#development

1 messages · Page 24 of 1

ocean raptor
#
GitHub

iOS Automation Framework iOS Touch Simulation Library - IOS13-SimulateTouch/Common.xm at 95c413598e0483f1f903b764815977d40dabca8a · wenliabc2007/IOS13-SimulateTouch

GitHub

AutoLaunch iOS App when App crashes abnormally. Only support jailbreak devices - autolaunch/Tweak.xm at 084957e739dc98aae42eba80a67339f98e4ec9cb · chenzhijie/autolaunch

restive ether
#

lol

#

don't look at the postinst.

peak quartz
#

What are my options to print logs with nslogs on palera1n? oslog seems to be broken. (I know I can write to file, trying to avoid that)

hasty ruin
restive ether
#

at least he fixed it breaking

faint stag
#

have a look at latchkey

tepid olive
#
    return %orig;
  }
#

but i cant find it in santander, for example

#

is it a bundle or something?

#

can u test ellekit

tepid olive
#
- (id)initWithPackageName:(NSString *)arg1 inBundle:(id)arg2 {
if(![arg1 containsString:@"lock"]) {
    return %orig;
  }
#

but still there are no "lock" bundle

#

could be this: /System/Library/PrivateFrameworks/SpringBoardUIServices.framework/lock@3x-d73.ca

#

but uhh

#

there are 5 of them

#

oh wait

#

yesss it's that

#

nvm

#

thanks @faint stag

fathom snow
#

where could I find SpringBoard headers n such

timid furnace
#

uhh, multiple places

#

basically you're looking for patched SDKs

#

you can find some in theos/sdks along with a script to make them

#

theos/headers has some commonly used frameworks along with other commonly used headers like substrate, libprefs, and libhooker

tepid olive
#

How do I view trustcache on fugu15

fathom snow
#

Quick thing, since the framework is UIKitCore and your package is targeting com.apple.UIKit, would the tweak still work on iOS 14+, or does it just work? @ocean raptor

#

Mr. Launch 😁

tepid olive
#

What tweak works on rootless ellekit

fathom snow
#

Assuming ones that follow these guidelines?

onyx ember
tepid olive
onyx ember
tepid olive
#

there's an atria build for rootless ellekit

#

i think ellekit's loader needs a tfp0 patch

#

actually tfp1

#

but it needs a patch to task_conversion_eval i think

tepid olive
#

So far ellekit seems to be installed

onyx ember
tepid olive
#

you need the loader to say done! for tweaks to work

tepid olive
#

you need the loader to be in a trustcache

#

i think

#

if it worked it should look like this

#

And how do I put it in there

ocean raptor
onyx ember
tepid olive
#

it probably still wont work

#

is task_conversion_eval patched by fugu15?

timid furnace
tepid olive
#

because if not itll error with KERN_INVALID_SECURITY

onyx ember
tepid olive
#

Fml

onyx ember
tepid olive
#

we should make ellekit reload tweak cache on respring

#

fr

tepid olive
ocean raptor
#

Ellekit has no support for arm64e

#

So failing to get it to run will be no help

onyx ember
timid furnace
tepid olive
#

Well Evelyne said to run loader and see what it did so that’s what I was trying to do

fathom snow
#

nvm

onyx ember
naive kraken
tepid olive
#

whar

naive kraken
#

e.g. not possible to patch without KTRR bypass

tepid olive
#

yeah

naive kraken
#

so the answer is no

tepid olive
#

i just use checkm8 patched kernel

#

i dont have a fugu15 device

naive kraken
#

anyways if the dylib is in trust cache, you promote the vnode manually to trust level 8 and bypass userland PAC by replacing jop_pid and rop_pid fields then it should work as long as ellekit stuff is compiled for arm64e and has the proper handling for PAC'ed thread states

#

but idk about CS_DEBUGGED / C function hooking

#

I'm also not sure whether promoting the vnode to trust level 8 is necessary or not, being in trust cache might be enough

#

the only things Fugu15 does is it gives you KRW, PAC, PPL bypass and a command to load a trustcache and that's it

#

it doesn't patch or neuter anything by itself

#

no

#

dylibs don't have PAC keys

#

threads do

#

so when you e.g. launch a binary that does the injection via task_for_pid and thread states, this binary's task and threads need to have the same PAC keys as the target processes task and threads

peak quartz
naive kraken
#

target process = launchd I guess

#

hm actually that could work idk

timid furnace
naive kraken
#

but I just launched my binary suspended, replaced the PAC keys with the ones from the target process, and then made in continue

#

I think all have the same

#

yeah

#

for some reason they just all have their own field

peak quartz
naive kraken
#

the purpose is the target thread not crashing with PAC failure when you replace PC and make it continue yes

#

allegedly there is a kernel mechanism to do this without having to fuck with PAC keys but idk

timid furnace
naive kraken
#

like the thing here is, e.g. debugserver also has to be able to replace the PC of another process

#

so it must be possible somehow

peak quartz
timid furnace
#

idevicesyslog is crossplatform

tepid olive
onyx ember
naive kraken
#

but can they without breaking arm64e debugging?

timid furnace
#

oh you might have to download the dependencies if you do that

peak quartz
timid furnace
#

lol alr

naive kraken
#

yeah that should be it

peak quartz
#

Thank you

naive kraken
#

where would I use this tho

#

in e.g. opainject

#

ah interesting

#

might give this a try

#

I don't see a reason why it shouldn't work tbh

#

unless they restricted this to stuff in trust cache

#

so just every time before I call thread_set_state I have to call thread_convert_thread_state?

#

that's surprisingly simple lol

#

well in opainject I first make the target process alloc a proper pthread

#

then I hijack that

#

I think this too much of a design flaw for it to be fixed

#

Only thing they could do is restrict it to trust cache processes

#

idk where to get that

onyx ember
#

I think they already do

ocean raptor
naive kraken
ocean raptor
#

github search is amazing now

#

what are you talking about?

naive kraken
#

ok then search for anything in that repo

#

0 results

ocean raptor
naive kraken
ocean raptor
naive kraken
#

well it's not called

#

I'm pretty sure that's already handled by some macros I use

faint stag
tepid olive
#

ellekit uses it

#

100% success rate

#

cc @naive kraken

naive kraken
ocean raptor
#

@marble perch @restive ether only 15 launchctl commands left

#

and it only cost me $5.81

restive ether
#

you balled too hard

restive ether
ocean raptor
#

🙏

restive ether
#

just lemme know how much it costs when it's all said and done

ocean raptor
#

gonna do submit right now

#

then gonna call it a day

#

I lied

#

gonna do a bunch more commands

#

found a ton of super simple ones that I can bang out super quickly

tepid olive
#

only reason taurine has a pac bypass is because coolstar forgot about that api fr

naive kraken
tepid olive
restive ether
ocean raptor
#

pretty much just submit imho

restive ether
#

@grave sparrow go ahead

#

add something

tepid olive
#

i love safari plus broken on 15+

ocean raptor
naive kraken
#

@grave sparrow @tepid olive thread_convert_thread_state doesn't seem to work for me

#

SpringBoard crashes with pointer auth failure

ocean raptor
restive ether
naive kraken
#

opainject crashes too though so idk

coral gazelle
#

Is the iBoot partition (/dev/disk1) able to be mounted with a navigable filesystem, or is it just a bunch of data with no filesystem?

naive kraken
# naive kraken <@434097922762735618> <@456226577798135808> `thread_convert_thread_state` doesn'...

Code I used:

    kr = thread_create(task, &bootstrapThread);
    if(kr != KERN_SUCCESS)
    {
        printf("ERROR: Failed to create bootstrap thread: %s.\n", mach_error_string(kr));
        return kr;
    }

    mach_msg_type_number_t bootstrapThreadStateSize = ARM_THREAD_STATE64_COUNT;
    kr = thread_convert_thread_state(bootstrapThread, THREAD_CONVERT_THREAD_STATE_FROM_SELF, ARM_THREAD_STATE64, (thread_state_t)&bootstrapThreadState.ts_64, bootstrapThreadStateSize, (thread_state_t)&bootstrapThreadState.ts_64, &bootstrapThreadStateSize);
    if(kr != KERN_SUCCESS)
    {
        printf("ERROR: Failed to convert thread state to bootstrap thread: %s.\n", mach_error_string(kr));
        return kr;
    }

    kr = thread_set_state(bootstrapThread, ARM_THREAD_STATE64, (thread_state_t)&bootstrapThreadState.ts_64, bootstrapThreadStateSize);
    if(kr != KERN_SUCCESS)
    {
        printf("ERROR: Failed to set thread of bootstrap thread: %s.\n", mach_error_string(kr));
        return kr;
    }

    kr = thread_resume(bootstrapThread);
    if(kr != KERN_SUCCESS)
    {
        printf("ERROR: Failed to resume thread: %s.\n", mach_error_string(kr));
        return kr;
    }
fathom snow
#

xenon doesn't work rootless lol

faint stag
fathom snow
#

yea lol

restive ether
#

garbage tweak not surprised

#

words i cannot say in this server.

tepid olive
#

so

tepid olive
#

fyi

faint stag
restive ether
#

killing myself

#

write it in zig

ocean raptor
#

@restive ether final total for today: $7.16

restive ether
#

dm me how you would wish to recieve your funding whore

ocean raptor
#

Gonna release v1.0 🥳

onyx ember
ocean raptor
#

like mother like son

onyx ember
#

Ah

ocean raptor
#

no

#

submit is deprecated

#

yes

#

so I did a 1:1

#

on iOS 16, submit is deprecated

#

and has no code path

#

smd

#

same on iOS 15

#

this is iOS sim launchctl, so monkashrug

#

I stubbed a bunch of subcommands, do one of them

#

I'm sure

restive ether
#

what am I looking at

ocean raptor
#

I'd agree but he just gave me money so

restive ether
#

I put a down payment for later on top of it

ocean raptor
#

real

#

for when my launchctl completely breaks someone's device and I have to fire up corel again to fix it

restive ether
#

so real

ocean raptor
#

try DYLD_INSERT_LIBRARIES with xpchook.dylib

#

what's the return code?

restive ether
#

I would also pay you for any related development of launchctl

#

just cause I want it done

#

oh fair

#

you can have uhh

#

like $1

#

I gave you a script like two days ago

#

and it worked nerd

analog ridge
#

Quick question, does anyone remember those “carrier hacks” from about a decade ago? I’m trying to figure out what exactly they modified to add volte support to the iPhone 5

restive ether
#

oh you didn't

#

if your carrier doesn't support VoLTE then it's not gonna work dog

#

oh never mind

#

I misread

analog ridge
#

The carrier does support volte, just the phone lacks the software to actually work on it

naive kraken
analog ridge
restive ether
#

forgot about the days of voice over 3g

sturdy chasm
#

hi, not sure if this is the right place to ask for this, but could someone give me a bit of insight as to what this error might mean? trying to boot ios 11.0

restive ether
#

what a terrible time

naive kraken
#

Exception Subtype: KERN_INVALID_ADDRESS at 0xdf166081aeb129a0 -> 0x00000001aeb129a0 (possible pointer authentication failure)

restive ether
#

I've seen carriers that still do it lol

naive kraken
#

it also has a PAC signature

restive ether
#

in modern phones

naive kraken
#

just it's invalid

analog ridge
#

I didn’t even know that channel existed, thanks

sturdy chasm
#

it's not really legacy though but ok

ocean raptor
fathom snow
#

y’all remember where litten’s tweak source is?

naive kraken
#

I mean it runs and returns KERN_SUCCESS?

restive ether
ocean raptor
#

seemed appropriate

restive ether
#

very much true

ocean raptor
#

?

restive ether
#

oh no Capt is gonna do his xpc critiquing now

analog ridge
sturdy chasm
#

well yeah that's why I thought i'd post it here

ocean raptor
#

way better than his

restive ether
#

apple is the xpc goat

coral gazelle
#

If I dump the iBoot partition with cat /dev/disk1, then output it to a file using dd, does the block size matter? Because when dumping onboard SHSH blobs, the block size for the dump (both the input and the output) is set to 256.

ocean raptor
#

bro

#

just use xpchook.dylib

fathom snow
indigo peak
ocean raptor
#

what is this?

indigo peak
#

should i put parenthasis

#

around the 36

#

so its sqrt(36) and not just sqrt36

ocean raptor
#

that's not a normal launchd routine message

#

L city

#

just install it then reinstall some package like openssh-server or shshd and check logs for errors

#

@timid furnace

indigo peak
timid furnace
#

hi

#

13

#

ok

ocean raptor
#

pls and thank you

indigo peak
#

bet

#

ty

#

#

thats what my dick looks like

#

to scale too

#

nah

tepid olive
tepid olive
#

why did it send twice wtf

indigo peak
#

we integrating some pussy 💀 💯 👿 🚬

tepid olive
#

am i tweaking

indigo peak
#

average discord

tepid olive
#

you should integrate some meaningful activities for self improvement into your daily routine

restive ether
#

words i cannot say in this server

tepid olive
primal perch
#

kitty

#

real

restive ether
#

fr

ocean raptor
timid furnace
#

no errors, launchdaemon runs

indigo peak
#

how do you use ios toast notifications again

primal perch
#

among

restive ether
ocean raptor
indigo peak
#

isnt there a private framework for it

ocean raptor
#

@grave sparrow you can go ahead and add submit if you want

#

Or add any command that is added as todo_cmd

fathom snow
#

how do I add executables to trustcache and why isn't git working

#

it gets stuck on Cloning...

vivid dew
fathom snow
#

am I stupid? Is there something I am missing?

restive ether
#

smartest stock buyer

tepid olive
#

fucking evelyn discord app

restive ether
#

still funny

tepid olive
#

true

wicked summit
indigo peak
wicked summit
fathom snow
tepid olive
#

improve*

indigo peak
#

how tho

tepid olive
#

write better code? maybe

#

/j

tepid olive
# indigo peak how tho

all i’m saying is there’s gotta be a better way than doing it based on like the button presses

#

case case case

#

😭

onyx ember
#

It worked @marble perch, just installed fakeroot and ran the script again.

sh repack-rootless.sh /Users/uar/Desktop/tc_1.0_iphoneos-arm.deb
Creating workspace
dpkg-deb: building package 'tc' in '/Users/uar/tc_1.0_iphoneos-arm64.deb'.
Cleaning up

I can send you the deb if you want @ocean raptor troll

tepid olive
#

cat

tepid olive
ocean raptor
onyx ember
ocean raptor
#

I can add it if it's not

onyx ember
ocean raptor
#

Btw, make sure to switch your repo

indigo peak
#

i prefer haha bad code

tepid olive
ocean raptor
#

sed -i s/iphoneos-arm64\/1800/1800/ /var/jb/etc/apt/sources.list.d/procursus.sources

ocean raptor
#

It's not on the repo yet though

#

Adding it now

#

Ok, refresh

#

It's on 1800 and 1900 repos now

onyx ember
tepid olive
#

Package: plooshi.tweak
Name: Ploosh Tweak
Version: 0.0.1
Architecture: iphoneos-arm
Description: whar
Maintainer: Ploosh
Author: Ploosh
Section: Tweaks
Depends: mobilesubstrate (>= 0.9.5000)

ERROR: control file '/Users/runner/work/tweak/tweak/.theos/_/DEBIAN/control' is missing a Version field at /Users/runner/work/tweak/tweak/theos/bin/dm.pl line 83.

#

wtf is wrong

native dune
#

missing blank line at end

indigo peak
#

@grim sparrow would it be possible to run a location spoofer without a jb/trollstore

#

like how aemulo could theoretically run with a iokit bug

grim sparrow
#

uuuuhhhhhhhhhhhh

#

probably

#

everything is reliant on entitlements really

indigo peak
#

yeah

#

that makes sense

grim sparrow
#

I know it would never happen but I really wish Apple would just let us use whatever entitlements we want when signed to run locally

indigo peak
#

i just want a basic spoofer

#

thats all i want on iOS 16 😭

grim sparrow
#

the interesting thing is

#

on ios 16

#

xcode will not complain at you for adding certain iokit entitlements

#

it will just strip them

indigo peak
#

when do they get stripped

#

when you compile

#

or when you run

grim sparrow
#

compile

indigo peak
#

hm

grim sparrow
#

I am now seeing what happens if you try and sign without xcode

#

im fully expecting an error here

#

no matter what it just seems to remove it

fathom snow
#

Ok fellas, the ldid binary on a Xina15 jb'd phone is NOT signed

#

what is a fella to do

#

on a intel mac's procusus ldid and sent back over

#

But it keeps returning the not cert'd error Killed: 9

#

so what is a fella to do

indigo peak
grim sparrow
indigo peak
#

hm

indigo peak
#

@grim sparrow do you have a list of all the ents

#

like which are allowed to be signed regularly and which arent

grim sparrow
indigo peak
#

useless 🙄

grim sparrow
#

an easy indicator that its not allowed is that it starts with com.apple.private

indigo peak
#

using what

#

vmware?

tepid olive
#

blanket

indigo peak
#

ryzen cpu + nvidia gpu

fathom snow
#

I know now that using cp strips a binary of entitlements and certs n all that. However, is there another form of data transfer (airdrop, webdav, scp) that doesn't strip entitlements? From what I found, scp does strip entitlements

ocean raptor
#

not at all how it works

#

you aren't signing correctly

#

make sure you use Procursus ldid

fathom snow
#

I am

ocean raptor
#

then just run ldid -S<replacewithyouents.xml> binary

fathom snow
#

Now, where do I get the entitlements in order to just friggin run the binary

ocean raptor
#
all: TestApp

SRCS := main.m TAAppDelegate.m QASAppSelectorController.m LSApplicationProxy+AltList.m

OBJS := $(SRCS:%=%.o)
DEPS := $(SRCS:%=%.d)

CPPFLAGS += -MMD

LIBS = -framework UIKit -fobjc-arc -framework IOKit -framework MobileCoreServices

TestApp: $(OBJS)
        $(CC) $(CFLAGS) $(LDFLAGS) $(LIBS) -o $@ $^

TestApp.ipa: TestApp embedded.mobileprovision Info.plist
        rm -f $@
        install -d Payload/TestApp.app/
        install -m644 $^ Payload/TestApp.app/
        ldid -Kkey.p12 -Sents.xml Payload/TestApp.app
        zip -r -9 $@ Payload
        rm -rf Payload

install: TestApp.ipa
        ideviceinstaller -i $^

%.m.o: %.m
        $(CC) -fobjc-arc $(CPPFLAGS) $(CFLAGS) -c -o $@ $<

%.c.o: %.c
        $(CC) $(CPPFLAGS) $(CFLAGS) -c -o $@ $<

%.cpp.o: %.cpp
        $(CXX) $(CPPFLAGS) $(CXXFLAGS) -c -o $@ $<

clean:
        rm -f $(OBJS) $(DEPS) TestApp TestApp.ipa

.PHONY: clean all install

-include $(DEPS)
fathom snow
#

SO i've been having a cert but 0 entitlements? is that what I am understanding

#

i have been scratching at my skin bc of this

#

i fucking hate xina15

ocean raptor
#

I have used this exact makefile plenty of times

ocean raptor
fathom snow
fathom snow
#

Now, how do I construct a ent.xml fil;le

ocean raptor
#

if you are using a jailbreak you dont need a cert

fathom snow
#

even rootless?

#

Oh My God

ocean raptor
#

🙂

fathom snow
#

none of these fucking binary files

#

have ents

#

not curl not clang fucking nothing

#

git does

ocean raptor
#

they should

fathom snow
#

somehow

ocean raptor
fathom snow
#

can't even do the most basic operations without facing the Killed: 9

ocean raptor
#

then sign your binary correctly lol

ocean raptor
#

how did you export your p12?

#

🤷‍♂️ skill issue

#

send p12

#

and mobileprovision

fathom snow
#
Unknown header magic are you sure that is Mach-O
ocean raptor
fathom snow
#

¿Por que?

#

hablame

undone nest
#

looks like your shit is fucked man

#

i cannot help you sadly

fathom snow
#

god

#

fucking

#

hooooly shit

ocean raptor
#

no clue if it worked

#

cause I'm not in the mobileprovision

#

@grave sparrow

wicked summit
#

gm

fathom snow
#

this fucking

#

hHAa

undone nest
#

are you sshed into a smart coffin

fathom snow
#

Xina15

undone nest
#

that would explain why it doesnt work

fathom snow
#

God FUcking Damnit

undone nest
ocean raptor
#

no

fathom snow
#

Someone said I didn't have to

ocean raptor
#

xina has no PPL bypass

ocean raptor
undone nest
#

thats unfortunate

fathom snow
ocean raptor
#

ok but the signature was fine

#

so smd

#

First I changed the ents to not be gamepigeon's bundle id

#

I changed it to YOURTEAMID.com.captballs.whatever

#

then did ldid -K../capt.p12 -S../ents.xml Game\ Pack.app

native dune
#

do you have PPQ check on your dev account

#

if so then no

ocean raptor
#

the mobileprovision gives a specific list of entitlements that are allowed iirc

native dune
#

this dumb thing that contacts apples server to verify every launch but if its the same bundle id as an appstore app your dev account gets flagged

ocean raptor
#

ldid -e Game\ Pack.app/Game\ Pack

#

yeah

#

bundle id is still the same in Info.plist

#

I just changed the bundle id for the signature

#

I deleted everything

native dune
#

if you have ppqcheck disabled for an app id (or cert, dont remember) the app will only last 7 days

ocean raptor
#

signing and sideloading an app with ldid and ideviceinstaller is so easy (if you have a paid acct)

native dune
#

for developing, apple cracked down on dev accounts for sideloading not too long ago, completely destroyed udidreg and other services

#

uhh i think its in the app id

#

you need to make a wildcard (?) app id so you can use any bundle id

#

yea BWJ45253TT is your team id

fathom snow
#

brotha did u just give up on me, xina15 is just fucked?

#

god bless cheyote needs to come out cuz at least there is a standard of care

native dune
#

must resign every 7 days if ppqcheck is disabled, which it most likely isnt

native dune
#

@grave sparrow when did you register your dev account you might not even need to worry about ppqcheck

native dune
#

you should be fine then

#

ppqcheck probably wont even exist on your account

#

last time i checked it doesnt matter

#

uhh

#

go and make an app id and see if theres an option for ppqcheck anywhere

fathom snow
native dune
#

how were people making app ids that were just *

#

because i know people used to do it

ocean raptor
#

you can get a * mobileprovision

native dune
#

here this is a better article explaining it

Since iOS 15 Apple has introduced more surveillance of your actions outside AppStore. Every single app, every time that you are launching it, is calling apple "provisioning profile query" service, that validates profile included in the app (profile consists developer certificate issued by apple, it is techincally required for app to run). And you can't lauch your app without internet connection, you know? They even don't bother at all, so included "PPQCheck" key in every provisioning profile that they are issuing for new developer accounts (for months at the moment). They can check what's exactly you are launching, when, how app is installed, big brother is watching, it's 1984 by Orwell. More importantly, they can check if app identifier belong to AppStore app or not. If it does, but app wasn't installed from AppStore, congratulations you are violator of their policy and Apple Developer Agreement. So they detect such cases and ban accounts immediately, issuing no refunds for their actions and limiting our freedom.
ocean raptor
#

L

native dune
#

then you dont have ppqcheck

#

iirc people that enrolled late 2021+ have it

ocean raptor
#

I hate theos

native dune
#

yell at kirb

#

yea but i think its fine since it was first enrolled in 2020

ocean raptor
#

I literally just told you

#

Idk why but I had to press enter a ton of times to get it to sign though

#

No

#

I didn't

#

Why would I

#

What is that error from

#

I need more info

native dune
#

damn

ocean raptor
#

@restive ether give me filter bypass

#

This from me signing or you

native dune
#

wtf an assert on procursus ldid

primal perch
#

among us

#

auto

ocean raptor
#

ok

#

does ldid handle appex correctly?

ocean raptor
#

lol

#

ok

#

come back when you fixed the issue

native dune
#

ldid -S Gay Pack.app

primal perch
#

D E E P

fathom snow
primal perch
#

whar

fathom snow
#

sorry

#

*xina15

vivid dew
spice egret
lime pivot
onyx ember
#

@ocean raptor lol

#

nvm got it to work

tepid olive
#

ok ui?

unkempt raft
opal sparrow
#

Is there a fix yet for XinaA15 1.1.5 to update the 35 dependencies?

crisp frost
tepid olive
#

anyone knows how to copy a folder from bundle directory to another path? for example a folder named assets to /var/mobile/Media/assets

#

in objc

fathom snow
#

I FIGURED IT OUT all of the correctly signed binaries are in /var/jb/xina!!

tepid olive
#

smh

fathom snow
#

i'm SORRY

elder scaffold
#

Does anyone know where can refer to the firmware key for ios 16.1+

#

the iphone wiki doesn't seem to be updated for some reason

tepid olive
elder scaffold
#

umm, but thanks

tepid olive
#

there’s no other way

#

you can also ask nicolas in hack different

elder scaffold
#

i have most checkm8 chips

#

So if i don't think about time and effort, that's fine

tepid olive
#

Yeah

#

Upload them after please

elder scaffold
#

true troll

wheat grotto
#

Found this guide for creating an auth system in nuxt, aaand i have an sql db that i can store creds in, but i dont really understand where and how i should send the creds to the db

hasty ruin
#

It’s easier

#

username:password

wheat grotto
#

i don’t work for twitch

#

but yeah, i still haven’t quite grasped how nuxt works

#

so that’s also an issue

fathom snow
#

ok so I have ldid on my phone now, I signed a curl binary with the same ents as the ldid binary and the same certificate as the ldid binary

#

but it still won't run

indigo peak
#
@interface CalculatorHistoryViewController : UIViewController
@end

@implementation CalculatorHistoryViewController
- (void)viewDidLoad {
    [super viewDidLoad];
    self.title = @"History";
    self.view.backgroundColor = [UIColor colorWithRed: 0.20 green: 0.20 blue: 0.20 alpha: 1.00];
}
@end

// presenting code
CalculatorHistoryViewController *vc = [[CalculatorHistoryViewController alloc] init];
[[self _rootView].rootViewController presentViewController:vc animated:YES completion:nil];

why does the title not show up

naive kraken
indigo peak
#

:/

#

that sucks

#

bc when i was doing that, i set a UITableView constraint to be the bottom of the nav bar, and when the view was rotated to be landscape, the tableview wasnt exactly in line w the top

#

well actually

#

i lied

#

but

#

it still doesnt work

#

i think

unkempt raft
indigo peak
#

the view shows up

#

not the title

unkempt raft
#

yeah you have to subclass uinavigationviewcontroller swiftui oops trollface

tepid olive
#

follow what opa said

indigo peak
#

@interface CalculatorHistoryViewController : UINavigationController

#

that?

unkempt raft
tepid olive
#

you don’t need to subclass UINavigationController unless the calculatorhistoryviewcontroller is for navigation, which from what i understand, it is not

#

A navigation controller is a container view controller that manages one or more child view controllers in a navigation interface

#

from my understanding, your calculatorhistoryviewcontroller is not going to be managing other vcs

#

but rather, you want to have it be managed

indigo peak
#

i just want smth like that

indigo peak
#

but without having to manually specufy the dimensioons and shit of it

tepid olive
#

specify the dimensions of what

indigo peak
#

The navbar

tepid olive
#

you don’t have to specify navbar dimensions

#

the navigation controller takes care of that on its own

indigo peak
tepid olive
#

i am flabbergasted

#

you gotta use clang-format or something my man

tepid olive
#

is completely unnecessary if you just use a navigationcontroller

#

because it’ll create and manage the navigation bar for you

#

and you don’t have to do whatever that is

#

and to add the actions (done, clear, etc) just do it via the navigationItem of the calculatorhistoryviewcontroller

indigo peak
#

yeah thats why i want to use a navigation controller

tepid olive
#

check out the documentation link that source location sent

hexed knot
#

@primal perch

indigo peak
#

@tepid olive sick

#

ty

#
CalculatorHistoryViewController *vc = [[CalculatorHistoryViewController alloc] init];
UINavigationController *navController = [[UINavigationController alloc] initWithRootViewController:vc];
[[self _rootView].rootViewController presentViewController:navController animated:YES completion:nil];
indigo peak
#

@tepid olive everything works perfectly

#

Thanks again

tepid olive
#

np, glad you got it working

indigo peak
#

I’m going to try and make the big switch block not so repetitive

#

Might have to do some &orig calls

tepid olive
#

true

lime pivot
#

big if kCFBooleanTrue

tepid olive
graceful gate
#

big if YES

lime pivot
#

big if !!1

indigo peak
#

big if 3 % 2

indigo peak
#

@tepid olive i wrote the most jank function that somehow works uhh

#
void (*orig_touchesEnd)(id, SEL, id, id);

NSString *function(NSMutableString * __strong *one, NSString *function, NSMutableString * __strong *two, id s, SEL _cmd, id touches, id event) {
    [*one setString:[displayView accessibilityValueLabel].text];
    [*two setString:function];
    orig_touchesEnd(s, _cmd, touches, event);
    NSString *ret = [NSString stringWithFormat:@"%@(%@) = %@", function, *one, flatten([[displayView accessibilityValueLabel].text doubleValue])];
    [*one setString:[displayView accessibilityValueLabel].text];
    return ret;
}
#
case 37: // natural log
    // [one setString:[displayView accessibilityValueLabel].text];
    // [two setString:@"ln"];
    // %orig;
    // result = [NSString stringWithFormat:@"%@(%@) = %@", two, flatten([one doubleValue]), flatten([[displayView accessibilityValueLabel].text doubleValue])];
    // addToHistory(result);

    // [one setString:[displayView accessibilityValueLabel].text];
    addToHistory(function(&one, @"ln", &two, self, _cmd, arg1, arg2));
    break;
#

so now that can replace every function, (sin/h, cos/h, tan/h, ln, log)

tepid olive
indigo peak
#

it is so unbelievably cursed

#

you have no idea

sour fractal
indigo peak
#

thats old code

#

what the function replacess

#

so much kinda better

#

@tepid olive i have an idea, instead of using a case for everything, i use a NSDictionary

#

and i just check the NSDictionary for the button id

tepid olive
#

proud of you for working to seriously improve this project and learn

#

many people don’t do that

indigo peak
#

using a switch statement def only works for the lower data sets

#

like when it was just the 4 basic operations

#

and now that im scaling it up to include 20+ operations

#

def wont go so well

tepid olive
#

yeah lol

#

fs

#

20 switch case statements is a yikes

indigo peak
#

look it made sense when i wrote it

#

@tepid olive so much better

tepid olive
#

much betta

tepid olive
indigo peak
#

im gonna try to make 1 function for all the types
so its not 4 different functions with slight differences

indigo peak
ocean raptor
#

(still working on ~60 packages that are a huge PITA, which includes most perl libraries and llvm woeis )

crisp frost
ocean raptor
#

llvm hates me

#

so does perl

onyx ember
ocean raptor
#

wdym?

onyx ember
crisp frost
#

I should probably just bring my repo offline after after that whole thingy is done but idk if that’ll cause any problems

ocean raptor
onyx ember
ocean raptor
#

you are looking at a cache

onyx ember
#

Ah

ocean raptor
#

I added a buttload of packages

onyx ember
#

How many?

ocean raptor
#

no clue

onyx ember
#

(Shit updating the Procursus trust cache for Fugu will be a pain)

ocean raptor
#

gonna be HUGE

ocean raptor
#

we started with 74 projects, we now have 533

#

so +459

#

we now have 1131 debs

onyx ember
ocean raptor
#

a few of those should only be scripts

#

and others will have tons of mach-os

onyx ember
timid furnace
#

How many trust caches can you load?

ocean raptor
#

this is the list of packages I still need to fix and build

cctools
duktape
futurerestore
ghc
ghostbin
gtk-doc
hidapi
imagemagick
isl
jbig2dec
libapt-pkg-perl
libepoxy
libjson-c
liblocale-gettext-perl
libpod-parser-perl
libredwg
libsgmls-perl
libterm-readkey-perl
libtest-harness-perl
libucontext
libvde
libxml-parser-perl
libyaml-tiny-perl
llvm
lsof
mariadb
mesa-demos
mtree-netbsd
myman
neovim
nodejs
nodejs-lts
openexr
openjdk
po4a
pstree
pythnon3-kimg4
python3-psutil
pyyaml
qemu
r2ghidra-dec
radare2
ruby
screen
sensible-utils
shc
starship
tcsh
tmate
top
tor
ttyrec
unrar
upx
weechat
xcb-proto
xf86-video-dummy
xfe
xmlto
xorg-server
youtube-dl
yt-dlp
onyx ember
ocean raptor
#

@restive ether make me a thread in #development called "capt-hater-backroom"

#

ok

#

@grave sparrow it's not tripping at the main binary

#

on some other binary

#

the symtab offsets don't make sense for the main binary

#

I set a breakpoint right before the assert and the one that it asserted on did not have the same symtab values as the main binary

#

no

#

it's asserting on a different binary

#

the appex

#

it's tripping on that

#

oh

#

hmmm

#

if you remove the assert, does it sign successfully?

#

sideloadable?

#

and launchable?

#

crashes on launch?

#

and it doesn't crash when signed with codesign, right?

#

can you diff -u <(otool -l codesign-signed) <(otool -l ldid-signed)

#

the one that launches and the one that crashes

#

I thought you fixed that already?

#

Ok

#

Do the ipsw macho info --sig -V diff on the appex too

tepid olive
#

is what you’re doing

#

and that works out in the end

#

<3

indigo peak
#

look, it works this far

#

so we chilling

onyx ember
#

@ocean raptor 🤣💀

tepid olive
#

what's the link for the MacDirtyCow writeup

naive kraken
#

means forbidden entitlement most likely

naive kraken
#

The one in TrollStore repo should be a proper p12

pearl sail
ocean raptor
#

And I totally can

pearl sail
pearl sail
ocean raptor
#

You manually build each package

pearl sail
#

That you will hate

ocean raptor
pearl sail
#

I know

tepid olive
steep granite
turbid fjord
#

OMG procursus 3 electric boogaloo

pearl sail
#

Very true

indigo peak
#

@ocean raptor how do i build ldid for windows

ocean raptor
#

Don't

#

Just download the actions

#

Compiling for windows is too complicated

indigo peak
#

im building shitter's ldid

ocean raptor
#

Grab it from the pr

#

I just approved his actions

indigo peak
#

where windows

restive ether
#

you're looking at it

#

@grave sparrow .07 per assert

ocean raptor
indigo peak
#

yeah i realized that

ocean raptor
#

@marble perch should ldid automatically add the full chain to the p12 when signing if it's not in there already?

onyx ember
indigo peak
#

preach my brotha

onyx ember
indigo peak
#

what

naive kraken
#

yeah that's what I reported

#

well then, neither do I

ocean raptor
#

uhhhh

spice egret
#

Anyone know where the system fonts are located?

tepid olive
#

anyone knows how to write a file to a specific directory without access to /var? i have access to /System but i dont for var and my file is there

ocean raptor
#

what

tepid olive
ocean raptor
#

I don't care

tepid olive
#

wait nvm im stupid, another question then. how do I copy a file from documents folder to bundle?

ocean raptor
#

AHHHHHHHHHHHHHHHHHHHHHHHHHHH

tepid olive
#

bruh

ocean raptor
#

this is what I get for not testing stuff

wicked summit
#

gm

#

merry Christmas

ocean raptor
#

llvm

tepid olive
ocean raptor
#

How about your mom stops being a whore?

vivid dew
#

true and based

tepid olive
#

@vivid dew

vivid dew
#

WTF
HOW

wheat grotto
#

can someone help me with these ? already installed fs, have no idea what the fuck node:util is and honestly have absolutely no idea about the 2 warnings

#

o wait im f blind

#

poggers

tepid olive
tepid olive
#

@tepid olive have you looked into what needs fixed for arm64e?

tepid olive
#

no actually

#

it gets further than i thought

#

which means that it’ll work out

#

gonna use the one weird trick to get the a key

#

wait wait wait @naive kraken if all processes with the same team id share the keys, will processes signed with the CT cert have the same keys as launchd

#

(pac A keys)

naive kraken
tepid olive
#

oh

naive kraken
#

it's a system binary meaning it's ad hoc signed and in trustcache

tepid olive
#

shoot

#

that’s annoying

naive kraken
#

your best bet is the thing you said earlier

tepid olive
#

ok gonna try the posix spawn method yeah

naive kraken
#

should work tbh

tepid olive
#

i hope

naive kraken
#

this is kinda a security barrier too because normally without the CT bug you can't spawn arbitrary binaries

#

and to spawn arbitrary binaries you'd need to nuke amfid

#

and to do that you'd need to bypass PAC

#

so chicken egg problem

#

So I assume it could just work

tepid olive
#

awesome

#

yes

#

posix_spawnattr_set_ptrauth_task_port_np

naive kraken
#

the thing that apple put themselves into pac.md

#

not like they're not aware of it

#

tbh userspace pac was never anything protecting from the case where someone already has krw

#

it's mainly to make like exploiting userspace processes harder

indigo peak
#

opa do you wanna like, make a iOS 16 sandbox escape

#

actually scratch that

#

just update troll store for iOS 16 please

#

that’s like an afternoon activity for you

#

make it a Christmas miracle

tepid olive
#

@tepid olive no rush at all but when you have a build that needs testing I’d be more than happy to test it for you

tepid olive
#

like

#

what are the odds.

tepid olive
naive kraken
tepid olive
#

should work

#

i hope

indigo peak
naive kraken
tepid olive
#

were waiting @opa335

indigo peak
#

you’re one of the smartest people I’ve ever talked to

tepid olive
#

@opa333

#

wtf

indigo peak
#

at least when it comes to iOS

tepid olive
#

at least when it comes to Discord iOS

naive kraken
#

I have never even found a bug

#

so idk

tepid olive
#

who needs to find bugs

indigo peak
indigo peak
naive kraken
indigo peak
#

why not

naive kraken
#

conflict of interest

indigo peak
#

mhm

naive kraken
#

I can be very greatful that Cellebrite has no problem with me working on my existing projects as is

#

But I can't just publish a bug I find

#

And also I'm fine with that

indigo peak
#

:(

#

I wish I was as smart as you

naive kraken
tepid olive
#

Very nice

#

With that thingy you can do almost anything can’t you?

naive kraken
tepid olive
#

Lol jk obviously

high citrus
#

at least when it comes to fake merch

naive kraken
indigo peak
#

ive been trying to do iOS shit since 2020

naive kraken
#

and tbh I got into the very advanced stuff by accident while just working on Crane

indigo peak
#

and I still have 0 idea what I’m doing now

#

and it’s 3 years into it

naive kraken
#

then the problem is most likely that you never got the fundamentals down

hasty ruin
#

you need to make minecraft videos to get knowledgable on ios internals

tepid olive
#

I wish I knew where to start so I could teach myself but I doubt I could

naive kraken
#

I have heard getting banned from The Hive for bullying a staff member also increases your chances

hasty ruin
indigo peak
hasty ruin
#

mods have been fine to me tho

#

always unban

naive kraken
hasty ruin
#

that was when they were HUGE

#

with deathrun

next wadi
#

BEEBA

naive kraken
#

the owner literally knows me because he personally issued the ban

next wadi
#

SKOOP INNA DINK

naive kraken
#

those where wild times

next wadi
#

Whoever reacted with the moyai emoji is Hella Gay.

high citrus
ocean raptor
hasty ruin
indigo peak
naive kraken
#

being dumb is a mindset though

hasty ruin
naive kraken
#

coding is 90% mindset

#

and continuity

indigo peak
tepid olive
#

I am speed

naive kraken
indigo peak
naive kraken
naive kraken
#

But you will get better with time

#

What I did, whenever I learned something new I always went back to my old code and improved it

#

Safari Plus 1.0 was ass

#

literally all of that code was rewritten at some point

#

some stuff even multiple times

indigo peak
naive kraken
next wadi
#

cope and seethe some more please

naive kraken
#

SafariPlusWK damn I don't even remember that lol

hasty ruin
next wadi
#

who is he

#

😭

hasty ruin
#

that formatting though

next wadi
#

fugly code

#

ugly

#

ugly

naive kraken
next wadi
#

ugly

#

ugly

#

ugly

#

🤮🤮🤮🤢🤢🤢🤢🤢🤢

#

me rn

primal perch
next wadi
#

oh

#

wait

#

did you write that @hasty ruin

hasty ruin
#

no

next wadi
#

if not nevermind it is very nice 😇😇

hasty ruin
next wadi
#

i just dont like it if you made it

indigo peak
hasty ruin
#

i dont trust people that write if(condition)

naive kraken
hasty ruin
#

gotta have the space

indigo peak
#

I mean, I’m rewriting the tweak now

#

but it’s just so bad

turbid fjord
next wadi
#

also if (condition == true)

naive kraken
indigo peak
#

don’t worry

hasty ruin
indigo peak
naive kraken
#
  1. you don't compare against localized strings
  2. you don't hook layoutSubviews
#

could be much worse

hasty ruin
#
if(condition)
{
}
else
{
}
} else {
}
indigo peak
hasty ruin
#

there's a clear winner

indigo peak
#

@naive kraken check that out

indigo peak
hasty ruin
#

ong

next wadi
#

there was a solid month where thats how i wrote brackets

hasty ruin
#

you change formatting every week

next wadi
#

i really do

naive kraken
next wadi
#

im never happy with it

indigo peak
#

like why do I load prefs every time I hook

#

I don’t need to %init every class manually

naive kraken
#

That's all neglectable

#

not that bad

high citrus
naive kraken
#

There is no better way to get the most up to date preferences

#

At least in a sandboxed env where you don't want to use Cephei

hasty ruin
#

unreleased tweak i wrote in like 2019 within filza frcoal

naive kraken
#

so what

indigo peak
#

@high citrus

naive kraken
#

I mean, if prefs are not supposed to change while the app is running, sure

#

but again, if it can be fixed by commenting out a bit of stuff

indigo peak
#

They aren’t

naive kraken
#

it's not bad code

indigo peak
#

considering when you leave gamepigeon it restarts the app

primal perch
hasty ruin
#

for real

indigo peak
#

finally I broke opa

#

let’s gooo