diff --git a/VolkswagenJB/.gitignore b/VolkswagenJB/.gitignore new file mode 100644 index 0000000..faf8687 --- /dev/null +++ b/VolkswagenJB/.gitignore @@ -0,0 +1,3 @@ +.theos/ +packages/ +.DS_Store diff --git a/VolkswagenJB/Makefile b/VolkswagenJB/Makefile new file mode 100644 index 0000000..d60baf2 --- /dev/null +++ b/VolkswagenJB/Makefile @@ -0,0 +1,13 @@ +TARGET = iphone:latest:14.0 +INSTALL_TARGET_PROCESSES = Volkswagen +ARCHS = arm64 + +include $(THEOS)/makefiles/common.mk + +TWEAK_NAME = VolkswagenJB + +VolkswagenJB_FILES = Tweak.x +VolkswagenJB_CFLAGS = -fobjc-arc +VolkswagenJB_FRAMEWORKS = Foundation + +include $(THEOS_MAKE_PATH)/tweak.mk diff --git a/VolkswagenJB/Tweak.x b/VolkswagenJB/Tweak.x new file mode 100644 index 0000000..ec0b4d5 --- /dev/null +++ b/VolkswagenJB/Tweak.x @@ -0,0 +1,98 @@ +#import +#import +#import +#import + +#define TARGET_MODULE "Volkswagen" +#define IDA_BASE 0x100000000 + +// sysctl P_TRACED check : always return 0 (no debugger) +#define ADDR_SYSCTL_DEBUG_CHECK 0x10081D5A4 + +// ptrace(PT_DENY_ATTACH) + FishHook installer : NOP the whole thing +#define ADDR_PTRACE_FISHHOOK 0x10081D704 + +// JailbreakDetection orchestrator (8 checks) : always return 1 (clean) +#define ADDR_JB_ORCHESTRATOR 0x100824E9C + +// Individual JB sub-checks : each returns 1 (no jailbreak found) +#define ADDR_JB_FILE_EXIST 0x100823E38 // type 1: stat/access +#define ADDR_JB_FILE_READABLE 0x100824238 // type 2: fopen/isReadable +#define ADDR_JB_SANDBOX_ESCAPE 0x1008245FC // type 3: write test + fork +#define ADDR_JB_SYMLINK 0x100824A14 // type 5: symlink resolve +#define ADDR_JB_DYLIB_NAMES 0x100824C7C // type 6: _dyld_get_image_name scan + +#define ADDR_SECURITY_CHECK_BFC 0x100828BFC // sub_100828BFC(v10) & 1 +#define ADDR_SECURITY_CHECK_D20 0x100828D20 // sub_100828D20() & 1 +#define ADDR_SECURITY_CHECK_CD4 0x100828CD4 // sub_100828CD4() : bool + + +static void *(*orig_sysctl_debug)(void); +static void *hooked_sysctl_debug(void) { NSLog(@"[VWTweak] hooked_sysctl_debug called"); return 0; } + +static void (*orig_ptrace_fishhook)(void); +static void hooked_ptrace_fishhook(void) { NSLog(@"[VWTweak] hooked_ptrace_fishhook called"); return; } + +static uint64_t (*orig_jb_orchestrator)(void); +static uint64_t hooked_jb_orchestrator(void) { NSLog(@"[VWTweak] hooked_jb_orchestrator called"); return 1; } + +// static uint64_t (*orig_jb_file_exist)(void); +// static uint64_t hooked_jb_file_exist(void) { NSLog(@"[VWTweak] hooked_jb_file_exist called"); return 1; } + +// static uint64_t (*orig_jb_file_readable)(void); +// static uint64_t hooked_jb_file_readable(void) { NSLog(@"[VWTweak] hooked_jb_file_readable called"); return 1; } + +// static uint64_t (*orig_jb_sandbox_escape)(void); +// static uint64_t hooked_jb_sandbox_escape(void) { NSLog(@"[VWTweak] hooked_jb_sandbox_escape called"); return 1; } + +// static uint64_t (*orig_jb_symlink)(void); +// static uint64_t hooked_jb_symlink(void) { NSLog(@"[VWTweak] hooked_jb_symlink called"); return 1; } + +// static uint64_t (*orig_jb_dylib_names)(void); +// static uint64_t hooked_jb_dylib_names(void) { NSLog(@"[VWTweak] hooked_jb_dylib_names called"); return 1; } + +static uint64_t (*orig_security_check_bfc)(uint64_t); +static uint64_t hooked_security_check_bfc(uint64_t arg) { NSLog(@"[VWTweak] hooked_security_check_bfc(%llu) called", arg); return 0; } + +static uint64_t (*orig_security_check_d20)(void); +static uint64_t hooked_security_check_d20(void) { NSLog(@"[VWTweak] hooked_security_check_d20 called"); return 0; } + +static uint64_t (*orig_security_check_cd4)(void); +static uint64_t hooked_security_check_cd4(void) { NSLog(@"[VWTweak] hooked_security_check_cd4 called"); return 0; } + + +static void hookAt(uintptr_t base, uintptr_t ida_addr, void *hook, void **orig) { + uintptr_t real = base + (ida_addr - IDA_BASE); + MSHookFunction((void *)real, hook, orig); + NSLog(@"[VWTweak] Hooked 0x%lx (slide base 0x%lx)", real, base); +} + +%ctor { + for (uint32_t i = 0; i < _dyld_image_count(); i++) { + const char *name = _dyld_get_image_name(i); + if (!name || !strstr(name, TARGET_MODULE)) + continue; + + uintptr_t base = (uintptr_t)_dyld_get_image_header(i); + NSLog(@"[VWTweak] Found %s at base 0x%lx", name, base); + + hookAt(base, ADDR_SYSCTL_DEBUG_CHECK, (void *)hooked_sysctl_debug, (void **)&orig_sysctl_debug); + hookAt(base, ADDR_PTRACE_FISHHOOK, (void *)hooked_ptrace_fishhook, (void **)&orig_ptrace_fishhook); + + hookAt(base, ADDR_JB_ORCHESTRATOR, (void *)hooked_jb_orchestrator, (void **)&orig_jb_orchestrator); + + // hookAt(base, ADDR_JB_FILE_EXIST, (void *)hooked_jb_file_exist, (void **)&orig_jb_file_exist); + // hookAt(base, ADDR_JB_FILE_READABLE, (void *)hooked_jb_file_readable, (void **)&orig_jb_file_readable); + // hookAt(base, ADDR_JB_SANDBOX_ESCAPE, (void *)hooked_jb_sandbox_escape,(void **)&orig_jb_sandbox_escape); + // hookAt(base, ADDR_JB_SYMLINK, (void *)hooked_jb_symlink, (void **)&orig_jb_symlink); + // hookAt(base, ADDR_JB_DYLIB_NAMES, (void *)hooked_jb_dylib_names, (void **)&orig_jb_dylib_names); + + hookAt(base, ADDR_SECURITY_CHECK_BFC, (void *)hooked_security_check_bfc,(void **)&orig_security_check_bfc); + hookAt(base, ADDR_SECURITY_CHECK_D20, (void *)hooked_security_check_d20,(void **)&orig_security_check_d20); + hookAt(base, ADDR_SECURITY_CHECK_CD4, (void *)hooked_security_check_cd4,(void **)&orig_security_check_cd4); + + return; + } + + NSLog(@"[VWTweak] Target module '%s' not found in dyld image list", TARGET_MODULE); +} \ No newline at end of file diff --git a/VolkswagenJB/VolkswagenJB.plist b/VolkswagenJB/VolkswagenJB.plist new file mode 100644 index 0000000..50f20a5 --- /dev/null +++ b/VolkswagenJB/VolkswagenJB.plist @@ -0,0 +1,7 @@ +{ + Filter = { + Bundles = ( + "com.volkswagen.WeConnect.production", + ); + }; +} \ No newline at end of file diff --git a/VolkswagenJB/control b/VolkswagenJB/control new file mode 100644 index 0000000..c96ed04 --- /dev/null +++ b/VolkswagenJB/control @@ -0,0 +1,9 @@ +Package: xyz.nohamr.volkswagenjb +Name: VolkswagenJB (Rootless) +Version: 1.0.0 +Architecture: iphoneos-arm +Description: Bypass jailbreak detection in Volkswagen app +Maintainer: NohamR +Author: NohamR +Section: Tweaks +Depends: mobilesubstrate (>= 0.9.5000) diff --git a/VolkswagenJB/index.md b/VolkswagenJB/index.md new file mode 100644 index 0000000..c0f670b --- /dev/null +++ b/VolkswagenJB/index.md @@ -0,0 +1,26 @@ +# VolkswagenJB + +Disables jailbreak detection in Volkswagen. + +- **App**: [Volkswagen](https://apps.apple.com/fr/app/volkswagen/id1517566572) +- **Latest version**: 2.72.0 +- **Tested on**: iOS 16.7.15 + +## Build + +```sh +make clean && make package THEOS_PACKAGE_SCHEME=rootless DEBUG=0 +``` + +## Inject + +```sh +cyan -i com.volkswagen.WeConnect.production_2.72.0.ipa \ + -o com.volkswagen.WeConnect.production_2.72.0_patched.ipa \ + -f xyz.nohamr.volkswagenjb_1.0.0-1_iphoneos-arm64.deb \ + -u +``` + +## Screenshots + +![../docs/screens/VolkswagenJB/undetected.png](../docs/screens/VolkswagenJB/undetected.png) \ No newline at end of file