-
Notifications
You must be signed in to change notification settings - Fork 11
/
Copy pathmain.m
155 lines (128 loc) · 3.72 KB
/
main.m
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
#import <UIKit/UIKit.h>
#include <mach/mach.h>
#include <sys/mount.h>
//Don't try to patch/hook me, it's a Kids's trick!
void detect_rootlessJB()
{
if(access("/var/JB", F_OK)==0) {
NSLog(@"rootless JB found!");
}
if(access("/var/containers/Bundle/dylib", F_OK)==0) {
NSLog(@"xina JB found!");
}
}
void detect_kernBypass()
{
if(access("/private/var/MobileSoftwareUpdate/mnt1/System", F_OK)==0)
{
NSLog(@"kernBypass installed!");
}
}
void detect_chroot()
{
struct statfs s={0};
statfs("/", &s);
if(strcmp("/", s.f_mntonname)!=0) {
NSLog(@"chroot found! %s", s.f_mntonname);
}
}
void detect_mount_fs()
{
struct statfs * ss=NULL;
int n = getmntinfo(&ss, 0);
for(int i=0; i<n; i++) {
//printf("mount %s %s : %s\n", ss[i].f_fstypename, ss[i].f_mntonname, ss[i].f_mntfromname);
if(strcmp("/", ss[i].f_mntonname)!=0 && strstr(ss[i].f_mntfromname, "@")!=NULL) {
NSLog(@"unexcept snap mount! %s => %s", ss[i].f_mntfromname, ss[i].f_mntonname);
}
for(int j=0; j<i; j++) {
if(strcmp(ss[i].f_mntfromname, ss[j].f_mntfromname)==0) {
NSLog(@"double mount: %s", ss[i].f_mntfromname);
}
}
}
}
void detect_bootstraps()
{
if(access("/var/log/apt", F_OK)==0) {
NSLog(@"apt log found!");
}
if(access("/var/log/dpkg", F_OK)==0) {
NSLog(@"dpkg log found!");
}
if(access("/var/lib/dpkg", F_OK)==0) {
NSLog(@"dpkg found!");
}
if(access("/var/lib/apt", F_OK)==0) {
NSLog(@"apt found!");
}
if(access("/var/lib/cydia", F_OK)==0) {
NSLog(@"cydia found!");
}
if(access("/var/lib/undecimus", F_OK)==0) {
NSLog(@"unc0ver found!");
}
}
void detect_trollStoredFilza()
{
if(access("/var/lib/filza", F_OK)==0) {
NSLog(@"trollStoredFilza found!");
}
if(access("/var/mobile/Library/Filza", F_OK)==0) {
NSLog(@"trollStoredFilza found!");
}
}
kern_return_t bootstrap_look_up(mach_port_t bp, const char* service_name, mach_port_t *sp);
static mach_port_t connect_mach_service(const char *name) {
mach_port_t port = MACH_PORT_NULL;
kern_return_t kr = bootstrap_look_up(bootstrap_port, (char *)name, &port);
return port;
}
void detect_jailbreakd()
{
if(connect_mach_service("cy:com.saurik.substrated")) {
NSLog(@"substrated found!");
}
if(connect_mach_service("org.coolstar.jailbreakd")) {
NSLog(@"coolstar jb found!");
}
}
int csops(pid_t pid, unsigned int ops, void * useraddr, size_t usersize);
void detect_proc_flags()
{
uint32_t flags = 0;
csops(getpid(), 0, &flags, 0);
//NSLog(@"csops=%08X", flags); //22003305/lldb32003004=>3600700D, 22003305/lldb32003005
if(flags & 0x00000004) {
NSLog(@"get-task-allow found!");
}
if(flags & 0x04000000) {
NSLog(@"unexcept platform binary!");
}
if(flags & 0x00000008) {
NSLog(@"unexcept installer!");
}
if(flags & 0x00004000) {
NSLog(@"unexcept entitlements!");
}
}
//#import "AppDelegate.h"
int main(int argc, char * argv[])
{
NSLog(@"Don't try to patch/hook me, it's a Kids's trick!");
detect_rootlessJB();
detect_kernBypass();
detect_chroot();
detect_mount_fs();
detect_bootstraps();
detect_trollStoredFilza();
detect_jailbreakd();
detect_proc_flags();
// NSString * appDelegateClassName;
// @autoreleasepool {
// // Setup code that might create autoreleased objects goes here.
// appDelegateClassName = NSStringFromClass([AppDelegate class]);
// }
// return UIApplicationMain(argc, argv, nil, appDelegateClassName);
//
}