chore: convert JIT checks to flags

Author: khanhduytran0

Natives/JavaLauncher.m

@@ -101,7 +101,10 @@ void init_loadCustomJvmFlags(int* argc, const char** argv) {
 int launchJVM(NSString *username, id launchTarget, int width, int height, int minVersion) {
     NSLog(@"[JavaLauncher] Beginning JVM launch");
 
-    BOOL requiresTXMWorkaround = DeviceRequiresTXMWorkaround();
+    init_loadDefaultEnv();
+    init_loadCustomEnv();
+
+    BOOL requiresTXMWorkaround = DeviceHasJITFlags(JIT_FLAG_FORCE_MIRRORED | JIT_FLAG_HAS_TXM);
     BOOL jit26AlwaysAttached = getPrefBool(@"debug.debug_always_attached_jit");
     if (requiresTXMWorkaround) {
         static void *result;
@@ -143,10 +146,6 @@ int launchJVM(NSString *username, id launchTarget, int width, int height, int mi
         NSLog(@"[DyldLVBypass] Hook disabled! Loading unsigned dylib will cause code signature error.");
     }
 
-
-    init_loadDefaultEnv();
-    init_loadCustomEnv();
-
     BOOL launchJar = NO;
     NSString *gameDir;
     NSString *defaultJRETag;

Natives/LauncherNavigationController.m

@@ -423,7 +423,7 @@ - (void)receiveNotification:(NSNotification *)notification {
 
 - (void)invokeAfterJITEnabled:(void(^)(void))handler {
     localVersionList = remoteVersionList = nil;
-    BOOL hasTrollStoreJIT = getEntitlementValue(@"jb.pmap_cs_custom_trust");
+    BOOL hasTrollStoreJIT = getEntitlementValue(@"jb.pmap_cs.custom_trust");
     BOOL isLiveContainer = getenv("LC_HOME_PATH") != NULL;
 
     if (isJITEnabled(false)) {
@@ -440,7 +440,7 @@ - (void)invokeAfterJITEnabled:(void(^)(void))handler {
         return;
     } else if (@available(iOS 17.4, *)) {
         NSString *scriptDataString = @"";
-        if(DeviceRequiresTXMWorkaround()) {
+        if(DeviceHasJITFlags(JIT_FLAG_FORCE_MIRRORED | JIT_FLAG_HAS_TXM)) {
             NSData *scriptData = [NSData dataWithContentsOfFile:[NSBundle.mainBundle.bundlePath stringByAppendingPathComponent:@"UniversalJIT26.js"]];
             scriptDataString = [@"&script-data=" stringByAppendingString:[scriptData base64EncodedStringWithOptions:0]];
         }

Natives/LauncherPreferencesViewController.m

@@ -371,7 +371,7 @@ - (void)viewDidLoad
                 @"icon": @"app.connected.to.app.below.fill",
                 @"type": self.typeSwitch,
                 @"enableCondition": ^BOOL(){
-                    return DeviceRequiresTXMWorkaround() && whenNotInGame();
+                    return DeviceHasJITFlags(JIT_FLAG_FORCE_MIRRORED | JIT_FLAG_HAS_TXM) && whenNotInGame();
                 },
             },
             @{@"key": @"debug_skip_wait_jit",

Natives/dyld_bypass_validation.m

@@ -68,7 +68,7 @@ bool redirectFunctionDirect(char *name, void *patchAddr, void *target) {
 }
 // redirectFunction for iOS 26+ (TXM)
 bool redirectFunctionMirrored(char *name, void *patchAddr, void *target) {
-    if (DeviceRequiresTXMWorkaround()) {
+    if (DeviceHasJITFlags(JIT_FLAG_FORCE_MIRRORED | JIT_FLAG_HAS_TXM)) {
         JIT26PrepareRegionForPatching(patchAddr, sizeof(patch));
     }
     // mirror `addr` (rx, JIT applied) to `mirrored` (rw)
@@ -160,8 +160,9 @@ bool searchAndPatch(char *name, char *base, char *signature, int length, void *t
 
     void *map = __mmap(addr, len, prot, flags, fd, offset);
     if (map == MAP_FAILED && fd && (prot & PROT_EXEC)) {
+        printf("[DyldLVBypass] mmap(prot=%d, flags=%d, fd=%d)\n", prot, flags, fd);
         map = __mmap(addr, len, prot, flags | MAP_PRIVATE | MAP_ANON, 0, 0);
-        if (DeviceRequiresTXMWorkaround()) {
+        if (DeviceHasJITFlags(JIT_FLAG_FORCE_MIRRORED | JIT_FLAG_HAS_TXM)) {
             JIT26PrepareRegion(map, len);
         }
 
@@ -192,7 +193,11 @@ int hooked___fcntl(int fildes, int cmd, void *param) {
 #if !(TARGET_OS_MACCATALYST || TARGET_OS_SIMULATOR)
         // attempt to attach code signature on iOS only as the binaries may have been signed
         // on macOS, attaching on unsigned binaries without CS_DEBUGGED will crash
-        orig_fcntl(fildes, cmd, param);
+        // ignoreFcntl is a special case for vphone or dev unit with TXM JIT enforcement disabled
+        BOOL ignoreFcntl = DeviceHasJITFlags(JIT_FLAG_IS_IOS_26 | JIT_FLAG_HAS_TXM) && !DeviceHasJITFlags(JIT_FLAG_FORCE_MIRRORED);
+        if (!ignoreFcntl) {
+            orig_fcntl(fildes, cmd, param);
+        }
 #endif
         fsignatures_t *fsig = (fsignatures_t*)param;
         // called to check that cert covers file.. so we'll make it cover everything ;)
@@ -218,21 +223,23 @@ void init_bypassDyldLibValidation() {
 
     NSDebugLog(@"[DyldLVBypass] init");
 
-    if (@available(iOS 26.0, *)) {
-        if (DeviceRequiresTXMWorkaround()) {
+    switch ((int)DeviceGetJITFlags(YES)) {
+        case JIT_FLAG_FORCE_MIRRORED | JIT_FLAG_HAS_TXM:
             NSDebugLog(@"[DyldLVBypass] Using redirectFunctionMirrored");
             redirectFunction = redirectFunctionMirrored;
-        } else {
+            break;
+        case JIT_FLAG_FORCE_MIRRORED:
             // Special special case for non-TXM iOS 26+
             // We can JIT without script, but we cannot modify existing code in dsc without it.
             // Therefore, we choose a hook method that avoids patching code in dsc completely, using hardware breakpoint.
             // The function only stashes the original function pointers, and the breakpoint handler will redirect to our hook
             NSDebugLog(@"[DyldLVBypass] Using redirectFunctionHWBreakpoint");
             redirectFunction = redirectFunctionHWBreakpoint;
-        }
-    } else {
-        NSDebugLog(@"[DyldLVBypass] Using redirectFunctionDirect");
-        redirectFunction = redirectFunctionDirect;
+            break;
+        default:
+            NSDebugLog(@"[DyldLVBypass] Using redirectFunctionDirect");
+            redirectFunction = redirectFunctionDirect;
+            break;
     }
 
     // Modifying exec page during execution may cause SIGBUS, so ignore it now

Natives/input_bridge_v3.m

@@ -139,7 +139,7 @@ void CTCDesktopPeer_openGlobal(JNIEnv *env, jclass clazz, jstring path) {
 
 void hackFix18LWJGL(void *addr) {
     addr = (void *)((uintptr_t)addr & ~PAGE_MASK);
-    if(@available(iOS 19.0, *)) return;
+    if(DeviceHasJITFlags(JIT_FLAG_FORCE_MIRRORED)) return;
     if(!mprotect(addr, PAGE_SIZE, PROT_READ | PROT_EXEC)) return;
     // FIXME: For some reason the one page in liblwjgl.dylib is mapped as r-x/rwx (COW), and recent builds on iOS 18 switches it to r--/rw- causing codesign failure. Here we hack it to map anon page to get r-x back
     char tempPage[PAGE_SIZE];

Natives/main.m

@@ -85,7 +85,8 @@ bool init_checkForJailbreak() {
 
     // Check if posix_spawn is hooked
     for (int i=0; i < _dyld_image_count(); i++) {
-        if (strcmp(_dyld_get_image_name(i),"/usr/lib/pspawn_payload-stg2.dylib") == 0) {
+        if (strcmp(_dyld_get_image_name(i),"/usr/lib/pspawn_payload-stg2.dylib") == 0 ||
+            strstr(_dyld_get_image_name(i),"/systemhook.dylib") == 0) {
             return true;
         }
     }

Natives/main_hook.m

@@ -67,8 +67,8 @@ void hooked_exit(int code) {
 
 void* hooked_dlopen(const char* path, int mode) {
     BOOL shouldUseDyldBypass26PPL = NO;
-    if (@available(iOS 19.0, *)) {
-        shouldUseDyldBypass26PPL = hwRedirectOrig[0] && !DeviceRequiresTXMWorkaround();
+    if (DeviceHasJITFlags(JIT_FLAG_FORCE_MIRRORED)) {
+        shouldUseDyldBypass26PPL = hwRedirectOrig[0] && !DeviceHasJITFlags(JIT_FLAG_HAS_TXM);
     }
     // Only patch Mach-O and use dyld bypass dylib is in the home dir
     // or tmp dir: LiveContainer makes a symlink to its own tmp dir so checking home dir alone would fail

Natives/utils.h

@@ -66,7 +66,15 @@ void* JIT26PrepareRegion(void *addr, size_t len);
 void JIT26PrepareRegionForPatching(void *addr, size_t len);
 void JIT26SetDetachAfterFirstBr(BOOL value);
 void JIT26SendJITScript(NSString* script);
-BOOL DeviceRequiresTXMWorkaround(void);
+
+// Device JIT flags
+typedef enum {
+    JIT_FLAG_IS_IOS_26 = 1 << 0,
+    JIT_FLAG_FORCE_MIRRORED = 1 << 1,
+    JIT_FLAG_HAS_TXM = 1 << 2,
+} JITFlags;
+JITFlags DeviceGetJITFlags(BOOL refresh);
+BOOL DeviceHasJITFlags(JITFlags flags);
 
 // Init functions
 void init_bypassDyldLibValidation();

Natives/utils.m

@@ -15,12 +15,12 @@
 BOOL getEntitlementValue(NSString *key) {
     void *secTask = SecTaskCreateFromSelf(NULL);
     CFTypeRef value = SecTaskCopyValueForEntitlement(SecTaskCreateFromSelf(NULL), key, nil);
-    if (value != nil) {
-        CFRelease(value);
-    }
     CFRelease(secTask);
-
-    return value != nil && [(__bridge id)value boolValue];
+    if (value == nil) {
+        return NO;
+    }
+    CFRelease(value);
+    return ![(__bridge id)value isKindOfClass:NSNumber.class] || [(__bridge id)value boolValue];
 }
 
 BOOL isJITEnabled(BOOL checkCSFlags) {
@@ -184,20 +184,58 @@ void JIT26SendJITScript(NSString* script) {
     NSCAssert(script, @"Script must not be nil");
     BreakSendJITScript((char*)script.UTF8String, script.length);
 }
-BOOL DeviceRequiresTXMWorkaround(void) {
-    if (@available(iOS 26.0, *)) {
-        DIR *d = opendir("/private/preboot");
-        if(!d) return NO;
-        struct dirent *dir;
-        char txmPath[PATH_MAX];
-        while ((dir = readdir(d)) != NULL) {
-            if(strlen(dir->d_name) == 96) {
-                snprintf(txmPath, sizeof(txmPath), "/private/preboot/%s/usr/standalone/firmware/FUD/Ap,TrustedExecutionMonitor.img4", dir->d_name);
-                break;
-            }
+
+BOOL DeviceCanCreateRXMap(void) {
+    // This is only guaranteed to be accurate when JIT is already enabled. Obviously this is only useful for vphone and similar internal environments where JIT is always enabled.
+    uint32_t *map = mmap(NULL, getpagesize(), PROT_READ | PROT_WRITE, MAP_ANONYMOUS | MAP_SHARED, -1, 0);
+    assert(map != MAP_FAILED);
+    *map = 0xFFFFFFFF;
+    int ret = mprotect(map, getpagesize(), PROT_READ | PROT_EXEC) | mprotect(map, getpagesize(), PROT_READ | PROT_EXEC);
+    munmap(map, getpagesize());
+    return ret == 0;
+}
+BOOL DeviceHasTXM(void) {
+    DIR *d = opendir("/private/preboot");
+    if(!d) return NO;
+    struct dirent *dir;
+    char txmPath[PATH_MAX];
+    while ((dir = readdir(d)) != NULL) {
+        if(strlen(dir->d_name) == 96) {
+            snprintf(txmPath, sizeof(txmPath), "/private/preboot/%s/usr/standalone/firmware/FUD/Ap,TrustedExecutionMonitor.img4", dir->d_name);
+            break;
         }
-        closedir(d);
-        return access(txmPath, F_OK) == 0;
     }
-    return NO;
+    closedir(d);
+    return access(txmPath, F_OK) == 0;
+}
+JITFlags DeviceGetJITFlags(BOOL refresh) {
+    static JITFlags cachedFlags = 0;
+    static dispatch_once_t onceToken;
+    if (refresh) onceToken = 0;
+    dispatch_once(&onceToken, ^{
+        const char *s = getenv("JIT_FLAGS");
+        if (s) {
+            if (s[0] == '0' && tolower(s[1]) == 'b') {
+                cachedFlags = strtoul(s + 2, NULL, 2);
+            } else {
+                cachedFlags = strtoul(s, NULL, 0);
+            }
+            NSLog(@"[JIT] Using overridden JIT flags: 0x%X", cachedFlags);
+            return;
+        }
+        
+        if (@available(iOS 26.0, *)) {
+            cachedFlags |= JIT_FLAG_IS_IOS_26;
+            if (!DeviceCanCreateRXMap()) {
+                cachedFlags |= JIT_FLAG_FORCE_MIRRORED;
+            }
+        }
+        if (DeviceHasTXM()) {
+            cachedFlags |= JIT_FLAG_HAS_TXM;
+        }
+    });
+    return cachedFlags;
+}
+BOOL DeviceHasJITFlags(JITFlags flags) {
+    return (DeviceGetJITFlags(NO) & flags) == flags;
 }

entitlements.sideload.xml

@@ -18,7 +18,7 @@
     <true/>
 
     <!-- Custom entitlement to indicate this was installed with TrollStore, still sandboxed -->
-    <key>jb.pmap_cs_custom_trust</key>
+    <key>jb.pmap_cs.custom_trust</key>
     <string>PMAP_CS_APP_STORE</string>
 </dict>
 </plist>