AppEnumGuard 1.2

AppEnumGuard 1.2

Rootless compatibility and corrected vulnerable-version range.

Changes

• Added a conventional rootless build with arm64 and arm64e slices.
• Supports any rootHide jailbreak environment through an explicit arm64e
  rootHide package; no jailbreak-specific integration is required.
• Changed the package firmware range to iOS 15.0 through 18.4.1. Apple fixed
  CVE-2025-31207 in iOS 18.5, so the package cannot be installed there or on a
  later release.
• Added a polished application icon to the sandboxed tester and included all
  required iPhone and iPad icon sizes in its IPA.
• Redesigned the tester with direct icon buttons for WhatsApp, YouTube, and
  Spotify. It reports green when the selected app is not detectable and red
  when it is detectable, without a separate confirmation control.
• Added portrait and landscape rotation with a scrollable adaptive layout.
• Normalized Spotify, Dopamine, and Reddit selector artwork to the same flat
  visual style as the other choices.
• Added Dopamine, TrollStore, and Reddit to the tester's icon grid.
• Red results now state that AppEnumGuard is not installed. Added an in-app
  project description and clickable GitHub link.
• Simplified result handling: only the known vulnerable 9 / 7 signature is
  red; all other numeric results are green instead of inconclusive.
• Handles equal results such as 7 / 7 and 9 / 9 as green, accounting for
  the native fix behavior observed on iOS 18.5. Result text is limited to
  App not detected, or App detected with AppEnumGuard missing.
• Standardized the tweak and tester identifiers under the reverse-domain
  cz.kolbi namespace. Package replacement metadata handles the briefly
  published kolbi.cz.appenumguard identifier and the original
  com.christoph.appenumerationfix package.
• The SpringBoard-side mitigation remains unchanged and continues to validate
  the private method ABI before installing the hook.

Assets

• AppEnumGuard_1.2_rootless_iphoneos-arm64.deb — conventional rootless
• AppEnumGuard_1.2_roothide_iphoneos-arm64e.deb — rootHide
• AppEnumGuardTester_1.2_sandboxed.ipa — sandboxed tester

SHA-256

f416d9b7db95c566312f65d590a9a919124dd195d6fe8d2118287b11a76f34da  AppEnumGuard_1.2_rootless_iphoneos-arm64.deb
677d5c336a3d5ffab42c475677af85b53531133745d1e4345586aa9fef0c17e8  AppEnumGuard_1.2_roothide_iphoneos-arm64e.deb
cc78e8f09b31d0811cf5976ac0e88037afcaed4e05d23cbe1cedfff5163061c1  AppEnumGuardTester_1.2_sandboxed.ipa

AppEnumGuard 1.1.1 — Metadata update

AppEnumGuard 1.1.1

Metadata maintenance release of the SpringBoard-side CVE-2025-31207 mitigation.

Changes

• Changed the Debian package identifier to cz.kolbi.appenumguard.
• Changed the package author and maintainer to Kolbicz.
• Added Conflicts, Replaces, and Provides metadata for the old
  com.christoph.appenumerationfix identifier so package managers do not retain
  both versions.
• The tested SpringBoard-side mitigation code is unchanged from 1.1.0.

Compatibility

• iOS 17.0–17.3.1
• Relaxin jailbreak with rootHide bootstrap
• arm64e devices
• Confirmed on iOS 17.3.1 build 21D61

Included assets

• AppEnumGuard_1.1.1_roothide_iphoneos-arm64e.deb
• AppEnumGuardTester_1.1.0_sandboxed.ipa

SHA-256

577e778ac3e2d6cc8bb5b4aad3abecb7939d77fa4c31bbd43a127744f61b51e7  AppEnumGuard_1.1.1_roothide_iphoneos-arm64e.deb
b19c8d0acc1191c903ab25e601f1f0e2cf69d1dc0f9a4f70b9736f5c019e3522  AppEnumGuardTester_1.1.0_sandboxed.ipa

AppEnumGuard 1.1.0 — SpringBoard-side protection

AppEnumGuard 1.1.0

AppEnumGuard 1.1 replaces the per-app mitigation from 1.0 with a centralized,
SpringBoard-side fix for CVE-2025-31207.

What changed

• Injects only into SpringBoard, not every UIKit application.
• Hooks the common FBSystemService trust-validation path.
• Rewrites unauthorized security-policy error 3 to application-not-found error
  4, making installed and missing bundle identifiers indistinguishable.
• Validates the private selector's runtime ABI before installing the hook.
• Removes the v1.0 requirement to enable injection for every protected app.
• An app can no longer bypass this mitigation merely by detecting or disabling
  tweak injection in its own process.

Version 1.0 successfully masked the leak but operated by hooking
SpringBoardServices inside each application. That design required injection into
all apps and was unsuitable for injection-sensitive banking and security apps.

Compatibility

• iOS 17.0–17.3.1
• Relaxin jailbreak with rootHide bootstrap
• arm64e devices
• Confirmed on iOS 17.3.1 build 21D61

Verification

The sandboxed tester was run with its own tweak injection disabled:

• Without AppEnumGuard: target 9, missing 7 — red FAIL.
• With AppEnumGuard 1.1: target 7, missing 7 — green PASS.

Included assets

• AppEnumGuard_1.1.0_roothide_iphoneos-arm64e.deb
• AppEnumGuardTester_1.1.0_sandboxed.ipa

SHA-256

e1d8ea5c64d32a7399a6c249f501af0f3a8e99bb5c63be27a63e4141c7856488  AppEnumGuard_1.1.0_roothide_iphoneos-arm64e.deb
b19c8d0acc1191c903ab25e601f1f0e2cf69d1dc0f9a4f70b9736f5c019e3522  AppEnumGuardTester_1.1.0_sandboxed.ipa

AppEnumGuard is a user-space mitigation for the published SpringBoardServices
side channel, not a substitute for Apple's complete iOS 18.5 fix.

AppEnumGuard 1.0.0

AppEnumGuard 1.0.0

Initial tested release.

CVE

CVE-2025-31207 is a FrontBoard information-disclosure issue that lets a
sandboxed app infer which applications are installed from differing private
SpringBoardServices launch return codes. Apple fixed the underlying OS issue in
iOS/iPadOS 18.5.

Compatibility

• iOS 17.0–17.3.1
• Relaxin jailbreak
• rootHide bootstrap and package architecture
• arm64e devices; the tweak dylib is arm64e-only
• Install the iphoneos-arm64e rootHide package; do not use a rootless build

Included assets

• AppEnumGuard_1.0.0_roothide_iphoneos-arm64e.deb
• AppEnumGuardTester_1.0.0_sandboxed.ipa

SHA-256

d4637d96fca670cca345130dd4603192d350023b22a9f4c70e59a8b9765e9af5  AppEnumGuard_1.0.0_roothide_iphoneos-arm64e.deb
a5f6143c1ca85a07d4f7722b6e38e29041623076d593a9f294160acf1daccf42  AppEnumGuardTester_1.0.0_sandboxed.ipa

Verification

On a vulnerable Relaxin/rootHide iOS 17 device with WhatsApp installed:

• Without AppEnumGuard: target 9, missing 7 — tester reports FAIL.
• With AppEnumGuard: target 7, missing 7 — tester reports PASS.

The tweak is a user-space mitigation for the published SpringBoardServices
side channel. It is not a substitute for Apple's complete iOS 18.5 fix.