AppEnumGuard

AppEnumGuard is a defensive tweak for the installed-application enumeration side channel tracked as CVE-2025-31207. It supports conventional rootless and rootHide jailbreak environments on iOS 15.0–18.4.1. The repository also contains a normal sandboxed iOS test application that demonstrates the vulnerable result and verifies the mitigation.

CVE-2025-31207

CVE-2025-31207 is an information-disclosure vulnerability in Apple's FrontBoard application-launching logic. A sandboxed application can submit arbitrary bundle identifiers through a private SpringBoardServices launch function and distinguish installed applications from missing applications using different return codes. This can reveal private information about the applications a user has installed, including banking, messaging, security, sideloading, and jailbreak-related apps.

Apple describes the issue as a logic problem that could let an application enumerate installed apps. Apple corrected it with improved checks in iOS and iPadOS 18.5. Consequently, systems earlier than iOS 18.5 remain affected at the OS level.

Compatibility

The default build uses conventional rootless Theos and includes arm64 and arm64e slices. The rootHide variant is built with rootHide Theos and contains the required rootHide .jbroot loader paths. Both packages declare firmware (>= 15.0) and firmware (<< 18.5): the mitigation is unnecessary on iOS 18.5 and newer, where Apple fixed CVE-2025-31207.

The SpringBoard-side v1.1 tweak and sandboxed tester were verified together on iOS 17.3.1 build 21D61 with injection disabled for the tester. The tester detected the leak with the tweak removed and returned a green pass after the tweak was installed.

How it works

The published primitive calls the private SpringBoardServices function SBSLaunchApplicationWithIdentifierAndURLAndLaunchOptions. On a vulnerable system it returns different errors for an installed application and a missing application:

• 9: target exists, but launch is denied by policy
• 7: target does not exist

AppEnumGuard 1.1 injects only into SpringBoard and hooks the common FBSystemService trust-validation method. When an unauthorized launch request would return FBSOpenApplicationErrorDomain security-policy error 3, the tweak changes it to application-not-found error 4. The outer SpringBoardServices API then returns 7 for both installed and missing targets.

The private method's argument count and Objective-C type encoding are validated before the hook is installed. If Apple changes the ABI, AppEnumGuard fails open instead of hooking an unknown SpringBoard method.

Change from 1.0

Version 1.0 hooked SpringBoardServices inside every UIKit application. It worked, but required injection into every app being protected; an app that disabled or detected injection could bypass the mitigation. Version 1.1 moves enforcement to SpringBoard, so a single central hook protects callers without injecting AppEnumGuard into their processes.

Release downloads

Release 1.2 can be built for either bootstrap:

• AppEnumGuard_1.2_rootless_iphoneos-arm64.deb — conventional rootless tweak
• AppEnumGuard_1.2_roothide_iphoneos-arm64e.deb — rootHide tweak
• AppEnumGuardTester_1.2_sandboxed.ipa — sandboxed verification app with icon

Install and verify

1. Install the .deb matching the rootless or rootHide bootstrap and respring.
2. Install the tester IPA using a normal developer/sideloading signature.
3. Leave AppEnumGuard injection disabled for AppEnum Test; v1.1 protects it from SpringBoard.
4. Tap the WhatsApp, YouTube, or Spotify icon for an app you know is installed.

Expected results with the selected target installed:

The tester reports green when the selected app is not detectable and red when it is detectable. Select only an app you know is installed: 7 / 7 alone cannot distinguish a working mitigation from a target that does not exist.

The device test reproduced both states with tester injection disabled: uninstalling the tweak produced the red 9 / 7 result, while installing v1.1 produced the green 7 / 7 result.

Build the tweak

With standard Theos, the default build is conventional rootless:

cd Tweak
make clean package FINALPACKAGE=1

For rootHide, install rootHide Theos and run:

cd Tweak
THEOS=/path/to/theos-roothide \
  make clean package FINALPACKAGE=1 THEOS_PACKAGE_SCHEME=roothide

Build the tester IPA

The tester is compiled with Xcode's iPhoneOS SDK and has no jailbreak or elevated entitlements:

./scripts/build-tester-ipa.sh

The resulting IPA is placed in dist/. It is ad-hoc signed so an installer may re-sign it with a normal development identity. Do not grant it platform-application or com.apple.private.security.no-sandbox, since the test is specifically intended to run from a normal application sandbox.

Scope and limitations

• This is a user-space mitigation for the published SpringBoardServices primitive, not Apple's complete FrontBoard patch.
• Version 1.1 does not require injection into protected applications. Disabling injection globally or for SpringBoard itself will disable the mitigation.
• The server-side implementation is confirmed on iOS 17.3.1 build 21D61. On other supported versions, the tweak installs its hook only when the private selector has the expected runtime-validated ABI.
• A 7 / 7 test is meaningful only when the target application is known to be installed.
• The tester intentionally calls an undocumented private API and is not suitable for App Store submission.

References

• Apple iOS 18.5 security content
• NVD: CVE-2025-31207
• Original public SpringBoardServices proof of concept
• rootHide developer documentation

License

MIT