Many third-party apps crash immediately on launch with an EXC_GUARD exception. The kernel kills the process when the app calls task_set_exception_ports on a guarded mach port.
This affects most apps that include crash reporting SDKs (Firebase Crashlytics, Sentry, Bugsnag, etc.) since they call task_set_exception_ports during initialization.
Crash log excerpt:
"termination": {"namespace":"GUARD","flags":2,"code":2305843037130981377} "exception": { "type": "EXC_GUARD", "subtype": "GUARD_TYPE_MACH_PORT", "violations": ["SET_EXCEPTION_BEHAVIOR"], "message": "SET_EXCEPTION_BEHAVIOR on mach port (guarded with 0x6e)" }
The crash occurs in the first frame of the main thread: mach_msg2_trap → task_set_exception_ports.
Root cause: The PCC-derived kernelcache has stricter mach port guard enforcement than standard iOS. On a real iPhone, task_set_exception_ports succeeds normally. On the vphone, the kernel raises EXC_GUARD and kills the process.
Attempted workarounds that didn't work:
- DYLD_INSERT_LIBRARIES with a hook dylib — AMFI strips the env var before the process starts
- MobileSubstrate/ElleKit tweak — ElleKit's pspawn injection isn't active on the vphone, so tweaks don't load into apps
Proposed fix: Add a kernel patch to patch_cfw.py that disables the EXC_GUARD enforcement for task_set_exception_ports, similar to the existing SSV bypass patches. The function to patch would be mach_port_guard_exception or the guard check in task_set_exception_ports itself.
Activity
0No activity yet.