By creating a dylib without code, just redefining the signed code verification function with a "return ok" method from another signed library and using lazy binding, the entire code signing requirement gets circumvented. This method has been used by developers for a long time now.
In evasi0n, the amfi.dylib redefines these functions:
- _kMISValidationOptionValidateSignatureOnly (_kCFUserNotificationTokenKey from CoreFoundation)
- _kMISValidationOptionExpectedHash (_kCFUserNotificationTimeoutKey from CoreFoundation)
- _MISValidateSignature (_CFEqual from CoreFoundation)
TODO: some more detailed description missing here.
- evasi0n jailbreak
- maybe others too
- networkpx blog post from 2009
- iPhoneDevWiki, Xcode, Developing without Provisioning Profile
- Accuvant Labs analysis of evasi0n Archived 2013-12-27 at the Wayback Machine