amfidont

https://github.com/zqxwce/amfidont
Admin
amfidont is a macOS utility that attaches to amfid using LLDB to bypass app signature verification...
Tokens:1,570
Snippets:21
Trust Score:8.7
License:GPL-3.0
Update:3 weeks ago
Show doc for...
Tokens:
Raw
### Start amfidont as daemon

Source: https://github.com/zqxwce/amfidont/blob/master/README.md

Starts amfidont in daemon mode with verbose output. This is an optional alternative to foreground mode.

```shell
sudo amfidont daemon --verbose
```

--------------------------------

### Spoof allowed binaries as Apple-signed

Source: https://github.com/zqxwce/amfidont/blob/master/README.md

Starts amfidont with Apple-spoofing enabled, patching isApple to return true for allowed binaries. Useful for running self-signed arm64e binaries without the arm64e_preview_abi boot argument.

```shell
sudo amfidont --spoof-apple --verbose
```

--------------------------------

### Install amfidont with pip

Source: https://github.com/zqxwce/amfidont/blob/master/README.md

Installs or updates the amfidont utility using pip. Requires Python 3 and xcrun.

```shell
xcrun python3 -m pip install -U amfidont
```

--------------------------------

### Start amfidont in foreground

Source: https://github.com/zqxwce/amfidont/blob/master/README.md

Starts amfidont in foreground mode with verbose output. Stop with Ctrl-C, which detaches amfidont and leaves amfid running.

```shell
sudo amfidont --verbose
```

--------------------------------

### amfidont CLI usage

Source: https://github.com/zqxwce/amfidont/blob/master/README.md

Shows the command-line interface of amfidont, including options and subcommands. Options can be specified multiple times and are merged with persistent configuration files.

```none
Usage: amfidont [OPTIONS] COMMAND [ARGS]...

A simple utility for bypassing amfid signature verification

Options:
  --path, -p TEXT      path of executable to allow (can be specified multiple times, merged with ~/.amfidont/paths)
  --cdhash, -c TEXT    cdhash of executable to allow (can be specified multiple times, merged with ~/.amfidont/cdhashes)
  --verbose, -v        enable verbose output
  --allow-all          allow all validations to pass
  --spoof-apple, -S    patch isApple to return true for allowed binaries
  --install-completion Install completion for the current shell.
  --show-completion    Show completion for the current shell, to copy it or customize the installation.
  --help               Show this message and exit.

Commands:
  daemon        Start amfidont in daemon mode.
  add-path      Add an allowed path prefix to persistent configuration.
  remove-path   Remove an allowed path prefix from persistent configuration.
  add-cdhash    Add an allowed cdhash to persistent configuration.
  remove-cdhash Remove an allowed cdhash from persistent configuration.
```

--------------------------------

### Breakpoint on isApple

Source: https://github.com/zqxwce/amfidont/blob/master/README.md

Additional breakpoint set when --spoof-apple is enabled. Patches isApple to return true for allowed binaries, making them appear Apple-signed.

```none
-[AMFIPathValidator_macos isApple]
```

--------------------------------

### Add persistent allowed path

Source: https://github.com/zqxwce/amfidont/blob/master/README.md

Adds a persistent allowed path prefix to the configuration. Requires sudo.

```shell
sudo amfidont add-path /Users/user/dev/myapp/build/Release/MyApp.app/
```

--------------------------------

### Breakpoint on validateWithError:

Source: https://github.com/zqxwce/amfidont/blob/master/README.md

Breakpoint set on the AMFIPathValidator_macos validation method. On each hit, amfidont inspects codePath, cdhashAsData, and isValid fields.

```none
-[AMFIPathValidator_macos validateWithError:]
```
Tokens:
Raw