[Enhancement] ellekit should block obj-c swizzle methods from running to early

[Cryptiiiic]

Not really a bug but apps like paypal are terribly made and swizzle NSData initilize to call their debug logger class.
Who tf knows why their debug logger is enabled in a release build.
When ellekit's libinjector is loaded into the app, corefoundation is called which in turn calls nsdata, nsdata initilize. But since the app swizzled that function, their version is called instead. This in turn jumps to apps code to early before anything is setup and goes into an inifinite recursion loop.

This can be resolved by just blocking swizzling until tweaks are done loading.

[hryan49]

Had an similar issue.
Resolved it by replacing swizzles with %hook nested in a %group. Call the %init(group) inside your ctor after some type of validation/loop (I used dyld to make sure my framework was loaded first before advancing to the %init)

[Cryptiiiic]

Its not a tweak issue though, because the app swizzles nsdata initialize, when libinjector does anything ns related it calls the app's method which in turn calls other app stuff too early. Libinjector loads the tweaks so its not related to specific tweaks stuff. @hryan49

@Cryptiiiic May I ask which call in libinjector you are talking about triggers this case?

[Cryptiiiic]

@roothide libinjector is part of ellekit. But anything down the injection chain will cause the issue. If a single dependency library or tweak loads core foundation it will break the app from swizzling.

@Cryptiiiic yes its the TweakLoader, and it does use CF* functions. the internal implementation of CoreFoundation uses objc, and almost all tweaks use objc. are you saying that any call to a CF* function in libinjector triggers the problem, or does it trigger the problem only after it calls a specific CF* function?

@Cryptiiiic could you show an example code for paypal(latest version?) that can reproduce this issue?

[Cryptiiiic]

@roothide
What do you mean example code? Any tweak/tweak dependency that links CoreFoundation will trigger the issue. The cf init code calls NSData initialize but paypal swizzles that. And since tweaks load very early, its ending up in the paypal code too early before anything is setup for paypal to run correctly leading to undefined behavior. In this case recursion happens.

No example code is needed because 99% of the time a tweak will be using corefoundtion. I already explained this in the prior messages.

@Cryptiiiic I use dopamine jailbreak with ellekit, and installed some tweaks which injected into paypal and linked CoreFoundation, but I didn't observe any abnormalities with paypal, it still runs normally. so how to reproduce the issue you said?

[Cryptiiiic]

@roothide lol it seems they finally removed the debug code, it works fine now so we will have to find another example app.

@Cryptiiiic alright.

I can understand the problem you said. usually objc+initialize will not be triggered prematurely, but because TweakLoader or tweaks use CoreFoundation, and the internal implementation of CoreFoundation uses objc extensively, this will cause the app code to get the opportunity to execute before the tweaks and cause abnormal behavior in the app, and even be used to detect jailbreaks and tweaks.

and almost all TweakLoaders use CoreFoundation or objc, so this is difficult to avoid, and almost all jailbreak payload-dylib will use xpc to connect to jbd before loading TweakLoader, and xpc also uses objc internally, which will also cause objc+initialize to be triggered.

I think we should be able to find a way to deal with this eventually, but there is nothing we can do at the moment.

[yakuv0]

helloo

this seems related to what happens with Termius app on launch.
crash report
{ "report": { "version": "3.2.0", "id": "1D91DF7E-D249-4D65-B1C5-71B391CA9BBD", "process_name": "Termius", "timestamp": 1697088010, "type": "standard" }, "binary_images": [ { "image_addr": 4386848768, "image_vmaddr": 0, "image_size": 32768, "name": "path/to/procursus/usr/lib/ellekit/libinjector.dylib", "uuid": "E36B82C6-B463-30AA-A94A-39E341F0437D", "cpu_type": 16777228, "cpu_subtype": 0, "major_version": 1, "minor_version": 0, "revision_version": 0 }, { "image_addr": 4311187456, "image_vmaddr": 4294967296, "image_size": 23855104, "name": "/path/to/Termius.app/Termius", "uuid": "2F7A73DD-5E70-3717-940C-94EC6939C7F9", "cpu_type": 16777228, "cpu_subtype": 0, "major_version": 0, "minor_version": 0, "revision_version": 0 },

above ellekit/libinjector.dylib is loaded before app which results in crash on launch.

app installed from App Store and equipped with jb and decryption detector which result in crash if the app is sideloaded but in this case where its on a rootless jb with disabling tweak injection via Choicy still result in crash and detects binary as decrypted when ellekit is loaded.

{"event_id":"da67487f617e458fb68147f7c5be611b","sdk":{"name":"sentry.cocoa","version":"7.4.7"}} {"type":"event","length":126317} {"extra":{"JailbreakCheckInfo":"sileo:\/\/ URL scheme detected, Suspicious file exists: \/var\/log\/apt, Suspicious file can be opened: \/var\/log\/apt","IsJailbroken":true,"Plan":"Not Registered","IsLoggedIn":false,"HasUsername":false},"message":{"formatted":"The application integrity has been compromised.\nMessage: App bundle not encrypted"},

for the jb detector in app shouldn't result in crash (just a warning massage in app), currently enabling shadow tweak on app doesn't result in crash on launch even with ellekit installed.

[tealbathingsuit]

@yakuv0 Thats not related, remove your Xina files before making issues

[yakuv0]

@Evelyneee got no xina, jb is on palera1n

may you explain? report shows ellekit loading before app that why I though its related to the same issue.

[tealbathingsuit]

It's detecting jailbreak files

obviously this app detects jailbreak, once you use choice to disable injection, it has nothing to do with ellekit.