Skip to content
This repository was archived by the owner on Jan 8, 2024. It is now read-only.

Commit

Permalink
Create README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
hrtowii authored Jan 7, 2024
1 parent 3b7429b commit e84dfc7
Showing 1 changed file with 31 additions and 0 deletions.
31 changes: 31 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
# Serotonin - not/semi-jailbreak for iOS 16.2 - 16.6.1

## How do I use it?
* Download tipa, install via TrollStore
* Press jailbreak
* Be happy

## How is this done?
* Replace launchd by searching through /sbin's vp_namecache, then find launchd's name cache and kwrite it with a patch to our patched launchd.
* Better explanation from AlfieCG [here](https://www.reddit.com/r/jailbreak/comments/18zehl2/comment/kgi5ya3/)
* patched launchd hooks posix_spawnp of SpringBoard and execs our own SpringBoard with springboardhook.dylib
* springboardhook loads in tweaks, ellekit, etc.
* CoreTrust bug used to bypass codesigning and allow any binary to run with arbitrary entitlements
* KFD / Any other kernel read/write bug to write to the name cache in the first place

## Todo in the future
* Try adding support for lower iOS versions by overwriting NSGetExecutablePath
* Add support for arm64
* Add a boot splash screen
* Fix `puaf_pages` picker crash in new UI

## Credits
* hrtowii / sacrosanctuary - main dev
* DuyKhanhTran - launchd and SpringBoard hooks
* NSBedtime - initial launchdhax, helped out a ton!
* AlfieCG - helped out a ton!
* Nick Chan - helped out a ton!
* BomberFish - main UI
* haxi0 - initial logger
* Evelyne for showing it was possible. I wouldn't have gotten motivated without that initial tweet lol

0 comments on commit e84dfc7

Please sign in to comment.