[AltServer] Supports enabling JIT on devices running iOS 17

AltServer embeds the AltJIT CLI tool in its app bundle and runs it as an admin subprocess.

AltServer/Extensions/Logger+AltServer.swift

@@ -0,0 +1,16 @@
+//
+//  Logger+AltServer.swift
+//  AltStore
+//
+//  Created by Riley Testut on 9/6/23.
+//  Copyright © 2023 Riley Testut. All rights reserved.
+//
+
+import OSLog
+
+extension Logger
+{
+    static let altserverSubsystem = Bundle.main.bundleIdentifier!
+    
+    static let main = Logger(subsystem: altserverSubsystem, category: "AltServer")
+}

AltServer/Extensions/Process+STPrivilegedTask.swift

@@ -0,0 +1,71 @@
+//
+//  Process+STPrivilegedTask.swift
+//  AltServer
+//
+//  Created by Riley Testut on 8/22/23.
+//  Copyright © 2023 Riley Testut. All rights reserved.
+//
+
+import Foundation
+import Security
+import OSLog
+
+import STPrivilegedTask
+
+extension Process
+{
+    class func runAsAdmin(_ program: String, arguments: [String], authorization: AuthorizationRef? = nil) throws -> AuthorizationRef?
+    {
+        var launchPath = "/usr/bin/" + program
+        if !FileManager.default.fileExists(atPath: launchPath)
+        {
+            launchPath = "/bin/" + program
+        }
+        
+        if !FileManager.default.fileExists(atPath: launchPath)
+        {
+            launchPath = program
+        }
+        
+        Logger.main.info("Launching admin process: \(launchPath, privacy: .public)")
+        
+        let task = STPrivilegedTask()
+        task.launchPath = launchPath
+        task.arguments = arguments
+        task.freeAuthorizationWhenDone = false
+        
+        let errorCode: OSStatus
+        
+        if let authorization = authorization
+        {
+            errorCode = task.launch(withAuthorization: authorization)
+        }
+        else
+        {
+            errorCode = task.launch()
+        }
+        
+        let executableURL = URL(fileURLWithPath: launchPath)
+        guard errorCode == 0 else { throw ProcessError.failed(executableURL: executableURL, exitCode: errorCode, output: nil) }
+        
+        task.waitUntilExit()
+        
+        Logger.main.info("Admin process \(launchPath, privacy: .public) terminated with exit code \(task.terminationStatus, privacy: .public).")
+        
+        guard task.terminationStatus == 0 else {
+            let executableURL = URL(fileURLWithPath: launchPath)
+            
+            let outputData = task.outputFileHandle.readDataToEndOfFile()
+            if let outputString = String(data: outputData, encoding: .utf8), !outputString.isEmpty
+            {
+                throw ProcessError.failed(executableURL: executableURL, exitCode: task.terminationStatus, output: outputString)
+            }
+            else
+            {
+                throw ProcessError.failed(executableURL: executableURL, exitCode: task.terminationStatus, output: nil)
+            }
+        }
+        
+        return task.authorization
+    }
+}

AltServer/JIT/JITManager.swift

@@ -0,0 +1,153 @@
+//
+//  JITManager.swift
+//  AltServer
+//
+//  Created by Riley Testut on 8/30/23.
+//  Copyright © 2023 Riley Testut. All rights reserved.
+//
+
+import RegexBuilder
+
+import AltSign
+
+private extension URL
+{
+    static let python3 = URL(fileURLWithPath: "/usr/bin/python3")
+    static let altjit = Bundle.main.executableURL!.deletingLastPathComponent().appendingPathComponent("altjit")
+}
+
+class JITManager
+{
+    static let shared = JITManager()
+        
+    private let diskManager = DeveloperDiskManager()
+    
+    private var authorization: AuthorizationRef?
+    
+    private init()
+    {
+    }
+    
+    func prepare(_ device: ALTDevice) async throws
+    {
+        let isMounted = try await ALTDeviceManager.shared.isDeveloperDiskImageMounted(for: device)
+        guard !isMounted else { return }
+        
+        if #available(macOS 13, *), device.osVersion.majorVersion >= 17
+        {
+            // iOS 17+
+            try await self.installPersonalizedDeveloperDisk(onto: device)
+        }
+        else
+        {
+            try await self.installDeveloperDisk(onto: device)
+        }
+    }
+    
+    func enableUnsignedCodeExecution(process: AppProcess, device: ALTDevice) async throws
+    {
+        try await self.prepare(device)
+        
+        if #available(macOS 13, *), device.osVersion.majorVersion >= 17
+        {
+            // iOS 17+
+            try await self.enableModernUnsignedCodeExecution(process: process, device: device)
+        }
+        else
+        {
+            try await self.enableLegacyUnsignedCodeExecution(process: process, device: device)
+        }
+    }
+}
+
+private extension JITManager
+{
+    func installDeveloperDisk(onto device: ALTDevice) async throws
+    {
+        try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<Void, Error>) in
+            self.diskManager.downloadDeveloperDisk(for: device) { (result) in
+                switch result
+                {
+                case .failure(let error): continuation.resume(throwing: error)
+                case .success((let diskFileURL, let signatureFileURL)):
+                    ALTDeviceManager.shared.installDeveloperDiskImage(at: diskFileURL, signatureURL: signatureFileURL, to: device) { (success, error) in
+                        switch Result(success, error)
+                        {
+                        case .failure(let error as ALTServerError) where error.code == .incompatibleDeveloperDisk:
+                            self.diskManager.setDeveloperDiskCompatible(false, with: device)
+                            continuation.resume(throwing: error)
+                            
+                        case .failure(let error):
+                            // Don't mark developer disk as incompatible because it probably failed for a different reason.
+                            continuation.resume(throwing: error)
+                            
+                        case .success:
+                            self.diskManager.setDeveloperDiskCompatible(true, with: device)
+                            continuation.resume()
+                        }
+                    }
+                }
+            }
+        }
+    }
+    
+    func enableLegacyUnsignedCodeExecution(process: AppProcess, device: ALTDevice) async throws
+    {
+        let connection = try await ALTDeviceManager.shared.startDebugConnection(to: device)
+        
+        switch process
+        {
+        case .name(let name): try await connection.enableUnsignedCodeExecutionForProcess(withName: name)
+        case .pid(let pid): try await connection.enableUnsignedCodeExecutionForProcess(withID: pid)
+        }
+    }
+}
+
+@available(macOS 13, *)
+private extension JITManager
+{
+    func installPersonalizedDeveloperDisk(onto device: ALTDevice) async throws
+    {
+        _ = try await Process.launchAndWait(.altjit, arguments: ["mount", "--udid", device.identifier])
+    }
+    
+    func enableModernUnsignedCodeExecution(process: AppProcess, device: ALTDevice) async throws
+    {
+        do
+        {
+            if self.authorization == nil
+            {
+                // runAsAdmin() only returns authorization if the process completes successfully,
+                // so we request authorization for a command that can't fail, then re-use it for the failable command below.
+                self.authorization = try Process.runAsAdmin("echo", arguments: ["altstore"], authorization: self.authorization)
+            }
+            
+            var arguments = ["enable"]
+            switch process
+            {
+            case .name(let name): arguments.append(name)
+            case .pid(let pid): arguments.append(String(pid))
+            }
+            arguments += ["--udid", device.identifier]
+            
+            self.authorization = try Process.runAsAdmin(URL.altjit.path, arguments: arguments, authorization: self.authorization)
+        }
+        catch let error as ProcessError where error.code == .failed
+        {
+            let regex = Regex {
+                "No module named"
+                
+                OneOrMore(.whitespace)
+                
+                Capture {
+                    OneOrMore(.anyNonNewline)
+                }
+            }
+            
+            guard let output = error.output, let match = output.firstMatch(of: regex) else { throw error }
+            
+            let dependency = String(match.1)
+            throw JITError.dependencyNotFound(dependency)
+        }
+    }
+}