通过运行未签名的可执行文件来检测越狱的 iOS 设备
目前，我正在尝试创建一个可重用的 objC 安全库供我公司的开发人员使用。在这个库中，我希望有一个 API 来检测他们的 iOS 设备是否越狱。我注意到 GregH 类似于 iBooks 正在做；您运行未签名版本的可执行文件（iOS 在通过 execve sys 调用启动应用程序时执行），如果它返回，您就知道设备已越狱。
问题：是否可以在 iOS 库中打包可执行文件并通过某些函数调用它？如果是这样，最好的方法是什么？
感谢您的帮助， 克
Currently, I'm trying to create a reusable objC security library for developers in my company to use. In this library I would like to have a API that detects if their iOS device is jailbroken. I noticed a clever response by GregH which is similar to what iBooks is doing; you run an unsigned version of an executable (iOS does upon startup of the app via the execve sys call), if it returns you know the device is jailbroken.
Question: Is it possible to package a executable in iOS library and invoke it thru some function? If so, what might be the best way to go about it?
Thanks for your help,
kc
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
上次我检查过，沙盒应用程序甚至无法
fork()。我不确定他们是否可以调用execve()。如果他们两者都做不到，那么只需调用execve()就可以了。我不确定越狱对此有何干扰。可以进行越狱，让您从未签名的应用程序运行未签名的应用程序，但如果调用者已签名，则行为正常。
显然可以将可执行文件“打包”到库中：只需使用
static unsigned char const data [] = { ... };，将其写入文件，chmod()< /code>，并尝试执行它。但归根结底，这可能会对您的用户造成伤害。手机越狱并不意味着您的应用程序已被盗版。除非您认识拥有越狱手机的人并愿意进行一些测试（并使用不同的越狱进行测试），否则您可能会陷入“它只是崩溃了！”的境地。评论。
（如果它确实崩溃了，那么有人会来破解您的应用程序。在决定是否需要修复之前，最好谨慎并监控“问题”。）
越狱发生的频率比您想象的要高。我已将 MobileSubstrate 检查添加到我们的自动崩溃报告符号脚本中，因为我们在很大一部分崩溃中都看到了它。 OTOH，应用程序安装到 /Applications 中的崩溃比例（这曾经是破解应用程序的传统方式；也许现在不再是了）可以忽略不计。
Last I checked, sandboxed apps can't even
fork(). I'm not sure if they can callexecve(). If they can't do either, then simply callingexecve()ought to work.I'm not sure how much jailbreaking interferes with this. It's possible to have a jailbreak that lets you run un-signed apps from un-signed apps but behaves normally if the caller is signed.
It's obviosuly possible to "package" an executable in a library: Just have
static unsigned char const data [] = { ... };, write it to a file,chmod(), and try to exec it.At the end of the day, though, this may be a disservice to your users. A Jailbroken phone doesn't mean your app has been pirated. Unless you know someone with a jailbroken phone who's willing to do some testing (and testing with different jailbreaks), you might be setting yourself up for "It just crashes!" reviews.
(And if it does crash, then someone will come along and crack your app. It's better to be discreet and monitor the "problem" before deciding whether it needs fixing.)
Jailbreaks happen more often than you think. I've added checks for MobileSubstrate to our automated crash-report-symbolicating script because we've seen it in a significant proportion of crashes. OTOH, the proportion of crashes where the app is installed into /Applications (which used to be traditional for cracked apps; perhaps it isn't anymore) is negligible.
我尝试通过添加项目中的可执行文件来打包 IOS 应用程序中的可执行文件，该项目的 main() 函数仅将整数返回到我的项目。
该文件在部署时复制到手机上，但复制时没有执行权限。
尽管文件所有者与当前用户（移动设备）相同，但尝试 chmod 文件以使其执行会导致“不允许操作”错误。
I have attempted to package an executable in an IOS app by adding the executable file from a project whose main() function simply returns an integer to my project.
This file is copied onto the phone when deploying, but is copied without execute permissions.
Attempting to chmod the file to give it execute results in an "Operation not permitted" error, despite the file owner being the same as the current user (mobile).