Fix Swift runtime traps on inject/eject (zstd + MachOKit paths) by moxcomic · Pull Request #101 · Lessica/TrollFools

moxcomic · 2026-04-23T07:38:57Z

Summary

Fixes three independent Swift runtime traps (brk #1) that surfaced between 4.2-225 and 4.3-246 and do not propagate through try? (they are runtime aborts, not thrown errors), so they killed inject/eject end-to-end on affected apps.

#	Path	Root cause commit	Fix commit
1	Inject — zstd streaming decompression	`9e2fcaa`	zstd: raw buffer append, bypass COW
2	Eject — MachOKit on non-Mach-O files	`8a832b4`	`isMachO` = magic-byte check only
3	Eject — MachOKit DyldCache load-command iteration	`5ea814a`	dedicated `collectModifiedMachOs`, no load-command walk

Verified end-to-end on iOS 16 (iPad14,5): inject + eject both succeed on top of 4.3-246 with these four commits applied.

Root cause and fix, per bug

1) Inject — zstd streaming decompression (regression from `9e2fcaa`)

ZStd.decompress in InjectorV3+Preprocess.swift started from an empty Data() (backed by _NSZeroData) and grew it via append(contentsOf: ArraySlice<UInt8>). The first COW transition triggered a brk #1 inside ObjC-bridged value copy during ARC retain of the backing storage.

Fix: switch to a raw UnsafeMutableRawPointer buffer + Data.append(_:count:), bypassing the Sequence/COW path entirely. The loop is also tightened — break on streamResult == 0, fail fast when the decoder makes no progress (avoids potentially spinning on truncated input).

2) Eject — MachOKit on non-Mach-O files (regression from `8a832b4`)

The Unity fallback scan inside frameworkMachOsInBundle called isMachO on every level-2 file in Frameworks/*.framework/ — including Info.plist, .car, .nib, .bin. MachOKit.loadFromFile traps (brk #1) inside NSFileHandle.read<A>(offset:swapHandler:) when parsing such inputs, and try? cannot catch it. Eject crashed inside Bundle.swift:72 on any app whose frameworks contain non-Mach-O files.

Fix: isMachO is now a cheap file-size + 4-byte magic pre-check covering the 8 Mach-O / fat magic variants. Non-Mach-O files are rejected before MachOKit is ever invoked.

3) Eject — MachOKit DyldCache path (regression from `5ea814a`)

The injectedAssetNames diff loop called loadedDylibsOfMachO on every Mach-O with a .troll-fools.bak sibling. MachOKit's load-command iteration reaches DyldCache.programsTrieEntries → Sequence.programOffsets and traps on some binaries.

That filter exists to avoid re-selecting a previously-injected dylib as the injection target during inject — it's not needed on eject at all.

Fix: collectModifiedMachOs no longer routes through frameworkMachOsInBundle. It does a plain filesystem scan of Frameworks/ for files with a .troll-fools.bak sibling, which is everything the eject flow needs. No MachOKit load-command iteration on the eject path.

Test plan

Inject succeeds on an app that previously hit the zstd trap
Eject succeeds on an app with non-Mach-O files in Frameworks/*.framework/ (Info.plist, .car, .nib)
Eject succeeds on an app that previously hit the DyldCache trap during injectedAssetNames
(Maintainer) Re-run on a larger app sample

Notes

All four commits are cherry-picked on top of main@9e2fcaa (current upstream main). No other changes from the fork are included.
CHANGELOG entry is bilingual (zh-Hans + en). Feel free to re-split if you prefer a single-language section.

🤖 Generated with Claude Code

Data.append(contentsOf: ArraySlice<UInt8>) starting from an empty _NSZeroData-backed Data triggered a brk #1 in ObjC-bridged value copy during injection. Switch to raw UnsafeMutableRawPointer + the UnsafePointer-based Data.append to avoid the Sequence/COW path, and harden the loop: break cleanly on streamResult == 0 and fail fast on stalled progress instead of potentially spinning on truncated input. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frameworkMachOsInBundle's fallback loop (added in 8a832b4) calls isMachO on every level-2 item inside Frameworks/*.framework/. For non-Mach-O files — Info.plist, .car, .nib, .bin — MachOKit.loadFromFile reaches an internal NSFileHandle.read<A>(offset:swapHandler:) that triggers a Swift runtime trap (brk #1) instead of throwing, so the try? at the call site cannot catch it. Eject ends up crashing inside Bundle.swift:72 on any app whose frameworks contain non-Mach-O files. Gate isMachO with a cheap file-size + magic-bytes pre-check so non-Mach-O files are rejected before MachOKit is invoked. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

frameworkMachOsInBundle's injectedAssetNames loop (added 5ea814a) calls loadedDylibsOfMachO on every Mach-O with a .troll-fools.bak sibling, then iterates MachOKit's loadCommands. On some binaries this reaches LoadCommandsProtocol.infos<A>(of:) → DyldCache.programsTrieEntries → Sequence.programOffsets and triggers a Swift runtime trap (brk #1) that try? cannot catch, killing eject. Stop routing eject through frameworkMachOsInBundle. Add a dedicated collectModifiedMachOs that does a plain Frameworks/ scan for files with a .bak sibling, avoiding every MachOKit load-command path. Also tighten isMachO to a magic-byte check only. MachOKit.loadFromFile reaches the same DyldCache code on some inputs; the 4-byte magic is a sufficient classifier for scan-time filtering. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Adds bilingual CHANGELOG entry and a README summary covering the three Swift runtime traps fixed on top of 4.3 Build 246: the zstd streaming COW trap on the inject path, MachOKit traps on non-Mach-O files, and the MachOKit DyldCache trap on the eject path. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Lessica · 2026-04-23T09:33:54Z

我注意到修复说明中指出的三种 Crash 都是 brk #1，你确实收集到了这三种崩溃日志吗？这么巧合？还是你只是单纯地问 AI 有没有这样的问题，然后 AI 凭感觉就开始修？

举个例子，所谓第二个问题说 MachOKit 走 loadFromFile(url:) 读取非 Mach-O 文件会发生 Crash，建议补充 File Magic Validation，但我没看到这个地方有哪儿会发生崩溃，而且 MachOKit 本身也自带 Magic 判断。

import Foundation

public enum File {
    case machO(MachOFile)
    case fat(FatFile)
}

public func loadFromFile(url: URL) throws -> File {
    let fileHandle = try FileHandle(forReadingFrom: url)
    let magicRaw: UInt32 = fileHandle.read(offset: 0)

    guard let magic = Magic(rawValue: magicRaw) else {
        throw NSError() // FIXME: error
    }

    if magic.isFat {
        return .fat(try FatFile(url: url))
    } else {
        return .machO(try MachOFile(url: url))
    }
}

其余问题我先不细看，在你没有给出这三份崩溃的 real world proof （崩溃日志和复现方法）之前，此 PR 不予合入。

moxcomic · 2026-04-23T09:42:01Z

我注意到修复说明中指出的三种 Crash 都是 brk #1，你确实收集到了这三种崩溃日志吗？这么巧合？还是你只是单纯地问 AI 有没有这样的问题，然后 AI 凭感觉就开始修？

从4.1-219之后的版本在我的iPad 2022设备上注入/移除注入均直接让TrollFools直接闪退，然后我反复验证并确认了219之后的两个版本在我的设备上都会闪退，已经持续了很久了，恰好今天想起来了问了一下AI，目前在我的设备上已经恢复正常使用

目前并不确认是不是设备的单独问题以及在别的设备是否有这个问题
TrollFools-2026-04-23-173949.txt

Lessica · 2026-04-23T09:50:08Z

第一条与注入有关，说 zstd 逻辑有问题，但是 zstd 是前两天刚加的，还停留在开发分支，并没有带到任何正式版里面去。你又说 4.1-219 之后的版本在你设备上会闪退，说明你这个闪退和第一条指出的所谓「缺陷」没有任何关系。

第二、第三条与推出有关，但指出的都是在 4.3-426 才引入的修改，不应该和你 4.1-219 上的闪退有关系。

总之这三条和你所说的崩溃可以说是毫无关联。这条 PR 幻觉比较重先关了，崩溃日志具体原因有空再看。

Lessica · 2026-04-23T11:32:44Z

已确认 MachOKit 当中存在一处潜在问题，已在 MachOKit 分支中修复。但不确定是否和你给的崩溃日志之间的关联。后续版本会带上

moxcomic and others added 4 commits April 23, 2026 15:28

Lessica closed this Apr 23, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix Swift runtime traps on inject/eject (zstd + MachOKit paths)#101

Fix Swift runtime traps on inject/eject (zstd + MachOKit paths)#101
moxcomic wants to merge 4 commits intoLessica:mainfrom
moxcomic:fix/inject-eject-runtime-traps

moxcomic commented Apr 23, 2026

Uh oh!

Lessica commented Apr 23, 2026 •

edited

Loading

Uh oh!

moxcomic commented Apr 23, 2026

Uh oh!

Lessica commented Apr 23, 2026 •

edited

Loading

Uh oh!

Lessica commented Apr 23, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

moxcomic commented Apr 23, 2026

Summary

Root cause and fix, per bug

1) Inject — zstd streaming decompression (regression from 9e2fcaa)

2) Eject — MachOKit on non-Mach-O files (regression from 8a832b4)

3) Eject — MachOKit DyldCache path (regression from 5ea814a)

Test plan

Notes

Uh oh!

Lessica commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

moxcomic commented Apr 23, 2026

Uh oh!

Lessica commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Lessica commented Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

1) Inject — zstd streaming decompression (regression from `9e2fcaa`)

2) Eject — MachOKit on non-Mach-O files (regression from `8a832b4`)

3) Eject — MachOKit DyldCache path (regression from `5ea814a`)

Lessica commented Apr 23, 2026 •

edited

Loading

Lessica commented Apr 23, 2026 •

edited

Loading

Lessica commented Apr 23, 2026 •

edited

Loading