development

[slender glade]

u know old people they’re all angry and poisoned by lead

[indigo peak]

ig it runs in the family

[slender glade]

Bro chill later

[hexed knot]

you can never lose

you either win

or you learn

the only time you lose is when you dont try

[visual meadow]

Also I always make dumb choices

Even if they end in the worst consequences

[slender glade]

Nathan stop typing for a second

Lemme tell u smth

if u keep saying this then you’ll just find yourself in an abyss of despair constantly sad and anxious and you won’t achieve what u want

You just need to keep practicing this shit more and more and you’ll get better at it

There’s some stuff u can do better socially for sure

But you’re not a bad person bro

[native dune]

damn it sounds like you're a human

[visual meadow]

I spent like 3 weeks on the same thing

no progress

What's the point

[steady nest]

and the older you get the worse it gets too

[slender glade]

it took napoleon 4 weeks to invade Russia

‼️

Time don’t mean shit

sometimes

but in this case too

[slender glade]

for sure

[steady nest]

bro I restarted an iOS 8 jb 3x

it’s been like a year

[visual meadow]

You know the only code I changed is the code that makes the JB button grey out

[slender glade]

Nathan

[visual meadow]

and say Unsupported

[steady nest]

not like you’re going to learn everything in one day

[visual meadow]

It's been 3 weeks

[slender glade]

I think you should be the guy who pisses in the shower rather than the guy who gets pissed on in the shower

[visual meadow]

or so

[steady nest]

if you don’t try you don’t succeed

[naive kraken]

Nathan reminds me of 2016-me

[slender glade]

So I think you just need to keep practicing bro

#development message

[naive kraken]

trying to plug ziVA into some project zero sandbox escape

[slender glade]

look at my questions man

[naive kraken]

without any idea on how to do it

[slender glade]

I was dumb as FUCK

But now I practiced more and more

And I’m way better at this shit

Im no coolstar but im not at the same level as I was 2 years ago

[visual meadow]

I mean I should know more since i first was in this server in 2018

[naive kraken]

https://github.com/lilpump1/ziVA-Triple_Fetch like what this guy did but he also just put both folders in the same repo and didn't figure out how to do it

[slender glade]

See @visual meadow

I didn’t even know how to use git till like late 2021 man

Keep practicing we’ll help you

You just need to be a little less insistent

[visual meadow]

I Mean atleast he had ideas

[slender glade]

And more patient and independent

[visual meadow]

and me i have no clue where to start in said project

[naive kraken]

if you don't know where to start, pick something simpler

I had NO CLUE how jailbreaks worked like in the beginning of 2022 btw

[steady nest]

bro most devs in my company don’t know how to use git

it’s super annoying

[hexed knot]

im convinced nobody knows git

they just google it

[steady nest]

nah it’s even worse

[visual meadow]

You had other experience though

[steady nest]

to the point they don’t know how to commit

or what a pull request is

[naive kraken]

yeah because I picked something simpler and did that

[steady nest]

the other day a SENIOR DEV asked what an IP was

[visual meadow]

Yeah TrollStore

[steady nest]

what’s that number with dots?

[naive kraken]

no

I mean

2016 type level simpler

the world was simpler back then too

[steady nest]

yeah

[visual meadow]

I mean I would know

[steady nest]

That’s why I’m making the 8 jb

[visual meadow]

thats when i was firwst on discord

[steady nest]

to learn

I can just patch everything there

[visual meadow]

https://thehackernews.com/2023/08/new-apple-ios-16-exploit-enables.html
I wonder how they even hook it

they must have a ppl bypass and everything

[naive kraken]

what you mean threat actors have ppl bypasses? no way lol

https://i.seadn.io/gae/TT4QcMO0FNxslpQrrtVm3hxlgKDoZPa8pFdec1i0vTaApZZ_81bWNNmOV-oy2nwKTuTb3qsF3X7o9ALqKpn683pzbJzvR81Q6AaswQ?auto=format&dpr=1&w=1400&fr=1

[visual meadow]

Wish I had that

I hate apples lockdown bullshit

I just hope apple didn't change anything arm64e related that happens to be in jailbreakd

and

cs wont give src

and

def wont fix it

[native dune]

we need real apple dev mode

[visual meadow]

therefore

[native dune]

fr

that'll never happen tho

[steady nest]

palera1n

they’re using mshookfunction

[visual meadow]

I mean the device they're using is most likely a arm64e one tho right

or

Funny

How do u know that

[indigo peak]

could be a X

[native dune]

LTE on atnt, probably arm64 device

[indigo peak]

so

palera1n

[native dune]

carriers now of days have 5G almost everywhere

[elder scaffold]

hey

[native dune]

hi

[steady nest]

https://vimeo.com/854784084/5b1f111960

[indigo peak]

@visual meadow

MSHookFunction()

[visual meadow]

Where'd you find

oh

[indigo peak]

https://www.jamf.com/blog/fake-airplane-mode-a-mobile-tampering-technique-to-maintain-connectivity/

[native dune]

isn't jamf that one MDM service

[steady nest]

meo

w

[primal perch]

meeow

[elder scaffold]

solution
1, Power off
2, Hardware-based forced reboot
3, Turn on airplane mode
4, Power off

[primal perch]

https://tenor.com/view/furry-friday-furry-friday-braixen-pokemon-love-gif-23479407

[visual meadow]

I'll stay on 14.4 until 16.5 ends and if i dont have the jb done ill update

[indigo peak]

https://tenor.com/view/boondocks-read-rap-fans-exorcism-uncle-ruckus-gif-23038600

[elder scaffold]

I remember making a 9.3.4-9.3.5 jailbreak for no reason

I need to investigate the current jailbreak around the end of September

my knowledge is clearly outdated

[visual meadow]

lol my knowledge does not exist

[elder scaffold]

whar

me

ow

[primal perch]

lmao

[steady nest]

meeow

[visual meadow]

u made a jb and i made a ass script that half the time doesn't work

[steady nest]

works fine for me tho

[primal perch]

meeow

[visual meadow]

I made it because i didn't want it to use python

Even tho people kept telling me to use pyimg4

It was too slow

[primal perch]

cimg4

[visual meadow]

pretty sure my script is the only thing that supports 15+

[steady nest]

supports 8

[primal perch]

https://tenor.com/view/dfm-wax-appeal-gif-18574175

[steady nest]

https://tenor.com/view/spin-chair-spin-spinning-chair-foldable-chair-gif-27635879

[primal perch]

https://tenor.com/view/spin-chair-spin-spinning-chair-foldable-chair-gif-27635879

surcropus

[elder scaffold]

This year we had clear good artifacts
sockport2 legacy
This made ios9jb reliable and made 8.x stable jailbreakable.

[visual meadow]

Barely

I need to make the binpack from scratch

[steady nest]

[steady nest]

oldcursus gang

if only zebra worked back then sigh

[elder scaffold]

I'd like to see a new one after fixing some bugs in it in September

[steady nest]

8.x?

or latest

[elder scaffold]

latest

8.x has to re-restore my 5s once and it takes time so i want to do it later

I don't have time right now.

:/

[steady nest]

Adult life gang

[steady nest]

Cydia eraser?

or you’re afraid of hfs compression stuff

[elder scaffold]

I'm going to restore rootfs via SSH

I've done it on 9.0.2 so it should be fine

[steady nest]

I need to revisit that later

Since now mounting mnt2 is possible

[elder scaffold]

nice

[pine holly]

This is the reason you can’t get shit done

You have 0 motivation

Fuck 16.5 just figure the shit out. Only way you will learn 🤷‍♂️

[primal perch]

https://tenor.com/view/flygon-hot-pokemon-pokemon-memes-furry-gif-25673027

[native dune]

oh

[primal perch]

oh

[pine holly]

Lmfao

[steady nest]

https://tenor.com/view/sesame-street-kermit-the-frog-kermit-fapping-watching-frag-porn-gif-16905446

[snow python]

Hey wait

[faint timber]

[primal perch]

fr

[hasty marsh]

@stray zenith :3

[pine holly]

Stfu femboy

[hasty marsh]

bro instantly responded 😭

[pine holly]

Get spawn camped

[topaz yew]

hey, how do sandbox escapes generally work?

[pine holly]

I love that I’m still in your pro

*pfp

It warms my heart

Ayo @native dune are you active

Super not important

[native dune]

idk why

[pine holly]

Fact to one of my messages real quick

Just do it

Then ping me

Twitter wants me to send you tips

[indigo peak]

kfd location spoofer where???

[primal perch]

sandbox no works

you app be free

[topaz yew]

fr

[unkempt magnet]

just questions.
Why value of self_proc from kcalling has not completed value?

self_proc: 0xfffffff27fb44000
self_proc_kcall: 0x7fb44000

where is 0xfffffff2 ㅠㅠ?

[vivid dew]

probably because your kcall only returns a 32bit value

[snow python]

Wut is kfd. I’m old now apparently, don’t know this slang

[primal perch]

new kernel r/w exploit

up to and including 16.5

[indigo peak]

kernel read write

[pine holly]

When he says up to he means we have no idea for what the earliest version it would work on

People were kinda surprised it worked on 15, then someone implemented into taurine to add 14.4.X support for arm64

And it’s worked on 13

So we have no idea how old it would work for

But main concern and use will be >15 for sure

[ashen birch]

someone make a kfd nonce setter

tro

[pine holly]

Fork around and Find out 😄

idk i will try, we will see what i can do

[olive peak]

To use it, i just need to include the substrate header and link to the dylib?

Do i also need to link to substrate?

[elder scaffold]

https://github.com/bazad/memctl
I know there are good functions for calling functions with no arguments, but with arguments you might need something like a JOP chain

[unkempt magnet]

Thanks!!

[elder scaffold]

A9 and below you can easily get 64bit retval using shellcode

A10 and up, it is annoying for KTRR and PAN

[pine holly]

Ayo call me stupid but no kwritebuf in kfd?

[pine holly]

mk so in theory it should be possible. My issue is only device is on 14.4.1. Which i knew before starting this but was under the impression wh1te's kfd fork was the same as the normal for functions.
his had a ton more with hella new offsets that were for ios 14. I cant get these offsets as no one has posted them and i dont have device.

but went strong for an hour making changes

[harsh junco]

man

why

[primal perch]

uh

no comment

[harsh junco]

why do you send his

[primal perch]

fr

[olive peak]

To build ellekit, should/could i disable debugging symbols and debug build?

Or will that mess up functIonality

[steady nest]

is kcall returning 32 bits address?

[unkempt magnet]

No, sometimes 64bit address can be out, but not accurate

Seems like related with zm_fix_addr

https://github.com/Siguza/v0rtex/blob/master/src/v0rtex.m#L1623

[steady nest]

You’re using v0rtex’s?

did you try electra’s?

[tepid olive]

does this work?

[unkempt magnet]

No. deprecated

[naive kraken]

you can just do thread manipulation like fugu15

[elder scaffold]

That's the technology I'm interested in right now...
I don't understand it due to skill issues, but would like to implement it when I have time.

[snow python]

Is this on a higher iOS? Your gonna need to be able to inject entitlements to make relocate me work, if you can’t add the entitlements it won’t work

[slender glade]

Can work

kfd is the exploit itself

krw with it is possible and is being done rn

You can also get root and I’m sure you can give yourself entitlements @ runtime

[snow python]

Been out of touch with jb because of school let me go look at this

[slender glade]

I thought you’re like 30

[snow python]

Lol bit younger then that

[slender glade]

my bad

[snow python]

All g

[indigo peak]

[primal perch]

[slender glade]

That’s the convo directly right above u

Why’d you ss and post

[slender glade]

I'm not falling for this. fuck you.

[topaz yew]

@visual meadow hey did you ever hook windowserver

[visual meadow]

No

[topaz yew]

i see you've talked about it

oh okay

[slender glade]

is this possible w/out no SIP?

[topaz yew]

i mean i can inject everything else but windowserver seemingly with sip off

im not sure what the problem is

[slender glade]

I'm gonna guess that's v intentional

possibly as some sort of anti adware or malware idk

[topaz yew]

im trying to like extend the compositor, damn this is a shame

[granite frigate]

isn't this why yabai is cucked? i don't think there's a way around it

[topaz yew]

i just thought they didnt feel like doing the work but idk

[granite frigate]

oh that's also possible idk either

[topaz yew]

maybe i can exploit WindowManager somehow

to do some of what i want

[granite frigate]

would be version reliant

[slender glade]

your objective?

[tepid olive]

w ellekit?

[topaz yew]

im not using ellekit

can it hook WindowServer?

i'll gladly use it 😅

[topaz yew]

i just wanna add some cool effects like borders and shadows and maybe even some animated bits if i get there

[slender glade]

oh rip

hm

[timid furnace]

good luck

WindowServer already spontaneously combusts for me on stock macOS

[slender glade]

lmao

[topaz yew]

i know right

[timid furnace]

it will just randomly stall and die, and thus the screen is basically dead and I have to reboot

[granite frigate]

https://cdn.discordapp.com/emojis/940047238212759572.webp?size=48&name=WorksonMyMachine&quality=lossless

[slender glade]

doesn't happen to me

[timid furnace]

yea idk i have no clue how to reliably repro it so

[topaz yew]

windowserver dies when my monitor goes off sometimes

[topaz yew]

mfw macos:

it doesn't make sense though

i can't even attach to it in xcode

i can dtruss it

and frida

[tepid olive]

possibly

[olive peak]

How do i use ellekit? I built the github main, linked to the lib, included substrate h and called mshook like normal. However it doesnt hook after installing the tweak using sileo

[naive kraken]

why would you need to build ellekit to use it?

[olive peak]

The latest release was older than the latest commit so i thought its better to build it

[naive kraken]

nah

latest commit has a lot of problems

you just install ellekit from sileo and write a normal tweak that links against substrate

[olive peak]

And to add it as an dependency i do that in controls?

Depends: ellekit

[naive kraken]

you don't need to depend on ellekit

you depend on substrate

[olive peak]

Youre right thank you

[primal perch]

meeo

w

meeow

[steady nest]

woem

[hasty ruin]

women

[zenith hatch]

meoow

[primal perch]

fr

[harsh junco]

Fight
Forn

[hasty ruin]

https://media.discordapp.net/attachments/688121419980341282/1139608104447791256/capt.gif

[gentle grove]

list of best developers for awful code

proof

my code is the best

[pearl sail]

No my code

[gentle grove]

proved my point

[hexed knot]

rolex are u a dev

[pearl sail]

bobalang sucks ass

So yes I am dev

[hexed knot]

👍

[turbid fjord]

GoHugo.io >>>

I really hate I’m learning assembly just to make a pong game

@grave sparrow how much can I pay you to do it for me

[pearl sail]

x128 Assembly

[turbid fjord]

Suffer

[gentle grove]

yeah because it doesn't exist

RISC

armv9be

[turbid fjord]

Arm6.9

Arm64 female (you won’t experience)

[pearl sail]

good make sure it never does

[turbid fjord]

0xC3-ard

@vivid heath you are a 0xC3ard

Good

Do it

[gentle grove]

do it in utf-16

[turbid fjord]

Send me the info
I’ll make an alt account so they don’t know it’s me
I’ll send it and ping mod role

[gentle grove]

mmmm yes a whitename fresh account that knows ret is filtered isn't gonna raise any red flags

[turbid fjord]

Exactly

It’s foolproof

[primal perch]

now

shepgoba is the second best developer

[hasty ruin]

https://media.discordapp.net/attachments/933428639620542474/1067152949211574332/caption.gif

[native orbit]

it has medic and safemode toggles for a reason

[hasty ruin]

https://media.discordapp.net/attachments/688122301975363591/1077671431875346494/caption.gif

[native dune]

medic mode

[visual meadow]

Hi why wont my mac machine work after installing this program called "Zefram"

It pink screened

and now

the Apple logo comes up and goes away

and comes up again

Please help

[topaz yew]

🥹

[visual meadow]

https://tenor.com/view/roblox-roblox-meme-in-life-you-have-roblox-in-life-you-have-road-blocks-gif-27667601

[gentle grove]

Terrible response! This is absolutely unacceptable and no way that you should conduct your business.

[hasty ruin]

zefram

more like no ram

[topaz yew]

i tried hooking windowserver with frida

but it seems ws was immune

ill have to settle for the dock

[visual meadow]

use ellekit if arm64

[blazing warren]

ellekitbratus

[gentle grove]

might write an imap client

just to get a feel for itg

[topaz yew]

for the task of injecting my dylib?

[visual meadow]

Yes

ellekit works well

it uses substrate

you can use mshookfunction

[topaz yew]

hmmm

[pine holly]

His ass gave up on taurine

Sad

[faint timber]

[acoustic imp]

@native dune idk if it was you but I think you asked what tweak you should make in #jailbreak but could you make a swipe to reply for iMessage like ik ios 17 ? (Just an idea, not a bounty)

Or like Snapchat

[pine holly]

@faint timber

I feel you would like this

[frigid pike]

Can a rootful be done in 15.7.8 ipad air 2 with palera1n? I ask because I need to install Flex 3, and that requires a rootful type installation. I seem to be having problems running the latest palera1n with the -c -f flags. Doesn't seem to create the filesystem no matter if I try to do a --force-revert with or without the -f flag. Wondering if anyone knows.

[primal perch]

https://media.discordapp.net/attachments/688121419980341282/1065738393281110016/IMG_4193.gif

[pine holly]

whats the use for flex 3? just viewing classes and scuh

i know it has various uses but you may be able to avoid using it

[frigid pike]

I need to be able to edit Boolean values of a program I run.

[pine holly]

do you know the methods?

[frigid pike]

No I need to examine on the fly and change accordingly. They change with each update to the app.

I’ve been using it for years, with each app update. But I needed to upgrade my iOS to get the supported version with my watch and there’s been a code change, so I need to examine and compare it against my old mod.

It’s aviation related

[misty cradle]

https://vxtwitter.com/dustinmoris/status/1692482728459936160?s=46&t=Wy_iksqTr9mQXvlzFY_ysg

[main apex]

https://youtu.be/Nrk8sqZfsgI

[grim sparrow]

Wrong

Just wrong

No

It’s jay w tee

[primal perch]

https://media.discordapp.net/attachments/1116214969747378296/1124587095101538304/caption.gif

[slender glade]

Says who

[grim sparrow]

Me.

[slender glade]

And I say it’s jot

[native dune]

it's jay w tee

[hasty ruin]

Jay w tee

[turbid fjord]

It’s JSON Web Token

[hasty ruin]

Jay’s on token

Jot

[wicked summit]

Jason wet toboggan

[cloud yacht]

It's JavaScript Object Notation Web Token

[slender glade]

many such cases

[hasty ruin]

Javascript Object Token

[hasty ruin]

xcode 👎

[slender glade]

i'd have prob made 20% less progress if we had to debug by building the ipa manually + moving it to device by alt/trollstore + opening antoine/console.app rather than literally just cmd+r in xc

[hasty ruin]

that's why you make automations

[slender glade]

yeah bro automate the airdrop

🗿

[topaz yew]

can ellekit hook c++

it surely can right

[native orbit]

had to do that for p1 loader, was fucking awful

airdrop so shit to so it barley works

[tepid olive]

yes

[indigo peak]

bro what crack was i cookin

void (*orig_ButtonPressed)(id, SEL, NSInteger);
NSString *function(NSString *function, NSMutableString * __strong *one,  NSMutableString * __strong *two, id s, SEL _cmd, NSInteger buttonID) {
    [*one setString:[displayView accessibilityValueLabel].text];
    [*two setString:function];
    orig_ButtonPressed(s, _cmd, buttonID);
    NSString *ret = [NSString stringWithFormat:@"%@(%@) = %@", function, *one, [displayView accessibilityValueLabel].text];
    [*one setString:[displayView accessibilityValueLabel].text];
    return ret;
}

NSString *power(NSString *power, NSMutableString * __strong *one,  NSMutableString * __strong *two, id s, SEL _cmd, NSInteger buttonID) {
    [*one setString:[displayView accessibilityValueLabel].text];
    [*two setString:getSuper(power)];
    orig_ButtonPressed(s, _cmd, buttonID);
    NSString *ret = [NSString stringWithFormat:@"%@%@ = %@", *one, *two, [displayView accessibilityValueLabel].text];
    [*one setString:[displayView accessibilityValueLabel].text];
    return ret;
}

void operation(NSString *operation, NSMutableString * __strong *one,  NSMutableString * __strong *two, id s, SEL _cmd, NSInteger buttonID) {
    [*one setString:[displayView accessibilityValueLabel].text];
    [*two setString:[NSString stringWithFormat:@" %@ ", operation]];
    orig_ButtonPressed(s, _cmd, buttonID);
}

[hexed knot]

n

fr

[vivid dew]

wfr

[pine holly]

@plain python do you have the offsets needed to update jbd or nah? Could prob get you them since I’m on 14.4. Just lmk, ill try to help best I can

[primal perch]

https://media.discordapp.net/attachments/688121419980341282/1139608104447791256/capt.gif

[steady nest]

then do it

[native orbit]

[pine holly]

What 💀

That’s crazy

[visual meadow]

I need debug build

Waiting for them to send

When they get the chance

[steady nest]

bro why do you need a debug build to check all the offsets 😭

[slender glade]

this is like getting a knee surgery to extend your dick

hold on..

[pine holly]

First off

Happened to my buddy Eric, it’sa True thing

[pine holly]

We dont, I’m offering to get the offsets in case she didn’t have an iOS 14 device so we can get debug

CS I’ll pay $75 if we get that debug build

[snow python]

Man can I have whatever you were on?

[indigo peak]

just wait, it gets better 😭

[slender glade]

Bro the only person on earth to have ever used one of the accessibility APIs

Other than accessibilityFrontmostApp

[indigo peak]

bro apparently this code has filtered speech in it

[steady nest]

they don't

[pine holly]

And that’s the exact reason I said that 😭

[visual meadow]

@steady nest it'd be easier to figure out whats exactly wrong tho

[steady nest]

stop making excuses for being a lazy fuck

please

[slender glade]

Me

🧛‍♀️

[steady nest]

me finally grabbing my mac because I've been procrastinating for a week:

[indigo peak]

clarity finally done putting up with rjb’s shit

[steady nest]

SHUT THE FUCK UP

[indigo peak]

😦

[steady nest]

JK

I had that ready before you even typed it

[indigo peak]

yeah I could tell 😭

[steady nest]

bruh i mean

why the fuck is the shared cache slid on disk

[indigo peak]

you had that shit sent 2μs after I sent mine

I’d be impressed if you could respond that quick 😭😭

[steady nest]

self bot confirmed?????

[indigo peak]

self bot to respond to all my messages with "SHUT THE FUCK UP"
worth the acc termination imo

[steady nest]

[visual meadow]

Does killing a process as root need entitlements

i have process running as root on 16.1.2 14 pro max

and

unsadnbox with tccd

[tepid olive]

no

[visual meadow]

ok

its the dumbest possible way running as root but its root

[visual meadow]

rm
Error Sending Signal
tccd
grant_full_disk_access returned error: (null)
rm
Error Sending Signal

can't kill 1

can I kill just regular apps

[tepid olive]

your sandbox won’t allow it

[visual meadow]

Yeah its stock app sandbox

Like developer cert sandbox

@tepid olive Ok so

like com.apple.app-sandbox.read-write

How would I know what tccd can grant

to a process

Like what other things can I replace inside grant_full_disk_access.m

[tepid olive]

@visual meadow You can’t fix it

[visual meadow]

Ok but

what else can i grant

besides com.apple.app-sandbox.read-write

[visual meadow]

do u know

[tepid olive]

Reverse engineer sandbox.kext

[visual meadow]

ok

[indigo peak]

idk check ida strings for tccd that match “com.apple.”

[visual meadow]

is com.apple.app-sandbox.read-write supposed to be a string inside said kext

[visual meadow]

i looked for com.apple.app-sandbox.read-write inside it and there wasn't any matches

[indigo peak]

mhm

so yeah

check sandbox strings

[visual meadow]

@tepid olive what about like com.apple.private.security.container-manager

lol

idk what it doe

does

@tepid olive what does this do

[radiant idol]

looks like it's security things

https://github.com/joeyhoer/starter/blob/3f6fecfdea257b6a2db5228c5d445b742ed86f42/system/security-privacy.sh#L66

related to TCC

[visual meadow]

com.apple.app-sandbox.read-write
where tf does this come from then]

[native orbit]

private shit or deprecated idk

[zenith hatch]

smol question whats tcc

[timid furnace]

wtf are you trying to do

[timid furnace]

Transparency, Consent, and Control

[radiant idol]

i dont know

oh

[zenith hatch]

ah

[radiant idol]

for once its an actually easy acronym to understand

[timid furnace]

or the relevant section in iOS

[visual meadow]

Just seeing what extra stuff I can grant to a app

[hasty ruin]

https://media.discordapp.net/attachments/688121419980341282/1139608104447791256/capt.gif

[olive peak]

@grave sparrow , so i said once that i saw someone hook on jailed with more than 6 hooks. He used this library (i think, he only said libevil), it should work. However the orig implementation is broken https://github.com/landonf/libevil_patch

[hasty ruin]

LMAO

[crisp frost]

capt u ok

[hasty ruin]

based

[hasty ruin]

lightweight

hydrate dont do it

[shut stag]

seeing that you say slurs when you are drunk, im gonna time you out for your own good

[hasty ruin]

[olive peak]

What does your drunk code look like

[hasty ruin]

the same as his sober code

[olive peak]

LOL

[torn oriole]

Oh he was drunk

I'll probably lift that warm

Might

Even

[hasty ruin]

he's only on 250

[torn oriole]

Keyword, might

[olive peak]

Honestly captinc, i wouldnt let that slide if i were you. You need to show him that youre him

[hasty ruin]

https://github.com/securing/IOSSecuritySuite/commit/6cc3f260b305d6a5500abbe9b4af5dfd3c4540d6 💀 yeah because that's a really great patch

[slender glade]

Jailbreak detection is fucking pointless

I still don't get it

[hasty ruin]

"but it lets us write insecure code and delay the consequences!!"

[slender glade]

fr

if you have to write jb detection that means

1. You're just forced to

2. Your app is really insecure and the moment someone gets around that detection easily they'll find that out

[hasty ruin]

yeah fr

[native orbit]

bro thinks hes so cool with his <haha>

[naive kraken]

he should play some games with mr jailbreak detection

[slender glade]

would that be you

[naive kraken]

no

[native orbit]

https://github.com/securing/IOSSecuritySuite/blob/master/IOSSecuritySuite/JailbreakChecker.swift#L148-L150

bro out of touch

[slender glade]

So much effort into something just useless

[native orbit]

honestly, waste of time

[hasty ruin]

Average jailbreak detection

[granite frigate]

thats a whole bunch of nothing

[gaunt helm]

Crazy? I was crazy once. They locked me in a room. A room full of tweak developers. And tweak developers make me crazy

[granite frigate]

Crazy? I was crazy once. They locked me in a room. A room full of tweak developers. And tweak developers make me crazy

[slender glade]

Crazy? I was crazy once. They locked me in a room. A room full of tweak developers. And tweak developers make me crazy

[steady nest]

this mf makes me have to carry my id card around because I’m too lazy to fix shadow myself

[zenith hatch]

Crazy? I was crazy once. They locked me in a room. A room full of tweak developers. And tweak developers make me crazy

[hasty ruin]

[steady nest]

true, you're not old enough to have to carry it

[hasty ruin]

i wrote bypasses for all apps I need

which is actually zero now ig bc rootless

[unkempt magnet]

... my tweak is here in detection list 🥹

[lime pivot]

my tom?

[wicked summit]

Happy birthday 🥳

[lime pivot]

bro's trying to play a game with open sourced checks, he already lost

[lime pivot]

tysm

    // "cydia://" URL scheme has been removed. Turns out there is app in the official App Store
    // that has the cydia:// URL scheme registered, so it may cause false positive```

ok that's hilarious

gonna release an app in the app store with sileo:// and zbra:// for shits

this is apparently the app https://apps.apple.com/ng/app/realconnect-dhre/id1346538794

[radiant idol]

Happy birthday @lime pivot!

[feral mirage]

Hbd adam

[lime pivot]

thanks friends 🧡

[unkempt magnet]

Happy birthday 🎉🎊🥳

[hasty ruin]

Shadow is open source too, and that’s the best detection he could come up with

[native dune]

@lime pivot happy birthday

[timid briar]

hbd!

[timid furnace]

@lime pivot happy birthday!!

[pearl sail]

@lime pivot Happy Birthday Big Woman!!!

[restive ether]

no he’s the crazy guy who’s making a bootstrap that won’t work

[slender glade]

Who

[restive ether]

i forget his name you’ll probably see him on twitter

it’s called like roothide

it has a dopamine fork

[slender glade]

Oh that

[restive ether]

@hasty ruin cunt do that again and i’m ruining your life n

[hasty ruin]

?????

[restive ether]

after two months(Dopamine publibc released) of research, we have the following patch schemes:

1. all paths are based on the original rootfs, and the /var/jb/ prefix is used to represent jbroot. this scheme has the best compatibility and the least cost.
   but I really don't like /var/jb/, it always reminds me of fixed path jbroot, it's my nightmare, I paid so much to kill it, I don't want people to use it anymore, and I don't want this fixed path to come out of the grave one day in the future. so I have been looking for other solutions.

2. all paths are based on the original rootfs, using other prefixes to represent jbroot (such as /JBROOT/), this scheme is not much different from scheme 1, we also use a prefix path that does not exist at all to represent jbroot, and there are more many compatibility issues, so I quickly gave up on this idea.

3. all paths are based on the original rootfs, use char* jbroot("/jbpath") in the programming code to access jbroot, and use the jbroot-based path to represent jbroot in the config file of the jailbreak program, then we ln -s / jbroot ("/rootfs"), so that we can use the /rootfs/ prefix in the configuration file of the jailbreak program to represent the path access to the original rootfs.
   at first I liked this scheme, it completely killed /var/jb, but soon I realized a huge problem, the constant string path in the config file may simply be passed to another jailbreak program, such as the cmd.conf of a jailbreak program may be written like this:
   /bin/sh /usr/local/xxx.sh
   then it directly executes this string through system(), without caring about every parameter in the command, so it will not call jbroot(/usr/local/xxx.sh) to convert the path.
   the reason for this dilemma is that different modules of a jailbreak program may receive different path-based inputs, sometimes they may receive an input based on the original rootfs path, and sometimes they may receive a jbroot-based path input. this also It caused programming difficulties and confusion. so I also gave up this solution.

4. all paths are based on jbroot. like solution 3, we also use char* jbroot("/jbpath") to access jbroot in programming code, and ln -s / jbroot("/rootfs"). but each of our jailbreak programs only accept a jbroot-based path input, and use jbroot() to convert (or use the shim library to convert automatically), so it seems that all jailbreak programs are running in the jailbreak world (based on jbroot path).
   the only thing that requires special handling is the path interaction between the jailbreak program and the system program (the system program still runs in the original world, based on the rootfs path). the interaction between the jailbreak program and the system program/library is exact, which will not cause confusion. and almost no system program/library will actively call the jailbreak program (pass a rootfs path to the jailbreak program).

[slender glade]

through system()

[restive ether]

as if @hasty ruin

[slender glade]

Holy hell

[restive ether]

i don’t remember which concept he ended up going with

[slender glade]

Caught his ass in 4k lmfao

[restive ether]

though no one of them are full proof

[slender glade]

moyai

[restive ether]

and they’d require tweak mods

or patching everything

[hasty ruin]

He forked procursus, NewTerm, sileo, zebra, dopamine

Fucking everything

[restive ether]

doesn’t really seem reasonable

[pearl sail]

Remove his dev role

[slender glade]

Bro had childhood trauma from /var/jb

[restive ether]

yeah he’s beefing with rootless path

[pearl sail]

fr

[slender glade]

😭

[pearl sail]

Fighting with ghost

[restive ether]

@slender glade https://github.com/RootHide/Procursus-roothide

[slender glade]

What’s the point

[restive ether]

idk he just has this obsession with jailbreak detection

[slender glade]

@restive ether iPhone 15 Pro will be able to "connect to the internet" and "browse the web" according to sources familiar with the matter

[restive ether]

he’s come to the conclusion that’s why people don’t jailbreak anymore

[slender glade]

Just use shadow bro

[restive ether]

not good enough

according to him

but in my experience that worked every time i needed it to

[restive ether]

i remember someone here saying his thing is pretty easy to bypass

[slender glade]

@restive ether

[late ridge]

Happy Birthday @lime pivot!!

[pine holly]

I mean it’s open source, all you gotta do is go 1 for 1. Shadow used to be able to bypass, to update shadow wouldn’t take much.

So it’s not “easy” but it’s been done and it was open source so

[grim sparrow]

dude literally add 1 commit to troll with the shadow devs

[pine holly]

“Lets play a game”

Like shut the fuck up

Haha

[grim sparrow]

Omw to write a 1:1 bypass in Swift

[pine holly]

I wonder if shadow worked before that, I’ll try to find an app that uses that

[grim sparrow]

it must have done

he wouldnt have bothered otherwise

[pine holly]

Yeah

[indigo peak]

@naive kraken is there a way to get the bundle id of the the parent cell using alt list?

<dict>
    <key>cell</key>
    <string>PSLinkListCell</string>
    <key>detail</key>
    <string>ATLApplicationListSubcontrollerController</string>
    <key>subcontrollerClass</key>
    <string>AppSettingsController</string>
    <key>label</key>
    <string>APPLICATIONS</string>
    <key>useSearchBar</key>
    <true/>
</dict>

and then in the AppSettingsController somehow access the bundle id of the app's PSLinkListCell?

idk if thats descriptive enough of what i want lol

[naive kraken]

yes, see the example

[indigo peak]

[specifier propertyForKey:@"applicationIdentifier"]?

• edit: yes

[indigo peak]

ty! sorry for the ping 🫠

[late ridge]

do I have to do anything special to get a live camera preview in springboard

I've been messing with this for a while but I keep getting a black screen

[plain python]

https://github.com/Odyssey-Team/Taurine/commits/kfd

someone give that a shot

[unkempt magnet]

Nice

[pine holly]

Did you compile IPA cause I have no Mac access rn. Also want me to try arm64e? Just lmk cause I need to rootFS, on Fugu rn

[hexed knot]

Kamsahamnida

[steady nest]

@visual meadow

[visual meadow]

I know

[steady nest]

@visual meadow

mid

https://tenor.com/view/spin-chair-spin-spinning-chair-foldable-chair-gif-27635879

[timid furnace]

developers have manage messages perms in this channel

in order to pin stuff

[pine holly]

Bro I didn’t even know that, thanks

[hexed knot]

yeah i typically abuse those perms in order to delete all of capts messages

[pine holly]

Will join you in this movement

[hasty ruin]

I deleted one of cameren’s earlier

[pine holly]

Hard R is crazy

[lime pivot]

thanks man

[indigo peak]

https://tenor.com/view/spin-chair-spin-spinning-chair-foldable-chair-gif-27635879

[primal perch]

happy birthyday kirby

[pine holly]

Bro used his government name

[lime pivot]

thanky you shepygoba

[primal perch]

[plain python]

@lime pivot happy birthday

[lime pivot]

tysm

hope you've been well

[plain python]

I have! it's been a while

[torn oriole]

Rare star appearance

[exotic spire]

Great to see that

[pine holly]

Bro apparently hasn’t seen #taurine

[hasty marsh]

@hasty ruin compile taurine kfd for me bbg

wrong chat

[crisp frost]

I tried this on a iPhone 7 running 14.8, and I tried it 10 times, all the 10 times it panicked shortly after "Selecting kfd [physpuppet] for iOS 14.0 - 14.8.1" was printed with either a kernel data abort or pmap_remove_pv: unexpected pv head panic messages.

Looking through #taurine I saw this was known already, sorry!

[granite frigate]

kfd works… on ios 12?

[naive kraken]

@plain python don't question this, try compiling kfd Taurine with "-Os"

For some reason that fixes some of the unreliability

Ah wait it's opensource so ig anyone can try this

[slender glade]

lol

clang optimizations go crazy

[naive kraken]

I have a bunch of 14 devices and might take a look in a bit

[pine holly]

Oh?

I love how much love 14 has been getting

Didn’t think I’d see the dsy

[plain python]

that's how it is by default in Release mode. But most people are compiling it themselves (probably in debug)

[plain python]

patchfinder runs horribly slowly in Debug mode so you'd want it with -Os anyways

[slender glade]

does it cache the offsets

[plain python]

no need. It runs basically instantly in Release mode

[slender glade]

😯

[naive kraken]

well the offsets used in the kfd in taurine for 14.x are certainly wrong on some subversions

[unkempt magnet]

How can inject dylib into every launched process when develop jailbrwak？
Is there any watchtower to process？
Sorry that noob 🙏

[restive ether]

too real

[naive kraken]

https://github.com/opa334/Presentations/blob/main/0x41con - Modern Jailbreaking Techniques.pdf

[granite frigate]

i still can't figure out why get_use_count isn't working, this is on iOS 12.5.7

[naive kraken]

Fixed kfd on A11 14.6 at least

[unkempt magnet]

Thanks, launchd hook seems need to watch carefully.

[native orbit]

u trying kfd on 12?

[granite frigate]

Yes

same error as on 13

I suspect indexedtimestampptr and ReadDisplacement may be wrong

[elder scaffold]

anyone trying kfd on 9

[native orbit]

sockportlegacy better

[elder scaffold]

true

[native orbit]

ios 12 time_saved better to

might work on ios 11 hm

[elder scaffold]

Are you trying to actually create jailbreak? @unkempt magnet

[unkempt magnet]

Well, just for fun

However, I think the development will be limited from September due to the opening of the university.

[elder scaffold]

oh

but cool

I'm hoping to learn to jailbreak these days someday

[indigo peak]

to get the most up to date theos toolchain where would I go

[native orbit]

bakera1n tho

[elder scaffold]

this is just an old-style jailbreak

[native orbit]

ahh u want do userland newer stuff

[elder scaffold]

yeah

[native orbit]

make ios 13 jb with full bypass

[elder scaffold]

For me
ios 8, kpp bypass based, bootrom exploit based: oldstyle
ios 9, ios 10(yalu1011): insanity style
ios 11-: modern style

[native orbit]

*less socket made me learn alot

ios 12 the next adventure

[elder scaffold]

i.e. my knowledge has not been updated since ios 11

[native orbit]

legacy better anyways lol

[elder scaffold]

I have no idea how KTRR-Less jailbreak works

[native orbit]

they not super complex for 10-11

[elder scaffold]

hmm

[native orbit]

hm

[elder scaffold]

[native orbit]

less code then bypass method

for me atleast

[naive kraken]

what part of it doesnt work

[slender glade]

You working on nekojb?

[granite frigate]

kread ---> object_id = 13, object_uaddr = 0x0000000129ffd000, object_size = 256, allocated_id = 16/4096, batch_size = 16
kr: -536870206
iosurface_get_use_count : (iokit/common) invalid argument (0xe00002c2)
[iosurface_get_use_count]: Failure: assertion failed: (kr == KERN_SUCCESS)
[iosurface_get_use_count]: Failure:
file: /Users/ibarahime/Downloads/u0_real_leak/Undecimus/kfd/libkfd/krkw/kread/../IOSurface_shared.h, line: 2452023-08-21 21:19:57.705522+0800

it says it has wrong args

[native orbit]

u0_real_leak

[granite frigate]

idk i just copied the code from weightbufs

[naive kraken]

this cannot be caused by wrong offets

[granite frigate]

not wrong offsets

[slender glade]

Yeah it’s just IOConnect smth bitching

Trap6 or callmethod I forgot

[granite frigate]

either port or surface_id is broken?

[native orbit]

trap6 for kexecute stuff

[naive kraken]

just test creating IOSurfaces without running any exploit

[granite frigate]

ok

[elder scaffold]

For me it's a function for flush_dcache

[native orbit]

has mulitple uses

[granite frigate]

creating surface with fast path with selector 6 works though

[naive kraken]

I like how it has multiple uses but none of them are related to what the driver was made for

[naive kraken]

Then call get_use_count on it

[granite frigate]

aight

[indigo peak]

ld: framework not found Preferences
clang: error: linker command failed with exit code 1 (use -v to see invocation)

bruh what

[naive kraken]

$THEOS/sdks is your friend

[indigo peak]

yeah i just installed the iOS 14 sdk from amy's repo

this is on my mac now

[unkempt magnet]

No, Just concentrate for kfund

[naive kraken]

kfd success on
14.6 arm64
14.3 arm64e

[indigo peak]

i was using 14.5 on linux and it worked, 14.5 on macos didnt work

so i tried 14 macos

still didnt work

[slender glade]

So the launchdhook isn’t for nekojb?

[unkempt magnet]

Never heard of that?

[slender glade]

[native orbit]

how is redacted serena jb going

[slender glade]

As good as 3 piece Maruki

[native orbit]

mfw doesn't play persona

[slender glade]

🤤🤤

[unkempt magnet]

Nice

[granite frigate]

This works as well

[naive kraken]

weird

[granite frigate]

Yh im depressed

[indigo peak]

@naive kraken

ls $THEOS/sdks/iPhoneOS14.5.sdk/System/Library/PrivateFrameworks | grep Preferences.framework  
BridgePreferences.framework
HIDPreferences.framework
IntlPreferences.framework
Preferences.framework
TelephonyPreferences.framework

Preferences.framework exists in my sdk

[naive kraken]

then you're compiling with another sdk that doesn't have it

[indigo peak]

ok weird i specified 14.5 instead of latest in my target and it compiled

well

it went away

i just gotta install AltList now

[naive kraken]

bruh

[indigo peak]

idk what other SDK it would be using

[naive kraken]

xcode

[indigo peak]

considering 14.5 is the ONLY sdk i have in ther

bruh

this is my first time compiling on a mac

i need new abi support

[naive kraken]

@plain python https://github.com/opa334/kfd switch to this, should fix wrong offsets on 14.5+

[granite frigate]

oh

💀

[visual meadow]

Also

14.4 problem resides with libhooker and jbexec

We used anydesk and stuff

Im gonna set up a hackintosh on monterey and use xcode 13

Coolstar thought one bug was fixed in 14.4, it was not

And had it disabled in 14.4+

Now the problem is in lh somewhere

[naive kraken]

plugged kfd changes into taurine, still panics on exploitation

oh it uses physpuppet by default

maybe only smith works

although weird cause physpuppet is way cleaner

[native orbit]

ios 14 just weird who knows

[naive kraken]

well with smith the exploit once worked for me now but it still paniced later

kernel data abort so probably wrong offset in Taurine itself

[slender glade]

is there a method that doesn't panic halfway through the exploit if ur phone isn't cold

[naive kraken]

damn getPortAddr panics

off_task_itk_space changed to 0x338 in some version between 14.3 and 14.6

ok next thing broken is nonce setter apparently

[restive ether]

that was broken well before lol

it didn’t even work when taurine came out for me

[naive kraken]

broken = panics

[restive ether]

oh that’s new

[naive kraken]

with that commented out I get ERR_REMOUNT

[slender glade]

who in the house with IORegistryEntrySetCFProperty(registry, CFSTR("com.apple.System.boot-nonce"), CFSTR(0x11111111111111))

[native orbit]

i got the same, seems kfd itself seemed to worked fine

[naive kraken]

already fixed

yeah with offset fixed and nonce setter commented out I consistently get ERR_REMOUNT now on A11 14.6

Selecting kfd [smith] for iOS 14.0 - 14.8.1
"IOSurface_id_write=10"
"context_write_port_addr=0xffffffe19cd2fe58"
"context_read_port_addr=0xffffffe19d1e3b10"
"ip_context_offset=0x0000000000000090"
"ret.context_write_context_addr=0xffffffe19cd2fee8"
"surface_port_addr=0xffffffe19d027db0"
"surface_kobject_addr=0xffffffe4cca34670"
"surface_clients_array=0xffffffe4cc9f8000"
"_context_write_context_addr=0xffffffe19cd2fee8"
done!
isKernRwReady: 1
Successfully exploited kernel!
Starting Electra...
Found kernproc
May have found allproc...
found our pid
found amfid
found cfprefsd
found launchd
found kernel proc
Found kernel base 0xfffffff018554000
kernel slide is at 0x0000000011550000
our proc is at 0xffffffe19a7ee1c0
kern proc is at 0xfffffff01a7a7a98
our uid is 0
Entitlement is not safe. Skipping com.apple.private.signing-identifier
Found an entitlement! task_for_pid-allow
Failed to get the region: 0x00000001ce70e4bf
Got amfid task port:  30479
found vnode:  launchd
found vnode (should be sbin):  sbin
found vnode (should be root):  System
vnode flags: 0x84801
com.apple.os.update-AE7C5674E9654D7594A090D50589303FDFF792AF7086FD9700A4F6C707CCD4619E12311E1D616AFF94B94F6299759D39@/dev/disk0s1s1
Entitlement is not safe. Skipping com.apple.private.signing-identifier
Found an entitlement! com.apple.private.security.disk-device-access
Found an entitlement! com.apple.private.vfs.snapshot
Found an entitlement! com.apple.private.apfs.revert-to-snapshot
System Snapshot:  com.apple.os.update-AE7C5674E9654D7594A090D50589303FDFF792AF7086FD9700A4F6C707CCD4619E12311E1D616AFF94B94F6299759D39
found dev flags:  1
mount: -1 1
mount completed with status  -1
Reset creds

@plain python

[native orbit]

rootvnode offset wrong? found vnode (should be root): System

[naive kraken]

hmmm

probably

I mean the parent struct offset must work

but why is sbin->parent=System???

is /System/sbin a thing on newer iOS 14 versions?

[visual meadow]

No

System, afaik, is the name of /dev/disk0s1s1

And sbin, is well, /sbin

@naive kraken

[naive kraken]

yeah seems to be right

[visual meadow]

I just need to figure out the stuff with libhooker

Wheres that stg 2 dylib come from

pspawn_payload-stg2.dylib

Thats the crash

@naive kraken do u know where the dylib comes from

[naive kraken]

from binpack....

[native orbit]

it new version of https://github.com/coolstar/electra/blob/master/basebinaries/pspawn_payload/pspawn_payload.m

part of basebins

[visual meadow]

Yeah I knowbm

I want to rebuild from src

Idk why its even crashing

[native orbit]

prob closed src

[visual meadow]

Anyone know

[naive kraken]

bruh

this crash is really bad

[visual meadow]

Mine or yours

[naive kraken]

yours

[visual meadow]

lol how

[naive kraken]

the hook isn't working

[visual meadow]

damn

Could it be outdated lh thing or

[native orbit]

libhooker not working?

[visual meadow]

Whatever I'll just setup a hackintosh later today

And then hope cs is on again

stg2 source?

If so damn thats crazy but idk how that helps if im not getting the src either way

[naive kraken]

it highly depends on what it is that was attempted to be hooked

[tepid olive]

jbexec source

[naive kraken]

what is jbexec

[visual meadow]

That's fixed I'm pretty sure

[tepid olive]

were basebins changed

[visual meadow]

There was a hardcoded 14.4 thing, that cs thought that was fixed in 14.4

[visual meadow]

No, not publicly at least

[visual meadow]

Like, disabled bug workaround

That cs thought was fixed in 14.4

[native orbit]

could try these for VnodeOffsets in offsets.swift, cant ensure they are correct, was just in a massive text file of offsets i have lol

    public struct VnodeOffsets {
        let ncchildren = UInt64(0x28)
        let flag = UInt64(0x4c)
        let usecount = UInt64(0x58)
        let type = UInt64(0x68)
        let id = UInt64(0x6c)
        let ubcinfo = UInt64(0x70)
        let specinfo = UInt64(0x70)
        let name = UInt64(0xb0)
        let parent = UInt64(0xb8)
        let mount = UInt64(0xd0)
        let data = UInt64(0xd8)
    }
    let vnode = VnodeOffsets()

[naive kraken]

nah I know parent is right

and that's 0xc0

[native orbit]

was labeled as: "xnu 7k?" lol

idk where it from

just checked in https://github.com/apple-oss-distributions/xnu/blob/bb611c8fecc755a0d8e56e2fa51513527c5b7a0e/bsd/sys/vnode_internal.h, the ones in taurine are correct for 14.5+

[plain python]

Will do

[plain python]

That’s the name of the apfs volume

[naive kraken]

yeah figured

mountRealRootfs fails

mount returns errno=1

[plain python]

Weird

[plain python]

Maybe the mount offsets changed too

Since it looks like it gets entitlements successfully

[naive kraken]

if anything it must be specinfo->flags

[plain python]

Yeah

[native orbit]

si_flags is still 0x10

[slender glade]

Yeah I know

Now you need to do some iodtnvram bs

[naive kraken]

yeah no nothing changed

vnode->specinfo is 0x78
specinfo->si_flags is 0x10

[plain python]

I hate how this offset is duplicated in Taurine because tihmstar wanted to use C++

since the swift part can have different offsets easily for different iOS versions

[faint timber]

Why does tihmstar use a language he doesn’t know how

[plain python]

and then he got pissed when I stripped away and replaced a lot of his code later after it was crashing left and right

[slender glade]

If tihmstar doesn’t know c++ then what does he know

[faint timber]

C++ compiled c

[slender glade]

dead

Someone needs to stop him from using macros

[naive kraken]

if (vnode_isblk(vp) && vnode_ismountedon(vp)) {
    error = EBUSY;
    goto out;
}

[visual meadow]

Me when compiling the 50th dependency

[naive kraken]

if ismountedon was the problem it would return EBUSY not EPERM

even not setting the flag still returns EPERM

so it doesn't even hit that piece of code

[faint timber]

Macros are fine just not the way he uses them. Also release asserts should be used correctly not like this

Apple uses a lot of release asserts and macros in seprom

It’s very very secure

It wouldn’t let me use it so I stopped trying

[native orbit]

this fr

[slender glade]

black market ahh defer

[faint timber]

C you are better off using switch case enum

[slender glade]

What

[faint timber]

Someone on the internet said that was good code

[native orbit]

mfw cant pass return val to defer block 😡

[faint timber]

State machines are good code apparently

Honestly you are better off optimizing for the best branch speculation

Have you looked at the compiled

Apple doesn’t care about an extra branch in their kernel

12 bytes isn’t enough saving

[naive kraken]

tested on a 14.3 device, by not setting the device flags I get errno 16

so there is probably some additional check in mount on newer versions

maybe I could use pongo to patch in some panics into mount to figure out what check fails, but I feel like the stock checkra1n patches will conflict with Taurine

[plain python]

@naive kraken just pushed to https://github.com/Odyssey-Team/Taurine/tree/kfd

[bleak wagon]

Yay coolstar!

[naive kraken]

ok dumb me wasn't looking at syslog:
Aug 21 21:57:50 kernel(Sandbox)[0] <Error>: System Policy: Taurine(259) deny(1) file-mount /private/var/MobileSoftwareUpdate/rootfsmnt

that's the issue

[plain python]

huh

did they change the sandbox policy again

[naive kraken]

they must have

[plain python]

try find+replacing "/private/var/MobileSoftwareUpdate/rootfsmnt" with "/private/var/MobileSoftwareUpdate/mnt1"

maybe we just have to use that dir

(though remember to remove all rmdir(mntpath))

[naive kraken]

Aug 21 22:03:16 kernel(Sandbox)[0] <Error>: System Policy: Taurine(292) deny(1) file-mount /private/var/MobileSoftwareUpdate/mnt1

[plain python]

...

[native orbit]

grab ents from /System/Library/Filesystems/apfs.fs/fsck_apfs instead of /var/containers/Bundle/Application/ctbypass

[native orbit]

tragic

[plain python]

fsck_apfs

[naive kraken]

lol

ok same issue as before

[native orbit]

apf goes crazy

[naive kraken]

in the kernel I can only see /private/var/MobileSoftwareUpdate/mnt not /private/var/MobileSoftwareUpdate/mnt1?

[plain python]

@naive kraken I wonder what if we grab com.apple.rootless.install and/or com.apple.rootless.volume.Update

(you can test by using the ctbypass bin, though you'll want to rebuild it with the added entitlements ^^)

[naive kraken]

how do I do that

nothing seems to be able to extract the gz

[plain python]

it's a zstd renamed to gz to try to confuse that guy who was ripping off taurine and swapping the strap

[naive kraken]

lol

[native orbit]

the th [ ] r guy?

[plain python]

yes

[native orbit]

smh

[pine holly]

I got into Twitter beef with that mans

[native orbit]

dude been at it for like 5 years now

[pine holly]

He is like mentally 12

[pine holly]

He is so persistent for no reason

Like he’s got some villain back story plot type shit 😭

[brazen timber]

is that guy incapable of running file lol

[steady nest]

is the guy seriously unable to file xyz.gz when tar fails

[plain python]

unfortunately not

I wish he was that incompetent

[brazen timber]

worth a shot

[visual meadow]

[plain python]

you can just build a new bin since the ctbypass/ folder is at the root of the repo btw

it's literally just a hello world executable lmao

[visual meadow]

downloading xcode

[naive kraken]

oh damn

[native orbit]

insane coretrust bypass

[pine holly]

Me frantically switching between here and #taurine

[steady nest]

ok

[pine holly]

Watching nebula brick their phone

[plain python]

@visual meadow stop spamming me and this channel with pointless shit

[visual meadow]

I stopped spamming u lol but thats true ill stop

[plain python]

I really hope we don't need the softwareupdated seatbelt-profile

[steady nest]

yeah I was going to say that

what ents does softwareupdated have

[plain python]

I know for mounting / unmounting DDI on iOS 14, you need the sandbox profile for MobileStorageMounter

[visual meadow]

lemme check

i can check 14.4

[steady nest]

ldid -e

[plain python]

https://newosxbook.com/ent.jl?osVer=iOS16&exec=System/Library/PrivateFrameworks/MobileSoftwareUpdate.framework/Support/softwareupdated

[steady nest]

com.apple.rootless.volume.Update yeah

[plain python]

let's try rootless.install and rootless.volume.Update first

if that doesn't work, I guess then we call a binary w/ the seatbelt profile to call mount for us