TrollStore README

The project's README from github.com/opa334/TrollStore. As one markdown file: README.md.

TrollStore

TrollStore is a permasigned jailed app that can permanently install any IPA you open in it.

It works because of an AMFI/CoreTrust bug where iOS does not correctly verify code signatures of binaries in which there are multiple signers.

Supported versions: 14.0 beta 2 - 16.6.1, 16.7 RC (20H18), 17.0

Installing TrollStore

For installing TrollStore, refer to the guides at ios.cfw.guide

16.7.x (excluding 16.7 RC) and 17.0.1+ will NEVER be supported (unless a third CoreTrust bug is discovered, which is unlikely).

Updating TrollStore

When a new TrollStore update is available, a button to install it will appear at the top in the TrollStore settings. After tapping the button, TrollStore will automatically download the update, install it, and respring.

Alternatively (if anything goes wrong), you can download the TrollStore.tar file under Releases and open it in TrollStore, TrollStore will install the update and respring.

Uninstalling an app

Apps installed from TrollStore can only be uninstalled from TrollStore itself, tap an app or swipe it to the left in the 'Apps' tab to delete it.

Persistence Helper

The CoreTrust bug used in TrollStore is only enough to install "System" apps, this is because FrontBoard has an additional security check (it calls libmis) every time before a user app is launched. Unfortunately it is not possible to install new "System" apps that stay through an icon cache reload. Therefore, when iOS reloads the icon cache, all TrollStore installed apps including TrollStore itself will revert back to "User" state and will no longer launch.

The only way to work around this is to install a persistence helper into a system app, this helper can then be used to reregister TrollStore and its installed apps as "System" so that they become launchable again, an option for this is available in TrollStore settings.

On jailbroken iOS 14 when TrollHelper is used for installation, it is located in /Applications and will persist as a "System" app through icon cache reloads, therefore TrollHelper is used as the persistence helper on iOS 14.

URL Scheme

As of version 1.3, TrollStore replaces the system URL scheme "apple-magnifier" (this is done so "jailbreak" detections can't detect TrollStore like they could if TrollStore had a unique URL scheme). This URL scheme can be used to install applications right from the browser, or to enable JIT from the app itself (only 2.0.12 and above), the format goes as follows:

On devices that don't have TrollStore (1.3+) installed, this will just open the magnifier app.

Features

The binaries inside an IPA can have arbitrary entitlements, fakesign them with ldid and the entitlements you want (ldid -S<path/to/entitlements.plist> <path/to/binary>) and TrollStore will preserve the entitlements when resigning them with the fake root certificate on installation. This gives you a lot of possibilities, some of which are explained below.

Banned entitlements

iOS 15 on A12+ has banned the following three entitlements related to running unsigned code, these are impossible to get without a PPL bypass, apps signed with them will crash on launch.

com.apple.private.cs.debugger

dynamic-codesigning

com.apple.private.skip-library-validation

Unsandboxing

Your app can run unsandboxed using one of the following entitlements:

<key>com.apple.private.security.container-required</key>
<false/>

<key>com.apple.private.security.no-container</key>
<true/>

<key>com.apple.private.security.no-sandbox</key>
<true/>

The third one is recommended if you still want a sandbox container for your application.

You might also need the platform-application entitlement in order for these to work properly:

<key>platform-application</key>
<true/>

Please note that the platform-application entitlement causes side effects such as some parts of the sandbox becoming tighter, so you may need additional private entitlements to circumvent that. (For example afterwards you need an exception entitlement for every single IOKit user client class you want to access).

In order for an app with com.apple.private.security.no-sandbox and platform-application to be able to access it's own data container, you might need the additional entitlement:

<key>com.apple.private.security.storage.AppDataContainers</key>
<true/>

Root Helpers

When your app is not sandboxed, you can spawn other binaries using posix_spawn, you can also spawn binaries as root with the following entitlement:

<key>com.apple.private.persona-mgmt</key>
<true/>

You can also add your own binaries into your app bundle.

Afterwards you can use the spawnRoot function in TSUtil.m to spawn the binary as root.

Things that are not possible using TrollStore

Compilation

To compile TrollStore, ensure theos is installed. Additionaly ensure brew is installed and install libarchive from brew.

Credits and Further Reading

@alfiecg_dev - Found the CoreTrust bug that allows TrollStore to work through patchdiffing and worked on automating the bypass.

Google Threat Analysis Group - Found the CoreTrust bug as part of an in-the-wild spyware chain and reported it to Apple.

@LinusHenze - Found the installd bypass used to install TrollStore on iOS 14-15.6.1 via TrollHelperOTA, as well as the original CoreTrust bug used in TrollStore 1.0.

Fugu15 Presentation

Write-Up on the first CoreTrust bug with more information.

TrollStore (opa334/TrollStore)

Searching Database…

22.4K ·GitHub
TrollStore
这是什么?TrollStore 是一款永久签名(permasigned)的越狱环境内应用,可以把你在里面打开的任何 IPA 永久安装到 iOS 上。它利用了一个 AMFI/CoreTrust 漏洞:当一个二进制文件有多个签名者时,iOS 不能正确校验代码签名,因此 TrollStore 可以用它伪造的根证书给应用重新签名,让它们永久保留在设备上。
那这算是越狱吗?不算——设备仍处于未越狱状态。TrollStore 只是一个普通应用,通过 CoreTrust 漏洞获得了安装权限,并且它故意借用了系统的 'apple-magnifier' URL scheme,这样越狱检测的检查就无法识别它。
怎么把 TrollStore 装到我的 iPhone 上?按照 ios.cfw.guide 上针对你设备的教程操作——具体方法取决于你的 iOS 版本。在已越狱的 iOS 14 上,TrollHelper 会把它直接安装到 /Applications 里,以'系统'应用的形式常驻。
用 TrollStore 装的应用能一直正常用吗,还是有什么坑?有一个坑:每当 iOS 重新加载图标缓存时,TrollStore 和它安装的所有应用都会退回'用户'状态,无法启动。你需要在某个系统应用里安装一个 Persistence Helper(TrollStore 设置里有这个选项),它就能把这些应用重新注册为'系统'应用。
支持哪些 iOS 版本?支持 iOS 14.0 beta 2 到 16.6.1,外加 16.7 RC(20H18)和 17.0。除此之外的每个 16.7.x 版本,以及 17.0.1 及之后的版本,除非再出现第三个 CoreTrust 漏洞,否则永远不会获得支持——而作者认为这不太可能。
通过 TrollStore 装的应用能做哪些普通应用做不到的事?它们可以携带任意 entitlements:先用 ldid 给 IPA 里的二进制文件 fakesign(ldid -S),TrollStore 用伪造的根证书重新签名时会保留这些 entitlements。这就解锁了脱离沙盒、以 root 权限启动 root 助手进程,以及为单个应用开启 JIT。
有没有连 TrollStore 也做不到的事?有:无法进行真正的 platformization(TFPLATFORM/CSPLATFORMIZED),无法启动 launch daemons,也无法向系统进程注入插件(tweak)。在搭载 A12 及以上芯片的 iOS 15 设备上,dynamic-codesigning 等三个代码签名 entitlements 被完全禁用——带有这些 entitlements 的应用一启动就会崩溃。
我能直接在浏览器里安装 IPA 吗?可以。TrollStore 接管了 'apple-magnifier' URL scheme,所以在 Safari 里打开形如 apple-magnifier://install?url=... 的链接就能开始安装;apple-magnifier://enable-jit?bundle-id= 则可以为单个应用开启 JIT(2.0.12 及以上版本)。在没有 TrollStore 1.3 及以上版本的设备上,链接只会打开放大器(Magnifier)应用。
怎么删除 TrollStore 装的应用?只能在 TrollStore 里面删:在'Apps'标签页中点击该应用,或把它向左滑动。iOS 自带的常规删除方式对这些应用不管用。
What are similar projects?AirCard, FilzaSlop, Erosion, misaka26, badnotes, ps5-webkit-autoloader, 3105, AirCard-iOS
Which topics is it in?iphone, root, jailbreak, exploit, ios-app, objective-c, installer, hacking, sandbox, app, reverse-engineering, mobile-app
Creator
opa334
Size
7.4 MB
Stars
22.4K
Updated
CommitApr 01Release2.1.1Apr 01
Age
4y
Commits · 90 Days