OK, well, I actually wrote part of a few of them, and they do none of that. First, "replacing system framework with your own hex edited version" -- no. They do

OK, well, I actually wrote part of a few of them, and they do none of that. First, "replacing system framework with your own hex edited version" -- no. They do patch the kernel, but they exploit it at startup and do dynamic patching using dynamic methods that work on any version. There is no hex editing. For adding to frameworks, they use a similar method to LD_PRELOAD on Linux. No in-binary patching ever happens. Poor source code? If you mean "not much is released", that's wrong, for example comex posts his kernel patching code at http://github.com/comex http://github.com/comex shortly after every release. .git directories? No idea where that comes from. So, here's what a jailbreak /does/ do: it evades the codesigning mechanisms on the device, and installs a file that does the same on boot. It then injects some code into the kernel, which does dynamic patching to remove the code signature verification checks. After that, it untars a basic *nix setup, with GNU coretools and the Cydia application, and moves the built-in applications to the larger partition (to make space for additional system components). Want to install a "tweak"? It installs MobileSubstrate, a tool that loads itself into processes via DYLD_INSERT_LIBRARIES (similar to LD_PRELOAD on Linux), and then injects whatever other packages you have installed using that. This allows dynamic patching of whatever we want, and you don't hex-edit or modify a single binary. So I'm not sure where you got that impression, but it's pretty much patently wrong.