|
This project is archived. The code was originally written in February 2025
and is kept here for reference / research purposes only.
In‑app dylib injection with CoreTrust bypass and opainject.
Titanium lets you pick a target process, optionally choose a custom .dylib, re‑sign it with a CoreTrust bypass, and inject it into the process on‑device.
Expected to work on iOS versions supported by TrollStore (roughly iOS 14.0 – 17.0) when running with appropriate platform entitlements.
- Uses Theos.
- Clone the repo and run:
make package- Resulting Titanium.tipa will be placed in packages/.
PRs and improvements are welcome.
- Device: iPhone 11 Pro (arm64e)
- Targets: Multiple stock App Store apps
- Notes: Injection tested on real App Store-signed binaries, running on-device via TrollStore with appropriate entitlements.
- CoreTrust bypass and signing flow based on fastPathSign.
- ROP‑based injection built around opainject.
- Upstream components retain their original licenses.
- Various ideas inspired by the iOS jailbreak / TrollStore community.
- Special thanks to rain for the idea of moving the dylib into the
Applicationfolder.
Also tagging this troublemaker because he insisted 😏 He cracks good jokes, so he’s here - nkhmelni
See LICENSE.