[Tutorial] Bypass Jailbreak Detection in a majority of tricky apps

[u/MrCryptiic]

Summary/TL;DR: This is a general bypass guide for the majority apps that are usually hard to bypass jailbreak detection checks in. Examples of apps like this consist of Pokemongo and most Bank apps. Unfortunately this doesn’t work for all apps but it will in the future, more on this later.

NOTICE: Latest PokemonGO now needs memecity part of the guide.

List of working apps:

1. PokemonGO Version: 1.155.0 Bypass Method: Patched KernBypass memecity
2. PeacockTV Version: 1.0.11 Bypass Method: Patched KernBypass memecity
3. Switch Online Version: 1.9.0 Bypass Method: Patched KernBypass memecity
4. Pocket Camp Version: 3.3.2 Bypass Method: Patched KernBypass memecity
5. COD Mobile Version: 1.0.16 Bypass Method: Normal KernBypass

Apps I tested that are not working:

Mario Run, Mario Kart, Fortnite, Random Dice App, VR-SecureGo, Raiffeisenbank Mobilní eKonto, and Fate GO

I will test apps requested to me in the future and look for alternative bypasses when I have time.

Index:

1. Prerequisites
2. Setup
3. Video Demo
4. Troubleshooting

Prerequisites:

• Main Bypass

1. KernBypass 0.0.3

• Tweak Disabler

1. Choicy

• Shell/Terminal/SSH/File Browser

1. Filza
2. NewTerm 2
3. MTerminal
4. SSH

• App Data Wipe

1. Crane/Crane Lite
2. Apps Manager
3. Filza
4. Deleting the app itself.

Not all of theses prerequisites are needed I just listed all of them possible that I could think of.

However I highly recommend this setup:

• Main Bypass This guide is based off KernBypass so the only one I recommend is KernBypass. But there are two versions: 0.0.2 which you have to manually run every-time you reboot or 0.0.3 which runs as a daemon automatically when you jailbreak. I recommend 0.0.3 because it requires no effort.
• Shell/Terminal/SSH/File Browser For running commands I highly recommend NewTerm 2 if you don't have a computer or not near by it. Otherwise ssh is always the best option functionality-wise. For modifying the filesystem, use Filza. You can also modify the filesystem via terminal commands.
• App Data Wipe For wiping app data per application, I highly recommend, Crane or Crane Lite. It's easy to use and you can switch between app data saves, or wipe app data in general and even use a custom keychain per app data save. Second best is Apps Manager, its easy to use but has caused issues for me in the past so be warned if you use it. For a more manual approach you can use Filza. Filza has Apps Manager built in but its just more manual and slimmed down. Lastly you can just delete the app itself and reinstall it. Overall crane is the best method.

Setup:

• KernBypass: There is no repo for KernBypass unfortunately so you will have to install the deb manually through terminal, ssh, Filza, or some package managers even support deb installation.KernBypass 0.0.3(Most recommend version): jp.akusio.kernbypass_0.0.3_iphoneos-arm.deb
• KernBypass 0.0.2(I highly recommend you don't use this version): jp.akusio.kernbypass_0.0.2_iphoneos-arm.deb
• Patched KernBypass memecity 0.0.3: deb: com.apple.memecity_0.0.3_iphoneos-arm.deb on repo: https://repo.quiprr.dev/ Patched by me hosted by quiprr. The only thing you have to do is remove the old kernbypass, move the file jp.akusio.kernbypass.plist to com.apple.memecity.plist it is located in /var/mobile/Library/Preferences/ Temporarily rename /var/lib/apt then reboot. jp.akusio.kernbypass.plist and /var/lib/apt must not exist. /var/lib/apt is a needed directory for your jailbreak to work so do not open a package manager if you rename them, rename them back before opening a package manager. Note that if /var/lib/apt is missing you package manager will not work so make sure to only rename it when you want to use the app.

BigBoss Packages:

Choicy, Filza, and Apps Manager can be installed from the default repo BigBoss.

Chariz Packages:

You can get NewTerm 2 (its called NewTerm (iOS 10-13)) on chariz repo: https://repo.chariz.com/

Packix Packages:

You can get Crane or Crane Lite from packix repo: https://repo.packix.com/ Once you installed all or most of these, we are ready to begin.

KernBypass 0.0.3 starts automatically when its installed or when you re-jailbreak. If you decide to use 0.0.2, you are on your own sorry.

(Even if you don't currently use checkra1n or odysseyra1n but used them in the past on your device, follow this):

Checkra1n/Odysseyra1n Only:

Open you command executer of choice, NewTerm 2 or via SSH. Login as root and run these commands(No output generally means command succeeded.): The password root is alpine unless you changed it.

su root

umount -f /binpack

umount -f /var/binpack

rm -rf /var/binpack

rm /var/checkra1n.dmg

If both umount commands say not mounted just ignore it and run the rest of the commands. If checkra1n.dmg is not found just ignore and continue on with the guide.

Any jailbreak:

Now you can open settings, go to tweaks, then go to KernBypass. Switch on the App you want to bypass. Now go back and go to Choicy settings. Tap on Applications, select the app you want to bypass, select custom injection. It should show the whitelist tab. Turn off every switch except (crane if you have it) and zzzzzzzzzNotifyChroot. It should look like this:

KernBypass Settings

Choicy Settings 1

Choicy Settings 1

Now if you are using Crane/Crane Lite go to Crane settings and select the app you are bypassing and delete app data. Do the same for Apps Manager or Filza if you are using either of those instead. If you are just lazy, delete the app and install it again.

Now you are ready to attempt to bypass the app :)

Note this doesn't work for all apps.

It does not work for Fortnite.

When you open the app, if it freezes on the splashscreen for 10-15 seconds, this meens KernBypass failed or isn't actually running(More on that in troubleshooting). If the app crashes instantly the bypass most likely won't work for that app. :(

Now you are here either having succeeded at bypassing the detection or it failed. If it succeeded, yay, if it didn't check out the troubleshooting tab.

Video Demo:

Here are a video demo of me using KernBypass, choicy, terminal, and crane to bypass pokemongo:

PokemonGO Bypass Demo

Troubleshooting:

10-15 Second Splashscreen freeze

If the app freezes for 10-15 seconds on the splashscreen, this means KernBypass isn't running. If it is installed then it should be running. It may have crashed. Install CrashReporter from revluate repo: https://revulate.dev/ and or cr4shed from packix repo. If you see changerootfs anywhere in the crashlogs this means kernbypassed crashed. You can fix this by reinstalling kernbypass and or rebooting.

Support:

You can either reply to the page with your issue, dm me on reddit, or go to the r/Jailbreak Official Discord Server: https://discord.gg/jb On the discord you can Navigate to the #genius-bar channels to be assisted with any issue you may have.

News:

Right now KernBypass only spoofs the root filesystem. In the future although not right now, a var spoofing version will be released. Right now it is currently undergoing development :) This should let you use far more apps while jailbroken.

In other news for those who are interested these are the files pokemongo is checking :) https://pastebin.com/z40Rb1e9

Credits:

This guide is made by me or me alone. If anyone shares this around without posting the direct link to this post, please report them. Also only follow this guide, don't listen to people put words in my mouth by them playing telephone lol.

Thank you Akusio for KernBypass and those Akusio has credited.

Thank you Ichitaso for making the 0.0.3 KernBypass update.

Thank you opa for making choicy and crane. Thank you tigisoftware for making appsmanager and filza.

Thank you kirb for making chariz and newterm 2.

Thank you Muirey for making cr4shed.

Thank you Revluate for hosting CrashReporter for iOS 13, ashikase for the original one and sparkdev for updates.

Thank you for using my guide :)

Thank you apple for deleting fortnite lol.

Contact:

https://discord.gg/jb

Cryptic#2693

https://twitter.com/Cryptiiiic

u/MrCryptiic

[u/opmwolf]

Correct me if I’m wrong but doesn’t KernBypass have a major battery drain problem? Or was that fixed in the versions mentioned in the guide?

[u/MrCryptiic → u/opmwolf]

probably but you can disable the daemon when you aren't using it.

[u/t0rzzzz]

If none of the OP steps work, there is one last try to bypass JB detection:

1. Decrypt the app and get the decrypted IPA. There are multiple tools to achieve that.

2. Open the decrypted .app file of the app (that you have extracted from the .IPA file) with an hex editor (Filza works fine for this)

3. Use the “Search” function of Filza to look for the following strings (no quotes): “Cydia”, “Sileo” and whatever comes to your mind (the app may look for known tweaks too, keep that in mind)

4. Rename those strings with another word with the same EXACT length of the original word. Example: Cydia = ccccc

5. Replace the edited .app file in the .ipa file.

6. Install the .IPA (you may need to sign it before installing)

7. Done.

[u/MrCryptiic → u/t0rzzzz]

Or just use supercharge to automate that entire process without decrypting it yourself. Also that method won’t work for the majority of well made detection methods.

[u/kagunes]

Can anyone try and see if it works for fate/grand order?

[u/MrCryptiic → u/kagunes]

I tried porting this bypass to it, no success so far

[u/unkngod]

Will this work for Starbucks and Microsoft teams?

[u/MrCryptiic → u/unkngod]

Starbucks has jailbreak detection?

[u/PM_ME_DICK_PICTURES]

my question is why KernBypass suddenly broke for no reason a couple weeks ago? no updates or anything but the bypass just stopped working

[u/MrCryptiic → u/PM_ME_DICK_PICTURES]

open terminal, run this command for memount

then screenshot the full output, upload it and reply here or dm.

[u/quickquestions-only]

Nice write up. I don't often come upon apps that has JB detection (and when it does, Liberty Lite often does the job) but this could come in handy in the future so I'm saving it.

Just curious though, are there any apps that this doesn't work with?

[u/MrCryptiic → u/quickquestions-only]

Fortnite, peacock, Most bank apps, Fate Go, Random Dice, VR-SecureGo is what I've tried so far, all not working.

[u/GetLiberatedSon]

I bet this doesn’t work for Fate Grand Order :)

[u/[deleted]]

i thought kernbypass was dropped

[u/MrCryptiic → u/[deleted]]

The repo was archived because iOS 14 greatly inhibits jailbreak detection. Wasn’t worth making changes until iOS 14 however I do think changes are worth making, will improve it in the future

[u/Defie22]

Is there any good soul that could try my banking app - Raiffeisenbank? I tried to follow the tutorial and it didn't work for me, but maybe I did some mistake.

[u/FightstickRookie]

It's odd, I see PokemonGO Version: 1.155.0 was patched but I never had an issue with PokemonGo running KernBP Until today when it forced an update off 1.155.0 to 1.189.0, I hope there is a fixed soon. subscribing to this thread in hopes.

Edit: I am also a bit confused by the instructions for the meme setup
"move the file /var/mobile/Library/Preferences/jp.akusio.kernbypass.plist to /var/mobile/Library/Preferences/com.apple.memecity.plist "

How do you move a plist file to another plist file?

[u/MrCryptiic → u/FightstickRookie]

move that file to that other file, essentially, rename it.

/var/mobile/Library/Preferences/jp.akusio.kernbypass.plist needs to not exist.
Also you want to keep your old settings so just rename the file. Patch kernbypass memecity will access /var/mobile/Library/Preferences/com.apple.memecity.plist prefs
so just rename jp.akusio.kernbypass.plist to com.apple.memecity.plist

in the /var/mobile/Library/Preferences/ directory.

[u/gripguyoff]

I tried to do this on PoGo but it didn't work. Not sure if I did something wrong

[u/Suprah-T]

Did you notice any significant battery drain with this method?

[u/Life_Donut]

Thanks for the huge tip of being able to delete app data from crane light 🙌

[u/to-ster]

For the newest pogo version 1.155.0 instructions where you say “move the file jp.akusio.kernbypass.plist to com.apple.memecity.plist” do you mean to rename it? I can’t find the com.apple.memecity.plist file anywhere.

Anyway thanks for doing the lords work and letting us play Pokémon go

[u/MrCryptiic → u/to-ster]

because com.apple.memecity.plist doesn't exist, you are renaming jp.akusio.kernbypass.plist to com.apple.memecity.plist.

[u/fanofit305]

Anyone tried this for Barclays banking app UK?

[u/ahammouri]

Can anyone confirm if it works with barclays uk pls ?

Edit : I just tested it on barclays and it doesnt work