Skip to content

Instantly share code, notes, and snippets.

@joncardasis
Last active August 23, 2021 11:32
Show Gist options
  • Save joncardasis/49641368ffa3872f088c6444d274b768 to your computer and use it in GitHub Desktop.
Save joncardasis/49641368ffa3872f088c6444d274b768 to your computer and use it in GitHub Desktop.
jb_protect for all device architectures
//
// jailbreak.h
// jailbreak-protect
//
// Created by Jonathan Cardasis (C) on 10/11/19.
// Copyright © 2019 Jonathan Cardasis (C). All rights reserved.
//
#ifndef jailbreak_h
#define jailbreak_h
//#define IS_APP_STORE_BUILD !TARGET_IPHONE_SIMULATOR && !DEBUG
//#if IS_APP_STORE_BUILD
/**
Most anti-debug code relies on libraries which are easy enough to hook
the symbols and bypass these checks. This is an ARM assembly solution
which requires much more effort to bypass.
*/
__attribute__((constructor)) static void prevent_ptrace() {
#ifdef __arm__ // 32 bit physical device
asm volatile (
"mov r0 #31\n"
"mov r1, #0\n"
"mov r2, #0\n"
"mov r12, #26\n"
"svc #80\n"
);
#elif __arm64__ // 64 bit physical device
asm volatile (
"mov x0, #26\n" // ptrace syscall (26 in XNU)
"mov x1, #31\n" // PT_DENY_ATTACH (0x1f) - first arg
"mov x2, #0\n"
"mov x3, #0\n"
"mov x16, #0\n"
"svc #128\n" // make syscall
);
#else // x86_64 (simulator)
asm volatile (
"pushq %rax\n"
"pushq %rdi\n"
"movq $0x1f, %rdi\n"
"movq $0x200001A, %rax\n"
"syscall\n"
"popq %rdi\n"
"popq %rax\n"
);
#endif
}
//#endif
#endif /* jailbreak_h */
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment