Jailbreak file artifacts · iOS · react-native-device-integrity

At a glance

Platform: iOS
Category: Jailbreak
Source: DIIntegrityChecks.m · hasJailbreakFiles
Default status: Makes status compromised
Seen firing: Not yet seen firing in a validated run. Based on validated scenarios whose observed result includes this signal; see below.
OWASP MASTG: MASTG-TEST-0088

How it works

What the code inspects.

Probes a fixed list of ~50 paths with NSFileManager fileExistsAtPath: and, as a fallback, the POSIX access(path, F_OK) syscall. Two lookups are used because some jailbreaks make paths invisible to the high-level Foundation API but not to the raw syscall.

The list covers package-manager apps (Cydia, Sileo, Zebra, Filza, Installer), tweak-injection runtimes (/Library/MobileSubstrate, libsubstrate.dylib, libhooker.dylib, ellekit, TweakInject), the APT package database, an OpenSSH server (sshd/ssh), and rootless jailbreak roots (/var/jb).

On the Simulator this whole family of checks is skipped by design — the paths would resolve against the host Mac filesystem and produce false positives.

The exploit it addresses

Why this matters.The threat.

A jailbreak removes Apple's sandbox and code-signing enforcement, giving the user (or malware) root and the ability to read another app's keychain, patch its binary in memory, and dump decrypted App Store binaries.

The presence of these files is the single most direct indication that the secure boot chain and sandbox the app relies on are no longer intact.

How it can be bypassed

No single check is sufficient.Known evasions.

Rootless jailbreaks (Dopamine, palera1n rootless) relocate the entire jailbreak into /var/jb, so hardcoded legacy paths like /Applications/Cydia.app no longer exist — detection has to know the new roots.

Anti-detection tweaks (Shadow, Choicy's tweak-hiding, kernel-level file hiding) hook stat/access/fileExistsAtPath: to make these paths report as absent.

A determined attacker simply does not install Cydia/Filza, or renames the package manager, leaving no file at a known path.

Validation scenarios

Where this check is exercised.1 scenario.

A06

Jailbroken iPhone

Blocked · ios

Open →

References & further reading

All checks

Jailbreak symlinks →

Jailbreak file artifactsJailbreak

At a glance

Why this matters.The threat.

No single check is sufficient.Known evasions.

Where this check is exercised.1 scenario.