TrollStore is a permasigned jailed app that can permanently install any IPA you open in it.
It works because of an AMFI/CoreTrust bug where iOS does not verify whether or not a root certificate used to sign a binary is legit.
| Version / Device | arm64 (A8 - A11) | arm64e (A12 - A15, M1) |
|---|---|---|
| 13.7 and below | Not Supported (CT Bug only got introduced in 14.0) | Not Supported (CT Bug only got introduced in 14.0) |
| 14.0 - 14.8.1 | checkra1n + TrollHelper | TrollHelperOTA (arm64e) |
| 15.0 - 15.4.1 | TrollHelperOTA (iOS 15+) | TrollHelperOTA (iOS 15+) |
| 15.5 beta 1 - 4 | TrollHelperOTA (iOS 15+) | TrollHelperOTA (iOS 15+) |
| 15.5 (RC) | Not Supported (CT Bug fixed) | Not Supported (CT Bug fixed) |
| 15.6 beta 1 - 5 | SSH Ramdisk | TrollHelperOTA (arm64e) |
| 15.6 (RC1/2) and above | Not Supported (CT Bug fixed) | Not Supported (CT Bug fixed) |
Due to the discovery of a new CoreTrust vulnerability, support for 15.5 - 16.6.1 and 17.0 might be added in the future. Stay on these versions if you want TrollStore. 16.7 and 17.0.1+ will NEVER be supported (unless Apple fucks CoreTrust up a third time...).
When a new TrollStore update is available, a button to install it will appear at the top in the TrollStore settings. After tapping the button, TrollStore will automatically download the update, install it, and respring.
Alternatively (if anything goes wrong), you can download the TrollStore.tar file under Releases and open it in TrollStore, TrollStore will install the update and respring.
Apps installed from TrollStore can only be uninstalled from TrollStore itself, tap an app or swipe it to the right in the 'Apps' tab to delete it.
The CoreTrust bug used in TrollStore is only enough to install "System" apps, this is because FrontBoard has an additional security check (it calls libmis) every time before a user app is launched. Unfortunately it is not possible to install new "System" apps that stay through an icon cache reload. Therefore, when iOS reloads the icon cache, all TrollStore installed apps including TrollStore itself will revert back to "User" state and will no longer launch.
The only way to work around this is to install a persistence helper into a system app, this helper can then be used to reregister TrollStore and its installed apps as "System" so that they become launchable again, an option for this is available in TrollStore settings.
On jailbroken iOS 14 when TrollHelper is used for installation, it is located in /Applications and will persist as a "System" app through icon cache reloads, therefore TrollHelper is used as the persistence helper on iOS 14.
As of version 1.3, TrollStore replaces the system URL scheme "apple-magnifier" (this is done so "jailbreak" detections can't detect TrollStore like they could if TrollStore had a unique URL scheme). This URL scheme can be used to install applications right from the browser, the format goes as follows:
apple-magnifier://install?url=<URL_to_IPA>
On devices that don't have TrollStore (1.3+) installed, this will just open the magnifier app.
The binaries inside an IPA can have arbitrary entitlements, fakesign them with ldid and the entitlements you want (ldid -S<path/to/entitlements.plist> <path/to/binary>) and TrollStore will preserve the entitlements when resigning them with the fake root certificate on installation. This gives you a lot of possibilities, some of which are explained below.
iOS 15 on A12+ has banned the following three entitlements related to running unsigned code, these are impossible to get without a PPL bypass, apps signed with them will crash on launch.
com.apple.private.cs.debugger
dynamic-codesigning
com.apple.private.skip-library-validation
Your app can run unsandboxed using one of the following entitlements:
<key>com.apple.private.security.container-required</key>
<false/><key>com.apple.private.security.no-container</key>
<true/><key>com.apple.private.security.no-sandbox</key>
<true/>The third one is recommended if you still want a sandbox container for your application.
You might also need the platform-application entitlement in order for these to work properly:
<key>platform-application</key>
<true/>Please note that the platform-application entitlement causes side effects such as some parts of the sandbox becoming tighter, so you may need additional private entitlements to circumvent that. (For example afterwards you need an exception entitlement for every single IOKit user client class you want to access).
In order for an app with com.apple.private.security.no-sandbox and platform-application to be able to access it's own data container, you might need the additional entitlement:
<key>com.apple.private.security.storage.AppDataContainers</key>
<true/>When your app is not sandboxed, you can spawn other binaries using posix_spawn, you can also spawn binaries as root with the following entitlement:
<key>com.apple.private.persona-mgmt</key>
<true/>You can also add your own binaries into your app bundle.
Afterwards you can use the spawnRoot function in TSUtil.m to spawn the binary as root.
- Getting proper platformization (
TF_PLATFORM/CS_PLATFORMIZED) - Spawning a launch daemon (Would need
CS_PLATFORMIZED) - Injecting a tweak into a system process (Would need
TF_PLATFORM, a userland PAC bypass and a PMAP trust level bypass)
@LinusHenze - Found the CoreTrust bug that allows TrollStore to work.