lilnynho · GitHub

I'm using Frida 17.9.3 on a rootless jailbreak (Procursus bootstrap).

Environment:

  • iOS: 16.7.15
  • Jailbreak: rootless (Procursus / preboot-based)
  • Frida version: 17.9.3
  • frida-server path: /var/jb/usr/sbin/frida-server
  • architecture: arm64

Issue:

When starting frida-server and trying to attach, Frida fails with:

Failed to attach: module not found:
frida-agent.dylib

The resolved path shows a duplicated Procursus/preboot prefix like:

/private/preboot/.../procursus/private/preboot/.../procursus/usr/lib/frida-1.0/frida-agent.dylib

Expected behavior:
frida-agent.dylib should be loaded from a single resolved path.

Actual behavior:
DYLD resolves a duplicated preboot/procursus path, causing module not found.

Steps to reproduce:

  1. Install frida-server on rootless jailbreak
  2. Start frida-server from /var/jb
  3. Attach to SpringBoard using remote frida
  4. Observe "module not found frida-agent.dylib"

Notes:

  • Removing symlinks or reinstalling does not fix the issue
  • Only happens in rootless/preboot environment
  • Frida works fine in non-rootless setups

Possible cause:
Rootless jailbreak introduces a double path translation between:
/var/jb -> /private/preboot/.../procursus

This seems to cause DYLD to resolve the frida-agent path twice.

Read the original on github.com ↗