Dev:Updating extensions for iOS 9

Let's collect knowledge like we did with Updating extensions for iOS 8 and Updating extensions for iOS 7 - paste in your notes and share what you've learned, and somebody else will organize it later. :) If you want to ask questions and share tips over chat with other developers, see How to use IRC for how to connect to #theos and #iphonedev.

'''Hey developer, you can add your knowledge here! Yes, you! Make an account and edit this page!'''

It's also helpful to double-check the statements here and add more info! These are notes and drafts from early research - feel free to update them.

If you want to see what's been recently updated on this page, you can use the wiki's history feature to compare the revisions (to look at the diff) since the last time you visited this page.

Compiling ldid on El Capitan
Not quite iOS 9, but still something to be aware of: El Capitan does not include OpenSSL, which ldid requires to compile. In order to get OpenSSL and modify ldid's make script to use it, follow these steps.

brew install openssl ./make.sh
 * Install Homebrew if you haven't already.
 * Install OpenSSL through Homebrew:
 * Clone ldid as normal.
 * Download this modded make.sh and replace the old one with this one.
 * Make as normal:

Alternatively, kirb (hi, that's me) just got ldid added to the main Homebrew repo.

brew update brew install ldid

This may be seen as more convenient for ensuring ldid is kept up to date in future.

Compilation changes
32 bit binaries loaded on 64 bit devices fail to do so since the 32 bit pagesize has been changed from 4096 bytes to 16384 bytes.

Tweaks targeted at 32 bit binaries on iOS 9 must now be compiled with

-Wl,-segalign,4000

This LDFLAG can be used to compile for older iOS versions as it had to be a multiple of 1000 and this new alignment is compatible.

If using Theos, add it like so to your makefile:

XXX_LDFLAGS += -Wl,-segalign,4000

This fix is integrated with kirb/theos. (Be sure to  regularly.)

If using Xcode, add a new entry to Other linker flags containing "-Wl,-segalign,4000" to the build settings of your project or target and make sure that the build option "Enable Bitcode" is disabled.

Source: saurik's tweet

One example of this are tweaks that modify Cydia, which is a 32 bit app.

Entitlements
Every dylib meant for injection has to be signed to work on iOS, even if no entitlements are required. Please make sure that your toolchain of choice is producing signed dylibs, if it is a fat binary, make sure that all slices are signed.

Use ldid to sign:

ldid -S Tweak.dylib

Failure to do this will invalidate the process and make it lose all entitlements. The standard symptom is the following, but frankly, it is confusing why any binaries are in the wild that haven't at least been passed through ldid, so please don't rely on this symptom and just fix your build environment.

Granting them at runtime
To grant entitlements to a specific process in iOS 9, it seems that iOS 8's _BSAuditTokenTaskHasEntitlement function in assertiond no longer does the trick, the new _BSXPCConnectionHasEntitlement needs to be hooked instead.

Sandbox Restrictions
Tweaks that create or edit files from a sandbox application outside the app's container is no longer allowed See CPDistributedMessagingCenter for some example code.
 * Use an XPC method to communicate with SpringBoard from the sandbox application

This way you could communicate with a SpringBoard class to get it to save or create your files

You would need to add AppSupport framework in your makefile XXX_FRAMEWORKS = AppSupport

You will get something like this: As a workaround you can just replace "atomically:YES" with "atomically:NO":
 * After the v1.1 Pangu Untether update it is no longer possible to save/create/modify the preferences from Sandboxed applications in "atomically" mode.

trying to use these functions in a sandboxed app will throw an error like:
 * some sysctl calls and proc_* functions cannot be used in a sandbox now

Which tools and other preexisting things are still working on iOS 9? Which ones don't work?
No fixes for the following at the time of this writing. Note that these work on 32-bit devices, such as an iPhone 5.


 * Cycript fails with the following error:


 * python fails with the following error


 * lighttpd fails with the following error

Killed: 9
Pangu9 causes many command-line tools to not work, with the error "Killed: 9"

This can be solved by running "ldid -S `which `"

Daemons
In iOS 9 the way daemons are loaded appears to have changed. Daemons prefixed with "com.apple" are loaded first with other daemons being loaded by launchd significantly later. This creates a bug for daemons that use XPC to communicate with SpringBoard. SpringBoard will be loaded before the daemon meaning a connection can never be established. Changing the daemon prefix to "com.apple" appears to make it load at the same time as SpringBoard allowing for the connection to succeed. More research is required into why other daemons are being loaded much later than in iOS 8.

Additionally, daemons are now outputting the error:

This can be fixed by adding the plist entry ExecuteAllowed with a boolean YES.

Daemons that use more than around 10MB are killed via Jetsam: The Jetsam log is written to ~mobile/Library/Logs/CrashReporter however it doesnt contain anything useful. It's possible Jetsam properties are required to be added to the plist to raise the daemon's memory limit. Apples launch daemon plists use properties in a device specific globals file at /System/Library/LaunchDaemons/com.apple.jetsamproperties.N71.plist It's not clear if you can still put the JetsamProperties keys in your daemon plist or if you need to add to the globals list, some Apple ones still have them e.g. com.apple.atc.plist.

Connecting to UNIX sockets
Tweaks built with a library injected into an app, communicating to a daemon using a UNIX a socket, might fail to connect to the UNIX socket, with error code EPERM, and the following syslog message: kernel[0] : Sandbox: app-name deny(1) network-outbound /private/var/tmp/mysocket Note that this worked with the original Pangu untether and has been failing to work (as described) with the latest (1.1.0) Pangu Fuxi Qin.

Update: This seems to be untrue. This doesn't work with the original Pangu untether as well. Maybe the Cydia update process has to do something with it? Maybe stashing?

A current workaround is to place the UNIX socket inside the app's sandbox.