amfid Lazy Binding Exploit

By creating a dylib without code, just redefining the signed code verification function with a "return ok" method from another signed library and using lazy binding, the entire code signing requirement gets circumvented. This method has been used by developers for a long time now.

In evasi0n, the amfi.dylib redefines these functions:

_kMISValidationOptionValidateSignatureOnly (_kCFUserNotificationTokenKey from CoreFoundation)
_kMISValidationOptionExpectedHash (_kCFUserNotificationTimeoutKey from CoreFoundation)
_MISValidateSignature (_CFEqual from CoreFoundation)

TODO: some more detailed description missing here.

Usage

evasi0n jailbreak

Credit

KennyTM~
maybe others too

References

networkpx blog post from 2009
Accuvant Labs analysis of evasi0n [Archived 2013-12-27 at the Wayback Machine]

v t e Exploits
Exploits	0x24000 Segment Overflow ARM Exception Vector Info Leak ARM7 Go AT+FNS AT+XAPP Vulnerability AT+XEMN Heap Overflow AT+XLOG Vulnerability AT+stkprof BPF_STX Kernel Write Exploit CVE-2013-0964 CVE-2021-30773 CVE-2021-30807 CVE-2021-30883 CoreTrust Root Certificate Validation Vulnerability De Rebus Antiquis Dual Boot Exploit Dynamic memmove() locating Fakeblank HFS Heap Overflow HFS Legacy Volume Name Stack Buffer Overflow IOPlatformArgs leak IOSurface Kernel Exploit IOUSBDeviceFamily Vulnerability IPSF Incomplete Codesign Exploit JerrySIM Kernel memory write via ROP gadget MacDirtyCow Malformed CFF Vulnerability Malformed PairRequest Minus 0x20000 with Back Extend Erase Minus 0x400 MobileBackup Copy Exploit Overlapping Segment Attack Packet Filter Kernel Exploit Psychic Paper Pwnage Pwnage 2.0 Racoon String Format Overflow Exploit Ramdisk Hack SHA-1 Image Segment Overflow Shebang Trick Soft Upgrade Symbolic Link Vulnerability Symlinks T1 Font Integer Overflow Timezone Vulnerability alloc8 Exploit amfid Lazy Binding Exploit amfid Text Relocation Exploit ... further results
Patches	/private/etc/fstab AMFI Binary Trust Cache Patch ASR Crazeles Hunnypot Kernel Patches PE_i_can_has_debugger Patch Sandbox Patch Signature Check Patch hgsp4 patch tfp0 patch vm_map_enter Patch vm_map_protect Patch

Usage

See Also

Credit

References