通过运行未签名的可执行文件检测越狱的iOS设备

Question

目前,我正在尝试为我公司的开发人员创建一个可重用的objC安全库.在这个库中,我希望有一个API来检测他们的iOS设备是否已越狱.我注意到GregH的一个聪明的回应,它类似于iBooks的做法; 你运行一个未签名版本的可执行文件(iOS通过execve sys调用启动应用程序),如果它返回你知道设备是越狱.

问题:是否可以在iOS库中打包可执行文件并通过某些功能调用它？如果是这样,最好的方法是什么呢？

谢谢你的帮助,kc

Answer 1

Last I checked, sandboxed apps can't even fork(). I'm not sure if they can call execve(). If they can't do either, then simply calling execve() ought to work.

I'm not sure how much jailbreaking interferes with this. It's possible to have a jailbreak that lets you run un-signed apps from un-signed apps but behaves normally if the caller is signed.

It's obviosuly possible to "package" an executable in a library: Just have static unsigned char const data [] = { ... };, write it to a file, chmod(), and try to exec it.

At the end of the day, though, this may be a disservice to your users. A Jailbroken phone doesn't mean your app has been pirated. Unless you know someone with a jailbroken phone who's willing to do some testing (and testing with different jailbreaks), you might be setting yourself up for "It just crashes!" reviews.

(And if it does crash, then someone will come along and crack your app. It's better to be discreet and monitor the "problem" before deciding whether it needs fixing.)

越狱发生的频率比您想象的要高。我已将 MobileSubstrate 检查添加到我们的自动崩溃报告符号脚本中，因为我们在很大一部分崩溃中都看到了它。OTOH，应用程序安装到 /Applications 中的崩溃比例（这曾经是破解应用程序的传统方式；也许现在不再是了）可以忽略不计。