Skip to content

Commit 0079cc8

Browse files
Arist Kojevnikovclaude
andcommitted
fix: fix black screen on iOS 26+ with correct dyld bypass and entitlements
- Use @available(iOS 26.0, *) with proper flag fallback chain for dyld bypass - Restore entitlements (application-identifier, container-required, jb.pmap_cs.custom_trust) - Remove auto-generated Xcode and binary changes Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
1 parent 00678b0 commit 0079cc8

2 files changed

Lines changed: 10 additions & 14 deletions

File tree

Natives/dyld_bypass_validation.m

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -228,23 +228,21 @@ void init_bypassDyldLibValidation() {
228228

229229
NSDebugLog(@"[DyldLVBypass] init");
230230

231-
switch ((int)DeviceGetJITFlags(YES)) {
232-
case JIT_FLAG_FORCE_MIRRORED | JIT_FLAG_HAS_TXM:
231+
if (@available(iOS 26.0, *)) {
232+
if (DeviceHasJITFlags(JIT_FLAG_FORCE_MIRRORED | JIT_FLAG_HAS_TXM)) {
233233
NSDebugLog(@"[DyldLVBypass] Using redirectFunctionMirrored");
234234
redirectFunction = redirectFunctionMirrored;
235-
break;
236-
case JIT_FLAG_FORCE_MIRRORED:
237-
// Special special case for non-TXM iOS 26+
238-
// We can JIT without script, but we cannot modify existing code in dsc without it.
239-
// Therefore, we choose a hook method that avoids patching code in dsc completely, using hardware breakpoint.
240-
// The function only stashes the original function pointers, and the breakpoint handler will redirect to our hook
235+
} else if (DeviceHasJITFlags(JIT_FLAG_FORCE_MIRRORED)) {
236+
// Non-TXM iOS 26+: avoid patching code in dsc, use hardware breakpoint instead
241237
NSDebugLog(@"[DyldLVBypass] Using redirectFunctionHWBreakpoint");
242238
redirectFunction = redirectFunctionHWBreakpoint;
243-
break;
244-
default:
239+
} else {
245240
NSDebugLog(@"[DyldLVBypass] Using redirectFunctionDirect");
246241
redirectFunction = redirectFunctionDirect;
247-
break;
242+
}
243+
} else {
244+
NSDebugLog(@"[DyldLVBypass] Using redirectFunctionDirect");
245+
redirectFunction = redirectFunctionDirect;
248246
}
249247

250248
// Modifying exec page during execution may cause SIGBUS, so ignore it now

entitlements.sideload.xml

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,10 @@
33
<dict>
44
<key>application-identifier</key>
55
<string>org.angelauramc.amethyst</string>
6-
<key>com.apple.private.security.container-required</key>
6+
<key>com.apple.private.security.container-required</key>
77
<string>org.angelauramc.amethyst</string>
88
<key>get-task-allow</key>
99
<true/>
10-
1110
<key>com.apple.developer.kernel.extended-virtual-addressing</key>
1211
<true/>
1312
<key>com.apple.developer.kernel.increased-memory-limit</key>
@@ -17,7 +16,6 @@
1716
<key>com.apple.private.memorystatus</key>
1817
<true/>
1918

20-
<!-- Custom entitlement to indicate this was installed with TrollStore, still sandboxed -->
2119
<key>jb.pmap_cs.custom_trust</key>
2220
<string>PMAP_CS_APP_STORE</string>
2321
</dict>

0 commit comments

Comments
 (0)