theiphoneos1project/microinjector

Purpose and entry points

MicroInjector is a runtime code-injection platform for armv6 devices running iPhone OS 1.x. It installs a launchd bootstrap path that loads injection code into system processes, while exposing native hooking APIs through MicroInjector.h and Cydia Substrate-compatible shims through SubstrateShims.c.

Key build/package entry points are Makefile, LaunchDaemon.plist, and PxlPkg.plist.

Boot-time launchd bootstrap

The launch daemon configuration in LaunchDaemon.plist starts the bootstrap executable during system boot. launchd_trampoline/launchd_trampoline.c acts as a small intermediate process/loader stage, allowing the project to establish injection before normal launchd-managed workloads proceed.

The bootstrap path is deliberately guarded by a user-abort mechanism implemented in inject_launchd/inject_launchd.c.

Safe-mode / injection abort boundary

inject_launchd/inject_launchd.c detects held hardware buttons during boot and avoids injection when Home, Volume Up, or Volume Down is pressed. Hardware input handling is separated into:

• inject_launchd/buttons.c

• inject_launchd/iokit_private.h

This is the main recovery boundary: a failed or incompatible injected payload can be bypassed without removing the package.

launchd process injection

The injector executable manipulates the launchd task using low-level task and Mach-oriented primitives:

• inject_launchd/inject_launchd.c

• inject_launchd/task_primitives.c

• inject_launchd/task_primitives.h

This stage is architecture- and OS-version-sensitive. It crosses the strongest privilege boundary in the repository: an external bootstrap process obtains sufficient control over launchd to place the runtime loader into its address space.

In-process loader and payload discovery

Once injection reaches a target process, Loader/MicroLoader.m provides the Objective-C-aware in-process loading stage. It is responsible for bringing the MicroInjector runtime/payload behavior into the process context rather than relying on the external injector thereafter.

Loader/MISafeModeAlert.m and Loader/MISafeModeAlert.h provide an in-process failure/safe-mode user interface, complementing the boot-button escape hatch.

Native hooking runtime

The public runtime API is defined in:

• MicroInjector.h

• MicroInjector.c

• MicroInjectorInternal.h

This layer implements the core function, memory, Objective-C method, class-pair, image, and symbol manipulation capabilities used by injected code. HookFunction.c is a focused implementation unit for native function interception.

Substrate compatibility surface

SubstrateShims.c adapts the project’s native runtime to expected Cydia Substrate-style APIs. This is the compatibility boundary for existing tweaks or payloads written against Substrate conventions, allowing them to use MicroInjector without directly depending on its internal API.

Runtime and platform dependencies

The project targets legacy iPhone OS 1.x on armv6 and depends on private platform behavior, including IOKit input access and task/process manipulation. Building requires clang, an unofficial iPhone OS 1 SDK, and a patched linker supporting the Objective-C fragile runtime, as encoded by Makefile. Distribution is packaged as a PXL installer artifact via PxlPkg.plist.