This is a weird thing by the way. It seems to me like you should be able to debug or do VM syscalls against yourself because there is no escalation of privilege. Debugging another process makes much more sense to block. But maybe my opinion is invalid because I also happen to think disallowing jit with kernel permissions is very silly. (Maybe dropping ability to do this in the style of openbsd's pledge(2) would be appropriate, but only for a process that really wants extra security.)
Actual JITs (ones blessed by Apple, not hacks like these) possess the dynamic-codesigning entitlement, and can just make RWX pages.
> But maybe my opinion is invalid because I also happen to think disallowing jit with kernel permissions is very silly.
Your opinion isn't invalid, but it goes against Apple's security model of iOS (namely: apps should not be able to modify themselves).
And my position is this is a silly approach, or, maybe is ok but should be opt-in, or perhaps opt-out with third parties being automatically trusted to decide they want to use JIT without hoops.
W^X is good default policy but Apple's policy is unreasonable and paranoid.
There are two types of certificate – development certificates, which allow get-task-allow for debugging purposes and can be installed directly to a device; and distribution certificates, which do not allow get-task-allow and can be distributed through ad-hoc means, Test Flight, or the App Store.
If this app requires get-task-allow, then it needs to be signed with a development certificate to run. If it's signed with a development certificate, then it can't be distributed to other people.
Official description: https://github.com/tbodt/ish#a-note-on-the-jit
It's a full x86 emulator.
> IIRC the dev said he also wasn't allowed to publish it to the App Store
He didn't, it's just never been tested whether it could be on the store or not.
You can compile binaries on iSH and they'll run on the emulator just as all the other code does.
Edit: just tried it and indeed you are right, it works in a few cases now. Clang also works for basic test cases.