Changelog

Nyxian

• Fix: crashes when importing an unknown project on iOS 27.x. (dc21a10)
• Major redesign for iOS 27.x. (da011ad, 2fde516, 8c18f4d, 25f6830, b2cb36c, a2c0ee9, 4ecc4cd, 9f098fe, cb5fadd, 27e1ed1, f0ffd1d, cb5fadd, fb8e2c7)
• Updated to Swift 6.3.3. (e2d0d7d)
• Exit code logging is now here. (d905ecb, 416edfc, 8955417, 86cb9ca)
• Back to the better icon and name lol. (1307236, a90a264)
• iOS version picker in project settings now adds the slot directly if missing. (92bcf89)
• File name extensions are now shown if they are unknown to the file manager. (70ba270)
• Experimental new userspace reboot button. (2200d96, 03e6761, 562e615, a9b142b, a9fcf42, f3ec620)

LiveProcess

• Vulnerability Patch: UB in snapshotting mechanism. (7f9a6f6)
• Fix: zero *tp_out out before task_for_pid. (f3af94c)
• Fix: return NULL if no main entry in MachO could have been found. (86e2d49)
• Swaps now the CFBundle and releases the main one entirely. (b3270a1)
• Now the main bundle is recognized as loaded and as executable. (3e4ec59, 9075d96, f34b78e)
• Now it hooks dlsym instead of dlopen when redirecting UIApplicationMain. (a464c42)
• Now it will show error on failure loading guest executable. (a8f05fe)

Micro Kernel (ksurface)

• Vulnerability patch: privilege escalation in permission check. (f42ba51)
• Vulnerability patch: DOS in permission check. (c631b9d)
• Vulnerability patch: OOM null ptr deref in radix tree. (a72cf36)
• Vulnerability patch: OOM null ptr deref in radix tree. (5b81cdc) (separate vulnerability yes)
• Vulnerability entry patch: race condition entry due to unchecked initialization of a mutex. (b3a406e)
• Vulnerability patch: Dangling process object crafting via failure path in SYS_handoffep. (83a6408) (found by @semvis123)
• Vulnerability patch: TOCTOU in installd daemon. (32847a5)
• Vulnerability patch: null ptr deref in installd daemon's doWeTrustThatBundle: method. (43b4bec)
• Vulnerability patch: LCMapMachO null ptr derefs. (f4e33cb)
• Vulnerability patch: OOB in entitlement_mach_verify. (369a6c2, 9d40768)
• Vulnerability patch: TOCTOU in LCBootstrap.m. (acdc3f6, 399e5a3, 03095d4, 20e871f, 98f9183, 7474bb1)
• Fix: Reconnection issues with daemons. (df0376d, c1d3949)
• On terminate of PEProcess uses now SIGTERM gives the process time to quit and after an amount of time if exceeded turns into a SIGKILL. (5e3307c)
• Uses now a guarded mach port as the syscall server receive port. (898edc4)

Contributors: @semvis123, @mimalloc

Changelog

emexDE

• better sheet dismissal detection (da744a2)
• updated to swift 6.3.2 (b5f5276, 9c44afb)
• updated to iPhoneOS26.5.sdk (eb30c07)
• rewritten more UI in Swift UIKit (24246c5)
• other UI improvements (8fa8d1d, 942fa70, ee2ad3b, d978293, cece9c7, 512a468)
• fix: weird window server glitches (fa81b3c, d09e052)
• fix: actually present windows on iOS 26 (cece9c7)
• feature: build projects for iOS versions newer than host version(only exporting product) (99a1e9c)
• feature: added cache browsing feature to projects (3b133c7)
• feature: slightly better project creation popup (c6f95d3, 11e5bc7)

Changelog

emexDE

• fixed project GUI (c937bba)
• updated credits (0dcfc06, 439915b, 6229a0d)
• emexDE rebranding (45b2f30, 5573ce8, d464ed1, 56e554f, ed85577, 271633e)
• fixed issues with window state management (012b5d4, 6f97cbb, e11733b, 972cf1c, 9dd1f0e, 9b4e25d)

ksurface (pre-rebrand)

• vulnerability fix: heap buffer overflow in archo Zsign, discovered by @orbisai0security (00975c4)

Thanks to contributions from @orbisai0security, @LucaVmu, @L0tsen and @mimalloc

Changelog

Nyxian

• fix: creating SwiftUI project correctly by generating info.plist key's in SwiftUI interface projects (lol, blame me) (98710fa)

Changelog

Nyxian

• feature: added Swift 6.3.1!!!
• feature: autosaving of files (62f99a7, 4bbcbdb, 0be6e7c, 5e00ece, 17dcc37, 7a85d33)
• feature: added NXOSVersion for better checks (5757f67, 200493d, 03ff0be, d588d6a, f94cf17, 0b10e63)
• feature: added UI Onboarding (e1d50d1)
• fix: calculate keyboard height correctly in code editor (7a0cb6b, 690dd22, 690dd22)
• fix: using LLVM's crash recovery context for safe LLD usage (72fdc00)
• fix: better threading (cbc0033)
• fix: don't force load every file thrown at the CodeEditor (5063e71)
• fix: don't delete the path extension when generating object file paths (72b4d84)
• performance: only reload project's variables once (9575b2b, 7764602)
• feature: take supported deployment targets straight from SDK (9575b2b)
• feature: redesigned project creation experience
• feature: added buttons to clear project and swift module cache (eb0a5f7)

Kernel Virtualization Layer (ksurface)

• vulnerability fix: removed a code signature bypass from inbuilt installd (1cb57a1)
• vulnerability fix: patched a deadlock in SYS_sysctl (16e667a)
• vulnerability fix: patched information disclosure vulnerability from permission over pid check (471e2ee)
• vulnerability fix: patched a race condition in PEProcessManager (memory corruption) (111f566)
• vulnerability fix: patched a resource exhaustion vector regarding FBProcessManager (5b08d63)
• vulnerability fix: added forgotten cleanup path in PEProcess (a0cdd40)
• vulnerability fix: patched a use-after-free caused by a reference underflow (b6e1011)
• vulnerability fix: patched a lenient memory corruption vulnerability (845fa60)
• vulnerability fix: patched a use-after-free in kvobject allocation API (1fe578d)
• vulnerability fix: patched a memory leak in process list API (09c423c)
• vulnerability fix: handling EAGAIN on rdlock's (e592fc0)
• vulnerability fix: patched buffer overflow in SYS_handoffep found by @zipgod24 (ebd6c28)
• vulnerability fix: patched use-after-free in proc_zombify(1) found by @zipgod24 (4337d89)
• vulnerability fix: patched a severe buffer over-read leading to information disclosure (ef6fb7c)
• vulnerability fix: patched ksurface termination vulnerability (1deeccb)
• vulnerability fix: patched a OOB vulnerability in ZSign by @orbisai0security (c878655)
• feature: using FBProcess for process state change handling (9d00fb1)
• performance: faster MachOObject (f37c7c6, cc0ac37, 5097f01, c4612ce, b03e161)
• performance: faster write in and out in FDObject (4d42ed5)
• performance: slightly faster PEProcessManager (fbc9911)
• performance: using faster NSExtension invocation method (b1dd4d7, 61e3c1d, 21939af)
• performance: removed redundant delay in PELaunchService (6731ed7)
• performance: made object allocation slightly faster (f325e0c)
• hardening: removed PEEntitlementProcessElevate from some presets (6a33561)
• fix: disabled darwinbg simulation cuz apple might just freeze parts of iOS for what ever reason (ae26edb)

Changelog

Nyxian

• Theming patches (1cc4c63)
• fixed objc utility generation (bff7e4d)
• fixed window handling on iPhone (ded2d5c)
• rethought application install (c87a607, dc5cb03, 1ee59d1, c205dc2, be12d71, b229747, f35d83b, 7d04700, 2aeb138, 7ee7cbe, 6cda7de, f73b0bd)
• fixed write access in SDK paths in file manager (ad2450e)
• fixed issue navigator on iPhone (e75c170)
• patched DOS in zip extraction (695e37e)
• corrected some appearance issues with GUI project configurator (a3b22fa, fb619f5, 6e6471a, c57ef22)
• improved dependency scan performance (d5f9fe7)
• fixed window double close bug on iPadOS (344524e)

Kernel Virtualization Layer (ksurface)

• Improved entitlement patching to Applications menu (8cb891d, 8e16df8, e4efbcf)
• PEObject patches (a20eae5)
• Radix tree patches (ddfce45)
• Vulnerability fix: unexpected system termination due to null ptr deref (d9d2c93)
• Vulnerability fix: improper cleanup path in tty initialization leading to a use-after-free (6ce3648)
• Vulnerability fix: improper action order in tty deinitilization leading to a race condition (8ae5e4d)
• Resource leak fix: resource exhaustion due to improper cleanup (c5b1004)
• Improvement: added PEEntitlementPlatformRoot (926a259, 1d53664, 3226ee6)
• Improvement: better trust and entitlement code (9c1cf66, 766434a, b5fe797)
• Security hardening: nerfing capability of root user process to automatically be able to enumerate processes (ad4a9e6)
• Bug fix: use correct path for the CFPrefsPlistSource hook (990bc47)

nxtool (resign trollstore apps on macOS to nyxian apps, basically embed nyxian entitlements into ipa's)

• initial release

Changelog

Nyxian

• Improved logic in Issue Navigator (d3e8522)
• Added GUI project configuration (d1fe1f2, a7e9da2, d98b16b, c784014, c120fb8)
• Updated SDK to iPhoneOS26.4 (751e2f1)
• Bug fix: fixed barbutton items not theming on iOS 26 (47eb2a8, e026fc3)
• Bug fix: touch inputs not getting delivered to NXTerminalWindowSession properly (62aa2f6)
• Bug fix: window focus refix (4f4cc1a)
• WindowServer v4 introduction
• Added "Jump to definition" in code editor (026ec8d, 5500bc9, 5384079, b98f2f2)
• Using LLVM's dependency scanner for better accuracy for incremental builds (fdb4d5a)
• Other minor optimizations

Ksurface

• Syscall server improvements (better performance) (4d5d37f, 3a55079, 2ba098c)
• Fixed vulnerability: critical type size mismatch of PEEntitlement (7d7ae3e)
• Fixed vulnerability: null pointer dereference in SYS_handoffep (72220c4)
• Fixed vulnerability: missing break label in SYS_ioctl (d1a0e2c)
• Fixed vulnerability: semantical mismatch of syscalls sys_task_ (58f51c5)
• Fixed vulnerability: memory corruption in proc_copy_for_proc(2) (95fbe14) (already replaced API with kvobject(stands for kernel virtualized object))
• Fixed vulnerability: dangling mach port reference created by SYS_gettask (6432e95, c0b69f1)
• Fixed vulnerability: DOS in SYS_gettask (d6ab609)
• Fixed vulnerability: object leak on ENOSYS path in syscall server (259a39f)
• Fixed vulnerability: null pointer deref may happen in proc list api (4dc1e69)
• Fixed vulnerability: flavour confusion in proc list api (25cec7c)
• Fixed vulnerability: race condition in SYS_procpath (af259e2)
• Fixed vulnerability: privilege escalation in SYS_gettask (2dfc66e)
• Fixed vulnerability: race condition in proc copy api (33cc1b5) (already replaced API with kvobject(stands for kernel virtualized object))
• Fixed vulnerability: missing unlock path of proc table in proc api (7e349d5)
• Fixed vulnerability: use-after-free in proc lookup api (cffd6a3)
• Fixed vulnerability: privilege escalation in proc_permitive_over_pid(5) (f373680, c392b2a)
• Fixed resource leak: file descriptor leak in SYS_signexec (d1a0e2c)
• Fixed resource leak: mach ports leak in syscall server (21e762c)
• Fixed resource leak: entire mach messages of syscall server (67871da, 7ae16ad)
• Bug fix: fixing the iOS 26.4+ crash (4b21e76, 565ed89)
• Bug fix: utility home paths incorrectly being set (407ace1)
• Feature: SYS_wait4 fix (9a0b0a4, ffb91ba, e966e06, 8fae3f1)
• Feature: better panic system (for debug only) (b80dfc8)
• Feature: tty support(no forkpty yet) (edb70ed, 8d4466e, 07eba8c, de3c5cf, 8d89c99, 5ed7894, 6c83b81, 1081cd5, 3af601a, 706796a, 58fe7df, fa052ef, 1cf242b, 1cf242b, 6959604)
• Feature: SYS_setent syscalls to drop entitlements (b7d96f8, a514fb8)
• Feature: new cryptographic code signing (507e828)
• Feature: process zombification (19e831c)
• Improvement: better ksurface init (b8d76de)
• Improvement: validating entitlements now on host side and replaced ksurfaced with containerd (3cee766)
• Improvement: Daemon crashes wont cause deadlocks anymore (f69d208, d4abbf1)
• Improvement: Added brand new kernel object api aka kvobject (29addf5, 5cddfe1, b750644, 0cd2d56, d70151a, f458091, 4ee265d, ca735b8, 09b45f2, eeef5fe, 632fc87, 673ce9e, 47c3ae0, 21b98d9, ebbaac7, e309858, 94c907a, ecf0c29, 5054f98, b5f5c14, c3a6a76, cf08598)
• Improvement: Now tfp works on all iOS versions (b6c9ee6, 4e9f0d1, aa54ed9, d9224e3, fcfbc61, 7f3d93a, 4f4affe, ffeb5da, c44c087, 5c74874, c0bede5, f989152, b1b47fa, 7062e71, 4ebf18b, a5398d5)
• Improvement: stripped and improved inefficient LC source code (25632e9, 261782b, 3987fb8, 5eb7835, d0af2c3, d0af2c3, 6c1b83c, 2822f87, ce1933e, 97be455, c3a2d78)
• Improvement: now the user is warned that the NSExtension is missing if it is missing (10aae93)
• Improvement: added task name support to SYS_gettask (11190af)
• Improvement: removed restrictions from DYLD_INSERT_LIBRARIES (3a32304)
• Improvement: introducing syscall server v3 with userspace ptr support (dbf7248)
• Improvement: introducing 64bit radix trees (2d78377)
• Improvement: replaced the fork() fix with the new vfork() fix (96cbd0f)
• Improvement: better process flag state management (ac4c8a0, 8fd6bef)
• Improvement: replaced 2000 branches with memcpy for CFBundle override (aaf5c50, 83d9356, 714b57f, b08963c)
• Improvement: now exit sets the exit of the process in ksurface (edeb207, be53319)
• Improvement: correctly overriding NSProcessInfo (a114284, 8d9d591, 8d9d591)
• Improvement: hookless posix spawn file actions fix (86cf307, 278465b, f9af413)
• Improvement: forkbomb halfway fixed? (3a9eadd)
• Improvement: fixed crash of process when they append a file descriptor to FDMapObject (328a45b, c0eca4b, 670753d)
• Improvement: return with errno in posix spawn api (814d45c)
• Security hardening: stripping entitlements regardless of platformization (58d5acb)
• Security hardening: removed potential DDOS vector and validated task port flavor in proc_task_for_proc(3) (bf475d4)
• Security hardening...

Changelog

Normal Changelogs will continue after 0.9.0 final beta release in 2 days.

Full Changelog: 0.8.6...0.9.0.PREVIEW.1

Changelog

Jailed

Nyxian

• improved KernelLogViewController (60d74e5, d571453)
• fixed utility compilation failing due to missing flags on lower iOS versions (a9cb50e)
• fixed utility development (eeb9a1c, 8b04ef4, f7b8f23, 7090741)
• added undo and redo button to CodeEditor (51bf255, a0987c1, 08acab8)
• fixed iOS 14 appearance issues (942a861, 025b4c1)
• improved keyboard tab button with indentation features (e33ade5, 6199989)
• fixed LDEWindow focusing on iPadOS (54a3efc, 8e21e1a)
• reduced jitter of XCodeButton animations (6233eeb)

LiveContainer

• fixed a bug where the bundle was kept LiveProcess, instead of overwritten with the value expected (78debea)
• overwrites now _CFGetProcessPath too (3307c66)
• fixed home path for utilities (105968a, a7497f9)
• fixed DYLD_INSERT_LIBRARIES (9f6c1b7)

Jailbroken

Nyxian

• initial release

Changelog

Jailed

Nyxian

• fixed many objc object leaks (213308c, 1f62e02, c84a64d, 1e589de)
• fixed many issues with utility development (f2f06fc, 314f814, af34bd4, 648cadc)
• fixed some iOS panic issues(iommu panic) with utility development (8747b8e)
• fixed nyxian installation on many sideloading services (cf31de8)