#development
hasty ruin
lime pivot
honestly in situations where you need it, you can do something like objc void initStuff() { %init(stuff); }
hexed knot
you and who
nobody anymore .
native dune
hasty ruin
honestly in situations where you need it, you can do something like ```objc
void...
i just assumed it would should if you init outside of a constructor
lime pivot
I figure if you know you really do need it, you'll know to do that
indigo peak
struct PE_Video {
unsigned long v_baseAddr; /* Base address of video memory */
unsigned long v_rowBytes; /* Number of bytes per pixel row */
unsigned long v_width; /* Width */
unsigned long v_height; /* Height */
unsigned long v_depth; /* Pixel Depth */
unsigned long v_display; /* Text or Graphics */
char v_pixelFormat[64];
unsigned long v_offset; /* offset into video memory to start at */
unsigned long v_length; /* length of video memory (0 for v_rowBytes * v_height) */
unsigned char v_rotate; /* Rotation: 0:normal, 1:right 90, 2:left 180, 3:left 90 */
unsigned char v_scale; /* Scale Factor for both X & Y */
char reserved1[2];
#ifdef __LP64__
long reserved2;
#else
long v_baseAddrHigh;
#endif
};
typedef struct PE_state {
boolean_t initialized;
PE_Video video;
void *deviceTreeHead;
void *bootArgs;
vm_size_t deviceTreeSize;
} PE_state_t;
i want PE_state.video.v_baseAddr
primal perch
7cbc0
hasty ruin
I figure if you know you really do need it, you'll know to do that
i ended up just modifying logos source
native dune
okay this chat is getting too stupid
lime pivot
well that's the workaround to, well, not do that
native dune
so glad no one saw what i edited.
hasty ruin
agree
native dune
Why are Furries rent free in your head.
hasty ruin
Why are Furries rent free in your head.
THATS WHAT YOU SAID
vivid dew
```
0xFFFFFFF00797CC40 - 0xFFFFFFF00797CBB8 =
0x0
```
your math skills are astonishing
vivid dew
indigo peak
hasty ruin
indigo peak
so what does that mean
primal perch
it’s 7cbc0
hasty ruin
this is why you use python to calc them
indigo peak
it’s 7cbc0
so whats my offset, like kslide + [what]
FFFFFFF00797CBC0, 00797CBC0, like what
primal perch
first one
hexed knot
0xaa55
primal perch
i’m just not typing it all
lime pivot
what
primal perch
well whatever the file offset is
hexed knot
yeah sheps smart
primal perch
that’s the virtual address
indigo peak
com.apple.kernel:__text:FFFFFFF0084549DC
primal perch
yeah that
indigo peak
yeah that
primal perch
idk i don’t do ios kernel stuff
indigo peak
the value you want is `FFFFFFF00797CBC0`
wait
so
com.apple.kernel:__text:FFFFFFF0084549DC STR X9, [X8,#(xmmword_FFFFFFF00797CBC0 - 0xFFFFFFF00797CBB8)]
thats the asm line
am i doing the hex after __text
or the xmmword
primal perch
you don’t need the static base then you can just do slide + that address then
or you can do the static base + slide + 0x978BC0
same thing
hexed knot
(((static kernel base address)^2 * file offset) - (file offset + kernel slide))^2
indigo peak
or you can do the static base + slide + 0x978BC0
ill do this
ok i wont do that
im not tripping i just dont know what im doing
primal perch
well ur the asian correct us pls
indigo peak
yeah idk wym by field
like what it translates to in the struct?
idk how to figure that out
shep just told me what baseAddr was
ok technically it should be PE_state.video.v_width
if my assumption guess is correct
hooray
i shall lyk if this works
primal perch
so exactly what i said
primal perch
i didn’t
i don’t need to rely on it when i can see in the ida screenshot that it’s the correct address
indigo peak
#define PE_STATE_STRUCT 0x978BB8
#define FRAMEBUFFER_OFFSET 0x8
#define KERNEL_BASE 0xfffffff007004000
uint64_t get_fb_addr(uint64_t kslide) {
return kread64(KERNEL_BASE + PE_STATE_STRUCT + FRAMEBUFFER_OFFSET + kslide);
}
yea true
primal perch
yeah
correct
scoob
mostly
ah yeah that’s where the captware meme started
boot loops
i dont remember that but i’ll believe it ig
crazeware tho
shepware (doesn’t exist)
lazy as hell
indigo peak
#define WHITE 0xffffffff
#define BLACK 0x00000000
#define PE_STATE_STRUCT 0x978BB8
#define FRAMEBUFFER_OFFSET 0x8
#define KERNEL_BASE 0xfffffff007004000
#include "iso_font.h"
uint64_t get_fb_addr(void) {
return kread64(KERNEL_BASE + PE_STATE_STRUCT + FRAMEBUFFER_OFFSET + ((struct kfd*)_kfd)->perf.kernel_slide);
}
void write_char(char c, int col) {
uint64_t addr = get_fb_addr();
for (int y = 0; y < 15; y++) {
int val = iso_font[c * 16 + y];
for (int x = col; x < col + 8; x++) {
if ((val & (1 << (x - col)))) {
kwrite64(addr + (x * 4) + (y * 256), WHITE);
} else {
kwrite64(addr + (x * 4) + (y * 256), BLACK);
}
}
}
}
void write_string(char *str, int len) {
for(int i = 0; i < len; i++) {
write_char(str[i], i * 8);
}
}
copied some prime billy ellis code, and it did not work
it didnt panic
but
nothing got displayed on le screen
so im starting to think
that
framebuffer
dont exist anymore
primal perch
see if the pointer is valid for starters
indigo peak
Aug 6 23:26:45 eyePhone kfd[7812] <Notice>: [kfd] [i] fb: 0x8f7104000
yeah
capt
figure out which offset it is
for the width of the screen
like 0x8 is the base addr
wait, is 'start of struct' start of PE_Info or PE_Video
primal perch
idk try filling it all with red or on a loop if that’s the lowest level framebuffer is it being overwritten each frame
does the kernel fb naturally go on top
primal perch
is it different than the fb everything else renders on top of
indigo peak
capt incorperated
boolean_t initialized;
PE_Video video;
void *deviceTreeHead;
void *bootArgs;
vm_size_t deviceTreeSize;
} PE_state_t;```0x8 is the start of the PE_Video struct then
primal perch
ya
indigo peak
struct PE_Video {
unsigned long v_baseAddr; /* Base address of video memory */
unsigned long v_rowBytes; /* Number of bytes per pixel row */
unsigned long v_width; /* Width */
unsigned long v_height; /* Height */
unsigned long v_depth; /* Pixel Depth */
unsigned long v_display; /* Text or Graphics */
char v_pixelFormat[64];
unsigned long v_offset; /* offset into video memory to start at */
unsigned long v_length; /* length of video memory (0 for v_rowBytes * v_height) */
unsigned char v_rotate; /* Rotation: 0:normal, 1:right 90, 2:left 180, 3:left 90 */
unsigned char v_scale; /* Scale Factor for both X & Y */
char reserved1[2];
#ifdef __LP64__
long reserved2;
#else
long v_baseAddrHigh;
#endif
};```oh wait
i see wym
bc since its the first field
you dont need to add anything
primal perch
yes
indigo peak
it would be 0x0
primal perch
indigo peak
mhm
primal perch
yeah we’re like mathematicians we skip over steps we know are redundant
“ok well we’ll just jump to here since that’s a given “
completely different equation
indigo peak
<:applethumbsup:958409257756266546>
so if i wanted to get v_width, it would be sizeof(unsigned long) * 2?
primal perch
assuming alignment is correct yes
which it should be
you can confirm it tho in the ida screenshot
and there is no assumption in the f5 code
i just don’t wanna scroll up
pretty sure it was tho
Boom tan tan tu tan toogaloogi, fo ut to but a ban ban on a toogi, when pull up it olla tan tan on a doogi 🗣️🔥🔥🔥🔥
indigo peak
so the struct does exist in the memory (and is populated with vals)
uint64_t v_height = 0xfffffff007004000 + kslide + 0x978BB8 + 0x8 + (sizeof(unsigned long) * 2);
printf("[i] v_width: 0x%llx\n", v_height);
printf("[i] kread64 v_width: 0x%llx\n", kread64(v_width));
Aug 6 23:39:25 eyePhone kfd[389] <Notice>: [kfd] [i] addr: 0xfffffff01a634bd0
Aug 6 23:39:25 eyePhone kfd[389] <Notice>: [kfd] [i] kread64 v_width: 0x492
0x492 -> 1170
zenith hatch
gm
primal perch
yea
just read it all to a struct on your end but it’d be a copy obviously
so you can’t write to it the same way
@gentle grove
indigo peak
@grave sparrow @primal perch
uint64_t v_width = 0xfffffff007004000 + kslide + 0x978BB8 + 0x8 + (sizeof(unsigned long) * 2);
printf("[i] v_width: 0x%llx\n", v_width);
printf("[i] kread64 v_width: 0x%llx\n", kread64(v_width));
kwrite64(v_width, 0x249);
panic
hexed knot
faint timber
No remington in my closet since my closet is in California but I should get one to forget her
hexed knot
you can borrow mine after
tepid olive
<@434097922762735618> <@726214891970625549>
```C
uint64_t v_width = 0xfffffff00...
boot args are protected by KTRR
elder scaffold
yalu1011 mitigation
steady nest
indigo peak
boot args are protected by KTRR
fields of PE_State/PE_Video are considered boot args?
unkempt magnet
boot args are protected by KTRR
Nice KTRR
tepid olive
fields of PE_State/PE_Video are considered boot args?
i fear that they are
indigo peak
additionally, I think I was writing 64 when it should’ve been 32
Idk if that has anything to do with it
But
That’s a thing
tepid olive
doesn’t really matter
indigo peak
i fear that they are
is that like a recent thing?
tepid olive
no
indigo peak
like implemented in iOS x.x
naive kraken
then how was billy Ellis able to do it on iOS 8/9
KTRR was introduced in the iPhone 7
half atlas
Is this game trying to detect a jailbreak with this? lol
indigo peak
KTRR was introduced in the iPhone 7
unfortunate
worthy rune
greenpoision
native orbit
Is this game trying to detect a jailbreak with this? lol
they failing so hard cuz they not using /ApplicationS 💀
half atlas
im gonna patch that out
elder scaffold
Is this game trying to detect a jailbreak with this? lol
blackra1n 
limera1n 
greenpois0n 
LMAO
half atlas
but whats in /private/var/lib/apt/ ?
faint timber
Something actually used
half atlas
linux stuff?
timid furnace
Stuff for the package manager
half atlas
thought so
worthy rune
/private/preboot
lime pivot
Is this game trying to detect a jailbreak with this? lol
this is the classic list (that doesn’t work since iOS 13) apps keep copying for some reason
lmao @ redsn0w.app on the phone, that was never a thing
half atlas
lmao @ redsn0w.app on the phone, that was never a thing
pretty old https://ijunkie.com/download-redsn0w/
half atlas
this is the classic list (that doesn’t work since iOS 13) apps keep copying for ...
is it now sandboxed or what changed with ios 13?
half atlas
do you have a link?
half atlas
bruh why would they use sth from 2013. its just so bad
half atlas
i wonder how many kreads would panic on 17 beta 1
prob seg fault after first attemp
granite frigate
yea i don't think anything useful is coming out of this
all im getting are kernel data aborts
half atlas
prob seg fault after first attemp
told u 🙂
granite frigate
does perf not working explain the unreliability?
Oooo
SPTM VIOLATION_ILLEGAL_RETYPE
velvet path
so is SPTM going to limit any semblance of 17.0b1 being viable for A15+
granite frigate
is sptm a new mitigation?
never heard of it sorry
A15 and 16 mitigation on 17 and above
Damn
unkempt magnet
Nice SPTM
tepid olive
lol
granite frigate
Anyway kreading and kwriting is worse than b2
can't even kclose because that uses kwrite
💀
native orbit
rip jailbreaking fr
tepid olive
can't even kclose because that uses kwrite
maybe some offsets changed
tepid olive
other parts use offsets
tepid olive
is this for kwrite
granite frigate
Yes
tepid olive
you could probably bypass it
granite frigate
Dunno how xd
tepid olive
well then
unkempt magnet
Now we don't need ppl bypass anymore on iOS 17+/A15+, that's good.
tepid olive
enjoy iOS 17
granite frigate
Fr
tepid olive
Now we don't need ppl bypass anymore on iOS 17+/A15+, that's good.
SPTM is so much worse
It’s crazy how bad it is
Jailbreaking is dead on A15+
gaunt helm
f
granite frigate
Idk what it does more than ppl
naive kraken
Now we don't need ppl bypass anymore on iOS 17+/A15+, that's good.
PPL bypasses are the easiest part of a jailbreak
just no one is willing to look into it
neither am I
naive kraken
you don't need kcall
but you need to be creative
All stuff done by PPL before is now done by SPTM so I really don't think what specific benefit it has over PPL
tepid olive
All stuff done by PPL before is now done by SPTM so I really don't think what sp...
check out that panic
granite frigate
I can send the ips sec
tepid olive
kfd’s strategy doesn’t work because the types in those mapped pages don’t match
it’s like firebloom in xnu
granite frigate
tepid olive
if this is actually it idk how exploits can be possible
naive kraken
so SPTM is a response to physical uaf's?
primal perch
https://proteas.github.io/ios/2023/06/09/some-quick-and-discrete-notes-on-sptm.h...
WOOOO MORE MITIGATIONS
granite frigate
tepid olive
also how will you bypass something in iBoot
primal perch
real
faint timber
All the fun sits in the 4. SecureROM, SEPROM, iBoot, and sepOS
Sepos Is my current task
indigo peak
just no one is willing to look into it
I’m willing to look into it but I have 0 idea what I’m doing 🗿
which is actively demonstrated by my difficulties last night trying to find a struct in the kcache
faint timber
Why would I look at kernel, kernel is stupid, kernel has fucking block syntax
Fucking block syntax god damnit
faint timber
which is actively demonstrated by my difficulties last night trying to find a st...
Kernel is open source use this to your advantage to find functions the struct is accessed in via strings etc
indigo peak
yeah but it took forever to find strings that lined up
like I found a string that I thought would work, found the function it was in (oss and kcache) and then the struct I needed just wasn’t referenced in that function
like it was on the kernel source, but when I checked in Ida it wasn’t there
indigo peak
other way around I think
visual meadow
@faint timber my brother in christ
when will this be fixed
on god 🔥
plz update libimobiledevice in ur bootstrap 🔥
acoustic imp
silly question but how do i get alerdis color picker like installed into theos?
native dune
i thought that was included by default
main apex
@lime pivot Is Alderis still not included by default?
native dune
well
native dune
native dune
right
hexed knot
this is all you have to do
native dune
yeah you just have to add it as a library since its added into theos already
lime pivot
it's Alderis.framework
hexed knot
CaptCPT back at it again
acoustic imp
the dev had it like this DockIndicators_LIBRARIES = colorpicker and the file it wants it AlderisColorPicker.h not Alderis.h
hexed knot
yup the lib is libcolorpicker for backwards compatibility
acoustic imp
@grave sparrow it also wants this AlderisSDKCompatibility.h which i cant find on the alderis github
nvm
im blind
hexed knot
acoustic imp
yes, im jsut blind lol
hexed knot
me when i read the docs
twilit jungle
primal perch
me when i read the docs
hexed knot
cephei and alderis have really good docs
acoustic imp
me when i read the docs
the docs tell you how to install it? well for like swift or sm
hexed knot
i recommend you read them
yes the docs tell you how to install it
for everything
youre a little mentally handicapped so its okay for you
acoustic imp
https://hbang.github.io/Alderis/ this right?
lime pivot
accurate
hexed knot
i know its okay
late ridge
@lime pivot no worries abt this, but is this just us being goofy or is this actually broken https://github.com/hbang/libcephei/issues/63
lime pivot
<@239564780271173642> no worries abt this, but is this just us being goofy or is...
actually broken, didn't get a chance to finish my solution yet
hasty marsh
skulley
zenith hatch
torn oriole
visual meadow
@faint timber reverse proxy working
just started restore
and it says it started now
lets see if it actually restores now
faint timber
what the hell are you doing rebuilding everything
visual meadow
my fault
unkempt magnet
Got working dump entitlements for iOS 16 (for test purpose),
Dopamine's DEREntitlementsDecode function works. but some apps not?
indigo peak
Now write entitlements 
hasty marsh
true
hexed knot
twilit jungle
true
gaunt helm
thank you for ghost pinging me
torpid beacon
Is there any way for me to put an IOS simulator in my vscode window? ideally as a widget of some kind
i looked at extensions but couldnt really find anything
gaunt helm
thank you @tepid olive
tepid olive
you're welcome
granite frigate
why did the string just magically disappear on iOS 17 😭
tepid olive
why did the string just magically disappear on iOS 17 😭
because PPL doesn’t exist on 17?
tepid olive
yeah
tepid olive
lol
wind ravine
how do u get a file/folder in the documents directory in obj c?
hasty ruin
bleak wagon
@unkempt magnet interesting commit?
unkempt magnet
bleak wagon
@unkempt magnet sorry for dumb question :
kfd
Undefined symbol: _IORegistryEntryFromPath
Undefined symbol: _kIOMasterPortDefault
?
unkempt magnet
Import iOKit.framework
bleak wagon
thank you 🙂
bleak wagon
@unkempt magnet for it to build i needed to change kIOMasterPortDefault to kIOMainPortDefault
hexed knot
no slaves
hasty marsh
false
tepid olive
i get these 4 errors while trying to build whi1te4ever's kfd fork
bleak wagon
i get these 4 errors while trying to build whi1te4ever's kfd fork
The first 2 you need to add your account the other three mean those functions are missing
It could be a missing reference to a file
cloud yacht
I mean it's better than them just asking for the ipa prebuilt
hasty ruin
how to make better
Add a link to my nickname
indigo peak
yeah i didnt know how to do that
so i couldnt figure out how to make a label to the side of a switch like that
indigo peak
Ugly code <:troll:794397046706667530>
hasty ruin
wait
native dune
man
hasty ruin
then no
indigo peak
Schrodinger's ass eat, you eating the best ass of your life, but your eyes are closed and you dont know who it is, do you open your eyes?
could be capt, could be hot woman, could be joseph stalins dead corpse
indigo peak
i get what you mean
took a second to think ab it
lmao
@grave sparrow
what.
severe stream
ui so good
hasty ruin
bro accidentally used SwiftUI
indigo peak
better?
@grave sparrow
hexed knot
@grave sparrow do you like Joe Biden
indigo peak
should i add a : next to the switch labels?
hexed knot
no
indigo peak
Add static kernel base: [0-]
Add KASLR slide: [-0]
hexed knot
anyone who adds colons to uiswitch labels are psychos
indigo peak
do i scale the buttons text up to be larger with the button size increase
wind ravine
i have committed war crimes with this code
radiant idol
why
also you do realize that
NSFileManager *const fileManager = [NSFileManager defaultManager];
exists
true
(it was mostly the font)
wind ravine
also you do realize that
```objc
NSFileManager *const fileManager = [NSFileManag...
u cant u have to symlink it
it isnt readable
im trying to learn dictionaries
radiant idol
That's not what I mean
brazen dock
i have committed war crimes with this code
fuck switch i love else ifs
radiant idol
what I mean is that you wrote the same code a lot of times
wind ravine
ye
radiant idol
so true
wind ravine
im rewriting it but i have no hecking clue how strings work in obj c
i hate this language so much
wind ravine
im rewriting it but i have no hecking clue how strings work in obj c
chatgpt told me to do that with the string and its clearly wrong
radiant idol
char * is not a NSString
wind ravine
the syntax is bad
indigo peak
im rewriting it but i have no hecking clue how strings work in obj c
%s is for char *
%@ is for NSString *
(%@ is for objects, not just NSString, but it was easier to say)
wind ravine
tweak is a char*
indigo peak
im rewriting it but i have no hecking clue how strings work in obj c
show enabledTweaks
wind ravine
enabled tweaks is a parameter
radiant idol
NSDictionary *const keyMapping = @{
@"0" : @"",
@"1" : @"",
@"2" : @"A B C",
@"3" : @"D E F",
@"4" : @"G H I",
@"5" : @"J K L",
@"6" : @"M N O",
@"7" : @"P Q R S",
@"8" : @"T U V",
@"9" : @"W X Y Z"
};
for (int i = 0; i < numTweaks; i++) {
NSString *tweak = [NSString stringWithUTF8String:enabledTweaks[i]];
NSString *letters = keyMapping[tweak];
if (letters) {
NSString *filePath [folderPath stringWithFormat:@"PasscodeKey-%@.png", tweak];
}
}
but
indigo peak
do you have a recommended width/height ratio?
wind ravine
```objc
NSDictionary *const keyMapping = @{
@"0" : @"",
@"1" : @"",
...
that wont work
wind ravine
nono i got it
indigo peak
radiant idol
no it's a special property
indigo peak
oh?
indigo peak
textView.textContainerInset
indigo peak
also why is the background black
like the viewcontroller's bg?
indigo peak
wdym, like show you what happens to the button when pressed?
like color changing and whatever/
oh
lmao
specifically for the write?
or for both write and read
no bozo
move the button down
for just the write mode
or move the button down for both read and write mode
alr
indigo peak
@grave sparrow @radiant idol now the UI looks good, do you even DARE look at the code
radiant idol
I'm scared
hasty ruin
what's with the switch statement using different formatting
indigo peak
appropriate response
hasty ruin
indigo peak
what's with the switch statement using different formatting
idk i was copying iflooder source code
indigo peak
placeholder 😄
indigo peak
hasty ruin
scob
indigo peak
set the placeholder
theres a built in placeholder thing?
hasty ruin
theres a built in placeholder thing?
hasty ruin
in like every search bar ever
radiant idol
this is insane
hasty ruin
iCraze actually helping people
ALWAYS
indigo peak
@hasty ruin ohghhhh do you wanna know what is is
i was using UITextView
not UITextField
hasty ruin
radiant idol
indigo peak
is there a difference????
native orbit
massive
hasty ruin
it's like textarea vs input in html
native orbit
u doing uikit?
indigo peak
yeah
hexed knot
hexed knot
im rewriting it but i have no hecking clue how strings work in obj c
who gave you dev role
wind ravine
i have committed war crimes with this code
and why did u question that but not this?
hasty ruin
the worst thing is that font
native orbit
just use swift 
hasty ruin
just use swift <:shrug:1018220212358746216>
native orbit
sounds like skill issue
hexed knot
what is with ppl using objc yet still using c functions
native orbit
NS shit
native orbit
the nextstep curse
hexed knot
yes c is better but if youre using the language use its methods
native orbit
c + msgsend 
indigo peak
@hasty ruin hooray 🎉
hasty ruin
mf said sendmsg
hasty ruin
W
native orbit
mf said sendmsg
i tried
hexed knot
i love sendmsg
hasty ruin
all hail objc api
hasty ruin
ios 8 was extremely buggy
was also the first version to support swift
native orbit
@hasty ruin bro ruining all context 😡
hasty marsh
drop swift, rust, c+, etc. code in windows command prompt
hasty ruin
ios 16 was extremely buggy
was also the first version to have swiftui running at all times
hexed knot
drop swift, rust, c+, etc. code in windows command prompt
batch:
pwsh:
windows command prompt my favorite scripting language
native orbit
apple rly thought ios 13 swiftui was good enough to drop
hasty ruin
apple rly thought swiftui was good enough to drop
radiant idol
apple rly thought
native orbit
apple
hasty ruin
radiant idol
.
native orbit
swiftui users trying to code a UI without swift package manger
hasty ruin
swiftui users trying to code a UI without swift package manger <:supershocked:11...
i have only ever tried to compile one swiftui app
and it failed every time
because xcode said something was too long
hasty marsh
uwu
wind ravine
swiftui users trying to compile it on windows
native orbit
lemme download the 73 dependencies quick
hasty ruin
swiftui users trying to compile it
hasty ruin
lemme download the 73 dependencies quick
js mfs
native orbit
python mfs
wind ravine
swiftui users trying to compile
hasty ruin
nah python is chill don't diss
native orbit
valid
wind ravine
swiftui users
hasty marsh
swift users trying to get bitches
native orbit
c mfs wen libc got them covered
native orbit
objc++ users when they exist 
hexed knot
objc++ is stupid
radiant idol
how so
radiant idol
ig
native orbit
tihmstars goto lang
torn oriole
Tihmware
cloud yacht
js mfs
nah we are like let me download 2000 dependacies and they each have their own 2000 dependancies
primal perch
frail cedar
Tihmware
tihmstar codes in dependency++
bro literally creates a dependency for two functions
native orbit
Abolish libgeneral
waiting for the liblibgeneral release
torn oriole
NOOOO
native orbit
libstunzeed next
native orbit
libkok3shi
native orbit
libkpplessfunny.dylib
elder scaffold
wen
native orbit
s0n
elder scaffold
native orbit
its been very stable
elder scaffold
native orbit
decompressed is better word
elder scaffold
true
native orbit
It's a method that can't be used in ios 9
i can make small patch finder
would be faster anyway
needs hgsp4 as well ofc
elder scaffold
i can make small patch finder
Can it find patch points faster than 500ms?
native orbit
likely
native orbit
whole jb at like 1.2 seconds (but no optimization rn)
bypass method is around 500-650ms range
elder scaffold
For libkok3shi,
exploit: 90ms
kfind+kpatch: 500ms
(with kppbypass: + 300ms)
restart: 1 sec~
native orbit
how 32bit speed?
native orbit
i got it down to 90ms on 32bit now
elder scaffold
32bit takes a long time to restart
native orbit
gc spray was slow
native orbit
32bit takes a long time to restart
saurikware 
elder scaffold
native orbit
why need ldrestart? just ios 9 moment?
elder scaffold
why need ldrestart? just ios 9 moment?
compatibility with pangu9.
Also because I want to inject mobilesubstrate and then reload the whole process
native orbit
ah make sense
elder scaffold
In the case of 32bit, it is unavoidable that it will be slow
It's because of the specs of devices
native orbit
at least exploit doesnt panic 70% of the time
elder scaffold
99.9% success with libkok3shi <:troll:794397046706667530>
The conditions for pan...
I think it will be a little slower, but if i dump the kernel and search using the find_kernel_task function instead of using the task structure, the chances of panic are even lower.
elder scaffold
never had panic, just very rarely a failed to leak task port
hum
native orbit
that is only when debugging with xcode though
elder scaffold
In my code it is infinitely close to 0
native orbit
need fix mine then 
elder scaffold
Well, just think over and over until succeed
native orbit
real
radiant idol
shut up capt
tepid olive
tihmstar codes in dependency++
have you seen a rust project?
faint stag
that's a lot of cargo
placid kraken
guys did i do this right
import modules from "./modules";
import { storages } from "@handlers/state";
const { React } = modules.common;
/**
* @description Implements raw statefulness to a storage key-value pair.
* @param {string} key - The key to access from the storage.
* @param {storages} store - The store to get the value from with the key provided
* @return {get, set} - Getting and setting the LocalStorage value statefully.
*/
export const useStorageValue = <T extends any>(key: string, store: keyof typeof storages) => {
const [value, setValue]: [T, (arg: T | ((previous: T) => T)) => void] = React.useState(storages[store].get(key))
React.useLayoutEffect(() => {
storages[store].set(key, value);
}, [value]);
return [value, setValue] as const;
}
look great 
tepid olive
phenomenal
bleak wagon
bro literally creates a dependency for two functions
“You need to build all of my libraries libraries.”
frail cedar
that's a lot of cargo
the project didn't support that
bleak wagon
@unkempt magnet can you merge kern offsets branch for easier offset integration for other devices? It makes maintaining forks with more offsets hard with incompatible offset form
zenith hatch
thanks lemon
hai rosie
gentle grove
olive peak
To add libraries, for example hook kit, i need to put the .h and the .tpc or whatever its called inside the lib folder of theos right? Or am i understanding something wrong?
And then i need to link to them inside of the makefile?
primal perch
velvet ivy
div{
float: center;
}
void yoke
I'm trying to use Frida on iOS 14.0.1 with Taurine, and whenever I try to do anything with it over USB (even a simple frida-ps), my phone instantly reboots. Any reasons why, and are there any alternatives to Frida?
coral gazelle
If a device requests an ApImg4Ticket for an OTA update before rebooting to install the update, how does the value of the SEPNonce after the reboot match the one in the ticket if there’s no NVRAM variable to set the SEPNonce?
raven maple
I'm trying to use Frida on iOS 14.0.1 with Taurine, and whenever I try to do any...
An old alternative is http://www.cycript.org/. But I never tested it and idk if arm64(e) can support it.
main apex
how to center div
<center><div></div></center>
gentle grove
are you trying to say it's not 1996 anymore
radiant idol
Windows 1
gentle grove
Why
bleak wagon
<center><div></div></center>
Margin auto
Center doesn’t center just the div
So you can’t manually align elements inside the div if it’s a child tag of a parent tag within a center tag
gentle grove
display: flex
mossy raven
Is it possible to load LookinServer into SpringBoard?
Im getting an Signing error :/
hexed knot
primal perch
Pp
hexed knot
hexed knot
quinn the eskimo
main apex
So you can’t manually align elements inside the div if it’s a child tag of a par...
They never specified child elements :P
native orbit
quinn the eskimo
dude is fucking everywhere
hasty ruin
every comment on that site is from eskimo
zenith hatch
true
faint stag
display: flex
TRUE
faint stag
They never specified child elements :P
the only time i can think of it not having any child elements is if it's <p> or <span>
and if there's no pseudo elements
gentle grove
untold drift
is there any way to trigger govertment emergency alert with jb?
unkempt magnet
Make taurine great again using kfd,
definitely so fast on my 6s than cicuta_virosa
tepid olive
Make taurine great again using kfd,
definitely so fast on my 6s than cicuta_vir...
wow that’s great
unkempt magnet
Make taurine great again using kfd,
definitely so fast on my 6s than cicuta_vir...
Special thanks to @naive kraken, contribute kfd project for arm64.
tepid olive
Run it on 14.8 @unkempt magnet
native orbit
wonder how far back kfd works
granite frigate
omw to run tns with kfd
native orbit
bouta replace libtiff with kfd
elder scaffold
opa's fork's kfd works without static offsets, right?
granite frigate
ooo he added an offset finder
tepid olive
opa's fork's kfd works without static offsets, right?
yes
native orbit
kok3shi13 with ktrr bypass wen
elder scaffold
kok3shi13 with ktrr bypass wen
where is the KTRR bypass
native orbit
ask sig 
elder scaffold
granite frigate
i managed to get kopen to work before it paniced immediately https://cdn.discordapp.com/emojis/1085060228241969192.webp?size=48&name=sadge~2&quality=lossless
tepid olive
i managed to get kopen to work before it paniced immediately https://cdn.discord...
makes sense, SPTM is a Monitor
it checks periodically
you can probably race it
granite frigate
can't see the latest panic log wtf
it's another kernel data abort
idk it's weird because half the time i get sptm panics then the other half are unrelated
unless it's a race like you said
visual meadow
Make taurine great again using kfd,
definitely so fast on my 6s than cicuta_vir...
I tried running this on 14.4 arm64e
it dies here
visual meadow
turns out it dies there on arm64 14.4+ too
native orbit
check the 1481 src and see if it different
visual meadow
check the 1481 src and see if it different
I looked mineek just deleted amfi swift
tepid olive
log the pointer
tepid olive
that is aligned
tepid olive
fix it
visual meadow
bro
native orbit
tepid olive
how would i know
granite frigate
idk how this works but adding usleep(1000) to kread/write just... stopped the panic
might be unrelated though idk
torn oriole
idk how this works but adding usleep(1000) to kread/write just... stopped the pa...
As soon as the sleep ends it'll panic
torn oriole
Real I guess
steady nest
Make taurine great again using kfd,
definitely so fast on my 6s than cicuta_vir...
worked first try, what a win
indigo peak
just use vscode and theos ¯_(ツ)_/¯
vivid dew
true
gentle grove
notepad++
radiant idol
@grave sparrow nothing can top this tho
primal perch
unfathomably based
hasty ruin
-(instancetype)initWithVersion:(instancetype)arg1 calendar:(instancetype)arg2 numberingSystem:(instancetype)arg3 months:(instancetype)arg4 standaloneMonths:(instancetype)arg5 shortMonths:(instancetype)arg6 standaloneShortMonths:(instancetype)arg7 tinyMonths:(instancetype)arg8 standaloneTinyMonths:(instancetype)arg9 weekdays:(instancetype)arg10 standaloneWeekdays:(instancetype)arg11 shortWeekdays:(instancetype)arg12 standaloneShortWeekdays:(instancetype)arg13 tinyWeekdays:(instancetype)arg14 standaloneTinyWeekdays:(instancetype)arg15 quarters:(instancetype)arg16 standaloneQuarters:(instancetype)arg17 shortQuarters:(instancetype)arg18 standaloneShortQuarters:(instancetype)arg19 eras:(instancetype)arg20 longEras:(instancetype)arg21 amSymbol:(instancetype)arg22 pmSymbol:(instancetype)arg23 shortDatePattern:(instancetype)arg24 mediumDatePattern:(instancetype)arg25 longDatePattern:(instancetype)arg26 fullDatePattern:(instancetype)arg27 shortTimePattern:(instancetype)arg28 mediumTimePattern:(instancetype)arg29 longTimePattern:(instancetype)arg30 fullTimePattern:(instancetype)arg31 decimalSeparator:(instancetype)arg32 groupingSeparator:(instancetype)arg33 currencyDecimalSeparator:(instancetype)arg34 currencyGroupingSeparator:(instancetype)arg35 plusSign:(instancetype)arg36 minusSign:(instancetype)arg37 exponentialSymbol:(instancetype)arg38 percentSymbol:(instancetype)arg39 perMilleSymbol:(instancetype)arg40 infinitySymbol:(instancetype)arg41 nanSymbol:(instancetype)arg42 decimalPattern:(instancetype)arg43 scientificPattern:(instancetype)arg44 percentPattern:(instancetype)arg45 currencyPattern:(instancetype)arg46 currencyCode:(instancetype)arg47 currencySymbols:(instancetype)arg48;
radiant idol
who knows at this point what apple came up with nowadays
radiant idol
# -(instancetype)initWithVersion:(instancetype)arg1 calendar:(instancetype)arg2 ...
instancetype
hasty ruin
radiant idol
LMAO
hasty ruin
fr
hasty ruin
radiant idol
I have to use limneos
oh
surprisingly they didnt
it didnt work for me
on ios 16
header was empty
but whatever
bru
perhaps it mysteriously vanished
hasty ruin
radiant idol
ok good they didnt add more
wicked summit
Windows is a nightmare
I tried to compile a C project
A small C project that strictly used ANSI C
Goddamn pain
visual meadow
@tepid olive ok so switching to release build fixes
but
amfi bypass just isnt working
I had someone try on 14.4.2 iphone 7
and it works
im pissed
gentle grove
Windows is a nightmare
WSL
steady nest
<@456226577798135808> ok so switching to release build fixes
there's a makefile
visual meadow
there's a makefile
Well
What would I do when it works
on
arm64 14.4.2 but not arm64e 14.4
amfid isnt fulyl bypassed
steady nest
how do you know it's amfid
faint timber
Sus
steady nest
amfidebilitate successful bro
visual meadow
amfidebilitate successful bro
what if that is false
steady nest
how's it false
visual meadow
it just checks if it has sandbox stuff
print("Waiting for amfi to really be debilitated...")
while testUnsandboxedExec() != 0 {
usleep(1000)
}
func testUnsandboxedExec() -> Int32 {
runCmdRaw(cmd: "/taurine/jbexec", args: ["helloWorld"])
}
we know all binaries in /taurine work
but the others dont'
hasty ruin
Aaron is gonna ban you
visual meadow
@steady nest So what do I do?
visual meadow
Crazy
visual meadow
How would I debug it tho 
it dont make sense 😭
hurrrr @steady nest
FUCK
i told you bro
i dmed cs and they answered by just saying Hey
(probably just ghosted me)
oh shit theyre typing
visual meadow
it is
steady nest
it's not bro...
steady nest
but the offsets should be the same as arm64 though?
visual meadow
yeah thats the thing
steady nest
https://github.com/Odyssey-Team/Taurine/blob/825424a24cb22da81644724067e3c2a2fea3a2d2/amfidebilitate/main.swift#L81 only thing i might see is around here
but I don't see how's amfi debilitate
steady nest
hurrrr <@213293185449852929>
especially not with this lolol
unkempt magnet
amfidebilitate is not opensource..
visual meadow
amfidebilitate is not opensource..
unkempt magnet
Sorry my bad, it's jailbreakd
visual meadow
hows it jbd
unkempt magnet
Revive?
visual meadow
i mean sadness for this tho
hasty ruin
native orbit
<:banswift:1117466779552317470>
visual meadow
hasty ruin
screenshot the full thing mf
native orbit
no
hasty ruin
native orbit
i need missing context
native orbit
i mean sadness for this tho
wonder if its just out of spite or a license issue
steady nest
native orbit
primal perch
topaz yew
man all these extra steps to load some dylibs
tepid olive
brazen timber
wonder if its just out of spite or a license issue
if u know anything about cs it's out of spite
hexed knot
it is out of spite
radiant idol
@hasty ruin you have one hour to explain yourself
native orbit
hasty marsh
screenshot the full thing mf
visual meadow
primal perch
thing
upper hull
no one has arm64e devices on 14
lots of folks do, myself included
hexed knot
how come i cant create a file using [[NSFileManager defaultManager] createFileAtPath:@ROOT_PATH("/test") contents:nil attributes:nil];, no file gets created or nothing
im on ios 15 rootless palera1n
hasty ruin
how come i cant create a file using `[[NSFileManager defaultManager] createFileA...
You’ll need root
ocean raptor
Um ashctually this is rootless ☝️🤓
steady nest
lots of folks do, myself included
hey, we found the second person in the world with an arm64e phone on 14!!!
visual meadow
https://twitter.com/wh1te4ever/status/1690299620285698048?s=46&t=LUSNSGJyUZ15gupblBCd_Q
@unkempt magnet but what about arm64e 14.4?
Twitter
steady nest
14.4 should still work with fixed offsets (if that's even the issue)
14.5 needs work
visual meadow
14.4 should still work with fixed offsets (if that's even the issue)
Well, does fugu14 bypass pac and ppl everywhere
steady nest
taurine doesn't use none of that
visual meadow
taurine doesn't use none of that
I just tried using fugu14 untether and then killing jbd and using taurine arm64
It went to the same place as per usual
but didnt panic
steady nest
you need to find out what's wrong
visual meadow
you need to find out what's wrong
Literally what do I look for thouhg
public struct CSBlobOffsets {
let csb_cputype = UInt64(0x8)
let csb_cpusubtype = UInt64(0xc)
let csb_flags = UInt64(0x10)
let csb_base_offset = UInt64(0x18)
let csb_cdhash = UInt64(0x48)
let csb_teamid = UInt64(0x80)
let csb_signer_type = UInt64(0x98)
let csb_reconstituted = UInt64(0x9C)
let csb_platform_binary = UInt64(0xA0)
}