How 34306/filzajailedds works
1. This repository is a packaged injected tweak for the Filza iPA, not a standalone app or service. The goal is to extend Filza’s file access capabilities on jailed iOS devices by combining userland hooks with low-level kernel primitives.
2. The top-level entrypoint is Tweak.m, with FilzaApplySandboxExt.plist acting as the injection/filter configuration. Makefile and control indicate it is built and distributed as a tweak/package rather than as a normal app binary.
3. The main user-facing logic lives in sandbox_escape.m and apfs_own.m. These appear to manage sandbox bypass behavior and file ownership changes so Filza can access paths it normally cannot. utils/ provides supporting helpers for file, process, and hex-dump operations.
4. The kernel-access layer is isolated under kexploit/. This includes an exploit implementation (kexploit_opa334.m), kernel read/write primitives (krw.*), device/offset metadata (machine_info.h, offsets.*), vnode helpers (vnode.*), and PAC-related helpers (xpaci.h). This layer is responsible for turning an exploit into usable kernel memory access.
5. kpf/patchfinder.* is the offset/patch-finding layer. Its job is to locate kernel code/data patterns across OS versions so the exploit and patching logic can adapt without hardcoded addresses.
6. The XPF/ subtree is the higher-level patching framework. It is split into shared logic (common, decompress, xpf) and execution paths for different environments (ppl.* and non_ppl.*), plus bad_recovery.* for cleanup/recovery. This strongly suggests the repo supports multiple low-level patching strategies depending on whether PPL-related constraints are present.
7. XPF/external/ChOma is a vendored dependency used for binary and cache inspection. It includes Mach-O, fat binary, dyld shared cache, code directory, entitlements, and patch-finding support. Architecturally, this lets the patching layer reason about system binaries and shared caches instead of relying only on raw kernel memory access.
8. The main data flow is: Filza launches → injected tweak initializes → sandbox/file-access logic runs → if needed, the kernel exploit provides krw → patchfinder/XPF locate the right targets → patches or ownership changes are applied → Filza gains the expanded access it needs.
9. The repo is highly version- and device-dependent. The README explicitly calls out iOS version support and exclusions, and the presence of offsets.*, patchfinder code, and PPL/non-PPL paths shows that behavior is tailored to specific OS internals rather than using a single universal technique.
10. There is no backend or network architecture here; the system is entirely local and privilege-oriented. The important architectural boundaries are between injected userland code, kernel exploit primitives, and version-specific patching/inspection logic.
Main entry points: xpf.c XPF core · kexploit_opa334.m Kernel exploit · krw.m KRW · sandbox_escape.m Sandbox escape
Components 20
Package
Tweak packaging, injection, and entrypoint layer.
- Tweak entry · Injected tweak entry that initializes the package's runtime behavior.
Tweak.m - Filter plist · Injection and process-filter configuration for Filza.
FilzaApplySandboxExt.plist - Package spec · Distribution metadata showing this is packaged as a tweak.
control - Build file · Build/package instructions for producing the tweak.
Makefile
Userland access
Injected logic that changes Filza's sandbox and file access behavior.
- Sandbox escape · Userland logic that expands Filza's accessible paths on jailed devices.
sandbox_escape.m - APFS ownership · Ownership and file-state changes used to widen access to protected paths.
apfs_own.m
Kernel access
Exploit-backed primitives and device-specific kernel helpers.
- Kernel exploit · Exploit implementation that opens the path to kernel memory access.
kexploit/kexploit_opa334.m - KRW · Kernel read/write primitives exposed after exploitation.
kexploit/krw.m - Offsets · Device and OS-specific offset metadata used by the exploit layer.
kexploit/offsets.m - Vnode helpers · Helpers for vnode and filesystem object manipulation in kernel space.
kexploit/vnode.m - PAC helpers · Pointer authentication helper macros and routines.
kexploit/xpaci.h
Patching
Version-adaptive kernel patch finding and patch application.
- Patchfinder · Kernel pattern and offset discovery across OS versions.
kpf/patchfinder.m - XPF core · Top-level patching framework coordinating shared logic and execution paths.
XPF/src/xpf.c - PPL path · Patch execution path for PPL-constrained environments.
XPF/src/ppl.c - Non-PPL path · Patch execution path when PPL constraints are not the primary barrier.
XPF/src/non_ppl.c - Recovery · Bad-state recovery and cleanup for patching failures.
XPF/src/bad_recovery.c
Vendor dep
Bundled binary inspection and patch-finding library used by XPF.
- ChOma · Vendored library for Mach-O, cache, entitlement, and patch inspection.
XPF/external/ChOma/src/MachO.c
Utils
Supporting helpers shared by userland and exploit code.
- File helpers · File-related helper routines supporting access and path manipulation.
utils/file.c - Process helpers · Process-related helper routines used by the tweak and exploit flow.
utils/process.c - Hex dump · Debug and inspection helper for binary data.
utils/hexdump.c
Connections 21
- Filter plist → Tweak entry: injects · Configuration enables the tweak to load into Filza.
- Tweak entry → Sandbox escape: starts · Entrypoint initializes sandbox-extension logic.
- Tweak entry → APFS ownership: starts · Entrypoint initializes ownership adjustments.
- Sandbox escape → File helpers: uses · Sandbox logic relies on file helpers.
- Sandbox escape → Process helpers: uses · Sandbox logic consults process state.
- APFS ownership → File helpers: uses · Ownership logic operates on filesystem targets.
- Sandbox escape → Kernel exploit: falls back to · Kernel exploitation is used when userland access is insufficient.
- APFS ownership → Kernel exploit: falls back to · Ownership changes can depend on kernel capabilities.
- Kernel exploit → KRW: enables · Exploit produces kernel read/write primitives.
- Kernel exploit → Offsets: adapts to · Exploit behavior depends on device and OS-specific offsets.
- KRW → Vnode helpers: supports · Kernel primitives drive vnode-level filesystem operations.
- KRW → Patchfinder: supports · Read/write access feeds patch location discovery.
- PAC helpers → Kernel exploit: supports · PAC handling assists exploit and kernel execution.
- Patchfinder → XPF core: feeds · Discovered targets are consumed by the patching framework.
- XPF core → PPL path: selects · Framework can execute PPL-aware patching.
- XPF core → Non-PPL path: selects · Framework can execute non-PPL patching.
- XPF core → Recovery: recovers · Framework invokes cleanup on failure or partial patching.
- XPF core → ChOma: uses · Framework uses ChOma for binary and shared-cache inspection.
- ChOma → Patchfinder: assists · Binary and cache parsing improves patch finding.
- PPL path → KRW: uses · PPL path depends on kernel primitives for patching.
- Non-PPL path → KRW: uses · Non-PPL path depends on kernel primitives for patching.