Rage Against the Sandbox: Bypassing Apple’s iOS Security to Run Unsigned Code via SSH
Abstract
Apple’s Sandbox and code signing have rendered traditional security research tools and development workflows impractical on iPhones, forcing researchers to rely on full-system emulation or increasingly scarce jailbreak exploits. The Sandbox prohibits process creation, which shell programs need for job control. Code signing prevents execution of unsigned binaries.
In this work, we present novel techniques for bypassing iOS Sandbox’s fork() restriction and code signing enforcement without exploiting vulnerabilities, and demonstrate their integration in TVM (Thread Virtual Machine), a practical framework for running unmodified programs on iPhones. TVM enables SSH servers and interactive shells on iPhones, with full support for fork() semantics and unsigned code execution.
We provide an in-depth technical analysis of our approach, which leverages multithreading, stack frame manipulation, and selective processor instruction emulation. This implementation demonstrates that the practical security boundaries of Apple’s sandbox can be pushed significantly further than previously possible on non-jailbroken devices.