Are you wondering why the long-awaited Electra jailbreak for iOS 11.3.1 has not yet been released? In this article
The reason was explained by a Reddit user under the nickname Samg_is_a_Ninja.
Let's start with the fact that Ian Beer, a member of the teamGoogle Project Zero security, published two exploits: multi_path (he called it mp) and empty_list (respectively, el). As Samg_is_a_Ninja writes, the mp exploit had a higher chance of success, but its use requires an Apple Developer account, which in turn requires a $99/year subscription. The el exploit, on the other hand, does not require a developer certificate but is less stable. Well-known hacker pwn20wnd has made a number of improvements, but the success rate is still 1/3, which is still too low.
A Reddit user notes that the developmentThe iOS 11.3.1 jailbreak was further complicated by the fact that Apple added new security features that use snapshots of the APFS file system rather than the root partition.
Everyone thought it would be pretty easy to useold code from Electra for iOS 11.1.X, simply replacing the kernel exploit – use mp or el instead of async_wake. However, when launching new exploits, it was discovered that Apple had added a new protective feature: the use of APFS snapshots, rather than the root partition, as it was before.
It was previously reported that the delay in the release of Electraassociated with instability of the remount code. Samg_is_a_Ninja revealed in more detail both the mounting problem and the reason why Electra for iOS 11.3.1 has not yet been released.
One of the main functions of jailbreak –the ability to access the entire file system of the device. Imagine that your smartphone's file system – these are two boxes of toys. The first one is calleddisk0s1s1, second –disk0s1s2. Boxdisk0s1s2larger in size and contains all the data under/var section, and is divided into sections – one for each app you have installed, plus photos, iBooks and everything like that. Boxdisk0s1s1smaller, and contains data under all other sections (/ Applications, / System, / Library, etc.), system applications and files that ensure the functioning of the system.
In stock iOSdisk0s1s2is mounted in read-write mode and allows each application to write data only in its assigned sandbox. Write data to other partsdisk0s1s2Only the system can. Sign up fordisk0s1s1is only possible during a program update or recovery.
On 11.2.6 and newer, once you get task_for_pid(0) (thanks to the exploits), it’s easy to mount anddisk0s1s1, Anddisk0s1s2in read and write mode. However, in iOS 11.3, Apple introduced a new feature: when you set up your device, the system takes a snapshot of the contentdisk0s1s1. From now on, every time you turn on the device, the system looks at the snapshot, then at the contentsdisk0s1s1and looks for differences.If any files have been moved or deleted, it returns them back. Any added objects are deleted, and any deleted – are being restored. And this is the whole problem: for example, the /Applications/Cydia.app/ section will be deleted every time you start it.
There is some good news.In particular, the new security feature has only just been added, and it seems to be full of vulnerabilities. Initially, Jonathan Levin (@Morpheus______) was going to work on a vulnerability that allows for remount (it was discovered by @SparkZheng), but now it seems that completing the exploit has become a distant priority.
The Reddit user also notes that the WebKit version of el has already been released. This gives hope for the release of iOS 11.3.1 jailbreak using Safari.
Another good news is thatEnthusiast Tom Michaud discovered a vulnerability in the launch daemon. It might even lead to the release of an untethered jailbreak for iOS 11.3.1. This vulnerability is similar to the one used in the untethered jailbreak evasi0n.
Given that we are talking about the most protectedthe operating system in the world, it’s not surprising that jailbreak fans have to be patient. It is important to wait for the full testing of the code to make sure that it is reliable and there is no risk of turning the device into a brick.