iOS
Jailbreak symlinksJailbreak
Detects system directories that have been replaced with symbolic links to free space on the root partition.
At a glance
- Platform
- iOS
- Category
- Jailbreak
- Source
- DIIntegrityChecks.m · hasJailbreakSymlinks
- Default status
- Makes status compromised
- Seen firing
- Not yet seen firing in a validated run. Based on validated scenarios whose observed result includes this signal; see below.
- OWASP MASTG
- MASTG-TEST-0088
How it works
What the code inspects.
Calls NSFileManager destinationOfSymbolicLinkAtPath: on directories that are plain directories on a stock device: /Applications, /Library/Ringtones, /Library/Wallpaper, /usr/include, /usr/libexec, /usr/share and others.
On a stock device the call fails (the path is not a symlink). If it returns a destination, the path has been turned into a symlink — a classic side effect of older (pre-rootless) jailbreaks that relocated these directories onto the larger data partition.
The exploit it addresses
Why this matters.The threat.
Legacy jailbreaks remount the read-only system partition and, because it is small, move large directories to /var and symlink them back. The symlink is a durable structural fingerprint of that remounting even after obvious apps are removed.
How it can be bypassed
No single check is sufficient.Known evasions.
Modern rootless jailbreaks never repartition or symlink system directories — they stay inside /var/jb — so this check does not fire on them at all.
Hooking destinationOfSymbolicLinkAtPath: to return nil hides the symlinks.
Validation scenarios
Where this check is exercised.1 scenario.
References & further reading
- MASTG-TEST-0088: Testing Jailbreak Detection (iOS)Open ↗
https://mas.owasp.org/MASTG/tests/ios/MASVS-RESILIENCE/MASTG-TEST-0088/
- iOS jailbreak landscape (ios.cfw.guide)Open ↗
https://ios.cfw.guide/types-of-jailbreak/
- IOSSecuritySuite (reference check set; no source copied)Open ↗
https://github.com/securing/IOSSecuritySuite