development

[next wadi]

i got inheriting working

main luzbuild

# meta
meta:
  # cc
  cc: /usr/bin/gcc
  # swiftc
  swiftc: /usr/bin/swiftc
  # zstd compression
  compression: zstd
  # rootless
  rootless: False
  # platform
  platform: macosx
  # vers
  version: 13
  # archs
  archs:
    - arm64
    - arm64e

# control info
control:
  # package name
  name: TrolleyTools
  # package bundle id
  id: com.jaidan.trolleytools
  # package architecture
  architecture: all
  # package description
  description: TROLLEY BUS DEMO
  # author
  author: Jaidan
  # section
  section: Tweaks
  # version
  version: 1.0.0
  
submodules:
  - C_Tool/
  - Swift_Tool/
  - Logos_Tweak

C_Tool/ luzbuild

# modules
modules:
  TrolleyToolC:
    # install dir
    installDir: /usr/local/bin
    # module type
    type: tool
    # source files
    files: Tool.c
    # compile changed
    onlyCompileChanged: False```

Logos_Tweak/ luzbuild

# meta
meta:
  # sdk
  sdk: $THEOS/sdks/iPhoneOS14.5.sdk
  # platform
  platform: iphoneos

# modules
modules:
  TrolleyTweakLogos:
    # module type
    type: tweak
    # source files
    files: Tweak.xm
    # compile changed
    onlyCompileChanged: False```

and it builds the Logos_Tweak submodule with the specified sdk

and inherits the rest from the main module

same with C_Tool

@grave sparrow

im the GOAT

[tepid olive]

true

[next wadi]

and if you're wondering how this impacted speed

it didn't.

you all should FEAR me

im too good

this is GOAT BEHAVIOR

🐐 🐐 🐐 🐐 🐐 🐐

[next wadi]

@timid furnace

[pearl sail]

don't care + you're pasty

[timid furnace]

Can you make a schema file

something to describe every possible option

idc whether it's an actual proper schema thing or whether it's just a YAML file with every option listed

would save me from looking through the code to see what options there are that aren't in the sample file

[next wadi]

https://github.com/LuzProject/luz/blob/main/luz/compiler/config/defaults.yaml

this has every option aside from installDir inside the modules

as well as what they default to

[steady nest]

sakuraaaaaaaaa

PORTUGUESE

[rotund hull]

anyone found a way to bypass ssl pinning in apps on ios without a jailbreak? I want to proxy my iphone to intercept requests from a private API

[faint stag]

jb required (or frida if possible)

[rotund hull]

:(

[steady nest]

there's a way without jb iirc

and without frida

I used it to intercept Xiaomi's traffic

https://github.com/doronz88/harlogger oof they changed it in 15

[woeful badge]

It is changed by apple because it was used by fmi off

[indigo peak]

w

[gaunt helm]

Your form has been received. Please allow up to 100 years for us to process your form. Thank you.

[hasty ruin]

hurry the fuck up then

[gaunt helm]

Your personal advisor has passed away. Estimated processing time: ∞ years

[tepid olive]

asking for a friend: how do you programmatically disable/enable location services and what entitlements do you need

[indigo peak]

@tepid olive as a tweak

or like trollstore

[tepid olive]

TrollStore or jben

[indigo peak]

bc i know how as a tweak

[tepid olive]

will probably help idk just asking on their behalf

[indigo peak]

its just hooking CLLocation and just returning nil for a bunch of shit

[tepid olive]

ty

"You can’t hook if you’re not using a tweak"

[indigo peak]

%hook CLLocationManager

- (id)delegate {
    return nil;
}

- (CLLocation *)location {
    return [[CLLocation alloc] initWithLatitude:0 longitude:0];
}

- (void)setDelegate:(id)delegate {
    %orig(nil);
}

%end

[indigo peak]

yeah ik, thats why i asjked

[tepid olive]

Does anyone know any good tutorials for learning ARM64 for someone with no previous experience with assembly?

[exotic heath]

does anyone know if is possible to put android whatsapp on ios? i know that its impossible to put a apk in ios, but there is a way to mod like watusi? or something like that

[glacial matrix]

Short answer: while theoretically possible it’s not simple, easy, nor done already

[exotic heath]

want to be the first then, just need help

someone that knows

[glacial matrix]

Do you know both Android and iOS internals to make a bridge between Java and objc/swift?

[exotic heath]

i have friends that mod android whatsapp and friends that mod ios

[glacial matrix]

Get them together then 😜

[exotic heath]

string mod

[glacial matrix]

Not sure that that screenshot is good enough proof to be able to emulate Android libraries on an iOS device

[exotic heath]

its not.

do u have any aknowledge to help us? we are from brazil but i can always translate

aknowledge

[glacial matrix]

I don’t have time or incentive to do much about it but I’d recommend Jonathan Levin’s books on internals, as well as read on emulation, simulation and virtualization

You need to know how both Android and iOS app lifecycle works, at the very least

[exotic heath]

god damn

seens difficult

need to chat with then

[tepid olive]

what exactly is your end goal

just use watsui

[glacial matrix]

Depends on where you’re looking from

[exotic heath]

put whatsapp from android in ios

without apk

[tepid olive]

why android

[exotic heath]

i want hype

we already got some but making a android whatsapp for ios is going to revive ios community in brazil so

we got some vids showing a modded watusi

wait

i can send links?

[exotic heath]

https://youtu.be/4Ll6n3z9cXE

there

[tepid olive]

[exotic heath]

happens

but u can see?

[exotic heath]

oh i get, its because i reposted this video, i downloaded from wp

[exotic heath]

this my plan, know someone to help?

[tepid olive]

you wont be able to emulate android on ios

its too complicated

[exotic heath]

i’m trying to mod the ios one

[kindred fable]

does anyone here know cmake enough to help

i'm trying to set up a development framework for ios to be usable on windows

and idk what i have to do to make cmake cross-compile

[gentle grove]

https://www.atnnn.com/p/operator-larrow/

is this real

[cloud yacht]

Why don't you try it and see?

[gentle grove]

I can't

[kindred fable]

enzyme update https://github.com/camila314/enzyme

it is now kinda sorta usable on mac!

[torn hawk]

so this essentially patches ipas as far as i understand?

[kindred fable]

pretty much

that + provides a build system where you can easily write code for static hooks

[tepid olive]

But you still need to get your hand on the ipa to inject it yourself right? Is it a better method than getting a decrypted ipa and then injecting the tweak?

Not sure I really understand how it works

[faint stag]

you will always need a decrypted ipa

the app will not launch if you modify code or modify signing if encrypted

think theos-jailed, not something like sideloadly

[kindred fable]

the point is to make actually injecting code much easier once you have the ipa

the biggest benefit is that enzyme doesn’t operate only through objective-c

it’s raw hooking

meaning you can write tweaks for any app regardless of what language it’s in

i created enzyme specifically for an extensive mod menu for geometry dash

a game written in c++

since objc selectors are just like C functions you can use this for objc too

[hasty ruin]

omw to write tweaks in brainfuck

[kindred fable]

real

[indigo peak]

dghost typing

real

[twilit jungle]

[hasty ruin]

DGh🙄st*

[indigo peak]

DGh st

hey

i was typing that

give me a minute

[hasty ruin]

slow

[indigo peak]

i couldnt find the emoji

[twilit jungle]

[hasty ruin]

i just copied his name

[indigo peak]

weak

[hasty ruin]

i won though

so who's the real winner

[indigo peak]

but at what cost

[indigo peak]

ok?
not you

[hasty ruin]

2 keystrokes off my keyboard's lifespan

[indigo peak]

technically 3

ctrl + c/v

how does WDBRemoveThreeAppLimit work
like how can it "hook" a method using dirtycow

[tepid olive]

it rebinds chained fixups

[indigo peak]

you lost me at "it"

[hasty ruin]

no ctrl needed

[tepid olive]

finally i can use lua

[kindred fable]

well the tweaks are still in c++💀

but you could write a mod for a lua app

by hooking the lua c engine and injecting your stuff

so i guess you can technically use lua

[tepid olive]

Sadly the last project that allowed lua outside of game engine for iOS is 8 years old

so no more lua

[kindred fable]

common apple L

[tepid olive]

Nah open source projects, not apple

Oh i bet they never even heard of it, why would they even use it, its just a super easy, beginner friendly language, which has lots of modules for multiple usages, and its not like if it was made to be an embeded language at some point anyways

[kindred fable]

true

[tepid olive]

ya ever used it?

[kindred fable]

but also i don’t like lua syntax

[tepid olive]

Bro

How can you not like it

[kindred fable]

when i was 11 i did roblox stuff

[tepid olive]

When you look at obj-c's syntax

[kindred fable]

so yeah i did lua

i like objc 💀

[tepid olive]

you can't say its not a better option to obj-c

[tepid olive]

bro reading the syntax gives me strokes

[kindred fable]

i’m just quirky like that what can i say

i’d rather write a basic app in objc than swift

[tepid olive]

i'd rather write it in lua

[kindred fable]

i’d rather write it in rust

[tepid olive]

https://github.com/alibaba/wax
lua for iOS 💀

bro the syntax is so ass fr

[kindred fable]

pyobjc is a better wrapper i think

[tepid olive]

py

so you mean python

bro do you know how badly i fucking hate python

Fuck python's syntax

I'd rather seriously learn cpp than python

[kindred fable]

half of enzyme is python

[frank fossil]

Fun fact: you don’t need brackets for functions that take no parameters

[kindred fable]

the other half is c++ and asm

[tepid olive]

i respect this half

[kindred fable]

well it’s “asm”

i made my own tiny preprocessor for arm assembly

(in python)

for ease of use

[tepid olive]

bro

fuck python

its all i'll say

[kindred fable]

lol you should see the python code

it screams “nobody was supposed to see this”

[tepid olive]

THE FUCKING INDENT

[kindred fable]

bc they weren’t

enzyme is literally held together with sticks and rocks

[tepid olive]

i mean

its still prtty cool

[kindred fable]

i agree

originally it was tailored very specifically for geometry dash

i had to do a lot of silly things to make it generic

[tepid olive]

i mean

still nice

fuck python

[kindred fable]

it’s cool though

[hasty ruin]

no way youre saying lua has a better syntax than objc

[next wadi]

brand new no-ar compression + decompression @timid furnace 😼

it works

i may or may not have typed my password wrong the first time dont sue me

[timid furnace]

lol nice

working on something rn but will try it in a bit

[primal perch]

zst better

[native dune]

so true

zst best

[faint timber]

zst will be the face of my next project

1.6kb -> 1.2kb

[primal perch]

chad

[tepid olive]

wanna bet?

[hasty ruin]

username checks out

[primal perch]

[tepid olive]

Dude lua is so much more fucking readable, ofc there are those sweats that are gonna make some weird fucking things but who cares about em

[tepid olive]

well actually i was named that way

[primal perch]

having done roblox development for a spell, i hate lua

[tepid olive]

I don't do roblox dev dw

[primal perch]

but you're entitled to your opinion so i will leave it at that

[tepid olive]

it looks sad af

[hasty ruin]

having done roblox cheat development to annoy children, i hate lua

[tepid olive]

i legit cheat in roblox like i own synapse and shit

i mean i have a synapse license

but roblox ain't so cool now, so i stopped playing at all

[hasty ruin]

synapse fell off

[tepid olive]

i also have sw...

[hasty ruin]

theyre moving to a subscription model

[tepid olive]

that one pwetty good and still not sub based yet

[hasty ruin]

if i end up wanting a new injector in the future imma get sw yea

done with synapse

[tepid olive]

i mean it never crashed so who cares

and v3 coming out soon, tho they postponned it cuz byfront and they are scared

[kindred fable]

i wanna make an injector for mac i feel like it’s possible

[primal perch]

https://media.discordapp.net/attachments/933428639620542474/1067152949211574332/caption.gif

[tepid olive]

tf is zefram

[primal perch]

@grave sparrow

[tepid olive]

yeah, and i got boned because of my cheat software merging with them for v3

[hasty ruin]

[primal perch]

zefram 2

[tepid olive]

if you've heard of protosmasher

it was a one time payment but their cheat client worked fine

although i never cheated on my main, obviously

[hasty ruin]

i do

[tepid olive]

although if roblox bans my main, i literally will not care that much

they're a company that reeks of pedos, piss-poor mismanagement, and shitty business practices

[hasty ruin]

real

[tepid olive]

roblox reeking of pedophilia isn't a joke either; an admin got fired after they were exposed to be a pedophile, and also roblox doesn't ban pedophiles on their platform

[tepid olive]

pedophiles only get banned off of roblox if their game gets DMCAed by SEGA, or if the FBI arrests them

[hasty ruin]

[tepid olive]

i wish that were a joke

[tepid olive]

https://youtu.be/wdDfdlLuAgA

major content warning btw

lots of really, really dark shit in that video

[gentle grove]

https://twitter.com/nixcraft/status/1623058575961759746?s=20

nixCraft 🐧 (@nixcraft)

can you help?

Likes

600

Twitter · Feb 7, 2023, 8:38 PM

[faint stag]

yq is the most obvious one
i know nothing else

[gentle grove]

idk what yq is

[faint stag]

it's jq for yaml

lol

[gentle grove]

oh

[indigo peak]

is there a boolean entitlement that all apps have an entitlement for

or like

whats one that i can use

wow that was a bad qeustion

lmao

[timid furnace]

i presume you mean "is there an unrestricted boolean entitlement i can add"

[indigo peak]

what boolean entitlement can i give to an app thats signed w a free dev account

yeah

that can set to be "true"

[timid furnace]

read the discussion section of the entitlements listed here
https://developer.apple.com/documentation/bundleresources/entitlements?language=objc

but some choice picks:
https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_fileprovider_testing-mode?language=objc
https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_kernel_increased-memory-limit?language=objc

[indigo peak]

bet

tysm

I think I might be onto something and I needed an entitlement

[timid furnace]

good luck

[indigo peak]

thank you

did you ever figure this out

[unkempt raft]

Yes

[indigo peak]

how

[steady nest]

https://media.tenor.com/MFVmqvq6jr4AAAAC/openbsd-puffer-fish.gif

[primal perch]

[hasty ruin]

fugu16

[pearl sail]

ban yourself to the nether realm

[hasty ruin]

sleep in the nether

[pearl sail]

die in the nether

[hasty ruin]

too skilled 😎

[cloud yacht]

more like creative mode

[hasty ruin]

no orange name? shut up

[tepid olive]

me

[tepid olive]

is that penis fish, the long awaited sequel to penis dog?

[primal perch]

bock and calls

[tepid olive]

it’s not happening

[indigo peak]

how 💀

[unkempt raft]

Yes

[indigo peak]

can you tell me 😭

[exotic heath]

smash

[ashen birch]

use my python shit

!

[frank fossil]

I have a crazy idea for MacDirtyCow, unless the following file is somehow signed
overwrite /Developer/.TrustCache with yours
overwrite another executable in /Developer and provide it with arbiratry entitlements
profit (haven’t tried this)

[tepid olive]

i don’t think this is possible

because people would have done it on iOS 14 to untether

u know what might be doable

debugserver hijacking

grant jit to a process that is run as root / unsandboxed and get a code exec primitive

[ocean raptor]

That is a trustcache in a signed img4

[tepid olive]

yes, that is the way

no we don't

this is iOS 16.1

lmao

@grave sparrow is setgid enough for root code exec

also @grave sparrow if something has CS_DEBUGGED will I be able to execute unsigned memory freely on iOS

debugserver has great entitlements

do i have to protect it

welp

thats harder

WAIT

LMAO

ok this is cool

there's a perfect piece of code here

trying to get full code execution in debugserver

so i can posix_spawn my app as root

[steady nest]

Don’t you have arbitrary ents

[tepid olive]

or just get unsandboxed code exec

no this is MacDirtyCow

it doesn't but it can setgid and setpgid

so maybe this will wofkr

work

only problem is that this won't allocate in the current task

[indigo peak]

/private/var/root/Library/MobileContainerManager/containers.sqlite3 what's this file

would overwriting this do anything?

[faint stag]

have you tried looking in the db lol

[indigo peak]

yeah i did after i sent that

i feel dumb now lol

[faint stag]

yep, it should be where containers are defined

better not touch it

[naive kraken]

no there is a check in PPL code where it always checks whether the target process has get-task-allow or run-unsigned-code before it sets CS_DEBUGGED

write a single swift method with a "do catch" challenge (impossible)

ok apparently try? exists

[zenith hatch]

it will return an optional of the return type if the func/method fails

and try! kills execution if it throws

please don’t use try! in production

[naive kraken]

swift thinks I'm dumb

I don't like swift

[zenith hatch]

L

whats wrong ill help you before i sleep

[cloud yacht]

tbh 99% of programmers are dumb

[zenith hatch]

i disagree

my app is fuckin lit

best thing ive ever made in my life

[naive kraken]

swift is wrong

[zenith hatch]

next to yt on apple watch

[cloud yacht]

your apps brightness is not related to your intelligence

[zenith hatch]

send me your code and stop hating on swift

[naive kraken]

like my super power brain obviously already thought of the case where some shit throws or it returns nil and knows it's not an issue but it still wants me to unwrap shit and all of that

like that makes anything better

[zenith hatch]

yeah duh you have to unwrap it to get its values

use conditional unwraps

such as

[naive kraken]

static func locateExistingFakeRoot() -> String? {
        let ppURL = URL(fileURLWithPath: "/private/preboot")
        let candidateURLs = try? FileManager.default.contentsOfDirectory(at: ppURL , includingPropertiesForKeys: nil, options: [])
        for candidateURL in candidateURLs {
            if candidateURL.lastPathComponent.hasPrefix("jb-") {
                return candidateURL.path
            }
        }

        return nil
    }

[zenith hatch]

lemme pull macbook out

[primal perch]

@here gm

[naive kraken]

no I just want this to compile

it complains about candidateURLs being optional

[zenith hatch]

i cant make it compile if im on mobile

[naive kraken]

like tf just don't execute the damn loop if it's not set

[zenith hatch]

not how optionals work but ok

[naive kraken]

You don't have to pull your macbook out for this

Yeah but why not

[naive kraken]

I just hate Swift

[zenith hatch]

L

its literally an easy language

[naive kraken]

In objc I don't have all of this bs and everything works fine

[zenith hatch]

because everything in objc is optional

[primal perch]

so real for that

[naive kraken]

as it should be, just skip everything when something is nil, what could go wrong

[primal perch]

this but unironically

just let it crash

[cloud yacht]

tbh this is part of why I like js

[naive kraken]

I fixed this with a single ! now

[zenith hatch]

that'd work but its bad for production

[naive kraken]

I literally don't care though

[zenith hatch]

do you want the entire func to return nil if the contents of dir fails

[naive kraken]

yea

[zenith hatch]

static func locateExistingFakeRoot() -> String? {
    let ppURL = URL(fileURLWithPath: "/private/preboot")
    guard let candidateURLs = try? FileManager.default.contentsOfDirectory(at: ppURL , includingPropertiesForKeys: nil, options: []) else { return nil }
    for candidateURL in candidateURLs {
        if candidateURL.lastPathComponent.hasPrefix("jb-") {
            return candidateURL.path
        }
    }

    return nil
}```

enjoy

[naive kraken]

Yeah I had that too

[zenith hatch]

guard 🙏

[naive kraken]

but it looks fucking ugly

[primal perch]

i mean

it already did

so you might as well be safe

[zenith hatch]

true

also its just inverted if statement

rf

[primal perch]

swift be like ????!!??!?!?!

!?!?!?!

[zenith hatch]

disagree

[naive kraken]

like why can I not get anything in swift done with fucking {} brackets

[zenith hatch]

nvm

[primal perch]

the chad C

int *gorn = malloc(1024);
*gorn = 30; // might be unsafe, might work, who cares

[zenith hatch]

read the docs bruh, they teach this shit to 6 year olds

[timid furnace]

@naive kraken what about this

static func locateExistingFakeRoot() -> String? {
        let ppURL = URL(fileURLWithPath: "/private/preboot")
        let candidateURLs = try? FileManager.default.contentsOfDirectory(at: ppURL , includingPropertiesForKeys: nil, options: [])
        if let candidateURLs = candidateURLs {
        for candidateURL in candidateURLs {
            if candidateURL.lastPathComponent.hasPrefix("jb-") {
                return candidateURL.path
            }
        }
        }

        return nil
    }

[zenith hatch]

[timid furnace]

ignore the formatting i did this in an online swift compiler

[zenith hatch]

wait up

[primal perch]

wait pp

[zenith hatch]

static func locateExistingFakeRoot() -> String? {
    let ppURL = URL(fileURLWithPath: "/private/preboot")
    let candidateURLs = try? FileManager.default.contentsOfDirectory(at: ppURL , includingPropertiesForKeys: nil, options: [])
    if let candidateURLs = candidateURLs {
        for candidateURL in candidateURLs {
            if candidateURL.lastPathComponent.hasPrefix("jb-") {
                return candidateURL.path
            }
        }
    }
    
    return nil
}

formatted

[primal perch]

formatte

french

[zenith hatch]

ew

gonna kms for that

[naive kraken]

that's so cursed

if let candidateURLs = candidateURLs wtf

[zenith hatch]

conditional let

i think they shortened it to if let optionalVariable {}

idk

[naive kraken]

shouldn't exist

[primal perch]

porn gorn

[naive kraken]

whatever that is

[zenith hatch]

you still deal in optionals 24/7

literally no guarantee of a value existing in objc

[timid furnace]

this works

[naive kraken]

at least I don't write two lines of code and get like 20 compiler errors in objc

[zenith hatch]

yoo W i should use it more often (ive never used it once)

[timid furnace]

idk i don't use swift so

[zenith hatch]

bro really cannot be serious

[naive kraken]

like it's a jailbreak it's not some military software

idfc if it crashes

[zenith hatch]

end users:

[primal perch]

dude the jailbreak is already 20x more unstable

so i dont think thats the main concern tbf

[naive kraken]

nah it will be stable af except for the wifi bug

[zenith hatch]

chinese chars thing?

[primal perch]

https://cdn.discordapp.com/attachments/1002131370400809010/1067685619066740807/F96603AB-2F1E-4AE0-9E5F-3E49157EECDC.gif

[zenith hatch]

real

2023-02-09 21:59:58.820371+0000 iPod[4981:1156040] Unbalanced calls to begin/end appearance transitions for <TtGC7SwiftUI41StyleContextSplitViewNavigationControllerVS_14NoStyleContext: 0x1040dcc00>.

ipad moment

[primal perch]

ios moment

(shit code)

[zenith hatch]

disagree

i put an unmodified iphon app on ipad and mac

both suck ass

[tepid olive]

https://cdn.discordapp.com/attachments/1002131370400809010/1067685619066740807/F96603AB-2F1E-4AE0-9E5F-3E49157EECDC.gif

[primal perch]

apples problem for claiming that you can have one codebase

then in reality you have to do hacks to fix broken shit

https://cdn.discordapp.com/attachments/1002131370400809010/1067685619066740807/F96603AB-2F1E-4AE0-9E5F-3E49157EECDC.gif

[zenith hatch]

so fucking true

swiftui does not fix this

[tepid olive]

cap

[exotic heath]

help me, ipa to make transparent icons

[lime pivot]

me when I need to get the pp url

[primal perch]

ware

sucks

PP

[pearl sail]

True

capt does suck dick

[wind ravine]

@naive kraken me and source figured out resetting icon cache without root

it is big brain

[primal perch]

bcvbcvbcvbcvbcvbcvcvb

[faint stag]

never going to forget this one

[wind ravine]

it is a pretty hacky solution but it works lol

[hasty ruin]

Shame you’re using the worlds worst font

[faint stag]

there's much worse

[wind ravine]

at least its not comic sans

[hasty ruin]

[wind ravine]

says me as i code in comic sans

[hasty ruin]

As someone who used comic sans on his phone for a week, it’s not that bad

[wind ravine]

agreed

the capital N just annoys me tho

[hasty ruin]

(Then bytafont broke and didn’t revert the font correctly, so i was stuck with it in some areas of the OS for like a year)

[wind ravine]

lmfao

[faint stag]

#jailbreak message

i got no response for this one

[faint stag]

you should see what i use on my phone

[hasty ruin]

is each letter a different type of animal

[faint stag]

nah

[hasty ruin]

android Mfs

[wind ravine]

is it jailbroken?

[cloud yacht]

no its an android

[faint stag]

no jb, but [[onesettings]] is a thing

[faint lion]

OneSettings

A great enhancement to your Settings App!

Author

Nightwind

Version

1.4.1

Price

$1.49

Repo

Chariz

Bundle ID

com.nightwind.onesettings

Powered by Canister · Feb 10, 2023, 1:44 AM

[faint stag]

[cloud yacht]

no status bar

[faint stag]

auto crop

[cloud yacht]

too much work

[restive ether]

oh no it's that guy who's friends with luci

[native dune]

Choco cooky

[faint stag]

there's similar fonts

but that's not it

[primal perch]

10$ for hours of RE and labor

💯

[restive ether]

bro ain't even offering minimum wage

[primal perch]

its pretty good

if youre in india

[ocean raptor]

Min in Florida is $11

Imagine paying less than Florida

[lime moat]

My own tweaks crashs in palera1n. What should i do for make it work

[lime moat]

Cr4shed also not works on palera1n. I mean that app doesnt makes log

It stuck 10-15 seconds then close

Not a crash at all

They are empety.maybe about my device

Okay lemme try get log

Its not showing real issue i guess. The tweaks make app stuck for 20 seconds. And thats why it crashs (atleast this is what it says)

Maybe this would work

When i sideload the dylib to app it works.i thought its substrate issue. But when i tried without injecting cydiasubstrate it was still working

Yea but thats not the issue im looking for why its causing infinte loop

Since it doesnt launching tweak none of nslogs works. But when i sideload it all nslogs work

Ye

Ok ill try

Im using OsLogger

Since i dont have a mac

[faint stag]

but like, idevicesyslog

lol

[lime moat]

wym

[timid furnace]

idevicesyslog is cross platform and will let you view NSLog

[lime moat]

oh thanks im fine with OSLogger easy to use

[grim sparrow]

Swift > C > ObjC

The runtime scares me

you aren't calling a function, you're asking the runtime to find it for you and then redirect your call

[tepid olive]

what about arm64

i’d rather write arm64 assembly than C

[grim sparrow]

I do like it

its just not my first choice

i'd rather write assembly over objc icl

[tepid olive]

YES

[blazing vault]

Wrong opinion

Swift 🤢

[tepid olive]

i found out how to do macdirtycow unsigned code execution

LETS FUCKING GO

@grave sparrow

[blazing vault]

At least it's not as bad as R*st

[tepid olive]

this all works in theory

[blazing vault]

No PAC/PPL?

[tepid olive]

group id 0 code execution, fully unsandboxed, with cs_debugged entitlement and permissions to debug other processes, with fork being allowed

im slaying

[tepid olive]

No it doesn’t matter

[blazing vault]

Because if it's with PAC couldn't you just do the amfid exception handler thing

[blazing vault]

sweet

[tepid olive]

Amfid doesn’t handle signing anymore

It’s only CoreTrust on iOS 16

I wrote an amfid bypass for iOS 16 already but it doesn’t rly do anything useful

And I’m not publishing because

[lime pivot]

irony of Apple putting all their trust (ha) in coretrust after we just learned it's been fundamentally broken from the start

[timid furnace]

Wtf

Slay

[lime pivot]

me when I hate things because I haven't used it

[restive ether]

dear liberal

[tepid olive]

Slay

[gentle grove]

my c++ program is more c than ++

[timid furnace]

i am mixing vectors and NSArrays

[flint night]

Same 😂

[hasty ruin]

i would not rather not

[faint stag]

pass me a fork and knife

[hasty ruin]

"fork and knife"

[faint stag]

is that not how you eat meat

smh

[hasty ruin]

never heard anyone say fork and knife

it's always knife and fork

[faint stag]

my brain didn't care about the order

[primal perch]

british

[hasty ruin]

you guys say it backwards???

[primal perch]

i just say utensils

whos saying each one

[blazing vault]

hello furries

[faint stag]

hello

[ocean raptor]

Silverware

[primal perch]

:3

POV: i use swiftui

[naive kraken]

ok so hear me out

var fakeRootPath = locateExistingFakeRoot()
if fakeRootPath == nil {
    fakeRootPath = generateFakeRootPath()
    FileManager.default.createDirectory(atPath: fakeRootPath, withIntermediateDirectories: true)
}

locateExistingFakeRoot returns String?

generateFakeRootPath returns String

why is fucking swift complaining in the createDirectory call that fakeRootPath is optional and must be unwrapped?????

[primal perch]

swift is statically typed

assigning a string to a string? is still string?

[indigo peak]

ik you can write to system binaries' __TEXT segments

can you write to user apps __TEXT segements

[timid furnace]

wat

[indigo peak]

like /usr/libexec/installd

is that not system binary

[timid furnace]

are you talking about MDC?

[indigo peak]

yeah

forgot to specify LMAO

[timid furnace]

since when could you modify __TEXT??

__TEXT is codesigned

[indigo peak]

wait

no

not __TEXT

yk what im talking ab

the strings section in ida

[timid furnace]

you can't modify __cstring

that's part of __TEXT

[indigo peak]

🤨

[timid furnace]

you can modify __cfstring because that's part of __DATA/__DATA_CONST

[indigo peak]

oh okay

yeah

that one

cf

not cs

so back to the orig question

can i write user apps

like appstore apps

[timid furnace]

you might end up overwriting them on disk

[faint stag]

well do that and you'd have to backup the binary

or just reinstall the app if you have to revert

[indigo peak]

well my app to overwrite the AppStore app was crashing when I would run it

so idk what I did wrong

since I just copied RemoveThreeAppLimit code and replaced class and methods

[primal perch]

https://github.com/facebook/zstd/releases/tag/v1.5.4 @marble perch wake up babe new zstd

1-10% faster on levels 5-12 on x64 and arm64 platforms

[pearl sail]

@ocean raptor

Package Request Baby

[timid furnace]

What did you change

[grim sparrow]

oh shit

[indigo peak]

can’t say for piracy reasons

[timid furnace]

[indigo peak]

well all I did was swap the class names and the method names

[timid furnace]

this isn't guaranteed to work

patchfind_find_class_rw_t_baseMethods may need to be adjusted

[indigo peak]

hm

weird

it should work

[timid furnace]

if you look at patchfind_find_class_rw_t_baseMethods you should be able to see why it won't work for all cases

[indigo peak]

i dont get it

patchfind_find_class_rw_t_baseMethods apparently works

like it doesnt fail

i think

[next wadi]

for my python heads here

is there any way to check if a function is being ran from a thread?

nvm

🚎

[restive ether]

(he googled the question)

[faint stag]

(he has evolved far beyond a whitename)

[next wadi]

its not possible i think

but i didnt need it anyway

i was being a smooth Brain

[next wadi]

brian

[primal perch]

brian

[tepid olive]

does anyone know how I can block certain domains/websites using objective c or whatever (without writing anything to etc/hosts file)

[faint stag]

there's a tweak called netfence

dunno about source code tho

well ofc none cause it's paid

it's app specific though so I'd assume it's not hard to just hook

app firewall is free but not open source afaik

[tepid olive]

The thing is I wanna do that on nonjb

[timid furnace]

yea that's not happening without modifying your IPAs

[faint stag]

of course

no one is hooking mdnsresponder

[timid furnace]

brb about to hardcode 1.1.1.1 in my app

[ocean raptor]

mdnsresponder is not a full dns resolver

It's only zeroconf

And a stub resolver

[faint stag]

so i should be looking at nsurlsessiond?

[timid furnace]

well if it's a stub resolver then it should be the proper target for a hook

[ocean raptor]

Doesn't iOS have pf

Just use that

[faint stag]

pfd? yeah it does

but ofc, we want something that'll work jailed so urlsession? idk

[ocean raptor]

What is pfd? I'm talking about pf

[faint stag]

pfd
packet filter daemon

man

[ocean raptor]

oh, that must be some darwinism

[faint stag]

i don't know about the existence of the binaries for controlling it though

[ocean raptor]

bro really said "I know what the darwin specific pfd is but not what pfctl is"

[faint stag]

the existence in ios

i know pfctl

just because they have very similar kernels and some daemons doesn't mean apple will just leave the binary there

we had to build launchctl lol

[heady whale]

Is there anyone who learned brainfuck ?

[pearl sail]

@grave sparrow only knows about the literal brain fuck i give him

[heady whale]

Lmao 😂

True chad ngl

[hexed knot]

yes

its simple

it looks worse than it really is

[gentle grove]

Ive never used it but I looked at it and it looked really obvious and simple

[wind ravine]

@tepid olive is there a tutorial about properly porting fonts to ios?

mainly ios 15-16

[restive ether]

using what

snowboard?

also I'm pretty sure you think evelyne is the themer and she is not

[tepid olive]

i am not

i make the thing that injects your theme engine

[wind ravine]

mdc

fontoverwrite

[wind ravine]

wait is it a different evelyn?

[restive ether]

yes

maybe idk

I assume you thought she was the designer

[wind ravine]

oops

whoever is credited in fontoverwrite

[next wadi]

i think every old navy has a card reader thats messed up like that lmfao

[restive ether]

that would depend on who you credited

[restive ether]

mine isn't

also shout-out old navy

[next wadi]

ur just trying to be different....

[restive ether]

cause you broke

[next wadi]

Wtf

true but wtf

[primal perch]

[indigo peak]

ive been staring at this function for the entire day and i dont see it

[tepid olive]

bro it says baseMethods

[indigo peak]

i dont get it

i thought baseMethods just got the offset for the first method

[indigo peak]

like it gets me an offset

idk whats the issue

[timid furnace]

is that offset in __objc_classname?

[indigo peak]

can i check that programatically

or do i have to compare to the macho in ida

[timid furnace]

both are easy

[indigo peak]

how do i do it programmatically

[storm veldt]

Is anyone aware of an explanation/breakdown of MacDirtyCow (blog post/writeup or video or something)? LiveOverflow gives a good explanation of the exploit on a general level, but I'm curious how it's being used in the iOS environment.

[timid furnace]

look at the segment and section commands and look at the start and size of each section

it's pretty boilerplate

[indigo peak]

too complex for me

[faint stag]

https://bugs.chromium.org/p/project-zero/issues/detail?id=2360
this is nowhere near simplified lol

[timid furnace]

then use IDA

[indigo peak]

too expensive for me 🧌

[timid furnace]

then why tf did you posit that as an option

[indigo peak]

i genuinlly dont know how to do this

[timid furnace]

use ghidra, or machoview, or machoexplorer, or whatever

[indigo peak]

im normal, i have it cracked

[timid furnace]

so you do have IDA...

[indigo peak]

yyeah i was joking

[storm veldt]

better than nothin, thanks

[timid furnace]

then go check

[timid briar]

Would anyone be willing to create a very simple dylib file that just writes to a specified path in/var? I'm trying to debug an issue I am having (need to see if installd can write to a path or not (opainject)).

I don't know ObjC/own a Mac so I wouldn't be able to easily do this
I’ll just set up an ObjC env in WSL and get ChatGPT to write the code lmao

[indigo peak]

Feb 11 23:31:10 eyePhone Sandbox[627] <Notice>: [test] The offset 498744 is in the __PAGEZERO segment
that cant be right

[primal perch]

100% off discount code

[ebon beacon]

hi there i have a question. I have iPhone 7 plus after i made palera1n jailbreak, when i use my phone or playing game on its temperature increase and after that Wi-Fi just close and I can't open it so i have to shut it down and open it again or the phone keep respring until the Wi-Fi back again so, please any notes about that thanks.

[primal perch]

https://tenor.com/view/dead-by-daylight-gif-20969766

[naive kraken]

I'm not there yet

nah they're pretty ok

setgid in jailbreakd

then patch launchd to not do kill(-1)

that thing

sid

idk

since iOS 15 launchd does kill(-1) before execve

kill everything

with SIGKILL

except for launchd itself

do you not have injection into launchd

?

I doubt there is any other way

enumerate all procs and send SIGKILL to them except when the process is jailbreakd

[elder scaffold]

injection into launchd already completed?

[naive kraken]

bro performance???

like what?? 3ms more?

[primal perch]

3ms would be a ton in kernel time

(and yes launchd isn’t the kernel but it’s used almost as much as it)

[naive kraken]

I don't see how a 3ms longer userspace reboot is going to make a difference lol

@grave sparrow if you managed to make jailbreakd survive a userspace reboot, how would you reconnect to it after the new launchd is up?

like is XPC this smart?

[tepid olive]

he already did that

with cursed mach port stuff i think

xpc doesn’t work immediately

[naive kraken]

that doesn't matter too much

if xpc works again and you use it, will it connect to the existing jailbreakd or spawn a new one

that's what I mean

[tepid olive]

good question

when we have kcall handoff we can handoff from launchd anyway

[naive kraken]

I guess so

[grim sparrow]

@ocean raptor Taurine 14.3, what happened

[ocean raptor]

[ocean raptor]

Can you run vtool -show /bin/launchctl

[grim sparrow]

its someone in my server, bear with]

[ocean raptor]

Ok

[grim sparrow]

cNpp2S5

if you want to ask him there

i dont think hes here

what package is vtool a part of?

[ocean raptor]

I'm glad I finally got an error for this openssh issue that I've gotten emails about

[ocean raptor]

[grim sparrow]

its probably because it was built for ios 16

cameron, proposal

when i finish aemulo trollstore support

could i put aemulocli on procursus

so you can do things like read, write and emulate from cli

[ocean raptor]

That is not my launchctl

[grim sparrow]

!!!

what!

[ocean raptor]

The launchctl on the iOS 14 repo is built correctly and does not link os_log_simple

Tell him to reinstall launchctl

cameron in test/usr/bin at build 
➜ vtool -show launchctl
launchctl:
Load command 11
      cmd LC_BUILD_VERSION
  cmdsize 32
 platform IOS
    minos 14.0
      sdk 16.2
   ntools 1
     tool LD
  version 820.1
Load command 12
      cmd LC_SOURCE_VERSION
  cmdsize 16
  version 0.0

cameron in test/usr/bin at build 
➜ nm launchctl | grep "os_log"

cameron in test/usr/bin at build 
➜ 

[grim sparrow]

404

[ocean raptor]

???

https://apt.procurs.us/pool/main/iphoneos-arm64/1700/launchctl/launchctl_1%3A1.0.1_iphoneos-arm.deb

It's right there

[faint timber]

urlencode

[indigo peak]

someone solve this for me

my level of math doesnt allow me to solve the summation

[nimble parcel]

pretty sure this is the Riemann hypothesis 😶

[grim sparrow]

Would help if it was a higher res lmao

[indigo peak]

true

🍎 🍊 🍪 🍺 🍕 🍔 🍇 🌭 🍒 🍉

those are all the emojis

[glacial matrix]

Over 99.999% of people
CAN'T solve this!!
🇵 🟰 🇳 🇵

[indigo peak]

🇴

🇵🇴🇳🇵 🇭🇺🇧

[hasty marsh]

forn

forn gorn

[naive kraken]

hmm good idea

[wind ravine]

how do i hecking get a file picker working on esign

ive tried the swiftui one and like 3 other libraries that are supposed to do it

[ocean raptor]

@grave sparrow would you like to do one of these?

bsexec and asuser too

why not

[primal perch]

based

and lazy ass pilled

[wind ravine]

how do i find the folder of an app in /var/mobile/Containers/Data/Applications?

its a system app so i cant just get its uuid

[ocean raptor]

Why do I care? I'm telling you to do it

[primal perch]

runtime? no idea. trying to dump assets? use filza bc it knows how

and shows the name

[wind ravine]

is there something like that for swift?

ae

[tepid olive]

don't care plus ratio

[wind ravine]

its just for 1 folder of 1 app i dont need that much

do i need a certain framework?

says FSBApplicationLibrary deosnt exist

its an xcode app

[tepid olive]

[wind ravine]

LSApplicationWorkspace works but that doesnt

[primal perch]

based capt actually helping in dev

[wind ravine]

i wrote a crappy function to check the metadata plist for the bundle id but that is hecking slow

alr

[primal perch]

rare

uncommon

[indigo peak]

no shot this is a thing

ive just done a for loop

😭

😭

[primal perch]

https://cdn.discordapp.com/attachments/1007123646558523432/1074501369668583434/Disrespect.mp4

[next wadi]

say hello to luz preferences

im BACK baby

its a little messed up

cuz i named the module funny

🚎

there we are

[tepid olive]

wtf

[hasty ruin]

[hasty ruin]

[tepid olive]

hello

[indigo peak]

@next wadi please make luz by default use json preferences

xml is inferior

[next wadi]

ok

i will

[indigo peak]

or make an argument to toggle it or something

just make it encouraged

[next wadi]

no i have different template types

for tools and tweaks i have objc, swift, c, asm, and objcpp ones

so for prefs i'll make one for xml and json

is there an iphonedevwiki page or something for a json pref plist @indigo peak

luz rootless is so good

https://github.com/LuzProject/luz/tree/main/luz/luzgen/templates

i have a folder of templates with tar files for the different source types

and luzgen decompresses whichever one you choose

its kinda based actually

i need to fix the tool swift one

its a lil broken

when i add prefs to luzgen i'll make xml and json templates

[indigo peak]

can I overwrite a main.jsbundle using dirtycow without fucking the code signature

[tepid olive]

yes

most likely

[elder scaffold]

fekeroot died why

dyld[7190]: terminating because inserted dylib '/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot.dylib' could not be loaded: tried: '/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot.dylib' (mach-o file, but is an incompatible architecture (have 'arm64', need '')), '/System/Volumes/Preboot/Cryptexes/OS/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot.dylib' (no such file), '/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot.dylib' (mach-o file, but is an incompatible architecture (have 'arm64', need '')), '/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot-0.dylib' (mach-o file, but is an incompatible architecture (have 'arm64', need '')), '/System/Volumes/Preboot/Cryptexes/OS/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot-0.dylib' (no such file), '/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot-0.dylib' (mach-o file, but is an incompatible architecture (have 'arm64', need ''))
dyld[7190]: tried: '/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot.dylib' (mach-o file, but is an incompatible architecture (have 'arm64', need '')), '/System/Volumes/Preboot/Cryptexes/OS/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot.dylib' (no such file), '/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot.dylib' (mach-o file, but is an incompatible architecture (have 'arm64', need '')), '/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot-0.dylib' (mach-o file, but is an incompatible architecture (have 'arm64', need '')), '/System/Volumes/Preboot/Cryptexes/OS/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot-0.dylib' (no such file), '/opt/homebrew/Cellar/fakeroot/1.30.1/lib/libfakeroot-0.dylib' (mach-o file, but is an incompatible architecture (have 'arm64', need ''))
/opt/homebrew/bin/fakeroot: line 178:  7190 Abort trap: 6           FAKEROOTKEY=$FAKEROOTKEY DYLD_INSERT_LIBRARIES="$FAKEROOT_LIB" "$@"
/opt/homebrew/bin/fakeroot: line 180:  7191 Abort trap: 6           exit $RESULT

it worked until yesterday, then suddenly died.

[ocean raptor]

What are you trying to inject into?

Cause SIP+arm64e makes it pretty useless

[elder scaffold]

oh i disabled sip

[elder scaffold]

yeah, it was caused by sip

[indigo peak]

How to jailbreak iOS 16.3.1

[unkempt raft]

@ocean raptor Hey, excuse me for pinging you, I have a question about reboot.c from https://github.com/ProcursusTeam/launchctl/blob/main/reboot.c.

From what library / framework is symbol reboot3 taken from?

[ocean raptor]

libSystem

[unkempt raft]

have it opened in ghidra, can't find it there - maybe I missed

thanks

[ocean raptor]

technically it's in libxpc I guess

but libxpc is reexported by libsystem

[unkempt raft]

ah ok

thanks for the quick answer

[indigo peak]

does apple strip entitlements that dont exist

like if i put

<true/>```
in entitlements.plist, will that entitlment get stripped?

[restive ether]

it just ignores it

[indigo peak]

so will the binary be signed with that entitlement

no right

[indigo peak]

@naive kraken would you happen to know off the top of your head what entitlement is required to run sandbox_extension_issue_iokit_user_client_class

[naive kraken]

none

every process can generate extensions for everything it can access

[indigo peak]

so would i have to find which processes can access AppleStockholmControlUserClient

[naive kraken]

yea

[indigo peak]

how tf would i do that lmao

im assuming nfcd would have access to it

because of this

[grim sparrow]

Nfcd

com.apple.nfcd.hwmanager is the xpc server for it

[indigo peak]

now just tryna get nfcd to call sandbox_extension_issue_iokit_user_client_class 😄

[next wadi]

does anyone know why theos needs fakeroot

[pearl sail]

ask the kirb

[timid furnace]

set perms for archive

[next wadi]

oh Luz doesnt need that L

[indigo peak]

like what is luz

like where did the name come from

[wind ravine]

how would i strip metadata programmatically?

[timid furnace]

that is an incredibly vague question

[indigo peak]

and i thought asked vague questions

[wind ravine]

trying to strip unneeded metadata of an image in order to lower the file size

i think its also related to the white edge issue for super compressed apps like youtube

[indigo peak]

import UIKit

// Original image data
let imageData = UIImageJPEGRepresentation(UIImage(named: "example.jpg")!, 1.0)

// Create a new data object without metadata
guard let image = CGImageSourceCreateWithData(imageData as CFData, nil) else {
    return
}
let options = [kCGImageSourceShouldCache: false] as CFDictionary
guard let strippedImage = CGImageSourceCreateThumbnailAtIndex(image, 0, options) else {
    return
}
let strippedImageData = UIImageJPEGRepresentation(UIImage(cgImage: strippedImage), 1.0)

according to chatgpt lmaoo

[wind ravine]

chatgpt has never been right for coding for anything ive tried

[cloud yacht]

its really good at explaing code, minus a few odd examples I found

[next wadi]

Light in Spanish

i called it that because it brings "light" to development

im so poetic

thats why it has that desc on gh

https://github.com/LuzProject

"brightening"

[indigo peak]

i thought bc its meant to be lightweight

[next wadi]

well i think thats a different word

idk

im not sure

thats true too though

it is lightweight

in

[unkempt raft]

How do I sign an .ipa with enterprise .p12 certificate and .mobileprovision?

[hasty ruin]

zsign

easy

https://github.com/zhlynn/zsign

[unkempt raft]

iOS App Signer doesn't seem to work with these settings

uh

[unkempt raft]

will try

[unkempt raft]

are there bins?

or compile only

[hasty ruin]

i have an ubuntu build and macOS

anything else, you'll have to compile yourself

[unkempt raft]

macos please

[hasty ruin]

dm

(mods this is piracy)

👍

[faint stag]

wdym it doesn't work

does the ipa fail to install or something

[next wadi]

afaik permissions are correct already

[unkempt raft]

Yes

Midnight moment, forgot to include the actual problem

Says unable to install

But I got it fixed by using zsign

[faint stag]

are they though? you aren't using dpkg for debs so permissions aren't actually verified unless you do that yourself

[next wadi]

well

it installs fine and the executables run

idk

[ocean raptor]

tar -tvf

[next wadi]

im not really sure if the perms are right otherwise

[next wadi]

will try when i get a minute

[ocean raptor]

Or dpkg-deb -c

[next wadi]

pypkg -c*

[faint stag]

bro who needs 17 point precision

[next wadi]

[faint stag]

no human can comprehend such small units of time
even if we're going to compare it to something else, what would one compare it to?

[hasty ruin]

i can