App crashes on launch when bootstrap tweak injection is enabled (SIGSEGV after CFPrefs error)

[onimac92]

Device Model

iPhone 12 Pro Max

iOS Version

17.0

Bootstrap Version

1.4

Serotonin Version

No response

What happened

I enabled bootstrap tweak injection on my iPhone 12 Pro Max running iOS 17.0, without installing any third-party tweaks, but the app was supposed to launch normally. Instead, it crashes immediately on startup. It doesn't work!

The crash happens right after prefshook redirects preferences. CoreFoundation reports an invalid use of kCFPreferencesAnyUser with a container, followed by a SIGSEGV (11).

Relevant logs:

Log output

Mar  3 02:18:34 ExampleApp(bootstrap.dylib)[694] <Notice>: prefshook: prefs redirect to com.example.hello.world : /var/mobile/Containers/Data/Application/7C24C5B8-5562-4213-AAB9-5AFD89AB0D89
Mar  3 02:18:34 ExampleApp(bootstrap.dylib)[694] <Notice>: prefshook: prefs redirect to com.example.hello.world : /var/mobile/Containers/Data/Application/7C24C5B8-5562-4213-AAB9-5AFD89AB0D89
Mar  3 02:18:34 ExampleApp(CoreFoundation)[694] <Error>: Couldn't read values in CFPrefsPlistSource<0x280ddc750> (Domain: com.example.hello.world, User: kCFPreferencesAnyUser, ByHost: Yes, Container: /var/mobile/Containers/Data/Application/7C24C5B8-5562-4213-AAB9-5AFD89AB0D89, Contents Need Refresh: Yes): Using kCFPreferencesAnyUser with a container is only allowed for System Containers, detaching from cfprefsd
Mar  3 02:18:34 SpringBoard(FrontBoard)[460] <Notice>: [app<com.example.hello.world(87D7E4C5-3DC0-404D-88C4-C3B17C106991)>:694] Process exited: <RBSProcessExitContext| specific, status:<RBSProcessExitStatus| domain:signal(2) code:SIGSEGV(11)>>.
Mar  3 02:18:34 runningboardd(RunningBoard)[32] <Notice>: [app<com.example.hello.world(87D7E4C5-3DC0-404D-88C4-C3B17C106991)>:694] termination reported by launchd (2, 11, 11)

Acknowledgement of README and FAQ

• I have read both the README and the FAQ.

[roothider]

its Bootstrap 2.0 beta7 now bro

[onimac92]

Thanks for the clarification. I just tested again using Bootstrap 2.0 beta7.

I enabled bootstrap tweak injection on my iPhone 12 Pro Max running iOS 17.0, without any third-party tweaks installed, but the app was supposed to launch normally. Instead, it still crashes immediately after launch. It doesn't work.

Here is the relevant log captured with: idevicesyslog

Mar 3 02:52:58 cfprefsd(roothidehooks.dylib)[715] <Notice>: CFPrefsGetPathForTriplet identifier=com.example.hello.world user=kCFPreferencesAnyUser byHost=1 container=(null) ret=1 : /private/var/preferences/com.example.hello.world.plist Mar 3 02:52:58 cfprefsd(roothidehooks.dylib)[714] <Notice>: CFPrefsGetPathForTriplet identifier=com.example.hello.world user=mobile byHost=0 container=/private/var/mobile/Containers/Data/Application/7C24C5B8-5562-4213-AAB9-5AFD89AB0D89 ret=1 : /private/var/mobile/Containers/Data/Application/7C24C5B8-5562-4213-AAB9-5AFD89AB0D89/Library/Preferences/com.example.hello.world.plist Mar 3 02:52:58 runningboardd(RunningBoard)[641] <Notice>: termination reported by launchd (2, 11, 11) Mar 3 02:52:58 SpringBoard(FrontBoard)[642] <Notice>: Process exited: <RBSProcessExitContext| specific, status:<RBSProcessExitStatus| domain:signal(2) code:SIGSEGV(11)>>

The app briefly reaches foreground state, then exits with SIGSEGV (11).

Device: iPhone 12 Pro Max
iOS: 17.0
Bootstrap: 2.0 beta7
No third-party tweaks installed

Let me know if you need a full syslog instead of the filtered one.

[roothider]

reinstall the app from appstore

[onimac92]

Using Bootstrap 2.0 beta7 after reinstalling the app from the App Store:

cfprefsd(roothidehooks.dylib):
CFPrefsGetPathForTriplet identifier=com.example.hello.world user=kCFPreferencesAnyUser byHost=1 container=(null) : /private/var/preferences/com.example.hello.world.plist
CFPrefsGetPathForTriplet identifier=com.example.hello.world user=mobile byHost=0 container=/private/var/mobile/Containers/Data/Application/XXXX/Library/Preferences/com.example.hello.world.plist

runningboardd:
termination reported by launchd (2, 11, 11)

SpringBoard:
Process exited: SIGSEGV (11)

[roothider]

upload crash logs from /var/mobile/Library/Logs/CrashReporter/

[onimac92]

localhost:~ root# ls /var/mobile/Library/Logs/CrashReporter/
ls: cannot access '/var/mobile/Library/Logs/CrashReporter/': No such file or directory
localhost:~ root#

[roothider]

ls /rootfs/var/mobile/Library/Logs/CrashReporter/

[onimac92]

Thanks again for your help.

Would you be open to discussing this privately? I’d be willing to pay for your time if needed to properly troubleshoot the issue.

If so, please let me know the best way to reach you. Otherwise, we can continue here, no problem at all.

Thanks!

[roothider]

just upload crash logs

[onimac92]

ExampleApp-2026-03-02-201137.txt

[roothider]

is it an appstore app?

[roothider]

you'd better try Bootstrap->settings->disable tweak injection first

[onimac92]

Yes, it’s an App Store app.

For privacy reasons, I’ve replaced the real bundle identifier with com.example.hello.world in the logs I shared, but the behavior is the same

[onimac92]

Yes, I tested that.

When the Bootstrap tweak injection toggle is disabled, the app launches normally and does not crash.

The crash only happens when tweak injection is enabled