Nyxian 0.11.1 "Scriptura" Beta

Changelog

Nyxian

• Feat: Browsing/deleting files directly in the guest file system (through MoltenFileManager, note this feature is still in early development) (dc5ecdb, 41bba65, f940a0b)
• Feat: added more Virtual Environment settings features such as restore, reload daemons, browsing files, clearing application caches, etc (056b062, 6047bb9, d0a3b4f, 7983d7d, 0a7789e, 92bbb4b, 62a8381, ec45b9a, 61aa4a4, 9aab755)
• Fix: Nyxian opens again on iOS 18 (idk which commit, one commit fixed it tho xD)

LiveProcess

• Fix: Properly restore exception ports in ktfp after handoff of task port (537075b)
• Hardening: enhanced launch service validation (baefff1)

Micro Kernel (ksurface)

• Vulnerability Patch: patched Mach IPC type Confusion (found by @semvis123) (5f35113)
• Vulnerability Patch: patched attacker controlled OOB write in LCPatchExecutableSlice (found by @semvis123) (662a9c1)
• Vulnerability Patch: patched 1 byte NULL overflow in KERN_HOSTNAME setting mechanism in SYS_sysctl (found by @semvis123) (8ae7ec7)
• Vulnerability Patch: patched SYS_wait4 async event handler leaks mach port send rights (found by @semvis123) (9af771c, d99bb10)
• Vulnerability Patch: patched another OOB write in LCPatchExecutableSlice (2952a33)
• Vulnerability Patch: patched attacker controlled stack buffer overflow in SYS_sysctl (found by @semvis123) (1e75dcb, dee9694)
• Vulnerability Patch: patched attacker controlled stack buffer overflow in macho_read_token (found by @semvis123) (f89090c)
• Vulnerability Patch: patched deadlock in SYS_setreuid and SYS_setregid (found by @semvis123) (cd2d67a)
• Vulnerability Patch: patched data corruption vulnerability in key.m (found by @semvis123) (068cf74)
• Vulnerability Patch: patched null ptr deref in proc_list (found by @semvis123) (068cf74)
• Vulnerability Patch: patched task port confusion (found by @semvis123) (e4d70d7)
• Vulnerability Entry Patch: patched a reference/lock leak in kvobject_snapshot (found by @semvis123) (4905e2a)
• Hardening: swapped binaries will now cause PECTL_CS_FALLBACK_ENT (shall fix some appstore apps failing to open properly) (f26cfdb)
• Hardening: added os_unfair_lock to DYLD cdhash verifier in LiveProcess (1b6b161)
• Hardening: applying LC hooks before constructors run (0d88cc3, ae31522)
• Hardening: entitlement sanitization (strips all entitlements that make no sense in a certain collection of entitlements) (6754f51, b370fba)
• Feat: more PEUserspaceManager features (056b062, 6047bb9, d0a3b4f, 7983d7d, 0a7789e, 92bbb4b, 62a8381, ec45b9a, 61aa4a4)

Contributors: @semvis123, @ruri1208

Note

Standard SDK used in this version of Nyxian is iPhoneOS26.5.

Note

This update is very recommended to install, it features a ton of patched to a ton of vulnerabilities @semvis123 collected over the last 3 months.

Nyxian 0.11.0 "Scriptura" Beta

Changelog

Nyxian

• Fix: crashes when importing an unknown project on iOS 27.x. (dc21a10)
• Major redesign for iOS 27.x. (da011ad, 2fde516, 8c18f4d, 25f6830, b2cb36c, a2c0ee9, 4ecc4cd, 9f098fe, cb5fadd, 27e1ed1, f0ffd1d, cb5fadd, fb8e2c7)
• Updated to Swift 6.3.3. (e2d0d7d)
• Exit code logging is now here. (d905ecb, 416edfc, 8955417, 86cb9ca)
• Back to the better icon and name lol. (1307236, a90a264)
• iOS version picker in project settings now adds the slot directly if missing. (92bcf89)
• File name extensions are now shown if they are unknown to the file manager. (70ba270)
• Experimental new userspace reboot button. (2200d96, 03e6761, 562e615, a9b142b, a9fcf42, f3ec620)

LiveProcess

• Vulnerability Patch: UB in snapshotting mechanism. (7f9a6f6)
• Fix: zero *tp_out out before task_for_pid. (f3af94c)
• Fix: return NULL if no main entry in MachO could have been found. (86e2d49)
• Swaps now the CFBundle and releases the main one entirely. (b3270a1)
• Now the main bundle is recognized as loaded and as executable. (3e4ec59, 9075d96, f34b78e)
• Now it hooks dlsym instead of dlopen when redirecting UIApplicationMain. (a464c42)
• Now it will show error on failure loading guest executable. (a8f05fe)

Micro Kernel (ksurface)

• Vulnerability patch: privilege escalation in permission check. (f42ba51)
• Vulnerability patch: DOS in permission check. (c631b9d)
• Vulnerability patch: OOM null ptr deref in radix tree. (a72cf36)
• Vulnerability patch: OOM null ptr deref in radix tree. (5b81cdc) (separate vulnerability yes)
• Vulnerability entry patch: race condition entry due to unchecked initialization of a mutex. (b3a406e)
• Vulnerability patch: Dangling process object crafting via failure path in SYS_handoffep. (83a6408) (found by @semvis123)
• Vulnerability patch: TOCTOU in installd daemon. (32847a5)
• Vulnerability patch: null ptr deref in installd daemon's doWeTrustThatBundle: method. (43b4bec)
• Vulnerability patch: LCMapMachO null ptr derefs. (f4e33cb)
• Vulnerability patch: OOB in entitlement_mach_verify. (369a6c2, 9d40768)
• Vulnerability patch: TOCTOU in LCBootstrap.m. (acdc3f6, 399e5a3, 03095d4, 20e871f, 98f9183, 7474bb1)
• Fix: Reconnection issues with daemons. (df0376d, c1d3949)
• On terminate of PEProcess uses now SIGTERM gives the process time to quit and after an amount of time if exceeded turns into a SIGKILL. (5e3307c)
• Uses now a guarded mach port as the syscall server receive port. (898edc4)

Contributors: @semvis123, @mimalloc

emexDE 0.10.3 "Avis" Beta

Changelog

emexDE

• better sheet dismissal detection (da744a2)
• updated to swift 6.3.2 (b5f5276, 9c44afb)
• updated to iPhoneOS26.5.sdk (eb30c07)
• rewritten more UI in Swift UIKit (24246c5)
• other UI improvements (8fa8d1d, 942fa70, ee2ad3b, d978293, cece9c7, 512a468)
• fix: weird window server glitches (fa81b3c, d09e052)
• fix: actually present windows on iOS 26 (cece9c7)
• feature: build projects for iOS versions newer than host version(only exporting product) (99a1e9c)
• feature: added cache browsing feature to projects (3b133c7)
• feature: slightly better project creation popup (c6f95d3, 11e5bc7)

emexDE 0.10.2 "Avis" Beta

Changelog

emexDE

• fixed project GUI (c937bba)
• updated credits (0dcfc06, 439915b, 6229a0d)
• emexDE rebranding (45b2f30, 5573ce8, d464ed1, 56e554f, ed85577, 271633e)
• fixed issues with window state management (012b5d4, 6f97cbb, e11733b, 972cf1c, 9dd1f0e, 9b4e25d)

ksurface (pre-rebrand)

• vulnerability fix: heap buffer overflow in archo Zsign, discovered by @orbisai0security (00975c4)

Note

Standard SDK used in this version of emexDE is iPhoneOS26.4

Thanks to contributions from @orbisai0security, @LucaVmu, @L0tsen and @mimalloc

Nyxian 0.10.1 "Avis" Beta

Changelog

Nyxian

• fix: creating SwiftUI project correctly by generating info.plist key's in SwiftUI interface projects (lol, blame me) (98710fa)

Note

This is a emergency patch created because of serious bugs.

Note

Standard SDK used in this version of Nyxian is iPhoneOS26.4

Warning

Jailbreak and trollstore support might be broken in this first release. In the case you wanna use them, don't downgrade, make sure to backup all app data and then upgrade.

Nyxian 0.10.0 "Avis" Beta

Changelog

Nyxian

• feature: added Swift 6.3.1!!!
• feature: autosaving of files (62f99a7, 4bbcbdb, 0be6e7c, 5e00ece, 17dcc37, 7a85d33)
• feature: added NXOSVersion for better checks (5757f67, 200493d, 03ff0be, d588d6a, f94cf17, 0b10e63)
• feature: added UI Onboarding (e1d50d1)
• fix: calculate keyboard height correctly in code editor (7a0cb6b, 690dd22, 690dd22)
• fix: using LLVM's crash recovery context for safe LLD usage (72fdc00)
• fix: better threading (cbc0033)
• fix: don't force load every file thrown at the CodeEditor (5063e71)
• fix: don't delete the path extension when generating object file paths (72b4d84)
• performance: only reload project's variables once (9575b2b, 7764602)
• feature: take supported deployment targets straight from SDK (9575b2b)
• feature: redesigned project creation experience
• feature: added buttons to clear project and swift module cache (eb0a5f7)

Kernel Virtualization Layer (ksurface)

• vulnerability fix: removed a code signature bypass from inbuilt installd (1cb57a1)
• vulnerability fix: patched a deadlock in SYS_sysctl (16e667a)
• vulnerability fix: patched information disclosure vulnerability from permission over pid check (471e2ee)
• vulnerability fix: patched a race condition in PEProcessManager (memory corruption) (111f566)
• vulnerability fix: patched a resource exhaustion vector regarding FBProcessManager (5b08d63)
• vulnerability fix: added forgotten cleanup path in PEProcess (a0cdd40)
• vulnerability fix: patched a use-after-free caused by a reference underflow (b6e1011)
• vulnerability fix: patched a lenient memory corruption vulnerability (845fa60)
• vulnerability fix: patched a use-after-free in kvobject allocation API (1fe578d)
• vulnerability fix: patched a memory leak in process list API (09c423c)
• vulnerability fix: handling EAGAIN on rdlock's (e592fc0)
• vulnerability fix: patched buffer overflow in SYS_handoffep found by @zipgod24 (ebd6c28)
• vulnerability fix: patched use-after-free in proc_zombify(1) found by @zipgod24 (4337d89)
• vulnerability fix: patched a severe buffer over-read leading to information disclosure (ef6fb7c)
• vulnerability fix: patched ksurface termination vulnerability (1deeccb)
• vulnerability fix: patched a OOB vulnerability in ZSign by @orbisai0security (c878655)
• feature: using FBProcess for process state change handling (9d00fb1)
• performance: faster MachOObject (f37c7c6, cc0ac37, 5097f01, c4612ce, b03e161)
• performance: faster write in and out in FDObject (4d42ed5)
• performance: slightly faster PEProcessManager (fbc9911)
• performance: using faster NSExtension invocation method (b1dd4d7, 61e3c1d, 21939af)
• performance: removed redundant delay in PELaunchService (6731ed7)
• performance: made object allocation slightly faster (f325e0c)
• hardening: removed PEEntitlementProcessElevate from some presets (6a33561)
• fix: disabled darwinbg simulation cuz apple might just freeze parts of iOS for what ever reason (ae26edb)

Note

standard SDK used in this version of Nyxian is iPhoneOS26.4

Warning

Jailbreak and trollstore support might be broken in this first release. In the case you wanna use them, don't downgrade, make sure to backup all app data and then upgrade.

Nyxian 0.9.1 "Falcon" Beta

Changelog

Nyxian

• Theming patches (1cc4c63)
• fixed objc utility generation (bff7e4d)
• fixed window handling on iPhone (ded2d5c)
• rethought application install (c87a607, dc5cb03, 1ee59d1, c205dc2, be12d71, b229747, f35d83b, 7d04700, 2aeb138, 7ee7cbe, 6cda7de, f73b0bd)
• fixed write access in SDK paths in file manager (ad2450e)
• fixed issue navigator on iPhone (e75c170)
• patched DOS in zip extraction (695e37e)
• corrected some appearance issues with GUI project configurator (a3b22fa, fb619f5, 6e6471a, c57ef22)
• improved dependency scan performance (d5f9fe7)
• fixed window double close bug on iPadOS (344524e)

Kernel Virtualization Layer (ksurface)

• Improved entitlement patching to Applications menu (8cb891d, 8e16df8, e4efbcf)
• PEObject patches (a20eae5)
• Radix tree patches (ddfce45)
• Vulnerability fix: unexpected system termination due to null ptr deref (d9d2c93)
• Vulnerability fix: improper cleanup path in tty initialization leading to a use-after-free (6ce3648)
• Vulnerability fix: improper action order in tty deinitilization leading to a race condition (8ae5e4d)
• Resource leak fix: resource exhaustion due to improper cleanup (c5b1004)
• Improvement: added PEEntitlementPlatformRoot (926a259, 1d53664, 3226ee6)
• Improvement: better trust and entitlement code (9c1cf66, 766434a, b5fe797)
• Security hardening: nerfing capability of root user process to automatically be able to enumerate processes (ad4a9e6)
• Bug fix: use correct path for the CFPrefsPlistSource hook (990bc47)

nxtool (resign trollstore apps on macOS to nyxian apps, basically embed nyxian entitlements into ipa's)

• initial release

Nyxian 0.9.0 "Falcon" Beta

Changelog

Nyxian

• Improved logic in Issue Navigator (d3e8522)
• Added GUI project configuration (d1fe1f2, a7e9da2, d98b16b, c784014, c120fb8)
• Updated SDK to iPhoneOS26.4 (751e2f1)
• Bug fix: fixed barbutton items not theming on iOS 26 (47eb2a8, e026fc3)
• Bug fix: touch inputs not getting delivered to NXTerminalWindowSession properly (62aa2f6)
• Bug fix: window focus refix (4f4cc1a)
• WindowServer v4 introduction
• Added "Jump to definition" in code editor (026ec8d, 5500bc9, 5384079, b98f2f2)
• Using LLVM's dependency scanner for better accuracy for incremental builds (fdb4d5a)
• Other minor optimizations

Ksurface

• Syscall server improvements (better performance) (4d5d37f, 3a55079, 2ba098c)
• Fixed vulnerability: critical type size mismatch of PEEntitlement (7d7ae3e)
• Fixed vulnerability: null pointer dereference in SYS_handoffep (72220c4)
• Fixed vulnerability: missing break label in SYS_ioctl (d1a0e2c)
• Fixed vulnerability: semantical mismatch of syscalls sys_task_ (58f51c5)
• Fixed vulnerability: memory corruption in proc_copy_for_proc(2) (95fbe14) (already replaced API with kvobject(stands for kernel virtualized object))
• Fixed vulnerability: dangling mach port reference created by SYS_gettask (6432e95, c0b69f1)
• Fixed vulnerability: DOS in SYS_gettask (d6ab609)
• Fixed vulnerability: object leak on ENOSYS path in syscall server (259a39f)
• Fixed vulnerability: null pointer deref may happen in proc list api (4dc1e69)
• Fixed vulnerability: flavour confusion in proc list api (25cec7c)
• Fixed vulnerability: race condition in SYS_procpath (af259e2)
• Fixed vulnerability: privilege escalation in SYS_gettask (2dfc66e)
• Fixed vulnerability: race condition in proc copy api (33cc1b5) (already replaced API with kvobject(stands for kernel virtualized object))
• Fixed vulnerability: missing unlock path of proc table in proc api (7e349d5)
• Fixed vulnerability: use-after-free in proc lookup api (cffd6a3)
• Fixed vulnerability: privilege escalation in proc_permitive_over_pid(5) (f373680, c392b2a)
• Fixed resource leak: file descriptor leak in SYS_signexec (d1a0e2c)
• Fixed resource leak: mach ports leak in syscall server (21e762c)
• Fixed resource leak: entire mach messages of syscall server (67871da, 7ae16ad)
• Bug fix: fixing the iOS 26.4+ crash (4b21e76, 565ed89)
• Bug fix: utility home paths incorrectly being set (407ace1)
• Feature: SYS_wait4 fix (9a0b0a4, ffb91ba, e966e06, 8fae3f1)
• Feature: better panic system (for debug only) (b80dfc8)
• Feature: tty support(no forkpty yet) (edb70ed, 8d4466e, 07eba8c, de3c5cf, 8d89c99, 5ed7894, 6c83b81, 1081cd5, 3af601a, 706796a, 58fe7df, fa052ef, 1cf242b, 1cf242b, 6959604)
• Feature: SYS_setent syscalls to drop entitlements (b7d96f8, a514fb8)
• Feature: new cryptographic code signing (507e828)
• Feature: process zombification (19e831c)
• Improvement: better ksurface init (b8d76de)
• Improvement: validating entitlements now on host side and replaced ksurfaced with containerd (3cee766)
• Improvement: Daemon crashes wont cause deadlocks anymore (f69d208, d4abbf1)
• Improvement: Added brand new kernel object api aka kvobject (29addf5, 5cddfe1, b750644, 0cd2d56, d70151a, f458091, 4ee265d, ca735b8, 09b45f2, eeef5fe, 632fc87, 673ce9e, 47c3ae0, 21b98d9, ebbaac7, e309858, 94c907a, ecf0c29, 5054f98, b5f5c14, c3a6a76, cf08598)
• Improvement: Now tfp works on all iOS versions (b6c9ee6, 4e9f0d1, aa54ed9, d9224e3, fcfbc61, 7f3d93a, 4f4affe, ffeb5da, c44c087, 5c74874, c0bede5, f989152, b1b47fa, 7062e71, 4ebf18b, a5398d5)
• Improvement: stripped and improved inefficient LC source code (25632e9, 261782b, 3987fb8, 5eb7835, d0af2c3, d0af2c3, 6c1b83c, 2822f87, ce1933e, 97be455, c3a2d78)
• Improvement: now the user is warned that the NSExtension is missing if it is missing (10aae93)
• Improvement: added task name support to SYS_gettask (11190af)
• Improvement: removed restrictions from DYLD_INSERT_LIBRARIES (3a32304)
• Improvement: introducing syscall server v3 with userspace ptr support (dbf7248)
• Improvement: introducing 64bit radix trees (2d78377)
• Improvement: replaced the fork() fix with the new vfork() fix (96cbd0f)
• Improvement: better process flag state management (ac4c8a0, 8fd6bef)
• Improvement: replaced 2000 branches with memcpy for CFBundle override (aaf5c50, 83d9356, 714b57f, b08963c)
• Improvement: now exit sets the exit of the process in ksurface (edeb207, be53319)
• Improvement: correctly overriding NSProcessInfo (a114284, 8d9d591, 8d9d591)
• Improvement: hookless posix spawn file actions fix (86cf307, 278465b, f9af413)
• Improvement: forkbomb halfway fixed? (3a9eadd)
• Improvement: fixed crash of process when they append a file descriptor to FDMapObject (328a45b, c0eca4b, 670753d)
• Improvement: return with errno in posix spawn api (814d45c)
• Security hardening: stripping entitlements regardless of platformization (58d5acb)
• Security hardening: removed potential DDOS vector and validated task port flavor in proc_task_for_proc(3) (bf475d4)
• Security hardening...

Nyxian 0.9.0 "Falcon" Beta (Preview 1)

Changelog

Normal Changelogs will continue after 0.9.0 final beta release in 2 days.

Full Changelog: 0.8.6...0.9.0.PREVIEW.1

Nyxian 0.8.6 "Kate" Beta

Changelog

Jailed

Nyxian

• improved KernelLogViewController (60d74e5, d571453)
• fixed utility compilation failing due to missing flags on lower iOS versions (a9cb50e)
• fixed utility development (eeb9a1c, 8b04ef4, f7b8f23, 7090741)
• added undo and redo button to CodeEditor (51bf255, a0987c1, 08acab8)
• fixed iOS 14 appearance issues (942a861, 025b4c1)
• improved keyboard tab button with indentation features (e33ade5, 6199989)
• fixed LDEWindow focusing on iPadOS (54a3efc, 8e21e1a)
• reduced jitter of XCodeButton animations (6233eeb)

LiveContainer

• fixed a bug where the bundle was kept LiveProcess, instead of overwritten with the value expected (78debea)
• overwrites now _CFGetProcessPath too (3307c66)
• fixed home path for utilities (105968a, a7497f9)
• fixed DYLD_INSERT_LIBRARIES (9f6c1b7)

---

Jailbroken

Nyxian

• initial release