做个记录越狱ios设备获取root权限（测试没通过）

最新推荐文章于 2023-04-25 16:43:26 发布

转载最新推荐文章于 2023-04-25 16:43:26 发布 · 834 阅读

文章标签：

#IOS

IOS 专栏收录该内容

24 篇文章

订阅专栏

本文详细介绍了如何通过在main.m中设置权限，正常构建应用，并将可执行文件复制到.app目录下，修改文件名并添加bash脚本来实现对非移动目录的访问。通过改变原始文件的权限和使用特定的bash脚本，SpringBoard能够首先运行此文件，然后通过传递参数启动实际的应用程序。确保在设备上SSH应用，并调整权限以顺利运行。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

It is true, the app has to run as root to access non mobile directories. After discussing this with Optimo and Saurik I finally found the right way to get root privileges.

In the main.m add setuid(0); and setgid(0);
Build the app normally.
Then copy and paste the executable inside the .app and rename it to anything you want, don't rename the original file.
Open the original executable file and delete its contents (the contents are now stored in the previously copied and renamed binary).
Add this bash script to the empty binary file from 4. :
```
#!/bin/bash
dir=$(dirname "$0")
exec "${dir}"/<COPIED FILE NAME> "$@"
```
Springboard will run this file first because its the CFBundleExecutable, then this will launch the actual app's executable. This is done because SpringBoard would fail to directly launch the executable with root permissions
Open terminal and change the directory to the .app (ex. cd /User/Me/Desktop/MyApp.app)
chmod the original executable file to 0755 (ex. chmod 0755 MyCFBundleExecutable) and the copied file to 6755 (ex. chmod 6755 CFBundleExecutableRoot)
SSH the .app into /Applications on your device, respring and launch it (if its not launching then repeat set 7. but by SSHing into your device via terminal)