TrollStore
Jailed iOS app that can install IPAs permanently with arbitary entitlements and root helpers because it trolls Apple
iOS app that installs other apps permanently without jailbreaking, by exploiting a signature verification bug in Apple's system.
TrollStore is an iOS app that can permanently install other iOS apps (in the IPA format) on a device without needing a traditional jailbreak. It works by exploiting a bug in Apple's code signature verification system (AMFI/CoreTrust), where iOS fails to correctly verify signatures when a binary has multiple signers. This lets TrollStore install apps with special permissions that Apple would normally block.
Supported iOS versions are 14.0 beta 2 through 16.6.1, 16.7 RC, and 17.0. Newer versions (16.7.x and 17.0.1+) are not and likely will never be supported unless another similar bug is found.
One practical complication is that iOS can reload its icon cache and revert installed apps back to a limited "User" state, making them unlaunchable. TrollStore addresses this with a "Persistence Helper," a small utility installed into a system app that can re-register TrollStore's installed apps as "System" apps when needed.
Apps installed through TrollStore can carry special entitlements, including the ability to run without Apple's app sandbox, to run helper processes as root, and to use many private system APIs. Some entitlements are blocked on newer hardware and cannot be used. TrollStore is built using theos, an iOS development toolkit, and is credited to researchers who discovered the underlying CoreTrust bugs.
Where it fits
- Install custom iOS apps on your device without needing a traditional jailbreak.
- Run apps with special permissions like sandbox escape and root helper processes.
- Use private system APIs that Apple normally blocks in App Store apps.
- Maintain persistent app installations even after iOS cache reloads.