development

[primal perch]

[hardy hearth]

Ye still same issue, no clue what I am doing wrong now tbh

make works but not nic.pl

[restive ether]

where is nic.pl located

[indigo peak]

isDarkMode isnt a function

you dont have code defining it

[primal perch]

[hasty ruin]

you should put the required headers on the repo so people can actually compile it

[graceful gate]

Learn objc

[primal perch]

real

[tacit spade]

so I’ve got a weird issue

if I animate in the Home Screen before unlocking (but after authenticating) the device

widgets don’t show up

i suspect this is an edge case that apple had no reason to consider

and it’s probably related to suspension

but unfortunately after you unlock the device the widgets don’t show up

until you scroll a page over

any uh

pointers?

[hardy hearth]

declaration of 'NSString' must be imported from module 'ObjectiveC.NSObject' before it is required What do I need to fix this?

[primal perch]

link Foundation

[hardy hearth]

Thanks

[onyx pulsar]

hello sorry if this is a dumb question but i'm trying to install a .ipa file into /var/jb/Applications on xinaA15, are there more steps involved other than extracting the .app from the .ipa file? because the app just crashes on launch when i do that

just tried it on my palera1n device at /Applications and same thing happens. doesnt seem to be a crash report either

[lapis vessel]

anyone tried making a daemon for XinaA15? Do people know if plists at /var/jb/Library/LaunchDaemons are automatically loaded? I'm presuming the jailbreak won't fix up the Program field in the plist to point to /var/jb either so the package will need to fix that up in the postinst or something?

[onyx pulsar]

nvm i think it was just the permissions, setting it to 755 fixed it on palera1n but on xina it caused every app to freeze on launch

[spice egret]

Does anyone know how I can get started with tweak development?

[onyx pulsar]

yep did that

[hasty ruin]

#development message

[minor silo]

This aged like milk

[cursive rampart]

it became fine cheese

[high citrus]

Would it be possible to backport a specific framework (AVFCore.framework) from iOS 15 to iOS 14?

[high citrus]

ah alright, so no easy/automated way

[naive kraken]

cranehelperd runs fine for what it's worth

although I had to insert some jbd calling code to get platformization

(I'm unsure about /var/jb, I added that but I think it worked without it before)

[lapis vessel]

oh interesting

I think I'll need to test things out for myself tbh

where did you find information about the jbd platformization code?

[naive kraken]

from xinas dms

void open_xpc_client()
{
    if (connection==NULL)
    {
        dispatch_queue_t  private_queue = dispatch_queue_create("org.xina.jailbreakd.client", DISPATCH_QUEUE_CONCURRENT);
        
        connection = xpc_connection_create_mach_service("jailbreakd", private_queue, 0);
        if (!connection) {
           // //NSLog(@"Failed to create XPC connection.");
            return;
        }
        else
        {
            xpc_connection_set_context(connection, &private_queue);
        }
        xpc_connection_set_finalizer_f(connection,xpcrelease);
        
        xpc_connection_set_event_handler(connection, ^(xpc_object_t event) {
            xpc_type_t type = xpc_get_type(event);
            if (type == XPC_TYPE_ERROR) {
                
                connection=NULL;
                //NSLog(@"正在断开退出.");
            } else {
                //NSLog(@"Unexpected XPC connection event.");
            }
        });
        
        xpc_connection_resume(connection);
        
    }
    
}

void xpc_fixProc(void)
{
    open_xpc_client();
    if (connection)
    {
        xpc_object_t message = xpc_dictionary_create(NULL, NULL, 0);
        
        xpc_dictionary_set_uint64(message, "pid", getpid());
        
        //NSLog(@"send fixOurProc %d",getpid());
        xpc_dictionary_set_bool(message, "fixproc", true);
        xpc_object_t event=  xpc_connection_send_message_with_reply_sync(connection, message);
        
        if (xpc_dictionary_get_uint64(event, "ok")==1314)
        {
            //NSLog(@"收到回复fixproc完成");
        }
        else
        {
            //NSLog(@"收到回复错误");
        }
    }
}

this is the code I was sent

but keep in mind you also need jailbreakd in com.apple.security.exception.mach-lookup.global-name entitlement for this to work

[lapis vessel]

gotcha, and I don't need to change anything in my launchdaemon plist or where it's stored?

[tacit spade]

whatcha tryna do?

[tepid olive]

frcoal tweak development guide

still the best to date

[faint stag]

true

no development = best development

[tepid olive]

i find it causes the least issues too

[indigo peak]

shut up

[primal perch]

on your

god

[lyric loom]

[primal perch]

jew man

[naive kraken]

no

(I mean where it's stored not, but as I said idk if you need to put /var/jb in front of the binary path or not, maybe test it out)

for better or worse, xina does a lot to maintain compatibility with non rootless stuff, heck the bootstrap it uses wasn't even compiled for rootless

[lapis vessel]

What do you do in crane, dynamically swap out the binary path at install-time?

[naive kraken]

No I just changed it to /var/jb now for testing

but I never actually checked if it works without it

[lapis vessel]

Fair enough, I'm tempted to release a "Cr4shed (Rootless)" tbh

[naive kraken]

actually I can check if crashedd starts in the current version

[lapis vessel]

Well atm I don't platformize the binary so I doubt it, but you can try

[naive kraken]

platformization is only needed for some specific stuff

like I do stuff with task ports in cranehelperd so I needed it

seems to start as you can see

[lapis vessel]

Oh that's awesome!

Ok I'll try and get something working for XinaA15 soon then

[primal perch]

john xina

https://tenor.com/view/social-credit-social-credit-score-meme-john-xina-gif-23649557

[naive kraken]

might be useful: https://pastebin.com/35HiESYk

xina installs everything into /var/jb as root path but also does a bunch of stuff already to support old packages

but I would still recommend putting all stuff you access in / into rootifyPath or rootifyCPath

[lapis vessel]

Thx opa, how would you like to be credited in a comment with that code?

[naive kraken]

you don't really need to credit me

[lapis vessel]

I'll just put //thx opa334 lol

[naive kraken]

this code is free to use tbh, I just want people to use it because it works around an issue where on some old u0 builds /var/jb points to /jb

So if you try to implement this yourself you'd break support for people that still have this symlink

(like I did before I found out about this because luckily my friend had such a device)

[lapis vessel]

If I was implementing this myself I'd do "if (full path in /var/jb exists) choose that else choose the path in /" probably

Finding the root path for the whole jailbreak is nicer tho

[naive kraken]

yeah that could work too

I think you could just check if what you're looking for exists in / and otherwise append /var/jb

but in the end it doesn't really matter how you do it

[high citrus]

Was asked to look at an AirPods Pro issue on iOS 14, microphone doesn’t seem to be working, but works on other devices. So my thought was to replace the glitchy framework with the fixed/updated framework. But since it isn’t easy I’m not gonna continue researching it.

[tepid olive]

Good luck replacing a framework

[lime pivot]

yeah it’s not easy. possibly not even possible any more except on check/palerain

[faint stag]

i mean, isn't that done already?
i'd assume xinaa15 just has both architectures by default

and if a package does support both, then i'd expect a preinst to move stuff to the right install dir i think

[ocean raptor]

Nope

You expect way too much from xina

[faint stag]

what's wrong with 1800

i mean it would be the same result but still

[faint stag]

wait then i'm confused, if it's just iphoneos-arm then wouldn't apt just not find the architecture in a rootless-only repo

[ocean raptor]

They don't use the rootless

They use the normal repo

[faint stag]

no, i mean if you were to add a repo like palera1n's one

[ocean raptor]

But force everything to run dpkg with --instdir=/var/jb

[restive ether]

you are expecting too much out of a guy who didn't ask anyone before doing anything that they did

[ocean raptor]

It would be like if you added that repo to checkra1n

It would say "unsupport architecture" or something like that

[restive ether]

didn't need to do anything to have a dangerous and unsafe thing in saily

[ocean raptor]

https://github.com/SailyTeam/Saily/issues/104

💀

[restive ether]

I must say I'm impressed

[ocean raptor]

This whole thread is ridiculous

Lakr doesn't seem to realize that the point of gui package managers is to baby it's users, because they're dumb

[restive ether]

the denialism is crazy lol

they don't even seem to understand apt at all

they definitely didn't read docs in full

@lime pivot sorry that you also had to read that man

[elder scaffold]

Does xina15 redirect all paths to /var/jb?

tweak etc

[restive ether]

yeah

but he so made paths of his own for some reason

[elder scaffold]

ooh

[untold drift]

when i analyze an app in IDA, i found a subswift class in a class. but that class not in dump headers.
e.g: App.Foo.Bar.init(params)

how can i hook that function ? i tried to access with objc_getClass and %hook but looking not working

[tepid olive]

One thing you could do is make a posix spawn hook and edit the mach header after spawning suspended

Or custom dyld

[ocean raptor]

Checkra1n already patches dyld

[nova geyser]

So how did you solve it?

[snow fjord]

oh i just removed all the yes/no questions

if you’re talking about fi you have to put # /usr/bin/bash at the top

something like that

[tardy narwhal]

pointless hate

[ocean raptor]

Pointless hate on saily?

[tardy narwhal]

imo yeah, the point outlining if users install incompatible tweaks and it forces to uninstall Essentials upon uninstalling, that's purely a users fault and still shows how some users disregard reading compatibility

[restive ether]

the problem is this jailbreak also encourages incompatibility

by actively forcing shit to attempt to worn

and ontop of that saily actively allowing it

[ocean raptor]

Opening an issue on saily saying "this software sucks" is a little rude, but warning users about the issues that saily can cause is justified imho

[tardy narwhal]

I agree with that but it just feels a little over the top

pure elitism

[ocean raptor]

When is someone going to create a jailbreak that uses aptitude as the default package manager

aptitude-swiftui

[tardy narwhal]

someone probably could and get ridden into the ground immediately because of "established methodologies"

[tepid olive]

get the swift symbol and use c function hooking

[lime pivot]

extremely rude I’d say

like, don’t ever do that

but otherwise the concerns are reasonable

[naive kraken]

I need a bashismless shell script to essentially emulate a call to getRootPath https://pastebin.com/35HiESYk and save that in a bash var, if anyone has done something similar already, please let me know, I suck at shell scripts, even more at bashism less ones

[restive ether]

@ocean raptor this seems like your field

[ocean raptor]

See, I was going to

Then I decided not to

[indigo peak]

export rootPath=""

function getRootPath {
    if [[ -L "/var/jb" ]]; then
        # get symlink target
        destination=$(readlink -f /var/jb)
        if [[ "$destination" != /jb ]] && [[ "$destination" != /jb/ ]]; then
            export rootPath="$destination/"
        fi
    fi

    if [[ "$rootPath" == "" ]]; then
        export rootPath="/"
    fi

    echo $rootPath
}

getRootPath

source ./getRootPath.sh

$rootPath holds the rootpath

[ocean raptor]

That's bash dude

He wants POSIX sh

[indigo peak]

whats the difference

i legit dont know

[primal perch]

one is bash one is sh

[indigo peak]

bruh

im sorry i even tried

[primal perch]

dont be

tone is difficult to interpret on the internet and it was likely not meant to degrade you

[cloud yacht]

what if I just mkdir /var/jb on a rooted device?

[indigo peak]

it looks for a symlink

[cloud yacht]

ln -s / /var/jb

[faint stag]

bruh

[ocean raptor]

can someone send me /Library/Developer/CoreSimulator/Profiles/Runtimes/iOS 14.5.simruntime/Contents/Resources/RuntimeRoot/bin/launchctl

[faint stag]

how do i obtain the 14.5 simruntime

[primal perch]

gorn.dev

[ocean raptor]

export rootPath=""

getRootPath() {
    if [ -L "/var/jb" ]; then
        # get symlink target
        destination=$(readlink -f /var/jb)
        if [ "$destination" != "/jb" ]; then
            export rootPath="$destination/"
        fi
    fi

    if [ "$rootPath" = "" ]; then
        export rootPath="/"
    fi

    echo $rootPath
}

getRootPath

but

readlink is not POSIX

so

[indigo peak]

i dont get it

[restive ether]

what part do you not get

[ocean raptor]

I doubt he knows what POSIX is

[restive ether]

oh like the entire thing

[indigo peak]

shut the fuck up

[faint stag]

i mean, he said bashismless, not posix

^

[ocean raptor]

bash without bashisms is posix sh

[faint stag]

yes, but you don't need bash for readlink

[ocean raptor]

Shut up

[faint stag]

looks fine, other than not quoting the variable in echo and using function instead of getRootPath ()

yeah, function is a bashism

[ocean raptor]

Run it through shellcheck

[faint stag]

i did

https://www.shellcheck.net/wiki/SC2113

[ocean raptor]

👍

[sly knoll]

i want build zebra2

how do i fix this error

[gentle grove]

fr coal

[ocean raptor]

what does SUB168() in ghidra decompiler output mean 🥺

[primal perch]

SUB168

[faint stag]

going to assume that means subroutine

[tacit spade]

wait really lol

I think I had this issue at one point

[neat knoll]

Has anyone compiled node higher than v12?

[cloud yacht]

I think procursus has v14

[ocean raptor]

How do I check the iOS version in C?

should I use if (floor(kCFCoreFoundationVersionNumber) >= 1800)

[faint stag]

ye cfversion seems best

[primal perch]

probably

since you have corefoundation though theres a neat (undocumented) function CFStringRef CFCopySystemVersionString();

returns Version 12.6.1 (Build 21G217) on mac for me

worse really bc private api but if you want a nice display name

[faint stag]

i guess you could do what sw_vers does (whatever that is)

[high citrus]

Did you find a fix for it?

[sly knoll]

i joined zebra discord before. but i dont know how to find the branch

thanks!

i try it!

[naive kraken]

thanks that looks usable

[ocean raptor]

Run it through shellcheck too

[faint timber]

https://twitter.com/ios_euphoria/status/1603190356597768192?s=46&t=I2PIXXj0YgBR6GccL6oR9g dmca this fool, tryna sell a gui

[tepid olive]

the app is 1gb

[hasty ruin]

https://twitter.com/ios_euphoria/status/1603232702924300289

Euphoria ❄️ (@ios_euphoria)

@jbvq19 @iM4CH3T3 IM JOKING. It will be free!

Twitter · Dec 15, 2022, 3:37 AM

They said foss

[faint timber]

All the braindeads in replies thinking they made the actual jailbreak

[hasty ruin]

Ofc

[elder scaffold]

Is there a way to prevent the substitute injector from injecting into specific processes?

[lime pivot]

I mean it'd work, as long as it's pointing to /

[onyx ember]

This should be done as an april fool prank lol

[pallid iris]

Is there any info on how to connect to SSH on a device running Palera1n?

[timid furnace]

OpenSSH server is installed with the bootstrap

[ocean raptor]

ssh mobile@deviceip

[timid furnace]

If you need access before bootstrap install you're going to have to boot an SSH ramdisk

[pallid iris]

Is it on port 22? I tried to iproxy it and had nothing.

[pallid iris]

Nope, this is after the bootstrap and I installed OpenSSH.

[timid furnace]

Open tips or the palera1n app and run do all

[restive ether]

22 / 2222

if you're using ssh from an app on the device then use 2222

[pallid iris]

Thanks all, going to give it a try.

[timid furnace]

@tepid olive do you mind explaining what pieces of ellekit I need on iOS and where to put them? I was abusing substitute's loader before so I don't really know

[ocean raptor]

#781041045760770049 message

[fathom snow]

Is there a good guide for tweak development with swift?

[ocean raptor]

@grave sparrow is that vm_allocate(mach_task_self(), &addr, round_page(arg1), 0xf0000003)?

[pearl sail]

I am sorry sir I am developing my own libcolorpicker it will be trash, but it shall be my trash

No I won't add it as a package dep until 6 or 7 months down the road

[primal perch]

POV binja user

[timid furnace]

wtf does "wrong platform to load into process" mean

[ocean raptor]

the issue was that I forgot a 0 💀

[ocean raptor]

only cause ghidra makes weird choices sometimes

cloud.binary.ninja is my backup

[ocean raptor]

@grave sparrow Mr cbt, please review https://github.com/ProcursusTeam/launchctl/commit/07c225255d3b9d2c5234dfae138ecf169c306705 🙏

[pearl sail]

README dev reviewing launchctl moment

[tepid olive]

sure

where are you at now, i suppose you tried it already

[timid furnace]

so uh

i have managed to break my jailbreak 3 times now

i'm going to do what i've been doing step by step with reboots in between and see where it breaks

aaaaand i clobbered my fs again

ffs

[ocean raptor]

Classic palera1n

[timid furnace]

i think i'm just skill issuing with rsync

[ocean raptor]

rsync is very easy (I mess up the flags all the time)

[timid furnace]

i keep clobbering /etc

[ocean raptor]

Just remember, if there is a / at the end of the source path it's copying the contents, if there is no / it's copying the dir

[timid furnace]

yea i had that from the beginning

 -K, --keep-dirlinks         treat symlinked dir on receiver as dir

this is prob what i need

ffs it's stalling during boot again

ugh

[tepid olive]

@timid furnace you need to get rid of substitute

it bootlooped me when i tried to bundle ellekit

my test device just doesn’t work anymore now

[restive ether]

that's epic

John Xina

[timid furnace]

this is first boot after restore rootfs

[tepid olive]

palera1n when

[timid furnace]

i am on palera1n

[tepid olive]

use doras thing

[timid furnace]

what is doras thing

[tepid olive]

ayakurame or something

might not even work with ellekit cuz it overrides launchd

[timid furnace]

well you see

16GB moment

[tepid olive]

nvm it does

[tepid olive]

Lmao

[timid furnace]

maybe i should just update the 6s to iOS 15

[tepid olive]

I should actually test ellekit on iOS myself

i have 2 test devices

[timid furnace]

here we go again

[tepid olive]

lmao

Hi Capt

Tell us

[timid furnace]

btw do i need to fakesign loader with task_for_pid-allow and platform-application

[tepid olive]

yes

dimentio entitlements

[timid furnace]

well for the few seconds i managed to run it an hour ago i got loader: no task for pid access

[tepid olive]

hydrate managed to run it

you also need to run as root

[timid furnace]

so i'm gonna assume i need the entitlements

i am root

[tepid olive]

yes

[timid furnace]

i will go add signing script

[tepid olive]

Make sure to put pspawn in the /usr/lib dir and substrate in /usr/local/lib and /usr/lib

Because I forgot to add the iOS path to the launchd hook

smart

i dont forward injection personally

[restive ether]

https://github.com/ProcursusTeam/Procursus/blob/main/build_misc/entitlements/dimentio.plist

[timid furnace]

oh i ended up changing the paths bc they were inconsistent

launchd hook had /usr/local/lib, loader had /usr/lib so i just changed both

finally

[ocean raptor]

Parent only injection

Skip children

What

Yes

[restive ether]

joe

[ocean raptor]

Just make sure my vm_allocate usage and stuff is good

[timid furnace]

@tepid olive ```
iPodSE:/etc/rc.d root# ./ellekit-loader
[+] got task 2563
zsh: trace trap ./ellekit-loader

dhinak@Dhinaks-MacBook-Air ellekit % atos -o '/Users/dhinak/Documents/Others/ellekit/build/Release-iphoneos/loader.dSYM' -l 0x1006e8000 0x1006ede9c
main (in loader) (main.swift:68)

it dies at ```swift
return UnsafeMutableRawPointer(bitPattern: UInt(page_address))!

https://github.com/evelyneee/ellekit/blob/main/loader/launchd.swift#L16

[tepid olive]

u probably have the wrong entitlements

it worked for @torn oriole tho

[timid furnace]

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>get-task-allow</key>
    <true/>
    <key>task_for_pid-allow</key>
    <true/>
    <key>platform-application</key>
    <true/>
    <key>com.apple.private.kernel.get-kext-info</key>
    <true/>
    <key>com.apple.private.security.no-container</key>
    <true/>
    <key>com.apple.security.iokit-user-client-class</key>
    <string>AppleMobileApNonceUserClient</string>
</dict>
</plist>

[tepid olive]

Is there a pspawn.dylib at the path you set

[timid furnace]

(i stole the dimentio entitlements)

[tepid olive]

And a libsubstrate in /usr/lib

[timid furnace]

yes

i think page_address is null

for some reason

[tepid olive]

Bad kpf patches then

Launchd is missing cs debugged

@tepid olive Any idea what causes this?

What ios are they on

[timid furnace]

15.6 RC

[tepid olive]

How is it still signed

Wild

[timid furnace]

[+] got task 4867
[+] loader: about to run alloc func
[-] loader: about to alloc func?
[+] loader: page address before mach_vm_allocate: 0
[+] loader: page address after mach_vm_allocate: 0
[+] loader: finishing alloc func
[+] loader: page address before ret: 0
zsh: trace trap  ./ellekit-loader

pro debugging

[tepid olive]

Yeah this is because of CS_DEBUGGED

Semi untethers have this issue, they use kernel rw to change the cs blob

You have to get launchd to enable jit ents

[timid furnace]

i uh

have no clue how to do that so

[faint stag]

this is clever, but stupid yet i did it anyway

swVersion=$(sw_vers -productVersion)
rawVersion="${swVersion//./}" # strip decimal | 12.0 --> 120
if [[ ${#rawVersion} -eq 3 ]]; then
rawVersion="${rawVersion}0" # 121 --> 1210
elif [[ ${#rawVersion} -gt 4 ]]; then
rawVersion="${rawVersion}.${rawVersion:3:5}" # 10.12.6 --> 1012.6
fi

versCheck=$(bc <<<"${rawVersion} < 1210 ") #

# insert if statement here

[ocean raptor]

sort -v

[indigo peak]

i cannot get prefs to work on ios 15

for whatever reason

[tepid olive]

more info? what exactly isn’t working

[indigo peak]

like the tweak doesnt reflect the changes of the tweak

i tried using both hbprefs and a function written to read the pref file

[tepid olive]

but it works on other versions of ios?

[indigo peak]

and neither works

[indigo peak]

when i made it on 14.3 it worked then

[tepid olive]

nsuserdefaults never fails that’s all i’m saying 💯

[tepid olive]

hbprefs is cephei yeah?

[indigo peak]

yeah

[tepid olive]

i mean if hbprefs isn’t working and reading the preference file isn’t either it’s likely there’s another underlying issue

[indigo peak]

and now the actual bundle wont even load

lmaooo

[tepid olive]

😭

[tepid olive]

id advise checking if the preference file’s contents are actually being changed

[indigo peak]

i gotta get it loading first 😭

[tepid olive]

and making sure you are using the same identifier in your preferences and when you’re using hbprefs

[tepid olive]

keep in mind cfprefsd might cache the changes and not write it to disk instantly to minimize io operations

(depending on how you’re doing it in the preference bundle)

[indigo peak]

brooo

wtf

I can’t get it to work anymore

shouldnt it automatically ldid

when you do make package install

[ocean raptor]

Classic, fiore not reading

[indigo peak]

ldid what part of it

[restive ether]

brother 😭

[twilit jungle]

[restive ether]

Christmas ghost

[indigo peak]

bro can everyone just shut the fuck up

i get it

im a r slur

[twilit jungle]

[ocean raptor]

💀

Will it filter my message if I say the f slur too?

[twilit jungle]

[ocean raptor]

You

[indigo peak]

dont think it is

no wait

it is

im slow

so cephei isnt reading the change

[ocean raptor]

Not necessarily

[indigo peak]

what else could it be

[primal perch]

wtf

dghost is here

[ocean raptor]

That's like when people chmod in postinst

[primal perch]

based tbh

cope

[faint stag]

what's wrong with that

[primal perch]

[cloud yacht]

Just compile the tweak in the postinst

[primal perch]

real

[indigo peak]

how could i use killall on ios 15 but also make it work on 14

- (void)apply {
    pid_t pid;
    const char *argv[] = {"killall", "MobileSMS", NULL};
    posix_spawn(&pid, rootifyCPath("/usr/bin/killall"), NULL, NULL, (char *const *)argv, NULL);
}

isn't working

[vivid dew]

idk

[ocean raptor]

💀

[ocean raptor]

posix_spawnp

[tepid olive]

id be surprised if it was a cephei issue
are you sure you’re using hbprefs correctly

[indigo peak]

yeah

im 99% sure

i changed it to use my own function

[tepid olive]

you should investigate the 1% possibility then /s

[indigo peak]

true

[indigo peak]

ty

[indigo peak]

it has like a 50/50 chance of working

[ocean raptor]

Ok&?

Yet everybody says I'm in your mom

[indigo peak]

rootifyCPath(char *path) returns path with the root appended to it
so for a rootless jb it appends /var/jb
and for a regular jb it just appends /

NSString* getRootPath(void) {
    static NSString* rootPath = nil;

    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^{
        NSFileManager* fileManager = [NSFileManager defaultManager];
        NSDictionary* attributes = [fileManager attributesOfItemAtPath:@"/var/jb" error:nil];
        if(attributes) {
            NSString* fileType = attributes[NSFileType];
            if([fileType isEqualToString:NSFileTypeSymbolicLink]) {
                NSString* destination = [fileManager destinationOfSymbolicLinkAtPath:@"/var/jb" error:nil];
                if(![destination isEqualToString:@"/jb"] && ![destination isEqualToString:@"/jb/"]) {
                    rootPath = destination;
                }
            }
        }
        if(!rootPath) {
            rootPath = @"/";
        }
    });

    return rootPath;
}

NSString* rootifyPath(NSString* path) {
    return [getRootPath() stringByAppendingPathComponent:path];
}

const char* rootifyCPath(const char* cPath) {
    NSString* path = [NSString stringWithUTF8String:cPath];
    return rootifyPath(path).fileSystemRepresentation;
}

i knew i shouldve trusted the chinese code

//system函数执行命令的替换方法
extern char **environ;
void run_cmd(char *cmd)
{
    pid_t pid;
    char *argv[] = {"sh", "-c", cmd, NULL};
    int status;
    status = posix_spawn(&pid, "/bin/sh", NULL, NULL, argv, environ);
    if (status == 0)
    {
        if (waitpid(pid, &status, 0) == -1)
        {
            perror("waitpid");
        }
    }
}```

idk tell that to opa

wait

so should i just manually replicate the code for the function

[tepid olive]

good

[timid furnace]

old unc0ver thing or something

[timid furnace]

here

let's just make a plist with the details of the jailbreak

name, version, rootless key if rootless, etc

[ocean raptor]

? Why is dyld acting based off the symlink path? Any sane software will go based off the real path

[indigo peak]

json

[ocean raptor]

CF

[timid furnace]

^

[ocean raptor]

CF is loaded into libSystem nowadays anyway iirc

Based!

Force sbingner to add libiosexec to elu

Ok

Palera1n made /.installed_palera1n a json file 💀

That's so much worse than plist

And how is that an issue?

[ocean raptor]

(iOS has multiple plist parsers: cf, foundation, expat, and xpc, but only one json parser: foundation)

Who tf is scanning the loaded libraries?

I had mistaken foundation using libswift for libSystem using CoreFoundation 💀

Brain fart

Gonna rewrite launchctl is swift

I should rewrite defaults in swift

Or netctl

Speaking of swift

@marble perch please fix shshd, building it is broken with swift 5.7 iirc

[ocean raptor]

I know that building it is broken, I don't know if 5.7 is the reason

I have a better method: Architecture: iphoneos-arm64

Wdym?

Procursus will never distribute a rootless Architecture: iphoneos-arm (this is not armv7 only), so they have no choice

I agree

Procursus 1800+ is rootless only

Tell that to xina

[grim sparrow]

so true

[ocean raptor]

Wrong. There's 1 standard, but it's the dumbest standard ever

And everyone has Stockholm syndrome to daddy saurik

[tepid olive]

@naive kraken What would be the best way to lookup tweak bundles from a sandboxed app

I have full launchd code exec and code exec to all children

read the plist and the path

maybe this should be done in launchd

yes

i’ll just handoff to launchd

read the plist from there

[ocean raptor]

Isn't that substituted's job?

[tepid olive]

I don’t want a daemon

[naive kraken]

no

[tepid olive]

I’ll do it inside launchd

Nvm

[tepid olive]

he’s right i think

[ocean raptor]

💀

What does substituted do then?

[tepid olive]

substituted looks up the bundles

[naive kraken]

on old unc0ver builds /var/jb points to /jb and when you don't exclude your code breaks on the devices that have this symlink

[tepid olive]

and handles safe mode

[naive kraken]

no clue, caches pages or something

what do I know

[ocean raptor]

Well you seem to know what it doesn't do

[tepid olive]

you should read the code on github

[naive kraken]

spoiler: it's closed source

[ocean raptor]

substituted is open source?

[tepid olive]

ah right

that’s the old one

[ocean raptor]

My question is: how is that legal?

[naive kraken]

Ok so @tepid olive do you want to know how current hooking frameworks do this or what I would say would be the best solution

[naive kraken]

idk I think it is

just the part they modify (libsubstitute) is open source

[tepid olive]

latter

[ocean raptor]

Is libsubstitute not GPL? Does substituted not link libsubstitute?

[tepid olive]

i'd rather not do it through this

not inject in every process

[naive kraken]

https://github.com/comex/substitute/blob/master/LICENSE.txt

[tepid olive]

https://github.com/evelyneee/ellekit/blob/main/injector/injector.swift @ocean raptor wanna rewrite this in C

90 loc

Just parses the bundles

[naive kraken]

ok so would I would say is: parse the macho in launchd, get all framework identifiers it links against (you can take some code or inspiration from Choicy if you want, it does just this in it's pref bundle). Then enumerate through the plists and find matches.

and if no match, don't load anything

and if one or more matches, load your loader

[tepid olive]

that's what i thought

why parse the macho

[naive kraken]

cause you can filter bundles

like e.g. if I filter com.apple.uikit

[ocean raptor]

So LGPL, if substituted static links libsubstitute we can ask sbingner to OSS it

[tepid olive]

ah right

[naive kraken]

my dylib injects into all processes that link uikit

[tepid olive]

ffs

forgot about this

[ocean raptor]

I have no idea if he uses anything from libsubstitute in substituted though

[naive kraken]

it definitely does not I think

nothing really links libsubstitute I think

only tweaks do

so loader dylib load tweaks and the tweaks then load substitute

or rather via substrate shim idk

[ocean raptor]

Using xpc or CF?

[naive kraken]

you can also filter classes, but that's shitty af and basically no1 does it and also impossible to predict

so I would say don't support that

basically the check in the loader dylib is whether NSClassFromString gives something back lol

[ocean raptor]

Add support to filter for any app

[naive kraken]

or rather objc_getClass

[tepid olive]

CF

[ocean raptor]

Filtering for UIKit is dumb, since you catch other things that are not apps

[naive kraken]

yeah but make it optional somehow so that I can both support this and fall back to com.apple.Foundation on other injection frameowrks

[naive kraken]

yes, but filtering UIKit isn't even enough

[tepid olive]

How can you even find a bundleid for a framework

[naive kraken]

if you want to truly inject into every app you need to filter Foundation

[ocean raptor]

It's in the code sig

[naive kraken]

because there is, and I kid you not, some apps that don't link UIKit

[tepid olive]

do u know how to parse that

[ocean raptor]

Or check the plist

[ocean raptor]

Sadly

[naive kraken]

I do it by one path back and then parse info.plist I think

[tepid olive]

lawful neutral

[tepid olive]

cursed

[naive kraken]

but idk

[tepid olive]

pls do it then

[naive kraken]

Check Choicy code

it has all of this

[ocean raptor]

No

[tepid olive]

smh

fine

can u do just the tweak plist parsing

[restive ether]

he's too busy making launchctl 2 sorry

[naive kraken]

https://github.com/opa334/Choicy/blob/master/Preferences/CHPMachoParser.m

[ocean raptor]

No, I'm far away from my computer

[naive kraken]

I can make a C dylib loader if you really don't want to do it yourself lol @tepid olive

[ocean raptor]

Where even is substituted?

[naive kraken]

that code needs some rework tbh

[tepid olive]

I will do it eventually I just despise CoreFoundation

Ideally I'd only use the stdlib

Is there even a libSystem xml parser

[naive kraken]

When you make it, don't forget to sort dylibs alphabetically

[tepid olive]

@ocean raptor you'd know

[ocean raptor]

xpc

[naive kraken]

really important for determistic order

[tepid olive]

huh?

How would you parse a tweak xml with xpc

[ocean raptor]

you can create an xpc dictionary from a plist

[naive kraken]

CFDictionaryRef is your friend

xpc dictionary is objc

[ocean raptor]

No?

[naive kraken]

(afaik)

[tepid olive]

I would love something that doesn't inject anything more into launchd

[naive kraken]

it definitely uses arc and objc internally

[naive kraken]

Yeah as I said, parse macho in launchd

you have no other option

[ocean raptor]

Ok&?

[tepid olive]

these are fine

[naive kraken]

that's completely irrelevant

[timid furnace]

Can you use CFBundleCreate and CFBundleGetIdentifier

[tepid olive]

i don't wanna dlopen other things

[naive kraken]

some lib injecting into launchd won't kill you

[tepid olive]

fair enough

[tepid olive]

yea

[naive kraken]

some lib injecting system wide into every process because your system wide injector library links it is way worse

[tepid olive]

true

i don't wanna have an injector ideally

[naive kraken]

I already gave you the solution

[tepid olive]

yep

i will do that

thank u

[ocean raptor]

Your injector should be limited to only libSystem (+ it's reexports)

[naive kraken]

honestly you can probably calculate all injecting tweaks for a binary in launchd and pass it to the process via an env variable

then make your loader inject via DYLD_INSERT_LIBRARIES

and then the loader reads that env variable and loads the dylibs

[timid furnace]

CFPropertyListRef CreateMyPropertyListFromFile(CFURLRef fileURL) {
 
    // Read the XML file
    CFDataRef resourceData;
    SInt32 errorCode;
    Boolean status = CFURLCreateDataAndPropertiesFromResource(
               kCFAllocatorDefault, fileURL, &resourceData,
               NULL, NULL, &errorCode);
 
    if (!status) {
        // Handle the error
    }
    // Reconstitute the dictionary using the XML data
    CFErrorRef myError;
    CFPropertyListRef propertyList = CFPropertyListCreateWithData(
                          kCFAllocatorDefault, resourceData, kCFPropertyListImmutable, NULL, &myError);
 
    // Handle any errors
 
    CFRelease(resourceData);
    CFRelease(myError);
    return propertyList;
}

File to plist in corefoundation idk if you need this but
https://developer.apple.com/library/archive/documentation/CoreFoundation/Conceptual/CFPropertyLists/Articles/Saving.html#//apple_ref/doc/uid/20001175-CJBEHAAG

[naive kraken]

and in launchd yeah use corefoundation it's not that bad

[tepid olive]

ty

[naive kraken]

also you can borrow code from choicy

[tepid olive]

i think i'll use choicy's mach-o code yeah

i am not a jailbreak infra connoiseur

[naive kraken]

the code is a bit crap, it can be improved to not do all of that weird swapping

By just making it use OSSwapBigToHostInt32, OSSwapHostToBigInt32, OSSwapLittleToHostInt32, OSSwapHostToLittleInt32

you get the point lol

I just didn't know that back when I wrote it lol

tbh you can probably even get away with using Foundation and objc in launchd

that shouldn't be too bad

[tepid olive]

https://github.com/opa334/Choicy/blob/0f553a5d5d240d8d85d0be5eeea0c463f6bbead8/Preferences/CHPTweakList.m#L75 this is awesome

[tepid olive]

i did swift in launchd

no problems really

[naive kraken]

yeah at that point lol

[ocean raptor]

https://github.com/CRKatri/trustcache/blob/main/machoparse/cdhash.c#L67

[naive kraken]

you can even rewrite my stuff in swift if you want

[ocean raptor]

(I needed to support FreeBSD , Linux, and darwin)

[naive kraken]

well I only need to support iOS lol

[naive kraken]

Just keep in mind this Choicy code is very finnicky and basically everything in it is required to make it work properly, I have always needed to add small improvements over the years to make it as good as possible

[ocean raptor]

Bro wrote his own bswap 💀

[naive kraken]

right now it detects tweaks that filter classes as injecting globally, everything else should be accurate though

[ocean raptor]

Saurik moment (ldid has the same)

[naive kraken]

only because i needed to make it conditional based on the mach header magic order

(which is stupid and unneeded, I know)

[tepid olive]

Okay got it to build

[tepid olive]

the cache parser is not doing well apparently

[shy reef]

Does Theos have the iOS 15 SDKS? stupid question and I haven't looked lol

[faint stag]

https://github.com/theos/sdks

in other words, not yet

reasons are probably obvious though as the build system does need modification for rootless etc

so i'd assume the sdk would be there when and if theos does support rootless completely

[shy reef]

That's a big "if" lol

I can see a fork probably popping up for rootless

[restive ether]

no reason for that

[shy reef]

Well there's no reason but it would make sense, one for Root and one for Rootless

[restive ether]

why does that make sense it's just a path and arch change it's not serious

[faint stag]

if it was only that much, it would've been done by now lol

[restive ether]

you overestimate the progress and time available to the people who work on it

[shy reef]

Still though I reckon it's a good idea separating them

That's just me tho obviously

[shut stag]

ellekit

[indigo peak]

should i just do [rootifyPath(@"/usr/bin/killall") UTF8String]

still didnt work

neither did this

but replacing rootifyCPath w the other call instead

[tepid olive]

is there a modern libjailbreak-like api

that jbs use

or nah

nothing i'm just curious

[misty cradle]

i love u

i hate u

i love u

i hate u

i love u

i hate u

[tepid olive]

was looking at https://github.com/PsychoTea/MeridianJB/blob/master/Working_with_libjailbreak.md

[misty cradle]

@misty cradle

[tepid olive]

crazy how many mitigations have been made since Meridian

iOS 11/10 was the last time we could patch kernel

Not unc0ver though?

[frail cedar]

disclaimer: when it comes to development I am not smart at all. my coding experience is in java.
I am attempting to get the Music app from iOS 8.3 running on iOS 10.3.3 on a 5c. These iOS versions lack RadioUI.framework, so I dumped it from the 8.3 dsc using decache. It's a valid binary, but it has no code signature so when iOS attempts to load it, it returns this: /System/Library/PrivateFrameworks/RadioUI.framework/RadioUI: required code signature missing for '/System/Library/PrivateFrameworks/RadioUI.framework/RadioUI'

I'm on an iPhone 5c, I've ripped the music.app and dsc from the 5c 8.3 IPSW

I'm not sure how I would give it a code signature, even if it's invalid and will only work when jailbroken

ok I remembered ldid exists and ran ldid -S /System/Library/PrivateFrameworks/RadioUI.framework/RadioUI and now it doesn't error with a no codesignature issue. It now says /System/Library/PrivateFrameworks/RadioUI.framework/RadioUI: overlapping segments which I think means the binary is invalid?

or is it something I could potentially fix

"I am attempting to get the Music app from iOS 8.3 running on iOS 10.3.3 on a 5c"

It needs RadioUI.framework to run

iOS 10.3.3 doesn't have that

I'm putting my three braincells together to try and make it work but

im not smart

Yeah I know

I've gotten much farther than last time I tried

which was me not knowing why I couldnt find the RadioUI binary in the framework folder.

Yeah

it exists in 9.0 too

Yes

Yeah

It does have Radio.framework though

which I think 8 doesn't?

lemme see

For what

how to find

ah found it

[timid furnace]

info.plist

[frail cedar]

com.apple.RadioUI

com.apple.Radio

done

[timid furnace]

install_name_tool go brr

[faint stag]

exactly lol

[frail cedar]

ye

currently on ventura

done that, swapped binary

I probably need to resign the binary

[faint stag]

i mean yeah ldid wouldn’t hurt

[timid furnace]

idk if the app has entitlements but if it does doesn't hurt to keep them too

[faint stag]

you should keep them lol

it’s music of all things

[frail cedar]

theres a file Music-Entitlements.plist in the app directory

[timid furnace]

ldid -M or something if you didn't already strip them

ldid -SMusic-Entitlements.plist cock/Music

no space between S and Music-Ent

[frail cedar]

Same overlapping segments error

dyld: Library not loaded: /Library/PrivateFrameworks/RadioUI.framework/RadioUI Referenced from: /Applications/Music.app/./Music Reason: no suitable image found. Did find: /Library/PrivateFrameworks/RadioUI.framework/RadioUI: overlapping segments /Library/PrivateFrameworks/RadioUI.framework/RadioUI: overlapping segments Abort trap: 6

yes.

[timid furnace]

are you sure the binary is actually valid

dsc extractors don't generally create usable binaries

[frail cedar]

it didn't give errors about malformed mach-o

yeah figures

my best shot was decache using 9.0 since 9.0 has RadioUI and the decache github says `Decache extracts working and completely valid files from an iOS dyld shared cache.*

• Used to...it currently is built for 9.0 armv7s`

Everything else gave errors about malformed mach-o

yeah, same overlapping segments. guess I get to work out how to compile imaon2 and hope that works.

[tepid olive]

cool

[next wadi]

whats the best way to parse a plist file in C

[ocean raptor]

CoreFoundation

[nimble parcel]

or libplist if you need cross-platform support and don’t wanna compile all of CF

[ocean raptor]

Compiling CFLite 💀

[indigo peak]

any app decrypt tweaks working on Xina15?

[next wadi]

TRUE ty capt

[lime pivot]

TIL xpc_create_from_plist that’s neat

[ocean raptor]

Is private 😔

[lime pivot]

ugh

[ocean raptor]

BUT THAT DOESNT STOP US

[lime pivot]

as always

[ocean raptor]

Other interesting private xpc functions:

void xpc_create_from_plist_descriptor(int fd, dispatch_queue_t queue, xpc_handler_t handler);

char *xpc_copy_short_description(xpc_object_t object);
char *xpc_copy_debug_description(xpc_object_t object);

(I don't know what these look like, just that they exist)

short:

debug looks identical to xpc_copy_description 💀

void xpc_dictionary_apply_f(xpc_object_t xdict, void *ctx, xpc_dictionary_applier_f applier);

typedef void (*xpc_dictionary_applier_f)(const char *key, xpc_object_t val, void *ctx);

[lime pivot]

I mean hey partner servers get like 200MB per file or something

[tardy narwhal]

artists using telegram as means to transfer between macs & windows

[lime pivot]

idk who needs to share 200MB files without using a dedicated file transfer service but hey

(until the cache expires)

everyone who says they don't get deleted doesn't understand how CDNs work

I don't blame them, it is easy to assume a deleted file hanging around 30 secs after deletion means it'll stay around forever

but it'll expire at some point, idk when exactly

[pearl sail]

smh

[hallow mesa]

What happend

[faint stag]

this assumes that sideloading gamepigeon works to begin with

[lime pivot]

yeah pretty much

they do delete the object from Google Cloud Storage, but if the link has been accessed at least once then Cloudflare still has a cached copy till it expires

most likely datacentre-specific but I'm not sure to what degree

[indigo peak]

@grave sparrow just post it in private vc chat lmao

[zenith hatch]

@indigo peak hi i have a question

do you know where ios’ keyboard headers are

trying to make a thing to insert images into text fields

[lime pivot]

UIKit

UIKeyboard* classes

[pearl sail]

Which one of you devs would like to go insane?

https://twitter.com/PoomSmart/status/1603577379393179648?s=20

PS (@PoomSmart)

@elihwyma Devs really need to make crash reporter working on XinaA15 so we know what's going on for others

Twitter · Dec 16, 2022, 2:26 AM

[faint stag]

i mean i thought muirey was considering that

[pearl sail]

Hopefully he has a easier time than I think he will

[tepid olive]

@grave sparrow ellekit now has no more injector :3

launchd handles the tweaks

btw

ur methods for zefram don’t work on iOS arm64e

At all

You can’t load a TL1 binary in TL3

trust level 1 = you
trust level 3 = launchd

good luck with ppl bypasses

how are you gonna do that

cursed

still requires ppl bypasses though

i’ll try to get the exception handler amfid technique going

[naive kraken]

errr, you sure about these trust levels? lol

it should be

[tepid olive]

that’s what coolstar put in her presentation iirc

[naive kraken]

trust level 5 = you
trust level 8 = launchd

[tepid olive]

what ios is that

[naive kraken]

15

[tepid olive]

how

fair enough

i need to write my CS_DEBUGGED thingy

[naive kraken]

or actually I think with the CT bug you get trust level 6

trust level 7 is dynamic trust cache

and trust level 8 is static trust cache

6 = app store

[tepid olive]

palera1n has such shitty patches that it sometimes has it set but sometimes not

[naive kraken]

5 = dev signed

[ocean raptor]

Is tc 7 or 8 lol

[naive kraken]

fixed

lol

7 are the binaries in the trust cache that Xcode loads (the one we can modify with PPL bypass)

8 are the ones in static one that's in kernel text

only with PPL bypass

or you need to do extremely hacky stuff to downgrade the trust level of launchd

yes

the problem is the process needs to restart for it to downgrade

yeah but

launchd execs launchd on userspace reboot

and you need to intercept that from another process

to get your dylib injected

[ocean raptor]

PPL bypass is the only way

[naive kraken]

afaik downgrading should work until 15.1.1

but idk

xina for example also has no dylib in launchd

[ocean raptor]

PPL bypasses are like the only way we can do good jailbreaks for iOS 15+ for A12+

[naive kraken]

it's the only process he can't hook

so that's also why you have to do ldrestart on xina

and when you do userspace reboot you loose jailbreak

and sometimes the system does a userspace reboot in the night

like launchd downgrading is the most difficult thing

[ocean raptor]

I ❤️ xina

[naive kraken]

you need to attach a debugger and then somehow do a userspace reboot while also changing the args of exec

with just a PAC bypass we can still do downgrading on 15.2+ afaik

so the future will be either shitty jailbreak with PAC bypass

or proper jailbreak with PPL bypass

[ocean raptor]

Just run launchctl examine

fr fr

If only we could get physrw with a better exploit

[naive kraken]

here are trust levels on macOS dev kernel btw

anything engineering doesn't exist on iOS

so anything after 7 is -1 on iOS

[ocean raptor]

What's engineering?

[naive kraken]

something only existant in development kernels I presume

[ocean raptor]

Ok, I would like to punch it

Fun fact: I've punched a lion in the face

No 😔

[naive kraken]

honestly should be doable tbh

[ocean raptor]

(This is a completely true story)

[naive kraken]

you just need to find a way to get your process a IOBufferMemoryDescriptor object in kernel space

then you can reuse the Fugu15 technique

physrw is unrelated to KTRR

no

physrw is needed for Fugu15 PAC bypass

idk

and the pac bypass in needed for the ppl bypass

with physrw you're not restricted to the virtual address space

[ocean raptor]

How does fugu's driverkit thing work again?

[naive kraken]

If only I knew

[ocean raptor]

💀

[naive kraken]

btw

[restive ether]

is this supposed to be public

not that I care, just apple or whatever

[naive kraken]

maybe not 😄

idk

I'm not going to go into detail where this is from

to protect it's source

[restive ether]

yeah that too

[tepid olive]

L

[naive kraken]

(but it's all publicly available)

[tepid olive]

weren’t dtks just published

[restive ether]

yeah I just didn't know the rules around KDKs

[naive kraken]

I mean it's a bunch of strings

not like they can sue me for that lol

[tepid olive]

dev kernel

[restive ether]

palerain users

[tepid olive]

How can I debug launchd

I still can’t get it working

[naive kraken]

this thread should have everything needed https://twitter.com/cutesmilee__/status/1593300872720678912 for physrw

Tommaso (@cutesmilee__)

@MiscMisty @opa334dev @Jakeashacks @xina520 they aren't uninitialised (that vulnerability got patched later), however since the buffer is allocated when you open the client, you can write to it using r/w before triggering the memdesc write

Twitter · Nov 17, 2022, 5:51 PM

[tepid olive]

try it

doesn’t work

[restive ether]

@grave sparrow join the dyld team

liberal

when did the kernel team hurt you man

you ever seen the linux kernel lol

alpha grindset

[faint stag]

good

[plain python]

this is why I choose to run the NT kernel instead

[naive kraken]

@lapis vessel just fyi the getRootPath function I sent here earlier is a bit flawed because for whatever reason reading the location that /var/jb points to causes some daemons to crash with sandbox errors

This is fine for most tweaks but as cr4shed injects system wide you need the fixed one

NSString* getRootPath(void)
{
    static NSString* rootPath = nil;

    static dispatch_once_t onceToken;
    dispatch_once(&onceToken, ^
    {
        NSFileManager* fileManager = [NSFileManager defaultManager];
        rootPath = @"/";
        if(![fileManager fileExistsAtPath:@"/jb"]) // ignore old unc0ver versions where /var/jb is a symlink to /jb 
        {
            BOOL dir = NO;
            if([fileManager fileExistsAtPath:@"/var/jb" isDirectory:&dir] && dir)
            {
                rootPath = @"/var/jb";
            }
        }
    });

    return rootPath;
}

this one works better

[lapis vessel]

considering just using objc NSString* rootifyPath(NSString* path) { return [[NSFileManager defaultManager] fileExistsAtPath:path] ? path : [@"/var/jb/" stringByAppendingPathComponent:path]; }

[naive kraken]

no

Ignoring it if it points to /jb is important

else you break support for some older devices that have a /var/jb -> /jb symlink

but just checking for /jb existance works aswell because it can't exist on rootless jailbreaks

[lapis vessel]

I mean, look at the code

it will be checking for the existence of paths that cannot exists on rootless jailbreaks

[naive kraken]

yeah but you want to support both rootless and root jailbreaks, no?

there is no real reason to make a separate package for rootless atm

[lapis vessel]

for example, I call rootifyPath(@"/usr/lib/Cephei.framework"), that returns @"/usr/lib/Cephei.framework" if /usr/lib/Cephei.framework exists, otherwise returns @"/var/jb/usr/lib/Cephei.framework"

[naive kraken]

ah

I misunderstood the code

lol

yeah I think it's better

[lapis vessel]

as far as I can tell, this code looks foolproof

for what I need anyway

[naive kraken]

maybe it's better to check the /var/jb one first

and prefer that over the system one

NSString* rootifyPath(NSString* path)
{
    NSString* rootlessPath = [@"/var/jb" stringByAppendingPathComponent:path];
    return [[NSFileManager defaultManager] fileExistsAtPath:rootlessPath] ? rootlessPath : path;
}

[lapis vessel]

I disagree. On non-rootless jailbreaks, /usr/lib/Cephei.framework cannot exist, whereas on normal jailbreaks, both /usr/lib/Cephei.framework and /var/jb/usr/lib/Cephei.framework can exist

I mean, obviously unlikely that /var/jb/usr/lib/Cephei.framework would exist on a normal jailbreak, but I want to always be using /usr/lib/Cephei.framework if it exists

[naive kraken]

yeah it depends but I don't think it matters too much in the end

the edge case is if both exist

and that will almost never happen

[lapis vessel]

yh exactly

[naive kraken]

and the question is which of the two you want to prefer in that case

make gate a check

on iOS <= 14, prefer /

on iOS >= 15, prefer /var/jb

idk lol

[lapis vessel]

probably unneccesary lol

[naive kraken]

yeah I think I will just be using yours

[lapis vessel]

yeah as I'm basically just using hardcoded paths in cr4shed, mainly to lazy-load libs, I'm happy it will work for me

[naive kraken]

that func seems to respring loop on my unc0ver Xs 14.3 for whatever reason

[lapis vessel]

what about the C version?c char* rootifyPath(const char* path) { if (access(path, F_OK) == 0) { return strdup(path); } char* ret = NULL; asprintf(&ret, "/var/jb/%s", path); return ret; }

oh also the rootifyCPath function in your pastebin is completely unsafe, it always returns a free'd pointer

[naive kraken]

I'm thinking of just making it a preprocessor macro btw

[naive kraken]

yeah exactly because of that

that may also be the reason for the crash now lol

just weird that it didn't happen before

[lapis vessel]

yeah you absolutely can't do this: return rootifyPath(path).fileSystemRepresentation;

the lifetime of fileSystemRepresentation is only as long as the return value of rootifyPath, which gets released before the function returns

so it returns a free'd pointer every time

[lapis vessel]

this should never crash tho?

[naive kraken]

no but it leaks memory

[lapis vessel]

it doesn't leak memory if used correctly...

[naive kraken]

yeah but you need to free things

[lapis vessel]

correct

[naive kraken]

no interest in doing that everywhere I use it

If I make a preprocessor that always goes through NSString for both things it should work tbh

#define NS_ROOT_PATH(path)([[NSFileManager defaultManager] fileExistsAtPath:path] ? path : [@"/var/jb" stringByAppendingPathComponent:path])
#define ROOT_PATH(cPath)(NS_ROOT_PATH([NSString stringWithUTF8String:cPath]).fileSystemRepresentation)

[lapis vessel]

ok: c #define ROOTIFY(path) ((access(path, F_OK) == 0) ? path : "/var/jb/" s)

[naive kraken]

hm yeah that can work too

[lapis vessel]

I quite like that solution tbf

[lapis vessel]

this still gives you a free'd pointer opa...

[naive kraken]

nope

the only reason the pointer was freed was because of arc which freed it at the end of the function

I mean this is still kinda bad but from my experience it should be ok

But I will use yours for the C version

[lapis vessel]

does ARC always insert objc_release calls at the end of the function?

[naive kraken]

yeah

at the end of the block I think

there is also autoreleasepools

idk

[lapis vessel]

yeah I mean if you insist on using the objc stuff in the c version then I would have added a call to autorelease

can you do that in ARC?

[naive kraken]

no

[lapis vessel]

whereas this will

[naive kraken]

==> Compiling HookCompat.m (arm64e)…
HookCompat.m:14:27: error: expected ')'
                void* lhImage = dlopen((ROOT_PATH("/usr/lib/libhooker.dylib")), RTLD_NOW);
                                        ^
./rootless.h:5:71: note: expanded from macro 'ROOT_PATH'
#define ROOT_PATH(path) (access(path, F_OK) == 0) ? path : "/var/jb/" s
                                                                      ^
HookCompat.m:14:26: note: to match this '('
                void* lhImage = dlopen((ROOT_PATH("/usr/lib/libhooker.dylib")), RTLD_NOW);

doesn't seem to be working

[lapis vessel]

u wat

[naive kraken]

ur macro

ok idk

[lapis vessel]

oh 1 sec

[naive kraken]

idk that much about string stuff in macros

maybe chatgpt can help me

[lapis vessel]

meant to be path not s lmao

[naive kraken]

ah

works

[lapis vessel]

changed parameter name, forgot to rename the one I used in the definition lol

[naive kraken]

until it gets a variable and not a contant string

smh

yeah that makes sense though

[lapis vessel]

oh yeah it absolutely won't work for variables

[naive kraken]

will just go through the other macro in that case

[lapis vessel]

ok so here's some code using your macro: objc #define NS_ROOT_PATH(path)([[NSFileManager defaultManager] fileExistsAtPath:path] ? path : [@"/var/jb" stringByAppendingPathComponent:path]) #define ROOT_PATH(cPath)(NS_ROOT_PATH([NSString stringWithUTF8String:cPath]).fileSystemRepresentation) void testStrings() { const char* path = ROOT_PATH("/bin/sh"); printf("path: %s\n", path); }

I've looked at the disassembly

[faint timber]

Ugh objc makes me sick

[naive kraken]

#import <Foundation/Foundation.h>
#include <unistd.h>

// Use for NSString literal or variable
#define ROOT_PATH_NS(path)([[NSFileManager defaultManager] fileExistsAtPath:path] ? path : [@"/var/jb" stringByAppendingPathComponent:path])

// Use for C string literal
#define ROOT_PATH_C(cPath) (access(cPath, F_OK) == 0) ? cPath : "/var/jb/" cPath

// Use for C string variable
#define ROOT_PATH_C_VAR(cPath)(ROOT_PATH_NS([NSString stringWithUTF8String:cPath]).fileSystemRepresentation)

I consider this the final version now

although let me know what your results say lol

[lapis vessel]

ARC does call objc_release on the NSString before the call to printf

BUT

it first calls objc_retainAutorelease

so your fileSystemRepresentation string will be alive until the next autoreleaseloop cycle

[naive kraken]

(me pretending I understand how objc memory allocations work)

alright so I guess it's fine lol

[lapis vessel]

yeah should be. stringByAppendingPathComponent returns a string with a refcount of 1, objc_retainAutorelease takes it up to 2, but it will be decremented on the next autoreleaseloop cycle, then objc_release takes it back down to 1, then printf is called

[naive kraken]

what happens if you do

printf("path: %s\n", ROOT_PATH("/bin/sh"));

[lapis vessel]

oh ROOT_PATH uses only string literals so they have no lifetime

they are never "free'd"

oh wait u mean ROOT_PATH_C_VAR?

[naive kraken]

I mean the same one you used in your prev test

[lapis vessel]

yeah sorry my bad

[naive kraken]

so yeah, in the new version it's ROOT_PATH_C_VAR

[lapis vessel]

exact same thing

[naive kraken]

interesting

[lapis vessel]

well they're completely equivalent

[onyx ember]

That's a pain

[lapis vessel]

anyway takeaway is that the return value of ROOT_PATH_C_VAR is safe to use temporarily, as long as you don't need to hold onto it for very long

[onyx ember]

You're limited to the PAGE_SIZE on every trustcache, you can't inject a cache more than 16384 bytes into the kernel. I liked the idea of @naive kraken about the daemon, but that will only work if that limit is not hit.

[naive kraken]

can you load more than 1 trust cache

[onyx ember]

Yes, you can

[naive kraken]

then load one trust cache per binary

ez

hmm idk it's certainly more difficult then I thought then

do you happen to know if dylibs in dynamic trustcache can inject into binaries in static trust cache

[onyx ember]

Just make an entry in Fugu like I'm doing for Procursus now, but I'll add a test entry too if you guys need to try out things...

[restive ether]

tc users 💪🏼💪🏼

[onyx ember]

I haven't tested this

[onyx ember]

lol

[naive kraken]

someone said to me it works on iOS 14

but having read the code that does the check I feel like it doesn't in 15

but then again I could be wrong

[onyx ember]

Worth trying...

[naive kraken]

how advanced is your fugu setup

put these 2 in trust cache and find out

[restive ether]

if you want an open source launchctl that exists now too

[onyx ember]

This kills oobPCI after auto_run, so we don't end up in a kp, but if you still need access to kernel debugging, you can do this by renaming the Trustcache to something like Trustcache2 and reboot, re-jb to get to original fugu modus by Linus

[naive kraken]

hm idk

just try what I sent

you need to find the SpringBoard pid though

wait no I remember it now