TrollStore README

The project's README from github.com/opa334/TrollStore. As one markdown file: README.md.

TrollStore

TrollStore is a permasigned jailed app that can permanently install any IPA you open in it.

It works because of an AMFI/CoreTrust bug where iOS does not correctly verify code signatures of binaries in which there are multiple signers.

Supported versions: 14.0 beta 2 - 16.6.1, 16.7 RC (20H18), 17.0

Installing TrollStore

For installing TrollStore, refer to the guides at ios.cfw.guide

16.7.x (excluding 16.7 RC) and 17.0.1+ will NEVER be supported (unless a third CoreTrust bug is discovered, which is unlikely).

Updating TrollStore

When a new TrollStore update is available, a button to install it will appear at the top in the TrollStore settings. After tapping the button, TrollStore will automatically download the update, install it, and respring.

Alternatively (if anything goes wrong), you can download the TrollStore.tar file under Releases and open it in TrollStore, TrollStore will install the update and respring.

Uninstalling an app

Apps installed from TrollStore can only be uninstalled from TrollStore itself, tap an app or swipe it to the left in the 'Apps' tab to delete it.

Persistence Helper

The CoreTrust bug used in TrollStore is only enough to install "System" apps, this is because FrontBoard has an additional security check (it calls libmis) every time before a user app is launched. Unfortunately it is not possible to install new "System" apps that stay through an icon cache reload. Therefore, when iOS reloads the icon cache, all TrollStore installed apps including TrollStore itself will revert back to "User" state and will no longer launch.

The only way to work around this is to install a persistence helper into a system app, this helper can then be used to reregister TrollStore and its installed apps as "System" so that they become launchable again, an option for this is available in TrollStore settings.

On jailbroken iOS 14 when TrollHelper is used for installation, it is located in /Applications and will persist as a "System" app through icon cache reloads, therefore TrollHelper is used as the persistence helper on iOS 14.

URL Scheme

As of version 1.3, TrollStore replaces the system URL scheme "apple-magnifier" (this is done so "jailbreak" detections can't detect TrollStore like they could if TrollStore had a unique URL scheme). This URL scheme can be used to install applications right from the browser, or to enable JIT from the app itself (only 2.0.12 and above), the format goes as follows:

On devices that don't have TrollStore (1.3+) installed, this will just open the magnifier app.

Features

The binaries inside an IPA can have arbitrary entitlements, fakesign them with ldid and the entitlements you want (ldid -S<path/to/entitlements.plist> <path/to/binary>) and TrollStore will preserve the entitlements when resigning them with the fake root certificate on installation. This gives you a lot of possibilities, some of which are explained below.

Banned entitlements

iOS 15 on A12+ has banned the following three entitlements related to running unsigned code, these are impossible to get without a PPL bypass, apps signed with them will crash on launch.

com.apple.private.cs.debugger

dynamic-codesigning

com.apple.private.skip-library-validation

Unsandboxing

Your app can run unsandboxed using one of the following entitlements:

<key>com.apple.private.security.container-required</key>
<false/>

<key>com.apple.private.security.no-container</key>
<true/>

<key>com.apple.private.security.no-sandbox</key>
<true/>

The third one is recommended if you still want a sandbox container for your application.

You might also need the platform-application entitlement in order for these to work properly:

<key>platform-application</key>
<true/>

Please note that the platform-application entitlement causes side effects such as some parts of the sandbox becoming tighter, so you may need additional private entitlements to circumvent that. (For example afterwards you need an exception entitlement for every single IOKit user client class you want to access).

In order for an app with com.apple.private.security.no-sandbox and platform-application to be able to access it's own data container, you might need the additional entitlement:

<key>com.apple.private.security.storage.AppDataContainers</key>
<true/>

Root Helpers

When your app is not sandboxed, you can spawn other binaries using posix_spawn, you can also spawn binaries as root with the following entitlement:

<key>com.apple.private.persona-mgmt</key>
<true/>

You can also add your own binaries into your app bundle.

Afterwards you can use the spawnRoot function in TSUtil.m to spawn the binary as root.

Things that are not possible using TrollStore

Compilation

To compile TrollStore, ensure theos is installed. Additionaly ensure brew is installed and install libarchive from brew.

Credits and Further Reading

@alfiecg_dev - Found the CoreTrust bug that allows TrollStore to work through patchdiffing and worked on automating the bypass.

Google Threat Analysis Group - Found the CoreTrust bug as part of an in-the-wild spyware chain and reported it to Apple.

@LinusHenze - Found the installd bypass used to install TrollStore on iOS 14-15.6.1 via TrollHelperOTA, as well as the original CoreTrust bug used in TrollStore 1.0.

Fugu15 Presentation

Write-Up on the first CoreTrust bug with more information.

TrollStore (opa334/TrollStore)

Searching Database…

22.4K ·GitHub
TrollStore
What is this?TrollStore is a permasigned jailed app for iOS that permanently installs any IPA you open in it. It works via an AMFI/CoreTrust bug: iOS doesn't correctly verify code signatures when a binary has multiple signers, so TrollStore can resign apps with its fake root certificate and keep them installed for good.
So is this a jailbreak?No — the device stays jailed. TrollStore is an ordinary app that abuses the CoreTrust bug to get install powers, and it deliberately borrows the system 'apple-magnifier' URL scheme so jailbreak-detection checks can't flag it.
How do I get TrollStore onto my iPhone?Follow the per-device guides at ios.cfw.guide — the right method depends on your iOS version. On a jailbroken iOS 14, TrollHelper installs it straight into /Applications, where it survives as a 'System' app.
Will apps I install with TrollStore keep working, or is there a catch?There's one: whenever iOS reloads the icon cache, TrollStore and everything it installed drop back to 'User' state and refuse to launch. You install a Persistence Helper into a system app (option in TrollStore settings) so it can re-register them all as 'System' again.
Which iOS versions does it support?iOS 14.0 beta 2 through 16.6.1, plus 16.7 RC (20H18) and 17.0. Every 16.7.x build except that RC, and anything from 17.0.1 on, will never be supported unless a third CoreTrust bug shows up — which the author considers unlikely.
What can apps installed through TrollStore do that normal apps can't?They can carry arbitrary entitlements: fakesign the IPA's binaries with ldid (ldid -S) and TrollStore preserves them when it resigns everything with its fake root certificate. That unlocks unsandboxing, spawning root helpers as root, and enabling JIT per app.
Is there anything even TrollStore can't do?Yes: no proper platformization (TFPLATFORM/CSPLATFORMIZED), no spawning launch daemons, and no injecting tweaks into system processes. On iOS 15 with A12+ chips three code-signing entitlements such as dynamic-codesigning are banned outright — apps signed with them crash on launch.
Can I install IPAs straight from the browser?Yes. TrollStore takes over the 'apple-magnifier' URL scheme, so a link like apple-magnifier://install?url=... starts an install from Safari, and apple-magnifier://enable-jit?bundle-id= turns on JIT for a single app (2.0.12+). On devices without TrollStore 1.3+ the link just opens the Magnifier app.
How do I delete an app TrollStore installed?Only from inside TrollStore itself: tap the app or swipe it left in the 'Apps' tab. Regular iOS deletion doesn't work for these apps.
What are similar projects?AirCard, FilzaSlop, Erosion, misaka26, badnotes, ps5-webkit-autoloader, 3105, AirCard-iOS
Which topics is it in?iphone, root, jailbreak, exploit, ios-app, objective-c, installer, hacking, sandbox, app, reverse-engineering, mobile-app
Creator
opa334
Size
7.4 MB
Stars
22.4K
Updated
CommitApr 01Release2.1.1Apr 01
Age
4y
Commits · 90 Days