Skip to content

added generic iss jb checks #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Xplo8E wants to merge 1 commit into
base: master
Choose a base branch
from
Open

added generic iss jb checks #3

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 33 additions & 2 deletions Shadow.dylib/hooks/dyld.x
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,11 +43,42 @@ static intptr_t replaced_dyld_get_image_vmaddr_slide(uint32_t image_index) {
static const char* (*original_dyld_get_image_name)(uint32_t image_index);
static const char* replaced_dyld_get_image_name(uint32_t image_index) {
if(isCallerTweak()) {
return original_dyld_get_image_name(image_index);
const char* name = original_dyld_get_image_name(image_index);
// NSLog(@"[Shadow Debug] Tweak caller - Image name for index %d: %s", image_index, name ? name : "NULL");
return name;
}

NSArray* _dyld_collection = [_shdw_dyld_collection copy];
return image_index < [_dyld_collection count] ? [_dyld_collection[image_index][@"name"] fileSystemRepresentation] : NULL;
const char* originalName = original_dyld_get_image_name(image_index);

// Check if the original name contains any suspicious strings
if (originalName) {
NSString* imagePath = @(originalName);
NSArray* suspiciousLibraries = @[
@"systemhook.dylib", @"SubstrateLoader.dylib", @"SSLKillSwitch2.dylib",
@"SSLKillSwitch.dylib", @"MobileSubstrate.dylib", @"TweakInject.dylib",
@"CydiaSubstrate", @"cynject", @"CustomWidgetIcons", @"PreferenceLoader",
@"RocketBootstrap", @"WeeLoader", @"/.file", @"libhooker",
@"SubstrateInserter", @"SubstrateBootstrap", @"ABypass", @"FlyJB",
@"Substitute", @"Cephei", @"Electra", @"AppSyncUnified-FrontBoard.dylib",
@"Shadow", @"FridaGadget", @"frida", @"libcycript"
];

for (NSString* suspicious in suspiciousLibraries) {
if ([imagePath.lowercaseString containsString:suspicious.lowercaseString]) {
// NSLog(@"[Shadow Debug] Hiding suspicious library: %s", originalName);
return "/System/Library/CoreServices/SystemVersion.plist";
}
}
}

const char* name = image_index < [_dyld_collection count] ?
[_dyld_collection[image_index][@"name"] fileSystemRepresentation] : NULL;

// NSLog(@"[Shadow Debug] Regular caller - Image name for index %d: %s", image_index, name ? name : "NULL");
// NSLog(@"[Shadow Debug] Original image name for index %d: %s", image_index, originalName ? originalName : "NULL");

return name;
}

static void* (*original_dlopen)(const char* path, int mode);
Expand Down