iOS逆向----iOS11以后绕过越狱检测

电玩女神 2022-02-01 12:53 840阅读 0赞

当然有手动绕过越狱检测的办法，比如自己利用[Fishhook][]或者OC的runtime机制去替换越狱检测的函数，甚至可以使用frida来Hook函数的返回值。这些都是比较稳妥的方法，本篇文章主要介绍的是自动绕过检测的工具Liberty Lite。

由于之前绕过越狱检测的xCon已经许久不更新，而且在iOS10.3以后的越狱手机上会导致很多APP崩溃。xCon没有白名单机制，因此只要安装就是全局起作用，导致Cydia崩溃后无法通过Cydia卸载该插件。因此有人推出了新的，支持iOS11-iOS13设备的绕过越狱检测的[tweak][]。

首先在Cydia中新增软件源「https://ryleyangus.com/repo/」  
然后在Sources中点击Ryley‘s Repo，点击Tweaks，找到「Liberty Lite」。这里建议安装Liberty Lite Beta版本。

安装好之后会提示Restart SpringBoard。

使用方法：  
进入系统设置->找到Liberty->点击Block Jalibreak Detection->选择需要生效的APP

由于添加了白名单机制，因此比之前的xCon更安全。

## 文件分析 ##

在Cydia中安装完之后，ssh连接手机，然后进入/Library/MobileSubstrate/DynamicLibraries目录下

cd /Library/MobileSubstrate/DynamicLibraries
    ls

![在这里插入图片描述][20190514154721463.png]  
这里会发现Liberty Lite安装了AppList.dylib、PreferenceLoader.dylib、RocketBootstrap.dylib、zzzzLiberty.dylib四个库以及他们各自的plist文件。其中AppList，PreferenceLoader，RocketBootstrap都是跟设置有关的tweak，主要代码在zzzzLiberty中。

我们通过分析zzzzLiberty.plist会发现他依旧是在加载UIKit的时候执行，这一点跟xCon一样：  
![在这里插入图片描述][20190514155311620.png]

同样的，我们利用otool和strings命令，逆向以及获取里面的字符串：

➜  Desktop otool -tV zzzzLiberty.dylib > xCon
    ➜  Desktop strings zzzzLiberty.dylib
    /Applications
    /Applications/
    /Applications/Cydia.app
    /Applications/Cydia.app/
    /Applications/Cydia.app/Cydia
    /Applications/Cydia.app/Info.plist
    /Applications/Cydia.app/../Cydia.app
    /Applications/Cydia.app/../Cydia.app/
    /Applications/Cydia.app/../Cydia.app/Info.plist
    /Applications/FakeCarrier.app
    /Applications/Icy.app
    /Applications/Iny.app
    /Applications/iFile.app
    /Applications/Activator.app
    /Applications/IntelliScreen.app
    /Applications/MxTube.app
    /Applications/RockApp.app
    /Applications/SBSettings.app
    /Applications/WinterBoard.app
    /Applications/blackra1n.app
    /Library/Activator
    /Library/Flipswitch
    /Library/Frameworks/CydiaSubstrate.framework
    /Library/MobileSubstrate
    /Library/MobileSubstrate/DynamicLibraries
    /Library/MobileSubstrate/DynamicLibraries/LiveClock.plist
    /Library/MobileSubstrate/DynamicLibraries/Veency.plist
    /Library/MobileSubstrate/MobileSubstrate.dylib
    /Library/MobileSubstrateMobileSubstrate.dylib
    /Library/Ringtones
    /Library/Switchs
    /Library/Wallpaper
    /System/Library/LaunchDaemons/com.ikey.bbot.plist
    /System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist
    /bin/bash
    /bin/sh
    /bin
    /bin/su
    /etc/apt
    /etc/apt/
    /etc/clutch.conf
    /etc/clutch_cracked.plist
    /etc/ssh/sshd_config
    /private/
    /private
    /private/vstb_writable_check
    /private/etc/fstab
    /private/Miitomo
    /private/var/lib/apt
    /private/var/lib/apt/
    /private/var/lib/cydia
    /private/var/lib/cydia/
    /private/var/tmp/cydia.log
    /private/var/mobile/Library/SBSettings/Themes
    /private/var/mobileLibrary/SBSettingsThemes/
    /private/var/stash
    /private/var/stash/
    /private/var/tmp/Cydia.log
    /usr/arm-apple-darwin9
    /usr/bin/ssh
    /usr/bin/sshd
    /usr/binsshd
    /usr/sbin
    /usr/sbinsshd
    /usr/include
    /usr/lib/pam
    /usr/lib/python2.5
    /usr/libexec
    /usr/libexec/cydia
    /usr/libexec/cydia/
    /usr/libexec/sftp-server
    /usr/libexec/ssh-keysign
    /usr/sbin/sshd
    /usr/share
    /var/cache/apt
    /var/cache/apt/
    /var/cache/clutch.plist
    /var/cache/clutch_cracked.plist
    /var/lib/apt
    /var/lib/apt/
    /var/lib/clutch/overdrive.dylib
    /var/lib/cydia
    /var/lib/cydia/
    /var/lib/dpkg/info
    /var/log/syslog
    /var/root/Documents/Cracked/
    /var/tmp/cydia.log
    /var/stash/Library/Ringstones
    /var/stash/Library/Wallpaper
    /var/stash/usr/include
    /var/stash/usr/libexec
    /var/stash/usr/share
    //Systetem/Library/LaunchDaemons/com.ikey.bbot.plist
    //System/Library/LaunchDaemons/com.saurik.Cy@dia.Startup.plist
    //Library/MobileSubstrate/MobileSubstrate.dylib
    //var/cache/apt/
    //var/lib/apt/
    //var/lib/cydia/
    //var/log/syslog
    //bin/bash
    //bin/sh
    //etc/apt/
    //etc/ssh/sshd_config
    //usr/libexec/ssh-keysign
    Library/MobileSubstrate/MobileSubstrate.dylib
    Applications/Cydia.app
    var/cache/apt
    var/lib/cydia
    var/log/syslog
    var/tmp/cydia.log
    bin/bash
    bin/sh
    usr/sbin/sshd
    usr/libexec/ssh-keysign
    etc/ssh/sshd_config
    etc/apt
    /var/root/.tastest
    /Library/Managed Preferences/mobile/.GlobalPreferences.plist
    /Library/Preferences/com.apple.security.plist
    /private/var/mobile/home/duh
    /etc/rel
    /System/Library/LaunchDaemons/com.apple.period.plist
    /System/Library/LaunchDaemons/com.apple.ksyslog.plist
    /private/var/mobile/home/syslog
    /private/var/mobile/home/sshd
    /Library/MobileSubstrate/DynamicLibraries/sfbase.dylib
    /usr/lib/libsubstrate.dylib
    /usr/bin
    /boot
    /var/root
    /var
    /private/var
    /library/MobileSubstrate/MobileSubstrate.dylib
    /mnt
    /lib
    /panguaxe
    /panguaxe.installed
    /private/var/mobile/Media/panguaxe.installed
    /private/var/lib/dpkg/info/io.pangu.axe7.list
    /private/var/lib/dpkg/info/io.pangu.axe7.prerm
    /System/Library/LaunchDaemons/io.pangu.axe.untether.plist
    /private/var/lib/dpkg/info/taiguntether83x.extrainst_
    /private/var/lib/dpkg/info/taiguntether83x.list
    /private/var/lib/dpkg/info/taiguntether83x.preinst
    /private/var/lib/dpkg/info/taiguntether83x.prerm
    /taig/
    /taig/taig
    /private/var/lib/dpkg/info/io.pangu.fuxiqin9.list
    /private/var/lib/dpkg/info/io.pangu.fuxiqin9.prerm
    /pguntether
    /var/stash/
    /var/stash
    /private/var/cache/apt/
    /private/var/log/syslog
    /private/etc/apt/
    /private/etc/ssh/sshd_config
    /var/mobile/Library/Application Support/Flex3/patches.plist
    /private/etc/dpkg/origins/debian
    /bin/gunzip
    /bin/gzip
    /bin/tar
    /Library/MobileSubstrate/DynamicLibraries/
    /usr
    /private/var/cache/apt
    /etc/fstab
    /bin/ps
    /Systetem/Library/LaunchDaemons/com.ikey.bbot.plist
    /Library/MobileSubstrate/DynamicLibraries/xCon.dylib
    /usr/lib/TsProtePass.dylib
    /var/stash/Library/Ringtones
    /var/stash/usr/arm-apple-darwin9
    /private/masbog.txt
    usr/bin/cycript
    usr/bin/cynject
    usr/sbin/frida-server
    /private/var/db/stash/
    /var/tmp//ct.shutdown
    /var/tmp/ct.shutdown
    /var/tmp//cydia.log
    /var/tmp//pgloader
    /var/tmp/pgloader
    /var/tmp/
    /var/tmp//.pangu93loaded
    /var/tmp/.pangu93loaded
    /var/tmp//RestoreFromBackupLock
    /var/tmp/RestoreFromBackupLock
    /Library/LaunchDaemons/com.openssh.sshd.plist
    /private/var/db/stash
    /bin/mv
    /private/jailbreak.txt
    /Library/MobileSubstrate/
    var/lib/apt
    /private/var/TestPB16.file
    /etc/TestPB16.file
    /Applications/TestPB16.file
    /System/Library/Caches/com.apple.dyld/enable-dylibs-to-override-cache
    /usr/lib/libmis.dylib
    /usr/lib/pangu_xpcd.dylib
    /System/Library/LaunchDaemons/io.pangu.untether.plist
    /xuanyuansword
    /xuanyuansword.installed
    /evasi0n7
    /System/Library/LaunchDaemons/com.evad3rs.evasi0n7.untether.plist
    /System/Library/Caches/com.apple.xpcd/xpcd_cache.dylib
    /usr/lib/libpatcyh.dylib
    /usr/share/bigboss/icons/bigboss.png
    /Library/MobileSubstrate/DynamicLibraries/tsProtector.dylib
    /Library/PreferenceBundles/tsProtectorSettings.bundle
    /Library/PreferenceLoader/Preferences/tsProtectorSettings.plist
    /private/var/lib/xcon
    /Library/MobileSubstrate/DynamicLibraries/MobileSafety.dylib
    /.cydia_no_stash
    /private/var/log/apt/term.log
    /Library/LaunchDaemons/re.frida.server.plist
    /usr/sbin/frida-server
    /sbin/reboot
    /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate
    /etc/ssh
    Applications
    Library/MobileSubstrate
    Library/MobileSubstrate/DynamicLibraries
    System/Library/LaunchDaemons
    private/var/lib
    private/var/mobile/Library/SBSettings
    private/var/tmp
    var/cache
    var/lib
    usr/sbin
    usr/bin
    usr/libexec
    etc/ssh
    var/tmp
    var/log
    Library/Frameworks
    /User/Library/Cydia
    /private/var/evasi0n
    DYLD_INSERT_LIBRARIES
    NSString
    UIApplication
    QPLibraryConfiguration
    HSBCRASPServices
    ShieldObserver
    Citibank.CBMSecurityCheck
    IPDKBAppDelegate
    SFBShieldDelegate
    GLMOBUtilities
    NSJSONSerialization
    access
    CFBundleGetAllBundles
    dlopen
    dlsym
    _dyld_image_count
    fopen
    fork
    getenv
    lstat
    open
    opendir
    stat
    statfs
    symlink
    sysctl
    sysctlbyname
    system
    vfork
    _dyld_get_image_name
    CFNotificationCenterPostNotification
    MSHookFunction
    MSFindSymbol
    _TasDraRecalcRiskAssessment
    _TasDraGetRiskItemCount
    _TasDraGetRiskAssessmentItemByName
    _TasDraGetRiskAssessmentItemByIndex
    ProtectionScreen
    HookFound
    JailbreakFound
    com.yoti.mobile.ios.live
    ubstrate
    /var/mobile
    /var/mobile/
    MobileSubstrate.dylib
    UniversalVideoDownloader.dylib
    Cydia
    NSMutableDictionary
    NSMutableArray
    policyValue
    bypass
    policyName
    com.uob.
    com.nintendo.
    REQUIRE_SECURE_DEVICE
    filza
    activator
    ifile
    cydia
    /private/var/mobile/Applications
    /private/var/mobile/Containers
    Liberty-%@
    com.ryleyangus.libertyenabledchanged
    com.ryleyangus.libertyprefchanged
    Hit loading Liberty Lite into %@ - (C) Ryley Angus, 2016-18. No warranty provided.
    EnableLiberty
    /var/mobile/Library/Preferences/com.ryleyangus.libertylite.plist
    /var/containers/Bundle/Application/
    /var/mobile/Containers/Bundle/Application/
    __LINKEDIT
    __DATA
    __DATA_CONST
    isEqualToString:
    processInfo
    instancesRespondToSelector:
    isOperatingSystemAtLeastVersion:
    release
    removeObjectsInArray:
    count
    rangeOfString:
    addObject:
    countByEnumeratingWithState:objects:count:
    init
    alloc
    arrayWithArray:
    intValue
    objectAtIndex:
    numberWithInt:
    setObject:forKey:
    allKeys
    isSubclassOfClass:
    class
    JSONObjectWithData:options:error:
    getJailBrokenDeviceInfoDict
    jailbreakAction
    shieldDelegateDidDetectJailbreak:
    shieldDelegateDidDetectLibraryInjection:
    postNotification:value:
    repackagingStatus:
    debuggerStatus:
    libraryInjectionDetected
    handleLibraryInjectionDetected
    jailbreakStatus:
    numberWithBool:
    runtimeConfigurationValueForKey:
    rangeOfString:options:
    canOpenURL:
    openURL:
    stringByDeletingLastPathComponent
    writeToFile:atomically:encoding:error:
    stringWithFormat:
    retain
    bundleIdentifier
    boolValue
    objectForKey:
    dictionaryWithContentsOfFile:
    containsString:
    absoluteString
    executableURL
    mainBundle
    /Applications
    /Applications/
    /Applications/Cydia.app
    /Applications/Cydia.app/
    /Applications/Cydia.app/Cydia
    /Applications/Cydia.app/Info.plist
    /Applications/Cydia.app/../Cydia.app
    /Applications/Cydia.app/../Cydia.app/
    /Applications/Cydia.app/../Cydia.app/Info.plist
    /Applications/FakeCarrier.app
    /Applications/Icy.app
    /Applications/Iny.app
    /Applications/iFile.app
    /Applications/Activator.app
    /Applications/IntelliScreen.app
    /Applications/MxTube.app
    /Applications/RockApp.app
    /Applications/SBSettings.app
    /Applications/WinterBoard.app
    /Applications/blackra1n.app
    /Library/Activator
    /Library/Flipswitch
    /Library/Frameworks/CydiaSubstrate.framework
    /Library/MobileSubstrate
    /Library/MobileSubstrate/DynamicLibraries
    /Library/MobileSubstrate/DynamicLibraries/LiveClock.plist
    /Library/MobileSubstrate/DynamicLibraries/Veency.plist
    /Library/MobileSubstrate/MobileSubstrate.dylib
    /Library/MobileSubstrateMobileSubstrate.dylib
    /Library/Ringtones
    /Library/Switchs
    /Library/Wallpaper
    /System/Library/LaunchDaemons/com.ikey.bbot.plist
    /System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist
    /bin/bash
    /bin/sh
    /bin
    /bin/su
    /etc/apt
    /etc/apt/
    /etc/clutch.conf
    /etc/clutch_cracked.plist
    /etc/ssh/sshd_config
    /private/
    /private
    /private/vstb_writable_check
    /private/etc/fstab
    /private/Miitomo
    /private/var/lib/apt
    /private/var/lib/apt/
    /private/var/lib/cydia
    /private/var/lib/cydia/
    /private/var/tmp/cydia.log
    /private/var/mobile/Library/SBSettings/Themes
    /private/var/mobileLibrary/SBSettingsThemes/
    /private/var/stash
    /private/var/stash/
    /private/var/tmp/Cydia.log
    /usr/arm-apple-darwin9
    /usr/bin/ssh
    /usr/bin/sshd
    /usr/binsshd
    /usr/sbin
    /usr/sbinsshd
    /usr/include
    /usr/lib/pam
    /usr/lib/python2.5
    /usr/libexec
    /usr/libexec/cydia
    /usr/libexec/cydia/
    /usr/libexec/sftp-server
    /usr/libexec/ssh-keysign
    /usr/sbin/sshd
    /usr/share
    /var/cache/apt
    /var/cache/apt/
    /var/cache/clutch.plist
    /var/cache/clutch_cracked.plist
    /var/lib/apt
    /var/lib/apt/
    /var/lib/clutch/overdrive.dylib
    /var/lib/cydia
    /var/lib/cydia/
    /var/lib/dpkg/info
    /var/log/syslog
    /var/root/Documents/Cracked/
    /var/tmp/cydia.log
    /var/stash/Library/Ringstones
    /var/stash/Library/Wallpaper
    /var/stash/usr/include
    /var/stash/usr/libexec
    /var/stash/usr/share
    //Systetem/Library/LaunchDaemons/com.ikey.bbot.plist
    //System/Library/LaunchDaemons/com.saurik.Cy@dia.Startup.plist
    //Library/MobileSubstrate/MobileSubstrate.dylib
    //var/cache/apt/
    //var/lib/apt/
    //var/lib/cydia/
    //var/log/syslog
    //bin/bash
    //bin/sh
    //etc/apt/
    //etc/ssh/sshd_config
    //usr/libexec/ssh-keysign
    Library/MobileSubstrate/MobileSubstrate.dylib
    Applications/Cydia.app
    var/cache/apt
    var/lib/cydia
    var/log/syslog
    var/tmp/cydia.log
    bin/bash
    bin/sh
    usr/sbin/sshd
    usr/libexec/ssh-keysign
    etc/ssh/sshd_config
    etc/apt
    /var/root/.tastest
    /Library/Managed Preferences/mobile/.GlobalPreferences.plist
    /Library/Preferences/com.apple.security.plist
    /private/var/mobile/home/duh
    /etc/rel
    /System/Library/LaunchDaemons/com.apple.period.plist
    /System/Library/LaunchDaemons/com.apple.ksyslog.plist
    /private/var/mobile/home/syslog
    /private/var/mobile/home/sshd
    /Library/MobileSubstrate/DynamicLibraries/sfbase.dylib
    /usr/lib/libsubstrate.dylib
    /usr/bin
    /boot
    /var/root
    /var
    /private/var
    /library/MobileSubstrate/MobileSubstrate.dylib
    /mnt
    /lib
    /panguaxe
    /panguaxe.installed
    /private/var/mobile/Media/panguaxe.installed
    /private/var/lib/dpkg/info/io.pangu.axe7.list
    /private/var/lib/dpkg/info/io.pangu.axe7.prerm
    /System/Library/LaunchDaemons/io.pangu.axe.untether.plist
    /private/var/lib/dpkg/info/taiguntether83x.extrainst_
    /private/var/lib/dpkg/info/taiguntether83x.list
    /private/var/lib/dpkg/info/taiguntether83x.preinst
    /private/var/lib/dpkg/info/taiguntether83x.prerm
    /taig/
    /taig/taig
    /private/var/lib/dpkg/info/io.pangu.fuxiqin9.list
    /private/var/lib/dpkg/info/io.pangu.fuxiqin9.prerm
    /pguntether
    /var/stash/
    /var/stash
    /private/var/cache/apt/
    /private/var/log/syslog
    /private/etc/apt/
    /private/etc/ssh/sshd_config
    /var/mobile/Library/Application Support/Flex3/patches.plist
    /private/etc/dpkg/origins/debian
    /bin/gunzip
    /bin/gzip
    /bin/tar
    /Library/MobileSubstrate/DynamicLibraries/
    /usr
    /private/var/cache/apt
    /etc/fstab
    /bin/ps
    /Systetem/Library/LaunchDaemons/com.ikey.bbot.plist
    /Library/MobileSubstrate/DynamicLibraries/xCon.dylib
    /usr/lib/TsProtePass.dylib
    /var/stash/Library/Ringtones
    /var/stash/usr/arm-apple-darwin9
    /private/masbog.txt
    usr/bin/cycript
    usr/bin/cynject
    usr/sbin/frida-server
    /private/var/db/stash/
    /var/tmp//ct.shutdown
    /var/tmp/ct.shutdown
    /var/tmp//cydia.log
    /var/tmp//pgloader
    /var/tmp/pgloader
    /var/tmp/
    /var/tmp//.pangu93loaded
    /var/tmp/.pangu93loaded
    /var/tmp//RestoreFromBackupLock
    /var/tmp/RestoreFromBackupLock
    /Library/LaunchDaemons/com.openssh.sshd.plist
    /private/var/db/stash
    /bin/mv
    /private/jailbreak.txt
    /Library/MobileSubstrate/
    var/lib/apt
    /private/var/TestPB16.file
    /etc/TestPB16.file
    /Applications/TestPB16.file
    /System/Library/Caches/com.apple.dyld/enable-dylibs-to-override-cache
    /usr/lib/libmis.dylib
    /usr/lib/pangu_xpcd.dylib
    /System/Library/LaunchDaemons/io.pangu.untether.plist
    /xuanyuansword
    /xuanyuansword.installed
    /evasi0n7
    /System/Library/LaunchDaemons/com.evad3rs.evasi0n7.untether.plist
    /System/Library/Caches/com.apple.xpcd/xpcd_cache.dylib
    /usr/lib/libpatcyh.dylib
    /usr/share/bigboss/icons/bigboss.png
    /Library/MobileSubstrate/DynamicLibraries/tsProtector.dylib
    /Library/PreferenceBundles/tsProtectorSettings.bundle
    /Library/PreferenceLoader/Preferences/tsProtectorSettings.plist
    /private/var/lib/xcon
    /Library/MobileSubstrate/DynamicLibraries/MobileSafety.dylib
    /.cydia_no_stash
    /private/var/log/apt/term.log
    /Library/LaunchDaemons/re.frida.server.plist
    /usr/sbin/frida-server
    /sbin/reboot
    /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate
    /etc/ssh
    Applications
    Library/MobileSubstrate
    Library/MobileSubstrate/DynamicLibraries
    System/Library/LaunchDaemons
    private/var/lib
    private/var/mobile/Library/SBSettings
    private/var/tmp
    var/cache
    var/lib
    usr/sbin
    usr/bin
    usr/libexec
    etc/ssh
    var/tmp
    var/log
    Library/Frameworks
    /User/Library/Cydia
    /private/var/evasi0n
    DYLD_INSERT_LIBRARIES
    NSString
    UIApplication
    QPLibraryConfiguration
    HSBCRASPServices
    ShieldObserver
    Citibank.CBMSecurityCheck
    IPDKBAppDelegate
    SFBShieldDelegate
    GLMOBUtilities
    NSJSONSerialization
    access
    CFBundleGetAllBundles
    dlopen
    dlsym
    _dyld_image_count
    fopen
    fork
    getenv
    lstat
    open
    opendir
    stat
    statfs
    symlink
    sysctl
    sysctlbyname
    system
    vfork
    _dyld_get_image_name
    CFNotificationCenterPostNotification
    MSHookFunction
    MSFindSymbol
    _TasDraRecalcRiskAssessment
    _TasDraGetRiskItemCount
    _TasDraGetRiskAssessmentItemByName
    _TasDraGetRiskAssessmentItemByIndex
    ProtectionScreen
    HookFound
    JailbreakFound
    com.yoti.mobile.ios.live
    ubstrate
    /var/mobile
    /var/mobile/
    MobileSubstrate.dylib
    UniversalVideoDownloader.dylib
    Cydia
    NSMutableDictionary
    NSMutableArray
    policyValue
    bypass
    policyName
    com.uob.
    com.nintendo.
    REQUIRE_SECURE_DEVICE
    filza
    activator
    ifile
    cydia
    /private/var/mobile/Applications
    /private/var/mobile/Containers
    Liberty-%@
    com.ryleyangus.libertyenabledchanged
    com.ryleyangus.libertyprefchanged
    Hit loading Liberty Lite into %@ - (C) Ryley Angus, 2016-18. No warranty provided.
    EnableLiberty
    /var/mobile/Library/Preferences/com.ryleyangus.libertylite.plist
    /var/containers/Bundle/Application/
    /var/mobile/Containers/Bundle/Application/
    __LINKEDIT
    __DATA
    __DATA_CONST
    isEqualToString:
    processInfo
    instancesRespondToSelector:
    isOperatingSystemAtLeastVersion:
    release
    removeObjectsInArray:
    count
    rangeOfString:
    addObject:
    countByEnumeratingWithState:objects:count:
    init
    alloc
    arrayWithArray:
    intValue
    objectAtIndex:
    numberWithInt:
    setObject:forKey:
    allKeys
    isSubclassOfClass:
    class
    JSONObjectWithData:options:error:
    getJailBrokenDeviceInfoDict
    jailbreakAction
    shieldDelegateDidDetectJailbreak:
    shieldDelegateDidDetectLibraryInjection:
    postNotification:value:
    repackagingStatus:
    debuggerStatus:
    libraryInjectionDetected
    handleLibraryInjectionDetected
    jailbreakStatus:
    numberWithBool:
    runtimeConfigurationValueForKey:
    rangeOfString:options:
    canOpenURL:
    openURL:
    stringByDeletingLastPathComponent
    writeToFile:atomically:encoding:error:
    stringWithFormat:
    retain
    bundleIdentifier
    boolValue
    objectForKey:
    dictionaryWithContentsOfFile:
    containsString:
    absoluteString
    executableURL
    mainBundle
    /Applications
    /Applications/
    /Applications/Cydia.app
    /Applications/Cydia.app/
    /Applications/Cydia.app/Cydia
    /Applications/Cydia.app/Info.plist
    /Applications/Cydia.app/../Cydia.app
    /Applications/Cydia.app/../Cydia.app/
    /Applications/Cydia.app/../Cydia.app/Info.plist
    /Applications/FakeCarrier.app
    /Applications/Icy.app
    /Applications/Iny.app
    /Applications/iFile.app
    /Applications/Activator.app
    /Applications/IntelliScreen.app
    /Applications/MxTube.app
    /Applications/RockApp.app
    /Applications/SBSettings.app
    /Applications/WinterBoard.app
    /Applications/blackra1n.app
    /Library/Activator
    /Library/Flipswitch
    /Library/Frameworks/CydiaSubstrate.framework
    /Library/MobileSubstrate
    /Library/MobileSubstrate/DynamicLibraries
    /Library/MobileSubstrate/DynamicLibraries/LiveClock.plist
    /Library/MobileSubstrate/DynamicLibraries/Veency.plist
    /Library/MobileSubstrate/MobileSubstrate.dylib
    /Library/MobileSubstrateMobileSubstrate.dylib
    /Library/Ringtones
    /Library/Switchs
    /Library/Wallpaper
    /System/Library/LaunchDaemons/com.ikey.bbot.plist
    /System/Library/LaunchDaemons/com.saurik.Cydia.Startup.plist
    /bin/bash
    /bin/sh
    /bin
    /bin/su
    /etc/apt
    /etc/apt/
    /etc/clutch.conf
    /etc/clutch_cracked.plist
    /etc/ssh/sshd_config
    /private/
    /private
    /private/vstb_writable_check
    /private/etc/fstab
    /private/Miitomo
    /private/var/lib/apt
    /private/var/lib/apt/
    /private/var/lib/cydia
    /private/var/lib/cydia/
    /private/var/tmp/cydia.log
    /private/var/mobile/Library/SBSettings/Themes
    /private/var/mobileLibrary/SBSettingsThemes/
    /private/var/stash
    /private/var/stash/
    /private/var/tmp/Cydia.log
    /usr/arm-apple-darwin9
    /usr/bin/ssh
    /usr/bin/sshd
    /usr/binsshd
    /usr/sbin
    /usr/sbinsshd
    /usr/include
    /usr/lib/pam
    /usr/lib/python2.5
    /usr/libexec
    /usr/libexec/cydia
    /usr/libexec/cydia/
    /usr/libexec/sftp-server
    /usr/libexec/ssh-keysign
    /usr/sbin/sshd
    /usr/share
    /var/cache/apt
    /var/cache/apt/
    /var/cache/clutch.plist
    /var/cache/clutch_cracked.plist
    /var/lib/apt
    /var/lib/apt/
    /var/lib/clutch/overdrive.dylib
    /var/lib/cydia
    /var/lib/cydia/
    /var/lib/dpkg/info
    /var/log/syslog
    /var/root/Documents/Cracked/
    /var/tmp/cydia.log
    /var/stash/Library/Ringstones
    /var/stash/Library/Wallpaper
    /var/stash/usr/include
    /var/stash/usr/libexec
    /var/stash/usr/share
    //Systetem/Library/LaunchDaemons/com.ikey.bbot.plist
    //System/Library/LaunchDaemons/com.saurik.Cy@dia.Startup.plist
    //Library/MobileSubstrate/MobileSubstrate.dylib
    //var/cache/apt/
    //var/lib/apt/
    //var/lib/cydia/
    //var/log/syslog
    //bin/bash
    //bin/sh
    //etc/apt/
    //etc/ssh/sshd_config
    //usr/libexec/ssh-keysign
    Library/MobileSubstrate/MobileSubstrate.dylib
    Applications/Cydia.app
    var/cache/apt
    var/lib/cydia
    var/log/syslog
    var/tmp/cydia.log
    bin/bash
    bin/sh
    usr/sbin/sshd
    usr/libexec/ssh-keysign
    etc/ssh/sshd_config
    etc/apt
    /var/root/.tastest
    /Library/Managed Preferences/mobile/.GlobalPreferences.plist
    /Library/Preferences/com.apple.security.plist
    /private/var/mobile/home/duh
    /etc/rel
    /System/Library/LaunchDaemons/com.apple.period.plist
    /System/Library/LaunchDaemons/com.apple.ksyslog.plist
    /private/var/mobile/home/syslog
    /private/var/mobile/home/sshd
    /Library/MobileSubstrate/DynamicLibraries/sfbase.dylib
    /usr/lib/libsubstrate.dylib
    /usr/bin
    /boot
    /var/root
    /var
    /private/var
    /library/MobileSubstrate/MobileSubstrate.dylib
    /mnt
    /lib
    /panguaxe
    /panguaxe.installed
    /private/var/mobile/Media/panguaxe.installed
    /private/var/lib/dpkg/info/io.pangu.axe7.list
    /private/var/lib/dpkg/info/io.pangu.axe7.prerm
    /System/Library/LaunchDaemons/io.pangu.axe.untether.plist
    /private/var/lib/dpkg/info/taiguntether83x.extrainst_
    /private/var/lib/dpkg/info/taiguntether83x.list
    /private/var/lib/dpkg/info/taiguntether83x.preinst
    /private/var/lib/dpkg/info/taiguntether83x.prerm
    /taig/
    /taig/taig
    /private/var/lib/dpkg/info/io.pangu.fuxiqin9.list
    /private/var/lib/dpkg/info/io.pangu.fuxiqin9.prerm
    /pguntether
    /var/stash/
    /var/stash
    /private/var/cache/apt/
    /private/var/log/syslog
    /private/etc/apt/
    /private/etc/ssh/sshd_config
    /var/mobile/Library/Application Support/Flex3/patches.plist
    /private/etc/dpkg/origins/debian
    /bin/gunzip
    /bin/gzip
    /bin/tar
    /Library/MobileSubstrate/DynamicLibraries/
    /usr
    /private/var/cache/apt
    /etc/fstab
    /bin/ps
    /Systetem/Library/LaunchDaemons/com.ikey.bbot.plist
    /Library/MobileSubstrate/DynamicLibraries/xCon.dylib
    /usr/lib/TsProtePass.dylib
    /var/stash/Library/Ringtones
    /var/stash/usr/arm-apple-darwin9
    /private/masbog.txt
    usr/bin/cycript
    usr/bin/cynject
    usr/sbin/frida-server
    /private/var/db/stash/
    /var/tmp//ct.shutdown
    /var/tmp/ct.shutdown
    /var/tmp//cydia.log
    /var/tmp//pgloader
    /var/tmp/pgloader
    /var/tmp/
    /var/tmp//.pangu93loaded
    /var/tmp/.pangu93loaded
    /var/tmp//RestoreFromBackupLock
    /var/tmp/RestoreFromBackupLock
    /Library/LaunchDaemons/com.openssh.sshd.plist
    /private/var/db/stash
    /bin/mv
    /private/jailbreak.txt
    /Library/MobileSubstrate/
    var/lib/apt
    /private/var/TestPB16.file
    /etc/TestPB16.file
    /Applications/TestPB16.file
    /System/Library/Caches/com.apple.dyld/enable-dylibs-to-override-cache
    /usr/lib/libmis.dylib
    /usr/lib/pangu_xpcd.dylib
    /System/Library/LaunchDaemons/io.pangu.untether.plist
    /xuanyuansword
    /xuanyuansword.installed
    /evasi0n7
    /System/Library/LaunchDaemons/com.evad3rs.evasi0n7.untether.plist
    /System/Library/Caches/com.apple.xpcd/xpcd_cache.dylib
    /usr/lib/libpatcyh.dylib
    /usr/share/bigboss/icons/bigboss.png
    /Library/MobileSubstrate/DynamicLibraries/tsProtector.dylib
    /Library/PreferenceBundles/tsProtectorSettings.bundle
    /Library/PreferenceLoader/Preferences/tsProtectorSettings.plist
    /private/var/lib/xcon
    /Library/MobileSubstrate/DynamicLibraries/MobileSafety.dylib
    /.cydia_no_stash
    /private/var/log/apt/term.log
    /Library/LaunchDaemons/re.frida.server.plist
    /usr/sbin/frida-server
    /sbin/reboot
    /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate
    /etc/ssh
    Applications
    Library/MobileSubstrate
    Library/MobileSubstrate/DynamicLibraries
    System/Library/LaunchDaemons
    private/var/lib
    private/var/mobile/Library/SBSettings
    private/var/tmp
    var/cache
    var/lib
    usr/sbin
    usr/bin
    usr/libexec
    etc/ssh
    var/tmp
    var/log
    Library/Frameworks
    /User/Library/Cydia
    /private/var/evasi0n
    DYLD_INSERT_LIBRARIES
    MSHookFunction
    NSString
    UIApplication
    QPLibraryConfiguration
    HSBCRASPServices
    ShieldObserver
    Citibank.CBMSecurityCheck
    IPDKBAppDelegate
    SFBShieldDelegate
    GLMOBUtilities
    NSJSONSerialization
    access
    CFBundleGetAllBundles
    dlopen
    dlsym
    _dyld_image_count
    fopen
    fork
    getenv
    lstat
    open
    opendir
    stat
    statfs
    symlink
    sysctl
    sysctlbyname
    system
    vfork
    _dyld_get_image_name
    CFNotificationCenterPostNotification
    MSFindSymbol
    _TasDraRecalcRiskAssessment
    _TasDraGetRiskItemCount
    _TasDraGetRiskAssessmentItemByName
    _TasDraGetRiskAssessmentItemByIndex
    ProtectionScreen
    HookFound
    JailbreakFound
    com.yoti.mobile.ios.live
    ubstrate
    /var/mobile
    /var/mobile/
    MobileSubstrate.dylib
    UniversalVideoDownloader.dylib
    Cydia
    NSMutableDictionary
    NSMutableArray
    policyValue
    bypass
    policyName
    com.uob.
    com.nintendo.
    REQUIRE_SECURE_DEVICE
    filza
    activator
    ifile
    cydia
    /private/var/mobile/Applications
    /private/var/mobile/Containers
    pokemongo
    0.109.2
    0.107.1
    0.105.1
    0.105.0
    0.103.5
    0.103.3
    0.101.1
    0.99.2
    0.97.2
    CFBundleShortVersionString
    com.nianticlabs.pokemongo
    Liberty-%@
    com.ryleyangus.libertyenabledchanged
    com.ryleyangus.libertyprefchanged
    Hit loading Liberty Lite into %@ - (C) Ryley Angus, 2016-18. No warranty provided.
    EnableLiberty
    /var/mobile/Library/Preferences/com.ryleyangus.libertylite.plist
    /var/containers/Bundle/Application/
    /var/mobile/Containers/Bundle/Application/
    __LINKEDIT
    __DATA
    __DATA_CONST
    processInfo
    instancesRespondToSelector:
    isOperatingSystemAtLeastVersion:
    release
    removeObjectsInArray:
    count
    addObject:
    rangeOfString:
    countByEnumeratingWithState:objects:count:
    init
    alloc
    arrayWithArray:
    intValue
    objectAtIndex:
    numberWithInt:
    setObject:forKey:
    allKeys
    isSubclassOfClass:
    class
    JSONObjectWithData:options:error:
    getJailBrokenDeviceInfoDict
    jailbreakAction
    shieldDelegateDidDetectJailbreak:
    shieldDelegateDidDetectLibraryInjection:
    postNotification:value:
    repackagingStatus:
    debuggerStatus:
    libraryInjectionDetected
    handleLibraryInjectionDetected
    jailbreakStatus:
    numberWithBool:
    runtimeConfigurationValueForKey:
    rangeOfString:options:
    canOpenURL:
    openURL:
    stringByDeletingLastPathComponent
    writeToFile:atomically:encoding:error:
    lastPathComponent
    valueForKey:
    infoDictionary
    isEqualToString:
    stringWithFormat:
    retain
    bundleIdentifier
    boolValue
    objectForKey:
    dictionaryWithContentsOfFile:
    containsString:
    absoluteString
    executableURL
    mainBundle

我们发现这里跟xCon惊人的相似。。。毕竟检测越狱就这么多手段。

[Fishhook]: https://github.com/facebook/fishhook
[tweak]: https://www.pandahelp.vip/blog/what-are-jailbreak-detection-bypass-tweaks-for-banking-apps-2/
[20190514154721463.png]: /images/20220201/5411251624a749adabebaa03e75024bb.png
[20190514155311620.png]: /images/20220201/ab3ef0e8f9c5462e9082dc5c1565e0ff.png