{"action":"created","issue":{"url":"https://api.github.com/repos/hrydgard/ppsspp/issues/8122","repository_url":"https://api.github.com/repos/hrydgard/ppsspp","labels_url":"https://api.github.com/repos/hrydgard/ppsspp/issues/8122/labels{/name}","comments_url":"https://api.github.com/repos/hrydgard/ppsspp/issues/8122/comments","events_url":"https://api.github.com/repos/hrydgard/ppsspp/issues/8122/events","html_url":"https://github.com/hrydgard/ppsspp/issues/8122","id":114189239,"number":8122,"title":"arm64 JIT and codesigning on iOS 9","user":{"login":"angelXwind","id":1980487,"avatar_url":"https://avatars.githubusercontent.com/u/1980487?v=3","gravatar_id":"","url":"https://api.github.com/users/angelXwind","html_url":"https://github.com/angelXwind","followers_url":"https://api.github.com/users/angelXwind/followers","following_url":"https://api.github.com/users/angelXwind/following{/other_user}","gists_url":"https://api.github.com/users/angelXwind/gists{/gist_id}","starred_url":"https://api.github.com/users/angelXwind/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/angelXwind/subscriptions","organizations_url":"https://api.github.com/users/angelXwind/orgs","repos_url":"https://api.github.com/users/angelXwind/repos","events_url":"https://api.github.com/users/angelXwind/events{/privacy}","received_events_url":"https://api.github.com/users/angelXwind/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/hrydgard/ppsspp/labels/Platform-specific%20(iOS)","name":"Platform-specific (iOS)","color":"fef2c0"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":128,"created_at":"2015-10-30T02:52:12Z","updated_at":"2016-08-07T22:34:16Z","closed_at":null,"body":"So, hi. I'm Karen/angelXwind, jailbroken iOS developer. This is going to be a rather lengthy post of sorts, detailing into the changes that were made in Pangu9 and such — and how they affect PPSSPP.\r\n\r\nNote that I will be skipping out on a bunch of the details as to how Pangu9 (`fuxiqin`) works — simply because I don't think I'm really supposed to say anything about that.\r\n\r\nAnyway, you may have noticed that attempting to use PPSSPP's JIT core on an arm64 iOS 9 device will just result in a crash. And you also may have noticed that using any PPSSPP build that isn't from PPSSPPBuildBot (that I run) will... \"crash\" instantly at launch, no matter what you do.\r\n\r\nThis is due to a number of changes in both iOS 9 and how Pangu9 works. iOS 9 (and OS X 10.11) includes something Apple advertises as \"Rootless Security\"\r\n\r\nNow, many people think \"Rootless\" means \"there is no longer root on iOS/OSX\" — no, that'd be crazy. \"Rootless\" (on iOS, at least) is actually called KPP — Kernel Patch Protection — something where iOS checksums the kernel *constantly* (ARM TrustZone functionality is how they're doing that without destroying battery life), and panics if anything is patched.\r\n\r\nBecause of this new security model in iOS, Pangu9 had to make a number of innovations in how the untether works — this is where I skip out on details. The core thing that affects PPSSPP and other projects requiring JIT/modifying of `rwx` memory pages (like my own NO PLS RECOVERY) is the fact that the kernel is no longer patched.\r\n\r\nYou see, no one's actually figured out how to break KPP. So Pangu9 does not actually patch the kernel, but rather does some [censored] magic to achieve *most* of what we see in past jailbreaks. Unfortunately, `VM_PROTECT` is not one of these things — this is what broke basically every JIT implementation out there.\r\n\r\nNow, some of you with iOS 9 32-bit devices (iPhone 5, 5c, 4s; iPad 2, 3, 4; iPod touch 5) may have noticed that hey — PPSSPPBuildBot's PPSSPP builds have perfectly working JIT! This is because Pangu9 on 32-bit devices actually does patch the kernel, including `VM_PROTECT` ;P So JIT is fine for you.\r\n\r\nThe solution to this issue is something I've already told @hrydgard — you'd need to do some trickery with deallocating/reallocating pages. While `VM_PROTECT` isn't patched, this is (so no, this won't magically make JIT work on non-jailbroken devices).\r\n\r\nBasically, you'd have to use `vm_deallocate` and `mmap` (with the `MAP_JIT` flag) in order to perform JIT.\r\n\r\nNow, this is something that... *should* work — by that, I mean no one's actually done this/tested this before. So we're headed into uncharted territory here ;P\r\n\r\nSo that's JIT.\r\n\r\nNow, moving onto this crash-at-launch issue that people are experiencing. This one's really simple, actually.\r\n\r\nBasically, it's an issue with code-signing. PPSSPP is an unsigned binary, and iOS 9 doesn't like that. We'd need to at least fakesign it via adhoc signing (use `-` code-signing). I have a pull request coming soon that'll fix this issue, but for now PPSSPPBuildBot already does this.\r\n\r\n**So what happens now?**\r\n\r\nCurrently, I'm still terribly busy with school (college applications, notably) — but those will be over in a few days. I plan to submit a pull request that'll do a few things:\r\n\r\n1. Modify the `canUseJit` functionality to check to see if PPSSPP is running on **arm64** iOS 9 — if so, the device will be marked as JIT-incapable (but not necessarily unjailbroken). This will fix the vertex shader JIT crash that occurs even if CPU JIT is off. When @hrydgard gets around to modifying the JIT core, this will be removed.\r\n\r\n1. Fix the codesigning issue by setting it to use Adhoc codesigning as opposed to no codesigning."},"comment":{"url":"https://api.github.com/repos/hrydgard/ppsspp/issues/comments/238112844","html_url":"https://github.com/hrydgard/ppsspp/issues/8122#issuecomment-238112844","issue_url":"https://api.github.com/repos/hrydgard/ppsspp/issues/8122","id":238112844,"user":{"login":"WilliamLCobb","id":870904,"avatar_url":"https://avatars.githubusercontent.com/u/870904?v=3","gravatar_id":"","url":"https://api.github.com/users/WilliamLCobb","html_url":"https://github.com/WilliamLCobb","followers_url":"https://api.github.com/users/WilliamLCobb/followers","following_url":"https://api.github.com/users/WilliamLCobb/following{/other_user}","gists_url":"https://api.github.com/users/WilliamLCobb/gists{/gist_id}","starred_url":"https://api.github.com/users/WilliamLCobb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WilliamLCobb/subscriptions","organizations_url":"https://api.github.com/users/WilliamLCobb/orgs","repos_url":"https://api.github.com/users/WilliamLCobb/repos","events_url":"https://api.github.com/users/WilliamLCobb/events{/privacy}","received_events_url":"https://api.github.com/users/WilliamLCobb/received_events","type":"User","site_admin":false},"created_at":"2016-08-07T22:34:16Z","updated_at":"2016-08-07T22:34:16Z","body":"I don't have time to test, but something like this should work.\r\n\r\nuint8_t codetest[] = {0xE7,0x23,0x00,0xB9,0xE7,0x23,0x40,0xB9,0xC0,0x03,0x5F,0xD6}; //ldr str ret arm64\r\nvoid *mem = mmap(NULL, 1024, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE, -1, 0);\r\nmemcpy(mem, codetest, sizeof(codetest));\r\nopPtr = (uintptr_t *)((uintptr_t)mem & 0xFFFFC000); //Align to page\r\nmprotect(opPtr, 16384 * 2, PROT_READ | PROT_EXEC);\r\nvoid (*func)() = (void(*)())mem;\r\nfunc();"}}
{"actor":{"display_login":"WilliamLCobb"}}