FalseRASP.js

/**
 * iOS Talsec FreeRASP Bypass
 * @author HAMMER
 * 
 * Bypasses Talsec's anti-debugging and anti-tampering protections.
 * 
 */

// Track bypass statistics for monitoring effectiveness
var stats = { exit: 0, exceptions: 0 };

/**
 * Delayed initialization to ensure process stability
 */
setTimeout(function() {
    try {
        // Find system libraries using manual enumeration
        // This bypasses Module.findExportByName() detection issues
        var mods = Process.enumerateModules();
        var kernelLib = null, cLib = null;
        
        // Locate critical system libraries dynamically
        // This ensures compatibility across iOS versions and devices
        for (var i = 0; i < mods.length; i++) {
            if (mods[i].name === 'libsystem_kernel.dylib') kernelLib = mods[i];
            if (mods[i].name === 'libsystem_c.dylib') cLib = mods[i];
        }
        
        // Hook ptrace - prevents debugger detection
        if (kernelLib) {
            var exports = kernelLib.enumerateExports();
            for (var i = 0; i < exports.length; i++) {
                if (exports[i].name === 'ptrace') {
                    Interceptor.replace(exports[i].address, new NativeCallback(function() {
                        // Always return success to bypass debugger detection
                        return 0;
                    }, 'int', ['int']));
                    break;
                }
            }
        }
        
        // Hook exit - prevents forced app termination
        // Talsec attempts to exit() when security violations are detected
        if (cLib) {
            var exports = cLib.enumerateExports();
            for (var i = 0; i < exports.length; i++) {
                if (exports[i].name === 'exit') {
                    Interceptor.replace(exports[i].address, new NativeCallback(function() {
                        stats.exit++;
                        if (stats.exit <= 3) console.log("[Bypass] exit() blocked!");
                    }, 'void', ['int']));
                    break;
                }
            }
        }
        
        // Handle security exceptions generated by Talsec's anti-tampering
        Process.setExceptionHandler(function() {
            stats.exceptions++;
            return true; // Continue execution despite security interference
        });
        
    } catch (e) {
        // Silent fail
    }
    
}, 1000);