Skip to content

Cryptex Support#344

Open
mpass99 wants to merge 4 commits into
Lakr233:mainfrom
mpass99:feature/cryptex-support
Open

Cryptex Support#344
mpass99 wants to merge 4 commits into
Lakr233:mainfrom
mpass99:feature/cryptex-support

Conversation

@mpass99

@mpass99 mpass99 commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

This PR adds functionality to install and list Cryptexes via vphoned.

Cryptexes are overlay file systems that can contain data, executables, and daemons, which can be added at runtime within the boundaries of Apple's security ecosystem.
Cryptexes are also being used in the context of Apple's physical Security Research Devices. Therefore, this feature allows security researchers to easily use their Cryptex toolchains also for researching with the vphone.

While developing the cryptex support for the vphone, we hit a limitation of pymobiledevice3. We opened doronz88/pymobiledevice3#1701 and hope to remove f05a53a once this is resolved. Meanwhile, we perform the restore with Apple's MobileDevice library (f05a53a). We have limited this to the patchless mode, for now.

In this PR, we use and copy the cryptexctl executable from the cloudOS filesystem as a utility. A future PR, however, might use the (private Swift) CryptexKit framework directly from vphoned.

mpass99 added 4 commits June 8, 2026 15:24
due to setup incompatibilities of idevicerestore and pymobiledevice in regard to REM and Cryptex support.
by allowing all Mach-O executables in both REM phases.

(cherry picked from commit 34e820a5baab19e1f149de10da71db2ccf462350)
(cherry picked from commit af4e207129b310d294c356f01e11d5a8167292ac)
@mpass99

mpass99 commented Jun 11, 2026

Copy link
Copy Markdown
Contributor Author

I just noticed that a MobileDevice restored vphone in Patchless mode panics from time to time. The reason is currently unknown.

Logs

static IOReturn AppleMobileFileIntegrityUserClient::loadTrustCache(OSObject *, void *, IOExternalMethodArguments *): PID 416 is requesting a trust cache load
Nested panic detected - entry count: 2 panic_caller: 0x<ptr>
Panicked thread: <ptr>, backtrace: 0x<ptr>, tid: 6123
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bea0
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bec0
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bf60
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bfe0
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bff0
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0xfffffdf00108f9f0
		  lr: 0x<ptr>  fp: 0xfffffdf00108fa10
		  lr: 0x<ptr>  fp: 0xfffffdf00108fa50
		  lr: 0x<ptr>  fp: 0xfffffdf00108fa70
		  lr: 0x<ptr>  fp: 0xfffffdf00108fb10
		  lr: 0x<ptr>  fp: 0xfffffdf00108fb80
		  lr: 0x<ptr>  fp: 0xfffffdf00108fbf0
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x000000023e999cd4  fp: 0x0000000000000000
      Kernel Extensions in backtrace:
         com.apple.sptm(25.1)[483B7ACD-3530-3B47-A0D4-D54DF1297E2B]@0x<ptr>->0x<ptr>
         com.apple.txm(25.1)[01108044-259B-370C-891A-7FFF39799C39]@0x<ptr>->0x<ptr>
         com.apple.driver.AppleMobileFileIntegrity(1.0.5)[DC4F4B6A-E3A4-3F23-8517-8534A1D40838]@0x<ptr>->0x<ptr>
            dependency: com.apple.driver.ApplePMGR(1)[1497C1AD-9E67-39B6-9861-2B871441DD83]@<ptr>-><ptr>
            dependency: com.apple.iokit.CoreAnalyticsFamily(1)[0F1FB7DB-F11C-3B27-85B3-E593C2BF7A18]@<ptr>-><ptr>
            dependency: com.apple.kec.corecrypto(26.0)[A80B80EC-469D-3B03-A024-36FDDD9AE18B]@<ptr>-><ptr>
            dependency: com.apple.kext.CoreTrust(1)[0B3E96FA-DA1E-30F2-BFB8-346ACDDE181B]@<ptr>-><ptr>
            dependency: com.apple.security.AppleImage4(7.0.0)[41E89479-AF32-305E-8061-931E08819969]@<ptr>-><ptr>
Nested panic detected - entry count: 3 panic_caller: 0x<ptr>
Panicked thread: <ptr>, backtrace: 0x<ptr>, tid: 6123
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bea0
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bec0
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bf60
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bfe0
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bff0
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0xfffffdf00108f9f0
		  lr: 0x<ptr>  fp: 0xfffffdf00108fa10
		  lr: 0x<ptr>  fp: 0xfffffdf00108fa50
		  lr: 0x<ptr>  fp: 0xfffffdf00108fa70
		  lr: 0x<ptr>  fp: 0xfffffdf00108fb10
		  lr: 0x<ptr>  fp: 0xfffffdf00108fb80
		  lr: 0x<ptr>  fp: 0xfffffdf00108fbf0
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x000000023e999cd4  fp: 0x0000000000000000
      Kernel Extensions in backtrace:
         com.apple.sptm(25.1)[483B7ACD-3530-3B47-A0D4-D54DF1297E2B]@0x<ptr>->0x<ptr>
         com.apple.txm(25.1)[01108044-259B-370C-891A-7FFF39799C39]@0x<ptr>->0x<ptr>
         com.apple.driver.AppleMobileFileIntegrity(1.0.5)[DC4F4B6A-E3A4-3F23-8517-8534A1D40838]@0x<ptr>->0x<ptr>
            dependency: com.apple.driver.ApplePMGR(1)[1497C1AD-9E67-39B6-9861-2B871441DD83]@<ptr>-><ptr>
            dependency: com.apple.iokit.CoreAnalyticsFamily(1)[0F1FB7DB-F11C-3B27-85B3-E593C2BF7A18]@<ptr>-><ptr>
            dependency: com.apple.kec.corecrypto(26.0)[A80B80EC-469D-3B03-A024-36FDDD9AE18B]@<ptr>-><ptr>
            dependency: com.apple.kext.CoreTrust(1)[0B3E96FA-DA1E-30F2-BFB8-346ACDDE181B]@<ptr>-><ptr>
            dependency: com.apple.security.AppleImage4(7.0.0)[41E89479-AF32-305E-8061-931E08819969]@<ptr>-><ptr>
Nested panic detected - entry count: 4 panic_caller: 0x<ptr>
Panicked thread: <ptr>, backtrace: 0x<ptr>, tid: 6123
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bea0
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bec0
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bf60
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bfe0
		  lr: 0x<ptr>  fp: 0xfffffdf000d0bff0
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0xfffffdf00108f9f0
		  lr: 0x<ptr>  fp: 0xfffffdf00108fa10
		  lr: 0x<ptr>  fp: 0xfffffdf00108fa50
		  lr: 0x<ptr>  fp: 0xfffffdf00108fa70
		  lr: 0x<ptr>  fp: 0xfffffdf00108fb10
		  lr: 0x<ptr>  fp: 0xfffffdf00108fb80
		  lr: 0x<ptr>  fp: 0xfffffdf00108fbf0
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
		  lr: 0x<ptr>  fp: 0x<ptr>
Backtrace continues...
      Kernel Extensions in backtrace:
         com.apple.sptm(25.1)[483B7ACD-3530-3B47-A0D4-D54DF1297E2B]@0x<ptr>->0x<ptr>
         com.apple.txm(25.1)[01108044-259B-370C-891A-7FFF39799C39]@0x<ptr>->0x<ptr>
         com.apple.driver.AppleMobileFileIntegrity(1.0.5)[DC4F4B6A-E3A4-3F23-8517-8534A1D40838]@0x<ptr>->0x<ptr>
            dependency: com.apple.driver.ApplePMGR(1)[1497C1AD-9E67-39B6-9861-2B871441DD83]@<ptr>-><ptr>
            dependency: com.apple.iokit.CoreAnalyticsFamily(1)[0F1FB7DB-F11C-3B27-85B3-E593C2BF7A18]@<ptr>-><ptr>
            dependency: com.apple.kec.corecrypto(26.0)[A80B80EC-469D-3B03-A024-36FDDD9AE18B]@<ptr>-><ptr>
            dependency: com.apple.kext.CoreTrust(1)[0B3E96FA-DA1E-30F2-BFB8-346ACDDE181B]@<ptr>-><ptr>
            dependency: com.apple.security.AppleImage4(7.0.0)[41E89479-AF32-305E-8061-931E08819969]@<ptr>-><ptr>
Nested panic count exceeds limit 5, machine will reset or spin

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant