Untethered + Unsandboxed code execution haxx as root on iOS 14 – iOS 14.8.1.
Based on CoreTrustDemo, also please note that certificates are not copyrightable.
Note: requires macOS + existing jailbreak
Get up and running
- On your mac import dev_certificate.p12 into the keychain, and the password is
- Modify haxx.c to include your own code (if you need it).
- On the device, Copy
- Then replace
- Create the
/private/var/haxxdirectory, mode should be 0777
haxxgenerated from the build to
/usr/local/binon the device, mode should be 0755.
After doing the above steps,
fileproviderctl will be broken, to fix it do the following steps
- Grab a copy of
/usr/bin/fileproviderctlon your device to your mac
- Patch the binary with GNU sed:
gsed -i 's|/usr/local/bin/fileproviderctl_internal|/usr/local/bin/fileproviderctl_XXXXXXXX|g' fileproviderctl
- Resign it:
codesign -s "Worth Doing Badly iPhone OS Application Signing" --preserve-metadata=entitlements --force fileproviderctl
- Put the fixed binary back onto your device.
To remove the installation, do the following steps
/usr/local/bin/fileproviderctl_internalas well as