Skip to content

ios-27: the key store and data protection notes and the on-phone test (#277 re-landed) #297

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
claudiusthebot merged 4 commits into from
Nov 12, 2026
Merged

ios-27: the key store and data protection notes and the on-phone test (#277 re-landed) #297

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e6934f4
ios-27: the key store and data protection (docs/ios27/KEYSTORE.md), t…
claudiusthebot Nov 9, 2026
e1106b1
ios-27 key store: what a phone run proved, the purgeable fsctl()s, fo…
claudiusthebot Nov 9, 2026
82ac798
ios-27 key store notes: the purgeable run, sandbox extensions, fork b…
claudiusthebot Nov 9, 2026
ab20733
ios-27 key store notes: the passcode run, the wallpaper picker's stat…
claudiusthebot Nov 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/ios27-starlte.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ builder's own, from their own IPSW; nothing of Apple's is in this repository.
| `tools/ios27/` | build, packing and test tools (`build-xnu-ios.sh`, which `OS_PROFILE=ios-27 make kernel` runs, with `dxb-common.sh`, `dxb.pin`, `dxb-ios.patch` and `firehose-ios.py`; `build-xnu-12377.sh` and `-ios.sh`, `mkpayload-ios26.sh`, `make-xnu-boot.sh`, the ADT makers, `a64e/`, `gpu/`, `mesa-ios/`, `ca-gpu/`) and wardevsa's `herolte/` packing tools |
| `tools/ios27/metal/` | Starbite's Metal stack (Metal 2 frontend, metal2vulkan, PanVK) rebuilt for iOS 27: build scripts, the root installer, `mtl27test`, `sbmtlc`; `docs/ios27/METAL.md` |
| `tools/ios27/speed/` | the boot-time and trap-cost work's root tools (the cache's PACGA and LDRA rewrite, the daemon list, the Settings patch, the kbd and QuartzCore patches of `docs/ios27/NIGHT.md`, `bench.py`) and `tools/ios27/cmdline/starlte-fast.txt`, its command line; `docs/ios27/SPEED.md` |
| `tools/ios27/keystore/` | `dptest`, the on-phone test of the key store's answers, protection classes and the keychain, with its launchd jobs and installer; `docs/ios27/KEYSTORE.md` |
| `tools/ios27/lse/` | the shared cache's LSE atomics rewritten into LL/SC thunks for the M3s (`lse-rewrite.py`, the root scripts, the differential test); `docs/ios27/EIGHT-CORES.md` |
| `userland/src/sbca.c` | CoreAnimation's renderer through OpenGL ES on the Mali-G72 (Mesa Panfrost behind HakiOS's EAGL bridge), with iOS 27.0.1's addresses; the bridge's iOS 27 table is `tools/ios27/ca-gpu/hakios/` |
| `docs/ios27/` | `IOS27-TARGET.md` (the iPhoneOS-target build and what it changes), `PARITY.md` (against Scion's 16.5 kernel), `EIGHT-CORES.md` (the eight cores: the LSE rewrite, the soft pins), `SPEED.md` (boot time and trap cost: what was measured, `sweetspeed`, the root edits), `OPTIMISE.md` (the sampling profiler's cost table and the changes made against it: FP16 forms, recommended cores, Panfrost's batch renaming, the DRM stand-in's answers, the surface hash; `tools/ios27/perf/`), `NIGHT.md` (what killed the daemons at boot, the 10 Hz, async GPU submits, the panel's brightness, Metal in CoreAnimation tried), `GPU-PATH.md` (what the GPU track found), `METAL.md` (Metal on the Mali), and the author's pages on the loader's USB console and fastboot, the microSD root and the recovery menu |
Expand Down
183 changes: 183 additions & 0 deletions docs/ios27/KEYSTORE.md
View file
Open in desktop

Large diffs are not rendered by default.

11 changes: 11 additions & 0 deletions tools/ios27/keystore/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
#!/bin/sh
# Build dptest (docs/ios27/KEYSTORE.md) for arm64e and arm64, ad hoc signed with its entitlements. Needs Xcode: DEVELOPER_DIR.
set -e
cd "$(dirname "$0")"
: "${DEVELOPER_DIR:?set DEVELOPER_DIR to your Xcode (its iPhoneOS SDK is used)}"; export DEVELOPER_DIR
for A in arm64e arm64; do
nice -n 10 xcrun --sdk iphoneos clang -arch $A -mios-version-min=16.0 -fobjc-arc -O1 -g -Wall -Wno-deprecated-declarations \
-o dptest.$A dptest.m -framework Foundation -framework Security -framework IOKit -framework CoreFoundation
codesign -f -s - --entitlements dptest.entitlements dptest.$A
done
cp dptest.arm64 dptest # default installed binary = plain arm64 (what the other jobs here run)
34 changes: 34 additions & 0 deletions tools/ios27/keystore/com.scion.dptest.mobile.plist
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>GroupName</key>
<string>mobile</string>
<key>JetsamProperties</key>
<dict>
<key>JetsamMemoryLimit</key>
<integer>512</integer>
</dict>
<key>Label</key>
<string>com.scion.dptest.mobile</string>
<key>LaunchOnlyOnce</key>
<true/>
<key>POSIXSpawnType</key>
<string>Interactive</string>
<key>Program</key>
<string>/usr/local/bin/dptest</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/dptest</string>
<string>mobile</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StandardErrorPath</key>
<string>/private/var/tmp/dptest-mobile.out</string>
<key>StandardOutPath</key>
<string>/private/var/tmp/dptest-mobile.out</string>
<key>UserName</key>
<string>mobile</string>
</dict>
</plist>
32 changes: 32 additions & 0 deletions tools/ios27/keystore/com.scion.dptest.passcode.plist
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>JetsamProperties</key>
<dict>
<key>JetsamMemoryLimit</key>
<integer>512</integer>
</dict>
<key>Label</key>
<string>com.scion.dptest.passcode</string>
<key>LaunchOnlyOnce</key>
<true/>
<key>POSIXSpawnType</key>
<string>Interactive</string>
<key>Program</key>
<string>/usr/local/bin/dptest</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/dptest</string>
<string>passcode</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StandardErrorPath</key>
<string>/private/var/tmp/dptest-passcode.out</string>
<key>StandardOutPath</key>
<string>/private/var/tmp/dptest-passcode.out</string>
<key>UserName</key>
<string>root</string>
</dict>
</plist>
31 changes: 31 additions & 0 deletions tools/ios27/keystore/com.scion.dptest.plist
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>JetsamProperties</key>
<dict>
<key>JetsamMemoryLimit</key>
<integer>512</integer>
</dict>
<key>Label</key>
<string>com.scion.dptest</string>
<key>LaunchOnlyOnce</key>
<true/>
<key>POSIXSpawnType</key>
<string>Interactive</string>
<key>Program</key>
<string>/usr/local/bin/dptest</string>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/dptest</string>
</array>
<key>RunAtLoad</key>
<true/>
<key>StandardErrorPath</key>
<string>/private/var/tmp/dptest.out</string>
<key>StandardOutPath</key>
<string>/private/var/tmp/dptest.out</string>
<key>UserName</key>
<string>root</string>
</dict>
</plist>
18 changes: 18 additions & 0 deletions tools/ios27/keystore/dptest.entitlements
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>application-identifier</key><string>dptest</string>
<key>keychain-access-groups</key><array><string>dptest</string></array>
<key>com.apple.keystore.access-keychain-keys</key><true/>
<key>com.apple.keystore.device</key><true/>
<key>com.apple.private.security.no-sandbox</key><true/>
<key>platform-application</key><true/>
<key>com.apple.keystore.device.verify</key><true/>
<key>com.apple.keystore.config.set</key><true/>
<key>com.apple.mobile.keybagd.UserManager.sync</key><true/>
<key>com.apple.mobile.keybagd.xpc</key><true/>
<key>com.apple.keystore.stash.access</key><true/>
<key>com.apple.private.keychain.keybag</key><true/>
</dict>
</plist>
Loading
Loading