Launchd.conf Untether - Revision history

5urd: 5urd moved page Launchd.conf untether to Launchd.conf Untether: capitalization

2015-03-16T15:27:43Z

5urd moved page Launchd.conf untether to Launchd.conf Untether: capitalization

Aker at 18:54, 5 September 2014

2014-09-05T18:54:45Z

Aker: iOS 7 fixed this way of untethering

2014-09-05T18:54:15Z

iOS 7 fixed this way of untethering

Http: initial page

2013-02-15T22:39:09Z

initial page

New page

{{lowercase}}
[[launchd]] is a unified, open-source service management framework for starting, stopping and managing daemons, applications, processes and scripts. As this controls the start of programs, this is a good place to place untether code. But because code needs to be signed, the file cannot simply be patched in order to start software after reboot. But what can be done is to configure this with the launchd.conf file in order to start a program after boot. The vulnerability is that the configuration file does not need to be signed.

<code>launchd.conf</code> in [[evasi0n]]:
bsexec .. /sbin/mount -u -o rw,suid,dev /
setenv DYLD_INSERT_LIBRARIES /private/var/evasi0n/amfi.dylib
load /System/Library/LaunchDaemons/com.apple.MobileFileIntegrity.plist
bsexec .. /private/var/evasi0n/evasi0n
unsetenv DYLD_INSERT_LIBRARIES
bsexec .. /bin/rm -f /private/var/evasi0n/sock
bsexec .. /bin/ln -f /var/tmp/launchd/sock /private/var/evasi0n/sock

=== External Links ===
*[[wikipedia:Launchd|launchd on Wikipedia]]

[[Category:Exploits]]

@@ Line 2: / Line 2: @@
 [[launchd]] is a unified, open-source service management framework for starting, stopping and managing daemons, applications, processes and scripts. As this controls the start of programs, this is a good place to place untether code. But because code needs to be signed, the file cannot simply be patched in order to start software after reboot. But what can be done is to configure this with the launchd.conf file in order to start a program after boot. The vulnerability is that the configuration file does not need to be signed.
-Apple fixed this in iOS 7 by adding a __RESTRICT segment to amfid, which prevents dylibs from hooking into it.
+Apple fixed this in iOS 7 by adding a <code>__RESTRICT</code> segment to amfid, which prevents dylibs from hooking into it.
 <code>launchd.conf</code> in [[evasi0n]]:

← Older revision	Revision as of 15:27, 16 March 2015
(No difference)