[PR #2264] feat(ios): Add iOS app support - add jailbroken runtime debugging lanes #5127

New issue

Open

opened 2026-10-31 01:04:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:04:11 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2264
Author: @kxdkxd
Created: 10/12/2026
Status: 🔄 Open

Base: main ← Head: feat/ios-jailbroken-runtime

📝 Commits (10+)

3451e68 feat(ios): add jailbroken runtime debugging lanes
538ed35 chore: merge main and preserve iOS runtime proposal
0fccc12 fix(ios): preserve runtime authority and helper ownership
2a10e54 fix(ios): reject unknown Frida helper ownership
cc3743b fix(ios): repair shell composition and CLI catalog contracts
e863926 fix(ios): isolate shared startup and own private helper logs
6e05920 fix(ios): give remote retirement an independent transport lifetime
b674844 fix(ios): share runtime starts and close providers
40a5d40 fix(ios): wait for shared Frida startup on close
bd290c8 Merge branch 'main' into feat/ios-jailbroken-runtime

📊 Changes

44 files changed (+4156 additions, -31 deletions)

View changed files

📝 README.md (+26 -25)
➕ docs/ios-device-analysis.md (+108 -0)
📝 docs/readme/README_ar.md (+2 -0)
📝 docs/readme/README_de.md (+2 -0)
📝 docs/readme/README_el.md (+2 -0)
📝 docs/readme/README_es.md (+2 -0)
📝 docs/readme/README_fa.md (+2 -0)
📝 docs/readme/README_fr.md (+2 -0)
📝 docs/readme/README_id.md (+2 -0)
📝 docs/readme/README_it.md (+2 -0)
📝 docs/readme/README_ja.md (+2 -0)
📝 docs/readme/README_ko.md (+2 -0)
📝 docs/readme/README_pl.md (+2 -0)
📝 docs/readme/README_pt-BR.md (+2 -0)
📝 docs/readme/README_ru.md (+2 -0)
📝 docs/readme/README_th.md (+2 -0)
📝 docs/readme/README_tr.md (+2 -0)
📝 docs/readme/README_uk.md (+2 -0)
📝 docs/readme/README_vi.md (+2 -0)
📝 docs/readme/README_zh-TW.md (+2 -0)

...and 24 more files

📄 Description

Summary

Adds a jailbroken iOS runtime analysis provider for paired devices, Dopamine 2 rootless/roothide environments, LLDB/debugserver workflows, and Frida scripting.

Problem and expected behavior

REA already supports static Apple application and Mach-O analysis, but it had no structured way to connect those findings to a running, analyst-owned jailbroken iPhone. This change adds bounded device observations and explicit dynamic analysis lanes while preserving evidence, limitations, and caller-selected targets.

Change and scope

Adds libimobiledevice device/app/process/syslog/file acquisition through a typed iOS provider.
Adds iproxy-backed SSH operations for root and mobile accounts, including /var/jb and roothide .jbroot-* discovery.
Adds structured debugserver/lldb-server attach, LLDB breakpoint/register/thread/expression commands, and bounded process-memory hexdumps.
Adds Frida host/device discovery, iproxy forwarding, and short-lived host script execution.
Adds CLI, MCP contracts, tool effects, catalog registration, documentation, and provider tests.
Keeps automatic VMP devirtualization and automatic deobfuscation out of scope; the provider returns runtime evidence for analyst-led correlation with existing native analysis.

Contract and boundary impact

Semantic owner and earliest changed stage: iOS domain schemas and provider adapter.
CLI and MCP/tool-catalog contract: adds iOS device, runtime, LLDB, Frida, and bounded-memory commands/tools.
Provider, bridge, target-format, or platform compatibility: caller-supplied libimobiledevice, iproxy, SSH, compatible debugserver/LLDB, and Frida binaries; Dopamine rootless/roothide paths are recognized.
Evidence, artifact, provenance, or reconstruction contract: observations retain source command, target identity, stdout/stderr, exit status, truncation, and explicit limitations.
Process execution, authorization, cleanup, or containment impact: SSH passwords are read only from REA_IOS_SSH_PASSWORD; iproxy, SSH, debugserver, and Frida helper processes are bounded and provider-owned; REA does not install jailbreak or instrumentation binaries.
Generated metadata (docs/public/product-catalog.json), package, or installation impact: catalog is generated and checked; no package dependency or installer change.

Evidence and regression coverage

Tests added or updated: iOS output parsing tests and contract/tool-effect coverage; existing fast suite remains green.
Base reproduction or other evidence: paired jailbroken iPhones were available for real-device probes; host LLDB and device /usr/bin/debugserver were detected. The test device did not have frida-server, and the host Frida CLI was unavailable, so the Frida execution lane was not claimed as real-device verified.
User-visible CLI/MCP output (if applicable): new iOS commands and MCP tools are documented in docs/ios-device-analysis.md.
Remaining proof gaps: no automatic VMP or obfuscation recovery; Frida runtime execution requires caller-installed compatible host/device binaries.

Validation performed

npm run check — passed; architecture guards passed and lint reported repository warnings only.
npm run test:fast — 395 test files passed, 5112 tests passed, 7 skipped.
npm run docs:check — passed.
npm run mcp-catalog:generate && npm run mcp-catalog:check:built — passed.
npm run verify:test-discovery — all 916 test files discovered exactly once.
Real-device probe — three paired Dopamine jailbroken iPhones were visible; LLDB/debugserver availability was observed, while Frida server/host CLI were unavailable.

Compatibility, safety, and release

Breaking changes or migration steps: none.
Real Hopper/Ghidra, browser, or OS coverage: macOS host with paired iOS hardware; native static analysis remains caller-selected.
Package or release metadata impact: no new runtime dependency.
Security, privacy, process, or containment review: intended for software the caller owns or is authorized to examine; credentials remain environment-only and are never returned or committed.

Review checklist

This PR addresses a concrete problem or an agreed enhancement.
The PR has one focused outcome and the title follows type(scope): outcome.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2264 **Author:** [@kxdkxd](https://github.com/kxdkxd) **Created:** 10/12/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `feat/ios-jailbroken-runtime` --- ### 📝 Commits (10+) - [`3451e68`](https://github.com/morluto/rea/commit/3451e684d7107ef61501c6f0def5362fb03fe652) feat(ios): add jailbroken runtime debugging lanes - [`538ed35`](https://github.com/morluto/rea/commit/538ed35aa05b2c0bc16af3905198862809ac22f9) chore: merge main and preserve iOS runtime proposal - [`0fccc12`](https://github.com/morluto/rea/commit/0fccc12de618faefe35e064d84b7b4a737836dea) fix(ios): preserve runtime authority and helper ownership - [`2a10e54`](https://github.com/morluto/rea/commit/2a10e54382ee8ddd887cd1cb80865e59c36f8be4) fix(ios): reject unknown Frida helper ownership - [`cc3743b`](https://github.com/morluto/rea/commit/cc3743bd7675c22fdc636295b261c3fc54a2526d) fix(ios): repair shell composition and CLI catalog contracts - [`e863926`](https://github.com/morluto/rea/commit/e86392601f98cf89a7ab82b4255108fde792f151) fix(ios): isolate shared startup and own private helper logs - [`6e05920`](https://github.com/morluto/rea/commit/6e0592007951cdcf4612d197013166ed1c1860ee) fix(ios): give remote retirement an independent transport lifetime - [`b674844`](https://github.com/morluto/rea/commit/b67484491fd4ea67464ee053abca02b89ebbed03) fix(ios): share runtime starts and close providers - [`40a5d40`](https://github.com/morluto/rea/commit/40a5d4003d0e411d710829af891f9466efec5d8b) fix(ios): wait for shared Frida startup on close - [`bd290c8`](https://github.com/morluto/rea/commit/bd290c8eabebe6623b56648e3b61f5e9b2bed829) Merge branch 'main' into feat/ios-jailbroken-runtime ### 📊 Changes **44 files changed** (+4156 additions, -31 deletions) <details> <summary>View changed files</summary> 📝 `README.md` (+26 -25) ➕ `docs/ios-device-analysis.md` (+108 -0) 📝 `docs/readme/README_ar.md` (+2 -0) 📝 `docs/readme/README_de.md` (+2 -0) 📝 `docs/readme/README_el.md` (+2 -0) 📝 `docs/readme/README_es.md` (+2 -0) 📝 `docs/readme/README_fa.md` (+2 -0) 📝 `docs/readme/README_fr.md` (+2 -0) 📝 `docs/readme/README_id.md` (+2 -0) 📝 `docs/readme/README_it.md` (+2 -0) 📝 `docs/readme/README_ja.md` (+2 -0) 📝 `docs/readme/README_ko.md` (+2 -0) 📝 `docs/readme/README_pl.md` (+2 -0) 📝 `docs/readme/README_pt-BR.md` (+2 -0) 📝 `docs/readme/README_ru.md` (+2 -0) 📝 `docs/readme/README_th.md` (+2 -0) 📝 `docs/readme/README_tr.md` (+2 -0) 📝 `docs/readme/README_uk.md` (+2 -0) 📝 `docs/readme/README_vi.md` (+2 -0) 📝 `docs/readme/README_zh-TW.md` (+2 -0) _...and 24 more files_ </details> ### 📄 Description ## Summary Adds a jailbroken iOS runtime analysis provider for paired devices, Dopamine 2 rootless/roothide environments, LLDB/debugserver workflows, and Frida scripting. ## Problem and expected behavior REA already supports static Apple application and Mach-O analysis, but it had no structured way to connect those findings to a running, analyst-owned jailbroken iPhone. This change adds bounded device observations and explicit dynamic analysis lanes while preserving evidence, limitations, and caller-selected targets. ## Change and scope - Adds libimobiledevice device/app/process/syslog/file acquisition through a typed iOS provider. - Adds iproxy-backed SSH operations for `root` and `mobile` accounts, including `/var/jb` and roothide `.jbroot-*` discovery. - Adds structured debugserver/`lldb-server` attach, LLDB breakpoint/register/thread/expression commands, and bounded process-memory hexdumps. - Adds Frida host/device discovery, iproxy forwarding, and short-lived host script execution. - Adds CLI, MCP contracts, tool effects, catalog registration, documentation, and provider tests. - Keeps automatic VMP devirtualization and automatic deobfuscation out of scope; the provider returns runtime evidence for analyst-led correlation with existing native analysis. ## Contract and boundary impact - Semantic owner and earliest changed stage: iOS domain schemas and provider adapter. - CLI and MCP/tool-catalog contract: adds iOS device, runtime, LLDB, Frida, and bounded-memory commands/tools. - Provider, bridge, target-format, or platform compatibility: caller-supplied libimobiledevice, iproxy, SSH, compatible debugserver/LLDB, and Frida binaries; Dopamine rootless/roothide paths are recognized. - Evidence, artifact, provenance, or reconstruction contract: observations retain source command, target identity, stdout/stderr, exit status, truncation, and explicit limitations. - Process execution, authorization, cleanup, or containment impact: SSH passwords are read only from `REA_IOS_SSH_PASSWORD`; iproxy, SSH, debugserver, and Frida helper processes are bounded and provider-owned; REA does not install jailbreak or instrumentation binaries. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact: catalog is generated and checked; no package dependency or installer change. ## Evidence and regression coverage - Tests added or updated: iOS output parsing tests and contract/tool-effect coverage; existing fast suite remains green. - Base reproduction or other evidence: paired jailbroken iPhones were available for real-device probes; host LLDB and device `/usr/bin/debugserver` were detected. The test device did not have `frida-server`, and the host Frida CLI was unavailable, so the Frida execution lane was not claimed as real-device verified. - User-visible CLI/MCP output (if applicable): new iOS commands and MCP tools are documented in `docs/ios-device-analysis.md`. - Remaining proof gaps: no automatic VMP or obfuscation recovery; Frida runtime execution requires caller-installed compatible host/device binaries. ## Validation performed - `npm run check` — passed; architecture guards passed and lint reported repository warnings only. - `npm run test:fast` — 395 test files passed, 5112 tests passed, 7 skipped. - `npm run docs:check` — passed. - `npm run mcp-catalog:generate && npm run mcp-catalog:check:built` — passed. - `npm run verify:test-discovery` — all 916 test files discovered exactly once. - Real-device probe — three paired Dopamine jailbroken iPhones were visible; LLDB/debugserver availability was observed, while Frida server/host CLI were unavailable. ## Compatibility, safety, and release - Breaking changes or migration steps: none. - Real Hopper/Ghidra, browser, or OS coverage: macOS host with paired iOS hardware; native static analysis remains caller-selected. - Package or release metadata impact: no new runtime dependency. - Security, privacy, process, or containment review: intended for software the caller owns or is authorized to examine; credentials remain environment-only and are never returned or committed. ## Review checklist - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-31 01:04:11 +00:00

bsakaguchi referenced this issue

2026-11-01 21:11:07 +00:00

[GH-ISSUE #5654] [Tracker] Open PRs that can't merge yet: conflicts and red CI (October 2026) #3425

bsakaguchi referenced this issue

2026-11-01 21:42:59 +00:00

[PR #5127] [CLOSED] fix(artifacts): preserve original Unicode spelling when NFC normalization changes a logical path #6779