Using fork objc

Question

When detecting jailbroken device, why do most examples terminate app if fork process fails? Doesn't that mean device is not jailbroken, so everything is ok, without any child process?

int pid = fork();
if (!pid){
    exit(0);
}
if (pid >= 0) {
    return YES;
}

I'm guessing those code comments are yours? The first one makes no sense. — Brad Allred
– Brad Allred, Commented Dec 19, 2018 at 17:05

Rob Napier · Accepted Answer · 2018-12-19 17:00:58Z

5

A PID of 0 doesn't mean the fork failed. It means the fork succeeded and that the current process is the child. PID > 0 means the fork succeeded and the current process is the parent (the returned value is the child's PID). PID -1 means that it failed.

Since app processes are usually forbidden from forking, a -1 is the expected result. If fork is allowed, then there are two processes. The parent returns YES, and the child is terminated since it isn't actually needed for anything but testing whether the fork was allowed.

answered Dec 19, 2018 at 17:00

Rob Napier

301k37 gold badges492 silver badges660 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

AnonProgrammer Over a year ago

I just tested on jailbroken device and pid returns -1. Do you know if this mean forks aren't allowed even on jailbroken device, or that sandbox isnt compromised although jailbroken?

Rob Napier Over a year ago

I would say that the generation of jailbreak OS you have doesn't fall for this detection technique. I was a bit surprised that such a basic test would work; it's a lot harder than that to detect jailbreaks. But the above is what that code is trying to do.

AnonProgrammer Over a year ago

this test is is commonly used, and also exemplified in an Oreily book Hacking and Securing iOS Applications. Ive added my jailbreak code. Are there any resources or examples of better jailbreak detection without risking app review rejection? Thanks for the help

Rob Napier Over a year ago

If a simple app-level test could reliably detect jailbreaks for an extended period of time, Apple would just apply that test to prevent jailbreaking in the first place. Jailbreaking and jailbreak detection is an arms race where you need to keep your techniques secret or they won't work any more. It's not security; it's just obfuscation, and that means anything you pick up on StackOverflow or in a popular book is going to have bypasses.

creker Over a year ago

The reason that fork is not working on your device is specific to the jailbreak software you used. Jailbreak usually does several kernel patches to disable security features that prevent unsigned code execution and enable certain features to allow developers easier access to iOS internals. Forking is one of them. You get -1 because this exact jailbreak does not enable it. Pretty much all older jailbreak did, it was a standard feature. Same with CydiaSubstrate support, you need specific patches to enable it. Some recent jailbreaks also lack these patches.

|

Collectives™ on Stack Overflow

Using fork objc

1 Answer 1

6 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

6 Comments

Your Answer

Sign up or log in

Post as a guest

Related