kolbicz/WQFiles

Overview

WQ Files is an iOS 27 file browser built on the “worse_query” sandbox technique, which it says reaches other apps' and system containers without a jailbreak or kernel exploit. It is aimed at users who need to inspect or maintain app data, app-group containers, extension data, daemons and system paths on a device they control. Built and tested on iOS 27.0.1 (project README).

What you can do

The browser lists app data containers by app name and icon instead of UUID, along with app groups, extension data, internal daemons, system data (listing only), and known system-group containers, plus a Go to Path option. Because container parents return no access token on 27.0.1, contents are located by querying the kernel for each inode's path via fsgetpath (README: files and paths).

The Apps view shows each app's data size and lets you back up, restore, clear data, or share a backup as a ZIP. The Cache Cleaner shows cache and temp sizes per app with bulk selection and a 50 MB+ large-cache filter. The file tools include a plist editor, a paged hex editor, image preview and editable text, with saves written back in place.

Quick start

1. Build the arm64 binary with ./build.sh; the script ad-hoc signs it with an App Group entitlement (group.cz.kolbi.wqfiles).
2. Re-sign with a signing tool that preserves an App Group entitlement. The technique requires one.
3. Install the signed app on an iOS 27 device, launch it, and confirm the Log screen shows the App Group it received. If it reports “No App Group”, the signer dropped the entitlement.
4. Use Go to Path or the Apps/Cache Cleaner lists to navigate; edits are made through the file browser's Open As tools.

A prebuilt signed app is not provided in the README, so the signing step is yours to complete.

Constraints

• iOS 27 only; built and tested on 27.0.1, and some system paths are listing-only because they are root-owned.
• System Groups on 27.0.1 cannot be listed as a parent; known container names must be tried one by one with the + button.
• App names come from LaunchServices' database read from lsd's container, since the LaunchServices API refuses the app on 27.x.
• Overwrites and deletions are preceded by copies into the app's Backups, but clearing app data and cleaning caches delete without file-by-file backup (Apps offers to back up first). In the browser only empty folders can be deleted.
• Editing another app's or system files can break apps or the system; the README advises keeping backups and changing only what you understand.
• Licensed GPL-3.0-or-later; the worse_query sandbox technique is by Taj C (forcequit) under GPL-3.0-or-later, and inode path lookup follows KAMUI by murk-sus (credits).

HotRepo's take

WQ Files was recorded on HotRepo's new-project list on 2026-11-09 with 107 stars gained and 8 forks over a roughly 4.5-hour observation window, and no GitHub daily rank is recorded. That is a single early snapshot, so it shows initial attention rather than sustained growth. The project's substance is the reimplementation of a jailbreak-free sandbox access technique and a fairly complete set of file, plist and hex editing tools; the practical gate is the signing requirement (an App Group must survive re-signing), which the README states explicitly.