[GH-ISSUE #110] JIT-less vs JIT enabled #97

New issue

Closed

opened 2026-03-03 15:30:30 +03:00 by kerem · 4 comments

kerem commented

2026-03-03 15:30:30 +03:00

Owner

Originally created by @corysus on GitHub (Aug 6, 2024).
Original GitHub issue: https://github.com/LiveContainer/LiveContainer/issues/110

Describe the issue

First, I want to thank you for the amazing project that you and your team have made. This is something that the community needed, because the limit of 3 apps for sideloading on overpriced devices that we buy is very frustrating and unfair.

I have set up LC with JIT-less and it works very well. Now, if I understand correctly, when we use JIT-less, it reuses the certs and mobileprovision that we get from Apple, and in this case, we sign the app with limited entitlements. But if we use JIT-enabled, then we don't need to use certs to sign the app, and in that case, the app uses the entitlements that are present inside the app? If this is true, can we in that case use ldid/zsign or any other sign tool to put any entitlements that we need along with any dylib we want?

Thank you.

Instructions to reproduce

—

What version of LiveContainer are you using?

Version 2.0-release (main/6f954a1)

Other

No response

Originally created by @corysus on GitHub (Aug 6, 2024). Original GitHub issue: https://github.com/LiveContainer/LiveContainer/issues/110 ### Describe the issue First, I want to thank you for the amazing project that you and your team have made. This is something that the community needed, because the limit of 3 apps for sideloading on overpriced devices that we buy is very frustrating and unfair. I have set up LC with JIT-less and it works very well. Now, if I understand correctly, when we use JIT-less, it reuses the certs and mobileprovision that we get from Apple, and in this case, we sign the app with limited entitlements. But if we use JIT-enabled, then we don't need to use certs to sign the app, and in that case, the app uses the entitlements that are present inside the app? If this is true, can we in that case use `ldid/zsign` or any other sign tool to put any entitlements that we need along with any `dylib` we want? Thank you. ### Instructions to reproduce — ### What version of LiveContainer are you using? Version 2.0-release (main/6f954a1) ### Other _No response_

kerem

2026-03-03 15:30:30 +03:00

closed this issue
added the
compatibility
label

kerem commented

2026-03-03 15:30:31 +03:00

Author

Owner

@khanhduytran0 commented on GitHub (Aug 7, 2024):

Unfortunately, it doesn’t work like that. Apple security is no joke. If you were able to use any entitlements with JIT only (including those that unsandbox, wait, is 17.0 TrollStore installation method right here?), it would be considered a security vulnerability and Apple would patch it immediately.
JIT mode just bypasses the code signature by dynamically loading unsigned executable pages only, it does not bypass AMFI/CoreTrust.

@khanhduytran0 commented on GitHub (Aug 7, 2024): Unfortunately, it doesn’t work like that. Apple security is no joke. If you were able to use any entitlements with JIT only (including those that unsandbox, *wait, is 17.0 TrollStore installation method right here?*), it would be considered a security vulnerability and Apple would patch it immediately. JIT mode just bypasses the code signature by dynamically loading unsigned executable pages only, it does not bypass AMFI/CoreTrust.

kerem commented

2026-03-03 15:30:32 +03:00

Author

Owner

@khanhduytran0 commented on GitHub (Aug 7, 2024):

To elaborate further, LiveContainer converts the main executable to a dynamic library (.dylib) before it could be loaded using a regular dlopen() call. Even if you managed to load an unpatched executable, it would not work either. AMFI only loads entitlements from the real main executable.

@khanhduytran0 commented on GitHub (Aug 7, 2024): To elaborate further, LiveContainer converts the main executable to a dynamic library (`.dylib`) before it could be loaded using a regular `dlopen()` call. Even if you managed to load an unpatched executable, it would not work either. AMFI only loads entitlements from the real main executable.

kerem commented

2026-03-03 15:30:32 +03:00

Author

Owner

@corysus commented on GitHub (Aug 7, 2024):

Ok, thank you for the detailed explanation.

@corysus commented on GitHub (Aug 7, 2024): Ok, thank you for the detailed explanation.

kerem commented

2026-03-03 15:30:32 +03:00

Author

Owner

@Johnzx07 commented on GitHub (Feb 5, 2025):