Fix a race condition in GUI when printing and fix malfunctioning analyticsd daemon.

[SongXiaoXi]

Fix a race condition in GUI when printing.

And it seems the exploitation and post-exploitation work on my iPhone 12 iOS 14.2.1 without any modification.

Fix malfunctioning analyticsd daemon

While the patch in Fugu14 preserved the user id and $HOME by changing the name of the user _analyticsd to _nanalyticsd, it seems that some other daemon changes the owner of /private/var/db/analyticsd and its subdirectories to ·_analyticsd·, whose uid has changed to 264. This will cause the _analyticsd.back with uid 263 to not be able to read /private/var/db/analyticsd at all, with error: Home directory is not setup. Waiting to see if it gets repaired....
This fix is based on the following facts:

• dyld enables independent closure loading by checking the env $HOME is a subdirectory in /private/var/mobile/Containers/Data/.
• launchd sets the daemons' $HOME env via getpwname_r.
• analyticsd get its own working path via getuid and getpwuid.
• An unknown daemon will set the owner of /private/var/db/analyticsd to the user name _analyticsd.

So if the passwd and master.passwd have the following contents, things can be easily fixed.

passwd (master.passwd is similar)
_nanalyticsd:*:263:263:Analytics Daemon:/var/db/analyticsd:/usr/bin/false
_analyticsd:*:263:263:Haxx Daemon:/private/var/mobile/Containers/Data/Fugu14Untether:/usr/bin/false

And then, after the system is powered on:

• launchd launches /System/Library/LaunchDaemon/com.apple.analyticsd.plist with username _analyticsd and set $HOME to /private/var/mobile/Containers/Data/Fugu14Untether based on the username.
• Then the dyld will load the closure exploitation and the system will be jailbroken.
• The unknown daemon will set the user ID of /private/var/db/analyticsd to 263, based on the username _analyticsd.
• Then the analyticsd.back with the user name _nanalyticsd is launched, which will use the uid 263. Although there are two user with the same uid 263, it will only pick the first one by getpwuid. So it will use /private/var/db/analyticsd with the correct owner, uid 263

Then the battery detail in Settings works properly.

If you have jailbroken by Fugu14, you can try the manual steps below, or remove origin Fugu14 jailbreak modification then and use this PR to jailbreak. Restoring rootfs is a easy way, but loses all tweaks. Or manually undo all modification according "Jailbreak" section in Fugu14 writeup.

[SongXiaoXi]

#238

[badger200]

@SongXiaoXi Absolutely incredible work!! 👏🏼👏🏼👏🏼 Outstanding root cause analysis. Man you just did the exact thing I hoped for on a long shot when I documented this 2 weeks ago on #238. What's even crazier is by sheer coincidence you're the same guy who did the bulk of the work when I set out to bring the official D0m0 CocoaTop64 BigBoss release up to iOS 13+ support and iPad SplitView compatibility etc.! (The only 2 major GitHub jailbreak projects I've participated on)

I'm ecstatic and cannot wait to try this out. I don't have a Mac and do all my development with Clang and theos on device, is there a way I can compile this? Or can you post a binary? I have a swiftc and repl but I've never used them.

[SongXiaoXi]

@badger200 Oh yeah, nice to see you here.
You can make these unsafe modifications even without compiling any code. The key is about username and the owner of some paths.
Since your device is iOS 14.4, the cicuta_virosa is not available. It may corrupt your Fugu14 untether or even bootloop and it's a hassle to fix them. Please be careful.
I tested these manual steps on two iOS 14.2.1 and iOS 14.5.1 devices a month ago, without taking any notes. So my memory may not be accurate. (Sorry for my procrastination.）You can refer to Linus's incredible Writeup to understand what the next steps are doing.

• Replace the lines containing _analyticsd and _nanalyticsd in /etc/passwd and /etc/master.passwd with the following: (the line containing _nanalyticsd must precede _analyticsd)

passwd:

_nanalyticsd:*:263:263:Analytics Daemon:/var/db/analyticsd:/usr/bin/false
_analyticsd:*:263:263:Haxx Daemon:/private/var/mobile/Containers/Data/Fugu14Untether:/usr/bin/false

master.passwd:

_nanalyticsd:*:263:263::0:0:Analytics Daemon:/var/db/analyticsd:/usr/bin/false
_analyticsd:*:263:263::0:0:Haxx Daemon:/private/var/mobile/Containers/Data/Fugu14Untether:/usr/bin/false

• You can check the file format is correct by some user switch commands sudo su in the terminal.
• Change the owner all subdirectory of /private/var/Fugu14UntetherDYLD/Caches/, /private/var/mobile/Containers/Data/Fugu14Untether and /private/var/db/analyticsd to user id and group id 263.
• Terminate the analyticsd.back with CocoaTop64. You can check in the section 'Open files' in CocoaTop64 whether this daemon can open files in /var/db/analyticsd/. After this, the analyticsd daemon should work properly.
• Make sure processes with user id 263 have permission to read analyticsd.closure and stage2.closure in /private/var/Fugu14UntetherDYLD/Caches/com.apple.dyld/. Both of files are protected by chflag. If not, first use chflags to remove noschg and nouchg flag on these files. Remember the flag must be changed to noschg and nouchg back. Otherwise, Fugu14 will not work after reboot!
• If you are confident that your changes are correct, reboot to check whether Fugu14 can work.

Good luck enjoying analyticsd!

[nildeveloper]

老哥 要不要简单出个修改脚本先

[dlevi309]

Have you been regularly rebooting to ensure that this all applies indefinitely? And great work

[user-wyc]

老哥方便做个脚本给普通用户使用嘛感激不尽

[dlevi309]

I think you should fully test out something like this before submitting a PR, I’m not doubting the logic, but the implementation seems to be broken atm.

[SongXiaoXi]

@dlevi309 Can you point out what implementation is wrong? I have it running on iPhone 12 iOS 14.2.1 and iOS 14.5.1. And this fix doesn't rely on struct offsets to be patched, so I don't think it's necessary to test all devices between these two system versions (of course, I don't own all of them).
Of course, this code does not guarantee compatibility, and fugu14 needs to be completely removed first.

[dlevi309]

@SongXiaoXi Hi, and I was getting a permissions issue error when the jailbreak would try drop the analyticsd plist onto the device, but I guess it was my fault for not fully unjailbreaking first. And I just want to confirm that you’ve installed this patch by running this project? because I noticed that you mentioned doing this manually. Sorry, I just wanna make sure before I attempt to run it again 😅

[SongXiaoXi]

@dlevi309 Yes, I have encountered this problem, it seems that fugu14 itself will not overwrite /Library/LaunchDaemon/analyticsd.plist if you forgot to delete it beforehand.

[dlevi309]

@SongXiaoXi You should probably add that to the explanation above then, because that would have been good to know :p either way, I’ll try this out again at some point, so thank you again for your contribution

[badger200]

@SongXiaoXi Success!! I finally got the nerve to do this. You were right, I needed to remove the schg,uchg chflags from /var/mobile/Containers/Data/Fugu14Untether/Library/Caches/com.apple.dyld/*.closure (analyticsd.closure and stage2.closure) in order to chown 263:263 them, then I restored it via chflags -v schg,uchg *.closure.

The rest was straightforward but I was triple checking everything and caution anyone following this, I made sure to use chown -h 263:263 /var/mobile/Containers/Data/Fugu14Untether/Library to affect the symbolic link itself (via the -h), then proceeded to chown -R 263:263 /var/db/analyticsd/.

For anyone following this, here's a list of my exact commands from my .bash_history, I left in all my checks so you can remember to confirm each step yourself:

I have several aliases:
xls is a Darwin copy of the ls binary (as opposed to GNU coreutils) I got from binpack64.
xlsxf is my alias for xls -l@O which displays flags (and xattrs, not needed here but useful to have).
v and vl are just my personal favorite bash aliases for dir listing:

alias v='ls -lapsF --group-directories-first'
alias vl='ls -lapF --color=always --group-directories-first'

Several more extremely handy aliases I use:

alias llg='launchctl list | grep' (usage: llg (servicename))
alias lpg='launchctl print' (usage: lpg system/(servicename))
alias lstop='launchctl stop' (usage: lstop (servicename))
alias lsop='lsof -p' (usage: lsop (pid))
alias p=nano (used so often I give it a 1-letter alias)
alias pg='ps aux | grep' (usage: pg (pid or process name))

46412  xlsxf /User/Containers/Data/Fugu14Untether/Library/Caches/com.apple.dyld/
46414  xlsxf /var/Fugu14UntetherDYLD/
46415  xlsxf /var/Fugu14UntetherDYLD/Caches/
46416  xlsxf /var/Fugu14UntetherDYLD/Caches/com.apple.dyld/
46417  xlsxf /var/db/analyticsd/
46418  xlsxf /User/Containers/Data/Fugu14Untether/
46419  xlsxf /User/Containers/Data/Fugu14Untether/Library
46420  xlsxf /User/Containers/Data/Fugu14Untether/Library/
46421  xlsxf /var/mobile/Containers/Data/Fugu14Untether
46422  xlsxf /var/mobile/Containers/Data/Fugu14Untether/Library/Caches/com.apple.dyld/
46423  cd /etc
46424  v *pass*
46425  cp -a passwd passwd.LKG
46426  cp -a master.passwd master.passwd.LKG
46427  p passwd
46428  p master.passwd
46429  cd /var/Fugu14UntetherDYLD/
46430  vl
46431  vl Caches/
46432  vl Caches/com.apple.dyld/
46434  chown --help
46435  v
46436  chown 263:263 .
46437  v
46438  chown 263:263 Caches/
46439  v
46440  cd Caches/
46441  v
46442  chown 263:263 com.apple.dyld/
46443  cd com.apple.dyld/
46444  v
46445  chown 263:263 *
46446  v /var/mobile/Containers/Data/Fugu14Untether/
46447  chown 263:263 /var/mobile/Containers/Data/Fugu14Untether/
46448  v /var/mobile/Containers/Data/Fugu14Untether/
46449  chown -h 263:263 /var/mobile/Containers/Data/Fugu14Untether/Library
46450  v /var/mobile/Containers/Data/Fugu14Untether/Library
46451  v /var/mobile/Containers/Data/Fugu14Untether/
46452  v /var/mobile/Containers/Data/Fugu14Untether/Library/Caches/
46453  v /var/mobile/Containers/Data/Fugu14Untether/Library/Caches/com.apple.dyld/
46454  v /var/db/analyticsd/
46455  chown -R 263:263 /var/db/analyticsd/
46456  v /var/db/analyticsd/
46457  v /var/db/analyticsd/state/
46458  v /var/db/analyticsd/Library/
46459  v /var/db/analyticsd/Library/Preferences/
46460  xlsxf /var/db/analyticsd/Library/Preferences/
46461  xlsxf
46462  man chflags
46463  v
46464  chflags -v noschg,nouchg *.closure
46465  xlsxf
46466  chown 263:263 *.closure
46467  xlsxf
46468  chflags -v schg,uchg *.closure
46469  xlsxf
46470  pg analytics
46471  alias xlsxf
46472  xlsx -lO
46473  alias xlsx
46474  xls -lO
46475  stat *
46476  lstop com.apple.analyticsd
46477  llg analyt 
46478  lsop 1234

(Verified that analyticsd.back (pid 1234) had immediately restarted itself and now has /var/db/analyticsd/config.sqlite open for the first time since I jailbroke!)

Notice command 46449 does NOT have a trailing / on the path, crucial for affecting the symlink itself, rather than the dir it points to)

[nildeveloper]

@SongXiaoXi Success!! I finally got the nerve to do this. You were right, I needed to remove the schg,uchg chflags from /var/mobile/Containers/Data/Fugu14Untether/Library/Caches/com.apple.dyld/*.closure (analyticsd.closure and stage2.closure) in order to chown 263:263 them, then I restored it via chflags -v schg,uchg *.closure.

The rest was straightforward but I was triple checking everything and caution anyone following this, I made sure to use chown -h 263:263 /var/mobile/Containers/Data/Fugu14Untether/Library to affect the symbolic link itself (via the -h), then proceeded to chown -R 263:263 /var/db/analyticsd/.

For anyone following this, here's a list of my exact commands from my .bash_history, I left in all my checks so you can remember to confirm each step yourself:

I have several aliases: xls is a Darwin copy of the ls binary (as opposed to GNU coreutils) I got from binpack64. xlsxf is my alias for xls -l@O which displays flags (and xattrs, not needed here but useful to have). v and vl are just my personal favorite bash aliases for dir listing:

alias v='ls -lapsF --group-directories-first' alias vl='ls -lapF --color=always --group-directories-first'

Several more extremely handy aliases I use:

alias llg='launchctl list | grep' (usage: llg (servicename)) alias lpg='launchctl print' (usage: lpg system/(servicename)) alias lstop='launchctl stop' (usage: lstop (servicename)) alias lsop='lsof -p' (usage: lsop (pid)) alias p=nano (used so often I give it a 1-letter alias) alias pg='ps aux | grep' (usage: pg (pid or process name))

46412  xlsxf /User/Containers/Data/Fugu14Untether/Library/Caches/com.apple.dyld/
46414  xlsxf /var/Fugu14UntetherDYLD/
46415  xlsxf /var/Fugu14UntetherDYLD/Caches/
46416  xlsxf /var/Fugu14UntetherDYLD/Caches/com.apple.dyld/
46417  xlsxf /var/db/analyticsd/
46418  xlsxf /User/Containers/Data/Fugu14Untether/
46419  xlsxf /User/Containers/Data/Fugu14Untether/Library
46420  xlsxf /User/Containers/Data/Fugu14Untether/Library/
46421  xlsxf /var/mobile/Containers/Data/Fugu14Untether
46422  xlsxf /var/mobile/Containers/Data/Fugu14Untether/Library/Caches/com.apple.dyld/
46423  cd /etc
46424  v *pass*
46425  cp -a passwd passwd.LKG
46426  cp -a master.passwd master.passwd.LKG
46427  p passwd
46428  p master.passwd
46429  cd /var/Fugu14UntetherDYLD/
46430  vl
46431  vl Caches/
46432  vl Caches/com.apple.dyld/
46434  chown --help
46435  v
46436  chown 263:263 .
46437  v
46438  chown 263:263 Caches/
46439  v
46440  cd Caches/
46441  v
46442  chown 263:263 com.apple.dyld/
46443  cd com.apple.dyld/
46444  v
46445  chown 263:263 *
46446  v /var/mobile/Containers/Data/Fugu14Untether/
46447  chown 263:263 /var/mobile/Containers/Data/Fugu14Untether/
46448  v /var/mobile/Containers/Data/Fugu14Untether/
46449  chown -h 263:263 /var/mobile/Containers/Data/Fugu14Untether/Library
46450  v /var/mobile/Containers/Data/Fugu14Untether/Library
46451  v /var/mobile/Containers/Data/Fugu14Untether/
46452  v /var/mobile/Containers/Data/Fugu14Untether/Library/Caches/
46453  v /var/mobile/Containers/Data/Fugu14Untether/Library/Caches/com.apple.dyld/
46454  v /var/db/analyticsd/
46455  chown -R 263:263 /var/db/analyticsd/
46456  v /var/db/analyticsd/
46457  v /var/db/analyticsd/state/
46458  v /var/db/analyticsd/Library/
46459  v /var/db/analyticsd/Library/Preferences/
46460  xlsxf /var/db/analyticsd/Library/Preferences/
46461  xlsxf
46462  man chflags
46463  v
46464  chflags -v noschg,nouchg *.closure
46465  xlsxf
46466  chown 263:263 *.closure
46467  xlsxf
46468  chflags -v schg,uchg *.closure
46469  xlsxf
46470  pg analytics
46471  alias xlsxf
46472  xlsx -lO
46473  alias xlsx
46474  xls -lO
46475  stat *
46476  lstop com.apple.analyticsd
46477  llg analyt 
46478  lsop 1234

(Verified that analyticsd.back (pid 1234) had immediately restarted itself and now has /var/db/analyticsd/config.sqlite open for the first time since I jailbroke!)

Notice command 46449 does NOT have a trailing / on the path, crucial for affecting the symlink itself, rather than the dir it points to)

How about making a shell script？

[badger200]

@nildeveloper I considered it, it would be pretty easy to do, but given the possibility of bricking someone's device or at least breaking their jailbreak possibly irreversibly (or necessitating an orig-fs restore which loses everything you've ever added on disk0s1s1 (all except /private/var or /var), I don't feel it would be a responsible thing to do. Also I only have iOS 14.4 to test on and I can't assume my shell script would correctly handle everyone using it. I really hope LinusHenze and Pwn2ownd will accept @SongXiaoXi 's PR to make this all part of the proper fix.

If you're willing to accept all those risks, I can take the terminal history I posted and just strip out all the verbose checks and let you try it...?

Or you could even do it yourself by pasting that into a file, then simply running something like cut -b7- myscript.sh > my scriptfixed.sh (might have to experiment with the number 7, I'm assuming that's enough to strip the 5 digit command numbers from each line in my bash history, plus the two spaces after them.) Of course you'd have to make sure you activated all the aliases I mentioned and have the Darwin ls binary available as xls in your path, plus chflags (available on bigboss, a package like system-cmds or similar name; just search and it'll come up, or use binpack64 from googling "newosxbook binpack64"

[nildeveloper]

@nildeveloper I considered it, it would be pretty easy to do, but given the possibility of bricking someone's device or at least breaking their jailbreak possibly irreversibly (or necessitating an orig-fs restore which loses everything you've ever added on disk0s1s1 (all except /private/var or /var), I don't feel it would be a responsible thing to do. Also I only have iOS 14.4 to test on and I can't assume my shell script would correctly handle everyone using it. I really hope LinusHenze and Pwn2ownd will accept @SongXiaoXi 's PR to make this all part of the proper fix.

If you're willing to accept all those risks, I can take the terminal history I posted and just strip out all the verbose checks and let you try it...?

Or you could even do it yourself by pasting that into a file, then simply running something like cut -b7- myscript.sh > my scriptfixed.sh (might have to experiment with the number 7, I'm assuming that's enough to strip the 5 digit command numbers from each line in my bash history, plus the two spaces after them.) Of course you'd have to make sure you activated all the aliases I mentioned and have the Darwin ls binary available as xls in your path, plus chflags (available on bigboss, a package like system-cmds or similar name; just search and it'll come up, or use binpack64 from googling "newosxbook binpack64"

Thanks for your reply, i have restored rootfs last night，bacause of the random reboot when using some APP.
It seems that the operation is still a bit complicated at present, let's wait for LinusHenze and Pwn2ownd to fix it.

[UInt2048]

I think the bigger news here is your claim on line 774 of arm/shared/KernelExploit/Sources/KernelExploit/offsets.swift that this works without issue on iOS 14.2.x

[Purool]

I had installed fugu14 with your change, now battery usage is normal. (12mini ,14.3)

[dlevi309]

pulled the trigger on this and battery usage + all the smaller bugs caused by the original bug (which was.. a lot) are all fixed up! Thanks for your work on this! (and I didn’t do the manual method, I restored rootfs, reinstalled the jailbreak with xcode, etc. on an iPhone 12 Pro Max, 14.4)

btw, if someone wrote a script to automate the manual method, this fix could easily be deployed as a package for users who currently have the original installed

[badger200]

Guys 🚨I've been getting kernel panics🚨 every time I play Real Racing 3 and click video ads (not sure why, but this is a very reliable trigger) usually panic log saying "Unexpected SoC watchdog reset" otherwise it's a use after free zone in panicked task launchd pid 1.

Ever since about 2 days after I did this fix... I have carefully traced everything else I changed on my system in this timeframe and step by step isolated it but the panics continue EVEN if I disable tweak injection altogether!

Could it possibly be related to the analyticsd fix?

Do any of you who implemented this fix have Real Racing 3 installed and can try clicking 5-10 ads? I cannot watch 5-10 ads without a panic. Usually it panics on the first ad. Sometimes it panics as soon as the RR3 game menu loads!

If anyone knows how to debug a kernel panic I'm all ears. I used jtool2 to symbolicate my panic-full-xxx.ips log but don't see any obvious culprit.

[UInt2048]

Does this occur with and without this PR? I have not tested PR #242, but I’ve experienced what I believe to be panics attempting to watch SimCity Buildit ads when jailbroken. iPadから送信

…

2022/06/12 5:18、badger200 ***@***.***>のメール:  Guys I've been getting kernel panics every time I play Real Racing 3 and click video ads (not sure why, but this is a very reliable trigger) usually panic log saying "Unexpected SoC watchdog reset" otherwise it's a use after free zone in panicked task launchd pid 1. Ever since about 2 days after I did this fix... I have carefully traced everything else I changed on my system in this timeframe and step by step isolated it but the panics continue EVEN if I disable tweak injection altogether! Could it possibly be related to the analyticsd fix? Do any of you who implemented this fix have Real Racing 3 installed and can try clicking 5-10 ads? I cannot watch 5-10 ads without a panic. Usually it panics on the first ad. Sometimes it panics as soon as the RR3 game menu loads! If anyone knows how to debug a kernel panic I'm all ears. I used jtool2 to symbolicate my panic-full-xxx.ips log but don't see any obvious culprit. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you commented.

[badger200]

@UInt2048 Unfortunately I found this Issue for uncover 8.0.2 on the same iOS 14.4 I'm on: unc0ver 8.0.2 ios 14.4 kernel panic when launching game He gets panics launching Fruit Ninja 2 on his iPhone.

Update: Wow, I installed Fruit Ninja 2, and just as his Issue describes, I ☠️immediately got a kernel panic☠️ (pink screen/reset) 10 seconds after launching the app. It was merely playing an intro screen.

Are you also using iOS 14.4?

I did the analyticsd user/group edits all manually (see my long comment above) and it's not easily reversible, I didn't take detailed notes on what all files/dirs/symlinks original perms were. So now I'm nervous about undoing the change, but I will have to do it if I can't find another solution.

[SongXiaoXi]

@badger200 As far as I know, the substituted spawned by unc0ver will patch struct task at the time when a process is created. If the process exits or some other thing happens, this patch will corrupt the task zone. This bug is common using Fugu14 and unc0ver. Because the kernel rw primitive of Fugu14 is slow and this race condition happens more frequently than the unc0ver with cicuta_virosa.
If your device is iOS 14.3 or below, you can remove or rename /usr/lib/libkrw/libFugu14Krw.dylib to force unc0ver using cicuta_virosa even with Fugu14 untether.

[badger200]

@SongXiaoXi Very good insight into the issue. Unfortunately I am using 14.4. I believe even when I disabled Tweak Injection in the SubstituteSettings.app, it still injects substitute-loader.dylib etc into every app.

I wonder if I could switch to Cydia Substrate somehow as a test?

[SongXiaoXi]

@badger200 No. substituted is a part of unc0ver with code obfuscation and only injects substitute. Cydia Substrate does not work.

[UInt2048]

Yes, my device is an iPad Air 4 on iPadOS 14.4. iPadから送信

…

2022/06/12 5:35、badger200 ***@***.***>のメール:  @UInt2048 Unfortunately I found this Issue for uncover 8.0.2 on the same iOS 14.4 I'm on: pwn20wndstuff/Undecimus#2288 He gets panics launching Fruit Ninja 2 on his iPhone. Are you also using iOS 14.4? I did the analyticsd user/group edits all manually (see my long comment above) and it's not easily reversible, I didn't take detailed notes on what all files/dirs/symlinks original perms were. So now I'm nervous about undoing the change, but I will have to do it if I can't find another solution. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you were mentioned.

[badger200]

@UInt2048 Can you install Fruit Ninja 2 and report whether it panics 10 seconds after launching the app?

I'm curious if anyone else here using unc0ver 8.0.2/Fugu14 on iOS 14.4+ gets panics on Fruit Ninja 2 a mere 10 seconds later?

[badger200]

@SongXiaoXi Do you think I should try changing my analyticsd groups etc back to original to see if my panics stop? Is there any step that could kill my jailbreak? I absolutely cannot afford to lose my /dev/disk0s1s1 data with an orig-fs restore.

(Unless it's possible to make a new snapshot, restore, then restore to this other snapshot, so the net result is as if I never did any restoring?)

[cdustevich1]

I restored rootfs and battery usage is appearing in settings and normally recording. I can try reinstalling the jailbreak but I have done that to no avail this far…

[badger200]

@SongXiaoXi In my research of the 3D game panics, I saw a kernel panic that suggested this occurs with the Apple Neural Engine, I saw a bunch of "ANExxxxxx" calls in the panic trace. I can't be certain though.

I desperately wish there was a way to temporarily disable the Neural Engine and test that. Apple tells developers there's no way to know if your code will execute on CPU, GPU, or Neural Engine processors, as it handles it automatically and uses its own judgment depending on various factors like how it performs, battery usage, how often the function is being called, etc. (Now I wonder if our crash might occur at a different rate plugged in vs on battery?)

So if there was a way to disable the ANE, theoretically everything should continue to function but just get executed on CPU or GPU.

I would be ecstatic if I had the option of disabling ANE and getting rock solid stability, I don't mind a performance trade off.

[SongXiaoXi]

@badger200 When I reviewed my crash logs from a previous time, I noticed that they all contained 'element modified after free' errors within the tasks or proc zone. This issue seems to occur frequently in low-quality web-based apps and may be related to different users' habits. Therefore, the panic caused by the Neural Engine you mentioned may be one of them, but I don't have any reverse engineering knowledge in this area.

By the way, based on my previous judgment, I conducted numerous tests using the modified Fugu14 and unc0ver/Taurine. For example, I used Fugu14 and the open-source parts of Taurine to construct an experimental jailbreak tool to test its effectiveness against crashes. There is still a small chance of crashing, as Taurine's jailbreakd is also not open source and may patch the kernel in a manner similar to substituted. I have no good way to modify it too. I still believe that the patches made by substituted/jailbreakd using kernel rw before each process starts greatly affect stability.

If I have a significant amount of free time, I plan to explore what Linus and opa334 did in Fugu15 and make one last attempt to build a jailbreak tool using Fugu14 and the fully open-source Fugu15 Max, possibly with my optimizations, similar to what sockH3lix achieved.

[Nonta72]

I tried this but analytics.back daemon won't run and therefore, no fix. I checked cocoatop and saw that it tries every time to fire up but disappears few seconds later. What am I missing?

[SongXiaoXi]

@Nonta72 There are likely some errors occurring with the analytics.back daemon, and it typically prints logs before exiting/crashing. If you have a Mac, you can retrieve the logs containing the keyword "analytics.back" through the Console app. If not, there is a tweak that allows you to view system logs on your device, but I couldn't recall its name even after spending a few minutes thinking about it. Please pay attention to any logs related to analytics.back or ReportCrash.

[cdustevich1]

I get these 5 errors repeating indefinitely. Brand new installation of your fork (after succession rootfs restore) iPhone 12 Pro Max 14.5.1

[Nonta72]

@Nonta72 There are likely some errors occurring with the analytics.back daemon, and it typically prints logs before exiting/crashing. If you have a Mac, you can retrieve the logs containing the keyword "analytics.back" through the Console app. If not, there is a tweak that allows you to view system logs on your device, but I couldn't recall its name even after spending a few minutes thinking about it. Please pay attention to any logs related to analytics.back or ReportCrash.

Hi, thank you for your reply!

I managed to retrieve logs and I have similar error messages just like the ones on the screenshot sent by @cdustevich1
Here's what mostly show up in logs (full file attached to this post) :

Apr 29 13:47:52 Nontas-iPhone-XS analyticsd.back[26214] <Notice>: [Configurer:Build] -- Building config Apr 29 13:47:52 Nontas-iPhone-XS analyticsd.back(libsystem_containermanager.dylib)[26214] <Notice>: container_system_group_path_for_identifier: success Apr 29 13:47:52 Nontas-iPhone-XS analyticsd.back(OSAnalytics)[26214] <Notice>: Using system group container: '/private/var/containers/Shared/SystemGroup/257C7AB7-940C-4876-AB65-09F3B0B8B801' Apr 29 13:47:52 Nontas-iPhone-XS analyticsd.back[26214] <Notice>: XPC Server com.apple.analyticsd.messagetracer: listening Apr 29 13:47:52 Nontas-iPhone-XS analyticsd.back(OSAnalytics)[26214] <Notice>: failed to create directory '/private/var/containers/Shared/SystemGroup/257C7AB7-940C-4876-AB65-09F3B0B8B801/Library/CoreAnalytics': Error Domain=NSCocoaErrorDomain Code=513 "You don\M-b\M^@\M^Yt have permission to save the file \M-b\M^@\M^\CoreAnalytics\M-b\M^@\M^] in the folder \M-b\M^@\M^\Library\M-b\M^@\M^]." UserInfo={NSFilePath=/private/var/containers/Shared/SystemGroup/257C7AB7-940C-4876-AB65-09F3B0B8B801/Library/CoreAnalytics, NSUnderlyingError=0x11bd07b70 {Error Domain=NSPOSIXErrorDomain Code=13 "Permission denied"}} Apr 29 13:47:52 Nontas-iPhone-XS kernel[0] <Notice>: analyticsd.back[26214] Corpse allowed 1 of 5 Apr 29 13:47:52 Nontas-iPhone-XS ReportCrash[26215] <Notice>: osa_update: Pid 26214 'analyticsd.back' CORPSE: Parsing KCData Apr 29 13:47:52 Nontas-iPhone-XS ReportCrash[26215] <Notice>: osa_update: Pid 26214 'analyticsd.back' CORPSE: Extracting Apr 29 13:47:52 Nontas-iPhone-XS ReportCrash[26215] <Notice>: osa_update: Pid 26214 'analyticsd.back' CORPSE: Symbolicating Apr 29 13:47:52 Nontas-iPhone-XS ReportCrash[26215] <Notice>: osa_update: Pid 26214 'analyticsd.back' CORPSE: Symbolicating2 Apr 29 13:47:52 Nontas-iPhone-XS ReportCrash[26215] <Notice>: osa_update: Pid 26214 'analyticsd.back' CORPSE: Capture Complete Apr 29 13:47:52 Nontas-iPhone-XS ReportCrash[26215] <Notice>: Formulating fatal report for corpse[26214] analyticsd.back Apr 29 13:47:52 Nontas-iPhone-XS ReportCrash(CoreAnalytics)[26215] <Notice>: Sending event: com.apple.stability.crash {"exceptionCodes":"KERN_INVALID_ADDRESS at 0x0000000000000000","incidentID":"B06EDDE6-8A72-4141-B8A0-E1B6269A8BCC","logwritten":0,"process":"analyticsd.back","terminationReasonNamespace":"<NO_NS>"} Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back(substitute-loader.dylib)[26216] <Error>: ExtensionLoader <private>: Safemode parent directory <private> is blocked by sandbox. Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back(substitute-loader.dylib)[26216] <Error>: ExtensionLoader <private>: Not loading <private>: Invalid filter plist (Bundles is not an array or is empty) Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: ==== START ==== Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back(libMobileGestalt.dylib)[26216] <Notice>: Could not open /private/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist: Permission denied Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: [CadenceManager] ==== FRESH INSTALL ==== Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: Scrub: [4] removing directory '<private>' Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: Scrub: [4] removing directory '<private>' Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Error>: [Config Store] DATABASE INITIALIZATION: clearing database Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Error>: [Config Store] DATABASE INITIALIZATION: creating tables Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Error>: [Config Store] DATABASE INITIALIZATION: complete Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: Running with LRU Cache Size: 131072 Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: Starting up kernel listener. Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: ==== starting mtShimServer Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: [Configurer] Bootstrap EMPTY config Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: ==== running main loop Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Error>: [Config Store] Deactivated all device configurations Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: Adding sink with privacy group 'Daily' Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: Adding sink with privacy group '90Day' Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: Adding sink with privacy group 'Never' Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: Adding sink with privacy group 'Daily' Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: Adding sink with privacy group '90Day' Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: Adding sink with privacy group 'Never' Apr 29 13:48:02 Nontas-iPhone-XS analyticsd.back[26216] <Notice>: ==== initialize best choice for config

PS : I'm also on iOS 14.5.1 on an iPhone XS. @cdustevich1 also has an iPhone 12 Pro Max with iOS 14.5.1. Maybe it has something to do with iOS 14.5.1?

29042023_135050_351_Nonta’s_iPhone_XS.log

[Nonta72]

I think I figured it out (somewhat!). As the logs state, there was no permission to write to /private/var/containers/Shared/SystemGroup/257C7AB7-940C-4876-AB65-09F3B0B8B801/Library/CoreAnalytics

I checked the permissions of each directory in /private/var/containers/Shared/SystemGroup/257C7AB7-940C-4876-AB65-09F3B0B8B801 and noticed that folder "Library" had the wrong ownership and permission values. In fact, the owner and group were both set to "nobody" with no permission of course. I changed the owner and usergroup to root:wheel and permissions to rwx-rwx-rwx. Now the daemon has fired up with PID 34883. I will observe the behavior and report back.

@cdustevich1 you should probably try this. Few commands in NewTerm2 or through an SSH tunnel should do the trick. You can use Filza if you don't want to use terminal.

[cdustevich1]

That worked, you are the man! The directory was different but I just looked through filza for the one with CoreAnalytics and set the permissions to 7777 for the Library folder and all subfolders and rebooted. Now if only there was a fix for Unc0ver breaking CarPlay…

[Nonta72]

That worked, you are the man! The directory was different but I just looked through filza for the one with CoreAnalytics and set the permissions to 7777 for the Library folder and all subfolders and rebooted. Now if only there was a fix for Unc0ver breaking CarPlay…

Glad it worked for you too! My battery graph has returned and so far no issue with it. I still face random reboots when I try to open some apps/games.

However, I never had any issue with CarPlay using this jailbreak. I use it with a Renault Clio 5. The only tweak I use that is related to CarPlay is CarBridge which allows me to access any app in CarPlay (not sure it can fix the problem you're facing, but it's worth mentioning).

[SongXiaoXi]

@Nonta72 I also noticed this permission denied error, which might be the reason why your analyticsd.back is not working. But strangely, on my device, the owner of files in this SystemGroup container is also nobody...
@Nonta72 Is there any files in /private/var/containers/Shared/SystemGroup/257C7AB7-940C-4876-AB65-09F3B0B8B801/Library/CoreAnalytics? Mine doesn't even have the CoreAnalytics directory.

[Nonta72]

@Nonta72 I also noticed this permission denied error, which might be the reason why your analyticsd.back is not working. But strangely, on my device, the owner of files in this SystemGroup container is also nobody... @Nonta72 Is there any files in /private/var/containers/Shared/SystemGroup/257C7AB7-940C-4876-AB65-09F3B0B8B801/Library/CoreAnalytics? Mine doesn't even have the CoreAnalytics directory.

No, there's nothing inside the folder. There was nothing before I changed the permission and I just checked, still nothing. Here's the output :

Nontas-iPhone-XS:~ root# ls -l /private/var/containers/Shared/SystemGroup/257C7AB7-940C-4876-AB65-09F3B0B8B801/Library/CoreAnalytics total 0 Nontas-iPhone-XS:~ root#
Are you on iOS 14.5.1 ? Because so far, it's the only thing @cdustevich1 and I have in common regarding this bug

[cdustevich1]

I also have nothing in the folder either. The permissions survived a rootfs (which surprised me but I guess makes sense) and it is definitely still working after a few hours. 14.5.1 does seem to be what’s in common between our devices so perhaps that’s the issue.

SXX ur looking at the systemgroup.com.apple.osanalytics folder correct? Because that’s the one that has CoreAnalytics in it for me.

[cdustevich1]

Glad it worked for you too! My battery graph has returned and so far no issue with it. I still face random reboots when I try to open some apps/games.

Can you list some of those apps? I can test on my devices and see if I have the same issues.

However, I never had any issue with CarPlay using this jailbreak. I use it with a Renault Clio 5.

Weirdly, CarPlay works on my CRV correctly every time but on my Mustang I have to unplug and replug 3 times for it to work. It's weird that it works differently on different vehicles, but I haven't been able to find a fix.

[Nonta72]

Can you list some of those apps? I can test on my devices and see if I have the same issues.

It mostly happens with a local shopping app (no use for you because you won't be able to download/use it outside my country). I also face the same issue with a crypto mining app called Pi Network. It's a hit or miss really. Sometimes it happens, sometimes it doesn't. I've given up on trying to fix that. I can use the website for shopping instead of the app. The crypto mining app bug doesn't bother me anymore really.

Weirdly, CarPlay works on my CRV correctly every time but on my Mustang I have to unplug and replug 3 times for it to work. It's weird that it works differently on different vehicles, but I haven't been able to find a fix.

Regarding the CarPlay, I'm not sure why it behaves like that with your vehicles. It's too bad because we're kinda stuck with 14.5.1 since iOS 16.3 and newer updates made futurerestore impossible because of the stup!d cryptex.

[Manan2004]

@cdustevich1 Here bro - https://apps.apple.com/us/app/golf-clash/id1089225191

This app will crash 2 mins into it

And it happens every time

[badger200]

@SongXiaoXi Check this out!!! Someone used the new "kfd" to make an unofficial fork of Taurine for 14.4! https://github.com/wh1te4ever/Taurine/releases/tag/v1.1.6-c

Unfortunately it only supports <A11 but still does this open any doors for a 14.4 fix that doesn't panic due to the task structure overwrite or whatever it is? And hopefully to avoid starting processes suspended like unc0ver v8 does? LMK

[SongXiaoXi]

@badger200 I have finally managed to find the time to tidy up all my code and release it here. And I can be certain that the kernel panic issue was caused by an implementation problem in unc0ver, because I haven't encountered any kernel panics in over two months, even when using these frequently problematic apps like low-quality web-based apps and the ones you mentioned, Fruit Ninja 2 and Real Racing 3.

However, it's still a work in progress, and I can't guarantee a completion date. I have only successfully tested it on iPhone 12 running iOS 14.5.1. There's still a lot to do: I have many details that I don't know how to implement, such as userspace reboot and ldrestart. The offsets or patching methods may not be compatible with other iOS versions or devices. And the installation UI is still misleading. If you want to give it a try, it's best to understand the changes I made to the code (although the implementation is quite messy). Contributions to the code are welcome.

[silentcloud]

@SongXiaoXi Great job! I hope you can release a usable version soon. I'll be available to assist with testing when that happens. 12 Pro Max 14.4.2.

[Liam0205]

Test device XR/14.5.1. : )

[junior2377]

I have a 12 Pro on 14.3 :)

[badger200]

Absolutely outstanding!! Is there any minimal way to try it? How/why is jailbreakd optional? Will excluding jailbreakd finally allow new processes to launch with full native speed?

If you want a great torture test, build Python and do a make test. It runs 1600 tests in batches according to cpu cores and ALWAYS kernel panicked my device about 50-60% through, I never once reached test 1600, making that a uniquely reproducible panic stemming from launching new terminal processes.

(If Python doesn't build, you might need to manually add #include <libutil.h> (or is it util.h?) atop _posixmodule.c for openpty. Also if ncursesw gives errors, you may have to copy and paste the compile command and change to -lncursesw.)