diff --git a/VI. AMFI/python/CrimsonUroboros.py b/VI. AMFI/python/CrimsonUroboros.py index 20c91e4..879b92b 100755 --- a/VI. AMFI/python/CrimsonUroboros.py +++ b/VI. AMFI/python/CrimsonUroboros.py @@ -2253,15 +2253,29 @@ class SnakeVI(SnakeV): def printStickyBit(self): print(f'STICKY: {self.hasStickyBit()}') + def hasAllowDEV(self, file_path): + ''' + Checks if the binary has com.apple.security.cs.allow-dyld-environment-variables. + This allow for Dyld Environment Variables. + ''' + if self.checkIfEntitlementIsUsed('com.apple.security.cs.allow-dyld-environment-variables', 'true', file_path): + return True + + return False + def checkDyldInsertLibraries(self): ''' Check if binary is vulnerable to code injection using DYLD_INSERT_LIBRARIES. ''' cs_flags = self.getCodeSignatureFlags() - if cs_flags & 0x12800: + if cs_flags & 0x2800: return False if self.hasSetUID() or self.hasSetGID() or self.hasRestrictSegment(): return False + has_insecure_entitlements_combination = self.hasDisableLibraryValidationEntitlement(self.file_path) and self.hasAllowDEV(self.file_path) + if (cs_flags & 0x10000) and (not has_insecure_entitlements_combination): + return False + return True def printCheckDyldInsertLibraries(self):