{"id":286,"date":"2017-10-12T08:31:01","date_gmt":"2017-10-12T07:31:01","guid":{"rendered":"http:\/\/kolbi.cz\/blog\/?p=286"},"modified":"2018-10-30T21:07:37","modified_gmt":"2018-10-30T20:07:37","slug":"citrix-receiver-jailbreak-detection-analysis-and-bypass","status":"publish","type":"post","link":"https:\/\/kolbi.cz\/blog\/2017\/10\/12\/citrix-receiver-jailbreak-detection-analysis-and-bypass\/","title":{"rendered":"Citrix Receiver Unblock – Jailbreak Detection Analysis and Bypass"},"content":{"rendered":"

im a jailbreaker. whatever device. PS3, PSVita, iPhone, iPad, Apple TV, etc. why? because i payed for the device and i want to do what i want with it. also its technically interesting to see behind the scenes. most of these devices run a linux or an OS that is rather similar. there are different CPU architectures (Intel, ARM, PowerPC, etc) which are quite interesting to work with too.<\/p>\n

but what does jailbreak mean?<\/strong> in short: a jailbreak removes the software restrictions implemented by the producer of the device. mostly it means you get root privileges and can install additional software, which the manufacturer would not allow.<\/p>\n

normal users should not have root or administrative privileges, because the could do harm to a system (without even wanting to). for that reason, jailbreak has a bad reputation and people think it is evil.<\/p>\n

but it is not<\/strong>. i use it to customize my iPhone just the way i want it. means, i can install tweaks that make the appearance or the functionality of the iPhone even better. it offers really a lot of options like SSH, a filebrowser, smaller icons on the homescreen, higher resolution, faster animations and a lot of other cool things.<\/p>\n

however – if you use an iPhone in a corporate environment, this might not be a desired state and therefore some apps implement a Jailbreak detection.<\/p>\n

Citrix also did that (i think mainly because of XenMobile) in the iOS Receiver. you can even configure your storefront, to block connections from jailbroken devices completely. here is how to do that:\u00a0https:\/\/docs.citrix.com\/en-us\/receiver\/ios\/6\/jailbroken-devices.html<\/a>\u00a0– but even without this configured, Citrix Receiver will show a Security Alert when launching it on a jailbroken phone:<\/p>\n

\"\"<\/a><\/p>\n

And on trying to connect with the Storefront configuration from Citrix:<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

that is quite annoying. can we somehow disable that? of course! like i said in the beginning, jailbreaking gives us root access on the device and we can do EVERYTHING. Citrix can only do what Apple allows<\/em> them and this is not much. Apple iOS is an operating system that has a LOT of security mechanisms like sandboxing, DRM and even worse stuff. a developer can only use a set of functions and is not allowed to access the iOS system with his app. Apple checks every App that is submitted to the store and does reject it when it violates this rule.<\/p>\n

on jailbroken iphones there is a framework called cydia substrate<\/a> which can hook iOS functions and therefore lets you modify the system without binary-patching it.<\/p>\n

my plan was, to find out how Citrix detects the jailbreak and then write a tweak to disable or spoof these checks. lets go:<\/p>\n

Jailbreak Analysis<\/h1>\n

to reverse engineer an iOS binary we need following tools:<\/p>\n