development

[visual meadow]

are these the offsets?

that are maybe wrong

[harsh junco]

what abt 14.6

[visual meadow]

Idk

Im trying to figure out 14.4 arm64e

[harsh junco]

panics

[hexed knot]

oops

i shouldve just went to sleep at like 12

[unkempt magnet]

Ios kopen working on 14.4 arm64e? @visual meadow

*Is

[visual meadow]

Wdym

latest commit?

[unkempt magnet]

Kopen works?

[visual meadow]

latest commit in taurine?

idk what u mean by kopen

[unkempt magnet]

Yes taurine

[visual meadow]

the latest commit doesnt work

it just panics

[unkempt magnet]

Take a look if kopen work or not

[visual meadow]

How

I dont understand lol

https://github.com/wh1te4ever/Taurine/commit/fe7287d08cda6abe1c1978f7e362ff4e59a46a4c

this commit panics

[unkempt magnet]

https://github.com/wh1te4ever/Taurine/blob/main/Taurine/exploit/krw.m#L60

Set breakpoint here if kopen works or not

[visual meadow]

ok

@unkempt magnet

[unkempt magnet]

Set break point set_selfproc again

[visual meadow]

panics

Selecting kfd - smith exploit for iOS 14.3 - ?
[info_init]: kfd->info.env.pid = 277
[info_init]: kfd->info.env.tid = 4347
[info_init]: kfd->info.env.vid = 10
[info_init]: kfd->info.env.ios = true
[info_init]: kfd->info.env.osversion = 18D52
[info_init]: kfd->info.env.maxfilesperproc = 10240
[puaf_init]: method_name = smith
[krkw_init]: method_name = kread_IOSurface
[krkw_init]: method_name = kwrite_IOSurface
[perf_init]: hw_model = J318AP
[puaf_helper_give_ppl_pages]: given_ppl_pages = 208
[puaf_helper_give_ppl_pages]: 🟢 0s 4ms 947us
[puaf_run]: 🟢 0s 12ms 167us```

[unkempt magnet]

Then you need to look for kfd offsets, especially libkfd/info.h

[visual meadow]

How would that fix though

Fix the amfi issue

physpuppet works fine

[unkempt magnet]

I don't have arm64e device, so can't help sorry

[visual meadow]

😭

[upper hull]

I have xr

[visual meadow]

What ios

[upper hull]

On 14.4.2

Currently using fugu14. I can restore root fs if need be

[visual meadow]

try this if u want to

i doubt it work but

[velvet path]

on paper I could take my iPad 6 to 14.4.1 (there's ways) and try it but:
A. I'm not home at the moment
B. It's been my 17.x palera1n test device so

[visual meadow]

it works fine on 14.4.1

arm64

[velvet path]

validated?

what even are the license guidelines surrounding redistribution of a fork or whatever

[visual meadow]

yeah i had someone try on iphone 7 14.4.2 and iphone 6s 14.4

but on arm64e it dont

im conteplating on just updating my ipad to 16.5

[velvet path]

so basically the fork works on arm64 14.4.x

[visual meadow]

Yeah

[velvet path]

thus this question

[visual meadow]

Idk

[upper hull]

Exploit seemed to work..

Asked me to reboot

[visual meadow]

yes but when you try again its probably gonna say ERR_JAILBREAK

[upper hull]

So far, no.. Just rebooting

[visual meadow]

on the first one it says that

[velvet path]

what changes between bootstrapping and rejailbreaking that would affect this?

[visual meadow]

because snapshot rename

[visual meadow]

its something with amfi

[upper hull]

Oh yeah, got that now.. Just stuck on installing sileo

[visual meadow]

Yup

Just rootfs. thne

its annoying and idk how to fix

Im about to just go to 16.5

[velvet path]

I mean eh 16.5 doesn't have a lot of hope either

sure you have better long term app compatibility but

[upper hull]

I wouldn't go to 16.5

There's a lot of potential here

[visual meadow]

Well idk

Idk how to fix amfi

[velvet path]

I saw something mentioned about offsets - don't know if that's related or not

[upper hull]

what's amfi complaining about?

[upper hull]

ah, why not redirect amfi to another dir

[visual meadow]

What

[upper hull]

instead of /usr/bin like /jb

[visual meadow]

that still wotnw ork

[upper hull]

this is what levin faced with when making liberty

he had to install the bootstrap in a different area

[upper hull]

can't amfi be signed with ct cert? since this is a ct issue and we have the bug?

[visual meadow]

that just dont make sense but igtg

[granite frigate]

does anyone know how I can set up a dev environment to create a 32 bit app for iOS 8

i was thinking i prolly needed an old xcode version

[upper hull]

yup, with old sdk

[granite frigate]

is there anything more to it? i'm on m1 so idk if there would be problems building 32 bit apps or if that's even a concern

ig i'll try

[native orbit]

xcode 11 is what u need @granite frigate

should work on m1

[velvet path]

could it somehow be related to the bootstrap being old?

[visual meadow]

No

[granite frigate]

my storage hates me

[granite frigate]

11.7 doesn't work

damn

i might just pull out a old macbook for this

[velvet path]

pretty sure you need to run it through CLI or something unless this is about something unrelated

[granite frigate]

oh how

[native orbit]

gotta fake the build version or something

it been awhile

there a guide on SO somewhere

[granite frigate]

ok i'm gonna do some googling

[granite frigate]

ayyyyy thanks for pointing me the right direction

https://stackoverflow.com/questions/74192400/how-to-use-xcode-13-in-macos-ventura

just copied the bash script and changed the versions

29gb dedicated to xcode 💀

[native orbit]

im using like 400gb for xcode bro

like 8 versions

so many sdks

cache hell

[granite frigate]

256gb ssd

[native orbit]

4tb ssd

[granite frigate]

might be a good time to buy extra storage

[native orbit]

can find good deals on 8tb ext hdds sometimes

like $100-150

[granite frigate]

ooo nice

[hasty ruin]

no that's zefram encrypting your drive

you wanna know why i like C? there’s barely any difference in noticeable speed between -O0 and -O3. that’s a programming language done right 👍

[hexed knot]

you wanna know why i like C? there’s barely any difference in noticeable speed between -O0 and -O3. that’s a programming language done right 👍

#development message

[hasty ruin]

meanwhile swift mfs compile with -O0, and their machine is suddenly from 1953. then they turn on -O3, and suddenly their machine is from 2010 (still too slow for 2023)

i do

that's why I'm repeating it

[olive peak]

Is it possible to load a dylib from the app folder instead of the frameworks folder?

[torpid beacon]

Is there any way for me to use simulators without xcode

I hate Xcode so much

All I use is the sims

[bleak ingot]

spend money to get a real device

[torpid beacon]

Fuck

[hasty ruin]

ios simulators suck, just run it as a macOS app on apple silicon

[torn oriole]

Mac Catalyst my beloved

[steady nest]

@granite frigate iOS 8 requires XCode 11

If you want to use XCode of course, XCode 14 compiles for iOS 8 just fine

For debugging & stuff you need 11

[steady nest]

hi

[wicked summit]

wen eta port xcode to iOS

Then you can use the iOS simulator on iOS

Install xcode on the simulation

Recurse

[hasty ruin]

what can I even expect from a swiftui dev at this point...

[wicked summit]

SwiftUI development be like

Everything simple is very easy

And then you try to do something mediocrely complex

And realize UIKit makes life easier

UIViewRepresentable

[radiant idol]

sorry if this is a noob question, but how would one diff two frameworks across two versions of iOS? I’ve already exported the binary from their two respective versions of dyld_shared_cache, but I’m stuck on trying to understand how to actually diff them

trying to fix this somehow:
https://developer.apple.com/forums/thread/691233

[frail cedar]

swiftUI is good for simple stuff like setting up root views, tab bar etc

But most things end up using a lot of UIViewRepresentable

[tepid olive]

use Bindiff

[radiant idol]

Yeah but how

Is that a plugin for IDA or something

[primal perch]

yea

works quite well

[wicked summit]

Jesus

You can buy a $2400 iPad

[primal perch]

2400$ for a toy

quite expensive

[wicked summit]

At that point though you're really just buying 2 TB storage

If you get 2 TB storage on your iPad

You need to store your shit elsewhere

Well when Xcode is ported to iOS/iPadOS, there will be a macOS simulator, so you can work within the macOS simulator on your iPad, therefore being akin to and competitive with other laptops 👍

[gleaming wave]

anyone know where I can get toolchains of older frida versions? the ones on https://build.frida.re are no longer available

[faint lion]

You have sent a link to a repo, you can use the buttons below to open it directly in your preferred package manager.

[frank fossil]

been trying to untether Taurine kfd (phypuppet, smith always panics), panic here, any ideas why?

[half atlas]

Is there a channel for reversing?

[indigo peak]

if its development related sure

[ocean raptor]

It's very simple, just shift your car into reverse then press the gas peddle

[half atlas]

[frail cedar]

Does it work if you don't run it during boot?

Also how are you attempting to untether it?

[olive peak]

what if its automatic

[worthy rune]

what the

[slender glade]

Hello developers

[slender glade]

Really felt

But honestly for crazy smooth animations I think SwiftUI is better

[hasty ruin]

easier but less performant

[native orbit]

animations are bloat anyway

[hasty ruin]

true

[slender glade]

Certainly true

Even on newer devices

I wonder

If UIKit’s animation backend is just CA

and SwiftUI’s is too

Why does SwiftUI’s perform worse?

Maybe it’s because of all the tracking by @State and other value trackers

[topaz yew]

any1 ever do anything with https://github.com/Ingan121/FSUntether

[tepid olive]

it's basically just an autoexec and not a true untether on versions that don't support trollstore

not THAT useful but can be used to persist mdc tweaks and such as long as you keep the app signed

[topaz yew]

ah i see, thanks

[acoustic imp]

Would it be simple to make a tweak that replaces the FaceTime call button with just a sms/iPhone call button and then also make it so if you hold down on it the FaceTime options come up?

[slender glade]

So what you’d need to do here is to hook the view controller, then in some function like viewDidLoad, call orig and then set rightBarButtonItem

UIBarButtonItem has a init for one that executes a primary action, and also shows a menu when held

Something like

[hexed knot]

serena is the most helpful person here

[slender glade]

Thanks Joe

UIBarButtonItem(image:, menu:, primaryAction)

[acoustic imp]

K, no clue what that means but I will try to teach my self, thank you for this 👍

[pearl sail]

@hexed knot do meth bro

[hexed knot]

i do

[slender glade]

The objc equivalent would be like UIBarButtonItem itemWithImage: menu: primaryAction

[hexed knot]

every saturday

[slender glade]

First, find the name of the view controller

You can do this with FLEX

[acoustic imp]

Yep

[hexed knot]

close but no

that is the button

not the view controller

[slender glade]

Second, hook it

@acoustic imp Do you know about UIAction?

It’s a type which allows you to execute code on controls such as buttons and sliders but with a block (closure, in Swift)

[acoustic imp]

I tbh don’t know anything about iOS devolpemeant, but I want to learn

[slender glade]

This is applicable to UIBarButtonItem too

[acoustic imp]

This?

[slender glade]

Which is those buttons on the toolbar

[acoustic imp]

Is this swift?

[slender glade]

No, the view controller

[slender glade]

Both swift and objc

[hexed knot]

the viewcontroller would end with ViewController

[slender glade]

The view controller owns the bar

[radiant idol]

CKNavbarCanvasViewController

[slender glade]

Thanks night :)

[radiant idol]

👍

[slender glade]

So you’d do

[acoustic imp]

Ik html/css, if you could like make references to that it would be very helpful but it’s ok if u can’t

[slender glade]

%hook CKNavbarCanvasViewController

[acoustic imp]

I’m firing up my Mac OS VM jus gime a sec

[slender glade]

then

[radiant idol]

wait

CKNavbarCanvasViewController already has a callButton property

its just nil for some reason

[slender glade]

Well setting the bar button manually shouldn’t be an issue no?

Also when’d you call it for it to be nil

Which func

[radiant idol]

I didn't set it to nil

I just took a look at it in FLEX

[slender glade]

Yeah I know

But if it returned nil you may have called it in a function too early

Ohh

my bad

[radiant idol]

this is very possible though

the functionality is already there

[acoustic imp]

This stuff?

[radiant idol]

one just needs to figure out how to enable it

lemme mess around in flex maybe

[hasty ruin]

Fucking rookie

[slender glade]

unifiedCallButton it seems?

[radiant idol]

There’s some properties to control which kind of button is displayed

I’m taking a look at it rn

[acoustic imp]

Porbky

[slender glade]

A UIButton

So you’d just have to add the menu with the menu property

And add the primary action with the addAction function

Make sure you remove the existing action it has!

[radiant idol]

I’m super sure there’s a way to do it without overriding things

There’s probably some bool somewhere

[acoustic imp]

Couldn’t u just change the current action then add another ?

[acoustic imp]

This ?

[radiant idol]

No

[topaz yew]

💀

[acoustic imp]

What😭 idk I’m new to this

[topaz yew]

ah

[acoustic imp]

Never made tweak in my life

Only some ideas

@radiant idol find anything yet?

[topaz yew]

let me have a look at the class

[acoustic imp]

Me? How do I show u?

[topaz yew]

i didn't mean that i can find it

[acoustic imp]

Ah

[radiant idol]

give me a minute

[topaz yew]

or try

[acoustic imp]

This

?

[radiant idol]

no bruh

just let me see

[acoustic imp]

k

Sry I jus wanna try/help

[topaz yew]

nvm i dont have the class header

aka i wont be of much help

[acoustic imp]

What’s that?

[hexed knot]

its the thing that you hook

CKNavbarCanvasViewController

thats a class

[acoustic imp]

oh

[hexed knot]

the class is defined in a header

CKNavbarCanvasViewController.h

the .h file ending specifies that its a header

[acoustic imp]

Sry for my un knowing of classes, but that file is where all of like the rules/properties would be?

[hexed knot]

classes have properties yeah

when they are defined so are all of their "rules"

a class consists of properties, instance variables, and methods

[radiant idol]

this what you wanted?

[hexed knot]

you would declare (i said define i meant declare) those things in the header

[acoustic imp]

Yea, did u do that w flex?

[radiant idol]

No

just made a quick tweak

[acoustic imp]

oh

K, but could u jus send source code so I can look at it etc ?

[radiant idol]

yeah hold on

you can also do this

if you want

[acoustic imp]

Ok, u made 2 tweaks ?

[radiant idol]

no it's just changing a false to true

that's all

[acoustic imp]

got it

[radiant idol]

This is for only the call button

this is for the whole menu

[slender glade]

They want a menu too, tho

oh

will that show a UIMenu?

[radiant idol]

Yes

[radiant idol]

looks like this

[slender glade]

fire

[hexed knot]

@slender glade you are a telephony

[radiant idol]

When possible, try to use stock implementations instead of redoing things

[slender glade]

my bad

[radiant idol]

A lot of things can just be toggled with BOOLs, you'd be surprised

[slender glade]

never tapped into MessageUI so this is a TIL for me too

[radiant idol]

Yeah neither have I

[slender glade]

mfer you made tweaks for iMessage

[radiant idol]

@acoustic imp when compiling, make sure to use com.apple.MobileSMS instead of com.apple.SpringBoard

[radiant idol]

wym?

no?

[slender glade]

am i tweaking

[acoustic imp]

Ohh, so basically if the number/contact can only do one option, IE call that person aka no FaceTime, iOS will just default that button to the only option you have? @radiant idol

[radiant idol]

yes you are

[slender glade]

isn't it that one tweak that was called one smth

[radiant idol]

thats right

[slender glade]

Yes

[radiant idol]

OneSettings?

[slender glade]

oh that

[radiant idol]

yeah that's for the settings app lol

[hexed knot]

who made that 3 dollar uicolor tweak

[slender glade]

thought it was called like OneUI

[hexed knot]

mf oneui is the ui that oneplus phones use

[slender glade]

this describes so many people

[hexed knot]

true

[slender glade]

no it's for the samsung

[hexed knot]

same shit

[slender glade]

wtf it's not

[hexed knot]

both droid

[slender glade]

he thinks he's kiryu

[hexed knot]

yup

[slender glade]

it's actually kind of insane how many mfers post 2017 released paid tweaks that were basically hooking the LS time

and nothing else

[radiant idol]

There's some cool ones tho

I like the look of Kalm

[slender glade]

Kalm deserves it that one was cool as hell

[hexed knot]

i dont really get how ppl can make expensive tweaks

[slender glade]

u don't deserve 2 dollars for adding seconds to the time tho

that was fucking insane dude

i forgot the name

[radiant idol]

Yeah ig

[hexed knot]

like mfs are telling me to sell joe for 2$ $2.50, mf i want it sold for 0.99 maybe 1.49

[slender glade]

yeah

[radiant idol]

whats joe

[hexed knot]

im selling it for 0.99

it doesnt deserve to be the same price as the other aio tweaks

it has nowhere near the same amt of features

[radiant idol]

.

[hexed knot]

joe

[radiant idol]

no seriously

[slender glade]

I think people automatically attribute part of the value to just it being a tweak

not the tweak's features itself

[hexed knot]

https://chariz.com/get/joe

[hexed knot]

idk bruh

[radiant idol]

brother

I cannot see the details

[slender glade]

You know what is available for purchase?

[radiant idol]

what

[slender glade]

https://chariz.com/get/antoine

[hexed knot]

u dont deserve to 👍

[radiant idol]

https://cdn.discordapp.com/emojis/1031490165669101579.webp?size=48&name=uh&quality=lossless

[hexed knot]

i have 1 complaint with antoine

[slender glade]

what is it

[hexed knot]

it doesnt log message when sbreload

[radiant idol]

"i think its a really easy fix"

[hexed knot]

but it does with killall -9 SpringBoard

[slender glade]

what

[hexed knot]

like

[slender glade]

oh

how lol

[hexed knot]

messages arent logged during sb being loaded with sbreload

but it does with killall

[slender glade]

I get u now

wtf lol

idek how

oh

the app being killed too ig?

hm

idk how that'd be fixed

[hexed knot]

idk

antoined

[acoustic imp]

I mean, u could just respring w the TS method, idk, apps don’t get killed when u respring w TS

[hexed knot]

yeah i could just killall -9 SpringBoard

its not a problem that i need fixed immediately

[slender glade]

so keeping antoine alive through sbreload

hm

[radiant idol]

https://github.com/opa334/TrollStore/blob/ea52074779f2e78ffabf1dc28a58550b123ce373/Shared/TSUtil.m#L275

[zenith hatch]

gm

[radiant idol]

this is how it resprings

[zenith hatch]

gm serena

[hexed knot]

that is infact killall

[slender glade]

gm

[radiant idol]

very true

[slender glade]

i got the name from when i was sleeping in french class when they were reading convos and i had to read the part of the guy called Antoine

(i butchered every word)

[hexed knot]

one of my boys is named antoine

in 8th grade he was eating fruit snacks in the bathroom

[slender glade]

show them this app and be like my friend named an app after u

[slender glade]

i did this w normal chocolate at the door

[hexed knot]

and when someone came in he got scared and dropped them all on the ground

[slender glade]

lmfaoo

[hexed knot]

he was in the stall

[acoustic imp]

@radiant idol could you dm me the to “codes” for the call button tweak thing, discord wount load the messages, I have like 2 bars

[acoustic imp]

Thank u

[next wadi]

what the fuck

how

[hasty ruin]

now ban jaidan

it's only fair

one in, one out

[slender glade]

Using private os_log apis

os_log_stream iirc

[hasty ruin]

i assumed he meant how are you back

[next wadi]

yes

[slender glade]

Ohh

Well @next wadi

I don’t know either

lol

[faint timber]

Who ghost pinged me in here

[primal perch]

https://cdn.discordapp.com/attachments/855848056163401728/1092479547687043184/watermark-1.gif

[hexed knot]

@ocean raptor i think i heard u have a fix for building tweaks on ios 15 arm64e with the toolchain on linux

is that true

dude went offline asap

[vivid dew]

me

[primal perch]

oh

[ocean raptor]

I don't know what that means

[hasty ruin]

if you can't use a new abi tc, you could use allemand to patch your dylib ig

[hexed knot]

what is allemand

found it

[hasty ruin]

dont forget to patch the prefs exec too

[hexed knot]

isnt allemand also shit bruh

cant i use a new abi toolchain on linux

do those exist

[ocean raptor]

I think kabir's toolchain is the new abi?

@nimble parcel

[hexed knot]

i'll try it out

[nimble parcel]

it’s based on OSS swift which afaik still has the old ABI unfortunately

[ocean raptor]

Ah

Wait fr?

[nimble parcel]

unless Apple finally updated their LLVM sources

[ocean raptor]

I thought llvm had new abi but ld64 609 didn't

[nimble parcel]

oh, does it?

[ocean raptor]

ld64 7XX came out and supports new abi but cctools-port hasn't been updated I think?

[nimble parcel]

interesting I’ll see if I can update my ld then

[ocean raptor]

I did a small port

https://github.com/CRKatri/ld64/

Uses meson

And only supports darwin and FreeBSD

I think

[primal perch]

puredarwin

🙏

[ocean raptor]

https://github.com/CRKatri/ld64/blob/main/EXTERNAL_HEADERS/non-darwin/mach-o/dyld.c

This just need a Linux version

And it should work

[nimble parcel]

thanks for the heads up, gonna look into it after my finals end on Tuesday

[ocean raptor]

I did a cctools port too, which only supports FreeBSD too

[nimble parcel]

they also updated tapi to v5

[ocean raptor]

https://github.com/CRKatri/cctools

[hasty ruin]

gl

[ocean raptor]

The update from a while ago? Cause I ported that to properly build as a llvm subproject

For like llvm 16? 15?

[hasty ruin]

ayo @primal perch

[primal perch]

gm

[nimble parcel]

not sure how long ago it was but afaik v5 is used in the betas

[ocean raptor]

https://github.com/CRKatri/tapi

https://github.com/CRKatri/tapi/commit/414d3009f372b35f857d61bf321e7262ebddebb6

I haven't really been interested in iOS recently though

[nimble parcel]

looks like this is up to date yep

[frank fossil]

It’s still a hit or miss. panic message: pmap_remove_pv: unexpected PV head
I was just reusing launchd haxx

[faint timber]

stuff like that occurs when you call the same pmap code on a process that already had the pmap code run

[wicked summit]

Final exams 😵‍💫

I'm not ready to go back to school 😵

[tepid olive]

my guess is that during boot there’s way more activity so it may need more puaf pages

[frank fossil]

Hm then guess I’ll try: exploit -> execve real launchd -> electra.jailbreak()

[unkempt magnet]

I can sure to say that exploit from now..
success rate: cicuta_virosa >= kfd
speed: cicuta_virosa <<<<< kfd

success rate of king: checkm8

[elder scaffold]

checkm8: 99.9%
blackbird: 99.9%

[slender glade]

I like having SEP

kfd success rate isn't bad

it's like, 1 in 5 or 1 in 4 on my iPhone 8

[pine holly]

Still waiting on arm64e

💀

Banking on taurine or this phone not making it much longer

Battery is killing itself and it runs hot cause of Fugu

[bleak wagon]

Ppl bypass never?

Mb we will get lucky on a crazy WebKit commit lol

[slender glade]

You may as well ask gaddafi for it

[bleak wagon]

Lmao

[elder scaffold]

This is the first time since 14.3 that a userland arm64 (non-e) jailbreak is being developed.

[granite frigate]

what was the last one

[slender glade]

14.3

what do u think mf

[granite frigate]

i mean what was the last jb 😭

[slender glade]

GUESS FROM THE NUMBER SACRO!!

[granite frigate]

taurine had e so is that counted? unless im misunderstanding

nvm im just stupid fr

[slender glade]

i think both non arm64e and arm64 count

[granite frigate]

oh i get it true

[slender glade]

@naive kraken Does dopamine have any way of giving itself entitlements post exploit?

Need this rn for task_for_pid lol

[naive kraken]

no

inject to trustcache, spawn binary

then you get whatever you want

[slender glade]

Yeah but we're trying to handoff krw

[naive kraken]

just do it via page tables

[slender glade]

from app to jbd

[slender glade]

is this what dopamine does

[naive kraken]

yes

[slender glade]

I hope that function is not A12+ then

[naive kraken]

it's not

[slender glade]

thanks :)

[naive kraken]

it should be even easier on arm64 but it would require you to understand how it works lol

https://github.com/opa334/Dopamine/blob/master/BaseBin/libjailbreak/src/handoff.m#L54

[slender glade]

Thanks goat

@tepid olive guessing we'll need to change handoffPPLPrimitives accordingly w non arm64e but i think it should be easy

[frank fossil]

yeah so exploiting before launchd seems works, now it's looking for amfid and real launchd

Unable to get launchd: 32
Waiting for amfid to register
... (keeps spamming even after fully booted up)

[tepid olive]

make it try to get launchd again

[olive peak]

How can i make a loop run in an already existing thread that the app created in my tweak?

Or anything run in that thread from my tweak if that makes sense

[tepid olive]

wait nooo

@frank fossil make the exploit run before launchd is spawned then run the jailbreak code whenever amfid is alive

[frank fossil]

For amfid I can probably reuse u0Launcher, not sure what to do with launchd (fix process name?)

[tepid olive]

You know you could just replace amfid instead of launchd

[frank fossil]

It defeats the purpose of untether: amfid only runs during open developer signed apps, which requires first unlock (that’s why u0Launcher exists)

[steady nest]

nop

[tepid olive]

ah okay

[steady nest]

it doesn't launch on boot and it not being trustcached makes you unable to open sideloaded apps

replacing launchd is fine from what I remember

[frank fossil]

Also iirc replacing any binaries other than launchd will cause panic unexpected exec of non-platform binary because it checks against trustcache

[naive kraken]

it's dumb how easy this would be to untether with a PPL bypass

[steady nest]

wdym

how'd that make it easier

[naive kraken]

you can literally just run exploit, patch dyld, trustcache basebin stuff, then execve the real launchd with an env variable to insert a hook into it

you'd still need to transfer primitives through the execve like I did in boomerang but that'd literally be it, from that point on the device would be jailbroken

[steady nest]

what if... you replace and resign dyld itself 😛

iirc resigning dyld would panic, but changing a single byte in dyld and resigning it worked

I don't remember if any issues from that arised

[naive kraken]

won't work

[olive peak]

without hooks

is what i meant

cuz i want to call other functions inside of the threat which only works from the same threat

Does anyone know of something called lib_evil? I heared someone say he can do lots of hooks on jailed using it. Also showing proof.

[timid furnace]

@grave sparrow GM

why does apple use absolute and image relative pointers

and chained fixups

sad

[frank fossil]

Oh well in fact Taurine has built-in amfid wakeup but doesn't work in untether for some reason

[naive kraken]

yeah xpc doesn't work when you're launchd

and especially not if you're executing before launchd

[slender glade]

?

I thought launchd itself used xpc?

[naive kraken]

launchd IS xpc

[slender glade]

ohh

yeah

[naive kraken]

like xpc sends a mach message to launchd which then sends it to the target

[slender glade]

I did hear that the backend is quite literally bootstrap functions and xpc

[slender glade]

i see

it just hit me after so many months now lol

[naive kraken]

And if you're launchd you're sending a mach message to yourself which will lock up the thread forever

[slender glade]

wyd for IPC then

[naive kraken]

pound sand

[slender glade]

lmao

but doesn't dopamine contact jbd through XPC in launchdhook?

[frank fossil]

I tried the wakeup code from terminal, still couldn't wakeup amfid, I have mach-lookup added. Probably sandbox issue? gonna take no-sandbox off

[granite frigate]

#779151007488933889 message

[naive kraken]

yes it does it through host special port that jbd is assigned to

[bleak wagon]

can launchd be overwritten as binary without a valid code signature

[slender glade]

bootstrap_look_up & bootstrap_check_in?

[slender glade]

thanks sacro

[naive kraken]

you can also find the private symbol to send a message synchronously yeah that's what linus is referring to

[slender glade]

ic

[frank fossil]

Yeah see haxx repo, it has launchd example

[bleak wagon]

Was this not patched?

[granite frigate]

14.x only

[slender glade]

How would they patch this

[granite frigate]

wasn't the haxx thing only from 14 to 14.8.1

[slender glade]

wasn't that bc of the exploit

[granite frigate]

oh true

i don't think the method itself would be patched ya

[frank fossil]

rootless in iOS 15 "patched" it I guess

[bleak wagon]

This is what I thought

If I am wrong, thank you guys so much

[gaunt helm]

@slender glade sewena

[slender glade]

Melena

[gaunt helm]

[olive peak]

He clearly hooked more than 6 functions tho, i will ask him about it then.

[slender glade]

[granite frigate]

what is a "jailbreakd" supposed to do? I was looking into what Electra does and it just says it keeps "task port open and runs a local server listening for commands" but i'm pretty sure it has a lot of other responsibilities. I was looking at dopamine src but i'm not sure what fakelib and trustcache does https://github.com/opa334/Dopamine/blob/e54df9148f082bc43f7c62ecfc4a74f1fcd37a9c/BaseBin/jailbreakd/src/server.m

[slender glade]

Among other things, jailbreakd handles requests that come in from other hooks

for example

if a program wants to use setuid

when that program is started, then launchdhook will tell jailbreakd to fix up the setuid function for that program

This is needed for stuff like Sileo's givemeroot and the thing that zebra uses

[granite frigate]

these hooks?

[slender glade]

Indeed

they communicate to each other through XPC, much like most of iOS

for example when you open the photo picker that Discord and some other apps use (called PHPickerViewController), that's using XPC from the Photos app

[granite frigate]

Oooo ic

[slender glade]

Or whenever you open an app, Springboard uses XPC to communicate w UIKit and tell it to start up the app by informing the app's UIApplicationDelegate

there's some more stuff that jbd does

but in short, think of it as the middle man of fixing up jailbreak related stuff

[granite frigate]

alright bet

wait so why did older jailbreaks not need a middle man

was it just not broken before

[slender glade]

before iOS 11, jailbreaks would directly patch what was needed, but on iOS 11 jailbreaks would require you to talk with libjailbreak or whatever their equivalent was, directly, then we got jailbreakds

iirc, electra did this

you couldn't just setuid(0)

[granite frigate]

ohhh

[slender glade]

you had to open the libjailbreak from your process

and tell it to platformatize blah blah

and then you could setuid

but the devs figured that's kind of a hassle so they just started doing that in jbd, starting with Electra

[granite frigate]

wasn't electra kinda notorious for having a crappy jbd

[slender glade]

not sure what it's reputation was

but it was basically the only open source jbd we had until fugu14 or 15

[granite frigate]

i see aight

[ocean raptor]

that's iOS 11, before that, they were able to do more patches to things so that jailbreakd was unnecessary

[slender glade]

i see

my bad

[ocean raptor]

Cause things like kpp didn't exist

[slender glade]

updated

thanks

[granite frigate]

Found this https://github.com/coolstar/electra/blob/master/docs/getting-started.md

basically what you said

[slender glade]

memories

holy fuck electra is 6 years old now

[blazing warren]

0.0000000001% succes rate

[slender glade]

It was 27% getting it to work was a struggle lmfao

then they found some way it to make it way better

[blazing warren]

it was a real pain to jailbreak with electra, 50 tries or more. then tor came out and jailbreaked the first time. coincidentally after tor electra solved the problem and also did it the first time

[slender glade]

lmfao

[blazing warren]

[slender glade]

no way i was filtered

[blazing warren]

https://tenor.com/view/thor-gif-21643627

[slender glade]

lmfaoo

[ocean raptor]

No way you're a Thor user

[hasty ruin]

💀

to piracy, not skidware

[blazing warren]

nexus malware detected

[hasty ruin]

https://tenor.com/view/letter-r-gif-9063762

[restive ether]

moron

[hasty ruin]

1984

[restive ether]

you’re weapons grade stupid

[vivid dew]

cuck

[hasty ruin]

hbd

[slender glade]

?

who keeps deleting all my messages

[granite frigate]

schizoposting

[vivid dew]

are the messages in the room with us right now

[hasty ruin]

https://tenor.com/view/in-your-walls-family-guy-gif-25842489

[slender glade]

No because you just deleted them

[vivid dew]

basically i control capt like a wooden puppet

[slender glade]

oh

(?)

[hasty ruin]

[vivid dew]

see i don't even have to say anything and he starts hornyposting

[topaz yew]

smart

[radiant idol]

Indeed

[granite frigate]

wait then how did unc0ver do shit without a jbd

No inefficient local jailbreak server (jailbreakd daemon)

[slender glade]

u0 had a libjailbreak

[granite frigate]

ohh

[slender glade]

“inefficient” lmfao

[slender glade]

If you look into any one of sam’s cli tools like that one snapshot tool he made

There’s code there for libjailbreak

[granite frigate]

oh

ok makes sense

thanks

[slender glade]

Yup

Yw

[ocean raptor]

Umm

I think that may be for electra compat

But u0 does have a jailbreakd, but they call it substituted or substrated

[hexed knot]

i believe you can shut up

nope dont have it

[naive kraken]

those both aren't jailbreakd's

unc0vers jailbreakd logic is in launchd

[ocean raptor]

Ohhh

Someone told me it was in substituted

[naive kraken]

idk

I could be wrong here

[pearl sail]

Audited your life and still an L

[hexed knot]

https://tenor.com/view/shut-up-man-will-you-gif-18636332

[slender glade]

I’m pretty sure that every jbd now loads Foundation too lol

I don’t think anyone really cares tbh this is mostly a performance freak thing

Okay well what are they supposed to do

[slender glade]

Sorry lemme write my own impl of all CF functions

Idk lots of miscellaneous uses

[ocean raptor]

plist parsing

CFBundle opening

[slender glade]

I hate you capt

Like

[ocean raptor]

Do they use swift in the kernel yet?

They should

[slender glade]

I’ve been trying to convince them

I’m gonna do it just to spite ur ass

watch me… kernel_start in SWIFT

You know

That’s not a bad idea

[ocean raptor]

Can swift compile UEFI programs?

[slender glade]

Great Q

prob not as it is

Exists

but the stdlib takes up a mb so

‼️‼️

[ocean raptor]

That's easy

[tepid olive]

probably already does

it’s in sep

[primal perch]

no wonder they’ve been so buggy this gen

[ocean raptor]

Doing it right now

[primal perch]

fr

that’s why i’m doing hardware

largest cock

[ocean raptor]

Anyone know how to stop colleges from sending me emails?

[primal perch]

ok only maybe i’m not sure yet

[ocean raptor]

I accidentally gave the college board my email like 2 years ago

[slender glade]

lool same

[tepid olive]

TASTE

[primal perch]

https://tenor.com/view/sorry-for-your-loss-sympathy-prayers-flower-gif-16425612

[ocean raptor]

Luckily they're all going to my school email

[slender glade]

I’ve been getting like 20 emails these last few weeks of colleges just saying “please take a look around :)@

[ocean raptor]

I only played that for the screenshot

I don't actually listen to Taylor swift

[slender glade]

I’m dead

[primal perch]

chad

[tepid olive]

i hate u nvm

[primal perch]

honestly she’s fine just not really my thing

[tepid olive]

coldplay = lana del rey

[primal perch]

i only hate on it to shitpost

and lana

[slender glade]

what

[tepid olive]

no theyre so fucking hot

never seen a mid typescript dev that’s all i’ll say

[slender glade]

I’ve never met a good looking js dev they’re all tech bros with beards

[tepid olive]

ts

not js

[slender glade]

That’s a whoooole other topic in terms of the devs then

Idk how people who primarily write TS are way more level headed than primarily JS

[tepid olive]

ugly gross and smelly

swift is a language for the LADIES

typescript is for the men

[slender glade]

Many have been saying this for a while…

[tepid olive]

c is for the otherworldly nerds

[slender glade]

C is for mfs who piss in the sink

[tepid olive]

swift is elegant and glamorous

it would solo headline vogue magazine

would

[slender glade]

@tepid olive opinions on rust devs

I think a lot of them are talented but they have this natural instinct to just be cringe

[ocean raptor]

💔

[slender glade]

You’re not wrong but you don’t use anything but c…

So you’re on the same level imo

[hexed knot]

yeah theyre really talented if they can read rust

rust is the shittiest syntax ever

[slender glade]

Rust is readable

[hexed knot]

ugly ass lang

[slender glade]

I just fucking hate that ‘ syntax

Implicit returns there are also kinda dumb, not unreadable, but the way they’re handled is stupid imo

[ocean raptor]

Any language that uses <> sucks

istg they are the worst characters in all of ascii

[slender glade]

You’ll not be given access to the gates of heaven

[ocean raptor]

It's just so ugly

[slender glade]

struct Something<Result>

how else would u do this for generics

[native orbit]

swift on top

[slender glade]

I’m saying

[native orbit]

they just lacking tbh

i hated swift at first

[ocean raptor]

Idk

[native orbit]

then tried it, now i realized that its good

[ocean raptor]

But <> not being full height just makes them so ugly

Makes it hard to read

[radiant idol]

swift is also generally an ugly language imo

[slender glade]

What? You have mental illness

[slender glade]

I disagree

[radiant idol]

I never said objc wasnt also ugly

[native orbit]

swift looks nice if u know how to write nice looking code

[slender glade]

Objc blocks are the ugliest things I’ve ever seen

[radiant idol]

.

[slender glade]

Bro already knew what I was gonna type

😭😭

[radiant idol]

Indeed

[slender glade]

Ok but like

Swift is not ugly

[radiant idol]

the amount of ??!?!!?! makes it ugly

and the generics

blegh

[native orbit]

swiftui can get messy

it also sucks

[slender glade]

OK BRO

c or any derivative of c excluding assembly because it’s not one of those

[radiant idol]

someone's angry

https://cdn.discordapp.com/emojis/861739890362286120.webp?size=48&name=elTroll&quality=lossless

[hexed knot]

swiftui is not worth bringing up because everyone already knows it sucks

[primal perch]

me

[slender glade]

Didn’t you get into a car accident a year ago

How’s that leg holding up bro

[primal perch]

took an interesting turn

[hexed knot]

yeah lowkey

[slender glade]

I’m joking it’s not them

it’s <redacted>

They go on schizo rants on twitter regularly

[radiant idol]

serena what

[hexed knot]

that does not narrow it down at all

still could be anyone here

[slender glade]

They got banned 2 years ago

m

[primal perch]

oh yeah that dude

[hexed knot]

oh miss that dude

[primal perch]

the transphobe

[slender glade]

He’s insane man

[primal perch]

dude went off in back rooms

[slender glade]

Crazy that he was like one of the 2 people good at tvOS stuff

And the other dude just disappeared from this server

[hexed knot]

@ivory prawn

[primal perch]

tbf tho just buy an nvidia shield

[slender glade]

👁‍🗨

[slender glade]

I miss this Mfer

[hexed knot]

fr

dude was kinda annoying sometimes but he still cool

[primal perch]

capt

[slender glade]

we bullied him I feel bad

[primal perch]

.png

[hexed knot]

no capts not cool

#jailbreak message

[slender glade]

That’s his last message?

[hexed knot]

yerah

[slender glade]

lmfao

He just dived into crypto and dipped on us

[hexed knot]

he jus like me

[slender glade]

U broke as fuck propr

[primal perch]

brokies

https://tenor.com/view/brokie-andrew-tate-meme-andrew-tate-memes-gif-26783954

[hexed knot]

i am not broke

[primal perch]

proof?

[hexed knot]

not anymore

[primal perch]

send iphone 14 pro max 1tb

[hexed knot]

i think this is pretty good proof

[primal perch]

a z590 and a rtx 3070

yeah i’m convinced

[hexed knot]

in full

1.1k

1.2

[primal perch]

oh word you got that christmas money

[hexed knot]

who gets 1.2k for christmas

[primal perch]

democrats probably

[hexed knot]

how

democrats are poor

[slender glade]

1k used to get u a whole computer build this is crazy

[pearl sail]

fr I wanna be in that democrat’s house

[primal perch]

cus their parents are chad republicans

and have money

because they work

[hexed knot]

the gpu is expensive bc it has a screen

i got it all for msrp

i got the other parts discounted bc of where i work

[slender glade]

Oh

Mashallah

[hexed knot]

mashallah fr

alhamdulillah for where i am

started out from the bottom, got lower, now im up here

[tired crag]

bro couldn't spring for the fhr either

[primal perch]

unfortunate

[hexed knot]

i got what newegg shuffle gave me

[primal perch]

we out here on fhr cards

[hexed knot]

i didnt get a z590 cuz i wanted it i got it bc i had to get it'

[primal perch]

paid itself off in 2021

[hexed knot]

i didnt pay 900 dollars for the gpu bc i wanted to

i had to if i wanted to get a 3070

[tired crag]

$900
$499 msrp

[primal perch]

paid 499

still feels good ngl

🍑

[hexed knot]

it has a screen therefore its 400 more

[primal perch]

word

[hexed knot]

also 3 fans and rgb

and its msi so

[primal perch]

g*gabyte

[hexed knot]

i mean gigabyte

not msi

[primal perch]

https://tenor.com/view/gigabyte-psu-gamers-nexus-pc-bomb-planted-gif-22845602

[ocean raptor]

Y'all are all broke

I just got a raise today

[primal perch]

he up to 17

🙏

[ocean raptor]

$20

I was $18

[indigo peak]

i was making 96 🥱

96 for the 2 weeks

not an hour

[slender glade]

96 dollars for 2 weeks?

[indigo peak]

yuh

we making BANK

[slender glade]

bro is working in the mines

[primal perch]

fr

[primal perch]

nice same

same previous too

we are holding the bag

https://media.discordapp.net/attachments/688122301975363591/1033962648494149632/3dgifmaker01679.gif

[visual meadow]

https://github.com/Odyssey-Team/Taurine/blob/825424a24cb22da81644724067e3c2a2fea3a2d2/Taurine/post-exploit/utils/offsets.swift#L106
to whoever said 14.4+ a12 issues are this

is wrong

its still 368 in 14.4

[native orbit]

its been 0x368 since ios 12

[visual meadow]

Thats crazy

I want to die

i spent 2 hours

[native orbit]

rip

[visual meadow]

Dude

what offset is it

im deadass

like

[native orbit]

the 0x368?

[visual meadow]

no like

what offset isnt working with amfi on arm64e

14.4

I might just turn my pc on and bindiff 14.4 and 14.3

Ok 14.3 is analyzing

[pine holly]

👍

[visual meadow]

thats cool

it wont even bindiff

[pine holly]

💀 ever figure it out?

[visual meadow]

no

[pine holly]

Yikes

[visual meadow]

and then it does not diff

and then i want die

[pine holly]

What smart person would know what to do

[faint timber]

diaphora 3 gonna work the best

[primal perch]

@timid furnace me realizing you made usbtoolbox

https://tenor.com/view/thats-it-yes-thats-it-that-right-there-omg-that-thats-what-i-mean-gif-17579879

slaps

[native orbit]

zefram

[primal perch]

zefram

[torn oriole]

shitram

[primal perch]

true?

!

[hasty ruin]

!

[visual meadow]

you know when people respond like this to questions

_ _

_ _

oh and

_ _

_ _

the best part is

_ _

and dont forget

_ _

feels great doesn't it

Like the best responses ever

Has helped me solve many issues

[primal perch]

https://media.discordapp.net/attachments/688122301975363591/1033962648494149632/3dgifmaker01679.gif

[hasty ruin]

https://media.discordapp.net/attachments/688122301975363591/1033962648494149632/3dgifmaker01679.gif

[cloud yacht]

I can't grow a beard yet

[hasty ruin]

Go on then, compare numbers

But yeah I agree

[olive peak]

Is @rpath the path to the frameworks folder?

[slender glade]

No

[olive peak]

Where does it usually go?

If i want to load a dylib inside of the .app folder of an app, what should i change the id of the dylib to?

[slender glade]

@olive peak rpath is just a pah at runtime that would be used to look for libs/frameworks

u can point it to the frameworks path

ie

-rpath @loader_path/fallback, where fallback would have frameworks

it's a search path at runtime