development

[faint timber]

The code actually works lmao

[trail niche]

I never thought of that

[trail niche]

im trying this rn, this seems so fucking wacky

anyone got a clue on why tweak_swift isn't here?

[indigo peak]

update theos?

[weary heath]

Do you need Orion

[hexed knot]

Because theos doesnt support swift

[trail niche]

I installed it yesterday

[trail niche]

whoops, am really stupid, sorry, completely looked over this step

[weary heath]

Np

[hexed knot]

Because theos doesnt support swift

[trail niche]

orion does

[hexed knot]

I mean support as in praise

[trail niche]

What IDE do y'all use for jb dev?

I want to use vscode

[primal perch]

windows 10 21H2 19044.1889

[trail niche]

bus the swift extension is beyond ass

[indigo peak]

nano

and sometimes notepad++

[trail niche]

lmao based af

How do I set the C compiler to usE?

its using normal clang, I think it needs apple clang

fjiwepfwenfwewef

[vivid dew]

fr

[trail niche]

does anyone know how I can get vscode keybindings for xcode

aye, do I have to make it myself?

lmfaoooo, stack in .bss

[vivid dew]

@primal perch

[trail niche]

stack in mmaped file

[nimble parcel]

use my updated swift toolchain, it includes apple clang etc and Orion basically expects it at this point: https://github.com/kabiroberai/swift-toolchain-linux/releases/tag/v2.1.0

[trail niche]

im using macOS

[indigo peak]

@grave sparrow

should these both be 0

[trail niche]

damn

thats really smart ngl

[nimble parcel]

ah nvm in that case I’d recommend using the stock toolchain and using Xcode as your IDE

[vivid dew]

i hope your code isn’t reentrant

[nimble parcel]

run make spm and open Package.swift in Xcode

[trail niche]

the problem is that clang-14 not apple clang is my default c compilre

[nimble parcel]

the problem in your screenshot was that VSCode uses macos as the default target for SPM

[nimble parcel]

do you see the same issue when running make?

[primal perch]

yes

yes it is

[indigo peak]

maybe running kreadbuf at 0 makes it error

[serene ridge]

my asm code clobbers 5 64bit values, so i have a struct of that size in __DATA, then its used as “context”, based on whatever function is currently executing

[trail niche]

I do not think so, that is very odd

[serene ridge]

yeah but it’s still the best we got

"Discord is pretty shit but it’s the best thing we got"

[trail niche]

ifr

irc??

[serene ridge]

Truth

Theres matrix but that is fucking dogshit

and theres uhh guilded but also a discord ripoff and its garbage

[vivid dew]

irc true

[nimble parcel]

—or multi-threaded

[trail niche]

Is using swift worth it for tweak development?

(orion)

[vivid dew]

yes (dubious)

[trail niche]

swift package manager won't use the correct Clang version 😩

[nimble parcel]

imo yes but im slightly biased towards the person who created orion (me)

[trail niche]

woah! Thank you for the tool!

[nimble parcel]

hahah yw

[trail niche]

do you got an idea on how to fix this error btw?

[nimble parcel]

use make

[indigo peak]

use normal theos

[trail niche]

how could i get the LSP to work then?

[nimble parcel]

see if make works for starters

if it does then worry about LSP

[trail niche]

aye, it seems to be workin

[nimble parcel]

what’s the output of which swift and which clang-14?

[trail niche]

clang 14 is homebrew clang

and then swift is /usr/local/opt/swift/bin/swift

[native dune]

@indigo peak did you figure out the KernelManager thing

[trail niche]

I set that manually in my .zshrc btw

[nimble parcel]

oh okay that’s why

[indigo peak]

@naive kraken should be the last ping, should the kreadbuf return a size_t

[nimble parcel]

yeah try adding the Xcode swift to your PATH

[indigo peak]

i think so

maybe?

no idea

[naive kraken]

kread_buf is supposed to write the read kernel memory into a buffer you supply

[trail niche]

yes sir

[naive kraken]

what it returns is irrevelant aslong as the read works

[indigo peak]

size_t kreadbuf(uint64_t where, void *p, size_t size) {
    printf("kreadbuf: %llx %p %zx\n", where, p, size);
    size_t remainder = size % 4;
    if (remainder == 0)
        remainder = 4;
    size_t tmpSz = size + (4 - remainder);
    if (size == 0)
        tmpSz = 0;

    uint32_t *dstBuf = (uint32_t *)p;

    size_t alignedSize = (size & ~0b11);
    for (int i = 0; i < alignedSize; i+=4){
        dstBuf[i/4] = kread32(where + i);
    }
    if (size > alignedSize) {
        uint32_t r = kread32(where + alignedSize);
        memcpy(((uint8_t*)p)+alignedSize, &r, size-alignedSize);
    }
    return size;
}

i stole that from somewhere

[primal perch]

unsafe

p was not nil checked

[naive kraken]

- (int)readBufferAtAddress:(uint64_t)addr intoBuffer:(void*)outBuf withLength:(size_t)len
{
    //printf("read at %llX - %lX\n", addr, len);
    //usleep(50);
    
    if(_kread_buf)
    {
        return _kread_buf(addr, outBuf, len);
    }
    else
    {
        uint64_t endAddr = addr + len;
        uint32_t outputOffset = 0;
        unsigned char* outputBytes = (unsigned char*)outBuf;
        
        for(uint64_t curAddr = addr; curAddr < endAddr; curAddr += 4)
        {
            //printf("read %llX\n", curAddr);
            //usleep(1000);
            uint32_t k = [self read32BitValueAtAddress:curAddr];

            unsigned char* kb = (unsigned char*)&k;
            for(int i = 0; i < 4; i++)
            {
                if(outputOffset == len) break;
                outputBytes[outputOffset] = kb[i];
                outputOffset++;
            }
            if(outputOffset == len) break;
        }
        
        return 0;
    }
}

this is the one I wrote

in the else I mean

[trail niche]

why not just memcpy?

[naive kraken]

you're reading kernel memory

[trail niche]

yeah

[naive kraken]

and you only have read32/ read64

and you somehow need to use those to read into a buffer

[indigo peak]

and im using the kernel_buffer var thats made using multicast

[trail niche]

i see

[nimble parcel]

also have you tried Xcode with Package.swift?

[trail niche]

yeah, still get an error

[nimble parcel]

what’s the error there?

[trail niche]

how can I easily get this? or do I ahve to look through dirs

[native dune]

i was trying to use the kread64 from kernel_rw

[indigo peak]

^

thats what i was doing

[nimble parcel]

xcrun -f swift

[naive kraken]

that's what read64BitValueAtAddress does internally

[trail niche]

ah, tha nks

[nimble parcel]

That’s a different issue, switch your target from the simulator to “Any iOS device”

[naive kraken]

KernelManager is just a huge abstraction of kernel r/w that I can plug any exploit in

[trail niche]

yes sir

[grim fulcrum]

hi

[trail niche]

built fine

thank ya!

the absolute state of OOP

[trail niche]

rn its building argument parser

[nimble parcel]

it takes a bit, the SwiftSyntax dep is especially heavy

[trail niche]

im even compiling with gmake

[trail niche]

its been compiling BashCompletionsGenerator for a while, should I kill and try again with -j8 or smth?

[indigo peak]

ok wtf

why is this still 0 and 0

desc race

[nimble parcel]

no just wait, SPM is slightly bad at progress reporting

[trail niche]

yep, just changed

[nimble parcel]

It usually gets stuck on that message for a bit even when it’s compiling other files

[indigo peak]

i dont wanna ping opa again

but i want to ask him

[naive kraken]

@naive kraken

here I did it for you

[indigo peak]

thank you

ill wait for him to get back ig

[naive kraken]

I mean idk

this isn't really rocket science lmao

[trail niche]

Wow im suprised, it just compiled perfectly fine

[nimble parcel]

awesome

[indigo peak]

when youre me opening a window is rocket science

[naive kraken]

you're just trying to read some data with a function that can only read a 64 bit value at a time

[trail niche]

and everyhing is working

even LSP in xcode

[crude swallow]

that’s rocket science

[naive kraken]

if it's 0 maybe you forgot to apply the fix to actually make kernel r/w work properly with multicast_bytecopy

[trail niche]

how 2 open terminal in xcode?

[indigo peak]

ctrl + `

[trail niche]

ah

thanks

nope didn't work

im switching IDEs anywyas so its all g

[nimble parcel]

The Xcode “terminal” is only for doing IO with command line tools you’re running; it won’t let you interact with Theos

[trail niche]

no i mean like

I want to use zsh in xcode

to do

[nimble parcel]

yeah you can’t do that

[trail niche]

gmake go

ah

[indigo peak]

@naive kraken i no longer see the 0, but its not doing anything after these lines

[nimble parcel]

it’s bizarre but Xcode still doesn’t have an actual terminal after several decades of development

[trail niche]

i switched to AppCode anywyas

student 😎

[nimble parcel]

ah nice lmk how appcode works with orion, haven’t really used it much

[trail niche]

yes sir

the things I do to make my xbox controller work on my ipad lmao

[indigo peak]

oh look

it works

[trail niche]

damn it

im just gonna use xcode

@nimble parcel is using -j4 ok for an orion project?

[nimble parcel]

it should be yes, and if you encounter any bugs please report them on GH

[trail niche]

whoops accidentally softlocked my ipad

im an idiot, I set the

MobileSubstrate Bundle filter
to com.apple.springboard

and then did

import Orion
import UIKit

class LabelHook: ClassHook<UILabel> {
    func setText(_ text: String) {
        orig.setText(
            text.uppercased().replacingOccurrences(of: " ", with: "👏")
        )
    }
}

im sure there is no way this can go wrong

holy shit that actually worked

[serene ridge]

what are you even trying to do

[trail niche]

how do I get a list of bundle ids?

[indigo peak]

tbh idek anymore

[serene ridge]

are you just doing random things

[trail niche]

@nimble parcel I want to patch a system framework (GameController), is the process the same?

nah its ok now, I found a workaround

How would I get the bundle-id of a framework tho

wdym

[vivid dew]

it's in the info.plist

[trail niche]

i see, thanks!

private func showPopup(title: String, description: String)
{
    let vc = UIViewController()
    let alert = UIAlertController(title: title, message: description, preferredStyle: .alert);

    
    alert.show(vc, sender: nil)
}
``` this is whats called a Pro Gamer Move

wait can I get the UIViewController of SpringBoard?

uh i just wanna show a popup

so the one that is active on the homescreen?

where do I get the console output of my tweak btw?

[faint timber]

Remember that rbp uses + and - so you have to set it to the middle of your alloc, eg size / 2

[trail niche]

yep, did that

[faint timber]

What’s even weirder is the app uses its own aslr slide that doesn’t match the one grabbed from dyld call

[trail niche]

bruh

[faint timber]

The hook works for some reason but for references the slide is different

Maybe I made a typo idk

[grim sparrow]

THE springboard view controller

Haven’t you heard

The most efficient way to code is to cram the entire program in one view controller

[trail niche]

unironically true

where can I find examples for orion?

[indigo peak]

@naive kraken you said that the brute force takes 0.1 seconds or somethign to execute on your device, how come my cmd.cmd is so far from the LC_SEGMENT_64

[trail niche]

Here is my plan for my tweak:

- Detect if connected bluetooth device is Xbox series X controller
- If true, make GameController framework treat is as a regular xbox controller
- ???
- profit

does anyone know how to hook into the bluetooth stuff?

[native dune]

I couldn’t even get past replacing the KernelManager instances

It has other things i can’t find

[indigo peak]

bad

[native dune]

[primal perch]

%hook

and find the right class

[trail niche]

Yeah, that’s what I’m stuck on lol

[indigo peak]

@grave sparrow do you know why

[trail niche]

xcode crashes randomly
please just end me

[tepid olive]

my brother in christ learn what a bridging header is

[lime pivot]

https://twitter.com/eric_capuano/status/1558252298387632129

Eric Capuano ⬡ (@eric_capuano)

My DEF CON is now complete.

Twitter · Aug 13, 2022, 12:41 AM

[native dune]

lmao

[gentle grove]

slack literally came way before discord fr

[restive ether]

[lime pivot]

lmao, discord was the slack ripoff, not vice versa

except they got the community angle right unlike Slack who chase tens of thousands a month from companies and dgaf about communities

sure does, globs/tilde don’t expand in quotes

[trail niche]

TIL

[indigo peak]

why not

[primal perch]

in reality discord won because the ccp pays hella for data

[lime pivot]

🙃

[indigo peak]

useless

🙄

[faint timber]

@grave sparrow you offered help for a good cause sir, I thank you

[indigo peak]

@faint timber would you happen to know?

[faint timber]

I'm not a mach-o expert

[indigo peak]

:(

you def know more than me

so

[faint timber]

make sure you use unsigned printing @indigo peak

[indigo peak]

I’ll go try that when I get upstairs

But it still takes forever

since there’s a condition that needs to be met

where cmd.cmd == LC_SEGMENT_64 it is

and it’s not running

so I don’t think that the printing is the issue

[faint timber]

I can suggest one thing

divide possibleValues by 4, then create 4 threads each running that section of the brute force

[indigo peak]

well if it’s 0x19 it’s 25, so could I do 5 instead

so it would technically be even

[faint timber]

good idea

[indigo peak]

idk what I’m doing so

Just a guess

[faint timber]

each thread has a different start and ending value

[indigo peak]

possibleValues has nothing to do w it

since it gets sent to find_bss_offset_and_size

and then theres a for loop

for(int ci = 0; ci < kernel_header.ncmds && cmdAddr <= cmdEnd; ci++)

maybe my kern_base is incorrect

which wouldnt make sense

bc that kern base that im passing is what im getting from multicopy_bytecast

[indigo peak]

this shit makes no sense

I want to give up but at the same time I won’t learn if I give up

I’m in a lose lose situation

[trail niche]

where can I fidn the console output for my tweak?

Console.app for macs,
wdym

like

I can get the output with ssh?

Oh got confused with terminal.app

[serene ridge]

“And Windows"

[trail niche]

will do

how do I conenct it?

yes sir

Do I have to use NSLog?

[lime pivot]

@naive kraken just released 1.0.3 https://chariz.com/get/stopcrashingpls/changelog

[grim sparrow]

Trolling

[lime pivot]

I’ve committed a small amount of it

[vivid dew]

chariz

[lime pivot]

hate those guys

[naive kraken]

👍

[naive kraken]

that's definitely wrong

tbh don't bother with sandbox_extension_generator, go straight for root

[lime pivot]

it’s a bunch of tin sheets somewhere in a recycling centre now

chariz shed is ded

yeah basically

[turbid fjord]

I bet boba struggles

[chilly plover]

someone said me this

"If SSL pinning is enabled you will not be able to MITM HTTPS traffic. The only way to do it would be to grab your part of the SSL/TLS session key in memory then use that to decrypt packets. But if you are that far it’d probably just be easier to grab the decrypted packet content from memory"

Is this solution works on how easy/difficult it is to implement?

[tardy narwhal]

that very someone should be able to elaborate further on it

[indigo peak]

but how would I write to the Applications folder if I don’t escape the sandbox

[naive kraken]

root already unsanboxes you

[indigo peak]

oh yeah

forgot about that

Do you have any idea why the sandbox cmd.cmd was so far away from LC_SEGMENT_64 tho

like everything should’ve been fine

i modified bypass_sandbox_offsetless to take in a uint64_t * for kern_base so when its run from multicast_bytecopy the kernel base is found without needing a KernalManager property for it, and then that kern_base value is passed into find_bss_offset_and_size

that the only thing that i could think of going wrong with it

is the kern_base maybe being cast to the wrong type somewhere along the way or something

[rose wren]

Lmao I forgot about this

Did they have Linux in yours

[indigo peak]

@naive kraken i figured it out

i was casting it wrong somewhere along the way

fun fact *(kern_base + sizeof(kernel_header)) is NOT the same thing as *kern_base + sizeof(kernel_header)

[naive kraken]

fun fact this chat with you may have lead me to discover the way fugu15 installs the fake signed app on iOS 15.2 and up lol @indigo peak but I'll have to test it first

but let's just say I have an idea and don't see why it wouldn't work lol

[indigo peak]

see, im not entirely useless

[rose wren]

[turbid fjord]

You are quite useless at being not entirely useless

[rocky token]

Man android is taking advantage of how new I am. Feels like it randomly makes my variables null between methods

[naive kraken]

unfortunately doesn't work, also this basically confirms that you need the app to be platformized to add to uicache

[indigo peak]

ok i might be more useless than i thought

[naive kraken]

you can fake platformization via kernel rw tho

I thought you might be able to add something to uicache from a normal app lol

[indigo peak]

does uicache run when you reboot

[naive kraken]

then you could put the fakesigned app into your app and add that path to uicache

no

[indigo peak]

interesting

[naive kraken]

also what you do here is something else entirely, you add something to the cache

https://github.com/ProcursusTeam/uikittools-ng/blob/main/uicache.m#L123

[indigo peak]

so i got the sandbox escaped and the exploit working, im just not sure what i have to do now

[naive kraken]

get root, get platformization, copy fakesigned app to some subpath of /var/containers/Bundle/Application, call LSApplicationWorkspace registerApplicationDictionary

[indigo peak]

this seems like more of a project than i thought it was going to be

[hexed knot]

Rewrite uicache in RUST

uikittools-rs

[indigo peak]

what even is platformization

i legit have 0 idea what anything you said means

so i found some random code from a white name from january 2021

and it uses libjailbreak.dylib

so now im extra lost

ok i mgiht not be as lost

[naive kraken]

you need tons of struct offsets but apart from that, platformizing yourself is pretty simple

if you already have self proc that is

well nvm it's not simple lol

maybe I'll just do it

I just hope my struct offsets work on more devices then just mine lmao

[indigo peak]

yeah i might just leave this up to someone else

i was watching reading https://github.com/0xilis/13fun/ and theres a lot of stuff i see here that seems like hardcoded values speciofic per version

[naive kraken]

lol my project is called fun15

[indigo peak]

[naive kraken]

maybe I got inspired without realizing it

[indigo peak]

my project is called opa

what could i even do with the sandbox escape

like with just the escaped sandbox, no root

[naive kraken]

I almost got tweak injection working in fun15 but PPL had a different plan

idk just filza jailed or something and that's it

[indigo peak]

so id need to get root in order for anything to work

[naive kraken]

yeah with root you can spawn binaries

[indigo peak]

how do you even find the offsets

[naive kraken]

IDA

[indigo peak]

o

dyld_shared_cache

or something

[naive kraken]

what

[indigo peak]

?

[naive kraken]

kernel cache

[indigo peak]

o

so all of these are from IDA

https://github.com/0xilis/13fun/blob/587d7f5bd81995d4238975684dc3860ce6084c7f/0pwn/0pwn.m#L22-L114

[naive kraken]

basically with root + kernel rw + coretrust bypass you can spawn platformized binaries with any entitlements you want

and all of that is public / really not that hard to get working but no one really does anything with it idk

yes

you take a symbolized kernel cache (14.0b5) and the kernel cache of your device, then try to match functions

and find xrefs and stuff

[indigo peak]

and then any of these values, 0x100, 0x78 or whatever https://github.com/0xilis/13fun/blob/587d7f5bd81995d4238975684dc3860ce6084c7f/0pwn/0pwn.m#L227-L254 is const between versions?

[naive kraken]

to then figure out the struct offsets

[indigo peak]

or is it specific per version

[naive kraken]

it depends whether the struct was modified

[indigo peak]

you get the kernel cache from the ipsw right

[naive kraken]

yes

[indigo peak]

i just have a iOS 16 ipsw downloaded

wtf

why

[naive kraken]

you need to find a function that accesses the struct member in the symbolicated kernel

and then use string xrefs and stuff to find it in your unsymbolicated kernel

[indigo peak]

im assuming theres no guide or anything online for this

[naive kraken]

idk

there is probably also patchfinders available for some offsets

but I didn't really bother lol

did everything by hand

[indigo peak]

thats what im gonna do

gotta download 10gb of iOS versions

less goo

[naive kraken]

a macOS KDK development kernelcache is also extremely useful because it's completely symbolicated also

[indigo peak]

yeah i dont have a mac

i have 1 iOS device on a modern version and a windows computer

and thats it

[naive kraken]

kdk are on apple developer

but idk how you would extract the kernelcache from it without a mac

[indigo peak]

hmm

how big of a file is the kernelcache

[naive kraken]

few mb

[indigo peak]

so @grave sparrow could hypothetically send me it

[tepid olive]

Makefile:1622: .deps/xtensa-modules.Plo: No such file or directory
make[2]: *** No rule to make target '.deps/xtensa-modules.Plo'.  Stop.
make[2]: Leaving directory '/private/var/mobile/Documents/gdb-ios/bfd'
make[1]: *** [Makefile:2748: all-bfd] Error 2
make[1]: Leaving directory '/private/var/mobile/Documents/gdb-ios'
make: *** [Makefile:875: all] Error 2

someone help

where do i get xtensa-modules.Plo from

[zenith hatch]

coom

[indigo peak]

@naive kraken what do i even do with the kernel cache in ida

[naive kraken]

you reverse it? lol

[indigo peak]

i took it out of the ipsw and i put it into ida

and i see nothing that i can wqork off of

[naive kraken]

you have the symbolicated one?

[indigo peak]

no

[naive kraken]

yeah I mean that's hard to reverse

you either want a macOS kdk or a 14.0b5 iphone11 research kernel

both have symbols

and then you need to look at them and find the stuff inside your kernel with string xrefs and stuff

[indigo peak]

will the offsets be the right ones for iOS 15 using the 14.0b5?

[naive kraken]

no

you find the locations in which the offsets are used in 14.0b5

and then you locate those locations in your unsymbolicated kernel

and then you have the offsets

but the code may not be 1:1 the same obviously

[indigo peak]

hm

okay

[naive kraken]

you don't need a dev account to download KDK's anyways

at least not that I know of

but you need macOS to install them and to then get the kernel files from /Library/Developer

[indigo peak]

@naive kraken do i disassemble using (kernel + all kexts) or (kernel only)

[naive kraken]

I think kernel only is enough if you just want the offsets

otherwise all kexts doesnt hurt

[faint stag]

is it just me or is bison from procursus missing a dependency?
dyld: dependent dylib '/usr/lib/libtextstyle.0.dylib' not found for '/usr/bin/bison', tried but didn't find: '/usr/lib/libtextstyle.0.dylib' '/usr/local/lib/libtextstyle.0.dylib'

i mean libtextstyle0v5 is on procursus but why isn't it in the control file for bison

[native dune]

pr it

[faint stag]

i do not know how

[serene ridge]

yeah you just need an apple id

[native dune]

[[libtextstyle0v5]]

[faint lion]

libtextstyle0v5

internationalization helper for strings

Author

Hayden Seay

Version

0.21-4

Price

Free

Repo

Procursus

Bundle ID

libtextstyle0v5

Powered by Canister · Aug 13, 2022, 7:49 PM

[native dune]

this is the dependency?

[indigo peak]

1. im assuming you meant iphone 11 iOS 14.0 beta 5 kernel cache
2. i dont see anything in xrefs under that kernel cache

[naive kraken]

the research kernelcache in the ipsw yes, idk what you mean with xrefs

[native dune]

@faint stag

[indigo peak]

isnt that what im supposed to be looking at?

the xrefs

[naive kraken]

you're first of all looking to find code segments that access the struct members you want

you can also check XNU source code for that

then you find that in the 14.0 kernel

and then you find it in the unsymbolicated kernel

[faint stag]

ye

[naive kraken]

to find the functions in the unsymbolicated kernel you can use string xrefs

[native dune]

and thats makes it work?

[indigo peak]

i was using the wrong kernelcache lol
i see things now when im using the right one

[native dune]

is this a small change

[faint stag]

correct

[native dune]

https://github.com/ProcursusTeam/Procursus/pull/1273

[faint stag]

o, that's where the control files were

ty

[native dune]

now you know

[wicked summit]

gm

[primal perch]

gm

[wicked summit]

to do or not to do a little trolling

[indigo peak]

using multicast_bytecopy, how do I get the proc for root user access

[primal perch]

it’s 1 bro

[indigo peak]

so is my iq

[hasty ruin]

dk if this is useful to anyone in here

https://github.com/JailbreaksApp/CertCheck

just made it public

[wicked summit]

thank you iCapt

very cool

[indigo peak]

does this tell me what the proc is

no

it’s useless

[hasty ruin]

[hasty ruin]

[rose wren]

I cap

[wicked summit]

i🧢

[primal perch]

node

[hasty ruin]

there's also this

but it isnt done yet

[primal perch]

c++

[hasty ruin]

and uh

[tepid olive]

C better

[hasty ruin]

L take but i like your name

[primal perch]

[lethal kayak]

@indigo peak wdym proc

[indigo peak]

to get root access

like kernelproc

or allproc

selfproc

[primal perch]

ok

very descriptive

[lethal kayak]

you use a patchfinder

or

you find a pointer into a proc struct and walk the linked list

[indigo peak]

no i need to pass it into a function

[indigo peak]

if i knew what i was doing id be able to explain it better

[lethal kayak]

maybe you should find that out before you try it

[indigo peak]

no

this is how i learn

[primal perch]

ah youre still in that i want to be a leet ios hacker stage

[indigo peak]

so for past jailbreaks and shit that get root user access, they work off of a proc to get the thingy

idk how to get the proc when using multicast_bytecopy

[primal perch]

probably struct proc

in the BSD part of the kernel

[indigo peak]

bdsm?

[lethal kayak]

well the old way was to steal the kernel's privileges from its proc struct and apply it to your own proc but im pretty sure that doesnt work anymore

havent done anything like this since ios 12

maybe read taurine source code

[indigo peak]

its in swift

ngl i dont wanna do that

[primal perch]

ok well

[indigo peak]

yes yes i know

[primal perch]

you have an option that may provide you the information

[indigo peak]

if i dont wanna do it

io shoudnt be denying

[lethal kayak]

it's the same thing basically

just read it

[indigo peak]

i did before

i didnt know what i was looking at

like i didnt know how to take whatr was there and implement it into my code

[primal perch]

i know virtually nothing about this either

i helped capt find a few offsets once and thats it

[indigo peak]

yeah well i got my offsets from capt

since idk what im doing

professional developr

[vivid dew]

ratio

[lethal kayak]

do you know how proc structs work

or are structured rather

[indigo peak]

nope

but if i say i do will you continue with what you were gonna say

[primal perch]

https://opensource.apple.com/source/xnu/xnu-2422.1.72/bsd/sys/proc_internal.h

[lethal kayak]

that

[primal perch]

https://opensource.apple.com/source/xnu/xnu-7195.81.3/bsd/sys/proc_internal.h.auto.html

newest one on the site

pretty sure this is like ios 14 era tho

[lethal kayak]

there's a linked list of all the procs at the beginning of the struct

so you can walk the list and read the pid to find the proc struct you're looking for as long as you know where one is

[hasty ruin]

light mode screenshot for any pedophiles in chat

[vivid dew]

this is a bigass struct

[primal perch]

pedos have now been eradicated

[hasty ruin]

(there are a few exceptions)

[primal perch]

ios 15 changed struct proc a lot btw

so you cant rely on half of that

[vivid dew]

probably need a whole page of ram to hold it

[lethal kayak]

in short, disassemble the ios 15 kernel

[primal perch]

yea

[indigo peak]

ok

i have it

disassembled

the kernel_cache

[primal perch]

great now you can start looking on functions that operate on struct proc

and you can fill in the gaps

[indigo peak]

deadass

like i know how to do that

[primal perch]

use the struct feature in IDA

[indigo peak]

ok

im there

[primal perch]

idk lets find a random ass function in the kcache

proc_lock

that operates on a proc struct

use the symbolicated one as a reference

you could also use bindiff

[primal perch]

and find the proc_lock in the ios 15 kernel

[primal perch]

now create a new one

named proc

and then while hopping between functions you can find what offsets correspond to what field

https://www.zynamics.com/bindiff.html

but really this shit will automate like 80% of functions for you

ive used it for 3ds binaries its very useful

but you will still need to do a lot of struct remapping

[indigo peak]

imma be real with you
i cant get passed this step

[primal perch]

does right click in the window work

otherweise just do it from the void * parameter in one of the functions

[indigo peak]

ok i got it

trying to get bindiff rn

[lethal kayak]

taurine source might be able to help you find the proc but if it’s really changed a lot in 15 the modifications to it might not be the same

¯_(ツ)_/¯

[primal perch]

intjshrug

intjstage

[indigo peak]

@primal perch so i made the proc struct and i installed bindiff

what should i do now

[primal perch]

run bindiff

comparing the symbolicated binary

[hexed knot]

I dismount your mom and i mount /proc

[primal perch]

best skin

[primal perch]

[indigo peak]

ok

im slow

ngl

[primal perch]

🤏

[indigo peak]

ok

fuck it

i dont knwo what im doin

[faint timber]

you have the generate the diff first

[indigo peak]

like this?

[wicked summit]

What if you struct procured some insert derogatory term

[lime pivot]

bitches

[vivid dew]

what if you were bitches

[primal perch]

Cock and balls torture

[hasty ruin]

🔨

??

[grim sparrow]

@hasty ruin why aren’t you asleep

[hasty ruin]

why aren't you asleep

[grim sparrow]

I was but I just woke up to puke

[hasty ruin]

oh

[grim sparrow]

I am sat on the floor of the bathroom

[hasty ruin]

L, i guess

i've been up till like 7 for the past 3 weeks or so

schedule a bit fucked

allow it 🙏

[grim sparrow]

I wake up at 7

[hasty ruin]

[grim sparrow]

Well

I probably won’t be tonight!

[primal perch]

[hasty ruin]

this morning*

[grim sparrow]

Shut

[hasty ruin]

is there a intjghostcum

YES

[grim sparrow]

I only had like 14 shots

[hasty ruin]

+ 🔨 =

[vivid dew]

wtf

[primal perch]

[primal perch]

COCKANDBALLTORTURE

[hasty ruin]

[restive ether]

secret service in shambles

[primal perch]

C++20

[thorny marsh]

hi

dumb question. Why do they read data of a file as uint8_t *?

[primal perch]

its raw bytes

uint8_t or unsigned char is the best data type for the job in c

[faint timber]

lmao

[thorny marsh]

cmao

[thorny marsh]

why

[faint timber]

mf asked why

[thorny marsh]

ye

i did

[faint timber]

this is nothing to do with c specifically, there is basic knowledge behind how computers operate and how it it translates to the human level

computers are binary right, so 0's and 1's. these are called bits
8 bits in a byte
so...
uint8_t -> 1 byte
uint16_t -> 2 bytes
uint32_t -> 4 bytes
uint64_t -> 8 bytes
uint128_t -> 16 bytes

since we want to read the data byte by byte, we use uint8_t which is is 1 byte aka a char

[thorny marsh]

why not char*?

not really

char* still used in some cases

[faint timber]

you can use char * just the same but all the cool kids use stdint types

[glacial matrix]

I was trying to think of a way to say that we use the smallest unit but then you have nibbles and bits, but what makes a difference is that most memory is only addressable in byte sizes, so uint8_t, generally the same size as char, is the smallest addressable size. Then the * just means it’s many of those

[rose wren]

C++17

[native dune]

wtf is that emote

[wicked summit]

Is there any difference between uint8_t and unsigned char?

Is it a typedef

[rose wren]

What’s wrong with it

[lime pivot]

_t signifies a typedef

[wicked summit]

Oh I never knew that

That makes a lot of sense

[lime pivot]

usually better to use the type that feels like it makes more sense in the context of what you’re using it for

even if it’s probably identical otherwise

although there are a handful of cases where the typedef exists because the underlying type differs across architectures/OSes

[wicked summit]

I see

I suppose a char isn't necessarily 8 bits

[tardy narwhal]

iirc uint8_t should only exist on platforms which define CHAR_BIT to be 8, however it can still be typedef'd to another integer type

you can find more about it in the C11 standard ref under section 5.2.4.2.1

or in a nutshell:
https://stackoverflow.com/a/16138308

[gentle grove]

wtf Vim

[rose wren]

Yeah

He loves bin

[zenith hatch]

coom

[primal perch]

⚪

[crude swallow]

whar

[drifting ermine]

Just wondering if anyone is interested in precompiled img4tool and other binaries for older than MacOS 10.15- I recently fixed ramiel on high Sierra

[restive ether]

in the year of our lord 2022 and people are still using high sierra

[rose wren]

I use Monterey

If you wanted to know 🙂

[native dune]

i use ventura

if you wanted to know 🙂

[midnight ether]

Is jailbreak for ios 15 being developed

[turbid fjord]

Not anymore since you asked

[midnight ether]

Damn

[primal perch]

sorry

[trail niche]

C standard moment

Literally only 1 system has not 8 bit char

Don’t worry about it

[wicked summit]

Texas Instruments moment

[hexed knot]

if you use 7bit ascii you deserve hell

[primal perch]

[gentle grove]

wasted a bit

c users malding

[primal perch]

based chad

[hasty ruin]

cpp > c

[wicked summit]

65c816 master race

[primal perch]

not true

but c++ is still good

so your opinion isn’t worth cringing over or debating

on some days i agree with it

[hasty ruin]

everyone knows php is the best language

[gentle grove]

memory leaks L

[rose wren]

No I didn’t

[hasty ruin]

Gotem!!!!

[faint timber]

we do a little trolling

[turbid fjord]

Omg omg Checkra1n ios 16??!! Wen eta

[crude swallow]

mojave better

[tepid olive]

Mojave is insanely old

Update your Mac

[primal perch]

fr

[crude swallow]

implying i own a mac

also it’s the last version to support wine

no one maintains the macos port of wine anymore, sad

[tepid olive]

Wineskin works

Lmfao

Did you even look it up

[crude swallow]

that’s a fork though isn’t it

cause i never heard of it

and officially it’s done

it’s either crossover or forks now

[native dune]

just pirate crossover

[restive ether]

ldid for windows

[tepid olive]

use my crossover crack 🤝

[restive ether]

now available on windows!

[tepid olive]

Based saurik

Bro hated build systems so much he puts everything in one file

[restive ether]

make.sh user

saurik wrote code like the average rug pull crypto dev

average zefram file

[tepid olive]

Send me all the Zefram files @grave sparrow

[restive ether]

should’ve wrote it with objc++

[tepid olive]

Please

Please

Please

Send me

Ok

Actually no you’re an adult

But

Please

😔

What does Zefram even use Assembly for

Isn’t it a hooking library

[restive ether]

we don’t need compiler optimizations

i am the optimization

[turbid fjord]

Cameren optimisations

[tepid olive]

Optimize your technique for finding bitches

[turbid fjord]

Any advice then?

[hexed knot]

Die

[crude swallow]

lmao

[indigo peak]

ok, a couple days later and i got my root

[naive kraken]

I have everything done already but one issue left, I can't seem to spawn a binary as root from the fakesigned app

and /var/containers needs root

[indigo peak]

oh :/

ok

[naive kraken]

well minus the installer

I'm testing some altstore like thing where you can open ipas and it installs them on 14 first

so I think an app that installs this on 15 would still be useful

[indigo peak]

ok, but would you need to reboot everytime you load up the app

[naive kraken]

no

[indigo peak]

wait

im dumb

lol

[naive kraken]

the app doesn't use a kernel exploit

[indigo peak]

i just realized after i said it

[naive kraken]

it runs as mobile but has an entitlement that allows it to spawn the helper binary as root

but… that doesn't work currently for some reason

[tepid olive]

Development

[naive kraken]

well I really only need allproc, proc->pid, proc->task, task->cred and cred->posix_cred

I have them for A15 15.1.1

[native dune]

@naive kraken which way would you uicache the app

i was attempting to permasign an app installed “as the user” jailbroken

to test

[indigo peak]

https://github.com/ProcursusTeam/uikittools-ng/blob/main/uicache.m#L123

with that

[native dune]

but pro’s uicache doesn’t work on appstore apps

[indigo peak]

i think thats what youre asking

[naive kraken]

any process that isn't sandboxed can run the uicache register function

it does you just need to force

[native dune]

oh

[naive kraken]

uicache -f -p

but it obviously only works because the app you add isn't actually an app store app

[native dune]

yeah

[indigo peak]

what even is platformization

[tepid olive]

Wait what are you trynna do

[indigo peak]

posix_spawn some bitches 😭

[tepid olive]

I'm gonna posix_spawn deez nuts in your mouth

[indigo peak]

:o

[indigo peak]

make a permasigner for iOS 15

[tepid olive]

I was

Then I started my job at Lockheed

[naive kraken]

everything in trustcase is "platformized"

but you can't add to trustcache without a PPL bypass

so you get the csblobs of the vnode of your process and set the platformized flag there

platformization checks are used in iOS to restrict functionality to only apple binaries

e.g. adding a launch daemon

[native dune]

how would you make the apps stay registered after a reboot

i was able to uicache -f -p it but it doesn’t stay

[naive kraken]

if it's in /var/containers/Bundle/Application then it does stay

[native dune]

(on my jailbroken device)

wtf

it’s in /var/containers/Bundle/Application/<random uuid here>/<app>.app

do i not need the uuid?

[naive kraken]

no

no

[native dune]

ohh

[naive kraken]

idk

[indigo peak]

how can i see if i do this right, like getting root you can do getuid

[naive kraken]

csops on yourself

there is a flag

CS_PLATFORMIZED

or something

[tardy narwhal]

@naive kraken I may get access to promon's shit in a few weeks, are you still up for breaking banking apps open?

[indigo peak]

now if only i knew how to use csops

[naive kraken]

what you mean? wouldn't that be legally questionable lol

[tardy narwhal]

the devs in some division contacted promon for a demo & pricing for their application, assuming they'll use it. Therefore I could peek inside

legally it's fine-ish

[naive kraken]

hmmm

I'm not sure if it's possible at all to bypas without a kernel level solution

[tardy narwhal]

when I peeked inside S-PushTAN/Sparkasse they reimplemented some basic functions & routines, but that's as far as I got before raging

Not sure how much more can be obtained while watching with xnuspy

[naive kraken]

well when tweaks are loaded it probably has it's own dyld parser

that fails the check

if the hooking framework is disabled fcntl ADD_SIGS or something fails

[tardy narwhal]

i'll diff all bins again

[naive kraken]

the problem is it does all syscalls through a ROP gadget in a system function

[tardy narwhal]

bruh

[naive kraken]

it's ucred->posix_cred or something

not proc

ucred->posix_cred is 0x18

for me at least

proc->ucred is 0xD8

well I like spaghetti code

[indigo peak]

A single spaghetti is a spaghetto

[tepid olive]

unsurprising message from tale development llc

[twilit jungle]

#development message

[rose wren]

is that your cat

[tepid olive]

nah i don’t even know where i got this picture tbh

i forget completely LMFAOO

my grandparents have a cat that looks like this…

idk

prob just some random image i found somewhere

[rose wren]

[tepid olive]

lmfaoo i used that as my pfp like a year ago on another account

[naive kraken]

well I think the helper binary needs to be installed into /private/preboot because /var/containers/Bundle/Application is too sandboxed

[native dune]

i didnt have that issue when i put it in /var/containers/Bundle/Application

it persisted after reboot

on my ios 14 device

but it wasnt a user app, it wasnt removable

so that might be an issue on ios 15

no i know it isnt an ios 15 issue, i mean it might not work right if it registers as a system app due to ssv?

not completely sure how uicache works

[naive kraken]

that's not true, /var/containers/Bundle/Application persists, /private/preboot does not

[hexed knot]

Lisp is dead and buried

Write in C

[crude swallow]

C is dead and buried

write in Cobalt

[hexed knot]

aint no way bro just said cobalt

its cobol bro

[gentle grove]

write in rust

[pearl sail]

not a stable lang

[gentle grove]

too bad

[tepid olive]

So true

[tepid olive]

Bruh why is this still alive

[primal perch]

same reason you are

it was fed and maintained

[vivid dew]

true (literally)

considering minting my virginity as an nft

[twilit jungle]

[vivid dew]

anyone want to buy it (you don't get the real thing, just the nft)

[gentle grove]

I found one of the quotes from the summer reading book for school minted as an nft

[wicked summit]

gm

[hasty ruin]

no

[wicked summit]

ok

[primal perch]

i love C++ so much

i love a robust language with stable ABIs, dynamic linking and a comprehensive standard library

[gentle grove]

i love rust so much

i love a memory safe and blazing fast language with no stable abi but a decent std

[primal perch]

BLAZING fast

[gentle grove]

yeah

[wicked summit]

I love python so much

I love a painfully slow interpreted language that's possibly overrated but promotes readability and has a library for everything so you never have to write real code

[primal perch]

true

[tepid olive]

put a space in the wrong place at the wrong time and behold be blinded by R E D

[crude swallow]

if you don’t like C, the door is over there —> Segmentation Fault

[crude swallow]

TRUE

[zenith hatch]

sexually transmitted disease wtf

[zenith hatch]

i love swift its fast and you have to write your own library 9 times out of 10

[hasty ruin]

Average swift user can’t spell “it’s”

[zenith hatch]

mf

[hasty ruin]

Also, “wrote”

[tepid olive]

https://github.com/mTvare6/hello-world.rs

Look at the issues tab and pull requests

[restive ether]

rust devs having 400 different depends

[faint timber]

[crude swallow]

If you don’t like C, the door is over there —> Segmentation Fault

[gentle grove]

I know

[gentle grove]

Unfortunately only like 5 of the dependencies are actually used

[crude swallow]

at least it still works™️

[naive sedge]

@cold prism, assuming you're the same as https://github.com/comex,
Very sorry for the ping, but I wanted to ask you about your project (https://github.com/comex/frash).
I see that it's for iOS 4.0 (and long dead), however, it seems to do something I can't find anywhere else:
load an android library on iOS. It seems like you wrote some kind of ELF loader, but for ARM32. I was wondering if perhaps you could explain how that works,
and how I might implement it on a modern version of iOS.

[native dune]

anyone know how to properly use tokens and paymentSecrets safely when setting up the sileo payment provider api? not sure where to save them/when to verify them and how

[primal perch]

do it in layoutSubviews

[trail niche]

I love C so much

I love a simple, fast, and widely used language with a stable abi and hundreds of thousands of libraries

[primal perch]

[trail niche]

No I’m serious

If I want OOP I’ll use objective C

And if I want scripting I use lua

I don’t need anything else

[primal perch]

i too, am serious

[trail niche]

What’s y’all’s favourite X toolkits?

Xmotif vs Xaw vs Xt vs Xview vs Xforms?

[crude swallow]

xdeeznuts

[primal perch]

not using X

"engineer"

nor hardware

nice fan apple

[gentle grove]

functional programming

[primal perch]

it apples defense when they moved to lightning in 2012 the standard was micro usb

which is dog

so id much rather lightning than that

na

its more complex

and extra stuff like that was expensive in the 1980s

yeah and it was tens of thousands of dollars

for the ram alone

also it had 4KiB of ram

dude was mind blowing ngl

[primal perch]

https://tenor.com/view/discord-moderator-discord-mod-luigi-luigi-dancing-gif-19490303

[hasty ruin]

https://tenor.com/view/discord-moderator-discord-mod-luigi-luigi-dancing-gif-19490303

[primal perch]

based

[hasty ruin]

https://tenor.com/view/mario-mods-discord-hypixel-moderators-gif-20487428

[primal perch]

who's on that Windows 10 21H2 19044.1889

[hasty ruin]

my main pc is on 21h2

[primal perch]

https://tenor.com/view/mario-mods-discord-hypixel-moderators-gif-20487428

[hasty ruin]

other pc is on ltsc 2021

[primal perch]

me flexing on macos users

[hasty ruin]

Updated opengl????

Impossible

[primal perch]

macOS users when they are stuck on 4.1

[hasty ruin]

just switch between devices

🧠

[primal perch]

true tr

=ue

true

[wicked summit]

256kb for such a large Hollywood production is wild 😮

[lime pivot]

eh you can make anything seem bad by bringing that up

[steady nest]

flex this ratio

[crude swallow]

you should see 256 kb demos

[serene ridge]

ew

[serene ridge]

i have a 3070ti but still ratiod

thats crazy but wha cpu

[steady nest]

5600sex

[tepid olive]

No

[native dune]

were you talking to me

if so, and if you weren’t joking, i’m talking about on the server side

[hexed knot]

layoutSubviews is the go-to function to hook

always hook it when you get the chance and do your shit in there

[weary heath]

And don’t bother calling %orig, it makes your tweak a bit heavier in size

[tepid olive]

diabolical

[naive sedge]

In a non-jailbroken app, can you load unsigned dylibs?

[twilit jungle]

[zenith hatch]

true

[hasty ruin]

thoes

[crude swallow]

toes

[hexed knot]

how do u tho

[foggy wharf]

Hey guys, apologies if this is the wrong place to ask this, but is it possible to replace assets inside of an app's Assets.car on a computer?

[hasty ruin]

https://github.com/insidegui/AssetCatalogTinkerer

[foggy wharf]

Thank you, but doesn't that only extract the contents?

[zenith hatch]

coom

[restive ether]

make a car extractor that doesn’t use coreui

[zenith hatch]

omw

[primal perch]

swift
coreui

[restive ether]

my balls

your jaw

any comment

[primal perch]

yeah sure