Enum EIOSJailbreakType

Kinds of jailbreak evidence that can be reported by IOSJailbreakDetector.

Namespace: GUPS.AntiCheat.Detector.IOS

Assembly: cs.temp.dll.dll

Syntax

public enum EIOSJailbreakType : byte

Remarks

The numeric values mirror the GupsJailbreakType enum in the native Objective-C++ plugin (Native/iOS/GupsAntiCheatJailbreak/GupsAntiCheatJailbreak.h). Keep both sides in sync when adding new categories - the native side writes the int directly into IOSJailbreakDetectionStatus.

Fields

Name	Description
DYLD_INJECTION	DYLD_INSERT_LIBRARIES or DYLD_FORCE_FLAT_NAMESPACE is populated in the process environment. iOS strips these for sandboxed apps; a populated value indicates runtime library injection.
FORK_SUCCESS	fork() returned a valid child PID. Sandboxed iOS apps cannot fork - a positive return is a strong jailbreak signal. Opt-in via GlobalSettings.IOS_DetectFork (default false).
SANDBOX_VIOLATION	The process was able to create a file outside of its app sandbox. On a stock device the sandbox blocks the write; success indicates the sandbox is not enforced.
SUSPICIOUS_DYLIB	A loaded dyld image matches a known tweak framework substring (MobileSubstrate, CydiaSubstrate, libsubstitute, libhooker, FridaGadget, ...).
SUSPICIOUS_PATH	A path typical for a jailbreak (Cydia.app, /private/var/lib/apt, /usr/sbin/sshd, /Library/MobileSubstrate, ..., or a rootless /var/jb prefix) was found on the device.
UNKNOWN	Default sentinel used when the type of jailbreak evidence could not be classified.
URL_SCHEME	A jailbreak-related URL scheme (cydia, sileo, zbra, filza, ...) returned true from UIApplication.canOpenURL. Requires the matching schemes under LSApplicationQueriesSchemes in Info.plist.