KFD

[x3n1al]

Wouldn't it be possible to use KFD (exploit that allows kernel read/write) for partial desandboxing? Xsf1re has managed to get partial desandboxing with the exploit https://github.com/wh1te4ever/kfd

[joeyoropesa-dev]

Well if you're an good developer (ready to sacrifice all the time you need for all of this), you can build for example kfd version of jailbreak (cli version) with including code in your cli jailbreak binary all steps that are required for an kfd-based jailbreak like finding offsets and etc...

Also, if you want on an higher version of iOS than iOS 15.5b4, you need to wait for TrollStore 2.0 to gets released and for A12+ devs, they also need to wait for those versions an kernel exploit to include it instead of kfd and with that you can use new version of cert that triggers new CoreTrust bug on newer iOS devices to sign that cli binary and of course add every entitlements (except for banned entitlements on A12+ devices) to be sure that jailbreak binary will run correctly with correct permissions to control device like an platform binary

After that, you should be able to follow all those instructions and include that code in haxx so that when you reboot your device, immediatelly after unlocking and 5 seconds, the device will execute your code and jailbreak your device by default

And probably springboard reboot automatically to apply patched kernel, bypasses and everything that you need for an jailbreak to actually work