development

[tepid olive]

the first arg has to be dash

then u put the real args

[tepid olive]

so r they all args

[lime pivot]

probably want to try [“dash”, “-c”, “\(scriptPath) \(debPath)”]

probably should escape both things

actually that will fork twice (dash runs the script as a command, meaning it has to parse the hashbang line and then spawn another dash)

[tepid olive]

            let command = "/var/jb/usr/bin/dash"
            AuxiliaryExecute.spawn(command: command, args: args)```?

[lime pivot]

[“dash”, scriptPath, debPath]

should work

1st arg just always has to be the program itself

[tepid olive]

ok sec lemme try

[tepid olive]

oh okay, first time doing execute stuff

[lime pivot]

yep it might seem confusing at first, but it’ll make total sense when you consider how a command line becomes the argv array passed into main()

[tepid olive]

@lime pivot https://media.discordapp.net/attachments/1095672343432548465/1096743700505305228/RPReplay_Final1681554461.mov

nothing happens anyway

[hasty ruin]

are you not logging spawn output

[tepid olive]

nope

should I?

[lime pivot]

should do so you can get an idea of what’s going on

[river tide]

syslog works with palera1n? how i can view nslog output with windows

[hasty ruin]

Sideloadly has a log viewer

[tepid olive]

output gives this:

?

    let scriptPath = Bundle.main.path(forResource: "repack-rootless", ofType: "sh")!
    @State private var debPath = ""
    @State private var outputAux = ""
    
    var body: some View {
        VStack {
            TextField("Enter path to deb here", text: $debPath)
            
            Button("Convert deb to rootless") {
                let args = ["/var/jb/usr/bin/dash", scriptPath, debPath]
                let command = "/var/jb/usr/bin/dash"
                AuxiliaryExecute.spawn(command: command, args: args, output:  { output in
                    outputAux += output
                })
            }
            
            Text(outputAux)
                .padding()
                .opacity(0.5)
        }
        .onAppear {
            UIApplication.shared.alert(title: "Warning", body: "Please make sure the following packages are installed: dpkg-deb, file, fakeroot, ldid (from Procursus).")
        }
    }
}```

ive removed /var/jb/usr/bin/dash and

from args

[ocean raptor]

PATH is not set

[tepid olive]

ohh right the things are in /var/jb

how can i set the PATH

like PATH=/var/jb?

[tepid olive]

    let scriptPath = Bundle.main.path(forResource: "repack-rootless", ofType: "sh")!
    @State private var debPath = ""
    @State private var outputAux = ""
    
    var body: some View {
        VStack {
            TextField("Enter path to deb here", text: $debPath)
            
            Button("Convert deb to rootless") {
                let args = [scriptPath, debPath]
                let command = "/var/jb/usr/bin/dash"
                let env = ["PATH": "/var/jb/usr/bin:$PATH"]
                AuxiliaryExecute.spawn(command: command, args: args, environment: env, output: { output in
                    outputAux += output
                })
            }
            
            Text(outputAux)
                .padding()
                .opacity(0.5)
        }
        .onAppear {
            UIApplication.shared.alert(title: "Warning", body: "Please make sure the following packages are installed: dpkg-deb, file, fakeroot, ldid (from Procursus).")
        }
    }
}```

Yes, I've set the PATH now and now its another thing:

its trying to create it inside the app which is where the script is located, can i make it to make it in another location?

[lime pivot]

might need to give your app the no-container entitlement so it can properly read and write stuff outside of its container

[tepid olive]

it has

TEMPDIR_NEW="$(mktemp -d)"```?

@restive ether happy birthday btw

[restive ether]

thanks big man

[lime pivot]

@restive ether my man happy birthday

[restive ether]

thank you big man

[lime pivot]

fr fr

[smoky cosmos]

So that rootless repacker script is meant to be ran on device, not on mac? I tried executing it on my mac but had issues with fakeroot failing

[onyx ember]

It works on both

You just need to install fakeroot

[radiant idol]

does it just force change tweaks that have no (hardcoded) paths within them or does it also patch the paths?

stupid question prob

[smoky cosmos]

That script uses install_name_tool and otool. So these are available on device too?

[onyx ember]

That's [[odcctools]]

[faint lion]

libtool-bin

Generic library support script (glibtool binary) This is GNU libtool, a generic library support script. Libtool hides the complexity of generating special library types (such as shared libraries) behi...

Author

Procursus Team

Version

2.4.7

Price

Free

Repo

Procursus

Bundle ID

libtool-bin

Powered by Canister · Apr 15, 2023, 4:23 PM

[smoky cosmos]

How do i install procursus fakeroot on my mac?

[onyx ember]

You need to get Procursus on Mac, check 📌 in Procursus server.

Also ask @ocean raptor if you need help

[tepid olive]

can anyone help me with this?

I have all the entitlements

[dim coyote]

I think it doesn’t patch the paths

[drifting dust]

damn this shit is fun to figure out, made another tweak for rootless

this time i ripped off saw LOL

if you dont make icons for your tweaks in mspaint what are you even doing

[radiant idol]

lol

[drifting dust]

How does FLEX (the app) work? Like how does it magically pull readable hooks out of thin air and an app binary? Is there a way to do that on a Mac? Like if I wanted to say mess with the Gmail app, I know nothing about it how would I know what to hook?

[indigo peak]

pretty sure the "magic" for pulling readable hooks from a binary is just basic reading of a binary, getting all the symbols and converting them into proper formatting

[tepid olive]

accept my friend request please

[drifting dust]

Makes sense. Any tools that automatically do it for me?

[hasty ruin]

objc runtime not be based challenge

[indigo peak]

if a file appears in CodeResources does that mean its codesigned

[graceful gate]

Is this how you read prefs in tweak (without additional deps) these days?
[[NSUserDefaults standardUserDefaults] persistentDomainForName:@"com.myname.mytweak"]

[tepid olive]

yes

[graceful gate]

TIL...

@naive kraken then I think we should replace /var/jb/... with "refactoring your pref reading code with -persistentDomainForName:"

[lime pivot]

the jb definitely should not be hooking cfprefsd

let something like Cephei do that

[naive kraken]

it needs to hook some other stuff for better rootless experience anyways so I don't see why I wouldn't want to hook that too

[lime pivot]

I guess. as long as those hooks can be updated as a package

[naive kraken]

nah that's not really possible, they need to be made in a special way so they also apply when you don't have an injection framework installed

[serene hawk]

is there any way i can declare an interface for the swift class i'm hooking? currently getting an error: "the property could not be found on object of type '__unsafe_unretained id const'", which is relatable. code looks like this: ```@interface DoublePhotoView : NSObject
@property (nonatomic, retain) BeaButton *button;
@end

%hook DoublePhotoView

• (void)viewDidLoad {
  UIView *view = (UIView *)self;
  self.button = view.subviews.lastObject;
  NSLog(@"Found b: %@", self.lateBeRealButton);
  }

%ctor {
%init(DoublePhotoView = obj_getClass("BeReal.DoublePhotoView");
}```

[elder scaffold]

'apply when you don't have an injection framework installed' a bit pain

[serene hawk]

hmm i see thanks

[tiny plume]

What is a best tool to decompile ipa?

[glacial matrix]

You defined DoublePhotoVoew as an NSObject subclass instead of UIView; you logged a “lateBeRealButton” property instead of “button”

[serene hawk]

have noticed that too, but still with the correct property it doesnt compile

[glacial matrix]

I’d suggest posting the right code and the full error message

[serene hawk]

yeah you're right; so this is the code (BeaButton gets added via another viewcontroller in the tweak before; i want to access it in the DoublePhotoView): ```@interface DoublePhotoView : NSObject
@property (nonatomic, retain) BeaButton *button;
@end

%hook DoublePhotoView

• (void)layoutSubviews {
  UIView *view = (UIView *)self;
  self.button = view.subviews.lastObject;
  NSLog(@"Found b: %@", self.button);
  }

%ctor {
%init(DoublePhotoView = obj_getClass("BeReal.DoublePhotoView");
}``` The errors its throwing is: "Tweak.x:163:32: error: property 'button' not found on object of type '__unsafe_unretained id const'
NSLog(@"Found b: %@", self.button);" and
Tweak.x:162:10: error: property 'button' not found on object of type '__unsafe_unretained id const'
self.button = view.subviews.lastObject;

[smoky cosmos]

i just reinstalled homebrew and fakeroot on my silicon mac and now theos builds fail. any solution?

[glacial matrix]

There’s an issue with logos that doesn’t define self as the class you’re hooking, but in your code you’re casting self to the generic UIView class instead of the one you declared, so the compiler complains that it does not have the property you defined

[serene hawk]

so how would i fix this? just use self without casting it to the uiview?

[glacial matrix]

You cast it to the class you are hooking

[serene hawk]

makes sense

thank i‘ll try

[radiant idol]

does anyone here speak fluent Spanish and would like to localize the preferences for my tweak? I'd really truly appreciate it

[glacial matrix]

Does native count?

[radiant idol]

yeah, anything better than direct google translate lol

just so it's understandable

[glacial matrix]

I’m too lazy to do it myself but not lazy enough to correct someone else’s work, be it google translate, deepL or chatGPT

[radiant idol]

Alright, I'll do ChatGPT

thanks lol

appreciate it

[glacial matrix]

I’ve been told it works decently enough

[dim coyote]

If you need, I've gpt4

[radiant idol]

that'd be nice

one sec, I'll send the english version

LABEL_OPTIONS_FOOTER_TEXT = "Example: $t has $c apps.
Result: FolderName has 23 apps.";
LABEL_OPTIONS_LABEL = "Label Options:";
HOMESCREEN = "Homescreen";
COUNT_TEXT = "Count Text:";
ROWS = "↓ ROWS PER PAGE";
COLUMNS_FOOTER_TEXT = "→ ICONS PER ROW";
BUILD_ROOTLESS = "Build: Rootless";
BUILD_ROOTFUL = "Build: Rootful";

TITLE_SCALE = "TITLE SCALE (%)";
TITLE_TRANSPARENCY = "TITLE TRANSPARENCY (%)";
TITLE_OFFSET = "TITLE OFFSET [-↑ / +↓]";
SUBTITLE_SCALE = "SUBTITLE SCALE (%)";
SUBTITLE_TRANSPARENCY = "SUBTITLE TRANSPARENCY (%)";
SUBTITLE_OFFSET = "SUBTITLE OFFSET [-↑ / +↓]";
HORIZONTAL_ICON_INSET_FOOTER_TEXT = "This can be used to squish the sides of your icons closer.";
HORIZONTAL_ICON_INSET = "HORIZONTAL ICON INSET";
TOP_ICON_INSET_FOOTER_TEXT = "Extra padding from the top.";
TOP_ICON_INSET = "TOP ICON INSET";
VERTICAL_ICON_SPACING_FOOTER_TEXT = "Vertical spacing of the icons.";
VERTICAL_ICON_SPACING = "VERTICAL ICON INSET";
HORIZONTAL_OFFSET_FOOTER_TEXT = "Horizontal offset of the folder from its original location.";
HORIZONTAL_OFFSET = "HORIZONTAL OFFSET";
ICON_SCALE = "ICON SCALE (%)";
HOMESCREEN_ICON_BLUR_FOOTER_TEXT = "Enabled: Background blur includes homescreen icons.

Disabled: Background blur is a blur of the homescreen wallpaper.";
HOMESCREEN_ICON_BLUR = "HOMESCREEN ICON BLUR";
HOMESCREEN_BLUR = "Homescreen Blur";
HOMESCREEN_ICON_BLUR_OFF_INFO_DESCRIPTION = "Background blur is a blur of the homescreen wallpaper";
HOMESCREEN_ICON_BLUR_ON_INFO_DESCRIPTION = "Background blur includes homescreen icons.";
DISMISS_AND_APPLY = "Dismiss and Apply";

RESPRING = "Respring";
RESET_PREFS = "Reset Prefs";
DEFAULT_APPS = "$c APPS";

RESET_PREFERENCES_QUESTION = "Reset Preferences?";
RESET_PREFERENCES_DESCRIPTION = "This cannot be undone.";

RESET_CANCEL = "Cancel";
RESET_RESET = "Reset";```

oh i thought it'd send a file

💀

[peak hornet]

Hey so I might just be an idiot and there is a wayyyy better way to do this
Butttt I wanted to simulate touch and keyboard events from an inject dylib. I coullllld do this without XCTest but I saw that https://github.com/lyft/Hammer has this really nice swift library that simulated alll these events and would use XCTest to make sure that it was ready to send more. I actually ripped out all the XCTest code and just had it working that way but I wanted to get that wait code working which meant I needed XCTest bundled or at least in the load path of my injected dylib.

I realized after doing all this that XCTest mayyyyybe already on the iPhone somewhere and I could have set the rpath for my dylib to look for it there. But instead I link my dylib to inkect with XCTest and then go and gather ALL of XCTest's dependencies. This was a hassssle

So I wrote a little script that I think works well to go and gather all the dependencies for any library, copy them to a folder for you, then add an rpath so they know where to find each other when you copy them to your apps framework directory.

My script is here: https://github.com/bebrws/fixDynamicLibPaths/blob/main/gatherAndFixLibs.sh

Would this be useful to anyone? Was it a dumb way to go about this? Curious what you all think?

[radiant idol]

@dim coyote

[dim coyote]

already doing it

[radiant idol]

kewl

thanks

[dim coyote]

np

Will take some time cause gpt4 isn't as fast

[radiant idol]

yeah no problem

[radiant idol]

@glacial matrix ^^^

[glacial matrix]

Lemme get back to you when I’m on a pc cause I got no good text editors on my device

[radiant idol]

yeah no problem

[dim coyote]

Can I code my theos tweak for fugu15 in xcode? I've been coding it in vscode till now

[drifting dust]

Does anyone have a decent MODERN tutorial or example code (simple one function tweak) for how to do preferences? For the life of me can’t get it to work with postnotification and whatnot

[dim coyote]

Do you code your tweaks in xcode or vscode?

[drifting dust]

Vscode

I have no desire or need to use Xcode

[dim coyote]

What if I wanted to use it, how would I?

[radiant idol]

you'd have to make substrate tweaks

[drifting dust]

Install logos extension from their marketplace for syntax highlighting, then just file>open folder your Theos project

[dim coyote]

That's what I'm doing right now but I'd want to code in xcode..

And if I wanted to cast my hackintosh to my windows laptop, how would I do it? Which app is recommended?

[radiant idol]

btw if you wanted to use Xcode, you'd have to make tweaks like this:

https://github.com/NightwindDev/Small-Tweaks/blob/main/nonewtermnavbar/Tweak.m

it's kind of a pain

@dim coyote ^

[dim coyote]

oh

so no %Hook

[radiant idol]

yep as far as I know, you can't use %hook or @hook

[dim coyote]

Ah alright then, I'll just stick with xcode

[glacial matrix]

@radiant idol how is COUNT_TEXT = "Count Text:"; used?

[radiant idol]

this is what it looks like in the end

[glacial matrix]

BUILD_ROOTLESS = "Build: Rootless";
BUILD_ROOTFUL = "Build: Rootful";

I'm not familiar with the spanish jb scene but I'd probably leave them as is or use "Versión" in place of "Build"

[radiant idol]

yeah that's fine, use Versión

[glacial matrix]

COUNT_TEXT = "Texto de conteo:"; could be fine then, "Texto de cantidad:" might work too

the remaining translations look decent

[radiant idol]

Texto de conteo: seems better as it's shorter

cool, thanks!!

[glacial matrix]

you are royally screwed with "homescreen" in that case

[radiant idol]

yikes

just saw it

https://cdn.discordapp.com/emojis/970902459188928513.webp?size=48&name=lmfaoEpic~1&quality=lossless

[glacial matrix]

why make the "count text" user editable?

[radiant idol]

Idk, the original Bolders had that

[steady nest]

neither looks ok i think

[radiant idol]

that's the original

[glacial matrix]

any tech text in spanish looks weird to me

[steady nest]

I'd say "Texto de cantidad"

[glacial matrix]

isn't that what I said?

[steady nest]

lmao I misread

[glacial matrix]

or do you mean the semicolon?

[steady nest]

🤣

[radiant idol]

alr welp I'll use that one then

lol

[steady nest]

yes, second one looks ok

I'm not a native speaker though

[glacial matrix]

get out then

XD

[radiant idol]

LOL

[glacial matrix]

did you take the necessary precautions for those user input texts in case they contain newlines or long lines?

[radiant idol]

didn't even think about that

:/

hm

[steady nest]

coño

[glacial matrix]

@radiant idol sometimes, less is more

[radiant idol]

perhaps

idk I do want it to be similar to the original

I've already replaced other parts of it with more modern settings

[glacial matrix]

it is called "reborn" so it can have changes

[radiant idol]

true

let's see what it looks like first

in spanish

ok well most of it looks good

except the end

💀

[steady nest]

yeah that's what you get when you localize everything

the translations look good tho

[radiant idol]

is there no other word for homescreen

hm

[steady nest]

the rough translation is start screen, I can't remember a better way to translate

[radiant idol]

ChatGPT says these can be translations for homescreen

[steady nest]

first and second are good

all the other ones don't make much sense in this context

[radiant idol]

right

is there any way to shorten "desenfoque de pantalla de inicio"? that's the thing that is causing issues

[steady nest]

maybe just desenfoque de iconos

[radiant idol]

hmm

oke

[steady nest]

and the explanation mentions homescreen

[radiant idol]

yeah that works

let's see how that looks

shortened it a little bit further as well

[glacial matrix]

have you checked what Apple uses to refer to their iOS UI in other parts of the settings app?

[radiant idol]

Pantalla de inicio

but that's too long

hm

[glacial matrix]

I just noticed, the HOMESCREEN_ICON_BLUR_XXX_INFO_DESCRIPTION are a bit redundant

[radiant idol]

yeah

it's a little hard to explain

idk

[drifting dust]

Does anyone have a decent MODERN tutorial or example code (simple one function tweak) for how to do preferences? For the life of me can’t get it to work with postnotification and whatnot

[hasty ruin]

do you overwrite setPreferenceValue

for the notification stuff

[zenith hatch]

dont listen to this guy he makes bad tweaks

[hasty ruin]

dont listen to this guy he writes swift

[zenith hatch]

his tweaks bootloop devices

[hasty ruin]

[zenith hatch]

my swift only causes springboard crashes

[hasty ruin]

his app gave me permanent hearing loss

[zenith hatch]

good

[hasty ruin]

(it set my airpods volume to 100%)

[zenith hatch]

oh

thats why i dont support macos

[drifting dust]

do i do what to what

[hasty ruin]

can you send a screenshot of your preference view controller's .m file

[drifting dust]

i took this as a baseline idk if its correct but it doesnt work, the prefs are there but i cant seem to get them to properly work in my tweak.x https://github.com/p2kdev/Waqt

[drifting dust]

i do like this

[hasty ruin]

oh so you're not doing anything with the postnotification key

[zenith hatch]

rootless

[hasty ruin]

steal setPreferenceValue/readPreferenceValue from https://github.com/p2kdev/Waqt/blob/master/WaqtPrefs/WQRootListController.m

and change
#define tweakPrefPath @"/User/Library/Preferences/com.p2kdev.waqt.plist" to
#define tweakPrefPath @"/var/mobile/Library/Preferences/com.p2kdev.waqt.plist", this'll make it work on rootful+rootless

[drifting dust]

aaahhhhh makes more sense thanks

i completely forgot theres code in that file

[drifting heron]

GPT 4?

[radiant idol]

no

gpt-3

[dim coyote]

If ya need gpt-4, lmk

[timid furnace]

@grave sparrow it doesn't really matter what function i use to allocate memory in the kernel right

never mind i figured out which function to use

tfw you are looking for mach_vm_allocate_kernel

you don't see it exported, so you look for every other allocation function

and then after wasting 20 minutes on such

/*
 *    mach_vm_allocate allocates "zero fill" memory in the specfied
 *    map.
 */
kern_return_t
mach_vm_allocate_external(
    vm_map_t                map,
    mach_vm_offset_t        *addr,
    mach_vm_size_t          size,
    int                     flags)
{
    vm_tag_t tag;

    VM_GET_FLAGS_ALIAS(flags, tag);
    return mach_vm_allocate_kernel(map, addr, size, flags, tag);
}

how the fuck did i not notice this bruh

nvm i have no idea how to get the current map

so uh

i will just use OSMalloc or IOMalloc yea

probably IOMalloc

[timid furnace]

@grave sparrow @steady nest you two are fucking geniuses

Chatgpt is usually stupid but it is helpful when it isn't

Lmao

In other news, I really do have to solve for current_map or whatever

Afaik only way to allocate memory in userspace

Oh

Rip

[hasty ruin]

it’s because you’re on android

[timid furnace]

fuck

get_task_map not exported

[ocean raptor]

@grave sparrow FREEBSD HAS CODESIGNING ALREADY

no

it has it's own codesigning thing

[timid furnace]

wat

[coral gazelle]

I'm trying to compile idevicerestore but it errors out and outputs this. I'm using macOS 13.3.1 with Xcode 14.2. Any fixes?

The feature sets of the compiled macOS versions I have are babies compared to the latest version

[timid furnace]

yes

the symbol isn't in com.apple.kpi.private either though

if kextlibs isnt lying to me

ah yes

this hack

me when apple does not reprocess kernel extensions that are already in the KC

anyways this isn't relevant for me

im injecting from bootloader

so i dont have to do any shenanigans for com.apple.kpi.private

but the symbol isnt in there

so im p sure i have to solve it at runtime

i mean i can solve it at runtime

its just

more work

i have to add like

6 lines of code

L

just port lilu to arm64

[ocean raptor]

@grim sparrow @lime pivot please add jailbreak and device information to the support email template, it'd really help

[grim sparrow]

Yeah

thats the plan

I just havent got round to it

[ocean raptor]

ok cool

just wanted to make sure it was planned

and remove the stupid Optional("QuickActions")

[lime pivot]

optional is still there? 😬

I thought I reported it and it was fixed aaaages ago

[lime pivot]

what info would you like to see?

[ocean raptor]

Device type
iOS version
Jailbreak (if possible)

I know sileo detects jailbreak already, idk if zebra does

[lime pivot]

I can tell you don't use Zebra

[radiant idol]

By the way, I still haven’t understand; is Zebra supposed to work on Fugu15? Because at least for me, it doesn’t

Packages won’t install for example

[lime pivot]

crashing or?

[radiant idol]

Nope

I’ll show you what it looks like

Hold on

[ocean raptor]

Last time I tried to use zebra it consistently crashed

Literally couldn't install a single thing

[radiant idol]

It doesn’t show as installed in neither Zebra nor Sileo after this

[ocean raptor]

I reported this to you

[lime pivot]

I know

[ocean raptor]

aptitude >>>>

[lime pivot]

the 15.0-15.1 crashes I know about

[ocean raptor]

I will write aptitude-swiftUI one day, I swear

[lime pivot]

those are L iOS versions but opa did figure out a workaround

[lime pivot]

hey it's the second best cat after oreo

[subtle scaffold]

Development question: Is it ok to test rootless tweaks on palera1n 16.4.1 (rootless) and then have them be used on Fugu15 Max?

[lime pivot]

how's this look?

[ocean raptor]

Can you differentiate between rootful and rootless palera1n?

Otherwise great

[lime pivot]

oh yep I was thinking of that and I forgot lol

[graceful gate]

I wanna hear his/her meow

[ocean raptor]

It sounds like "meow"

[graceful gate]

[ocean raptor]

Her name is clementine

[primal perch]

https://tenor.com/view/patrick-riding-seahorse-spongebob-squarepants-loop-enjoyed-gif-18229126

[timid furnace]

thanks for the tip though, vm_map_page_size (although i could have probably hardcoded it i think) was in kpi.private, i would have never realized to check that

my code seems to work now

key word seems

right now it breaks on relative paths so uh...

W

[tiny plume]

Is it possible to hook DeviceCheck with Objection, etc.?
I would like to know the logic of device token generation

[tepid olive]

so idk this wasent happening before but all of sudden when building tweak i get this, > Making all for tweak Example…
==> Preprocessing Tweak.xm…
==> Compiling Tweak.xm (arm64)…
Tweak.xm:1:9: fatal error: 'UIKit/UIKit.h' file not found
#import <UIKit/UIKit.h>, i know what that means but just idk why, also with this spefic tweak i get fatal error: 'ctype.h' file not found
#include_next <ctype.h>, i know also what that means but idk how to fix
i got patched ios 15.5 sdk

[tepid olive]

Yeah, it is possible to hook DeviceCheck with Objection

[tepid olive]

As for the logic of device token generation, DeviceCheck generates a token based on unique device identifiers that are combined with a secret key stored on Apple's servers. This token can then be used by developers to validate a device's authenticity and prevent abuse of their services. The specific implementation details of DeviceCheck are not publicly disclosed by Apple

[tiny plume]

I see, so even if you use Objection to hook, you can't create a fake device token

[tepid olive]

yeah sadly

what u tryna make im just interested

it even it cannot be faked or spoofed. Any attempt to do so would be detected by the server side verification process and rejected

[tiny plume]

It is a simple interest, but I found out that device tokens used for appcheck, etc. are created by DCDevice, and I wondered if it is possible to create fake tokens? I wanted to solve the question "Can I make fake tokens?

[tepid olive]

yeah but simply any attempt to create a fake token will be detected and rejected by Apple's servers

[tiny plume]

Android : PlayIntegretion
iOS : DCDevice

Each of them is used for appcheck, but they are properly protected against fake

I'm interested in the bypass method, but it doesn't seem to be realistic

[tepid olive]

im not saying its impossible but it is almost impossible for my knowledge

[timid furnace]

unfortunately DeviceCheck is pretty impossible to spoof

gm

[tepid olive]

yeah

[timid furnace]

i have more questions to pester you with

[tepid olive]

anyone got updated toolchain for theos? using ubuntu wsl, just because 15.5 sdk aint supported by the default toolchain

[timid furnace]

• figure out how to parse relative paths from kernelspace (involves more unexported symbol shenanigans)
• or just inject one dylib into everything and have that deal with injecting tweaks

i'm leaning toward the latter but idk if that's the best approach

[naive kraken]

no clue but it is

it must be because other libs can access it too

and this works

[tepid olive]

or could i use like 14.5 sdk to create tweaks for ios 15.3 or sum?

[timid furnace]

alr

[ocean raptor]

yes

[timid furnace]

did a new toolchain for linux users drop yet

looks like a no

[ocean raptor]

no, I'll do it soon (I won't)

[tepid olive]

Alr, would there be much difference than using like 15.5 sdk

[ocean raptor]

no

[tepid olive]

Aight, then i wont waste my time finding new toolchain

[timid furnace]

anything i should outright blacklist from injecting ZeframLoader into? ie. launchd

[ocean raptor]

everything

[timid furnace]

true!

actually i'm probably just going to have to block everything before data is mounted

my binaries are platform

i love kernelspace

[timid furnace]

this will probably take care of all of the early things anyways

ignoring userspace reboots

but idrc about userspace reboots

[hasty ruin]

Anyone know what @available(iOS …, *) actually checks, and maybe how to hook it?

[river tide]

How i can log nslogs in windows

[timid furnace]

it tries to dlsym _availability_version_check
if that's not available:

• on macOS, it checks SystemVersion.plist
• on iOS, it checks kCFCoreFoundationVersionNumber i thinjk

[hasty ruin]

Ty, I saw it access()ing systemversion in the decomp, but didn’t realise it was macOS only

[timid furnace]

i might be wrong

let me double check

[river tide]

ayo please help me about nslogs...

[timid furnace]

i think i lied

[river tide]

i want to listen a spesific dylib in app

[timid furnace]

theres ___clang_at_available_requires_core_foundation_framework but it doesn't seem to be used

i think it might be systemversion on both then yea

[hasty ruin]

Weird, I hooked access and didn’t have any logs for systemversion

[timid furnace]

builtin-available/test: builtin-available/test.m
    clang -Wall -target x86_64-apple-macos10.15 -framework Foundation -framework Security $< -o $@

builtin-available/test-ios: builtin-available/test.m
    clang -Wall -target arm64-apple-ios10.0 -isysroot "/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk" -framework Foundation -framework Security $< -o $@

builtin-available/test-ios-sim: builtin-available/test.m
    clang -Wall -target x86_64-apple-ios10.0 -isysroot "/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneSimulator.platform/Developer/SDKs/iPhoneSimulator.sdk" -framework Foundation -framework Security $< -o $@

#import <Foundation/Foundation.h>
#import <dlfcn.h>
#import <objc/objc.h>

int main(int argc, const char * argv[]) {
    @autoreleasepool {
        // insert code here...
        NSLog(@"Hello, World!");
        if (@available(macOS 11.0, iOS 12.0, *)) {
            NSLog(@"macOS 11.0 or later");
        } else {
            NSLog(@"macOS 10.15 or earlier");
        }
    }
    return 0;
}```

from what i can tell it's practically the same behavior

besides ios-sim which also checks getenv IPHONEOS_SIMULATOR_ROOT or something

[ocean raptor]

it's open source

idiots

[timid furnace]

[ocean raptor]

https://github.com/llvm/llvm-project/blob/main/compiler-rt/lib/builtins/os_version_check.c#L269

[timid furnace]

yea i just found it

what is __clang_at_available_requires_core_foundation_framework for though

https://github.com/llvm/llvm-project/blob/21b68422c84087719ec0f6c216e506d177ac64fd/clang/lib/CodeGen/CGObjC.cpp#L4062

hm

[hasty ruin]

[ocean raptor]

To tell if they need CoreFoundation for the @available check

Depending on the iOS version they may not need CoreFoundation

[grim sparrow]

@ocean raptor https://twitter.com/musicstruggles1/status/1647998403643682817

music struggles (@musicstruggles1)

really hope this isn’t true

Likes

238

Twitter · Apr 17, 2023, 4:20 PM

[uneven falcon]

Plizzzzz can someone make a tweak for video as ringtone !? For ios15

[ocean raptor]

Smh

I watched an insta stream of it

But it cut out right when he played self control 😭😭😭

[coral gazelle]

Does anyone know how much of the iPhone's hardware is emulated by Corellium, and how they've been able to emulate all of it (i.e. have they patched out any security checks in iOS and/or its bootchain)?

[tepid olive]

Idk if there is much public info about that, maybe if it has been reverse engineered someone can answer

[grim sparrow]

they use a custom version of iboot

they emulate cpu, nand flash and gpu (non accelerated) nearly 1:1

other hardware such as nfc, camera, speakers arent emulated

you can choose to leave the kernel as stock or disable whatever security features you like

so you could load up an iPhone 14 Pro Max on the latest iOS version fully jailbroken

just with a switch

or you can load one thats completely stock

https://support.corellium.com/getting-started/introduction-to-virtual-devices/quickstart-for-ios

[coral gazelle]

Is it possible that the original versions of all stages of iBoot (SecureROM, iBoot first-stage loader, iBoot second-stage loader) could be emulated? How similar to the original hardware would the emulator have to be to get that to work?

[grim sparrow]

Their custom boot loader is near identical

If you were trying to debug iboot shit you'd be better off buying a debug cable

[radiant idol]

Anyone know the bundle ids for these?

• XinaA15 [this is com.xina.jailbreak]
• unc0ver [it's science.xnu.undecimus]
• checkra1n loader [this is kjc.loader]
• palera1n loader (this looks like it is com.samiiau.loader)

Thanks!

[tepid olive]

You can use qemu-t8030 to boot iOS (with stock iBoot/ROM/SEP) on your own computer, for free

[coral gazelle]

If the GPU is almost identical, how come it doesn't support Metal?

[grim sparrow]

because metal support would be a complete pia to work on, require a lot more compute, and be completely unnecessary for the majority of security research

[hasty ruin]

not like anyone uses metal anyway 🥱

[primal perch]

fr

[serene hawk]

soo i'm trying to get ivars of a swift class. if i nslog them, i get: <invalid NS/CF object> does that basically mean i'm fucked or is there any way to modify and return them? ivars like window for example get logged correctly

[grim sparrow]

If you’re trying to get something like String you won’t be able to use objc runtime methods

[serene hawk]

thanks; are there any other methods i could try? tbh idk what it is since flex shows ? hasAccessToUnblurred but i guess it is a bool

[timid furnace]

@grave sparrow give macos tweak

[restive ether]

me when i didn’t read the 100 warnings on the page

[timid furnace]

anything simple to test my shit

something that either uses dyld_interposing or swizzling

im too lazy to install ellekit

ok

[ocean raptor]

[indigo peak]

does this change the color of message bubbles

are there any open source tweaks to do that

like how complicated is it to change the color of the bubbles

[cloud yacht]

Why don't you try it and see

irs probably not that hard cause they change sometimes anyways

[indigo peak]

my jb phone is dead

[cloud yacht]

Sad

[indigo peak]

and im not booting an entire other computer just to rejb

[cloud yacht]

I feel like litten maybe did that at one point

[cloud yacht]

Oh no she did one where the 3D touch menu was changed

[indigo peak]

figured it would be easy

I wanna try to get it to work on iOS 16 stock iOS

give me the hook

and then I’ll go from there

[tepid olive]

what is the latest sdk version that official theos toolchain supports?

[restive ether]

16.5

[tepid olive]

can u provide sdk for ios 15 sdk because the latest official of their sdks are 14.5 and idk i tried using some sdks but i just got missing some files etc example when building it told UIkit not found

[rustic fiber]

I'm having trouble getting a theos project to compile on WSL with UIKit

`import <Foundation/Foundation.h>

While building module 'UIKit' imported from Tweak.xm:1:
While building module 'UserNotifications' imported from /home/jake_/theos/sdks/iPhoneOS15.5.sdk/System/Library/Frameworks/UIKit.framework/Headers/UNNotificationResponse+UIKitAdditions.h:10:
In file included from <module-includes>:1:
In file included from /home/jake_/theos/sdks/iPhoneOS15.5.sdk/System/Library/Frameworks/UserNotifications.framework/Headers/UserNotifications.h:8:
/home/jake_/theos/sdks/iPhoneOS15.5.sdk/System/Library/Frameworks/UserNotifications.framework/Headers/NSString+UserNotifications.h:8:9: fatal error: could not build module 'Foundation'
#import <Foundation/Foundation.h>

While building module 'MachO' imported from /home/jake_/theos/vendor/include/substrate.h:45:
/home/jake_/theos/sdks/iPhoneOS15.5.sdk/usr/include/c++/v1/module.modulemap:4:8: error: redefinition of module 'std_config'
module std_config [system] [extern_c] {`

[tepid olive]

yeah i get same kinda errors, idk why that happens

[tepid olive]

does anyone know why

[rustic fiber]

I was able to get it working with the 14.5 sdk

but now I am wondering

Is there a good way to get get crash reports on Fugu Max 15?
Because I am getting a crash from simply trying to log stuff

[tepid olive]

yeah i know that works but idk why newer sdks dont

[serene hawk]

krashkop

[tepid olive]

anyone know why when i builded anouk from the source and tried using it, it doesnt do anything even tho sileo shows it installed, but when just downloading it normally through sileo it works

[serene hawk]

i‘m the dev of anouk so i‘m happy to help but it has to be some issue on your end when compiling. have you tampered with the makefile or something?

[tepid olive]

Nice to hear, yeah i have edited it but i can try the default make file, like it always shows up on sileo tho when builded but nothing happens, this happens with all tweaks i build but them could just be my coding issues lol

doesnt show any errors

okey now when i tried the default make file i get this error

[rustic fiber]

I am getting an EXC_BAD_ACCESS function when trying to log stuff on my tweak. Is it because the Linux tool chain hasn’t been updated for rootless yet?

[serene hawk]

maybe run: make clean

[restive ether]

the linux tool chain doesn’t support newer versions of ios

on arm64e at least

arm64e abi changes blah blah blah

[rustic fiber]

Wait really 😞

I really don’t wanna setup a hackintosh

[tepid olive]

oh so the wsl theos default toolchain doesnt support rootless yet or what?

[rustic fiber]

Are there any plans for it to be updated?

[restive ether]

yeah cameron will do it eventually

it’s a matter of when not if

[tepid olive]

@serene hawk man sorry for the ping but it builds when there isint FINALPACKAGE = 1 in the makefile

[tepid olive]

what versions?

[rustic fiber]

How difficult is it?

[tepid olive]

@marble perch wen eta iphoneos-arm64e

Yan, could it be since i’m using ios 14.5 toolchain cuz like idk jakesnake and also me had problem with higher ios sdk version

So what don’t support what?

Nah i just never understood what toolchain doesn’t support arm64e newer ios versions if i even understood correctly because my english isint good so its hard to understand

Ahhh okey alright

can dpkg support it?

[ocean raptor]

[primal perch]

[ocean raptor]

I CAN"T GET LLDB TO WORK!

[gentle grove]

is it installed

[naive kraken]

no no no

[primal perch]

easiest fix: restore latest ipsw and never think about jailbreak again

[naive kraken]

no iphoneos-arm64e pls

no one needs that

64e is not even ABI stable

it doesn't make sense to have a bootstrap in it

[ocean raptor]

I agree

arm64e can lick my sweaty balls

[hasty ruin]

.

[native dune]

.

[ocean raptor]

....

[tepid olive]

okay

[restive ether]

giant uncompressed package file

[peak hornet]

If I wnat to poke around kernel memory is there. atool like memctl that works for ios 15.7, palerain?

[rain falcon]

@primal perch nfr

[primal perch]

[rain falcon]

nfr

[jagged hinge]

on which iOS?

[peak hornet]

15.7.2

I was looking at somethign like xnuspy ? Not sure where to start

Im really just hoping to poke around memory and see if I can learn more about xnu. Kind of following https://www.youtube.com/watch?v=iXAlfTDSmwU

[timid furnace]

@grave sparrow how do you deep sign properly

does that take care of resources though

ok so i just have to do depth-first signing

thank god

nah i have to write it in python

also im not signing apps, i'm signing frameworks and kexts

but my main issue was whether i had to actually play "figure out if this folder is a bundle or not" or if i could just sign every macho

beautiful

i'm only going to use --deep for verifying then

no it doesnt

dhinak@Dhinaks-MacBook-Air Universal-Binaries % codesign --verify "longasspath/NVIDIA Driver Manager.prefPane"

dhinak@Dhinaks-MacBook-Air Universal-Binaries % codesign --verify "longasspath/NVIDIA Driver Manager.prefPane/Contents/MacOS/NVAgent.app"
longasspath/NVIDIA Driver Manager.prefPane/Contents/MacOS/NVAgent.app: a sealed resource is missing or invalid

dhinak@Dhinaks-MacBook-Air Universal-Binaries % codesign --verify --deep "longasspath/NVIDIA Driver Manager.prefPane"
longasspath/NVIDIA Driver Manager.prefPane: a sealed resource is missing or invalid
In subcomponent: /pathtolongasspath/longasspath/NVIDIA Driver Manager.prefPane/Contents/MacOS/NVAgent.app

[vivid dew]

trolley

[timid furnace]

@grave sparrow say I, for some reason, have two files in the root of a framework

ie. Zefram.framework/Contents/Versions/A/Zefram, and Zefram.framework/Contents/Versions/A/Zefram2

does it matter which order i sign them in

both are machos obviously

yea but then i need to figure out detecting bundles

won't work for me

cursed i know

but info.plist isn't guaranteed to exist

and i can't work around it easily

[timid furnace]

bro

this is stupid

codesign doesn't even touch this folder

what fucking garbage am i going to have to do for this shit

[timid furnace]

stuff in a framework's root:

• symlink to the binary
• Agents (binaries or bundles)
• BundledIntentDefinitions (resource type dir)
• Contents (only seen (app) bundles)
• Executables (binaries)
• Frameworks (haha funny recursive)
• Helpers (binaries or bundles)
• literal apps (???)
• whatever the fuck .momd is (resource type dir)
• OverrideBundles (bundles)
• Resources (symlink to Versions/Current/Resources)
• yea fuck it i give up

maybe i should just

• find macho
• traverse up until i find Versions or Contents

yea fuck this

i'll just try my chances with signing all the machos

[timid furnace]

ERROR: Universal-Binaries/10.13.6/System/Library/Frameworks/OpenCL.framework/OpenCL: bundle format is ambiguous (could be app or framework)

.

oh the symlink broke

[tepid olive]

What sdk i should use for ios 15 tweak development and toolchain for it on theos (running on wsl ubuntu)

[dim coyote]

I'm using iOS15.5 sdk

[tepid olive]

I tried using but idk it just throws error, u have mac or using wsl?

[dim coyote]

mac

(hackintosh)

[tepid olive]

Ahhh then idk seems nobody is really using wsl

[dim coyote]

I actually used it but it didn't compile my tweak

so I switched to macos

also

[tepid olive]

I actually can compile the tweak and it shows up on sileo but literally just doesnt do anything

Builded this from the open source of that tweak and idk it just doesn’t work, when downloading it officialy from sileo it does

[hasty ruin]

we always ignore you capt

[restive ether]

get a clipboard manager broke ass

[primal perch]

fr

dude keeps spamming my dms

[hasty ruin]

[serene hawk]

is there any way i can get swift ivars, modify and return them?

[coral gazelle]

@tepid olive If I send pwned iBSS and iBEC that was created using your SSHRD_Script (15.0 for iPhone9,1), I can use irecovery to run iBoot commands but they output ea0f64a4253252:448 instead of any useful information. Is there a way I can get commands like help or printenv to output properly?

[tepid olive]

Development iBoot

Find them in ota files, decrypt, patch, sign with blob

Im busy rn

[steady nest]

… or patch them using iBoot64Patcher and nvram whitelist everything

[rain falcon]

@grave sparrow twerk

[hybrid kindle]

does anyone know why https://github.com/TrungNguyen1909/qemu-t8030 is archived? Cool stuff happened last January https://mastodon.social/@ntrung03/109712247237110967
https://twitter.com/ntrung03/status/1616111498429865989?cxt=HHwWioCx1Yy2yu0sAAAA

Trung Nguyễn Hoàng (@ntrung03)

I guess my Mac is 🍎’s now

Likes

493

Twitter · Jan 19, 2023, 4:33 PM

[coral gazelle]

What OTAs would I look through?

[tepid olive]

that's true

[stark stratus]

I’m trying to compile a C program using clang but stdio.h apparently doesn’t exist, how can I get it or else should I print?

[faint stag]

clipboard manager costs 0 dollars lol

[faint stag]

uhh, are you on linux

well anyway, on macOS that should just be part of the sdk

on linux that should be in whatever provides the standard c library (glibc/musl) (typically in /usr/include)

[primal perch]

the

[stark stratus]

iOS 14.4 with unc0ver

Should’ve probably mentioned that

[faint stag]

Yeah you just need the ios sdk lol

[stark stratus]

Where do I find this

[quiet agate]

[rustic fiber]

Does anyone know how to skip forward and backward on the playing media. I tried MRMediaRemote but didn't have any luck

[tepid olive]

send a playback command

[tepid olive]

@grim sparrow who is in charge of taurine now that cs is gone?

asking cuz of something

[grim sparrow]

uuuhhhhhhhh

Bear with me

@mortal isle I'm referring this to you because I'm lazy.

cc @tepid olive

[mortal isle]

Officially nobody

[grim sparrow]

You were the one taught about publishing new builds

You're the most qualified out of all of us

[mortal isle]

Fill me in, what needs done lol

[grim sparrow]

I have no idea

[tepid olive]

can i dm you?

[mortal isle]

Sure, shoot

[tepid olive]

it won't let me lol

[mortal isle]

Sec lol

[grizzled narwhal]

Hi, can someone can tell me how to install numpy with pip i've got this error, same error for cchardet

[faint timber]

if you bothered to install the compiler like it said you would get a different error

clang-14: error: the clang compiler does not support '-march=native'

sudo apt-get install theos-dependencies

[grizzled narwhal]

thanks

[faint timber]

so still need to find a fix or wait on a fix for that clang error

idk why its doing that

[grizzled narwhal]

i'll check this

[faint timber]

sudo apt-get install theos-dependencies libpython3.9-dev

[grizzled narwhal]

yup

It is obvious that I am a beginner 🙂

ImportError: dlopen(/private/preboot/7835725F81F6F4801F77C7CC82E24F40BDA709DB5C2FAC27DA97474B4C803321145028320C338646CF69D4EAAB18B1FF/jb-OzlzRE/procursus/usr/local/lib/python3.9/dist-packages/charset_normalizer/md.cpython-39-darwin.so, 0x0002): tried: '/private/preboot/7835725F81F6F4801F77C7CC82E24F40BDA709DB5C2FAC27DA97474B4C803321145028320C338646CF69D4EAAB18B1FF/jb-OzlzRE/procursus/usr/local/lib/python3.9/dist-packages/charset_normalizer/md.cpython-39-darwin.so' (mach-o file (/private/preboot/7835725F81F6F4801F77C7CC82E24F40BDA709DB5C2FAC27DA97474B4C803321145028320C338646CF69D4EAAB18B1FF/jb-OzlzRE/procursus/usr/local/lib/python3.9/dist-packages/charset_normalizer/md.cpython-39-darwin.so), but incompatible platform (have 'macOS', need 'iOS'))

any idea ? @faint timber

(i'm on ios)

[zenith hatch]

gm

[faint timber]

sudo apt-get install ldid

ldid -S /var/jb/usr/local/lib/python3.9/dist-packages/charset_normalizer/md.cpython-39-darwin.so

if that doesn't work python has the macos version

[zenith hatch]

why does no one want to rewrite ldid again

[faint timber]

someone tried, gave up

[zenith hatch]

how come

[faint timber]

didn't say

they just gave up

[zenith hatch]

fair

[faint timber]

https://blog.umangis.me/posts/a-deep-dive-into-ios-code-signing/

Maybe dm them this person and ask why they never released this?

[grizzled narwhal]

i guess i have macos version

[faint timber]

not talking about the person I said to dm here

[faint timber]

just for normalizer

its downloading the macos so

[gentle grove]

Why not

[restive ether]

cameron signer coming soon

[coral gazelle]

Speaking of code signing, The Apple Wiki says that execution on boot requires a code signing bypass, which is why there haven’t been more than a few untethered jailbreaks since iOS 9. It says that Fugu15 uses CVE-2022-36766 to bypass code signing. Does that mean such an exploit could be part of an exploit chain (containing additional exploits that have yet to be developed) that would be able to jailbreak 14.0-15.5 beta 4 and 15.6 beta 1-5 untethered?

[ocean raptor]

Nah, I gave up too

[restive ether]

you’re kinda real for that

[gentle grove]

did you seriously just paste that question into chatgpt

[dim coyote]

ye xD

[gentle grove]

[dim coyote]

Quite good answer ngl

[grizzled narwhal]

cuz i don't find how haha

[gentle grove]

I'm sure it doesn't actually make any real sense

but it sounds quite goot

that's what GPT is

[dim coyote]

Well, I'm sure if I had been more detailed, it would have resulted in a better answer...

[gentle grove]

no it literally just doesntbhave the capacity to think

the only thing gpt does is imitate (confidently) the input it was trained on

[naive kraken]

not good answer cause it doesn't know about SSV

[runic marsh]

what’s going on with cryptex and SEP incompatibility breaking downgrades

[timid furnace]

SEP incompatibility is the normal SEP incompatibility shenanigans

cryptex incompatibility is tl;dr cryptex also has a nonce that we can't set

using latest cryptex does not go well

as you are basically shoehorning different versions of the OS together

[steady nest]

15 has SSV

[coral gazelle]

I thought SSV only verified the contents of the root filesystem. If the files for an untether were located outside of the root filesystem, I don't see how that would fail the SSV check.

[dim coyote]

gpt4 do be carrying though

[steady nest]

nothing execs on boot outside the root filesystem

[ocean raptor]

That's not what SSV is...

[coral gazelle]

So in order to create an untether, you would need to find a vulnerability in code that runs on boot by default that would lead to arbitrary code execution? Also, why do untethers require code signing bypasses in the first place?

[steady nest]

Yes, you can circumvent that if you have a codesigning bypass - you can spoof your executable being the executable that runs on boot

[timid furnace]

https://github.com/asdfugil/haxx

[coral gazelle]

I'm wondering when an untether for iOS 13.3.1-13.7 will be developed. (9.2-13.3 are vulnerable to the Racoon String Format Overflow Exploit and thus could have untethers developed using that. Also, is said racoon bug patched in iOS 12.4.5-12.5.7 as 12.4.5 came out alongside 13.3.1?)

[tepid olive]

never

[coral gazelle]

Speaking of untethers, what exploit does Fugu14 use to untether the jailbreak, and what's the minimum iOS version that it's available on?

[primal perch]

tomorrow

[velvet path]

it uses… it’s own

(only works for 14.0-14.5.1 as well as 14.6b1 (other 14.6 betas untested, patched by 14.6)

[acoustic imp]

Idk who/where poomSmart is but I just tried to install the emoji stuff, followed someone in #dopamine. installed 6 packages but the thing didn’t show up in the settings(the font didn’t show up). What I did was just copy paste(AirDrop) the folder from my iOS 14 iOS to my phone and copy pasted it into the themes>efm folder and it now works. Idk if this is helpful, sry if it isn’t.

[coral gazelle]

Do you know the CVE ID of the exploit?

[steady nest]

that’s useless

[elder scaffold]

9.2-9.3.4 has pegasus

but I didn't understand the exploit for untether

[limpid star]

iirc its CVE-2021-30768, which is a dyld bug

[faint timber]

It’s just webkit jsc shellcode that’s executed via symlinks and early boot file @elder scaffold

[elder scaffold]

yeah but, only the 32bit version was published, and I didn't know how to change the jbme code to trigger with the jsc binary...

[faint timber]

Shouldn’t be too difficult unless there’s an SoC security difference

[exotic saffron]

Does anyone in here knows how to code a paypal button? asking for a friend ... lol

Or is this off-topic ?

[faint timber]

No context, context is needed

[elder scaffold]

Also it's not an exploit code issue, A9 seems to use rtbuddyd, a 32-bit alternate binary, at startup.
However ios 9 there is no identity verification for launchdaemon so if it can be replaced by another daemon it is no problem

[lime pivot]

"static security validation" lol, surprised it's not in its corpus considering it first appeared in 2020

[lime pivot]

to answer @coral gazelle's original question, in theory yes, if someone finds a way to trigger the exploit on boot. the technique used to be to add spawn commands to /etc/launchd.conf, but that file was disabled in iOS 9 or so

[steady nest]

since you're replacing it with another platform binary, there shouldn't be an issue?

rtbuddyd <-> JavaScriptCore

[elder scaffold]

I think A9 used rtbuddyd

[steady nest]

yes, the symlink?

--early-boot or something

yeah

[elder scaffold]

Prior to A8 putting the jsc symlink in /usr/libexec/rtbuddyd and the .js symlink in /--eraly-boot should work

[steady nest]

Yes, and there's the presentation from fried apple team talking about jailbreak diy

[elder scaffold]

but A9 i think /usr/libexec/rtbuddyd exists in the first place

[steady nest]

I think not, they did it on 6s

but I can check

[elder scaffold]

oh really? I may have misunderstood lol

[steady nest]

I'm charging my 6s

[steady nest]

@elder scaffold it exists

but we can just replace it with jsc's binary right?

[elder scaffold]

I remember boot looping when I tried to replace it 😅

im wondering how pegasus untethered it when it was 9.3.3...

[steady nest]

pretty sure it was rtbuddyd too

maybe you bootlooped because jsc was exiting with an error code != 0

[elder scaffold]

ah i see...

[tepid olive]

did you execute rtbuddy from jsc?

[elder scaffold]

no. maybe I think it was just replacing rtbuddyd with another binary that did nothing.
I don't remember if I replaced it with a jsc symlink or not...

[tepid olive]

rtbuddy is probably needed

[steady nest]

I think it's launchd panic'ing because some launch daemon was always exiting with an error

[steady nest]

I think not

it's not there on some devices even

[gentle grove]

https://twitter.com/PR0GRAMMERHUM0R/status/1649518391957368832?s=19

Programmer Humor (@PR0GRAMMERHUM0R)

Safari is such a pain. https://t.co/fiBwvoD6dp

Likes

4074

Retweets

359

Twitter · Apr 21, 2023, 9:00 PM

[radiant idol]

lol true

[rustic void]

has anyone reverse engineered how mremap_encrypted worked on 11.2.3? I wanted to get a fairplay decrypt working for ventura but it doesn't seem like theres been any work done on that. https://github.com/subdiox/UnFairPlay

would be nice to pair that with ipatool to actually get working ipa decrypts locally

[marsh gulch]

hey uhm does someone here have any experience with hosting a repo?

If yes please ping me or slide in my dms I kinda need help setting stuff up

[restive ether]

just copy the sileo template

[marsh gulch]

thats not what i have problems with

ok so i just deleted my entire repo and readded everything which fixed my issue

[tepid olive]

You probably need a private entitlement now

Or kernel read/write

[gentle grove]

bruh they swapped the fucking buttons

i keep clicking no

[dim coyote]

Lol

[hexed knot]

i hate that feature

[gentle grove]

fr i hate cybersecurity

[hexed knot]

idc if its to be safe

its annoying

let me be unsafe

[gentle grove]

note the checkbox

[hexed knot]

it doesnt help for me

the way i do my folders n shit that doesnt work

[gentle grove]

then disable it

[hexed knot]

how

[gentle grove]

search workspace trust in settings

[late ridge]

Is there a wiki or something for windows modifications like process injection and hooking of system processes

[robust radish]

i have. this tool probably fails because mremap_encrypted expects cryptoff to be page aligned, which is not always true. this tool isn't doing the necessary fixups to handle that

[rustic void]

@robust radish is that the only issue? its just page alignment thats blocking decryption of ios ipas on macos?

[topaz yew]

https://github.com/opa334/opainject hey whats ROP method?

[faint timber]

Return Oriented Programming(ROP)

You can chain together preexisting “gadgets” inside a binary to complete a specific arbitrary task. But each gadget has to have a return at the end usually 2-3 instructions long.

[faint timber]

^

[drifting heron]

nvm found them!

[warped thicket]

Discovered a way to get keychain working for iOS 16, totally insecure but lets people use banking apps etc

[shy veldt]

Hey

I’m trying to color the lockscreen clock

I can’t get it done for some reason

I can only color the background but not the actual label

Would appreciate help… thank you very much

[shy veldt]

Ok.. I have succeeded

Fucking Apple

Thanks anyway🙏

[gentle grove]

ruby is cool

[tepid olive]

hello i would like developer role back and access to the ellekit/dopamine thread

[dreamy mason]

gimme a ruby 😄

[late ridge]

unironically what is it used for i never hear abt it

[hybrid horizon]

If I wanna run macos (on an AMD processor, NVIDIA graphics card) will i have a better time getting it to run natively or via a Linux KVM?

WSL2 KVM's don't work on AMD Processors on Win 10 and I know MacOS has spotty (at best) native NVIDIA graphics cards support

heavily leaning towards KVM but wanted to get some input first from anyone more knowledgable

[gentle grove]

mastodon

[late ridge]

oh fr

lol

[grim sparrow]

What card specifically

[hybrid horizon]

3070. I ended up finding a definitive answer that 30 series just. Don't work with hackintoshes (no kernel support after Monterey) so I've gone with the KVM option

[grim sparrow]

Yup

[hasty ruin]

wtf

[timid furnace]

you are going to have no acceleration either way

Ampere never ever had macOS drivers

[gentle grove]

ampere???

[timid furnace]

3070 is Ampere right? i can't remember codenames for the life of me

[hybrid horizon]

I don't need ACCELERATION per say, just for it to not run like ass, which a KVM seems like it'll accomplish just fine

Gonna be doing Xcode stuff anyway

[timid furnace]

you do understand what graphics acceleration is right?

[hybrid horizon]

yeah

[gentle grove]

wtf i didnt know they codenamed it that

i was thinking of the arm processors

[hybrid horizon]

Vaguely

[timid furnace]

without graphics accel you'll have missing icons and shit

personally i haven't tried Xcode but it won't be super amazing

[steady nest]

it's not

no animations, everything is slow, impossible to use

[restive ether]

if amy can do it you can do it

[lime pivot]

github also is a big one

[gentle grove]

oh true

forogt about that

github loves ruby on infrastructure

[primal perch]

get a cheap polaris card if you want to do kvm or dual boot

rx 460 is 50–60$ these days and will likely have driver support until intel gets EOLd altogether

like people said macos with gpu accel sucks ass

i can also recommend the wx4100 as its single slot and has the rx 460 die, works great on macos

low tdp as well, works fine off chipset lanes. any pcie 3.0+ x4 slot will be fine

70-80 on ebay

[gaunt mesa]

Hello

Almost 2 years

[ocean raptor]

Who

[gaunt mesa]

Or

===

[wide gyro]

It was over a year ago now, but thank you for this advice. We originally talked about doing it for Cylinder, which I'm currently unsure if it will ever happen, but I will be updating Cask this week to do this now that Orion has been updated. It'll probably be a huge performance increase

[late ridge]

welcome back

[hybrid horizon]

update: i didn't think it would be that bad but it is

may be worth a cheap amd card

no missing icons but i imagine after i install Xcode things are just gonna straight up die

[hasty ruin]

🤓🤓🤓🤓

[minor silo]

I'm leaving this server because i've spent too much time here and haven't gained anything in a while.
Good luck everyone with your projects, you all are pretty talented

[hasty ruin]

What the fuck is your bio

[wheat grotto]

penis

[hasty ruin]

penis

[harsh junco]

penis

[primal perch]

penis

[copper stream]

Tell me you want random dick pics without telling me you want random dick pics

[peak hornet]

Hey, I haven’t done too much digging myself, but I am getting airs trying to iOS deploy whatsapp after injecting Frida and signing. Just wondering if anyone knows if WhatsApp has any special anti dylib injection stuff going on?

I was going to try to use configurator to install the ipa next

[grim sparrow]

I’m assuming the method you used worked in other apps?

[naive kraken]

no but sideloading isn't possible for a lot of apps without additional patches because they use group containers and keychain stuff that a sideloaded app cannot access

https://github.com/opa334/IGSideloadFix

[peak hornet]

Yes it has worked

I even tried the same command with another app I have been tweaking

And the app layout for whatsapp is relaly different than other apps.. like dynamic libraries in the .app folder. Not Frameworks.. etc.. Thank u so much! I'll check out that repo too

Really appreciate it

[trail venture]

Someone should make me a hackintosh efi for my smol PC

[dim coyote]

Do it yourself

[trail venture]

I tried but messed up

[dim coyote]

What went wrong?

[trail venture]

Idk

After that I wiped the USB so

[dim coyote]

Hmm

If you had patience like I did back in 2021 you would just keep asking in the hackintosh discord

I went from being stuck on exitbs start to having a 3gb graphics acceleration

[trail venture]

There are like 10 and the one I was in was dead for the moment I needed help

I will likely try again but I'm getting Linux installed on a diff drive first

[dim coyote]

I was actually lucky to get help my a somewhat smart person

He even helped me get iServices working

I’ll find my apple support pdf later it’s pretty wild

[trail venture]

You should send me the link to the server you were in so I can try later

[tepid olive]

Does anyone know how I can hook UIAccessibilityIsReduceTransparencyEnabled ?

https://developer.apple.com/documentation/uikit/1615074-uiaccessibilityisreducetranspare?language=objc

maybe MSHookFunction -> http://www.cydiasubstrate.com/api/c/MSHookFunction/

[wheat grotto]

MySQL My beloved. Whenever i delete a thing from my data tables, id love the ids to automatically correct themselves(....?), how do i do that ?

This how my stuff currently look, but id want it to be 1, 2, 3, 4, 5 etc. again. the ID field is the PK of that table

[late ridge]

don't we all :/

I'd use a different item to sort with, maybe creation time or a separate column of uid's you update after removing items. I've looked this up before and I don't remember there being a solution like that

[wheat grotto]

What im looking for, i guess, is resetting auto increment

Using an auto incremented id would have been perfect for what i need

[gentle grove]

https://www.google.com/search?client=firefox-b-1-d&q=mysql+reset+auto+increment+after+delete

[late ridge]

https://befused.com/mysql/reset-auto-increment/

[gentle grove]

https://stackoverflow.com/a/2214209/19003757

https://www.mysqltutorial.org/mysql-reset-auto-increment

[late ridge]

lol ya I take back what I said earlier

[gentle grove]

the point is this answer

ask why you want to reset that number, just because of ocd? '

[tepid olive]

you are going to break stuff if you retroactively change existing ids in the db, just don't

[wheat grotto]

Well, any other ideas ? auto increment would be awesome for what i need.

Timestamps could be the same for multiple entries as well as the other data in this case

[wheat grotto]

Yeah and no. Im displaying that data as well as the id, so, seems kinda weird to have the data start from 3 if u know what i mean

Or.... i can just not show the ID

Maybe

[gentle grove]

why show the id

[wheat grotto]

man idfk, i wouldnt be using sql in the first place if i had the chance

[late ridge]

lol if you're trying to show a list of items then I'd just number them in the UI

[wheat grotto]

Yea, i guess i could just do that

im stupid

And whats the difference between TIMESTAMP and DATETIME lol, they both have the same format

[gentle grove]

https://www.google.com/search?q=mysql timestamp vs datetime&ie=utf-8&oe=utf-8&client=firefox-b

You can think of DATETIME as a literal value, as it stores the date and the time but has no reference to a specific timezone. So when you store the value of NOW(), for example, the server time zone will be used. Once inserted, the value of the DATETIME will remain the same regardless of any current sessions.

[grim sparrow]

@ocean raptor why do you have a box of tissues at your desk

[ocean raptor]

Cause I had bad allergies not that long ago

Also, that's my cubicle at work...

It didn't rain here for months

There was no air

Only pollen

[grim sparrow]

understandable

Can’t believe some people are allergic to plant sex

Truly lower class citizens

[hasty ruin]

[grim sparrow]

L?

[ocean raptor]

But not lower than British people

[grim sparrow]

True

[hexed knot]

cuz he be jerking it

[hasty ruin]

[severe prairie]

hi all. i want to make a tweak which fakes dual sim in the status bar and to change the text of the second carrier. the problem is, i've never made a tweak before. are there any resources or advice you could give me to achieve this goal? thanks!

[hasty ruin]

Look up Zane Helton on YouTube

or https://icrazeios.com/kodey-tweak-guide/

[primal perch]

https://tenor.com/view/funny-monkey-eat-hungry-adorable-cute-gif-16750529

@hasty ruin

[hasty ruin]

[viral moth]

[lime pivot]

the idea of an autoincrement key is to be unique to the exact row, never being reused

I think you have an xy problem here, what are you actually trying to achieve?

[lethal kayak]

not to mention that would add unnecessary time complexity to removing a row unless you really need to do it

[cedar mica]

how to write tweaks for Fugu15(Dopamine)?

[wheat grotto]

Well, i just decided to sort using timestamps by default not the IDs, so ig this is solved.

Off to another question then, i want to make some stuff configurable for the UI, for example, customizing certain "limits" and when they show as red, orange, green etc, what would be the most efficient way of storing these settings ?

My project involves measuring soil/air/whatever statistics and i guess it would be better to save these settings per-device, as, well, the "limits" for measuring moisture in a greenhouse and a normal house room would be different.

[wheat grotto]

As you would for any jb, but, well, now it has to be rootless

[cedar mica]

Theos still works?

Thanks

[wheat grotto]

i think there are better alternatives now

[cedar mica]

But Dopamine said: Tweak injection (via ElleKit)

And Dopamine still load Cydia Substrate tweaks?

[wheat grotto]

About those "limits", this is what i mean

[naive kraken]

ellekit has substrate compatibility shim

all you need to do is compile for rootless and make sure to use Xcode 12 or higher when compiling

[gentle grove]

A database table most likely

[wheat grotto]

Well, that was my idea too, but if im measuing temperature and moisture for air and soil + air pressure, thats 5 different min, normal and high fields, or am i missing something

[gentle grove]

make columns

[wheat grotto]

I guess this works

But then, whenever a new device gets added, i have to make sure its settings table gets populated with some default values

[severe prairie]

thank you!

[late ridge]

You should use Luz 👀
https://luz.jaidan.dev/en/latest/index.html
if u have questions abt it j ask in #1080675975714578482

[gentle grove]

Luz is written in pure Python, and only uses libraries that I’ve created myself in its code. This means that it’s very fast.

[severe prairie]

hi again. i'm having trouble finding the right method to hook if I want to change the secondary sim text. I'm pretty sure it's in https://developer.limneos.net/index.php?ios=15.2.1&framework=SpringBoard&header=SBStatusBarStateAggregator.h

thank you again!

[late ridge]

maybe try NSString* _secondaryServiceBadgeString;

[severe prairie]

thank you, do I just hook that?

because it doesn't appear in logify

or am i missing something

[indigo peak]

thats an ivar, not a method, so you cant 'hook' it like a regular hook, you need to find a point to do smth like

SBStatusBarStateAggregator *stateAggregator = /**/;
MSHookIvar<NSString *>(stateAggregator, "_secondaryServiceBadgeString") = @"test";

[severe prairie]

ookay. so i would have to find something else to hook?

[indigo peak]

prob smth along the lines of:

%hook SBStatusBarStateAggregator

// not sure what youre gonna need to hook here, you need to figure that out on your own
- (void)someMethod {
  SBStatusBarStateAggregator *stateAggregator = [SBStatusBarStateAggregator sharedInstance];
  MSHookIvar<NSString *>(stateAggregator, "_secondaryServiceBadgeString") = @"test";
}

%end

[severe prairie]

ty

[hasty ruin]

Also you’ll need to rename Tweak.x to Tweak.xm to use MSHookIvar

[primal perch]

-(void)_updateSecondaryServiceItem

or use valueForKey its better

[hasty ruin]

What if non kvp compliant 🤓

[primal perch]

then do it

but try it first

[severe prairie]

weird, i get /home/leo/theos/sdks/iPhoneOS15.2.sdk/usr/include/c++/v1/module.modulemap:4:8: error: redefinition of module 'std_config' when compiling now

and without the custom sdk (using theos default ones) i get this

Tweak.xm:41:50: error: receiver 'SBStatusBarStateAggregator' for class message is a forward declaration
  SBStatusBarStateAggregator *stateAggregator = [SBStatusBarStateAggregator sharedInstance];
                                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~
Tweak.xm:57:8: note: forward declaration of class here
@class SBStatusBarStateAggregator;
       ^
Tweak.xm:41:77: error: no known class method for selector 'sharedInstance'
  SBStatusBarStateAggregator *stateAggregator = [SBStatusBarStateAggregator sharedInstance];
                                                                            ^~~~~~~~~~~~~~
Tweak.xm:43:14: error: declaration of 'NSString' must be imported from module 'ObjectiveC.NSObject' before it is required
  MSHookIvar<NSString *>(stateAggregator, "_secondaryServiceBadgeString") = @"MarcPhone Cell";
             ^
/home/leo/theos/sdks/iPhoneOS14.5.sdk/usr/include/objc/NSObject.h:13:8: note: previous declaration is here
@class NSString, NSMethodSignature, NSInvocation;
       ^
3 errors generated.
make[3]: *** [/home/leo/theos/makefiles/instance/rules.mk:289: /home/leo/projects/dualsim/.theos/obj/debug/arm64e/Tweak.xm.d4f79cc6.o] Error 1
make[2]: *** [/home/leo/theos/makefiles/instance/library.mk:52: /home/leo/projects/dualsim/.theos/obj/debug/arm64e/dualsim.dylib] Error 2
make[2]: *** Waiting for unfinished jobs....
==> Compiling Tweak.xm (arm64)…
/home/leo/theos/toolchain/linux/iphone/bin/clang++: /lib64/libtinfo.so.6: no version information available (required by /home/leo/theos/toolchain/linux/iphone/bin/clang++)
/home/leo/theos/toolchain/linux/iphone/usr/bin/clang-10: /lib64/libtinfo.so.6: no version information available (required by /home/leo/theos/toolchain/linux/iphone/usr/bin/clang-10)
Tweak.xm:41:50: error: receiver 'SBStatusBarStateAggregator' for class message is a forward declaration
  SBStatusBarStateAggregator *stateAggregator = [SBStatusBarStateAggregator sharedInstance];
                                                 ^~~~~~~~~~~~~~~~~~~~~~~~~~
Tweak.xm:57:8: note: forward declaration of class here
@class SBStatusBarStateAggregator;
       ^
Tweak.xm:41:77: error: no known class method for selector 'sharedInstance'
  SBStatusBarStateAggregator *stateAggregator = [SBStatusBarStateAggregator sharedInstance];
                                                                            ^~~~~~~~~~~~~~
Tweak.xm:43:14: error: declaration of 'NSString' must be imported from module 'ObjectiveC.NSObject' before it is required
  MSHookIvar<NSString *>(stateAggregator, "_secondaryServiceBadgeString") = @"MarcPhone Cell";
             ^
/home/leo/theos/sdks/iPhoneOS14.5.sdk/usr/include/objc/NSObject.h:13:8: note: previous declaration is here
@class NSString, NSMethodSignature, NSInvocation;
       ^
3 errors generated.
make[3]: *** [/home/leo/theos/makefiles/instance/rules.mk:289: /home/leo/projects/dualsim/.theos/obj/debug/arm64/Tweak.xm.0895a8d9.o] Error 1
make[2]: *** [/home/leo/theos/makefiles/instance/library.mk:52: /home/leo/projects/dualsim/.theos/obj/debug/arm64/dualsim.dylib] Error 2
make[1]: *** [/home/leo/theos/makefiles/instance/library.mk:37: internal-library-all_] Error 2
make: *** [/home/leo/theos/makefiles/master/rules.mk:119: dualsim.all.tweak.variables] Error 2

[indigo peak]

put this at the top of your tweak file

@import Foundation;

@interface SBStatusBarStateAggregator : NSObject {
  NSString* _secondaryServiceBadgeString;
}
+(id)sharedInstance;
@end

[wanton cedar]

Do we have a way to control tweak dylib load order? Or is it just filename trickery

[hasty ruin]

Filenames

if you need smth to be loaded before yours, just dlopen it

[wanton cedar]

Gross.. Maybe this can be made a feature in ElleKit through the dylib plist? Something like <Priority> 0-10 where 0 is loaded first and default is 5

[late ridge]

if ellekit did that that'd be awesome
no more 000000TweakName.dylib

[tepid olive]

Everyone would use 0 or 10

[tepid olive]

my thoughts exactly

[late ridge]

lol true

[naive kraken]

actually if you want to be first you need to use spaces, not zeroes

Choicy has 3 of them

[late ridge]

LOL fr

[naive kraken]

but you would always want to inject after Choicy

[late ridge]

Choicy.dylib that's it's name?

[naive kraken]

Choicy had 0's at first but then some tweak started having spaces

yes

[late ridge]

that's so funny

[wanton cedar]

Lol well thats just the idea, it could be like 0,1,2 instead

[primal perch]

yeah counterpoint people don’t put any effort after the code

and would use whatever default is in the template

[hasty ruin]

then everyone uses 0 or 2

[tepid olive]

yea how do you decide which of them need to be really first/last, even among the non-default priority ones

[ocean raptor]

Or you could just do a "load before this tweaks" if you're trying to tweak a tweak

[naive kraken]

or you could just not do anything because it would just make things more complicated considering people would want to support this and the old method

[robust radish]

interesting idea. i'll put this in libhooker. i agree people will probably abuse it though and always define themselves as priority 0

[faint timber]

an idea would be approval system

request approval to use 0

[robust radish]

end users wont understand what it is

[faint timber]

no like the dev

[robust radish]

do you mean approval at the repo level?

like when submitting packages you need to justify why you need higher priority?

[faint timber]

more like a pr for ellekit and libhooker

a list

[robust radish]

that would be a very large maintenance burden

[ocean raptor]

💀

[wanton cedar]

I dunno if people would really abuse 0 priority though, cuz if their tweak works fine with normal prio then theres no point in changing the prio anyway

Especially if they can just 000000000 their filename right now

[ocean raptor]

Who would even realize that the priority exists?

Do you think tweak "developers" read documentation???

This is the best idea

[robust radish]

to airchair's point, developers that have some need for higher priority and who go looking for solutions would find it

[tepid olive]

tbh this should actually be thought through

and not just done like that

• nobody will actually use this in its current state. substrate and substitute are still supported on the latest iOS, so we can’t change the bundle format for shits and giggles without bingner’s approval

[tepid olive]

^^^^^^

[robust radish]

you just wouldn't get load order on those hookers. the format would otherwise be the same. its not a breaking change

[tepid olive]

it is, some tweaks require load ordering to work

e.g. choicy

[robust radish]

and they do it by abusing filename?

[wanton cedar]

Yeah its a pretty compatible addition imo if you keep the same filename stuff but moving forward afterwards if its more standardized we can get rid of the filename hack

[tepid olive]

yes

[robust radish]

i dont see why that would change given the optional ability to specify priority in a non hacky way

[tepid olive]

?

you need substitute support

[robust radish]

wym?

I need sam's approval?

[restive ether]

palerain?

[tepid olive]

You need Sam to implement it

Good luck with that

[robust radish]

in libhooker?

[tepid olive]

In Substitute…

[restive ether]

is libhooker oss just enough to work on checkra1n?

[tepid olive]

libhooker oss is broken asf

[robust radish]

why do i need Sam to implement something that I want to add to libhooker

[tepid olive]

Because you need Substitute support for whatever you’re making

Otherwise nobody will use it

[robust radish]

libhooker oss works fine on everything i've tested it on. but let me know if otherwise; im maintaining it for darwin

[tepid olive]

Doesn’t work on 16.4 afaik

[robust radish]

@upbeat wyvern im gonna add load priority to libhooker. DM me on slack if you want to discuss