
Theos was initially ‘iphone-framework’, a project created to simplify building code at the command line, primarily for jailbroken iOS devices. It later underwent significant changes and became Theos, a flexible Make-based build system targeting jailbreak software development, but also with complete support for building for various other platforms. Theos runs on, and can build projects for, macOS, iOS, Linux, and Windows.
Installation on Jailbroken device
The first step is to connect to the jb device via ssh after that execute the following commands:
- mkdir /opt
- export THEOS=/opt/theos
git clone --recursive https://github.com/theos/theos.git $THEOS
- Download an SDK for your device and place it inside /opt/theos/sdks
Hook an iOS app with Theos
This demo will show how to bypass the jailbreak detection mechanism in an Objective-C application.
First thing download and install the app on the jailbroken device. after that, You need to create a Tweak
- perl /opt/theos/bin/nic.pl

- Choose a Template (required): 17
- Project Name (required): JbBypass
- Package Name [com.yourcompany.jbbypass]: blank
- Author/Maintainer Name [System Administrator]: blank
- MobileSubstrate Bundle filter [com.apple.springboard]: com.diego.certif.aaaa (Insert the bundle id of the app you wish to hook here)
- List of applications to terminate upon installation (space-separated, ‘-‘ for none) [SpringBoard]: blank

At this point, we can implement the Tweak.
- cd jbbypass/
- nano Makefile
ARCHS = armv7 arm64
THEOS_DEVICE_IP=192.168.5.116
TARGET := iphone:clang:latest:10.0
INSTALL_TARGET_PROCESSES = SpringBoard
include $(THEOS)/makefiles/common.mk
TWEAK_NAME = JbBypass
JbBypass_FILES = Tweak.x
JbBypass_CFLAGS = -fobjc-arc
include $(THEOS_MAKE_PATH)/tweak.mk
Our goal is to modify isJailbroken’s behavior
nano Tweak.x
%hook ViewController
- (BOOL)isJailbroken {
return NO;
}
%end
%hook
—Opens a hook block and allows you to hook a given class.%ctor
—Injects a new constructor into the application.%orig
—Calls the original implementation of a hooked function.%log
—Writes details of a method and its arguments to the system log.%end
—Used to close a%hook
block.

- make package install

As long as everything goes well, we can bypass the jailbreak detection.

Demo 2
In this demo, I’ll show how to bypass the jailbreak detection mechanism in a Swift application. Download
- Choose a Template (required): 17
- Project Name (required): swiftjb
- Package Name [com.yourcompany.swiftjb]:
- Author/Maintainer Name [System Administrator]:
- List of applications to terminate upon installation (space-separated, ‘-‘ for none)[SpringBoard]:

- cd swiftjb
- nano Makefile
ARCHS = armv7 arm64
THEOS_DEVICE_IP=192.168.5.116
TARGET := iphone:clang:latest:10.0
INSTALL_TARGET_PROCESSES = SpringBoard
include $(THEOS)/makefiles/common.mk
TWEAK_NAME = swiftjb
swiftjb_FILES = Tweak.x
swiftjb_CFLAGS = -fobjc-arc
include $(THEOS_MAKE_PATH)/tweak.mk
nano Tweak.x
#include <substrate.h>
#import <Foundation/Foundation.h>
%hook ViewController
static Boolean (*orig_VC_JB)(void)=NULL;
Boolean hook_ViewController_isJailBroken() {
return false;
}
%end
%ctor{
%init(ViewController = objc_getClass("JBDetection.ViewController"));
MSHookFunction(MSFindSymbol(NULL,"_$s11JBDetection14ViewControllerC12isJailbrokenSbyF"),
(void*)hook_ViewController_isJailBroken,
(void**)orig_VC_JB);
}
- make package install
As long as everything goes well, we can bypass the jailbreak detection.