Add ThreeAppBypass functionality and MobileGestalt view

- Implemented ThreeAppBypassManager for patch loading and application.
- Created ThreeAppBypassView for user interaction with patch management.
- Added MobileGestaltView for managing MobileGestalt entries with save/load functionality.
- Introduced Makefile and README for the ThreeAppBypass tweak.
- Developed scripts for symbol resolution, IPSW extraction, and binary handling.
- Added example symbol maps and patches for demonstration.
- Implemented logging and error handling throughout the new features.

Author: openclawy-bot

Docs/3AppBypass_Plan.md

@@ -0,0 +1,70 @@
+# 3 App Bypass — Implementation Plan (sideload 3‑app limit)
+
+Goal
+- Provide a jailbroken-device feature to bypass Apple's 3‑app sideload limit so users can install more than three sideloaded apps via free provisioning approaches.
+
+Summary of approaches
+
+A) User-level tooling (low-risk)
+- Use or integrate with AltStore/AltServer workflows to avoid the limit (refresh provisioning, re-sign apps periodically).
+- Pros: safe, no kernel/daemon patching. Cons: limited automation and needs a companion host app.
+
+B) Daemon-level patch (medium-risk, recommended first prototype)
+- Target daemons that enforce installation/validation (primarily `installd`, `installcoordination`, and related processes) and intercept logic that rejects additional installations.
+- Alternatively, patch `amfid` to accept unsigned/modified signatures for selected bundles.
+- Pros: precise, can be scoped to specific processes or bundle IDs. Cons: requires jailbreak (code injection or tweaks), reverse-engineering per iOS version.
+
+C) Kernel-level bypass (high-risk)
+- Patch AMFI kernel enforcement (AppleMobileFileIntegrity) or code-signing enforcement points in kernel/kexts to globally disable signing/count checks.
+- Pros: broad coverage. Cons: highest risk, version-specific offsets, dangerous if incorrect (can brick device).
+
+Recommended path
+1. Prototype a daemon-level tweak that hooks `amfid` or `installd` behavior for the install/validation code path used during sideload with free developer provisioning. This mirrors historical approaches (AppSync-style) and avoids direct kernel patches.
+2. Provide a conservative UI to enable/disable the bypass per-app and to create automatic rollback (restore original binaries or restart daemons).
+3. If daemon patching proves insufficient (server-side checks or external enforcement), evaluate a narrowly scoped kernel patch with extensive backups and explicit user warnings.
+
+Required components
+- Jailbreak or kernel write primitives from `lara` (for persistent patching and overwriting system files).
+- Offset mapping for target iOS versions (function addresses in `amfid`/`installd`/kernel). Keep an offsets checklist per iOS build.
+- A tweak skeleton to inject code into `amfid`/`installd` (Theos/MobileSubstrate or Substitute) with per-OS symbol resolution.
+- Safe backup & revert: backup original daemons/binaries and the AMFI cache before applying changes.
+
+Known references / PoCs
+- AppSync-style packages (historical jailbreak solutions that allow unsigned apps).
+- ProjectManticore / amfid bypass PoCs on GitHub (search results: ProjectManticore, amfidont).
+- The iPhone Wiki entries for `AMFI` and `installd` describing historical approaches.
+- AltStore (non-jailbreak sideload alternative) for user-level strategy.
+
+Testing and safety
+- Only enable bypass on confirmed jailbroken devices; detect jailbreak early and refuse on stock devices.
+- Create an explicit backup before modifying any system binary or the code-sign trust cache. Provide a one-tap restore.
+- Test across a small matrix of iOS builds (17.5–18.6.2 baseline as with `lara`) and device types.
+
+Next steps (immediate)
+1. Locate and extract `amfid`/`installd` symbols for target iOS builds (requires device access or symbol dumps). Produce a short list of candidate functions to hook.
+2. Scaffold a MobileSubstrate tweak skeleton that logs calls and can return a forced "valid" result for signature checks in-process.
+3. Validate the tweak on a test device and implement safe revert.
+
+Helpers added
+- `other/3app-bypass/scripts/get_device_binaries.sh` — SCP helper to pull binaries from a jailbroken device.
+- `other/3app-bypass/scripts/scan_symbols.py` — scan local binaries for likely amfid/installd/AMFI-related symbols using `nm`/`otool`/`strings`.
+
+Usage examples
+- Pull binaries from device:
+
+```bash
+./other/3app-bypass/scripts/get_device_binaries.sh root@192.168.1.42 ./work/binaries
+```
+
+- Scan the pulled binaries:
+
+```bash
+./other/3app-bypass/scripts/scan_symbols.py ./work/binaries/amfid ./work/binaries/installd
+```
+
+
+Notes
+- This feature is intended for jailbroken devices only. It may violate App Store/Apple policies if used to distribute apps circumventing platform protections; include clear warnings and an opt-in flow.
+- Keep patches minimal and reversible.
+
+Status: plan created. Next: scaffold tweak skeleton and start identifying amfid/installd symbols on-device.

Docs/3AppBypass_Research.md

@@ -0,0 +1,25 @@
+# 3 App Bypass — Research Notes
+
+Goal: Implement a feature to bypass the "3 App" limitation (context to confirm) and provide user controls in `lara`.
+
+Open questions (to resolve via research):
+- Confirm meaning of "3 App Bypass" in project context: does it refer to:
+  - Bypassing Apple's limit on sideloaded apps with free Apple IDs (3-app limit), or
+  - Bypassing App Store / Managed Device restrictions that limit installed apps, or
+  - A different, project-specific restriction (ask owner if ambiguous).
+
+Potential technical approaches:
+1. Modify MobileDevice/amsd responses or provisioning checks to allow additional unsigned apps.
+2. Patch system daemons that enforce app count (if present) or alter code signing checks via kernel patches.
+3. Use per-app entitlements or container modifications to trick the system into treating apps differently.
+
+Risks and prerequisites:
+- Many approaches require kernel privileges and correct offsets per iOS version.
+- High risk of device instability; must provide good rollback.
+
+Next steps:
+1. Confirm exact intended bypass behavior with project owner (clarify scope).
+2. Search for existing bypass implementations and PoCs.
+3. Map required kernel hooks / entitlements and create minimal prototype plan.
+
+Status: research started. Next: confirm meaning and gather PoCs.

Docs/3AppBypass_Sources.md

@@ -0,0 +1,17 @@
+# 3 App Bypass — Community Sources & PoCs
+
+Collected public resources (initial):
+
+- `zqxwce/amfidont` — simple amfid bypass utility (GitHub): https://github.com/zqxwce/amfidont
+- `ProjectManticore` — jailbreak project with historical amfid bypass references: https://github.com/ProjectManticore/Manticore
+- Historical AppSync-style packages and discussions (search GitHub for AppSync / installd tweaks).
+- The iPhone Wiki pages for AMFI and `installd` (background): https://www.theiphonewiki.com/wiki/AppleMobileFileIntegrity and https://www.theiphonewiki.com/wiki/Installd
+- Community MobileGestalt and MobileGestalt patcher repos discovered earlier (for reference): `MGKeys`, `autoPatcher-mobilegestalt`, `MobileGestalt-hook` (search GitHub for "MobileGestalt").
+
+Notes:
+- Public PoCs exist but may not include symbol maps or offsets for iOS 18.x; many projects target older iOS versions and need per-build offsets.
+- Next step: search community symbol dumps and offsets repos (e.g., `offsets` / `symbols` JSON in GitHub), or extract symbols from IPSW if unavailable.
+
+How to contribute symbol maps:
+- If you have a device or IPSW for a target build, extract `amfid`/`installd` and run `other/3app-bypass/scripts/scan_symbols.py`.
+- Produce a JSON map at `/var/mobile/Library/lara/3appbypass_symbols.json` with resolved addresses for the tweak to use.

Docs/FinishAndReleasePlan.md

@@ -0,0 +1,60 @@
+Finish & Release Plan — lara
+
+Goal: finish a working release that includes MobileGestalt Editor (viewer + runtime overrides + KFS persistence) and a tested 3‑App bypass prototype (daemon/tweak approach) for jailbroken devices.
+
+Milestones (2–5 days estimate depending on device access):
+
+1) MobileGestalt polish (0.5 day)
+- Add concise logging in `MobileGestaltManager` and `MobileGestaltView` (already present).
+- Ensure Save/Load/Apply show clear status and errors across cases.
+- Add UI link in settings or main menu (done).
+
+2) KFS verification & backups (0.5–1 day)
+- Verify `saveOverridesToKFS`, `loadOverridesFromKFS`, `applyOverridesToSystemCache`, and restore on a test device.
+- Confirm backup file exists and restore works across reboots.
+
+3) Tests & compatibility matrix (0.5 day)
+- Create manual test checklist and minimal unit tests where possible (plist serialization, override persistence).
+- Document tested iOS builds and device types.
+
+4) Tweak symbol resolution & scripts (1 day)
+- Use `get_device_binaries.sh` + `scan_symbols.py` to identify candidate symbols.
+- Populate `/var/mobile/Library/lara/3appbypass_symbols.json` example for target builds.
+- Verify tweak hooks by address via the JSON map.
+
+5) Prototype and test tweak on-device (1–2 days)
+- Build Theos package (`make package`), install on test device, observe logs.
+- Iterate until signature checks are reliably bypassed for test bundles.
+- Always keep backups and a documented rollback (restore AMFI cache + original daemon).
+
+6) Safety, docs, and release (0.5 day)
+- Add warnings, opt-in toggles, and recovery instructions to `Docs/3AppBypass_Plan.md` and `README.md`.
+- Package example symbol maps under `other/3app-bypass/examples/`.
+- Tag release and produce short changelog.
+
+Quick test commands (local dev)
+
+- Pull binaries:
+
+```bash
+./other/3app-bypass/scripts/get_device_binaries.sh root@<device_ip> ./work/binaries
+```
+
+- Scan binaries:
+
+```bash
+./other/3app-bypass/scripts/scan_symbols.py ./work/binaries/amfid ./work/binaries/installd
+```
+
+- Build tweak (on host with Theos):
+
+```bash
+cd other/3app-bypass
+make package
+```
+
+Notes & warnings
+- 3 App Bypass is intended for jailbroken devices only. Provide explicit warnings and require manual confirmation for any destructive actions.
+- Do not attempt kernel-level patches until daemon-level prototype is exhausted; kernel patches are high-risk.
+
+Status: plan created. Begin with MobileGestalt verification and KFS tests, then move to tweak symbol resolution.

Docs/ImplementationPlan.md

@@ -0,0 +1,46 @@
+# Implementation Plan — MobileGestalt Editor & 3 App Bypass
+
+Summary
+- MobileGestalt Editor: provide safe viewer + runtime override ability, plus optional persistent patching for keys that cannot be overridden in userland.
+- 3 App Bypass: implement (device-jailbreak-only) kernel/daemon patches to bypass Apple's 3-app sideload limit; high-risk, requires kernel privileges and careful rollback.
+
+MobileGestalt — technical approaches
+1. Read-only viewer
+   - Use existing Swift wrappers (e.g., `p-x9/swift-mobile-gestalt`) to call `MGCopyAnswer`/`Gestalt` APIs and list keys.
+2. Runtime overrides (preferred first-step)
+   - Hook MobileGestalt API calls in-process using:
+     - `fishhook` for C symbol rebinding (works for non-Objective-C symbols bound via dyld), or
+     - MobileSubstrate / Substrate-like hooking (for tweaks), or
+     - `DYLD_INSERT_LIBRARIES` / dyld interpose for processes we control.
+   - Create an in-memory override table that returns patched values for selected keys.
+3. Persistent patching (fallback)
+   - Some keys are generated by system daemons or from binary blobs. For these, use an offsets-based patcher (see `Rust505/autoPatcher-mobilegestalt`) to modify MobileGestalt.plist or daemon behavior using kernel write primitives provided by `lara`.
+
+3 App Bypass — technical approaches
+1. User-level workaround (low-risk)
+   - Recommend using tools like AltStore/AltServer to sideload without addressing system limits.
+2. Daemon/Service patch (medium-risk)
+   - Identify the system daemon enforcing the limit (install-related or server-side checks). Hook or patch its enforcement path to ignore the count. Needs careful reverse-engineering per iOS version.
+3. Kernel-level bypass (high-risk)
+   - Patch code-signing checks (amfid/ksystem) or interception points where the system validates developer provisioning counts. Requires kernel offsets and write primitives from `lara`.
+
+Security, risk, and rollback
+- All persistent or kernel patches must implement safe revert operations and backups of modified blobs.
+- Warn users and provide an explicit confirmation plus automated revert option.
+- Limit UI options to jailbroken devices / devices where `lara` confirms privileges.
+
+Immediate next steps (short-term tasks)
+1. Build a read-only MobileGestalt viewer in `lara` using `swift-mobile-gestalt`.
+2. Implement runtime hooking prototype for MobileGestalt using `fishhook` in a test target to validate overrides for `ProductType`, `RegionInfo`, etc.
+3. Confirm exact target for 3 App Bypass (we have confirmation: sideload 3-app limit). Start by searching amfid/installd/related daemons for enforcement logic.
+4. Map kernel offsets and entitlements needed for persistent patching; add to `Docs/OffsetsChecklist.md`.
+
+References (initial)
+- Fishhook: https://github.com/facebook/fishhook
+- GitHub search results for MobileGestalt (repos: `MGKeys`, `MobileGestaltHooking`, `autoPatcher-mobilegestalt`, `retr0devops/MobileGestalt-hook`)
+- AltStore: https://altstore.io/
+
+Delivery
+- Create `MobileGestalt` viewer UI and backend API in `lara`.
+- Add a developer-only "Experiment" section for runtime overrides with logs and revert.
+- If you approve, I will start implementing the read-only viewer and the `fishhook`-based runtime override prototype next.

Docs/MobileGestalt_Research.md

@@ -0,0 +1,26 @@
+# MobileGestalt Editor — Research Notes
+
+Goal: Add UI + backend to view and edit MobileGestalt keys on-device.
+
+Background summary:
+- MobileGestalt is an iOS system service (private API) that provides device properties (e.g., "ProductType", "SerialNumber", "RegionInfo").
+- Many keys are derived from hardware, provisioning profiles, or system configuration; some are read-only without kernel or sandbox bypass.
+
+Areas to research (next actions):
+1. MobileGestalt API surfaces (libMobileGestalt, MobileGestalt.c) and how to call from Swift.
+2. Which keys are stored in preferences/plists vs. derived by kernel/hardware.
+3. Existing tools that patch MobileGestalt responses (MobileGestaltServer patching, jailbreak tweaks, dyld interpose approaches).
+4. Feasibility of per-key runtime interception (xpc proxy, function interpose) vs. persistent system plist edits.
+5. Required entitlements, sandbox/kext/kernel access, and offsets for supported iOS versions (17.5–18.6.2 baseline).
+
+Deliverables for implementation:
+- A safe read-only viewer for MobileGestalt keys.
+- An edit flow that attempts non-destructive runtime overrides first (in-memory/interpose), with fallback to persistent patching when possible.
+- Backend APIs in `lara` to get/set keys and to revert changes.
+
+References (to gather):
+- Apple internal docs and libMobileGestalt headers (search web)
+- Jailbreak tweak sources that modify MobileGestalt
+- dyld interposing examples and XPC proxy hooking patterns
+
+Status: research started. Next: gather authoritative resources and examples.

Docs/References.md

@@ -0,0 +1,20 @@
+# References — collected links
+
+MobileGestalt resources and examples:
+- GitHub search: https://github.com/search?q=MobileGestalt
+- MGKeys (deobfuscation): https://github.com/PoomSmart/MGKeys
+- MobileGestalt hooking examples: https://github.com/Naville/MobileGestaltHooking
+- autoPatcher-mobilegestalt (offset-based patcher): https://github.com/Rust505/autoPatcher-mobilegestalt
+- Example hooks: https://github.com/retr0devops/MobileGestalt-hook
+- Swift wrapper: https://github.com/p-x9/swift-mobile-gestalt
+
+Hooking and interpose tools:
+- fishhook (symbol rebinding): https://github.com/facebook/fishhook
+- dyld interposing (OSX/iOS dyld technique): https://opensource.apple.com/
+
+3 App / sideloading resources:
+- AltStore (sideloading tooling): https://altstore.io/
+
+Notes:
+- Collected links are a starting point for implementation and reverse-engineering.
+- Several community PoCs exist for MobileGestalt; examine licensing and copyright before reuse.

lara/MobileGestaltBridge.h

@@ -0,0 +1,12 @@
+//
+// MobileGestaltBridge.h
+// Bridge to call MGCopyAnswer from Swift
+//
+
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+FOUNDATION_EXPORT NSString * _Nullable MGCopyAnswerString(NSString *key);
+
+NS_ASSUME_NONNULL_END

lara/MobileGestaltBridge.m

@@ -0,0 +1,48 @@
+//
+// MobileGestaltBridge.m
+// Objective-C bridge implementation that calls MGCopyAnswer via dlsym.
+//
+
+#import "MobileGestaltBridge.h"
+#import <dlfcn.h>
+#import <CoreFoundation/CoreFoundation.h>
+
+typedef CFTypeRef (*MGCopyAnswerFunc)(CFStringRef key);
+
+NSString * MGCopyAnswerString(NSString *key) {
+    if (!key) return nil;
+    static MGCopyAnswerFunc mgFunc = NULL;
+    if (!mgFunc) {
+        mgFunc = (MGCopyAnswerFunc)dlsym(RTLD_DEFAULT, "MGCopyAnswer");
+    }
+    if (!mgFunc) return nil;
+
+    CFStringRef cfKey = (__bridge CFStringRef)key;
+    CFTypeRef result = mgFunc(cfKey);
+    if (!result) return nil;
+
+    NSString *str = nil;
+    CFTypeID t = CFGetTypeID(result);
+    if (t == CFStringGetTypeID()) {
+        str = CFBridgingRelease(result);
+    } else if (t == CFNumberGetTypeID()) {
+        long long v = 0;
+        CFNumberGetValue((CFNumberRef)result, kCFNumberLongLongType, &v);
+        str = [NSString stringWithFormat:@"%lld", v];
+        CFRelease(result);
+    } else if (t == CFBooleanGetTypeID()) {
+        Boolean b = CFBooleanGetValue((CFBooleanRef)result);
+        str = b ? @"true" : @"false";
+        CFRelease(result);
+    } else {
+        CFStringRef desc = CFCopyDescription(result);
+        if (desc) {
+            str = CFBridgingRelease(desc);
+        } else {
+            str = @"<non-string>";
+        }
+        CFRelease(result);
+    }
+
+    return str;
+}