what the hell
#development
hexed knot
of course i do
olive peak
Hello again, im using shadow for jailbreak detection, however the apps i use it on lag very badly. I think its cuz one of the settings, but i dont really want to try all different settings. Is this a common issue or just me and how could i fix it?
pearl sail
Christian recommends HolyC
That is why he is in a padded cell
stiff dragon
Does anyone have a jailbroken iOS 16 device? And could you please send me a copy of the ioreg -l output, I have a nice crash log and wonder if it can be triggered on iOS 16 👀
reef fiber
you don't really need to define the stuff yourself I think, the header is there, I cannot understand why they say it isn't, you just #import <spawn.h>. Another note I would make is, the environ variable is used to send the whole environment of your app to the binary you're calling, so if you don't want to do that, just put NULL there in the end of the call, don't need to declare it either in this case.
reef fiber
yeah true 🙂 i was in some box at the moment writing this
wicked summit
Has anyone yet installed TempleOS on an iPhone
That needs to be done
I'm waiting for the sequels ChurchOS, SynagogueOS, and MosqueOS
olive peak
Ive been looking around the code of Shadow from jjlano, and i noticed that activating the hooks takes an instance of HookSubstitutor, but why?
I guess i can steal his code right? Not the entire app just some of the hooks. Since he already made it open source.
hasty ruin
depends on the license
hexed knot
That is why he is in a padded cell
no thats for a different reason
pearl sail
no thats for a different reason
The voices in our heads are real
brazen timber
Our Haskell, who art in binary,
hallowed be thy type system,
thy monoids come,
thy will be done,
on Vim as it is in emacs.
Give us this day our daily recursion
and forgive us our side effects and infinite loops,
and lead us not into imperative languages,
but deliver us from mutation,
for thine is the type-system and the monoids
and the pure functions, forever.
amen
tepid olive
Does anyone have a jailbroken iOS 16 device? And could you please send me a copy...
i have a uh
jailbroken ios 17 device
does that work
eh i sent one in dms either way
I can probably grab ioreg output on my iphone 14 pro max on 16.1.2 too
as root
btw
tepid olive
eh it ran as root either way
because i just made. alaunch daemon
log to /tmp
that ran ioreg -l
timid furnace
ioreg is on stock?
tepid olive
ioreg is on stock?
Yes
timid furnace
dump its entitlements
tepid olive
its used in sysdiagnose iirc
timid furnace
wonder what I need
timid furnace
What macOS version are you on
timid furnace
it has none on macos
Yes as sandbox doesn't fuck you on macOS
tepid olive
NOT PIRACY
hasty ruin
timid furnace
Interesting
tepid olive
also ios ioreg as expected works fine on macos
i used vtool to change stuff to macos
tepid olive
Interesting
maybe its something in trustcache?
indigo peak
i made a portable idevicesetlocation device using a raspberry pi, 0.96" LCD, and a portable power bank that is controlled by a custom version of RelocateMe that requires 0 networking on the rpi's end, only networking capabilities on the iphone to use RelocateMe's address searching
tepid olive
how
this doesn't just apply to system binaries too
it works with any binary that has a valid signature
indigo peak
most normal jb dev
it legit looks like a bomb lmfao
wicked summit
chlorophyll pcb
indigo peak
i made a portable `idevicesetlocation` device using a raspberry pi, 0.96" LCD, ...
clown on my python code later, but if it works, it works (any suggestions or improvements are appreciated)
tepid olive
Does anyone have a jailbroken iOS 16 device? And could you please send me a copy...
this works on macos too
latest beta
on a m1
(cc @tepid olive you might be interested)
tepid olive
new version today fixed
finally
nevermind
fucking hell
high quality driver man
tepid olive
@tepid olive wdym? ioreg causes a crash?
No his poc
What is it
Idk if I'm allowed to say
Where is it
tepid olive
Does anyone have a jailbroken iOS 16 device? And could you please send me a copy...
Am i
tepid olive
Where is it
Private
i can take a look
And tell you if it’s kinda exploitable or not
It probably isn't but we do know it works all the way to latest beta
And it depends on device
Because on iphone 12 and up service isn't loaded
tepid olive
Its a oob in ApplePMP
ApplePMP?
Yes
Well that’s worth a lot of money
Good job burning it
Bro
What
He said that's fine idk
It’s literally worth a bunch of money
stiff dragon
No I think, only oob read
tepid olive
But since you’ve shared it it’s worthless
stiff dragon
👌
stiff dragon
wanna send the poc? i’ll take a look
pm?
tepid olive
I just unlocked them
hexed knot
no i think ur just dumb
tacit spade
hasty ruin
TRUE
wicked summit
.
olive peak
Hello, can someone please explain to me what a bundle path is? Im currently rewriting some functions in shadow, so that i only have the stuff i really need. Theres a function which gets the executable path and then a property which uses it called bundlePath, so if i only use it for one app cant i just set the bundlePath?
hasty ruin
Hello, can someone please explain to me what a bundle path is? Im currently rewr...
The current app’s .app folder
The path contains a UUID, so you can’t really hardcode it
olive peak
Okay thanks
wind ravine
getters and setters are L
hasty ruin
getters and setters are L
Didn’t you bootloop your own device 
tepid olive
Mastodon .
mossy raven
I am completely new to debugging iOS tweaks. I've written a tweak that simply NSLogs something when I turn the volume up. I patched the debugserver and attached it to the SpringBoard, then connected and entered "c" to continue the SpringBoard. But when I turn the volume up, nothing is printed on the LLDB screen.
Am I missing something?
hasty ruin
use idevicesyslog
mossy raven
I am trying to make a tweak that uses AVCaptureSession but after capturePhotoWithSettings captureOutput never gets called. I hoped that LLDB would output some more information, like when testing the code in a normal ObjC app. Can I debug this behaviour with idevicesyslog?
mossy raven
Thank you for this detailed answer 😉
ocean raptor
Stop using chatgpt
pearl sail
@ocean raptor don’t check your DMs
ocean raptor
<@897323786691563521> don’t check your DMs
I lied to capt anyways
I never tell him legit information in dms
This mfer thinks I actually have an internal SDK 
Me when I spread misinformation
pearl sail
tepid olive
This mfer thinks I actually have an internal SDK <:TrollFront:790745323743477760...
imagine not having one
pearl sail
Okay
wicked summit
@grave sparrow just download https://www.apple.com/confidential/ios/18/sdk 🤦♂️
hexed bolt
Does Rocketbootstrap work on palera1n rootful 15.7 within apps?
I can't get it to work with my example, which does work on my checkra1n'ed 14.7 devices.
Tweak: https://cdn.discordapp.com/attachments/1028692204778160249/1131705887753515068/rocketbootstrapexample.zip
It boils down to these logs from idevicesyslog:
Jul 21 02:49:49 SpringBoard(rbstestpringboard.dylib)[22982] <Notice>: [RBSTest] Initializing Center
Jul 21 02:50:22 Tips(rocketbootstrapexample.dylib)[23003] <Notice>: [RBSTest] Hi!
Jul 21 02:50:22 Tips(rocketbootstrapexample.dylib)[23003] <Notice>: [RBSTest] Send a message with no dictionary
Jul 21 02:50:22 SpringBoard(rbstestpringboard.dylib)[22982] <Notice>: [RBSTest] handleMessageNamed:myMessageName withUserInfo: (null)
Jul 21 02:50:22 Tips(rocketbootstrapexample.dylib)[23003] <Notice>: [RBSTest] Send a message with a dictionary
Jul 21 02:50:22 SpringBoard(rbstestpringboard.dylib)[22982] <Notice>: [RBSTest] handleMessageNamed:myMessageName withUserInfo: {
object = key;
}
Jul 21 02:50:22 Tips(rocketbootstrapexample.dylib)[23003] <Notice>: [RBSTest] Send a message with no dictionary and receive a reply dictionary
Jul 21 02:50:22 SpringBoard(rbstestpringboard.dylib)[22982] <Notice>: [RBSTest] handleMessageNamed:myMessageName withUserInfo: (null)
Jul 21 02:50:22 Tips(rocketbootstrapexample.dylib)[23003] <Notice>: [RBSTest] Reply: {
key = object;
}
Jul 21 02:50:22 Tips(rocketbootstrapexample.dylib)[23003] <Notice>: [RBSTest] Send a message with a dictionary and receive a reply dictionary
Jul 21 02:50:22 SpringBoard(rbstestpringboard.dylib)[22982] <Notice>: [RBSTest] handleMessageNamed:myMessageName withUserInfo: {
object = key;
}
Jul 21 02:50:22 Tips(rocketbootstrapexample.dylib)[23003] <Notice>: [RBSTest] Reply: {
key = object;
}
On 15.7.7 palera1n rootful device, I do not see any handling messages from Springboard, only the initializing center. And all of the replies are nil.
olive peak
So is it looking for a file?
hexed knot
naive kraken
could it be used for an amfid patch
no, and even it it was possible, amfid is not involved in code signing verification anymore
brave zealot
is there a chance of it turning into any sort of jailbreak
naive kraken
not by itself
brave zealot
I see
indigo peak
https://github.com/felix-pb/kfd/tree/main
@naive kraken inb4 "update trollstore"
olive peak
Im trying to get the rulesets of shadow for the app i injected it into.
minor cliff
Anyone have a list of packages / scripts / config files to quickly bootstrap a decent NewTerm setup?
restive ether
just use starship and call it a day
hexed knot
only rust program ill use
vivid dew
rewrite it in swift
olive peak
Is rulesets a file, or am i misunderstanding something?
vivid dew
how captgpt has fallen
hexed knot
september 2021
vivid dew
he used to generate full essays for small questions
now he doesn't know what a ruleset is 😢
hexed knot
openai sued 💔
primal perch
wow they give orange name to anyone
cloud yacht
I mean I haven't got it
faint stag
they want to know what shadow is looking for
or in this case, patching calls for lol
indigo peak
im looking at the kfd github, and the kernelcache offsets struct provides the strings used to locate the offsets, but when i load the same kernelcache (version + device) into ida, what i think are the offsets are not the same i think the offset for the struct is in the parenthesis
// kernelcache struct:
struct kernelcache_addresses {
u64 kernel_base;
u64 vn_kqfilter; // "Invalid knote filter on a vnode!"
u64 ptov_table; // "%s: illegal PA: 0x%llx; phys base 0x%llx, size 0x%llx"
u64 gVirtBase; // "%s: illegal PA: 0x%llx; phys base 0x%llx, size 0x%llx"
u64 gPhysBase; // "%s: illegal PA: 0x%llx; phys base 0x%llx, size 0x%llx"
u64 gPhysSize; // (gPhysBase + 0x8)
u64 perfmon_devices; // "perfmon: %s: devfs_make_node_clone failed"
u64 perfmon_dev_open; // "perfmon: attempt to open unsupported source: 0x%x"
u64 cdevsw; // "Can't mark ptc as kqueue ok"
u64 vm_pages; // "pmap_startup(): too many pages to support vm_page packing"
u64 vm_page_array_beginning_addr; // "pmap_startup(): too many pages to support vm_page packing"
u64 vm_page_array_ending_addr; // "pmap_startup(): too many pages to support vm_page packing"
u64 vm_first_phys_ppnum; // "pmap_startup(): too many pages to support vm_page packing"
};
and like, idk if im getting the offset wrong, or whatever, but if someone can help
steady nest
you have to go to the xref
indigo peak
yeah, i was going to the xref
- search for string, for example :
Invalid knote filter on a vnode! - jump to xref
- view psuedocode
- put my cursor here:
panic("Invalid knote filter on a vnode! @%s:%d", "vfs_vnops.c", ^right here^2140LL); - look at offset, and its not right
(i looked at the wholepanic()line, and the offset doesnt match up to anywhere in the line
the offset that's on the github repo: 0xfffffff007f3960c just doesnt even exist in the xref's function, the earliest offset in the function is 0xfffffff007f39904
@grave sparrow help me
native orbit
14 pro 16.1 if anyone care idk lol
// From the iOS 16.1 kernelcache for the iPhone 14 Pro.
{
.kernel_base = 0xfffffff007004000,
.vn_kqfilter = 0xfffffff007f101a0,
.ptov_table = 0xfffffff0077ffa18,
.gvirtbase = 0xfffffff007849f38,
.gphysbase = 0xfffffff00784bd50,
.gphyssize = 0xfffffff00784bd58,
.perfmon_devices = 0xfffffff00a34c310,
.perfmon_dev_open = 0xfffffff00a311168,
.cdevsw = 0xfffffff00a311168,
.vm_pages = 0xfffffff0077fc6d8,
.vm_page_array_beginning_addr = 0xfffffff0077fe9d8,
.vm_page_array_ending_addr = 0xfffffff00a34b778,
.vm_first_phys_ppnum = 0xfffffff00a34b780,
},
@primal perch also, you dont need to cope and write it by hand, idc.get_screen_ea() puts it in the console
indigo peak
14 pro 16.1 if anyone care idk lol
```
// From the iOS 16.1 kernelcache for ...
do you know how to fix the issue im having above
native orbit
just open one that already is defined and cross ref it
indigo peak
how much more
to the offset?
that good enough?
yeah
finding the default
it should be 0xfffffff007f3960c
according to the github repo
yeah
// From the iOS 16.4 kernelcache for the iPhone 14 Pro Max.
downloaded: iPhone15,3_16.4_20E247_Restore.ipsw
native orbit
there is only 1 ref to vn_kqfilter btw
hexed knot
mov ah, 0xa
native orbit
@indigo peak string search for ^{ucred=^{ucred_rw}^vQ{posix_cred=IIISS[16I]IIIi}^{label}{au_ses and look up a bit
primal perch
mov bitches, capts_dick
hasty ruin
mov bitches, capts_dick
primal perch
fr
indigo peak
<@396496265430695947> string search for `^{ucred=^{ucred_rw}^vQ{posix_cred=IIISS...
i get 2 results
indigo peak
com.apple.kernel:__cstring:FFFFFFF007080C7E 0000006C C v16@?0^{ucred=^{ucred_rw}^vQ{posix_cred=IIISS[16I]IIIi}^{label}{au_session=^{auditinfo_addr}{au_mask=II}}}8```
indigo peak
check them both
and all the xrefs??
native orbit
yes
native orbit
what device + ver
hexed knot
chatCPT
native orbit
give kcache and ill do rn 
indigo peak
what device + ver
16.4 iP 14 pro max, im trying to figure out how to do it with the offsets given so i can do it with my own later
native orbit
its already done for 16.4
.
// From the iOS 16.4 kernelcache for the iPhone 14 Pro Max.
{
.kernel_base = 0xfffffff007004000,
.vn_kqfilter = 0xfffffff007f3960c,
.ptov_table = 0xfffffff0078e7178,
.gVirtBase = 0xfffffff0079320a8,
.gPhysBase = 0xfffffff007933ed0,
.gPhysSize = 0xfffffff007933ed8,
.perfmon_devices = 0xfffffff00a44f500,
.perfmon_dev_open = 0xfffffff007eecd3c,
.cdevsw = 0xfffffff00a411208,
.vm_pages = 0xfffffff0078e3eb8,
.vm_page_array_beginning_addr = 0xfffffff0078e6128,
.vm_page_array_ending_addr = 0xfffffff00a44e988,
.vm_first_phys_ppnum = 0xfffffff00a44e990,
},
indigo peak
its already done for 16.4
yeah i know its done for 16.4, im trying to learn from it
so i know where to look to find it
so then
i can replicate it
for my own later
native orbit
bet, send the cache
indigo peak
native orbit
dec where
indigo peak
thats iPhone 13 iOS 16.5
native orbit
seems small
mine was like 70mb
indeed is decrypted
@indigo peak so u trying to find for 16.5 iph 13 correct?
hexed knot
capt do u like white girls or asian girls more
hasty ruin
capt do u like white girls or asian girls more
he likes boys
hexed knot
i forgot
notice he just said white and not white girls which shows how he is open to both genders
hexed knot
basically #development
native orbit
devs in dev chat 
hexed knot
DARWIN 20
primal perch
gay
hexed knot
@grave sparrow I need like sum weekly updates on zefram cuz idk where zefram is at rn
halcyon tusk
what is happening
hexed knot
all ui dev sucks
halcyon tusk
(im not a developer just lurking)
hexed knot
but apple ui dev is best
halcyon tusk
hooray
native orbit
@indigo peak vn_kqfilter: 0xFFFFFFF0079230C0
hexed knot
no feds allowed
native orbit
swiftui shit
halcyon tusk
sobbing rn
hexed knot
wtf is the difference between appkit and uikit i thought they were the same except appkit has more stuff bc macos and prefix is NS
native orbit
indigo peak
<@396496265430695947> vn_kqfilter: 0xFFFFFFF0079230C0
yeah i have 0 idea how you got that
hasty ruin
wtf is the difference between appkit and uikit i thought they were the same exce...
appkit is uikit if it was r
hasty ruin
<:banobjc:1100948119157485628>
native orbit
yeah i have 0 idea how you got that
look for string: libmalloc_experiments, and down a bit
hexed knot
thanks i didnt know any of this
indigo peak
look for string: libmalloc_experiments, and down a bit
like did u know that
primal perch
thanks i didnt know any of this
native orbit
<:banswift:1117466779552317470>
invalid opinion
primal perch
hexed knot
swift devs when they slap on another keyword to their code (they dont know what said keyword does)
native orbit
cuz apple
indigo peak
nah cuz idk why my ida doesnt work like it should
like the string should bring me to it right
native orbit
kpp trolling in swift 
hasty ruin
ios 17 takes like 3 seconds to load the stock wallpaper after respringing
i love swiftui 
hexed knot
ios 17 takes like 3 seconds to load the stock wallpaper after respringing
you think thats bad
native orbit
page table patching in swift was hell
hexed knot
after my phone rebooted it took literally like 10 hours for my wallpaper to load
hasty ruin
fuck.
hexed knot
on beta 2
primal perch
fuck swiftui
hexed knot
my phone would reboot and it’d just be black wallpaper
indigo peak
@native orbit is there just smth wrong with ida, like when i search the string, it should just be in the strings xref, right
hexed knot
i go to sleep and wake up and its normal
native orbit
<@1054895265347276840> is there just smth wrong with ida, like when i search the...
it only had 1 xref
hasty ruin
swiftui devs are just ui designers
native orbit
hating on swift with a swift color role 
primal perch
objc runtime is not cheap
indigo peak
it only had 1 xref
like i just dont understand 😭
native orbit
like i just dont understand 😭
show what happens when u show xrefs on the string
primal perch
all data suggests swift is faster
native orbit
100% is
primal perch
i like objc more but let’s not cope on falsehoods
primal perch
yea
native orbit
i use storyboards 
hasty ruin
programmatic uikit 
primal perch
fr
indigo peak
show what happens when u show xrefs on the string
primal perch
idk i dont like the data either
native orbit
this string: "libmalloc_experiments"
primal perch
i need to write a cli app and compare
indigo peak
hasty ruin
idk i dont like the data either
just write regular c in a .m file
easy perf win
primal perch
hexed knot
theres this guy who tested like a shit ton of programming languages by calculating like 10000 prime numbers and a prime sieve objc and swift were both tested
native orbit
hexed knot
idk which is faster
hasty ruin
#jailbreak message bro got fugu17
indigo peak
what do i do with that? jump to the function?
primal perch
how isn’t it
indigo peak
look like:
yeah
primal perch
it tests code generation based on front end input
it’s not comprehensive
but it’s still valid data
native orbit
https://discord.com/channels/349243932447604736/688122301975363591/1132155548574...
u0 dark in 2023
hasty ruin
a private class
indigo peak
@native orbit do i have to find something inside the sub_?
bro idk what im doing
i thought i knew
native orbit
sub_FFFFFFF007F49FE8 = 0xFFFFFFF007F49FE8 = the offset for vn_kqfilter
indigo peak
<@396496265430695947> vn_kqfilter: 0xFFFFFFF0079230C0
then what is this
native orbit
16.4 14pm
indigo peak
o
native orbit
not 16.5 13
indigo peak
yeah
figured that out now
so how do i do the other ones
bc how you had me search for libmalloc_experiments, which isnt on the github repo
you just magically found it
hexed knot
theres this guy who tested like a shit ton of programming languages by calculati...
i lied theres no objc
indigo peak
it just another random thing near it
so should i just ignore the strings they provided on the repo
hexed knot
objective c is an obscure programming language used by a very small group
indigo peak
and look for my own strings
native orbit
i would load another ida window with the 16.4 14pm and label the offsets from the repo and reference those to find them for 16.5
indigo peak
mhm
okay
ty
@native orbit i think i got my first offset:
.gVirtBase = 0xFFFFFFF00793A2D8
no idea
lmfao
native orbit
ye that right
native orbit
yep thats the fun parts
indigo peak
@native orbit
{
.kernel_base = 0xFFFFFFF007004000,
.vn_kqfilter = 0xFFFFFFF007F49FE8,
.ptov_table = 0xFFFFFFF0078EF180,
.gVirtBase = 0xFFFFFFF00793A2D8,
.gPhysBase = 0xFFFFFFF00793C100,
.gPhysSize = 0xFFFFFFF00793C108,
.perfmon_devices = 0x0,
.perfmon_dev_open = 0xFFFFFFF007EFD480,
.cdevsw = 0x0,
.vm_pages = 0xFFFFFFF0078EBEC0,
.vm_page_array_beginning_addr = 0xFFFFFFF0078EE130,
.vm_page_array_ending_addr = 0x0,
.vm_first_phys_ppnum = 0x0,
},
thats what i was able to get
0x0 idk
native orbit
ref gVirtBase and gPhysBase will normally be right under it, and gPhysSize is just gPhysBase+0x8
for cdevsw just jump to _cdevsw
indigo peak
ref gVirtBase and gPhysBase will normally be right under it, and gPhysSize is ju...
i dont see anything where gPhysBase will be near it
ok i got gPhysBase & gPhysSize
is kernel_base the same?
native orbit
yes
indigo peak
alr just missing 4 now
indigo peak
{
.kernel_base = 0xFFFFFFF007004000,
.vn_kqfilter = 0xFFFFFFF007F49FE8,
.ptov_table = 0xFFFFFFF0078EF180,
.gVirtBase = 0xFFFFFFF00793A2D8,
.gPhysBase = 0xFFFFFFF00793C100,
.gPhysSize = 0xFFFFFFF00793C108,
.perfmon_devices = 0xFFFFFFF00A4AF520,
.perfmon_dev_open = 0xFFFFFFF007EFD480,
.cdevsw = 0xFFFFFFF00A471208,
.vm_pages = 0xFFFFFFF0078EBEC0,
.vm_page_array_beginning_addr = 0xFFFFFFF0078EE130,
.vm_page_array_ending_addr = 0xFFFFFFF00A4AE988,
.vm_first_phys_ppnum = 0xFFFFFFF00A4AE990,
},
@native orbit i got that, but it still panics
so at least 1 of these is wrong 😭
i thought i did it right
olive peak
What im trying to do is copy the file hooks from shadow, but it also needs a function which checks the file path to either return null or orig to the hook. Meaning that i need to copy the functions which are responsible for the check. However one of them reads through rulesets which i dont know how to copy, so that they are always the same as i want to make it only for one app and tweak.
cloud yacht
(im not a developer just lurking)
Yeah development is most entertaining channel
lime pivot
only currently you hate it?
indigo peak
```C
{
.kernel_base = 0xFFFFFFF007004000,
.vn_kqfilter = 0xFFFFFFF007F49...
i redid all the addresses and got the exact same ones, still panics
indigo peak
@native orbit so apparently theres an issue with 16.5, me & evelyn were both having issues with 16.5
(no idea what any of this means)
velvet path
<@1054895265347276840> so apparently theres an issue with 16.5, me & evelyn were...
I think they also fixed it after that message though
indigo peak
someone shared it w me
velvet path
i dont have access to the channel
basically reduce the binary size
indigo peak
basically reduce the binary size
by how much
im compiling with theos, went from make clean package PACKAGE_FORMAT=ipa to make clean package PACKAGE_FORMAT=ipa FINALPACKAGE=1 STRIP=1 and the binary went from 777k bytes to 304k b
velvet path
that’s all that was said
(basically the exploit is corrupting it’s own pages, reducing the binary sizes causes it to… not do that)
indigo peak
interesting
hasty ruin
im compiling with theos, went from `make clean package PACKAGE_FORMAT=ipa` to `m...
fyi, finalpackage strips symbols by default
indigo peak
is there any other way to make it smaller
native orbit
compression
indigo peak
i specified archs to only be arm64
got it down to 158k bytes
hm its back to kernel data abort @velvet path
hasty ruin
is there any other way to make it smaller
-Os
native orbit
size AGGRESSIVE
tepid olive
@indigo peak What method are you using
native orbit
still panics for me too 
indigo peak
<@396496265430695947> What method are you using
native orbit
skill issue
prob, what method u using
olive peak
Thats what im trying to do. However i dont know which paths should be hidden. Thats why im copying the functions which do that. But one of them seems to use rulesets to decide that.
native orbit
true
olive peak
Thanks
steady nest
task->proc->go back(+0x10)
sorry bro
i wish i knew this earlier
or
the exploit leaks your own task addr
or any task addr
indigo peak
works for me
how 😭
timid furnace
@radiant idol ever experience an issue where css variables just dont work
timid furnace
safari on desktop:
radiant idol
mk
timid furnace
safari on phone
restive ether
does the ios version definitely support whatever you’re doing
timid furnace
desktop vs mobile
timid furnace
does the ios version definitely support whatever you’re doing
its just standard css variables
its not even my css
radiant idol
yeah should work then
radiant idol
show me the selector of the btuton you're styling
radiant idol
ok does it work if you don't have a var there but instead just a hex val or whatever
timid furnace
yes
hasty ruin
Username checks out
radiant idol
timid furnace
what else do i know uses css variables
motherfucker
it works on another site
wtf
hasty ruin
css moment
timid furnace
ok im going to copy the simplecss into my stylesheet instead of importing
maybe that will do something
timid furnace
same
what the fuck
is ios 15 just broken lmao
what the hell is ::backdrop and why is it breaking ios
radiant idol
iOS 15.2.1
velvet path
I'm not home at the moment, but I do have 15.4 and can say it works there
timid furnace
let's see how long it takes for my phones to turn on
velvet path
I'm guessing anywhere between 0 and 20 years
indigo peak
who has older ios
how old
hexed knot
yeah ios 17
hasty ruin
preferably newer 14/13/etc
not home rn sadly
you're right, discord, i have not read this message
hasty ruin
hasty ruin
wholesome
shrewd smelt
censorship ...
hasty ruin
acoustic imp
anything older than 15.1
I got a SE1 on 13.3.1?
timid furnace
I got a SE1 on 13.3.1?
all good i tested on 13.1.1
it's just apple being apple and taking 6 years to implement a css feature
acoustic imp
Yea saw sm thing about 15.4 being the Verision it was added in (ur ss)
cloud yacht
who has older ios
I do
hasty ruin
@grave sparrow then we must be siblings
wind ravine
how do u hecking
flex wont work inside the app
i just wanna make a tweak 
ok got it
olive peak
If i put ruleset files in the same directors as the file that contains this code, will i need this or can i delete it? https://cdn.discordapp.com/attachments/688122301975363591/1132643088007966740/image0.jpg https://cdn.discordapp.com/attachments/688122301975363591/1132643438999908422/image0.jpg
hasty ruin
Why can’t you just use shadow anyway?
olive peak
I‘ll rewrite the function then
Since im not making it for rootless i dont need the getJBPath function i think.
olive peak
Does this mean that SHADOW_RULESETS folder is only available at runtime?
Ok nope, its always available.
Where does /Library/Shadow get created? I dont find it anywhere
Like in the code
olive peak
What does that mean? Sorry
lime pivot
it's created when it gets installed because the folder exists inside the deb
wanton cedar
if you are making a specific bypass tweak, shadow rulesets won't help you (much) because of:
- whitelisting in standardrules ruleset as a catch-all
- dpkg info compiled into dpkgInstalled ruleset (this is probably the most useful but it doesn't catch everything that apps check for)
you can copy the hooks if you know what functions your targeted app uses, and i would probably just use shadow's debug build to find out what paths the app checks for and hardcode them into a "path checker" method in your tweak to be used by the hooks
indigo peak
@lime pivot besides STRIP=1 what else can i do to make my resulting binary smaller
_ in theos
indigo peak
TARGET = iphone:clang:latest:16.0
INSTALL_TARGET_PROCESS = kfd
PACKAGE_FORMAT=ipa
STRIP=1
include $(THEOS)/makefiles/common.mk
APPLICATION_NAME = kfd
kfd_FILES = ContentView.swift kfdApp.swift
kfd_SWIFTFLAGS = -validate-tbd-against-ir=none
include $(THEOS_MAKE_PATH)/application.mk
thats my makefile
lime pivot
DEBUG=0 to do a release build, or FINALPACKAGE=1 which gives you a few more optimisations
lime pivot
erm well it should be, debug binaries have debug symbols, aren't stripped, and aren't optimised
indigo peak
no im dumb, i had my files ordered by name, not by date modified
so it went to the bottom
the release pacakge
lime pivot
oh makes sense
tepid olive
@indigo peak i don't think making the binary smaller will help
ocean snow
is anyone interested in Medium account sharing?
shrewd smelt
Whar?
primal perch
Whar?
night rover
is anyone interested in Medium account sharing?
shrewd smelt
gentle grove
is anyone interested in Medium account sharing?
primal perch
proof
primal perch
fr
faint stag
is anyone interested in Medium account sharing?
why do you need one tho
brazen timber
is anyone interested in Medium account sharing?
gentle grove
why do you need one tho
scroll up it's literally a copypasta
faint stag
how tf was i supposed to know
shrewd smelt
is anyone interested in Medium account sharing?
gentle grove
is anyone interested in Medium account sharing?
yeah
wheat grotto
rate my gaming setup
primal perch
olive peak
<:worryPeek:704044517300371587>
Thats a good idea thank you very much. I wouldnt have thought of that as a professional ctard…
Tho, i get these 2 errors, which i dont know how to fix.
ld: warning: directory not found for option '-F/Users/pengu1nx/theos/lib/iphone/rootful'
ld: framework not found RootBridge
olive peak
Ok i fixed them
lime pivot
rate my gaming setup
-10000/10 unironically using a magic mouse
lime pivot
Tho, i get these 2 errors, which i dont know how to fix.
ld: warning: director...
update Theos, we fixed the rootful directory warning
olive peak
update Theos, we fixed the rootful directory warning
I need to run update file in bin folder for that right?
olive peak
I already did that, but i just added the folders manually now
But what i do have a problem with is linking to libSandy, do i need to build it first and then add the dylib to the shadow folder?
Or do i run the install to theos sh
hasty ruin
update Theos, we fixed the rootful directory warning
I could kiss you
Though it might hurt my back leaning that far
lime pivot
I could kiss you
please don't
hasty ruin
no promises
minor cliff
Are there any shims, transpilers, support packages, etc for jailbroken 15 devices to install apps or updates that require iOS 16?
whole shadow
How I can help research for PPL bypass?
urban cipher
rate my gaming setup
god I’m suffering from looking at this pic
NOT THE MAGIC MOUSE
whole shadow
I want help for creating new jailbreak
silver rampart
:giveme:
hasty ruin
silver rampart
expected better from you captain inc
naive kraken
How I can help research for PPL bypass?
patchdiff some 16.x subversion PPL routines
visual meadow
this works pretty well
brave zealot
That screenshot is clean
native orbit
this works pretty well
finally got it work for me
visual meadow
finally got it work for me
what did u change
native orbit
nothing
visual meadow
oh
visual meadow
heres the source
ill send the line where it gets it
hang on
there right
?
its pretty stable for me ngl
native orbit
with
uint64_t getProc(u64 kfd, pid_t pid) {
uint64_t proc = ((struct kfd*)kfd)->info.kaddr.kernel_proc;
while (true) {
if(kread32(kfd, proc + 0x60/*PROC_P_PID_OFF*/) == pid) {
return proc;
}
proc = kread64(kfd, proc + 0x8/*PROC_P_LIST_LE_PREV_OFF*/);
}
return 0;
}
I wonder
@grave sparrow you think its possible to kill processes with this?
true
I wonder how tho
like crash or kill doesn't matter
yes
native orbit
native orbit
"lib" moment
visual meadow
is it possible to userspace reboot with kernel rw?
hang on i have idea
idea worked
native orbit
what idea
visual meadow
i just hid the homebar with vnode thing
visual meadow
hang on i wanna see if its permanent until reboot
no its temporary
/System/Library/PrivateFrameworks/MaterialKit.framework/Assets.car
see the file is missing
it comes back eventually
afaik
visual meadow
ok this is a really dumb question
but can you give yourself jit with this?
joever
im gonna see if i can chroot
i already have code that i can base it off of
native orbit
look at the src fr
steady nest
do you want a drawing
colored and everything
an animated video, maybe on youtube
😭
native orbit
maybe a video for each step to
native orbit
inb4 begs for chat logs
hexed knot
use UIKit
wicked summit
#if os(macOS)
/* import AppKit */
fatalError("Use a different operating system.")
#else
import UIKit
#endif
uikit on windows
primal perch
uikit on windows
primal perch
wicked summit
Yulky Tulky
jaidan
hasty ruin
Yulky Tulky
ifunniers crying at the sound of that name
ocean raptor
uikit on windows
fermui
wicked summit
better than doing nothing
Doing nothing is fire though
@rose wren how's your RH internship been? 🔴🎩
rose wren
<@471024890909032489> how's your RH internship been? 🔴🎩
Fine, my mentor dipped so I got a new one but I think the new one lowkey hates me
wicked summit
Your mentor dipped?! 😭
rose wren
yea
for 3 weeks
they extended my pronext I think
They said it was gonna be finished by end of June
They gave me a write up for it last week
rose wren
For the intern expo?
I haven’t been to any of that stuff 😭
My manager keeps on saying for me to go but I never do
wicked summit
Yea the expo smh you should do that I think
rose wren
I demoed for my team and my manager’s manager gave me red hat reward points
I’m tryna demo next week for the standup but I don’t think I’ll have something ready 😔
wicked summit
I haven't received any red hat rewards 😔
Yea I have to figure something out for team demo on Wednesday
rose wren
ItMs free money
rose wren
Yea I have to figure something out for team demo on Wednesday
They told me it’s not necessary
I thought it was like “not necessary” and like they want people to demo but no
I was literally the only person to demo on my team
rose wren
😭
wicked summit
What product do you work under? e.g., I'm under Ansible
rose wren
Observability
OpenShift stuff
Like log collection and storing
I have to setup a cluster every morning on was just to even start working :\
wicked summit
So many mfs in open shift
rose wren
And it takes 34 mins on average
hasty ruin
Doing nothing is fire though
As a professional nothing doer, I can confirm this is true
rose wren
So many mfs in open shift
I’m pretty sure I can’t submit anything for the expo
Anymore
It’s too late
When do you present yours I’ll watch
wicked summit
Slides are due tomorrow at 5
rose wren
Oh
wicked summit
I still have to make mine lmao
rose wren
wicked summit
I'm around 10:15am I think
rose wren
You’re gonna get me yelled at again by my mentor
wicked summit
ET
primal perch
As a professional nothing doer, I can confirm this is true
fr
wicked summit
lmao
primal perch
Version 115.0.5790.102 (Official Build) (64-bit)
rose wren
And I have adhd so my ass don’t be paying attention to the 1 and a half hour 1 on 1 meetings
wicked summit
Yea that's brutal
rose wren
Nah it was only one meeting like that
wicked summit
My mentor's telling me that I've gotta get into startups
rose wren
I miss my old mentor he was so chill
@wicked summit do you have to setup dev environments
For your work
I’m on that rn
I literally worked backwards
Since I switched mentors I did the code work first now I’m learning how to do the dev environments
wicked summit
Well I set up my dev environment for the main code base I work on
fathom snow
yo would it be theoretically possible to hook imessage to get its decrypted packets?
wicked summit
Though I've contributed to 4 repositories so I've had to figure out a bunch of different dev environments 🥴
rose wren
Oh do you not needa work on like clusters
wicked summit
No
fathom snow
me n a pal wanna reverse engineer the protocol
rose wren
😭
wicked summit
That's an open shift moment
rose wren
Did you finish your main project
rose wren
That's an open shift moment
NOTHING IS DOCUMENTED
I HAVE TO GUESS AND CHECK
AND THEN MY MENTOR GOT MAD AT ME FOR THAT
he was like
Stop running commands all Willy nilly without knowing what they do
wicked summit
Nah 💀 I kinda blasted through the first project was given and started picking up a ton of other shit ... but now the first thing isn't completed and it might never be completed bc I'm fully blocked by another developer now
rose wren
I read the command I kinda do know sorta a little@bit 😭
rose wren
Nah 💀 I kinda blasted through the first project was given and started picking u...
My project was split into 2 and then they switched the fucking language into a rust based one that was made like last year I think
So no GitHub copilot :(
rose wren
I learned Go for prototyping
fathom snow
you should do rust lol
rose wren
Then I switched to vector remap language
wicked summit
RH does a lot of golang
rose wren
Which is based on vector
Which is based on Rust
vector’s docs expect you to know how to use the language before you look at the docs
So it was not fun learning how it works!!
rose wren
And there was like
Close to 0
Outside resources
Cuz the language is so niche and new
wicked summit
Yea idk what it is lmao
rose wren
Yeah me neither
wicked summit
Besides I know it's based on rust!
rose wren
And I’ve made a whole ass project on it
wicked summit
💀
fathom snow
ok i have a better question, would the header files be able to tell me if I COULD mess around with how Imessage works?
rose wren
oh my god my favorite part was when I asked like a shit ton of questions about the project cuz it was so ambiguous my mentor was like don’t worry about that now and we switched the language
He kicked it down the road 😭
I can’t tell if I’m moving super slow or they just aren’t being clear enough for me to work with it
I think it’s a combination of both but I defo think I shoulda finished this last month
Anyways can I still sign up for the expo @wicked summit
wicked summit
mm idk you'd have to ask the people running it soon if they have a slot open
But I know the presentations haven't been due yet
Though they're due tomorrrow
wicked summit
I think it’s a combination of both but I defo think I shoulda finished this last...
Yea for me I wish I had fully completed the first project I was assigned, but my mentor encouraged me to pick up a lot of other different issues which have helped me learn a lot more on the whole
Also brutal that I probably could finish if I weren't currently blocked but 🤷♂️
wheat grotto
How does one install xcode on an external ssd ?
I dont want that shi to take up 80% of my free space
grim sparrow
How does one install xcode on an external ssd ?
Symlinks.
wheat grotto
is there a guide
forest dock
Does anyone know what entitlements you need to use the UIKit UIDevice class if any?
Don't have access to XCode atm and can't see it in the docs
radiant idol
Don’t think you need any
forest dock
Cool thx
hexed knot
i think im ret’ed bc i never remember the syntax for symlink and it takes me like 5 minutes to understand the manpage
lime pivot
ln -s /path/to/source /path/to/destination
also destination is relative to the source
gaunt helm
*also destination is relative to the source*
isn't that -r
lime pivot
no
unkempt raft
requested building with img4tool, but library could not be found
(tihmstar jumpscare)
does anybody know how to install img4ltool lib?
olive peak
Do i need to cast obj to an object of NSString or NSUrl for this to compile? If that even is possible. The compiler gives me an error saying „No knows class method for selector isPathRestricted:options“
lime pivot
Do i need to cast obj to an object of NSString or NSUrl for this to compile? If ...
it shouldn’t matter in this case, are you sure self is correctly defined as the class you’re looking for?
olive peak
it shouldn’t matter in this case, are you sure self is correctly defined as the ...
Im not sure about that, how can i know when self is the correct self? The functions are in the same class i think.
ocean raptor
Do i need to cast obj to an object of NSString or NSUrl for this to compile? If ...
Are you trying to act on self or on obj?
olive peak
Are you trying to act on self or on obj?
Im trying to call a function from the same class, using obj as an argument
brazen dock
tihmstar challenge complete
I got the offsets with this tool but still getting kernel panic lol
unkempt raft
I got the offsets with this tool but still getting kernel panic lol
it doesnt get all offsets correctly
brazen dock
it doesnt get all offsets correctly
Do you know which ones are incorrect?
brazen dock
native orbit
use ida 
unkempt raft
just use ida
are symbols included in the cache?
tepid olive
no
unkempt raft
like how hard is it
tepid olive
that still doesn’t have symbols
kernel symbols are found with lumina
lumina is only in paid ida
binja doesn’t have it
offsets don’t help much anyways
faint timber
Why does no one else have the offset mindset
tepid olive
Wym
faint timber
the obvious logic to find offsets
faint timber
I have offsets xyz for device/firmware/kernel abc, its easy to port it to my kernel I just follow the surrounding patterns and match those same patterns in my kernel
I started with this mindset in 2016 when I had zero experience. Its not hard, I guess not everyone has an engineer brain.
this the basic fundamentals of reverse engineering, by me telling everyone this instead of figuring it out on you own means u were just spoonfead
I'm only trying to help, this is your wakeup call
unkempt raft
I have offsets xyz for device/firmware/kernel abc, its easy to port it to my ker...
good idea
faint timber
the secret to myself is no secret, its commonsense
faint timber
compiling tihmstar's code is another
not being able to compile tihmstart stuff means you didn't read the autoconf manual file
unkempt raft
not being able to compile tihmstart stuff means you didn't read the autoconf man...
i already compiled it
steady nest
kernel symbols are found with lumina
what if those symbols you got from lumina are wrong
unkempt raft
but it still wont really work correclty
faint timber
what if those symbols you got from lumina are wrong
I guarentee they are
steady nest
or how you don't know how to go from semaphore to kernproc
i look at src at a func where the offset is used and then i look for it on the re
and the offset is simply plastered there
faint timber
alt b and alt i are your best friends in ida
faint timber
I wish ida had r2 pattern matching
tepid olive
I guarentee they are
they aren’t
tepid olive
or how you don't know how to go from semaphore to kernproc
this seems to be broken on 16.6b1
faint timber
correction they were when lumina first came out I haven't used it since
I'm busy with everything t8110 rn
steady nest
not the "default" offsets but maybe some change in some struct
tepid olive
not the "default" offsets but maybe some change in some struct
i think the issue is the proc size changed
it changes a lot
and it’s crucial
yeah that’s it
it’s 0x730 now
steady nest
i see
shrewd smelt
gorn
hexed knot
SCD_Struct_UI162
unkempt raft
yeah i think i’ll use tihmstar’s thing
@grave sparrow I told you there was another way
indigo peak
┌──(fiore㉿linux)-[~/libpatchfinder]
└─$ offsetexporter
offsetexporter: error while loading shared libraries: libpatchfinder.so.0: cannot open shared object file: No such file or directory
😭
what is wrong with this
./autogen.sh --without-img3tool --with-offsetexporter
hexed knot
whenever i click on the pslinkcell in my prefs using alderis i just get sent to a blank page
<dict>
<key>cell</key>
<string>PSLinkCell</string>
<key>cellClass</key>
<string>HBColorPickerTableCell</string>
<key>defaults</key>
<string>com.luf.joeprefs</string>
<key>default</key>
<string>#33b5e5</string>
<key>label</key>
<string>Tint Color</string>
<key>showAlphaSlider</key>
<true/>
<key>key</key>
<string>Color</string>
<key>PostNotification</key>
<string>com.luf.joeprefs/ReloadPrefs</string>
</dict>
i looked at other stuff using alderis and im pretty sure its the same
indigo peak
`./autogen.sh --without-img3tool --with-offsetexporter`
┌──(fiore㉿linux)-[~]
└─$ offsetexporter
offsetexporter: liboffsetfinder64 version: 0.143-ab2d635e1cd0c51ae6e7ff1d2bfa2b6af9bdeee7-RELEASE
Usage: offsetexporter [SHORTOPTS]
hooray
hexed knot
whenever i click on the pslinkcell in my prefs using alderis i just get sent to ...
@lime pivot pls help 
lime pivot
<@239564780271173642> pls help <:frHD:1123162054157672448>
need to do ThingPrefs_LIBRARIES = colorpicker
hexed knot
need to do `ThingPrefs_LIBRARIES = colorpicker`
yeah i have that
torn oriole
Real
lime pivot
yeah i have that
might need to clean and rebuild if it didn't relink
hexed knot
oo that fixed it
thank you
yea sometimes i need to remember to do make clean every now and then
native orbit
I still gotta figure out offsets for kfd <:trolsmile:723229451709579306>
oops
native orbit
can just use trolly offset finder fr
bleak wagon
https://github.com/tihmstar/libpatchfinder/tree/master/example/offsetexporter
Kernel.dec is needed so you need img4tool which isn’t on amd64 arch yet, unless anyone knows a work around to obtain a kernel.dec from the cache
Also when I tested my offsets I got a kernel crash and they were generated with libpatchfinder but afaik they still might be correct given that it ran for like 9 seconds and the debugger was showing errors but not in the command line output
Could try playing around with different page settings later as well
steady nest
Kernel.dec is needed so you need img4tool which isn’t on amd64 arch yet, unless ...
? how’s it not on amd64
do you know what amd64 is
or did you mean arm64
bleak wagon
Ya sorry
steady nest
(spoiler, img4tool works on both)
bleak wagon
Wait
steady nest
img4lib is usually my go to
bleak wagon
How do I compile I’m getting architecture errors
When I try to run make
Do I need different config arguments
steady nest
there you just img4 -i file -o out
steady nest
Gives me architecture errors
skill issue
bleak wagon
Thanks for help but would it have functioned if I tried a configure argument to target arm64 as the platform for future reference?
steady nest
Thanks for help but would it have functioned if I tried a configure argument to ...
it should just work
you don’t need to specify arch
just ./autogen.sh and make
if it doesn’t work you don’t have the dependencies
or you didn’t clone something
bleak wagon
Maybe OpenSSL?
steady nest
it can simply be too much stuff
steady nest
Maybe OpenSSL?
yes, that’s always a problem
bleak wagon
I’m looked at the flask I had built libplist and tihmstar general
steady nest
because somehow, it’s never linked properly