Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Doubt: why not to use fork directly? #139

Open
izmcm opened this issue Oct 9, 2024 · 0 comments
Open

Doubt: why not to use fork directly? #139

izmcm opened this issue Oct 9, 2024 · 0 comments

Comments

@izmcm
Copy link
Contributor

izmcm commented Oct 9, 2024

I'm searching for new ways to detect jailbreaks and many blogs present system with NULL argument to make that, similar to what is done in the checkFork method with fork below

  private static func checkFork() -> CheckResult {
    let pointerToFork = UnsafeMutableRawPointer(bitPattern: -2)
    let forkPtr = dlsym(pointerToFork, "fork")
    typealias ForkType = @convention(c) () -> pid_t
    let fork = unsafeBitCast(forkPtr, to: ForkType.self)
    let forkResult = fork()
    
    if forkResult >= 0 {
      if forkResult > 0 {
        kill(forkResult, SIGTERM)
      }
      return (false, "Fork was able to create a new process (sandbox violation)")
    }
    
    return (true, "")
  }

But I could not understand why not to use fork (or system) functions directly and instead use dlsym to get fork. Is there any reason for this?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant