osy/AMFIExemption

Failed to execute with private entitlements

4ch12dy opened this issue · 3 comments

4ch12dy commented

Environments

macOS: Serra
Lilu kext load success.
AMFIExemption load success.
AMFIExemption info.plist
image

Problems

If use self-sign with requested entitlement, the app/cmd will be failed to execute. Terminal just say "zsh: killed"
Console log: proc 9220: load code signature error 4 for file "snappy"

I don't understand "This KEXT only disables the requirement that most entitlements require an Apple CA anchor"

AMFIExemption has no " remove amfi check" code , I think. So how to sign binary with private entitlement ? That can get amfi exemption.

osy commented

I only tested this on Mojave and Catalina. It probably doesn’t work on other versions.

4ch12dy commented

Thanks for your response!
In Fact, I tested it on Mojave, too.
The problem is below

I don't understand "This KEXT only disables the requirement that most entitlements require an Apple CA anchor"

AMFIExemption has no " remove amfi check" code , I think. So how to sign binary with private entitlement ? That can get amfi exemption.

When I use self-sign with special entitlements, Binary can not execute due to AMFI
image

More info:
image

Could you show more explanation or some examples? Thank you so much!

osy commented

Use codesign -s - --entitlements /path/to/xml /path/to/bin