iOS system log viewer with kernel exploit. Reads launchd.log and other system logs that are normally inaccessible to apps.
iOS apps are sandboxed — they can’t read system logs. LaunchdDS uses DarkSword kernel exploit to escape the sandbox and read /var/log/ directly.
launchd is the first process on iOS (pid 1). Its log (/var/log/com.apple.xpc.launchd/launchd.log) records every process launch, crash, and service event on the system. This is the most useful log for understanding what iOS is doing.
Launch animation → Exploit → Log viewer
- kexploit_opa334 — gets kernel read/write via ICMPv6 socket corruption
- sandbox_escape — patches sandbox extensions in kernel memory
- Log viewer — reads
/var/log/files + streams own-process logs viaos_activity_stream
- iOS 17.0 – 18.7, experimental 26.0
- Chips A10 – A18, M1 – M4
- Devices iPhone 7 through iPhone 16, iPads with matching chips
Hardcoded kernel struct offsets for every iOS version and chip combination (from ds-kexploit-fun).
Requires Theos with iPhoneOS SDK.
export THEOS=~/theos
make clean && make package FINALPACKAGE=1Output: packages/AntoineDS.ipa — sideload via TrollStore or similar.
| Project | What we use |
|---|---|
| Antoine | Log viewer UI, os_activity_stream integration |
| ds-kexploit-fun | DarkSword exploit, kernel offsets for iOS 17–26 |
| lara | Sandbox escape approach (proc_ro → ucred → sandbox → ext_set) |
| opa334 | kexploit_opa334 (physical OOB r/w → socket corruption) |
| libgrabkernel2 | Kernelcache download for dynamic offset resolution |
| XPF + ChOma | Kernel patchfinder |
- percache — maintainer
- Serena — Antoine
- seo — DarkSword, offsets
- rooootdev — lara, sandbox escape
- opa334 — kexploit
- alfiecg24 — libgrabkernel2, XPF, ChOma
MIT