Apple Security Framework Signature Validation Bypass

This repository contains a sophisticated exploit tool targeting Apple's CoreTrust code signature verification on iOS and macOS. The main entry point is `src/main.m`, which orchestrates the process of extracting the preferred Mach-O slice from a (potentially FAT) binary, performing ad-hoc signing, and then applying a CoreTrust bypass. The bypass is implemented in `src/coretrust_bug.c`, which manipulates the code signature superblob of the Mach-O binary by injecting a template App Store code directory, updating hashes, and generating a new signature using a bundled private key. The exploit ensures the Team ID matches between code directories and removes problematic flags to maximize compatibility. The tool is intended to be run locally on a binary file, and does not interact with network endpoints. The codebase is modular, with reusable components for Mach-O and code signature manipulation, and includes a number of template blobs and cryptographic routines. The exploit is operational and can be used to allow unsigned or self-signed binaries to run on iOS devices by bypassing CoreTrust signature checks.

This repository contains a tool for bypassing Apple's CoreTrust code signature enforcement on iOS. The main entry point is 'src/main.m', which processes either a single Mach-O binary or recursively processes all binaries in an app bundle. The tool works by first performing ad-hoc signing of the target binary, then extracting the appropriate architecture slice, and finally applying a CoreTrust bypass by modifying the code signature blobs. The bypass leverages embedded CA certificates and private keys (see 'src/templates/CADetails.h') and signature templates (see 'src/templates/TemplateSignatureBlob.h', 'src/templates/DERTemplate.h'). The code interacts with low-level Mach-O structures and Apple's security frameworks, and uses the third-party 'ChOma' library for Mach-O manipulation. The exploit is operational and can be used to re-sign iOS binaries to run with forged signatures, which is useful for running unauthorized code on iOS devices, especially in a jailbroken or app repackaging context. The attack vector is local, requiring access to the target binary or bundle. The only notable fingerprintable endpoint is the use of '/tmp/XXXXXX' as a temporary file for Mach-O slice extraction.