more up to date with jailbreakd, nothing appears broken, may not be any better either. still figuring it out.

Meridian/jailbreakd/kern_utils.h

@@ -70,6 +70,9 @@ kern_return_t mach_vm_allocate(vm_map_t target, mach_vm_address_t *address, mach
 kern_return_t mach_vm_deallocate(vm_map_t target, mach_vm_address_t address, mach_vm_size_t size);
 
 uint64_t find_port(mach_port_name_t port);
+
+void fixupsetuid(int pid);
+
 char *proc_name(int pd);
 
 int dumppid(int pd);

Meridian/jailbreakd/kern_utils.m

@@ -98,6 +98,49 @@ uint64_t find_port(mach_port_name_t port) {
     return port_addr;
 }
 
+void fixupsetuid(int pid){
+    char pathbuf[PROC_PIDPATHINFO_MAXSIZE];
+    bzero(pathbuf, sizeof(pathbuf));
+    
+    int ret = proc_pidpath(pid, pathbuf, sizeof(pathbuf));
+    if (ret < 0){
+        fprintf(stderr,"Unable to get path for PID %d\n", pid);
+        return;
+    }
+    struct stat file_st;
+    if (lstat(pathbuf, &file_st) == -1){
+#ifdef JAILBREAKDDEBUG
+        fprintf(stderr,"Unable to get stat for file %s\n", pathbuf);
+#endif
+        return;
+    }
+    if (file_st.st_mode & S_ISUID){
+        uid_t fileUID = file_st.st_uid;
+#ifdef JAILBREAKDDEBUG
+        fprintf(stderr,"Fixing up setuid for file owned by %u\n", fileUID);
+#endif
+        
+        uint64_t proc = proc_find(pid, 3);
+        if (proc != 0) {
+            uint64_t ucred = rk64(proc + offsetof_p_ucred);
+            
+            uid_t cr_svuid = rk32(ucred + offsetof_ucred_cr_svuid);
+#ifdef JAILBREAKDDEBUG
+            fprintf(stderr,"Original sv_uid: %u\n", cr_svuid);
+#endif
+            wk32(ucred + offsetof_ucred_cr_svuid, fileUID);
+#ifdef JAILBREAKDDEBUG
+            fprintf(stderr,"New sv_uid: %u\n", fileUID);
+#endif
+        }
+    } else {
+#ifdef JAILBREAKDDEBUG
+        fprintf(stderr,"File %s is not setuid!\n", pathbuf);
+#endif
+        return;
+    }
+}
+
 void set_csflags(uint64_t proc) {
     uint32_t csflags = rk32(proc + offsetof_p_csflags);
     csflags = (csflags | CS_PLATFORM_BINARY | CS_INSTALLER | CS_GET_TASK_ALLOW | CS_DEBUGGED) & ~(CS_RESTRICT | CS_HARD | CS_KILL);

Meridian/jailbreakd/main.m

@@ -10,6 +10,23 @@
 #include "helpers/kexecute.h"
 #include "mach/jailbreak_daemonServer.h"
 
+//more stuff from electra jailbreakd
+
+#define CS_OPS_STATUS       0   /* return status */
+
+#define CS_GET_TASK_ALLOW    0x0000004    /* has get-task-allow entitlement */
+#define CS_INSTALLER        0x0000008    /* has installer entitlement */
+
+#define    CS_HARD            0x0000100    /* don't load invalid pages */
+#define    CS_KILL            0x0000200    /* kill process if it becomes invalid */
+#define CS_RESTRICT        0x0000800    /* tell dyld to treat restricted */
+
+#define CS_PLATFORM_BINARY    0x4000000    /* this is a platform binary */
+
+#define CS_DEBUGGED         0x10000000  /* process is currently or has previously been debugged and allowed to run with invalid pages */
+
+int csops(pid_t pid, unsigned int  ops, void * useraddr, size_t usersize);
+
 #define PROC_PIDPATHINFO_MAXSIZE  (4 * MAXPATHLEN)
 int proc_pidpath(pid_t pid, void *buffer, uint32_t buffersize);
 
@@ -22,6 +39,8 @@ kern_return_t bootstrap_check_in(mach_port_t bootstrap_port, const char *service
 #define JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT_FROM_XPCPROXY 3
 #define JAILBREAKD_COMMAND_FIXUP_SETUID 4
 
+#define JAILBREAKDDEBUG 1
+
 mach_port_t tfpzero;
 uint64_t kernel_base;
 uint64_t kernel_slide;
@@ -58,7 +77,56 @@ int handle_command(uint8_t command, uint32_t pid) {
         setcsflagsandplatformize(pid);
         kill(pid, SIGCONT);
     }
-    
+    if (command == JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT_FROM_XPCPROXY) {
+#ifdef JAILBREAKDDEBUG
+        fprintf(stderr,"JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT_FROM_XPCPROXY PID: %d\n", pid);
+#endif
+        __block int PID = pid;
+        
+        dispatch_queue_t queue = dispatch_queue_create("org.coolstar.jailbreakd.delayqueue", NULL);
+        dispatch_async(queue, ^{
+            char pathbuf[PROC_PIDPATHINFO_MAXSIZE];
+            bzero(pathbuf, sizeof(pathbuf));
+            
+            int tries = 0;
+            int ret = proc_pidpath(PID, pathbuf, sizeof(pathbuf));
+            while (ret > 0 && strcmp(pathbuf, "/usr/libexec/xpcproxy") == 0 && tries < 5000){
+                proc_pidpath(PID, pathbuf, sizeof(pathbuf));
+                usleep(100);
+                tries++;
+            }
+            if (tries >= 5000){
+                fprintf(stderr, "Warning: xpcproxy timer timed out for PID %d\n", pid);
+            }
+            
+            uint32_t flags;
+            csops(pid, CS_OPS_STATUS, &flags, 0);
+#ifdef JAILBREAKDDEBUG
+            fprintf(stderr, "Waiting for CSFlags to reset for PID %d...\n", pid);
+#endif
+            
+            tries = 0;
+            while ((flags & (CS_PLATFORM_BINARY | CS_INSTALLER | CS_GET_TASK_ALLOW | CS_DEBUGGED)) != 0 &&
+                   (flags & (CS_RESTRICT | CS_HARD | CS_KILL)) == 0 &&
+                   tries < 5000){
+                csops(pid, CS_OPS_STATUS, &flags, 0);
+                usleep(100);
+                tries++;
+            }
+            
+            if (tries >= 5000){
+                fprintf(stderr, "Warning: CSFlag timer timed out for PID %d\n", pid);
+            }
+            
+            setcsflagsandplatformize(PID);
+            kill(PID, SIGCONT);
+#ifdef JAILBREAKDDEBUG
+            fprintf(stderr,"Called SIGCONT on pid %d from ENTITLE_AND_SIGCONT_FROM_XPCPROXY\n", PID);
+#endif
+        });
+        dispatch_release(queue);
+    }
+    /*
     if (command == JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT_FROM_XPCPROXY) {
         NSLog(@"JAILBREAKD_COMMAND_ENTITLE_AND_SIGCONT_FROM_XPCPROXY PID: %d NAME: %s", pid, name);
         __block int blk_pid = pid;
@@ -79,9 +147,10 @@ int handle_command(uint8_t command, uint32_t pid) {
         });
         dispatch_release(queue);
     }
-    
+    */
     if (command == JAILBREAKD_COMMAND_FIXUP_SETUID) {
-        NSLog(@"JAILBREAKD_FIXUP_SETUID PID: %d NAME: %s (ignored)", pid, name);
+        NSLog(@"JAILBREAKD_FIXUP_SETUID PID: %d NAME: %s", pid, name);
+        fixupsetuid(pid);
     }
     
     free(name);

Meridian/meridianTV/electra_extras/sbinject/.theos/_/DEBIAN/control

@@ -7,5 +7,5 @@ Maintainer: CoolStar
 Author: CoolStar
 Section: System
 Tag: role::developer
-Version: 0.0.1-11
+Version: 0.0.1-14
 Installed-Size: 88

Meridian/meridianTV/electra_extras/sbinject/.theos/last_package

@@ -1 +1 @@
-./debs/com.yourcompany.sbinject_0.0.1-11_appletvos-arm64.deb
+./debs/com.yourcompany.sbinject_0.0.1-14_appletvos-arm64.deb

Meridian/meridianTV/electra_extras/sbinject/.theos/packages/com.yourcompany.sbinject-0.0.1

@@ -1 +1 @@
-11
+14

Meridian/meridianTV/electra_extras/sbinject/Makefile

@@ -2,7 +2,7 @@ ARCHS=arm64
 TARGET = appletv
 export SDKVERSION=10.1
 include theos/makefiles/common.mk
-THEOS_DEVICE_IP=apple-tv.local
+THEOS_DEVICE_IP=gtv.local
 
 LIBRARY_NAME = TweakInject
 TweakInject_LIBRARIES = substrate