Load MobileSubstrate in setuid iPhone app

Question

I have a root app on my iPod touch (Installer4) and I want it to load MobileSubstrate so I can start making a tweak to fix its bugs. I know that root apps have an intermediate executable to be able to put 6755 permissions on it without the app to crash, in the case of Installer, it's named Scythe. I tried to make a new one to load MobileSubatrate with execve() without success. The app dosen't crash and it's still as root but MobileSubatrate won't load :/ (I know this because Activator doesn't work).

Here is my Scythe.c (based on Trichlorotrifluoroethane.c from Icy) :

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <dlfcn.h>

int main(int argc, char * argv[], char * envp[]) {
    char fullpath[1024];

    strncpy(fullpath, argv[0], strlen(argv[0]) - strlen("Scythe"));
    strcat(fullpath, "Installer");

    char* newArgv[] = { fullpath, NULL };

    char* newEnvp[] = { "LD_PRELOAD=/Library/MobileSubstrate/MobileSubstrate.dylib", NULL };

    return execve(fullpath, newArgv, newEnvp);
}

As you can see, I've researched how to load a dylib with execve() and I've found LD_PRELOAD and LD_LIBRARY_PATH, but both aren't working. And I don't have the source code of Installer to do a dlopen("/Library/MobileSubstrate/MobileSubstrate.dylib", RTLD_LAZY), anyway if I had it I would not be asking this question.

I hope that someone will figure out the problem.

Answer 1

I completely oppose doing anything regarding Installer or any other Cydia alternative. I am just posting this for people to know what to do when it comes to similar things.

Still, MobileSubstrate does not load extensions into root apps; you'd have to dlopen the MobileSubstrate extension from inside your root app (like Cydia loads Activator from inside it).

But note that doing so is highly risky and can break a lot of things (as is having Installer, bleh), so you should usually not try to bypass this.