Add iOS 16.7.2(arm64e) sandbox escape support

[hxhlb]

Summary

This PR adds iOS 16 support, including:

• Add an iOS 16-specific sandbox escape path
• Add iOS 16 sandbox extension table detection and patching
• Add K_ios16() for iOS 16 kernel pointer validation
• Allow the app to run on iOS 16
• Add self proc/task readiness checks before kcache fetching
• Update file operation and MobileGestalt overwrite handling for iOS 16
• Update the Xcode project and packaging script for the tested iOS 16 build path
• Adjust project settings for devices affected by the arm64e capability installation issue

Details

Sandbox escape

iOS 16 uses a different sandbox extension table layout from the older path. This PR adds a dedicated iOS 16 implementation that:

• Reads the iOS 16 extension table from sandbox + 0x08
• Seeds a writable probe extension
• Finds the matching read-write extension in the extension table
• Copies metadata from the container extension
• Patches the probe extension path to /
• Verifies the result with real file-system access

The existing sandbox escape flow remains the default path for non-iOS 16 systems. On iOS 16, sbx_escape() dispatches into the new iOS 16 implementation.

iOS 16 validation

This PR adds K_ios16(), backed by ds_isvalid(), for pointer validation in the iOS 16-specific sandbox path.

File operations and MobileGestalt

This PR updates file operation helpers and MobileGestalt overwrite handling so they work with the iOS 16 sandbox escape flow.

The MobileGestalt path now uses the updated sandbox/VFS handling so overwrite operations can run after the iOS 16 escape path is ready.

Xcode project and packaging changes

This PR also includes Xcode project updates required for the tested iOS 16 build path.

These changes are needed because some devices can fail installation with an arm64e capability error, for example:

"lara" requires the "arm64e" capability which is not supported

The project changes adjust the build configuration so the app can be installed and tested on the affected iOS 16 device path. The packaging script is updated alongside the project configuration to match that build flow.

Remote call

Remote Call support is still under development and is not available in this PR.

Testing

Tested locally on:

• iPhone XS Max, iOS 16.7.2

Verified:

• App starts on iOS 16
• Sandbox escape reports success
• File-system verification passes
• /private/var/mobile/Library/Preferences write test passes
• MobileGestalt overwrite flow runs after sandbox/VFS readiness

I only have one iOS 16 device available for testing, so the current validation may be incomplete. More iOS 16 devices should be tested before marking this PR ready for review.

[hxhlb]

Here’s a demo recording of the current implementation.
Video