jtool --unsign

[abmamba]

Hey,

An awesome feature I'll be surely find useful is the option to remove the signature blob out a binary.
I found this project https://github.com/steakknife/unsign which claims to provide the good, but trying to re-sign a binary just messes everything up. Looks like the "unsign" does not corrects mach-o 's offsets correctly.

And an even better feature to add can be to take a binary, override its entitlements with a user-given ones, and resign the binary.
Unless there is something out there that does that already, and does that good enough.

Thanks!

[Siguza]

IIRC, saurik's ldid is capable of re-signing a binary and replacing its entitlements.

[abmamba]

Saurik's ldid breaks the binary (when trying to replace the entitlements).

[Siguza]

Huh, okay.
I did some testing just now, and it seems like "codesign -f" does the trick though.

[morpheus]

err.. people.. jtool -rC will remove a load command. If that load command is the code signature, you have an unsign. Then resign using --inplace

btw, if I recall I fixed it so --inplace on an existing code signature will remove and resign.

Ldid is for wusses. It system("/...codesign"). Real programmers dont use system.

[Siguza]

You're right, -rC does seem to do the job.
It will make codesign refuse to operate on the binary though ("main executable failed strict validation").
Also it is mentioned on the website that --ent can be used to sign with entitlements, but that is omitted from the command line help. Maybe add that?

About ldid: I don't know if it has system()-called codesign in the past, but at least the current iOS version doesn't do that (anymore). There's no codesign binary on my phone, and the string "codesign" doesn't appear in the ldid binary (and ldid works there, obviously).

On an unrelated note, jtool seems unable to properly disassemble the iOS (ARMv6) version of ldid (link, if you need it).
Version 0.999something of jtool printed about 30 lines of disassembly, v1-ε^2 returned everything as DCD 0x..., and v1-ε^3 seems to be stuck in an infinite loop on the start symbol (oddly enough, _main and start are both present...).

[morpheus]

I totally nuked ARM 32-bit support. That's why.

But anyways, jtool --sign --inplace --ent ent.xml binary is what I use. Works like a charm every time.

[Siguza]

Oh, okay. Could you then make it display an error message when trying disassemble a 32bit binary? Would be nice.

[morpheus]

Sustained. Done.

Gettting ready for a major release soon, but for now I updated a nightly build

[Siguza]

Thanks