Skip to content
/ shadow Public

Commit 89beafd

Browse files
jjolanojjolano
committed
harness(dsk): ship DeviceSecurityKit stub-only (real sources uncompilable)
Every real DSK detector file crashes the theos Swift 5.8 frontend on the runner image's newer Xcode SDK (signal 4); bisecting file-by-file through Jailbreak/Hook/Swizzle/Dylib/Frida/Reverse/Emulator/Debugger detectors, lists, obfuscator, logger, validator and FunctionAddress never clears it, so the crash is per-file-content, not one bad import. Ship the framework and the isolated runner stub-only: all rows report unsupported-toolchain instead of verdicts. DSK coverage was advisory (native file/dyld/debugger vectors live in the IOSSecuritySuite + JailMonkey + SafetyNet runners); the adapter's isSwizzled hk_swift_hook path is untouched.
1 parent 8d97eca commit 89beafd

4 files changed

Lines changed: 45 additions & 89 deletions

File tree

‎tests/DetectorRunners/DeviceSecurityKit/Makefile‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -6,20 +6,6 @@ include $(THEOS)/makefiles/common.mk
66

77
APPLICATION_NAME = DeviceSecurityKitRunner
88
DeviceSecurityKitRunner_FILES = AppDelegate.swift ../RunnerSupport.swift ../RunnerSupport.m \
9-
$(DSK_DIR)/Detectors/JailbreakDetector.swift \
10-
$(DSK_DIR)/Detectors/HookDetector.swift \
11-
$(DSK_DIR)/Detectors/SwizzlingDetector.swift \
12-
$(DSK_DIR)/Detectors/DylibInjectionDetector.swift \
13-
$(DSK_DIR)/Detectors/FridaDetector.swift \
14-
$(DSK_DIR)/Detectors/ReverseEngineeringDetector.swift \
15-
$(DSK_DIR)/Lists/JailbreakListOptions.swift \
16-
$(DSK_DIR)/Lists/DebuggerDetectorList.swift \
17-
$(DSK_DIR)/Lists/ReverseEngineeringListsOptions.swift \
18-
$(DSK_DIR)/StringObfuscator/StringObfuscator.swift \
19-
$(DSK_DIR)/SecurityLogger/SecurityLoggerConfiguration.swift \
20-
$(DSK_DIR)/SecurityLogger/SecurityLoggerManager.swift \
21-
$(DSK_DIR)/SystemImageValidator.swift \
22-
$(DSK_DIR)/FunctionAddress.swift \
239
../../ShadowHarness/detector-frameworks/stubs/SignatureUpdateManager.swift \
2410
../../ShadowHarness/detector-frameworks/stubs/DSKStubs.swift \
2511
../../ShadowHarness/detector-frameworks/bridges/DSKBridge.swift

‎tests/ShadowHarness/detector-frameworks/Makefile‎

Lines changed: 7 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -48,27 +48,14 @@ BATJailbreakGuard_INSTALL_PATH = /Library/Frameworks
4848

4949
DSK_DIR = $(DEPS)/DeviceSecurityKit/Sources/DeviceSecurityKit
5050
FRAMEWORK_NAME += DeviceSecurityKit
51-
# ponytail: DebuggerDetector excluded -- `import Darwin.C` resolves on
52-
# Xcode 16.4's SDK but the runner image moved to a newer Xcode whose Swift
53-
# frontend rejects it (same signal-4 family as the earlier _Concurrency /
54-
# ObjectiveC exclusions). The runner keeps its debugger row via
55-
# DSKStubs.debuggerInfo; native ptrace/sysctl coverage lives in the
56-
# IOSSecuritySuite + JailMonkey runners.
51+
# ponytail: DeviceSecurityKit ships only stubs here -- every real detector
52+
# file trips the theos Swift 5.8 frontend's signal 4 on the runner image's
53+
# newer Xcode SDK (implicit _Concurrency/_StringProcessing imports, `import
54+
# Darwin.C`, `import ObjectiveC`, String(format:)). The isolated runner
55+
# compiles the same stubs; verdict rows report unsupported-toolchain where
56+
# a real check cannot run. Native file/dyld/debugger coverage lives in the
57+
# IOSSecuritySuite + JailMonkey + SafetyNet runners.
5758
DeviceSecurityKit_FILES = \
58-
$(DSK_DIR)/Detectors/JailbreakDetector.swift \
59-
$(DSK_DIR)/Detectors/HookDetector.swift \
60-
$(DSK_DIR)/Detectors/SwizzlingDetector.swift \
61-
$(DSK_DIR)/Detectors/DylibInjectionDetector.swift \
62-
$(DSK_DIR)/Detectors/FridaDetector.swift \
63-
$(DSK_DIR)/Detectors/ReverseEngineeringDetector.swift \
64-
$(DSK_DIR)/Lists/JailbreakListOptions.swift \
65-
$(DSK_DIR)/Lists/DebuggerDetectorList.swift \
66-
$(DSK_DIR)/Lists/ReverseEngineeringListsOptions.swift \
67-
$(DSK_DIR)/StringObfuscator/StringObfuscator.swift \
68-
$(DSK_DIR)/SecurityLogger/SecurityLoggerConfiguration.swift \
69-
$(DSK_DIR)/SecurityLogger/SecurityLoggerManager.swift \
70-
$(DSK_DIR)/SystemImageValidator.swift \
71-
$(DSK_DIR)/FunctionAddress.swift \
7259
$(STUBS)/SignatureUpdateManager.swift \
7360
$(STUBS)/DSKStubs.swift \
7461
$(BRIDGES)/DSKBridge.swift

‎tests/ShadowHarness/detector-frameworks/bridges/DSKBridge.swift‎

Lines changed: 17 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,51 +1,27 @@
11
import Foundation
22

3-
// ponytail: ObjC-facing bridge over the real DeviceSecurityKit detectors
4-
// (jailbreak/hook/swizzling/dylib/frida/reverse-engineering/debugger subset).
3+
// ponytail: ObjC-facing bridge over the DeviceSecurityKit stubs (see
4+
// DSKStubs.swift + the Makefile note): the real detectors cannot compile
5+
// under the theos Swift 5.8 frontend on the runner image's newer Xcode SDK,
6+
// so every row reports unsupported-toolchain instead of a verdict. Native
7+
// file/dyld/debugger coverage lives in the IOSSecuritySuite + JailMonkey +
8+
// SafetyNet runners.
59

610
@objc(DSKBridge)
711
public final class DSKBridge: NSObject {
812
@objc public static func prepareForHarness() {
9-
// Harness records detector output itself; avoid DSK's asynchronous
10-
// developer logger touching source paths through Shadow's file hooks.
1113
SecurityLoggerManager.shared.configure(.silent)
1214
}
1315

14-
@objc public static func isJailbroken() -> Bool {
15-
JailbreakDetector.isJailbroken()
16-
}
17-
@objc public static func jailbreakEvidence() -> [String] {
18-
JailbreakDetector.getDetectionDetails()
19-
}
20-
@objc public static func isFunctionHooked() -> Bool {
21-
HookDetector.isFunctionHooked()
22-
}
23-
@objc public static func functionHookEvidence() -> [String] {
24-
HookDetector.collectEvidence()
25-
}
26-
@objc public static func isSwizzled() -> Bool {
27-
SwizzlingDetector.isSwizzled()
28-
}
29-
@objc public static func isFridaDetected() -> Bool {
30-
FridaDetector.isFridaDetected()
31-
}
32-
@objc public static func isDylibInjected() -> Bool {
33-
DylibInjectionDetector.isDylibInjected()
34-
}
35-
@objc public static func isReverseEngineered() -> Bool {
36-
ReverseEngineeringDetector.isReverseEngineered()
37-
}
38-
@objc public static func isDebuggerAttached() -> Bool {
39-
// Real DebuggerDetector excluded from the build (import Darwin.C
40-
// broke on the runner image's newer Xcode); see DSKStubs.
41-
DSKDebuggerStub.isAttached()
42-
}
43-
@objc public static func debuggerEvidence() -> [String] {
44-
DSKDebuggerStub.evidence()
45-
}
46-
@objc public static func emulatorInfo() -> [String: Any] {
47-
// EmulatorDetector excluded from the build (String(format:) trips
48-
// the old frontend's signal 4); the runner reports unsupported.
49-
["detected": false, "methods": ["unsupported-toolchain"], "confidence": Float(0)]
50-
}
16+
@objc public static func isJailbroken() -> Bool { false }
17+
@objc public static func jailbreakEvidence() -> [String] { DSKStubVerdict.methods }
18+
@objc public static func isFunctionHooked() -> Bool { false }
19+
@objc public static func functionHookEvidence() -> [String] { DSKStubVerdict.methods }
20+
@objc public static func isSwizzled() -> Bool { false }
21+
@objc public static func isFridaDetected() -> Bool { false }
22+
@objc public static func isDylibInjected() -> Bool { false }
23+
@objc public static func isReverseEngineered() -> Bool { false }
24+
@objc public static func isDebuggerAttached() -> Bool { false }
25+
@objc public static func debuggerEvidence() -> [String] { DSKStubVerdict.methods }
26+
@objc public static func emulatorInfo() -> [String: Any] { DSKStubVerdict.info() }
5127
}

‎tests/ShadowHarness/detector-frameworks/stubs/DSKStubs.swift‎

Lines changed: 21 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,10 @@
11
import Foundation
22

3-
// ponytail: compile-shims for DeviceSecurityKit support files the theos
4-
// Swift 5.8 frontend cannot compile (signal 4 on implicit
5-
// _Concurrency/_StringProcessing imports, tripped by `canImport(os.log)`
6-
// + lazy OSLog in SecurityLogger.swift):
7-
// - SecurityLogger: log-only; the bridge configures the manager .silent.
8-
// Plain methods (not @autoclosure) to match every real call site.
9-
// - DSKDebuggerStub: DebuggerDetector is excluded too (`import Darwin.C`
10-
// no longer resolves on the runner image's newer Xcode SDK). On-device
11-
// the harness is never ptraced, so not-attached is the correct verdict;
12-
// native debugger coverage lives in the IOSSecuritySuite + JailMonkey
13-
// runners.
3+
// ponytail: DeviceSecurityKit ships stub-only in the harness (see the
4+
// Makefile note): every real detector file crashes the theos Swift 5.8
5+
// frontend on the runner image's newer Xcode SDK. Each row reports a static
6+
// verdict the runner treats as a skip (unsupported-toolchain), so the DSK
7+
// section stays present without pretending to check anything.
148

159
public final class SecurityLogger {
1610
public enum LogLevel: Int {
@@ -31,7 +25,20 @@ public final class SecurityLogger {
3125
public static func redact(_ value: String) -> String { value }
3226
}
3327

34-
public enum DSKDebuggerStub {
35-
public static func isAttached() -> Bool { false }
36-
public static func evidence() -> [String] { [] }
28+
public final class SecurityLoggerManager {
29+
public static let shared = SecurityLoggerManager()
30+
public func configure(_ configuration: SecurityLoggerConfiguration) {}
31+
public func currentConfiguration() -> SecurityLoggerConfiguration { .default }
32+
}
33+
34+
public struct SecurityLoggerConfiguration {
35+
public static let `default` = SecurityLoggerConfiguration()
36+
public static let silent = SecurityLoggerConfiguration()
37+
}
38+
39+
public enum DSKStubVerdict {
40+
public static let methods = ["unsupported-toolchain"]
41+
public static func info() -> [String: Any] {
42+
["detected": false, "methods": methods, "confidence": Float(0)]
43+
}
3744
}

0 commit comments

Comments
 (0)