- Expose an API to frida that allows it to hook memory over hookd, fixes panics when using frida on iOS 26+ (Requires frida >=17.19.0) (contributed by @devnoname120)
- Fix Xcode debugging being broken on iOS 17+ after a userspace reboot if a developer disk image was already mounted before the userspace reboot
- Fix jailbreak apps not being removed from home screen when removing the jailbreak on iOS 18.4+
- Remove "Remove Jailbreak" button from settings when the device is jailbroken since it was too unstable, it will now only show up when not jailbroken on TrollStore installations, the only supported uninstallation flow on non TrollStore installations is now to reboot and rejailbreak with the "Remove Jailbreak" toggle enabled
- Fix "Hide Jailbreak" explanation not showing up in app settings [2.5 beta regression]
- Improve "Hide Jailbreak" explanation in app settings to cause less confusion about what it does and emphasize the fact the user should only use it on their own risk
- Fix an OOB kernel write during the jbupdate process that could cause a panic and in some cases leave the file `/var/jb/basebin/gen/dyld.old` in a corrupted state where it cannot be deleted anymore (Technically not a 3.0 regression, just 3.0 made the allocation smaller which is why the issue is only noticeable since 3.0)
- During rejailbreak, `/var/jb/basebin/gen/dyld.old` corruption is now automatically detected and if found, the issue is automatically solved by moving the corrupted file to `/private/preboot//orphaned-`, which will allow rejailbreaking to work again
- Fix "Finalizing Bootstrap" sometimes failing with "code signature invalid" error when jailbreaking a device for the first time [3.0.5 regression]
DISCLAIMER: Dopamine 3.0 - 3.0.6 have had a bug where during jailbreak environment updates, a kernel panic could occur that could leave `/var/jb/basebin/gen/dyld.old` in a corrupted state where it could not be deleted anymore, as a result of this, I do not recommend using this version span and rather recommend using 3.0.7 or higher instead. If you are affected by this issue, jailbreaking with 3.0.7 will automatically resolve this issue.
- **Actually** fix random panics on TXM devices when something tries to load a dynamic trustcache (#893)
- **Actually** enable support for iOS 26.1 beta 1 - 3 (A12/A13)
- Fix possible panics after using the the "Respring" and "Reboot Userspace" buttons in the Dopamine app on iOS >=17
- Properly disable jailbreak button when the device is jailbroken with Dopamine <=2.x or when it was jailbroken with a Dopamine app that had a different app id then the one currently running
EDIT: This build was reuploaded at 11:09 UTC (August 13) to change the bundle identifier back from "com.opa334.FuckYou" to "com.opa334.Dopamine". In case you are curious why this happened: Apple is bullying me by quietly revoking my dev certificate every time I sideload something with "com.opa334.Dopamine". So every time I test Dopamine now, I have to change it to something else, that something else being "com.opa334.FuckYou", unfortunately this time I forgot changing it back before pushing the build and going to sleep.
DISCLAIMER: Dopamine 3.0 - 3.0.6 have had a bug where during jailbreak environment updates, a kernel panic could occur that could leave `/var/jb/basebin/gen/dyld.old` in a corrupted state where it could not be deleted anymore, as a result of this, I do not recommend using this version span and rather recommend using 3.0.7 or higher instead. If you are affected by this issue, jailbreaking with 3.0.7 will automatically resolve this issue.
- Fix missing post exploitation clean up if the jailbreak failed or is being removed
DISCLAIMER: Dopamine 3.0 - 3.0.6 have had a bug where during jailbreak environment updates, a kernel panic could occur that could leave `/var/jb/basebin/gen/dyld.old` in a corrupted state where it could not be deleted anymore, as a result of this, I do not recommend using this version span and rather recommend using 3.0.7 or higher instead. If you are affected by this issue, jailbreaking with 3.0.7 will automatically resolve this issue.
- Fix support for iOS 18.2 to 18.(?) [3.0.2 regression]
DISCLAIMER: Dopamine 3.0 - 3.0.6 have had a bug where during jailbreak environment updates, a kernel panic could occur that could leave `/var/jb/basebin/gen/dyld.old` in a corrupted state where it could not be deleted anymore, as a result of this, I do not recommend using this version span and rather recommend using 3.0.7 or higher instead. If you are affected by this issue, jailbreaking with 3.0.7 will automatically resolve this issue.
- Fix random panics on TXM devices when something tries to load a dynamic trustcache
- Fix non CS_ADHOC libraries not being loadable on TXM devices in certain processes for which fcntl(F_ADDSIGS, ...) is blocked by sandbox (Fixes some tweaks not working)
- Fix binaries and libraries signed with a team id not working on TXM devices
- Fix crashes with some apps that were installed by TrollStore Lite on iOS 17.0 - 17.3.1
- Fix momentarius not working on older iOS versions (by @staturnzz)
- Minor improvements to DarkSword and ClearSword (by @TheRealClarity)
- Fix support for iOS 18.1 beta 4 (A12/A13)
DISCLAIMER: Dopamine 3.0 - 3.0.6 have had a bug where during jailbreak environment updates, a kernel panic could occur that could leave `/var/jb/basebin/gen/dyld.old` in a corrupted state where it could not be deleted anymore, as a result of this, I do not recommend using this version span and rather recommend using 3.0.7 or higher instead. If you are affected by this issue, jailbreaking with 3.0.7 will automatically resolve this issue.
- Fix Titan not working on ARM_LARGE_MEMORY kernels (Mainly M1/M2 iPads)
- Fix XPF being broken on some iOS 15.x versions
- Fix kfd exploits being broken on iOS 16.x
- Fix ClearSword / DarkSword showing up as supported even on devices that do not support them
- In DarkSword / ClearSword workaround message, add notice about A8 possibly requiring multiple attempts
- Enable support for iOS 26.1 beta 1 - 3 (A12/A13)
(All of the issues fixed were regressions from 3.0)
DISCLAIMER: Dopamine 3.0 - 3.0.6 have had a bug where during jailbreak environment updates, a kernel panic could occur that could leave `/var/jb/basebin/gen/dyld.old` in a corrupted state where it could not be deleted anymore, as a result of this, I do not recommend using this version span and rather recommend using 3.0.7 or higher instead. If you are affected by this issue, jailbreaking with 3.0.7 will automatically resolve this issue.
- Add Titan PPL/SPTM bypass by @alfiecg24, introduces support for all devices running 16.5.1 - 17.3.1
- Add momentarius PPL bypass by @staturnzz and @TheRealClarity, introduces support for A12/A13 devices running 16.6 - 18.7.1, 26.0 - 26.0.1
- Add support for SPTM devices up to 27.0 betas in general, can be tested on Corellium devices using the install script at Standalone/Corellium, obviously only works up to 17.3.1 on real devices due to lack of an SPTM bypass on >=17.4
- Add ClearSword exploit by @TheRealClarity, cleaner alternative to DarkSword that seems to have better reliability
- Add workaround for DarkSword/ClearSword not working on A8 iPads, iPad 5, iPad 6 and iPad Pro 9.7" contributed by @sk8ingDuck, involves a respring through a respring method contributed by @wh1te4ever
- Fix various issues with the Dopamine app from the 2.5 Betas, such as settings not saving
- Fix various issues with installing apps via TrollStore Lite on iOS 17.4+
- More secure method of detecting the Dopamine app that jailbroke the device by saving it's id when intially jailbreaking and later comparing against it, should also solve issues when a signing tool renames the .app bundle
NOTES:
- The DarkSword/ClearSword respring workaround may need to be done multiple times on A8
- A jbupdate from an earlier versions will trigger a full reboot by design
DISCLAIMER: Dopamine 3.0 - 3.0.6 have had a bug where during jailbreak environment updates, a kernel panic could occur that could leave `/var/jb/basebin/gen/dyld.old` in a corrupted state where it could not be deleted anymore, as a result of this, I do not recommend using this version span and rather recommend using 3.0.7 or higher instead. If you are affected by this issue, jailbreaking with 3.0.7 will automatically resolve this issue.
- Add support for iOS 16.7.16, 17.0 - 18.7.1 (arm64)
- Fix a logic bug in forkfix [2.4.8 regression]
- This build contains a lot of changes that will affect 15.0 - 16.7.15 too, so there needs to be extensive testing on those versions too so I can be sure there aren't any regressions
Known issues
- DarkSword currently does not support 2GB RAM devices running iOS 17.0 or higher (e.g. iPad 6)
- Zebra crashes on launch on some newer iOS versions due to a missing entitlement, this will be fixed soon
- DarkSword currently does not support A8(X)
- DarkSword currently may not work on A9X
- DarkSword currently may not work on early iOS 16 versions (presumably 16.0 - 16.3.1)
- DarkSword may sometimes fail and make the Dopamine app close
- The version in Dopamine will show as 2.4.99, this is to prevent issues with the in-app updater
- Fix an issue where the jailbreaking process would get stuck on "Patchfinding" on some device / version combinations (seemingly affected early iOS 15 arm64 devices the most) [2.4.6 regression]
- Fix issues with custom boot logos not getting set / not persisting correctly
- Fix an issue where selecting a picture taken with a camera as the custom boot logo would cause it to have the wrong orientation in some cases
- Add the ability to have the device display a boot logo during userspace reboots (By default the background of the selected theme will be used, additionally there is an option to select a custom one)
- Fix the issue that previously broke iOS 15 arm64 support when compiling libjailbreak with compiler optimizations, enable compiler optimizations for libjailbreak again
- Fix a page table alignment bug in `pmap_map_in` that would never be triggered in practice unless a developer called it themselves with addresses not aligned to L2 boundaries
- Several optimizations have been made to make rejailbreaking / userspace rebooting slightly faster
Thanks to @TheRealClarity for looking into some issues with boot logos on landscape iPads.
- Fix an issue where calling dlopen in a fork child would fail (on iOS 15) or crash the process (on iOS 16) (Fixes `perl` crashing when running `apt-file search ` on iOS 16) [2.4 regression]
- Extend library validation bypass to also work when something manually invokes fcntl in the dyld_shared_cache
- Remove stray macho magics from patched dyld, works around issues where third party software (e.g. Frida) would mistake the wrong page to be the start of dyld, causing it to fail in unpredictable ways (Regarding Frida, there is still an issue where it conflicts with the spinlock panic fix, but I don't think there is anything I can do on Dopamines end to fix it, the issue is being tracked [here](https://github.com/frida/frida-core/issues/1137)) (Credits to @tihmstar for helping with debugging)
- Update bootstrap tarball (Better late than never?)
NOTE: Doing an OTA update to this version will reboot your device, requiring a rejailbreak afterwards, this is expected and unavoidable, because Dopamine <=2.3 has a bind mount that cannot possibly be unmounted without panicing the device.
- Add a workaround for spinlock panics on iOS 15 arm64e that fully prevents them in all cases (except one, see below*)
- Make "Hide Jailbreak" fully hide the jailbreak, to the point where it should be undetectable (see notes below)
- Apply sandbox patches before linking, fixes issues when a process directly links against a library inside /var/jb
- Improve and optimize library validation bypass
- Slightly improve forkfix
- Fix/reenable tweak injection into WebContent on iOS 16
- Fix a rare system deadlock during "Initializing Jailbreak"
**CAVEATS WITH "HIDE JAILBREAK":**
- Once you have hidden the jailbreak once since the last userspace reboot, spinlock panics can happen again* if your device is affected by them (iOS 15 arm64e), this is because the spinlock workaround relies on a dyld hook, which has to be disabled to properly hide the jailbreak, there is not much that can be done about this, the only idea I had did not work when I tested it
- When hiding the jailbreak, a few processes, such as apps where tweak injection has been disabled via Choicy, will crash, I was trying to fully fix this by deprecating the /usr/lib bind mount in favor of a namecache based solution, but that caused weird panics on iOS 16 (the code for this has been pushed to the `nofakelib` branch), so unless a fix for those can be found, there is nothing I can do about this
**POTENTIAL CAVEATS WITH JAILBREAK DETECTION:**
- Since Dopamine 2.4 has introduced a dyld hook and also redirects dyld to a different folder via symlink now, it might be slightly more detectable, even while tweak injection for an app is disabled, there is not much that can be done about this, but as explained in the change log, the "Hide Jailbreak" option now works better as a result of these changes
- Stop redirecting all `execve` calls to `posix_spawn`, fixes issues with certain sandbox profiles (e.g. `configd`) that block `posix_spawn` but allow `execve`, fixes WPA2/3 ENTERPRISE networks not working (these issues started in 2.2 but were not a regression, in earlier versions the exec call was not hooked properly which is why this wasn't noticed before)
- Bump default jetsam multiplier back to 3x because apparently people don't read changelogs and that's why we can't have nice things (Most people should still be using 2x, but that's on their own to figure out now...)
- Remove `DYLD_INTERPOSE` in favor of other hooking techniques, since `DYLD_INTERPOSE` was apparently causing memory usage to be much higher than what it should be
- The jetsam multiplier can now be configured inside the Dopamine app, in previous Dopamine versions this was 3x everywhere with no option to configure it, due to the removal of the `DYLD_INTERPOSE`, the default setting has been able to be lowered to 2x
- `NSTask` is now supported everywhere by default, unlike before where it was only supported inside tweak dylibs or when you called `dopamine_fix_NSTask` yourself
- Due to the better hooking techniques, a lot of unnecessary code has been able to be removed
- Fix kcall on iOS 15 arm64 not working from libkrw and iDownload
- Fix `frida-ps -U` panicing the device (To be honest, I have no clue what change actually fixed this, the only thing I know is that it happens in older Dopamine versions and doesn't happen in 2.2 anymore)
- Improve launchd crash reporter in various different ways
