## https://sploitus.com/exploit?id=4A42AF43-5719-568B-967F-68EA689AA4DB
# DeviceToolbox – iOS Sidecar Privilege Toolkit
Device privilege toolkit for iOS sidecar (enterprise signed) scenarios: kernel vulnerability chain evasion, system container access, full device file reading/writing, Wallpaper Lab, AI forced activation, model masking, cleanup tools, operation logs. **Based on Swift 6 + SwiftUI, GPLv3 license**. ExploitCore and Wallpaper Lab core code sourced from [YangJiiii/3105](https://github.com/YangJiiii/3105) (GPLv3). > ⚠️ **This project is only intended for iOS research/educational purposes. Please comply with local laws. Unauthorized intrusion into others’ devices is illegal in most regions. All risks are assumed by the user.**
---
## Features
| Feature | Description |
|---|---|
| Home Page | Device cards (model/iOS/SoC/emulator identification) + capability probe progress + quick access |
| Device Details | 7 sets of information about hardware/software/storage/battery/screen/network/system |
| Feature Center | 20+ system capability compatibility checks, status badges âś“/â–ł/Ă—/? |
| Privilege Engine | 3105 kernel vulnerability chain (kexploit_opa334 + sandbox_escape + bad_query). Real-time probe reports actual status; capability entry always visible |
| System Container | Container-level file access/scans (MCM channel). Available when enterprise signed with container entitlements |
| Full Device Files | Browse files from any path, automatic privilege escalation (dependent on the Privilege Engine) |
| Wallpaper Lab | System wallpaper installation/analysis (3105 porting) |
| AI Activation | Write MobileGestalt/eligibility to activate AI capabilities, automatic backup+atomic write+recoverable |
| Model Masking | Modify gestalt/eligibility device model identifier. Backups can be rolled back |
| Cleaner | Pages for cache/logging cleanup tools |
| Patch Work Area | Import/edit/password-protected patch management for patch packages |
| Operation Logs | All high-risk operations are recorded; settings page can be exported/cleared |
### Version Window (Important, please verify with actual testing)
- Kernel chain available in **iOS 17.0 – 26.0.x** (runtime guard `< 26.1`)
- iOS 26.1+/27 beta: Kernel chain unavailable. Container-level capabilities depend on **signing identity** (available with enterprise signed with container entitlements; free personal signed MCM always fails)
- Differences in behavior between versions should be reported via Issues. Maintainers will gradually update the compatibility database
---
## Building
Requirements: macOS + Xcode (Swift 6, iOS 17+ SDK, recommended Xcode 15+/27 beta verified) + [xcodegen](https://github.com/yonaskolb/XcodeGen). No third-party dependencies required. ```bash
git clone https://github.com/93857536-pixel/DeviceToolbox && cd DeviceToolbox
xcodegen generate
# Emulator compilation
export DEVELOPER_DIR=/Applications/Xcode-beta.app/Contents/Developer # Only for beta users
xcodebuild -project DeviceToolbox.xcodeproj -scheme DeviceToolbox -
destination 'generic/platform=iOS Simulator' -
derivedDataPath build/DD build
# Unsigned Release (produces unsigned .app for enterprise signed tools)
xcodebuild -project DeviceToolbox.xcodeproj -scheme DeviceToolbox -configuration Release -
destination 'generic/platform=iOS' -derivedDataPath build/DD-ipa
CODE_SIGNING_ALLOWED=NO CODE_SIGNING_REQUIRED=NO build
```
### Installation (Sidecar)
The built product is a **unsigned .ipa**; you need to sign it yourself:
1. Use tools like AltSign for enterprise signing (more capabilities when with container entitlements), or
2. Free developer account for 7-day signing (some container channels are limited).
[source-iocs-preserved url=https://github.com/93857536-pixel/DeviceToolbox/issues]