development

[bleak wagon]

I’ll test the dudes flask tomorrow thanks so much though!

[indigo peak]

@lime pivot i updated theos and then swift stopped working

fiore@DESKTOP:~/kfd$ make clean package
==> Cleaning…
> Making all for application kfd…
==> Building Swift support tools…
sh: 1: swift: not found
Failed to build swift-support: command failed: SPM_THEOS_BUILD=1 swift build -c release --package-path /home/fiore/theos/vendor/swift-support --build-path /home/fiore/theos/vendor/swift-support/.theos_build
make[2]: *** [/home/fiore/theos/makefiles/instance/rules.mk:204: internal-kfd-swift-support] Error 2
make[1]: *** [/home/fiore/theos/makefiles/instance/rules.mk:62: before-kfd-all] Error 2
make: *** [/home/fiore/theos/makefiles/master/rules.mk:152: kfd.all.application.variables] Error 2

[native orbit]

why you building it with theos

[visual meadow]

@native orbit hello good sir

would you mind adding me to the taurine148 repo

i am getting a 14.4 ipad pro 11inch

a12x

[native orbit]

i dont know if i can?

[visual meadow]

and yes

i know it doesn't work on 14.4

[native orbit]

it does

[visual meadow]

oh

?

i thought it was broken

on 14.4

mineek told me that

[native orbit]

i think it fine iirc

[visual meadow]

plelase add me to said repo

or

[native orbit]

that was a10 so

[visual meadow]

give permission for mineek to allow said thing

will you guys let me into repo

[native orbit]

ill ask mineek, i dont think i have repo admin perms

[visual meadow]

ok

[native orbit]

msg has been sent

[indigo peak]

i dont have a mac

ok now i have ```
/home/fiore/theos/toolchain/linux/iphone/usr/bin/swift-build: error while loading shared libraries: libFoundation.so: cannot open shared object file: No such file or directory
Failed to build swift-support: command failed: SPM_THEOS_BUILD=1 swift build -c release --package-path /home/fiore/theos/vendor/swift-support --build-path /home/fiore/theos/vendor/swift-support/.theos_build
make[2]: *** [/home/fiore/theos/makefiles/instance/rules.mk:204: internal-kfd-swift-support] Error 2
make[1]: *** [/home/fiore/theos/makefiles/instance/rules.mk:62: before-kfd-all] Error 2
make: *** [/home/fiore/theos/makefiles/master/rules.mk:152: kfd.all.application.variables] Error 2

nvm back to the first error

[native orbit]

ah makes sense

[indigo peak]

i have a hackintosh but its big sur

and kfd xcodeproj isnt made for that low of a version

[nimble parcel]

are you using my toolchain?

[bleak wagon]

how do you calculate the vnode offsets?

i'm looking into the kernelcache in hopper and i am still unsure i found a few lines that mention an analogous comment description to the variable name in the vnodebypass for kfd

[primal perch]

nexus jumpscare

[olive peak]

A class method can call an instance method right? Just that self doesnt work in it, or does self work?

[primal perch]

you can call it on an instance but self wont be an instance of the class

@implementation AmongUs
-(void)lorn {
  NSLog(@"lorn");
}
+(void)gorn{
  AmongUs *a = [AmongUs new];
  [a lorn];
}
@end

[indigo peak]

yes

[ocean raptor]

@grave sparrow give me money

[olive peak]

Where can i get the .tbd files of libsubstrate and cydiasubstrate built for iphoneos?

Theos tells me, that my current ones are both built for simulator ios.

[hasty ruin]

you can ignore that warning

[untold vine]

hey um i just found a kernal offset for ios 16.2 iphone 14 pro if anyone needs it. https://github.com/34306/kfd_offsets/issues/1

[cinder island]

development

[hasty ruin]

go away pink name

orange-only here

[pearl sail]

Silence child

[hasty ruin]

• dogs

[main apex]

Jazzy is r/jb queen so she is allowed to be anywhere.

[hexed knot]

is there a way i can check if a color is set using alderis in prefs

i've been checking if the alpha is 0 its not set but now i need alpha so i cant do that

so im wondering if theres a way i should be doing it

[brazen dock]

i compared the offsets found by tihmstar's tool with the ones published in kfd's github on iphone 14 pro max and ios 16.5

[olive peak]

Shadow redefines MSHookFunction to use Hookkit like this. And theres also this file hooking a lot of things using it. Is it possible to do that using only MSHook?

[ocean raptor]

No

[olive peak]

Thats what happened after i updated theos

[native orbit]

theos will be updated after you update theos nvm thought u said what happens if i update theos

[olive peak]

Could you please tell me how? The hooks, hook symbols right?

[ocean raptor]

Now give me money

[olive peak]

Yes

[primal perch]

seek employment

[olive peak]

😧

[primal perch]

Qualcomm Shepdragon 8 Gen 2

[olive peak]

I think i just overthought it, ..again.

Actually, theres an issue. One of these hooks makes the app crash, but the NSLog after the hooks still gets called, even after the app already closed. Im not sure if its the replacement function or the call itself.

[mossy raven]

Is it possible to decrypt an iPA without executing it? Bfdecrypt trys to execute the App and it’s fail because of the jailbreak detection :/ Can I start the app using debugserver and the dump somehow the iPA?

[hexed knot]

i personally would not use captappdecrypt

[primal perch]

fr

capptdecrypt

[native orbit]

defo malware

[primal perch]

memes aside it works well but actually commending capt's work isnt allowed so

it sucks

hgis

[cinder island]

:3

[visual meadow]

@tepid olive https://twitter.com/xsf1re/status/1684269309361782784?s=46&t=LUSNSGJyUZ15gupblBCd_Q

XsF1re (@XsF1re)

Escaped sandbox.

Twitter · Jul 26, 2023, 6:27 PM

[mossy raven]

Thank you so much :)))
Is there a Rootless build for flexdecrypt? :))

[granite frigate]

Just realised i know nothing NADA about reading disassembly

Literally opened up the decompiled kernelcache and was lost instantly

Are there any video or text guides on how to use disassemblers properly, or is it a learn as you go thing

[hexed knot]

I’d say learn as you go

[granite frigate]

did you ever figure this out btw

[visual meadow]

Figure one out I'm on my watch so reply to this message figure one out

No i didn't

[granite frigate]

then the chroot thing?

[visual meadow]

I want to smash this watch with a brick

[visual meadow]

No

[granite frigate]

ahh ok

i’m too stupid to figure stuff out but slowly i guess

[indigo peak]

i did a fresh install of theos, and when it asks if i want to use the swift toolchain, i type y and then it installs

> Making all for application kfd…
==> Building Swift support tools…
sh: 1: swift: not found
Failed to build swift-support: command failed: SPM_THEOS_BUILD=1 swift build -c release --package-path /home/fiore/theos/vendor/swift-support --build-path /home/fiore/theos/vendor/swift-support/.theos_build
make[2]: *** [/home/fiore/theos/makefiles/instance/rules.mk:204: internal-kfd-swift-support] Error 2
make[1]: *** [/home/fiore/theos/makefiles/instance/rules.mk:62: before-kfd-all] Error 2
make: *** [/home/fiore/theos/makefiles/master/rules.mk:152: kfd.all.application.variables] Error 2

[nimble parcel]

ah that’s the wrong toolchain then

[indigo peak]

how should i install your toolchain then

[nimble parcel]

https://github.com/kabiroberai/swift-toolchain-linux/releases/tag/v2.3.0

[indigo peak]

what do i need to run to install it

i think ik what to do

but idk if im doing it right lmfao

[nimble parcel]

extract it, remove your old toolchain from $THEOS/toolchains, replace it with this one

[indigo peak]

do i need to ln anything

bc the theos install script has ln -s $THEOS/toolchain/linux/iphone $THEOS/toolchain/swift

[nimble parcel]

nope no need

[indigo peak]

I’m not home anymore, but when I ran make it was hanging

[nimble parcel]

it might take a bit to build

[indigo peak]

ah

makes sense

I got no output so I thought it was just hanging

[lime pivot]

kentucky fried dobs

[primal perch]

kentucky fried dildoes

[primal perch]

https://media.discordapp.net/attachments/1067998815401025550/1133879691326005420/Zefram_Machine.png?width=1252&height=918

[winged saffron]

What

[hasty ruin]

hope this helps

[winged saffron]

Oh

[visual meadow]

@cedar stag could u send a friend req to this acc now?

if u havent seen my other one got disabled

[cedar stag]

Send a friend request to you or md? I’m confused

[visual meadow]

to me, this account

i was just showing u were friends with me and i had a question too

[tough frigate]

@grave sparrow

[indigo peak]

its been 25 min

is that normal

[nimble parcel]

that might be a bit much

where’s it stuck?

also try make clean all messages=yes

[nimble parcel]

what gets logged if you ctrl+c

[indigo peak]

^Cmake: *** [/home/fiore/theos/makefiles/master/rules.mk:152: kfd.all.application.variables] Interrupt

[nimble parcel]

can you ls $THEOS/toolchain

[indigo peak]

linux```

[nimble parcel]

and what about theos/toolchain/linux?

[indigo peak]

fiore@DESKTOP-TU08N9T:~/kfd$ ls $THEOS/toolchain/linux/
host  iphone

i can tree if you want

[nimble parcel]

no need your toolchain install looks fine

is there any Swift code involved here?

[indigo peak]

yeah

its a swiftui application

that worked fine BEFORE i updated theos

[nimble parcel]

did you update your submodules?

[indigo peak]

im trying on a fresh theos install now

like i renamed theos to theos.bak

and then i redownloaded theos

[nimble parcel]

try rm -rf .theos

in your project dir

[indigo peak]

ok and rebuild?

[nimble parcel]

yeah

[indigo peak]

no output this time

[main apex]

@nimble parcel Would theos work via macos github actions for compiling a tweak?

[nimble parcel]

it should

[nimble parcel]

okay try THEOS_NO_SWIFT_CACHE=1 make clean all messages=yes

[nimble parcel]

what’s your distro and version?

[indigo peak]

wsl ubuntu 20.2

hang on

im getting the full vs

[nimble parcel]

I wonder if it’s a wsl issue

[nimble parcel]

wdym

[indigo peak]

Distributor ID: Ubuntu
Description: Ubuntu 20.04.5 LTS
Release: 20.04
Codename: focal

[nimble parcel]

ah

[indigo peak]

20.04

i thought it was 20.2# myb

[nimble parcel]

okay I’m gonna try to repro

gimme a bit but for now you can downgrade your theos

[indigo peak]

how do i downgrade theos

[nimble parcel]

git checkout

and git submodule update

[indigo peak]

to what branch/version

[hasty ruin]

Whatever you were on before

[indigo peak]

idk what it was before

[nimble parcel]

try 9941262

that’s the commit

[indigo peak]

warning: unable to rmdir 'vendor/orion': Directory not empty
warning: unable to rmdir 'vendor/swift-support': Directory not empty

ignore?

[nimble parcel]

yeah that’s okay

[indigo peak]

alr it works now

[nimble parcel]

you can remove them if you want

[indigo peak]

only errors are in my code

[nimble parcel]

any chance you could dm me your project?

[indigo peak]

yeah sure

@nimble parcel now its hanging on make[3]: *** Waiting for unfinished jobs.... and slowing my whole pc down

[nimble parcel]

after downgrading?

[indigo peak]

yeah

💀

thats when i killed it

[nimble parcel]

try downgrading your toolchain too

[indigo peak]

what version

[nimble parcel]

use CRKatri's

[hasty ruin]

swift malware

need theos 2

removes all swift support

[indigo peak]

ok i did that and it fixed my code's errors too 😭

what

[ocean raptor]

[nimble parcel]

@indigo peak I just tried on a fresh Ubuntu install and it worked lol

try updating your SDK

to 16.4

[indigo peak]

💀

[nimble parcel]

also kfd_CFLAGS = -Wno-error should fix your build issues

different toolchain versions have different warnings

and Theos uses -Werror by default for some inexplicable reason

[indigo peak]

#if __OBJC__
    #include <Foundation/Foundation.h>
#endif

im not crazy

thats something i can do right

[nimble parcel]

#import

[indigo peak]

    NSString *str = [NSString stringWithFormat:@"[kfd] %s", format];```

[nimble parcel]

are you using it in a C file though

[indigo peak]

oh yeha

its being included in c file

im just tryna be able to see printf in syslog

since i dont have a mac

[nimble parcel]

os_log might work in C

[indigo peak]

int printf(const char * __restrict format, ...) {
    va_list args;
    va_start(args, format);
    NSString *str = [NSString stringWithFormat:@"[kfd] %s", format];
    NSLogv(str, args);
    va_end(args);
    return 0;
}

[nimble parcel]

or just rename the file to .m

[indigo peak]

#if __OBJC__
#import <Foundation/Foundation.h>
int printf(const char * __restrict format, ...) {
    va_list args;
    va_start(args, format);
    NSString *str = [NSString stringWithFormat:@"[kfd] %s", format];
    NSLogv(str, args);
    va_end(args);
    return 0;
}
#else
#include <os/log.h>
int printf(const char * __restrict format, ...) {
    os_log(OS_LOG_DEFAULT, "[kfd] %s", format);
    return 0;
}
#endif

hooray

windows defender doesnt like the code 💀

[nimble parcel]

@indigo peak I cannot for the life of me repro your issue

[indigo peak]

😭

[nimble parcel]

tried both 20.04 and 22.04 using Docker Desktop on my Mac

[indigo peak]

could be WSL

[native dune]

i dont see how WSL could cause issues but its possible

[nimble parcel]

actually @indigo peak do you mind retrying with the newer Theos, and this time running make clean all --debug messages=yes?

I think I know what's wrong

a little incentive: on the latest commit you can run make commands to get intelligent autocomplete

[indigo peak]

do i need to change my toolchain too

[nimble parcel]

yeah update to mine

[indigo peak]

ugh cant make this easy for me 😭

lmao

[ocean raptor]

@grave sparrow wanna help me work on machosign?

[visual meadow]

@tepid olive I know why macos 14b4 tccd crashes

theres a new database named REG.db

and tccd breaks it somehow

i got one from someone who actually boots fine with it

and replaced mine

and now my macbook works fine

[coral gazelle]

I used iBoot64Patcher to modify iBSS to change the pointer of the "go" command handler to 0x800000000, which is the value of the loadaddr environment variable and, from what I can tell, where files uploaded over USB reside. But if I boot into this iBSS, upload an unencrypted iBSS or iBEC without an IMG4 container, and execute the go command, it just reboots the device. Why doesn't it boot the uploaded iBSS?

[vivid dew]

.

[mossy raven]

Your script worked Perfectly thank you so much :)))

[primal perch]

captware working

[faint timber]

Imo this is the wrong approach it’s not much effort to just create an img4

[tepid olive]

how can i install kok3shi9 on ipad mini on 9.3.6 jailbroken with phoenix previously. no pc

[coral gazelle]

I haven’t gotten booting IMG4’s to work with much of anything besides iBEC.

[hexed knot]

this makes no sense whatsoever

why is it different on the lock screen than it is on the homescreen

[wheat grotto]

oh wait, that’s legacy

#969343289641828382

[hasty ruin]

general doesn't exist
we are not in off-topic

[wheat grotto]

🤓

[primal perch]

[restive ether]

@shrewd smelt

[shrewd smelt]

https://cdn.discordapp.com/attachments/1002131370400809010/1067685619066740807/F96603AB-2F1E-4AE0-9E5F-3E49157EECDC.gif

[primal perch]

feel that

thats treu

[lime pivot]

this reminds me, for some reason the UK still uses the old subway branding

@grim sparrow why is your country so weird

[faint timber]

yah even with the correct patches, there is a wrong way and a right way

it depends on device though

[manic marten]

So if all we need to worry about now is ppl, that leaves a few possible ways to attack it. Because it manages kernal code, in theory that would mean it HAS to run before baseband or any kind of radios kick in right? If that's the case, the keys have to be stored on the device to check against. Can we overwrite those?

[vivid dew]

whar?

[manic marten]

I'm bored and trying to look into ppl feel free to correct me if I made a wrong assessment, there's not a ton of ppl info

[vivid dew]

i don't see how the baseband has any relation to ppl

[manic marten]

It doesn't that's the point. So how does it know if something is signed? That means it has to be stored somewhere on device right?

[vivid dew]

you know what

i suggest asking @grave sparrow directly, he is the most knowledgeable person in this server on ppl-baseband communication

[restive ether]

schizo rant

[manic marten]

Nah those come later once I've smoked a bowl or two

[lime pivot]

@vivid dew happy birthday big man!

[vivid dew]

i wonder who this blocked message could be from

[manic marten]

I wonder if kfd can overwrite memory on ppls stack. Overwrite the memory for ppls check, make it think it's checking code that is actually signed, as opposed to the code it's actually verifying?

[steady nest]

I can't believe @grave sparrow didn't think of that

[restive ether]

well he is a dumbass

[manic marten]

It's ok I'll run through all the bad ideas and get caught up and then I'll be helpful promise 😛

[vivid dew]

@grave sparrow in shambles rn

[faint timber]

It’s a good idea to always test the ideas people say won’t work yourself

[vivid dew]

we could have had a jailbreak years ago with this guys ideas

[manic marten]

I have no idea how to test them lmao I assume I need a Mac and I'm too broke for that

So instead I just shout ideas into the void until one sounds smart enough to mean something

[steady nest]

not an idea if you don't know what you're talking about tbh

[manic marten]

Bad ideas are still ideas. And good ideas start out as bad ideas. And also everyone has to start somewhere so maybe one day I will know what I'm talking about. Until then won't stop me saying ideas about what little I do know

[steady nest]

yeah but they aren't even bad ideas

[vivid dew]

in about 30 minutes you will hop back on league of legends and forget this ever happened

[steady nest]

they aren't anything to start

To start with, you need to know or at least have an idea what PPL or a Kernel is

Else you'll just be spewing bs and will not learn anything

[manic marten]

Ok by starting out I didn't really.mean starting out lol. I'm a programmer, just not for ios. And i know linux which is similar even though I'm well aware it's not the same.

[granite frigate]

was trying to zero out cr_label+0x10 and copied some of pattern_f's code in. looks like i have the wrong offsets here https://github.com/pattern-f/TQ-pre-jailbreak/blob/1a13ceb2b1519ad46be9fe83e50348500442bda6/mylib/k_offsets.c#L39
do I have to look through the kernelcache to find them?

i just panic when trying to

yep rip

[bleak wagon]

funVnodeHide(kfd, "/System/Library/PrivateFrameworks/CoreMaterial.framework/dockDark.materialrecipe");
funVnodeHide(kfd, "/System/Library/PrivateFrameworks/CoreMaterial.framework/dockLight.materialrecipe");

hide dock with kfd

[grim sparrow]

5 day streak? pfft, amateur

[native dune]

my streak is like 210 days

[bleak wagon]

Mein Deutsch ist nicht sehr gut

[timid briar]

ez

[bleak wagon]

Das ist gut!

[bleak wagon]

void gibmebar(uint64_t kfd) {
    funVnodeChown(kfd, "/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist", 501, 501);
    funVnodeChmod(kfd, "/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist", 0107777);
    NSString *filePath = @"/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist";

    // Check if the file exists before proceeding
    if ([[NSFileManager defaultManager] fileExistsAtPath:filePath]) {
        NSMutableDictionary *theDict = [NSMutableDictionary dictionaryWithContentsOfFile:filePath];

        if (theDict) {
            // Replace the key "ArtworkDeviceSubType" with the value 2796
            [theDict setValue:@(2796) forKey:@"ArtworkDeviceSubType"];

            // Save the modified dictionary back to the plist file
            if ([theDict writeToFile:filePath atomically:YES]) {
                printf("Dictionary successfully modified and saved to file.");
            } else {
                printf("Error: Failed to write dictionary to file.");
            }
        } else {
            printf("Error: Failed to read dictionary from file.");
        }
    } else {
        printf("Error: File not found at path:");
    }

    // Reset file permissions and ownership
    funVnodeChown(kfd, "/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist", 0, 0);
    funVnodeChmod(kfd, "/var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist", 0100755);
//    xpc_crasher("com.apple.mobilegestalt.xpc");
    xpc_crasher("com.apple.frontboard.systemappservices");
    xpc_crasher("com.apple.backboard.TouchDeliveryPolicyServer");
}

why does this fail to write

it seems like the perms change properly according to the logs for the file

[i] Patching /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist vnode->v_gid 0 -> 501
[i] /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist UID: 501
[i] /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist GID: 501
[i] Patching /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist vnode->v_mode 100644 -> 107777
[i] /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist mode: 107777
2023-07-28 00:41:25.061222-0400 kfd[610:13188] Error: Failed to write dictionary to file.
2023-07-28 00:41:25.061305-0400 kfd[610:13188] Error details: (null)
[i] Patching /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist vnode->v_uid 501 -> 0
[i] Patching /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist vnode->v_gid 501 -> 0
[i] /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist UID: 0
[i] /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist GID: 0
[i] Patching /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist vnode->v_mode 107777 -> 100755
[i] /var/containers/Shared/SystemGroup/systemgroup.com.apple.mobilegestaltcache/Library/Caches/com.apple.MobileGestalt.plist mode: 100755

^kfd logs

[lean ember]

Ik kfd is the topic right now but can anyone help me understand why Frida-ps -U would kernelpanic iOS 14.2?

[bleak wagon]

edit: I realized the issue

[tepid olive]

did you manage to write to MobileGestalt?

[sturdy herald]

vnode permissions?

[bleak wagon]

No I need a better sandbox escape It’s based on x1fires sandbox escape (in his previous commit he had a function called vnode research which did some mount hax to give us r/w to var but not subdirs.)

I realized I couldn’t write to subdirs after due to the sandbox escape escape method. Apparently he has a new method but that one crashes my device so I am waiting to see if he patches it.

[bleak wagon]

Is it functionally possible to use NSFileManager with the newer x1fire r/w function?

Like i think it's based on your method

of getting MDC emulation

[bleak wagon]

does the mdc emulation have to be in binary

[cedar stag]

I'm kinda lost so I figured I'd ask it here. I want to build a stock, non-jailbroken iOS app that utilizes curl, openssl and libcrypto. So I grabbed the static libraries from procursus, and added them to Xcode to be linked with the mach-o. However, Xcode does not seem to be recognizing the libraries correctly. It gives undefined object errors related to libcurl

also, when I instead use dynamic libraries to link the app, it compiles just fine, but unable to run due to stock iOS refusing to work with dylibs.

[nimble parcel]

stock iOS should work fine with dylibs — you probably have linkage issues

[cedar stag]

oh I thought dylibs were not allowed in stock iOS?

[nimble parcel]

they are

though if you care about App Store safety then bundle them into a .framework

[cedar stag]

here's the crash log

sorry about the png

[nimble parcel]

check your syslog

[primal perch]

nsfilemanager extension

[bleak wagon]

Ya but the x1fire sandbox escape works through pmap to change contents of files

I don’t think you can use nsfilemanager with the binary stream from pmap

[visual meadow]

@naive kraken @tepid olive idea: are jetsam restraints protected by ppl?

[tepid olive]

i don’t think so

[visual meadow]

We could give app unlimited money

Mem*

But I'm more interested in launchd haxx

If it gives unlim ents then jetsam ent would be easy

[lime pivot]

there are further dependencies you need such as libbrotli and I suppose librtmp

it may be better to compile your own copy of libcurl with only the features you need? it'll be a bit heavy in binary size otherwise

[tepid olive]

well you get all the launchd entitlements….

[visual meadow]

Wait what

The entitlements that are on /sbin/launchd ?

[tepid olive]

never mind just stop asking questions

[visual meadow]

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.apfs.get-dev-by-role</key>
    <true/>
    <key>com.apple.private.amfi.can-allow-non-platform</key>
    <true/>
    <key>com.apple.private.iokit.system-nvram-allow</key>
    <true/>
    <key>com.apple.private.kernel.system-override</key>
    <true/>
    <key>com.apple.private.persona-mgmt</key>
    <true/>
    <key>com.apple.private.pmap.load-trust-cache</key>
    <array>
        <string>cryptex1.boot.os</string>
        <string>cryptex1.boot.app</string>
        <string>cryptex1.safari-downlevel</string>
    </array>
    <key>com.apple.private.record_system_event</key>
    <true/>
    <key>com.apple.private.roots-installed-read-write</key>
    <true/>
    <key>com.apple.private.security.disk-device-access</key>
    <true/>
    <key>com.apple.private.security.storage.driverkitd</key>
    <true/>
    <key>com.apple.private.security.storage.launchd</key>
    <true/>
    <key>com.apple.private.security.system-mount-authority</key>
    <true/>
    <key>com.apple.private.set-atm-diagnostic-flag</key>
    <true/>
    <key>com.apple.private.spawn-panic-crash-behavior</key>
    <true/>
    <key>com.apple.private.spawn-subsystem-root</key>
    <true/>
    <key>com.apple.private.vfs.allow-low-space-writes</key>
    <true/>
    <key>com.apple.private.vfs.graftdmg</key>
    <true/>
    <key>com.apple.private.vfs.pivot-root</key>
    <true/>
    <key>com.apple.rootless.restricted-block-devices</key>
    <true/>
    <key>com.apple.rootless.storage.early_boot_mount</key>
    <true/>
    <key>com.apple.rootless.volume.Preboot</key>
    <true/>
    <key>com.apple.security.network.server</key>
    <true/>
</dict>
</plist>```

These?

Oh

[bleak wagon]

@tepid olive do you impersonate launchd services by dumping memory addresses or something

[tepid olive]

no

[vivid dew]

[bleak wagon]

I was reading about an exploit that did this for sandbox

and if you have kernal read and write there is like a part of the memory as far as I am aware that is responsible for ownership right

of the process

i might be incorrect idk isn't ucred uid in memory

actually i'm 100% correct

// looks like it's comparing process ucred with kernel's ucred

processes do have ucred

and i think it is stored in memory

any response? @grave sparrow

so why did you say lmfao what

originally

i thought i might have said something wrong

so i googled it again and i was correct that this is a potential method for sandbox escape

is attacking the ucrid of launchd to impersonate services of launchd an effective means of escaping the sandbox

okay then

thank you!!!

[indigo peak]

@grave sparrow help me

why does kfd return 0x0 as my kernel slide

fr

Jul 28 20:04:40 eyePhone kfd[890] <Notice>: [kfd] fo_kqfilter: 0xddc556f018801fe8

#define t1sz_boot (25ull)
#define ptr_mask ((1ull << (64ull - t1sz_boot)) - 1ull)
#define pac_mask (~ptr_mask)
#define unsign_kaddr(kaddr) ((kaddr) | (pac_mask))

i wonder if it has smth to do with changing t1sz_boot from 17ull to 25ull

its not me

its kfd developer

no idea

also ask why its all in headers

so do i do that instead of u64 vn_kqfilter = unsign_kaddr(fo_kqfilter); ?

u64 vn_kqfilter = (uint64_t)ptrauth_strip((void *)fo_kqfilter, ptrauth_key_function_pointer);

u64 fo_kqfilter = 0;
kread((u64)(kfd), fo_kqfilter_kaddr, &fo_kqfilter, sizeof(fo_kqfilter));
printf("fo_kqfilter: 0x%llx\n", fo_kqfilter);

@grave sparrow https://github.com/felix-pb/kfd/blob/main/kfd/libkfd/perf.h#L187-L218

Lowkey, I think both

More 2 than 1 o guess

[indigo peak]

@grave sparrow I’m just tryna think if there’s 1 static offset that’s wrong for my version/device somewhere in this block

[hasty ruin]

I blame SwiftUI

[indigo peak]

true

[indigo peak]

.-.

alr 1 sec

finishing my Panera

Jul 28 21:08:40 eyePhone kfd[568] <Notice>: [kfd] fo_kqfilter: 0xA5A974F00CB8DFE8```

[primal perch]

introducing CaptGPT
based on replies and comments from captinc in rjb development

[indigo peak]

yeah thats my .vn_kqfilter = 0xFFFFFFF007F49FE8,

in the offsets

what

dmed

[hasty ruin]

[hasty ruin]

doctored imagery

[primal perch]

kernelcache.research.iphone12b

[indigo peak]

yeah now you see my issue

lmao

it calculates 0x0

what

more of a slide than 0x0

[hasty ruin]

i blame capt

(write your question within a header file, else he won't reply)

[indigo peak]

can i just calculate it an old fashioned way

kernel slide

😦

[primal perch]

https://tenor.com/view/mario-mario64-sm64-ttc-tick-tock-clock-gif-26295583

[cloud yacht]

where are prefs stored on rootless jbs?

[radiant idol]

/var/jb/var/mobile/Library/Preferences/... iirc

[cloud yacht]

ok thought so

[radiant idol]

I store mine there at least

idk about others

[cloud yacht]

I'm trying to port a tweak to rootless for someone and I updated the prefs path (well I just used theo's ROOT_PATH_NS on it) but the prefs won't save

[radiant idol]

huh

check if the file is there even

[cloud yacht]

I uhh lost my test device so I only have their device

[indigo peak]

thats what i thought

hm

should i rewrite that section

to not use unsign_kaddr

[cloud yacht]

actually coult it be saving to another path but loading them elsewhere?

[indigo peak]

wha why not

[radiant idol]

It could. If I were you, I would get your tester to check the plist with Filza to make sure that it is there and that it is changing

[indigo peak]

hm

[primal perch]

https://cdn.discordapp.com/attachments/688121419980341282/1128588327377981521/image0.gif

[primal perch]

[cloud yacht]

file doesn't exist in /var/jb/var/mobile/Library/Preferences/

doesn't exist in /var/mobile/Library/Preferences/ either

oh wait it does exist in the second

[radiant idol]

我认为创建文件时可能有问题

smh

the translator plugin

(I use it to communicate with the Chinese users of my tweaks)

[radiant idol]

So it might be something to do with the file creation then

[primal perch]

didnt u make nexus icraze

[cloud yacht]

oh wait it s another pref file from the same dev

[hasty ruin]

yeah, i did

[radiant idol]

malware drm

[primal perch]

fr

https://cdn.discordapp.com/attachments/688122301975363591/1117637975732404294/nexus-jumpscare.gif

[hasty ruin]

that's it bucko, you're going on the list

[radiant idol]

ok

I make my own alternatives to tweaks

https://cdn.discordapp.com/emojis/923095151457497098.webp?size=48&name=gigaChad&quality=lossless

[hasty ruin]

alternate these

[cloud yacht]

ok imma just copy the writing code from my own tweaks

[indigo peak]

@grave sparrow any ideas or are you busy

[primal perch]

@grave sparrow any ideas or are you busy

[hasty ruin]

malicious software

[primal perch]

me

[radiant idol]

photoshop

or xina

either one

[cloud yacht]

ok bruh theos wtf you doing

[radiant idol]

I think your sdk is bad

[cloud yacht]

i swear it worked earlier

[radiant idol]

why are you using a iPhoneOS 10.3 sdk?

use something like iPhoneOS 14.5

[cloud yacht]

it was the closest sdk I had to the one the tweak was originaly built for

[radiant idol]

Oh okay

I think that SDK is for the simulator though

not iOS

[cloud yacht]

oh yeah I had to set the SYSROOT varible to build the tweak idk why

theses so much shit I had to do to get this to build

[radiant idol]

Wait

I tried compiling that tweak a while ago

[cloud yacht]

did you

[radiant idol]

It doesn't completely work on iOS 15 from what I understand

I have a build

but I gave it for someone to test and he said it didn't work completely

[cloud yacht]

hmm thats weird the person I made this for said someone built it for them but it didn;t work

screw this the logic is simple enoguh I'll just rewrite it from scratch

[radiant idol]

I think we're talking about the same person then lol

[hasty ruin]

[primal perch]

https://tenor.com/view/learn-c-and-cpp-programming-learners-academy-programming-c-programming-cpp-gif-24622350

[radiant idol]

jumpscare

[hasty ruin]

sometimes capt pisses me off

[radiant idol]

sometimes iCraze's drm pisses me off

[granite frigate]

I know this sounds like i’m expecting to get spoonfed and i’m being selfish but i can’t figure wtf i’m doing wrong here, even tho it’s prolly a simple mistake

https://cdn.discordapp.com/attachments/1133713501312008192/1134663224114036766/message.txt

I was trying to follow opa’s method using mmap read only, then vm_entry and set prot

this is using kfd and wh1te4ever’s fork

[hasty ruin]

um pal

you broke the chain

how dare you ask for help

[granite frigate]

😭

bro i spent like an hour staring at it

[naive kraken]

you're passing the wrong pointer to task_get_vm_map

you're supposed to pass the task of your own process to that

[granite frigate]

ah

so i'd have to get that ok

[primal perch]

nah ur not being spoon fed

spoon feeding is white names needing help to compile it in xcode

for each step

[granite frigate]

WWWW

i finally got home and got it working

[tepid olive]

offsets?

and version?

[granite frigate]

16.6b1

offsets are just the dopamine ones

not xsf1re's vnoderesearch2

[visual meadow]

@tepid olive https://twitter.com/eveiyneee/status/1685288752321638400?s=61&t=-xLWK6ruY8FP4Dy7az-eGw

évelyne (@eveiyneee)

.@XsF1re can you update grant_full_disk_access.m to use your overwrite file code?

Twitter · Jul 29, 2023, 1:58 PM

[granite frigate]

Bummer

why do you need to overwrite tccd

what does it do? sorry a bit clueless

https://github.com/verygenericname/ish-tccd/blob/master/Exploit/grant_full_disk_access.m#L143 ?

https://github.com/wh1te4ever/kfd/commit/a4d6e5a4b232765aef02e638e3631f853d336c12

[indigo peak]

it can allow for granting sandbox escape to an app

[granite frigate]

Ah

Well he pushed 16 minutes ago

[naive kraken]

what prevents you from finding a code page of e.g. launchd in kernel memory and overwriting it

[indigo peak]

@naive kraken I still haven’t figured out that kernel slide bug, I think it’s bc of the 25ull switch

[naive kraken]

no

also there are like 100 ways of getting the kernel slide

[indigo peak]

mhm

[naive kraken]

you can always just find any pointer in the text region and walk the pages back until you find the kernel base magic value

[granite frigate]

@visual meadow @tepid olive might want to look at this

[indigo peak]

I asked capt if I could do it a “traditional” way which is something like that, but he said it’s not possible

[visual meadow]

Nice

[naive kraken]

it is possible

[indigo peak]

@naive kraken

[naive kraken]

…

yeah

but

what you have is something inside the kernels __TEXT, no?

also it doesn't make sense that the pointer you get is unslid

unslid pointers don't exists

[indigo peak]

capt says it’s not stripping PAC code correctly

[naive kraken]

WHY WOULD NOT STRIPPING PAC CORRECTLY GIVE YOU AN UNSLID POINTER

Pac is this: 0xACFHAGFF261718

[indigo peak]

idk ask capt

[naive kraken]

non pac: 0xFFFFFFF261718

[indigo peak]

.

[naive kraken]

you're just masking the weird shit at the beginning out

Just look at the raw pointer then

[indigo peak]

@naive kraken

#define t1sz_boot (17ull)
#define ptr_mask ((1ull << (64ull - t1sz_boot)) - 1ull)
#define pac_mask (~ptr_mask)
#define unsign_kaddr(kaddr) ((kaddr) | (pac_mask))

unsign_kaddr is supposed to strip pac code right

[naive kraken]

yes

but

just replace this with something that's known working???

you can literally just do a xpaci in userspace

[indigo peak]

@naive kraken

[naive kraken]

just start by logging the signed pointer

[steady nest]

why can’t we just have a main fork

and work on that

we have people with rw and people like fiore that broke the exploit

[indigo peak]

@naive kraken

printf("fd_ofiles_pac: 0x%llx\n", fd_ofiles);
u64 fileproc_kaddr = unsign_kaddr(fd_ofiles) + (kfd->perf.dev.fd * sizeof(u64));
printf("fd_ofiles_stripped: 0x%llx\n", fileproc_kaddr - (kfd->perf.dev.fd * sizeof(u64)));

Jul 29 11:47:58 eyePhone kfd[570] <Notice>: [kfd] fd_ofiles_stripped: 0xffffffdd281ec000
Jul 29 11:47:58 eyePhone kfd[570] <Notice>: [kfd] fo_kqfilter_kaddr: 0xFFFFFFF0232230C0

[indigo peak]

bro idek what i did

i dont think i changed anything 😭

[steady nest]

What phone is that

Didn’t people already succeed

[indigo peak]

iPhone 13 16.5

now i cant get the kernel slide

[steady nest]

^

[indigo peak]

i got it to exploit

i just wont get kslide right

[steady nest]

How the hell is stripped +0x20

[indigo peak]

wait i just edited

look again

[naive kraken]

bro that's not just stripped, you're adding shit

[indigo peak]

i subtracted the added part

[indigo peak]

Jul 29 11:51:05 eyePhone kfd[583] <Notice>: [kfd] fd_ofiles_pac: 0x4edffedd281cc000
Jul 29 11:51:05 eyePhone kfd[583] <Notice>: [kfd] fd_ofiles_stripped: 0xffffffdd281cc000

printf("fd_ofiles_pac: 0x%llx\n", fd_ofiles);
u64 test = unsign_kaddr(fd_ofiles);
printf("fd_ofiles_stripped: 0x%llx\n", test);

there

[naive kraken]

second log has a small x but in the log the letters are uppercase

still

oh

nvm

still wrong

[indigo peak]

what else could i try

[naive kraken]

sending the right logs for instance

[indigo peak]

wdym

are those not the right logs??

[naive kraken]

where is fd_ofiles_pac

not there in the log

[indigo peak]

oh shit

fuck

@naive kraken check edit, my bad

[naive kraken]

hm

I think whatever you're reading there isn't even a kernel pointer

[indigo peak]

https://github.com/felix-pb/kfd/blob/main/kfd/libkfd/perf.h#L186-L224

if you wanted the code for reference

[naive kraken]

0xFFFFFFDD281CC000 is the correct unsigned pointer anyways

so surprised pikachu, pac unsigning isn't your issue

[gaunt helm]

[indigo peak]

[naive kraken]

most likely one of the struct offsets is wrong

[indigo peak]

hmm
one of the dynamic or static

[naive kraken]

no idea

wait

the pointer is right probably

log fo_kqfilter

[indigo peak]

u64 fo_kqfilter_kaddr = unsign_kaddr(fg_ops) + static_offsetof(fileops, fo_kqfilter);
u64 fo_kqfilter = 0;
kread((u64)(kfd), fo_kqfilter_kaddr, &fo_kqfilter, sizeof(fo_kqfilter));
printf("fo_kqfilter_kaddr: 0x%llX\n", fo_kqfilter_kaddr);
printf("fo_kqfilter: 0x%llX\n", fo_kqfilter);

u64 vn_kqfilter = unsign_kaddr(fo_kqfilter);
printf("vn_kqfilter: 0x%llx\n", vn_kqfilter);

would this be fine for logs?

Jul 29 12:12:00 eyePhone kfd[677] <Notice>: [kfd] fo_kqfilter_kaddr: 0xFFFFFFF0232230C0
Jul 29 12:12:00 eyePhone kfd[677] <Notice>: [kfd] fo_kqfilter: 0x41C103F023849FE8
Jul 29 12:12:00 eyePhone kfd[677] <Notice>: [kfd] vn_kqfilter: 0xfffffff023849fe8

[naive kraken]

0xfffffff023849fe8 is your text pointer

and it is slid as expected as well

so I don't get what ur problem is

[indigo peak]

0x1B900000 is that a valid slide

[naive kraken]

yes

[indigo peak]

idk what happened

something fixed it?

something broke?

idk

Jul 29 12:16:42 eyePhone kfd[317] <Notice>: [kfd] kernel_slide: 295796736
Jul 29 12:16:42 eyePhone kfd[317] <Notice>: [kfd] gVirtBase: 18446744005328175104
Jul 29 12:16:42 eyePhone kfd[317] <Notice>: [kfd] gPhysBase: 34395848704
Jul 29 12:16:42 eyePhone kfd[317] <Notice>: [kfd] gPhysSize: 3824271360

ok now everything works

@grave sparrow

idk what the fuck was wrong

or what was right?>

but everythings good now?

i think?

[coral gazelle]

How do I compile pongoterm? I've already downloaded the PongoOS source code.

[granite frigate]

nvm i figured it out

nvm i didn't figure it out

i'm trying to open() files in /var/ and they all return -1, but opening files in /System/ work

does this mean it's only limited to /System/?

[naive kraken]

/var is sandboxed

[granite frigate]

aight

i suppose i can try to make a documents folder within the app where it will read the files inside

[lethal kayak]

kfd

[tepid olive]

@naive kraken MacDirtyCow was able to write to signed executables but this new method can’t :/

Codesigning fails

[visual meadow]

maybe you can check the differences in a hex editor

see if it corrupts anything

[steady nest]

💀?

[visual meadow]

wdym 💀

[vivid dew]

dirty cow isn't real

[primal perch]

dirty cow isn't real

[native orbit]

dirty cow isn't real

[radiant idol]

dirty cow isn't real

[hasty ruin]

capt's mother:

yeah true, fuck swift

[primal perch]

yeah true, fuck swift

fuck swiftUI 10x more tho

[hasty ruin]

facts

[primal perch]

at least swift alone didnt lag the OS

[hasty ruin]

[primal perch]

[radiant idol]

https://cdn.discordapp.com/emojis/1075416583893168202.webp?size=48&name=banswift&quality=lossless

[hasty ruin]

[radiant idol]

https://cdn.discordapp.com/emojis/1075416583893168202.webp?size=48&name=banswift&quality=lossless

[hasty ruin]

[radiant idol]

https://cdn.discordapp.com/emojis/1075416583893168202.webp?size=48&name=banswift&quality=lossless

[hasty ruin]

[radiant idol]

https://cdn.discordapp.com/emojis/1075416583893168202.webp?size=48&name=banswift&quality=lossless

[hasty ruin]

[radiant idol]

https://cdn.discordapp.com/emojis/1075416583893168202.webp?size=48&name=banswift&quality=lossless

[hasty ruin]

[primal perch]

[radiant idol]

https://cdn.discordapp.com/emojis/1075416583893168202.webp?size=48&name=banswift&quality=lossless

[primal perch]

[hasty ruin]

[radiant idol]

https://cdn.discordapp.com/emojis/1075416583893168202.webp?size=48&name=banswift&quality=lossless

[primal perch]

[hasty ruin]

[radiant idol]

https://cdn.discordapp.com/emojis/1075416583893168202.webp?size=48&name=banswift&quality=lossless

[primal perch]

[radiant idol]

https://cdn.discordapp.com/emojis/1075416583893168202.webp?size=48&name=banswift&quality=lossless

[hasty ruin]

[primal perch]

[hasty ruin]

smh why didn't it crop properly

[gentle grove]

most readable code written in c++

[radiant idol]

i...

[native orbit]

[hasty ruin]

[radiant idol]

get out.

you are not welcome here

[native orbit]

[primal perch]

troll

[coral gazelle]

I need pongoterm to decrypt SEP firmware keybags on A10.

[next wadi]

gm

[next wadi]

DAMN

[radiant idol]

do not hate on objective-c.

[flint gyro]

any1 wanna help

[hexed knot]

W nightwind

[native dune]

it has both

[hasty ruin]

good servers only have

sooo

[flint gyro]

i fixed it; it was a non-optional type, but it was a optinal binding.

[cloud yacht]

if anyone was wondering (noone was), I did this and it works

[radiant idol]

oh nice

[naive kraken]

but what would be the difference

[radiant idol]

Do you have a GitHub link to the project? The person I was talking to would also probably like this

[cloud yacht]

gimme a bit and I can make one

[radiant idol]

Alright thank you

[cloud yacht]

https://github.com/WilsontheWolf/CustomLockscreenDuration

[radiant idol]

Thank you!

Also yeah we were talking about the same person haha

[olive peak]

Does anyone have or know how i could make a function which makes a popup with a text as argument and 1 button, that continues the program when clicked.

[vivid dew]

that's easy if you're using appkit

[olive peak]

Ok, i will see.

[olive peak]

I got this, but idk if it pauses my tweak. If not how do i do that?

static void showAlert(const char* title, const char* message) {
static bool hasShownAlert = false;
if (hasShownAlert) {
return;
}

UIAlertController* alert = [UIAlertController alertControllerWithTitle:[NSString stringWithUTF8String:title] message:[NSString stringWithUTF8String:message] preferredStyle:UIAlertControllerStyleAlert];
UIAlertAction* defaultAction = [UIAlertAction actionWithTitle:NSSENCRYPT("OK") style:UIAlertActionStyleDefault handler:nil];
[alert addAction:defaultAction];

UIViewController* rootViewController = [UIApplication sharedApplication].keyWindow.rootViewController; [rootViewController presentViewController:alert animated:YES completion:nil];

hasShownAlert = true;

}

[wheat grotto]

shit

[primal perch]

[tepid olive]

with MDC maybe it never rechecks the code signature because it’s not aware that writes are occuring

[naive kraken]

that shouldn't happen with either of the krw techniques neither tbh

[tepid olive]

true it’s kinda weird

i feel like it may work if you swap it onto another file in /System and then change the v_data pointers

[naive kraken]

wait

try faulting in the memory first

like mmap, fault in, then change to r/w

[tepid olive]

how is that done?

[naive kraken]

by accessing it

you see the virtual memory system tries to be smart and doesn't actually map in the memory until you access it

so the first access of a page will cause a fault, which goes to the kernel, that maps it in and then gracefully returns to userspace again

so you'd want to access each page

[tepid olive]

@naive kraken but when writing to r/w memory that was executable in iOS the VM system checks the page signing all the time

[naive kraken]

how though?

if you do it in direct MMIO the vm layer shouldn't notice

but idk

unless they map the memory as read only and handle the faults when writing

[granite frigate]

does editing this plist to another file location then killing tccd launch whatever is at that file location?

[lime pivot]

I believe no because the system plists are actually hardcoded in a dylib, files on disk aren't actually used. you would need to modify memory in launchd to achieve that

pretty much to protect against this kind of filesystem attack

[primal perch]

https://tenor.com/view/brain-linux-firmware-linux-users-when-proprietary-gif-22937891

[hasty ruin]

fsuntether:

[acoustic imp]

trying to compile heartline for rootless?

make file...

[radiant idol]

You don't have libkitten installed on your theos install

That's why you hav the error

[acoustic imp]

but i do tho

[radiant idol]

not for rootless

[acoustic imp]

like its looking in the rootless spot for the library but sense libk is not rootless. nothing is there?

[radiant idol]

there you go

you understood the error

[acoustic imp]

yaa, but could i just move the rootfull V?

ima try

[radiant idol]

no

they're not the same

they dont have the same architecture

[acoustic imp]

so i need to recomile it to ...arm64 ?

[radiant idol]

you need to compile it for rootless

[acoustic imp]

so add the theos package scheme rootless thing to make file?

and recompile

[radiant idol]

that's a way to do it, yes

[acoustic imp]

alr

[radiant idol]

or you can just do make <args> THEOS_PACKAGE_SCHEME=rootless

[acoustic imp]

ye

[radiant idol]

but in your case it doesnt really matter

[acoustic imp]

@radiant idol did i do sm wrong ?

[radiant idol]

uhh

I think you need to put it in $THEOS/vendor/lib/iphone/rootless @acoustic imp

[acoustic imp]

in the make file?

[radiant idol]

No

the .dylib file

[acoustic imp]

ohhhhhhhhhhh

got it

[radiant idol]

it needs to be in tesla3092/vendor/lib/iphone/rootless

[acoustic imp]

🥲

@shell sphinx did u recompile heartlines for rootless?

[steady nest]

it clearly tells you what the error is

[acoustic imp]

but idk what to do about it caue the library is (i think) in the right place

[steady nest]

I don’t see it

[shell sphinx]

don’t think so, currently updating my mac so i can’t check

[acoustic imp]

im so dumb

[radiant idol]

libKitten's there, now you need to recompile libpddokdo

[acoustic imp]

isnt lappearancecell a cephie thing?

@radiant idol ?

[radiant idol]

Yes it is a cephei thing

[acoustic imp]

but cephie comes w theos, so it shoudl already be there right?

[radiant idol]

I don't know

I don't use Ceph__ei__

[native dune]

cephie

[radiant idol]

get out.

you are not welcome here

[native dune]

CEPHEI IS THE BEST TWEAK I BELIEVE IN HASHBANG PRODUCTIONS SUPREMACY

[radiant idol]

Cephei's fine

"Cephie" isn't

[tepid olive]

Does elib still work? https://github.com/MojoLayersOSS/elib

[native dune]

she alloc on my UIImpactFeedbackGenerator till i [feedback impactOccurred]

[indigo peak]

call me beef the way i be stroganoff

[radiant idol]

which style is your UIImpactFeedbackGenerator

[native dune]

UIImpactFeedbackStyleRigid

[indigo peak]

UIImpactFeedbackStyleHeavy (he takes after his mom)

[native dune]

oh

[radiant idol]

oh same!

[indigo peak]

im tempted to run this

[hexed knot]

it probably wont

actually maybe it will

i was gonna say you probably need dll’s but idk

[granite frigate]

what's this

[timid furnace]

not working

[tepid olive]

💀💀💀💀

wine it is my dude

Can you get malwares by running exe on wine? Could it actually hurt the os or just the windows part that is created by wine?

[granite frigate]

it should just destroy the wineprefix only but don't count on it

unless you run it as root and it tries to delete Z:/

[hexed knot]

fermiui

[bleak wagon]

Wine has symlinked access to home dir

[tepid olive]

Ah

[gentle grove]

ah yes "extracting" an exe

[gentle grove]

I know, but it's just the program making up a fake file structure

since it's not actually an archive format

[pearl sail]

Shut up nerd

[harsh junco]

what

[visual meadow]

@tepid olive this fixes the issue

https://twitter.com/dedbeddedbed/status/1685718821217177600?s=61&t=qCrUiDiZF1cXRSCVP6682Q

Nathan (@dedbeddedbed)

Heres how to fix macos 14b4 bootloop issue

Boot into recovery mode, doesn’t matter if you already updated and are bootlooping or before update
run:
cd /Volumes/Data/Library/Application\ Support/com.apple.TCC
rm REG.db (if it says file not found, ignore and move on)
(1/2)

Twitter · Jul 30, 2023, 6:27 PM

macos 14b4

[torn oriole]

trolley

[tepid olive]

cool

[vivid dew]

@tacit spade happy birthday manus celes

[hasty ruin]

damn you two share a birthday

[primal perch]

@grave sparrow listen to muse right now

[tacit spade]

Thank youuuuu

And you too!!

[radiant idol]

Happy birthday(s)!

[granite frigate]

am i too small brain again? when i'm trying to run getTask from my swift code which doesn't call kopen() i panic, so do I have to do kopen in the swift file that overwrites as well

idk why I assumed calling kopen in 1 swift file means that every swift file can do the same thing /shrug

[bleak wagon]

Size of over_write data ?

[granite frigate]

what

it's just copying unalignedcopyswitchrace

[bleak wagon]

In memcpy

[granite frigate]

ok i figured it out i'm actually braindead

the swift checks if return code is 1

i was returning 0 in my overwrite code.

[bleak wagon]

Did it work

[granite frigate]

well the console says it works, but my phone says otherwise

no fonts show up

[acoustic imp]

@radiant idol can I ask for a little tweak ? Basically all I need is to increase the time for like the siri activation by the power button. like add 0.5s or 1s to what the one is ? Or could you make like a plst file with a value (the time)so I could edit-the timing. Like it checks the value when spring board loads and sets it every respring.

[radiant idol]

No clue on how to do that

[granite frigate]

Does anyone know why my overwrite isn't working? Well it does work, but the font doesn't change afterwards and i'm a bit at a loss of what I should do

I SAW THE FONT SHOW UP THEN REVERT

[olive peak]

Where can i learn about sideload/jailbreak detections? And how you find and bypass them.

[restive ether]

the liberal store

[primal perch]

liberal

[native orbit]

libstore.a

[wicked summit]

#include <jailbreak/bypass.h>

int main() {
  int n_applications;
  struct application *applications = get_device_applications(APPLICATIONS_ALL, &n_applications);

  for (int i = 0; i < n_applications; ++i) {
    load_bypass(applications[i]);
  }

  launch_bypass_worker();

  return 0;
}

just use Apple's jailbreak headers

[coral gazelle]

Is it possible to dual boot iPadOS 17 with iPadOS 14 as the main OS by tethered booting with an iPadOS 17 restore SEP?

I've been trying to do that on an iPad 6th gen but I can't get it to boot the kernel cache.

[primal perch]

fr

[vivid dew]

trolled

[nocturne bobcat]

is there a way to use wine on ios/build crossover

port toolkit made me think

cause moltenvk exists

i can imagine dxvk <-> mvk <-> crossover/port toolkit would be faster than running a d3d 9 game on utm

[tepid olive]

you need an x64 emulator for wine

[nocturne bobcat]

wym

[unkempt raft]

iphone is arm64

[nocturne bobcat]

ya

oh ur saying because its still x64 instructions

[tepid olive]

can you get rosetta working on ios

[primal perch]

[tepid olive]

No, you don’t have TSO

[visual meadow]

can you stick dyld shared cache in a ramdisk

and will it load it

if iboot even accepts that big of a ramdisk

[vivid dew]

wtf

yuno gasai pfp in 2023

[primal perch]

can you boot macos 14 beta on iphone 4

[hexed knot]

yuno gasai gun

ak47

[visual meadow]

iOS

0

xnu-0\

111

2

[bleak wagon]

int gibmebarplist(NSString *path) {
    NSInteger type = 2556;
    NSDictionary *dictionary = @{
        @"ArtworkDeviceSubType": @(type)
    };
    
    BOOL success = [dictionary writeToFile:path atomically:YES];
    if (!success) {
        printf("[-] Failed createPlistAtPath.\n");
        return -1;
    }
    
    return 0;
}```

the .txt one is the vnode finder function this is the plist function

it gets ret0 on symlink

but fails to show dynamic island am i doing something wrong

based on (working for me,) ResSet16

[bleak wagon]

@tepid olive thanks for offsets btw

[tepid olive]

welcome

[bleak wagon]

@tepid olive I’m trying to get dynamic island working, do you know if my code is correct?

[exotic saffron]

Hello i never come in here ... but i was wondering if someone could compile an open source theos project for me

[granite frigate]

does anyone have a unified dynamic_info.h for every iOS and device

[olive peak]

How does an app usually detect files in its .app that usually arent there (for example injected dylibs) ?

[primal perch]

check loaded dyld images at runtime

[olive peak]

But i think in my case it detects the files rather than running libraries.

[torn oriole]

Probably just probes for directories, which it normally wouldn't be able to access. But if thanks to a jailbreak it can then it triggers

[granite frigate]

snapchat or pogo (i forgot) have a super long list of directories that they try accessing when starting

[tepid olive]

can’t get it working either

[tepid olive]

working on another technique

[tepid olive]

well the write fails

i’m gonna have to do something different i guess

[tepid olive]

ok write works but it doesn’t do anything either

this is all correct though

Just saw your tweet

[wind ravine]

copy to a temp directory in the app, use propertylistserialization to change the property value, then override the original file with that data

[tepid olive]

right, right but the plist has a bigger size even though i changed a single int

[wind ravine]

remove a byte from the device model name

"iPhon 13 Pro"

[tepid olive]

true, i could do that

or just empty the string

[wind ravine]

no

wait

if its unsandboxed why do u need to override it?

[tepid olive]

it’s not unsandboxed

haven’t done that yet

[hexed knot]

what the hell

how does it do that

average webm

[wind ravine]

i cant even figure out how to get this running

[lament mica]

Does anyone know what UI components these sliders are?

im guessing some component from SwiftUI? because of the misaligned speaker icon

[hasty ruin]

tbf that's an interesting problem to solve

the speaker icon is given the same left inset as the top/bottom

but when the volume is on 0, the white part just wont "contain" the icon, unless it's moved temporarily

it's just weird

to answer the question though, it's either smth swiftui related, or something custom

[peak quartz]

https://twitter.com/roothidedev/status/1686439221874274304?s=46&t=dxd-yHRRQiwe-ixQ1xnMXg man he is really at it

RootHide (@RootHideDev)

jailbreak detection is dead, jailbreak alive again.

▶ Play video

Twitter · Aug 1, 2023, 6:10 PM

[timid briar]

Anyone know what’s up with these WiFiLQMMetrics logs? There’s nothing in them when I view and when I export it it’s all mangled

I have 3 that are apparently just blank (corrupted?) from the past couple days

I wonder if it's somehow related to how Dopamine auto disables/enables WiFi

[radiant idol]

Except right now this is exactly the same as just not being jailbroken

https://cdn.discordapp.com/emojis/835302180146905109.webp?size=48&name=frCursed&quality=lossless

[acoustic imp]

ik this probly sound dumb but in XCode 14 how do i choose OBJC instead of swift?

im at this screen

@radiant idol ?

[vivid dew]

my banking app doesn't have jailbreak detection

[acoustic imp]

@native dune ?

[native dune]

click next then choose storyboards and objective c

[acoustic imp]

fill this out then next?

[native dune]

yeah but fix that bundle id its awful

com.teslaman3092.objc-helloworld is even better

[acoustic imp]

@native dune

where does it say storyboard and or have the OBJC option?

[native dune]

uhhh thats weird

[acoustic imp]

is it caue like i need to enble Objc or sm?

[visual meadow]

@tepid olive dm pls

[native dune]

@acoustic imp this is what it looks like on xcode 15, and when i used to use xcode 14 it looked the same

[visual meadow]

@rigid glen

[acoustic imp]

do i need a like paid dev acc?

[native dune]

i dont have one

[acoustic imp]

google isnt helping

got it, i had mine not on IOS

[acoustic imp]

how do i like make it so that it puts my name after the com. every time?

like u have

[native dune]

dont know

[primal perch]

same

me when i just bedge

[hasty ruin]

mine does but i bypassed it

now i'm on rootless and it doesn't detect

rootless superiority

[vivid dew]

i'll bypass you

[hasty ruin]

?

[cloud yacht]

Mine does but it's a one time pop up that warns me and doesn't do anything else. Haven't seen it since iOS 11

[acoustic imp]

does simject work on ios15 and or ios16 Xcode simulator?

or is it a matter of Xcode version? i have (14.2)

[lean ember]

Finally got DVIA-V2 to build and run using Xcode now what? 😆

[bleak wagon]

did you get kfd working? I think you need to change boot ull

to 25ull from 17ull

[wind ravine]

no

doesnt work

[tepid olive]

so vnodeOverwriteFile2 doesn’t work

[wind ravine]

what

my issue is on kopen

[tepid olive]

not talking about u

[topaz yew]

what else can you do with kfd besides emulate macdirtycow

[severe stream]

kernel r/w

[tepid olive]

send log

[wind ravine]

the log looks normal

[info_init]: kfd->info.env.tid = 6801
[info_init]: kfd->info.env.maxfilesperproc = 10240
[info_init]: kfd->info.env.kern_version = Darwin Kernel Version 22.6.0: Tue May  9 06:18:36 PDT 2023; root:xnu-8796.140.12.502.1~12/RELEASE_ARM64_T8101
[info_init]: kfd->info.env.vid = 0
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_sem_open
[krkw_init]: method_name = kwrite_sem_open
[puaf_helper_give_ppl_pages]: given_ppl_pages = 215
[puaf_helper_give_ppl_pages]: 🟢 0s 3ms 266us
[puaf_run]: 🟢 0s 10ms 654us
[krkw_helper_grab_free_pages]: grabbed_free_pages = 45676
[krkw_helper_grab_free_pages]: 🟢 0s 235ms 233us
[krkw_helper_run_allocate]: 🟢 0s 5ms 84us
[krkw_helper_run_allocate]: kread ---> object_id = 2079, object_uaddr = 0x00000003d275c000, object_size = 16, allocated_id = 3072/10140, batch_size = 1024
[0x0000]: ffffffe0a24a2680 0000000000000000 
[krkw_helper_run_allocate]: 🟢 0s 0ms 763us
[krkw_helper_run_allocate]: kwrite ---> object_id = 446, object_uaddr = 0x00000003d21fc000, object_size = 32, allocated_id = 3584/10140, batch_size = 512
[0x0000]: 0000000000000001 0000000000000001 94e91dded7188e80 0000000000000000 
[krkw_helper_run_deallocate]: 🟢 0s 0ms 7us```

[tepid olive]

Skull issue

@wind ravine version?

[wind ravine]

16.6b1

[tepid olive]

Actually I know already

Yeah

Device?