 24 | 6D8DF629241C9C5C002430E6 /* ThorJBbypass.mm */ = {isa = PBXFileReference; lastKnownFileType = sourcecode.cpp.objcpp; path = ThorJBbypass.mm; sourceTree = ""; }; 25 | 6D8DF62E241C9C5C002430E6 /* ThorJBbypass.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = ThorJBbypass.plist; sourceTree = ""; }; 26 | /* End PBXFileReference section */ 27 | 28 | /* Begin PBXFrameworksBuildPhase section */ 29 | 6D8DF615241C9C5C002430E6 /* Frameworks */ = { 30 | isa = PBXFrameworksBuildPhase; 31 | buildActionMask = 2147483647; 32 | files = ( 33 | 6D8DF61D241C9C5C002430E6 /* UIKit.framework in Frameworks */, 34 | 6D8DF61F241C9C5C002430E6 /* Foundation.framework in Frameworks */, 35 | 6D8DF621241C9C5C002430E6 /* CydiaSubstrate.framework in Frameworks */, 36 | ); 37 | runOnlyForDeploymentPostprocessing = 0; 38 | }; 39 | /* End PBXFrameworksBuildPhase section */ 40 | 41 | /* Begin PBXGroup section */ 42 | 6D8DF60E241C9C5C002430E6 = { 43 | isa = PBXGroup; 44 | children = ( 45 | 6D8DF622241C9C5C002430E6 /* ThorJBbypass */, 46 | 6D8DF61B241C9C5C002430E6 /* Frameworks */, 47 | 6D8DF61A241C9C5C002430E6 /* Products */, 48 | ); 49 | sourceTree = ""; 50 | }; 51 | 6D8DF61A241C9C5C002430E6 /* Products */ = { 52 | isa = PBXGroup; 53 | children = ( 54 | 6D8DF619241C9C5C002430E6 /* ThorJBbypass.dylib */, 55 | ); 56 | name = Products; 57 | sourceTree = ""; 58 | }; 59 | 6D8DF61B241C9C5C002430E6 /* Frameworks */ = { 60 | isa = PBXGroup; 61 | children = ( 62 | 6D8DF61C241C9C5C002430E6 /* UIKit.framework */, 63 | 6D8DF61E241C9C5C002430E6 /* Foundation.framework */, 64 | 6D8DF620241C9C5C002430E6 /* CydiaSubstrate.framework */, 65 | ); 66 | name = Frameworks; 67 | sourceTree = ""; 68 | }; 69 | 6D8DF622241C9C5C002430E6 /* ThorJBbypass */ = { 70 | isa = PBXGroup; 71 | children = ( 72 | 6D8DF628241C9C5C002430E6 /* ThorJBbypass.xm */, 73 | 6D8DF629241C9C5C002430E6 /* ThorJBbypass.mm */, 74 | 6D8DF623241C9C5C002430E6 /* Package */, 75 | 6D8DF626241C9C5C002430E6 /* Supporting Files */, 76 | ); 77 | path = ThorJBbypass; 78 | sourceTree = ""; 79 | }; 80 | 6D8DF623241C9C5C002430E6 /* Package */ = { 81 | isa = PBXGroup; 82 | children = ( 83 | 6D8DF624241C9C5C002430E6 /* DEBIAN */, 84 | 6D8DF62B241C9C5C002430E6 /* Library */, 85 | ); 86 | path = Package; 87 | sourceTree = ""; 88 | }; 89 | 6D8DF624241C9C5C002430E6 /* DEBIAN */ = { 90 | isa = PBXGroup; 91 | children = ( 92 | 6D8DF625241C9C5C002430E6 /* control */, 93 | ); 94 | path = DEBIAN; 95 | sourceTree = ""; 96 | }; 97 | 6D8DF626241C9C5C002430E6 /* Supporting Files */ = { 98 | isa = PBXGroup; 99 | children = ( 100 | 6D8DF627241C9C5C002430E6 /* ThorJBbypass-Prefix.pch */, 101 | ); 102 | path = "Supporting Files"; 103 | sourceTree = ""; 104 | }; 105 | 6D8DF62B241C9C5C002430E6 /* Library */ = { 106 | isa = PBXGroup; 107 | children = ( 108 | 6D8DF62C241C9C5C002430E6 /* MobileSubstrate */, 109 | ); 110 | path = Library; 111 | sourceTree = ""; 112 | }; 113 | 6D8DF62C241C9C5C002430E6 /* MobileSubstrate */ = { 114 | isa = PBXGroup; 115 | children = ( 116 | 6D8DF62D241C9C5C002430E6 /* DynamicLibraries */, 117 | ); 118 | path = MobileSubstrate; 119 | sourceTree = ""; 120 | }; 121 | 6D8DF62D241C9C5C002430E6 /* DynamicLibraries */ = { 122 | isa = PBXGroup; 123 | children = ( 124 | 6D8DF62E241C9C5C002430E6 /* ThorJBbypass.plist */, 125 | ); 126 | path = DynamicLibraries; 127 | sourceTree = ""; 128 | }; 129 | /* End PBXGroup section */ 130 | 131 | /* Begin PBXHeadersBuildPhase section */ 132 | 6D8DF616241C9C5C002430E6 /* Headers */ = { 133 | isa = PBXHeadersBuildPhase; 134 | buildActionMask = 2147483647; 135 | files = ( 136 | ); 137 | runOnlyForDeploymentPostprocessing = 0; 138 | }; 139 | /* End PBXHeadersBuildPhase section */ 140 | 141 | /* Begin PBXNativeTarget section */ 142 | 6D8DF618241C9C5C002430E6 /* ThorJBbypass */ = { 143 | isa = PBXNativeTarget; 144 | buildConfigurationList = 6D8DF631241C9C5C002430E6 /* Build configuration list for PBXNativeTarget "ThorJBbypass" */; 145 | buildPhases = ( 146 | 6D8DF613241C9C5C002430E6 /* ShellScript */, 147 | 6D8DF614241C9C5C002430E6 /* Sources */, 148 | 6D8DF615241C9C5C002430E6 /* Frameworks */, 149 | 6D8DF616241C9C5C002430E6 /* Headers */, 150 | 6D8DF617241C9C5C002430E6 /* ShellScript */, 151 | ); 152 | buildRules = ( 153 | ); 154 | dependencies = ( 155 | ); 156 | name = ThorJBbypass; 157 | productName = ThorJBbypass; 158 | productReference = 6D8DF619241C9C5C002430E6 /* ThorJBbypass.dylib */; 159 | productType = "com.apple.product-type.library.dynamic"; 160 | }; 161 | /* End PBXNativeTarget section */ 162 | 163 | /* Begin PBXProject section */ 164 | 6D8DF60F241C9C5C002430E6 /* Project object */ = { 165 | isa = PBXProject; 166 | attributes = { 167 | LastUpgradeCheck = 1130; 168 | TargetAttributes = { 169 | 6D8DF618241C9C5C002430E6 = { 170 | CreatedOnToolsVersion = 11.3.1; 171 | }; 172 | }; 173 | }; 174 | buildConfigurationList = 6D8DF612241C9C5C002430E6 /* Build configuration list for PBXProject "ThorJBbypass" */; 175 | compatibilityVersion = "Xcode 9.3"; 176 | developmentRegion = en; 177 | hasScannedForEncodings = 0; 178 | knownRegions = ( 179 | en, 180 | Base, 181 | ); 182 | mainGroup = 6D8DF60E241C9C5C002430E6; 183 | productRefGroup = 6D8DF61A241C9C5C002430E6 /* Products */; 184 | projectDirPath = ""; 185 | projectRoot = ""; 186 | targets = ( 187 | 6D8DF618241C9C5C002430E6 /* ThorJBbypass */, 188 | ); 189 | }; 190 | /* End PBXProject section */ 191 | 192 | /* Begin PBXShellScriptBuildPhase section */ 193 | 6D8DF613241C9C5C002430E6 /* ShellScript */ = { 194 | isa = PBXShellScriptBuildPhase; 195 | buildActionMask = 2147483647; 196 | files = ( 197 | ); 198 | inputFileListPaths = ( 199 | ); 200 | inputPaths = ( 201 | ); 202 | outputFileListPaths = ( 203 | ); 204 | outputPaths = ( 205 | ); 206 | runOnlyForDeploymentPostprocessing = 0; 207 | shellPath = /bin/sh; 208 | shellScript = "/opt/MonkeyDev/bin/md --xcbp-logos\n"; 209 | }; 210 | 6D8DF617241C9C5C002430E6 /* ShellScript */ = { 211 | isa = PBXShellScriptBuildPhase; 212 | buildActionMask = 2147483647; 213 | files = ( 214 | ); 215 | inputFileListPaths = ( 216 | ); 217 | inputPaths = ( 218 | ); 219 | outputFileListPaths = ( 220 | ); 221 | outputPaths = ( 222 | ); 223 | runOnlyForDeploymentPostprocessing = 0; 224 | shellPath = /bin/sh; 225 | shellScript = "/opt/MonkeyDev/bin/md --xcbp\n"; 226 | }; 227 | /* End PBXShellScriptBuildPhase section */ 228 | 229 | /* Begin PBXSourcesBuildPhase section */ 230 | 6D8DF614241C9C5C002430E6 /* Sources */ = { 231 | isa = PBXSourcesBuildPhase; 232 | buildActionMask = 2147483647; 233 | files = ( 234 | 6D8DF62A241C9C5C002430E6 /* ThorJBbypass.mm in Sources */, 235 | ); 236 | runOnlyForDeploymentPostprocessing = 0; 237 | }; 238 | /* End PBXSourcesBuildPhase section */ 239 | 240 | /* Begin XCBuildConfiguration section */ 241 | 6D8DF62F241C9C5C002430E6 /* Release */ = { 242 | isa = XCBuildConfiguration; 243 | buildSettings = { 244 | COPY_PHASE_STRIP = YES; 245 | EXCLUDED_RECURSIVE_SEARCH_PATH_SUBDIRECTORIES = "*.nib *.lproj *.gch (*) .DS_Store CVS .svn .git .hg *.xcodeproj *.xcode *.pbproj *.pbxproj"; 246 | FRAMEWORK_SEARCH_PATHS = ( 247 | "$(MonkeyDevPath)/frameworks/**", 248 | "$(MonkeyDevTheosPath)/vendor/lib", 249 | ); 250 | GCC_C_LANGUAGE_STANDARD = gnu99; 251 | GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES; 252 | GCC_WARN_ABOUT_RETURN_TYPE = YES; 253 | GCC_WARN_UNUSED_VARIABLE = YES; 254 | HEADER_SEARCH_PATHS = "$(MonkeyDevTheosPath)/vendor/include/**"; 255 | IPHONEOS_DEPLOYMENT_TARGET = 8.0; 256 | LIBRARY_SEARCH_PATHS = "$(MonkeyDevTheosPath)/vendor/lib/**"; 257 | MonkeyDevPath = /opt/MonkeyDev; 258 | MonkeyDevTheosPath = /opt/theos; 259 | OTHER_CFLAGS = "-DTHEOS_INSTANCE_NAME=\"\\\"ThorJBbypass\\\"\""; 260 | SDKROOT = iphoneos; 261 | TARGETED_DEVICE_FAMILY = "1,2"; 262 | VALIDATE_PRODUCT = YES; 263 | }; 264 | name = Release; 265 | }; 266 | 6D8DF630241C9C5C002430E6 /* Debug */ = { 267 | isa = XCBuildConfiguration; 268 | buildSettings = { 269 | COPY_PHASE_STRIP = NO; 270 | EXCLUDED_RECURSIVE_SEARCH_PATH_SUBDIRECTORIES = "*.nib *.lproj *.gch (*) .DS_Store CVS .svn .git .hg *.xcodeproj *.xcode *.pbproj *.pbxproj"; 271 | FRAMEWORK_SEARCH_PATHS = ( 272 | "$(MonkeyDevPath)/frameworks/**", 273 | "$(MonkeyDevTheosPath)/vendor/lib", 274 | ); 275 | GCC_C_LANGUAGE_STANDARD = gnu99; 276 | GCC_DYNAMIC_NO_PIC = NO; 277 | GCC_OPTIMIZATION_LEVEL = 0; 278 | GCC_PREPROCESSOR_DEFINITIONS = ( 279 | "DEBUG=1", 280 | "$(inherited)", 281 | ); 282 | GCC_SYMBOLS_PRIVATE_EXTERN = NO; 283 | GCC_WARN_ABOUT_MISSING_PROTOTYPES = YES; 284 | GCC_WARN_ABOUT_RETURN_TYPE = YES; 285 | GCC_WARN_UNUSED_VARIABLE = YES; 286 | HEADER_SEARCH_PATHS = "$(MonkeyDevTheosPath)/vendor/include/**"; 287 | IPHONEOS_DEPLOYMENT_TARGET = 8.0; 288 | LIBRARY_SEARCH_PATHS = "$(MonkeyDevTheosPath)/vendor/lib/**"; 289 | MonkeyDevPath = /opt/MonkeyDev; 290 | MonkeyDevTheosPath = /opt/theos; 291 | ONLY_ACTIVE_ARCH = YES; 292 | OTHER_CFLAGS = "-DTHEOS_INSTANCE_NAME=\"\\\"ThorJBbypass\\\"\""; 293 | SDKROOT = iphoneos; 294 | TARGETED_DEVICE_FAMILY = "1,2"; 295 | VALIDATE_PRODUCT = NO; 296 | }; 297 | name = Debug; 298 | }; 299 | 6D8DF632241C9C5C002430E6 /* Release */ = { 300 | isa = XCBuildConfiguration; 301 | buildSettings = { 302 | CLANG_ENABLE_OBJC_ARC = YES; 303 | CODE_SIGN_IDENTITY = "Apple Development"; 304 | CODE_SIGN_STYLE = Automatic; 305 | DEVELOPMENT_TEAM = 2SRNLG9873; 306 | DYLIB_COMPATIBILITY_VERSION = 1; 307 | DYLIB_CURRENT_VERSION = 1; 308 | GCC_PRECOMPILE_PREFIX_HEADER = YES; 309 | GCC_PREFIX_HEADER = "ThorJBbypass/ThorJBbypass-Prefix.pch"; 310 | INSTALL_PATH = /Library/MobileSubstrate/DynamicLibraries; 311 | MonkeyDevBuildPackageOnAnyBuild = YES; 312 | MonkeyDevClearUiCacheOnInstall = NO; 313 | MonkeyDevCopyOnBuild = NO; 314 | MonkeyDevDeviceIP = ""; 315 | MonkeyDevDevicePassword = ""; 316 | MonkeyDevDevicePort = ""; 317 | MonkeyDevInstallOnAnyBuild = YES; 318 | MonkeyDevInstallOnProfiling = YES; 319 | MonkeyDevkillProcessOnInstall = Thor; 320 | PRODUCT_NAME = "$(TARGET_NAME)"; 321 | TARGETED_DEVICE_FAMILY = "1,2"; 322 | }; 323 | name = Release; 324 | }; 325 | 6D8DF633241C9C5C002430E6 /* Debug */ = { 326 | isa = XCBuildConfiguration; 327 | buildSettings = { 328 | CLANG_ENABLE_OBJC_ARC = YES; 329 | CODE_SIGN_IDENTITY = "Apple Development"; 330 | CODE_SIGN_STYLE = Automatic; 331 | DEVELOPMENT_TEAM = 2SRNLG9873; 332 | DYLIB_COMPATIBILITY_VERSION = 1; 333 | DYLIB_CURRENT_VERSION = 1; 334 | GCC_PRECOMPILE_PREFIX_HEADER = YES; 335 | GCC_PREFIX_HEADER = "ThorJBbypass/ThorJBbypass-Prefix.pch"; 336 | INSTALL_PATH = /Library/MobileSubstrate/DynamicLibraries; 337 | MonkeyDevBuildPackageOnAnyBuild = YES; 338 | MonkeyDevClearUiCacheOnInstall = NO; 339 | MonkeyDevCopyOnBuild = NO; 340 | MonkeyDevDeviceIP = ""; 341 | MonkeyDevDevicePassword = ""; 342 | MonkeyDevDevicePort = ""; 343 | MonkeyDevInstallOnAnyBuild = YES; 344 | MonkeyDevInstallOnProfiling = YES; 345 | MonkeyDevkillProcessOnInstall = Thor; 346 | PRODUCT_NAME = "$(TARGET_NAME)"; 347 | TARGETED_DEVICE_FAMILY = "1,2"; 348 | }; 349 | name = Debug; 350 | }; 351 | /* End XCBuildConfiguration section */ 352 | 353 | /* Begin XCConfigurationList section */ 354 | 6D8DF612241C9C5C002430E6 /* Build configuration list for PBXProject "ThorJBbypass" */ = { 355 | isa = XCConfigurationList; 356 | buildConfigurations = ( 357 | 6D8DF62F241C9C5C002430E6 /* Release */, 358 | 6D8DF630241C9C5C002430E6 /* Debug */, 359 | ); 360 | defaultConfigurationIsVisible = 0; 361 | defaultConfigurationName = Release; 362 | }; 363 | 6D8DF631241C9C5C002430E6 /* Build configuration list for PBXNativeTarget "ThorJBbypass" */ = { 364 | isa = XCConfigurationList; 365 | buildConfigurations = ( 366 | 6D8DF632241C9C5C002430E6 /* Release */, 367 | 6D8DF633241C9C5C002430E6 /* Debug */, 368 | ); 369 | defaultConfigurationIsVisible = 0; 370 | defaultConfigurationName = Release; 371 | }; 372 | /* End XCConfigurationList section */ 373 | }; 374 | rootObject = 6D8DF60F241C9C5C002430E6 /* Project object */; 375 | } 376 | --------------------------------------------------------------------------------