Palera1n, 16.2, mmap: Operation not permitted about fouldecrypt

[dlevi309]

@ZonD80 I noticed coming from iOS13->iOS14 that fouldecrypt and flexdecrypt weren’t working unless the encrypted app/binary were launched in some form (they need to be catalogued into memory) I wrote a simple tool that achieves this in a non-destructive and unobtrusive way, it basically dlopen‘s the target binary without having to launch it:

#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>

int main(int argc, char** argv) {
  for (int i = 1; i < argc; i++) {
    void* handle = dlopen(argv[i], RTLD_LAZY | RTLD_GLOBAL);
    if (!handle) {
      fprintf(stderr, "Error: %s\n", dlerror());
    }
    dlclose(handle);
  }
  return 0;
}

build this code as a separate tool and run it on the encrypted binary (linktool <path/to/encrypted_binary>) after you run it, you should be able to decrypt the target binary without mremap_encrypted failing.

[HenryQuan]

@dlevi309 The same trick doesn't seem to work for app extension. Is it due to security concerns in the latest system?