development

[plain python]

that won't help

[visual meadow]

yea i guess

[hollow wraith]

Physpuppet often crashes earlier on

Should I try as user app rather than a system app

[visual meadow]

Just wait i'll be home soon

Also no that wont help

[hollow wraith]

Ok no worries mate

mfw the kernel is spooked

[primal perch]

https://tenor.com/view/cum-jar-me-entering-video-game-gif-16032003

[plain python]

@hollow wraith gonna send you a build with a bunch of sleep statements scattered in. It'll run slow AF but it'll tell us where it's crashing

(since it'll purposely wait 3 seconds at random points)

[hollow wraith]

Ok thank you very much

DM?

[hollow wraith]

Oh ignore my friend request

[plain python]

I don't do DMs on jailbreak servers, since I really shouldn't be here in the first place

[hollow wraith]

Huh why

[visual meadow]

because of the people here

in this community

[plain python]

^^ there's a reason I quit jailbreaking

[hollow wraith]

Oh right

[acoustic imp]

L toxic ppl

[hollow wraith]

Oh and people are horrible people in DMs

[plain python]

I saw people being transphobic on r/jb again literally just yesterday, to no one's surprise

since I'm still subbed to that subreddit for some reason

[hollow wraith]

Ignore the dirty ass screen I cleaned it an hour ago

Smith

[visual meadow]

It has to be ppl

Right?

[steady nest]

huh

[visual meadow]

Or bad

[steady nest]

what

[visual meadow]

Im making guesses

I'd assume it might be offsets though

[velvet path]

I would probably stop making guesses until there’s literally no logical possible explanation left

[steady nest]

yeah this is exploit fail

[hollow wraith]

Puppet

[plain python]

exploit fail

[tepid olive]

send the panic lol

[hollow wraith]

Wait it got further this time

[tepid olive]

the next to last panic

[hollow wraith]

I don’t have a scooby how lol

[steady nest]

yeah, send the 17:14 panic

[hollow wraith]

I’m literally a kid on his iPad

How do I do that lol

[steady nest]

Settings -> Privacy -> Analytics

and then look for the panic with 17:14 in the name

[acoustic imp]

Settings -> Privacy -> Analytics -> analytics data

[hollow wraith]

171452?

[plain python]

jop pid seems to be correct so it's not that

[slender glade]

that subreddit is actually so vile on large threads

[steady nest]

should be

[plain python]

send the panic (look for 17:14 timestamp)

[plain python]

that's a major reason why I quit

[hollow wraith]

Is this safe to send publicly

[visual meadow]

Yea

[plain python]

yes

[slender glade]

+1

[tepid olive]

i don’t get why you would tell them ur trans though

[plain python]

I'm curious if it panics before or after it starts amfidebilitate

[steady nest]

isn't twitter worse

[slender glade]

twitter is better bc i can just block anyone I don't like

but if u post smth anywhere some asshat posts it on reddit

and u can't control it there

[tepid olive]

it’s none of their business anyway

[plain python]

luckily because of Elon's rebrand I don't even open twitter on accident on my phone anymore

I search spotlight for Twitter, nothing pops up and I go about my day

[steady nest]

discord should rebrand

my productivity would rise 200%

[acoustic imp]

@plain python ik this is probly a dumb question but like could you JB a chromebook? like change the UI/animations etc?

[slender glade]

wydm

[tepid olive]

why would u come out publicly

when u can just change name and people will follow

[hollow wraith]

here

[slender glade]

idk i think that's just a human thing to do

[steady nest]

data abort

[tepid olive]

that’s not pac then

ppl

[hollow wraith]

Do you need any more logs

[tepid olive]

not ppl

[raven agate]

guys i tried to jailbreak an ipad air 2 with taurine 1.1.7b1 but it said running exploit, then rebooted and didn't jailbreak

[fiery seal]

the exploit failed, try again

[plain python]

you can do far better with a chromebook

[tepid olive]

if you come out publicly you miss out on the fun of arab transphobic guys lusting over you 🤭

[hollow wraith]

I have lots of panics and I can make more

[slender glade]

[plain python]

you forget they still sent me dick pics before I finally quit jailbreaking

[visual meadow]

That poor, poor, cpu

[acoustic imp]

ik but kinda like having the playstore stuff, and ik windows 11 has it but i like the way chrome OS/fyde OS has it

[slender glade]

HSR

[velvet path]

nice job on this by the way - just saw the ping for it in the chrultrabook server

[plain python]

Intel N100 benchmarks about the same as the Core i5-7400 actually

[fiery seal]

I have a panic-full from A13 14.7.1 too if it's needed (this on 1.1.7b2)

[steady nest]

same place

[plain python]

you can run apk's on Win11

[steady nest]

x0 is 0x60 again

[tepid olive]

i didn’t know about that wtf

[hollow wraith]

I’m not feeling very well I think Tim apple is rebelling

[plain python]

hm amfidebilitate is spawning and panic'ing

let me clean + rebuild basebins

that might be the issue

[slender glade]

@plain python gun to the back of ur head name 5 hanzo mains who are not unbearable

[tepid olive]

are any of these words in the bible

[slender glade]

Yeah

gun

[plain python]

@hollow wraith try this

[plain python]

I did a funny edit of it to actually put HSR in

(yes I blocked out the UID so y'all can't add me)

[hollow wraith]

Did so much then fell short

Full log required?

[steady nest]

panic?

looks much better hehe

[slender glade]

is it the caltrain

[hollow wraith]

No panic

[visual meadow]

It looks like it got to the jbexec/libhooker issue

[plain python]

check if you have a jbexec crash

[hollow wraith]

How

[visual meadow]

Search for jbexec in logs

[plain python]

same place as the panic log

[visual meadow]

^

[plain python]

just search for jbexec instead

[steady nest]

lh isn't used here is it lol

[hollow wraith]

Send it?

[visual meadow]

Yea

[steady nest]

yes

[plain python]

it is

[steady nest]

[hollow wraith]

There is one

Do I send it

[visual meadow]

Yeah

[plain python]

jbexec dlopens pspawn-stg2 (which uses libhooker) and calls posix_spawn

so jbexec is almost never the problem. it's pspawn-stg2 usually

[hollow wraith]

Do I need to try chris or whatever

[visual meadow]

Opa says some hook is failing

No

Just send jbexec log

[slender glade]

EXC_BAD_ACCESS :hahawtf:

[visual meadow]

I think its the same thing as mine

This ones from 14.4

[slender glade]

Yeah it's the same

[plain python]

this looks slightly different

[hollow wraith]

Ok

[visual meadow]

I wonder if that one bug is fixed

[slender glade]

?

[hollow wraith]

When trying smith I get a weird error

Freezes here

[visual meadow]

That's normal

[hollow wraith]

Oh

Well it freezes

There

[visual meadow]

Just wait

Err jb will spew

Sure

Spire

[hollow wraith]

How long

It’s been 2 mins

[visual meadow]

Holy shot single trolling is so bad

Of my god

Swipe typing is ass

[hollow wraith]

Is this just a shut up and be patient moment

[visual meadow]

yes

[steady nest]

huh this is quite different

[hollow wraith]

Do I need to charge it? Actively cool it?

That’s smith

[visual meadow]

Its because bootstrap is already extracted

[hollow wraith]

Well shit it didn’t reboot

[steady nest]

did it extract bootstrap in the run before?

[visual meadow]

yes

[visual meadow]

Its the libhooker issue

That needs fixed

[hollow wraith]

How do I reboot it in a taurine not dying friendly way

[visual meadow]

Just... reboot

[hollow wraith]

Is there an option for that? Wont turning off and back on clear ram?

[visual meadow]

Just turn off and on

[hollow wraith]

Ok

Turning it on

[visual meadow]

No need to rerun because libhooker issue will happen again

Just wait for cs

[hollow wraith]

Ok

So it wasn’t actually jailbroken?

[visual meadow]

I guess you could call it kinda

[hollow wraith]

As in call it in software or as in I could say that but that’s not technically the right term

[visual meadow]

You are close to jben tho

Just 1 issue, most likely

[hollow wraith]

Oh wait I did it again now it’s err_jailbreak

[visual meadow]

Because thats like right at the end of jb process

[visual meadow]

Normal

Its not gonna work

[hollow wraith]

Yeah I know I ran it before you said not to

So does taurine see if jailbreakd is running and decide from that?

[visual meadow]

Yes

[hollow wraith]

Right

Can you @ me when I’m needed please I don’t feel well at all, I’m sweating but I’m cold, I’m shaking and I feel sick with a headache

[granite frigate]

restore rootfs

[hollow wraith]

Ok

Why

[steady nest]

rest a bit bro

[hollow wraith]

Do I restore rootFS anyway

[steady nest]

don't fuck up your health for a jailbreak

[hollow wraith]

Nah bro it’s for everyone bro

Not just for me

[steady nest]

also nathan will be home in a bit

[fiery seal]

i can test too

[hollow wraith]

I’m only gonna be a miserable git trying to sleep anyway

[steady nest]

yeah and cube exists so

[hollow wraith]

So should I restore rootfs

[visual meadow]

I get home at 2:40 EST

[visual meadow]

I also set up a hackintosh with xcode 12.whatever

The one coolstar used

[steady nest]

14 is fine

[visual meadow]

Actually no its 13.whatever

[visual meadow]

Yea but debug is fucky

Anyways I got anydesk on it too

We used my macbook air and xcode beta wasn't working well

And it barely had space

My hackintosh has 1tb so

[hollow wraith]

boom

Does restore rootfs delete /taurine

[visual meadow]

Yes

[hollow wraith]

So I’m meant to restore rootfs

And that will wipe that

[visual meadow]

Just rootfs for now

Yea

[granite frigate]

coolstar plays hsr

lfg

[blissful prawn]

A14 14.6 not work

[hollow wraith]

What’s that

[granite frigate]

Honkai Star Rail

[hollow wraith]

/taurine is NUKED

[visual meadow]

Just wait it will be fixed soon

[hollow wraith]

Is this gonna bit a shitty experience when I set it up anyway

[blissful prawn]

Ok thx 🙏🙏🙏

[hollow wraith]

Like it’s new

I like testing

[visual meadow]

Yeah that issue is on 14.4-14.8.1 arm64e

Just wait

[hollow wraith]

Wait so I have achieved root file access?

[primal perch]

taurine 2

[visual meadow]

Yes

[hollow wraith]

Wow there’s a chance I’m the first person in the world on my device software combo

[visual meadow]

I'll dm or ping cs when I'm home

Whatever is preferred

[hollow wraith]

Perf. I’ll take some paracetamol. I’m down to help

Wow I need to be prepared to jb

Uhh I need to buy some tweaks

Shit I spent my money on mwiii

Oh well maybe free tweaks are good too

[fiery seal]

cylinder reborn from chariz is a good free tweak to just test and see if tweak injection is working

cause the effects are immediately obvious

[hollow wraith]

That sounds bad

What are said effects?

Oh I won a tweak that isn’t compatible with iOS 15 and I fucking redeemed it

[fiery seal]

cool effects when you swipe between pages on the home screen

https://cdn.chariz.cloud/screenshot/cylinder-reborn/cylinder-reborn.mp4

[hollow wraith]

That’s headache inducing

[primal perch]

iOS 18 leak

[hollow wraith]

anyway yeah if someone wants to give me an iOS 15-15.7 phone to install Joe on

Oh can I force enable app library on iPadOS 14

[visual meadow]

Yea

[fiery seal]

you can't deny it's a good test for tweak injection tho

[hollow wraith]

I suppose

[hasty ruin]

So is nexus 👍

[hollow wraith]

Sellout

[fiery seal]

nexus drm activated ווי און אַבאָנירן

[hasty ruin]

[hollow wraith]

Is it free

[fiery seal]

nope

[primal perch]

yeah true, safe mode is pretty obvious

[hollow wraith]

@hasty ruin damn looks like you’re gonna he’s to gift me the tweak for me to test it

What a shame

[naive kraken]

I mean the crashes @hollow wraith @visual meadow seem to be caused by the process not having debug flags set

and it's trying to run unsigned code

[visual meadow]

@plain python?

I guess that makes sense

[hollow wraith]

Damnit do I need fucking Xcode

[visual meadow]

I already have it

[hollow wraith]

Wait dont jit launchers launch with debug flag

[visual meadow]

Why wouldn't it be set?

[naive kraken]

I have no idea how this is done on 14

but xina uses get-task-allow entitlement + ptrace

[plain python]

I really hope we don't actually have to call ptrace on 14

since it just uses CS_DEBUGGED there

[naive kraken]

did that just work?

[plain python]

yes

[naive kraken]

like on 15 you have to set wx_allowed on the pmap and that's PPLed

[plain python]

I know that's there on 15

[hollow wraith]

Is this terrible news or bad news

[plain python]

but shouldn't be necessary on 14

[naive kraken]

I mean

unc0ver works somehow

[hollow wraith]

Mfw closed source

Wait is it

[naive kraken]

yes..

[hollow wraith]

Shi

Thought so

[naive kraken]

anyways this crash is either CS_DEBUGGED not being set correctly or the change to wx_allowed having been done earlier

I mean you can always call csops to verify it being set

[plain python]

I doubt 14.4 has it

[visual meadow]

That really could've changed in just 14.3 to 14.4?

[naive kraken]

doubt

I mean

actually

[blazing barn]

https://tenor.com/view/nick-eh-30-never-back-down-never-give-up-gif-15938629783250590873

[naive kraken]

hmmm

[pine holly]

Im currently on 14.4.1, what info do you guys want me to check (u0)

[naive kraken]

I was going to say Fugu14 is open source

But idk if it does anything like this

[velvet path]

Fugu14 uses a PAC Bypass and PPL Bypass iirc

[naive kraken]

also that has a PPL bypass anyways

[naive kraken]

this isn't easy to check

[primal perch]

gnu+ linux

[pine holly]

Why not? Could you just whip together a quick IPA that just used kfd to check the info of something already running

Cause I’m already jb and all

Not saying your wrong, legit have no idea what you are talking about so

[naive kraken]

I mean that's possible with libkrw aswell

but it's like

what do you check

the only thing you could check is what happens when you unset CS_DEBUGGED and run unsigned code that hasn't been paged in

[hollow wraith]

Going to see my mom at work. They put her on a late shift

[pine holly]

Hmmm yeah I see what you mean

[blazing barn]

Say hi for me

[pine holly]

That also sucks with Fugu, it’s open source but it’s implementation isn’t

So much info but none at the same time

[granite frigate]

i figured out why i can't go on to kwrite

the patchfinder is hanging

[naive kraken]

yeah not surprising

the instruction it checks for prob doesn't exist on iOS 12

[granite frigate]

man

i'm too stupid to write my own patchfinder

[pine holly]

Wait

[primal perch]

https://tenor.com/view/hi-morning-sunshine-good-morning-gif-18461250

[granite frigate]

checkra1n works on ios 12 though shouldn't its patchfinder work

[pine holly]

Fugu14 has open source jbd?

Since when

[granite frigate]

Yes

since it released

[pine holly]

I thought it used u0’s jbd

[naive kraken]

u0 has no jbd

[pine holly]

Damn ok

I never knew that

[naive kraken]

bro that's not the point of this patchfinder

the point of this patchfinder is to find kernproc in reasonable time

[granite frigate]

oh tru e...

[naive kraken]

of course you can always do a proper patchfind but it's going to take ages

cause the read primitive is slow af and you don't have access to the kernelcache file until the exploit is done

[granite frigate]

rip

[plain python]

you could pull the thing I did in Electra1141 and download kernelcache from Apple's servers 🚎

[naive kraken]

I'd rather not lol

[native orbit]

reminds me of https://github.com/tihmstar/libgrabkernel

[granite frigate]

i forgot to change the 0x4000 to 0x1000

[naive kraken]

@granite frigate you can always just find the offset via IDA

[granite frigate]

would that affect it 💀

[granite frigate]

right

ok

[naive kraken]

What 0x4000

hm

[naive kraken]

worth a try

[granite frigate]

nope

[naive kraken]

depends on whether it got stuck there

[granite frigate]

😭

[native orbit]

u on a 4k device?

[granite frigate]

yea a7

[native orbit]

ah

what u trying to do

[granite frigate]

get kfd to work on ios 12 a7

okkk the 0x1000 doesn't work

sadge

[native orbit]

how far u gotten?

[granite frigate]

finding kernproc

[blazing barn]

damn iphones have 4k screens thats 🔥

[native orbit]

dont kfd find that?

[steady nest]

can't you hardcode it

[plain python]

that was the thing that was used

[steady nest]

just look it up on the kcache

[granite frigate]

i am sad to say i have no idea how

[steady nest]

or fixup the patchfinder of course

uh

do i have a 12.5 device...?

[native orbit]

idk do u

[elder scaffold]

update 5s

[granite frigate]

i got the kcache but idk how to actually find stuff in it

[steady nest]

perfect time to learn how!

[granite frigate]

Yeah

ok time to google

[visual meadow]

I have real hopper

I bought it lol

[native orbit]

ida 7.7 >

[naive kraken]

ida 8.3 >

[granite frigate]

It works well enough right

[hollow wraith]

opa334>opa333

334>333

[primal perch]

piracy >

real binja ftw

shits affordable asf

38/year as student

[steady nest]

IDA 7.7 is free

[granite frigate]

in conclusion idk wtf im doing

[gentle grove]

no one here has jobs

[visual meadow]

i have job

[primal perch]

yea true mb

[hollow wraith]

I’m 14 and have job

Yippee

I still like bargains though

I get termius for free

[steady nest]

bad battery & fucked screen connectors on mobo probably

[granite frigate]

💀

ok clearly im too stupid to find it manually

[hollow wraith]

Had some wwi and paracetamol

I feel better and I’m ready to help

Any new discoveries in the 14.4+ A12?

[slender glade]

child labor

[hollow wraith]

Nope

Completely legal

Only a couple hours per week

[slender glade]

I hope they’re not paying you

[hollow wraith]

What

Did you accidentally add a not

[slender glade]

No

[hollow wraith]

Why would you want unpaid labour

[pine holly]

None

[naive kraken]

IDA 8.3 is "free" too if you work somewhere where you need it

[primal perch]

[hollow wraith]

Has Nathan been testing stuff or are testers awaiting

[pine holly]

Im not entirely sure what he has tested

But I don’t think he is actively testing anything rn

[granite frigate]

ok kernel data abort (I tried sem_open and kqwl workloop to find kernelproc as they used static offsets)

[hollow wraith]

Ok

[slender glade]

He’s in between

[hollow wraith]

Ok perf

I’ll stay out of it now

[slender glade]

Yeah keep flexing

[naive kraken]

and as a bonus you don't have to deal with wine bullshit

[slender glade]

I just have someone else pay for mine

shout out to @queen thicket

dude paying for IDA AND binja we ate his wallet up bruh

[raven agate]

I've tried twice

What should I do

[visual meadow]

Cs sent me something to test so ill test when i get home

[slender glade]

Broke boy

[raven agate]

Should I turn on airplane mode or smth??

[visual meadow]

Huh

[slender glade]

Bro stuck on iOS 11

Prob not gonna help

[fiery seal]

on my A8X 14.8.1 device the success rate is terrible, it took me like 20 tries
it's potentially fixable but idk the progress on that

so keep trying

[raven agate]

I'm on 14.6

[fiery seal]

yeah

[pine holly]

Nice good to hear

[fiery seal]

it may help to turn on the device and let it sit like that for a few minutes before jailbreaking

[pine holly]

Put in fridge

[fiery seal]

unnecessary

[pine holly]

In front of fan

[slender glade]

What

[pine holly]

Don’t worry about bro

He in his own world

https://media.discordapp.net/attachments/688121419980341282/1139608104447791256/capt.gif

[slender glade]

[vivid dew]

capt can't even spell his own name in his pfp

[pine holly]

Nah cause straight up

[raven agate]

Wait which exploit did u use

Physpuppet or smith

[fiery seal]

i've had at least one success with both, but both have terrible success rate

[raven agate]

Ye ik

Probably the 10th time I've tried now and still the reboot issue

Did u turn on airplane mode when doing it?

[primal perch]

faptain kink

[raven agate]

Can we keep this out of here pls

[primal perch]

no

we can’t sadly

https://media.discordapp.net/attachments/688121419980341282/1116997332089700462/image0.gif

gorn

[raven agate]

Ok now I understand

[vivid dew]

how about you stp your antipsychotics onto your throat stack

how about you stp your antipsychotics onto your throat stack

[primal perch]

how about you stp your antipsychotics onto your throat stack

[primal perch]

true tho

[shrewd smelt]

faptain kink

[primal perch]

armoids

x86 sigmas

amd64 so much cleaner fr

https://media.discordapp.net/attachments/688121419980341282/1139608104447791256/capt.gif

[slender glade]

Your ass ain’t even an orange name

Take your ass back to #jailbreak

[main apex]

#OnlyOrangeNamesShouldBeAllowedToMessageInHere

[slender glade]

actually true

[pine holly]

I mean true but then again you get the occasional no name white name like legit level 0 who has 18x my knowledge

Like there is a decent chunk of people I have never seen that are more knowledgeable than me

But that’s rare

[slender glade]

Sacrosanct

[pine holly]

Beautiful example 😭

Cause it’s accurate

[granite frigate]

I'm not smart

[pine holly]

Can’t make a comment on this but you know more than me 🤷‍♂️

All about relativity

Nobody looks smart when CS or Opa is in chat

[granite frigate]

Lmao

[pine holly]

I legit struggle to hold convos with them because only half the time do I know what I’m talking about

Still tryna learn but like

[granite frigate]

Same

[naive kraken]

I'm not smart

[pine holly]

All about relativity

[naive kraken]

😄

[pine holly]

How many jaikbreaks did each dev make
Iosrouter: 0

Opa: 1

Boom

[vivid dew]

i made leviathan

[pine holly]

Actually someone explain this to me

Why tf does u0 with Fugu14 need PPL but taurine doesn’t

[velvet path]

Fugu14 included a PAC Bypass and PPL Bypass

[pine holly]

But taurine doesn’t have PPL bypass does ITV

*it?

Or am I being stupid

Also PAC wasn’t intro’d until 14.5

Im on 14.4.1

[velvet path]

no?

[velvet path]

Taurine doesn’t utilize Fugu14 whatsoever, and prior to 15 it wasn’t a necessity

[pine holly]

PPL isn’t needed in 14 at all?

[granite frigate]

I'm assuming you can do something like PPL-less like how PACless is a thing

[pine holly]

I guess that’s fair

[naive kraken]

unc0ver also doesn't utilize Fugu14 for anything other than kernel r/w

afaik

[pine holly]

You sure?

[naive kraken]

pretty sure

[pine holly]

Not saying your wrong I’ve just never had someone answer that

I’ve asked that question millions of times

Because Fugu14 itself is like 15 exploits

[naive kraken]

I mean they support iOS 14.8 arm64e too

And I don't think they wanna have extra logic for when they have access to a PPL bypass vs not

[pine holly]

Yeah That makes sense

Surprised no one messed with Fugu14 untether more

I know it’s rough cause easy bootloop but still

Especially with how curious people are

I think it’s very valid iOS 14 has been seeing some love tho

No one could have guessed that

[steady nest]

well, the Fugu14 untether doesn't matter at all

It did at the time, but it was superseded

[pine holly]

Just cause of TrollStore or because it’s such a small compatibility window?

[granite frigate]

haxx?

[velvet path]

because of the CoreTrust bug

[pine holly]

Was never even used I don’t think which sucks but

[steady nest]

which essentialy gives you code exec as pid 1 with any entitlement

[steady nest]

wtf bro

ah minsunderstood

thought you said it sucked lol

[pine holly]

Nah you good

I meant like nobody really implemented right?

Unless I’m wrong

https://github.com/asdfugil/haxx

We are talking about this right^

Sorry can’t delete embed, mobile

@visual meadow how’d you get your ass on here

😭 I’m crying

I’m dead as fuck

Bro was doing tricks on it

[granite frigate]

Is that iOS 13 or 14

my phone also has that github bug on ios 13

Oh ok

[pine holly]

Yeah GitHub been weird

Idk why

Is this a Fr known thing?

The zoom out or whatever

I thought I was diffy and unlucky

[steady nest]

¯_(ツ)_/¯

[granite frigate]

Prolly old browser

[pine holly]

Yeah I refuse to use chrome or anything

Not cause it’s bad I just fw safarai

Most of the time

[velvet path]

I mean all browsers on iOS use the webkit included with the OS version

[granite frigate]

Man wtf i still cant figure out how to find kernproc

[pine holly]

Diff versions

[granite frigate]

W/e i'll try tomorrow

[pine holly]

Have you added prints just to see where the issue is

[granite frigate]

I think every browser in iOS is just Safari under the hood

[pine holly]

Diff WebKit versions tho right?

[granite frigate]

It's stuck in a while true loop

[pine holly]

Idk

[granite frigate]

Nah

That's the entire point of CyberKit

[pine holly]

What ver are you doing

12?

[granite frigate]

Yes

[pine holly]

Wtf is CyberKit

Is this a tweak or just another kit

[granite frigate]

Webkit browser backported for older iOS

https://github.com/UInt2048/CyberKit

[pine holly]

Oh shoot lemme look this up

I’m crying

267k

Bro the UI is like non existent 😭

[restive ether]

how did bro get that far behind

[pine holly]

Right

[late ridge]

yoo

@indigo peak happy birthday!

[harsh junco]

@indigo peak happy birthday!

[indigo peak]

thanks!

[lost nebula]

yooo fr

happy bday

[raven agate]

At least I have an ass

[raven agate]

W comeback

[slender glade]

Are you 12

[raven agate]

No

[slender glade]

Ok so don’t act like it or move ur ass to #jailbreak

[raven agate]

Say it nicely

[slender glade]

Suck my dick

@granite frigate u on?

did u test kfd on iOS 12

[raven agate]

I'll pass on that offer

[raven agate]

I think you're in the wrong server bro, there's no nsfw channel here

[slender glade]

Sorry bro I just joined rjb 7 days ago idk anyrhing abt this server

[pine holly]

They got stuck on KernProc

[pine holly]

“Man wtf i still cant figure out how to find kernproc”

“"“Man wtf i still cant figure out how to find kernproc”"”

[slender glade]

🗿

[steady nest]

wtf is a kernproc

[slender glade]

proc of kernel idk

[tepid olive]

a global that points to the kernel proc

[pine holly]

I just relayed the info 🤷‍♂️

[tepid olive]

there’s also initproc

@slender glade @steady nest

[slender glade]

is initproc that of launchd’s

[tepid olive]

yep

[slender glade]

😲

[steady nest]

uint64_t find_kernproc(uint64_t region, uint8_t* kdata, size_t ksize)
{
    // search C8 10 82 52
    //__TEXT:__text:FFFFFF80024BBC58                 LDR             X8, [X22,#_kernproc@PAGEOFF]
    //__TEXT:__text:FFFFFF80024BBC5C                 STR             X8, [SP,#0x60+var_28]
    //__TEXT:__text:FFFFFF80024BBC60                 MOV             W8, #0xFFFF
    //__TEXT:__text:FFFFFF80024BBC64                 STR             W8, [SP,#0x60+var_44]
    //__TEXT:__text:FFFFFF80024BBC68                 MOV             W8, #0x1086
    uint8_t search[] = { 0xC8, 0x10, 0x82, 0x52 };
    uint32_t* insn = memmem(kdata, ksize, search, sizeof(search) / sizeof(*search));
    if (!insn)
        return 0;
    
    // Find LDR
    uint32_t* ldr_addr = find_prev_insn_matching_64(kdata, insn, insn_is_ldr_imm_64);
    if (!ldr_addr)
        return 0;
    
    //PFLog("ldr_addr %p\n", (void *)((uint8_t *)ldr_addr - kdata));
    
    uint64_t pc_ref = find_pc_rel_value_64(region, kdata, ksize, ldr_addr, insn_ldr_imm_rn_64(ldr_addr));
    if (!pc_ref)
        return 0;
    
    return find_pc_rel_value_64(region, kdata, ksize, ldr_addr + 1, insn_ldr_imm_rn_64(ldr_addr));
}

this finds it for iOS 8, YMMV

the symbol shouldn't be there on later iOS versions

[visual meadow]

Anyone have arm64e 14.3 device

[steady nest]

wait FUICK

[visual meadow]

what

oh

right

yeah

[hasty marsh]

aaaaaa

taurine keeps getting stuck at jailbreakd started

[visual meadow]

what phone that is

[hasty marsh]

iphone 7

ios 14.6

[visual meadow]

idk goot bye

[hasty marsh]

💀

[hasty marsh]

i have an xs on 14.2 somewhere

[primal perch]

ios 18 leak

[ashen birch]

everyone's favorite img4 parser got an update https://github.com/m1stadev/PyIMG4/releases/tag/v0.8

[primal perch]

[faint timber]

please sir depless windows support

[ashen birch]

this should actually do that

from now on installing pyimg4 by itself doesn't require a buildsystem

but no compression support

you'll have to install pyimg4[compression] for that

[faint timber]

yah was referring to compression deps on windows

[ashen birch]

i c

write the lzss/lzfse libs in pure python then trolley

[indigo peak]

i got you

[ashen birch]

at least it actually works on windows if you install a buildsystem

[plain python]

https://github.com/Odyssey-Team/Taurine/blob/main/Taurine/post-exploit/utils/asn1/LZSSDecoder.swift

just port that

[ashen birch]

i need compression also

& lzfse

[plain python]

is that bvx2?

[ashen birch]

yeah

[steady nest]

The compresison libraries

[ashen birch]

give me LZSS/LZFSE compression impls that iboot will actually accept

those libs are p much only good for decompression

[hasty marsh]

i ran 3dmark and once it was finished i got a successful attempt on taurine kfd trolley

wild life unlimited mode

[ashen birch]

can you send

[faint timber]

also need python dmg mounter or reader/writer for multiplat

[timid furnace]

it was very customized for my usecase

aka parsing a cert

[ashen birch]

ah

[ashen birch]

pure python dmg mounter would actually be crazy

ngl

[timid furnace]

wip

https://github.com/jevinskie/FruitSU

[ashen birch]

looks slightly dead

cool though

[timid furnace]

dev is active in hack different

[hasty marsh]

cum library

sorry

[faint timber]

jevin the goat

[primal perch]

jevin the goat

[indigo peak]

@ashen birch how should test LZSSDecoder.py (from the swift port from CS)

[ashen birch]

extract a kernel im4p with pyimg4 but don't decompress it

and just run it through that

[primal perch]

@hasty ruin

[hasty ruin]

@primal perch

[hollow wraith]

@plain python did you manage to debug the issue? I’m free for a bit to help, but I don’t got Xcode if logs and stuff are needed

[indigo peak]

can you send me one i dont think i have any kernel caches downloaded :/

[steady nest]

pzb one?

[faint timber]

ipsw download ipsw -v 16.5.1 -d iPhone15,2 --kernel

[visual meadow]

We were working on it

well mostly cs but

Got it to jailbreak and userspace reboot

and then

all processes were broken

But I guess its a step

[steady nest]

wen eta untether

realistically, what work would be necessary for taurine to be untethered?

[faint timber]

nvram read for anti-bootloop

[steady nest]

We hijack launchd, then we’d need launchd working but not spawning any tasks or daemons, but spawning amfid…?

userspace reboot on boot wouldn’t be needed, what else

[visual meadow]

Then why not like

Hook into launchd

If its possible to inject ct signed dylib into it

with DYLD_INSERT_LIBRARIES

[steady nest]

No

[visual meadow]

or does that not work

ok

[steady nest]

I mean

we can’t spawn amfid without launchd

[steady nest]

this doesn’t work because it isn’t tf_platform

[steady nest]

and this doesn’t work because uh… dyld?

[faint timber]

not this shit again main

did you already forget

[steady nest]

yes

[visual meadow]

sorry

[steady nest]

need to check pwned dyld signed with codesign @faint timber

[faint timber]

still safer to bindmount

would be suicidal to outright replace dyld on fs

[steady nest]

I can sshrd

[native orbit]

mfw 100% rootfs usage

[steady nest]

your gf is 3

[steady nest]

IOPlatformPanicAction -> AppleEmbeddedNVMeController
IOPlatformPanicAction -> AppleT8011USBXDCI
IOPlatformPanicAction -> AppleS5L8960XWatchDogTimer
IOPlatformPanicAction -> AppleT8010MemCacheController
IOPlatformPanicAction -> RTBuddy
IOPlatformPanicAction -> RTBuddy
IOPlatformPanicAction -> RTBuddy
panic(cpu 0 caller 0xfffffff014bd89c0): unexpected SIGKILL of init  with reason -- namespace 9 code 0x1 description none```
![intjstage](https://cdn.discordapp.com/emojis/1082143327765409842.webp?size=128 "intjstage")

oh so you're not against it

why are you against having 3 girlfriends

[pine holly]

Honestly the fact more isn’t broken is solid, support was added in like under a couple days

[steady nest]

doesn't seem caused by taurine

and nonce was almost always broken too

[hasty marsh]

never doubt our god cs

[pine holly]

Yeah I didn’t post it out of disappointment, actually a lil impressed

[indigo peak]

is there a proper way to programatically edit tweak prefs plist

[pine holly]

What.?

Like just edit a plist? With code?

[indigo peak]

yeah

thats what programatically means

[pine holly]

You just load plist and modify

Find it’s path and load

Then just change and save

[restive ether]

the sudo thing is probably some weird upgrade path stuff i’m sure that bootstrap is ancient

[indigo peak]

https://tenor.com/view/mcdonalds-grimace-dancing-dance-dance-off-gif-16706381

me when capt gives helpful advice

[shrewd smelt]

[brazen timber]

forgot how cursed objc is when it's not decompiled

[pine holly]

https://media.discordapp.net/attachments/688121419980341282/1139608104447791256/capt.gif

[steady nest]

you have a dirty mind

[brazen timber]

i prefer objc_msgSend

[wooden yarrow]

you can use objc like how ida shows it

[brazen timber]

yeah obviously

[wooden yarrow]

it just isn't recommended

[indigo peak]

@grave sparrow
so

- (void)setPreferenceValue:(id)value specifier:(PSSpecifier *)specifier {
    if (![specifier propertyForKey:@"key"]) return;
    if ([specifier propertyForKey:@"defaults"]) [super setPreferenceValue:value specifier:specifier];
    // ...
}
``` would become:
```OBJC
- (void)setPreferenceValue:(id)value specifier:(PSSpecifier *)specifier {
    if (![specifier propertyForKey:@"key"]) return;
    if ([specifier propertyForKey:@"defaults"]) {
        NSUserDefaults *defaults = [[NSUserDefaults alloc] initWithSuiteName:@"com.yourcompany.tweak"];
        [defaults setObject:value forKey:[specifier propertyForKey:@"key"]];
        [defaults synchronize];
    }
    // ...
}

?

the class the method is in is inheriting from PSListController

and

[self setPreferenceValue:self.dictionary specifier:[self specifier]];

would become

NSUserDefaults *defaults = [[NSUserDefaults alloc] initWithSuiteName:@"com.yourcompany.tweak"];
[defaults setObject:self.dictionary forKey:[[self specifier] propertyForKey:@"key"]];
[defaults synchronize];

? (this class inherits from PSViewController

[pine holly]

Fiore in the nicest way possible, I thought you knew how to do plist shit? Not calling you a bad dev, you are miles past me

I legit learned a lot from your GitHub, especially that one disvord tweak that hooked network

[indigo peak]

its 5 lines 😭

[indigo peak]

i do (somewhat) , im updating an old tweak for newer a newer version + rootless, so need to figure out how to keep the same functionality, yk

[pine holly]

I KNOW

BUT ITS A DAMN GOOD 5 LINES

It has comparative string

And easy on how to hook

[pine holly]

Bro my tiny ass head forgot about rootless

I don’t know how to do rootless prefs

[indigo peak]

its such a small tweak github thinks is more makefile then logos lol

[pine holly]

I’m lost that makes a lot more sense

[pine holly]

Yep real

[radiant idol]

barely anyone does plist stuff anymore lets be honest

[pine holly]

Fair

[hexed knot]

@indigo peak btw when doing file paths include rootless.h and use ROOT_PATH_NS() for file paths

[indigo peak]

@pine holly

%hook NSURL
+(id)URLWithString:(NSString*)arg1 { return [arg1 containsString:@"discord.com"] && [arg1 hasSuffix:@"/typing"] ? NULL : %orig; }
%end

there, 3 lines

[pine holly]

That shit has never worked for me

Serious skill issue but still

[pine holly]

Bro I know but it’s still good

[indigo peak]

ty

[pine holly]

It helped me ok 😭

[indigo peak]

i swear this was the fastest tweak i ever made, i think it worked on the first build tbh

[hexed knot]

Makes it easier to compile between rootless and rootful

[indigo peak]

mhm

[hexed knot]

That macro will automatically put /var/jb at the beginning if compiling for rootless

[indigo peak]

https://github.com/donato-fiore/Suffisso
this was legit just me disassembling i use **ch btw and adding a pref page LOL

hooray

copilot to the rescue!

[hexed knot]

lol

[indigo peak]

i dont think i even communicated with you when i made that tweak tbh

[timid furnace]

wat

[hexed knot]

Capt can u do me a favor

[indigo peak]

i def didnt see it
i swear to god

pov i got themeing working for enmity

[pine holly]

Lmfao

[indigo peak]

yeah i remember you made a read all button as well

or at least started to

[hexed knot]

Capt give me a realistic price on typecentury source code

[shrewd smelt]

he's true ^

[cinder island]

development

[hexed knot]

This dude wrote definition and then edited it down to def

Average python dev

[shrewd smelt]

async def

[hasty ruin]

never lmao

[granite frigate]

no i get stuck halfway

but the exploit itself works, physpuppet

[atomic widget]

I also got this error. Is it caused by jailbreakd?

Jailbreak failed but when I go into apps it detects jailbreak. So I had to Restore RootFS

[pine holly]

The issue is cause arm64e isn’t supported yet. Just wait a lil, we can’t do much besides wait

[pine holly]

https://media.discordapp.net/attachments/688121419980341282/1139608104447791256/capt.gif

[primal perch]

fr

[hasty ruin]

https://media.discordapp.net/attachments/688121419980341282/1139608104447791256/capt.gif

[pine holly]

Ayo if I were to make a tweak to count number of respring what’s safest method of “hooking” a respring. Initially I thought about fuckung with the command itself but that’s not safe

[primal perch]

count how many times the app loads or hook launchd or sum

[pine holly]

Wait you are right, I could just Ctor mf Springboard

[primal perch]

yeah i guess

[pine holly]

STOP THE CAR

[indigo peak]

shorty giving bomb head finna call it sloppenheimer

[pine holly]

shorty giving bomb head finna call her fiore’s mother

[indigo peak]

😭

[primal perch]

Nebula's pronouns are she/her and she is also a furry but she loves denying it.

[vivid dew]

ok

[pine holly]

Is nebula Fr a woman. Legit can’t get an answer out of he/she/them

@native dune

[native dune]

any pronouns I don't care

[pine holly]

BUT WHAT ARE YOU

[native dune]

isk

idk

[pine holly]

THATS THE QUESTION

BROOOOOOOOOO

I’m filtering through the Twitter

I’m figuring this out

Key words, balls, dick,

Uhh uhh dudes

Idk

[native dune]

balls dick

[native orbit]

bro going cia mode

[pine holly]

Born December 29th

Done

Gone

I win

[native dune]

ok

[pine holly]

Dead ass I found your state on accident in your Twitter before your gender

That’s wild

Prolly not accurate

[native orbit]

[pine holly]

I be waiting to see what opa says

I don’t know the topic but I’m interested asf

[naive kraken]

What you need to do is statically patch launchd in a way where it instead of spawning amfid, it spawns a statically patched CordTrust signed amfid stub instead I think.

[pine holly]

Why not create 2 launchd’s. One would be your modified to spawn statically patched... the other functions as normal. You would at least be able to retain its original functions

[native dune]

what

what's the point of having 2

[native orbit]

double the launching

[pine holly]

One to spawn patched CT signed amfi stub

🤷‍♂️

I just work here

[native dune]

you can't just switch between them though really

[pine holly]

Yeah I guess

By “I guess” I mean I realize what I said didn’t make much sense

Holy shit you tweet a lot

[native orbit]

chronically online lifestyle

[pine holly]

^^^^^^

I love saying that shit 😭

[pine holly]

I give up you win

[raven agate]

I have arm64e iOS 14.5, but idk if that helps

[olive peak]

How do i only detect loaded libs that are codesigned?

[vivid dew]

well the codesigned ones probably have a code signature attached

[olive peak]

Whats that

[vivid dew]

you should probably pick an easier project

[olive peak]

Ok so its just a signature to see if its been modified by anyone else than creator?

[hollow wraith]

The issue seems to be on 14.4 and above sadly

[granite frigate]

i just realised Dimentio finds kernproc can't I just copy paste that and hardcode it in

0xFFFFFFF0034A9380

ok gonna try

[steady nest]

that's not a valid address

[granite frigate]

yes i just realised

i changed it

0xFFFFFFF0220D8A20

idk where i got the 1st one from

[steady nest]

that's still not valid mate

[granite frigate]

💀

bye

[steady nest]

look it up on ida before pasting it on the code

[granite frigate]

T rue...

[steady nest]

:/

outside of container && !i_can_has_debugger

tried original ents, tried no ents, tried

    <key>com.apple.private.security.no-sandbox</key>
    <true/>
    <key>com.apple.private.security.no-container</key>
    <true/>
    <key>com.apple.private.security.storage.AppDataContainers</key>
    <true/>

[granite frigate]

ok i guess I can try looking at dimentio's patchfinder and doing what it does manually in the kcache

[naive kraken]

What did you do

just called posix_spawn in launchd?

[steady nest]

signed amfid with ct bypass and just launched a sideloaded app

[naive kraken]

hm

idk

[steady nest]

how do you sign dyld on dopamine?

like, how's it valid

[naive kraken]

how about

<key>seatbelt-profiles</key>
<array>
    <string>amfid</string>
</array>

[naive kraken]

it's ad hoc signed via Security.framework and added to trustcache

Either way I don't think amfid will launch regularly because it doesn't have platformization

But I think with patching launchd it might be possible

there is the "unexpected exec of non platform binary" panic but I think that's a userspace panic triggered by launchd

[steady nest]

yep it doesn't spawn on boot

only when a sideloaded app launches (maybe some other occasions)

[steady nest]

yes, that happens for every platform binary signed by ct

[steady nest]

same but... why's it amfid_mod lol

[naive kraken]

because ldid is stupid

actually that's probably the core reason why it doesn't work

[steady nest]

I'm using codesign though

[naive kraken]

use the original codesign identifier of amfid

when resigning

[steady nest]

do I use preserve metadata?

[naive kraken]

idk

I think so

codesign --force -s - --preserve-metadata=identifier,entitlements,requirements /Users/opa334/Desktop/dyld_patched_resigned

[steady nest]

nope :/

Let me try to add the seatbelt-profiles

[steady nest]

should this be amfid or com.apple.amfid?

[naive kraken]

fairly sure just amfid

but don't see why you'd need it if you preserved metadata

[steady nest]

codesign --force -s "Worth Doing Badly iPhone OS Application Signing" --preserve-metadata=identifier,requirements --entitlements ents.plist amfid

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>com.apple.private.security.storage.AppDataContainers</key>
        <true/>
        <key>seatbelt-profiles</key>
        <array>
            <string>amfid</string>
        </array>
    </dict>
</plist>

still a no :/

[naive kraken]

oh

there is a CS platform check

IDA gave wrong variable names for some reason

[steady nest]

oof

lumina ftw

[naive kraken]

platform-application should fix it

add that too

this is what the check actually looks like basically

[steady nest]

ohoh

(err=22) failed to assign builtin profile

gotta be due to seatbelt-profiles?

[naive kraken]

hm yeah

I guess you can take any other seatbelt profile

maybe amfid doesn't exist

tbh I don't think you need one at all

[steady nest]

lol panic

unexpected exec of non-platform binary

userspace panic

[naive kraken]

yep

now you need to patch launchd to no longer trigger that

and then you're free from codesigning

[steady nest]

[naive kraken]

Tbh what I would do is just add a library dependency on your own hook library in launchd and resign it

although give it get-task-allow aswell

then you can use ptrace PT_TRACE_ME to get CS_DEBUGGED and do proper hooking shenanigans in launchd

From there it's just a matter of patching out the check and loading an additional launch daemon that runs kfd, activates Taurine and userspace reboots

then ur untethered

although idk how well Taurine would work with this

because you replaced amfid

wait why do you even need to replace amfid lol

if the kfd launch deamon is CT signed it should just run

[steady nest]

just patch this here to unconditionally go green on the csops check

[naive kraken]

yeah

[steady nest]

and nop that tbz

[hollow wraith]

Wait what are you trying to do

[steady nest]

someone tried to untether taurine and it wouldn't untether because amfid wouldn't spawn on boot lol

[hollow wraith]

Wait what version is the untether for lol

[naive kraken]

of course it wouldn't because it was done wrong

anyways there are definitely some problems but I think this is possible

[naive kraken]

14.x

[hollow wraith]

Oh cool

Is the untether a consequence of fixing the unsigned code by a non-debug process issue or just for shits n giggles

[naive kraken]

it doesn't have anything to do with that

[steady nest]

when does launchd setup xpc

[hollow wraith]

So shuts n giggles?

[steady nest]

before starting to launch daemons I suppose?

[hollow wraith]

Just to have an untether

That’s cool

[steady nest]

because those would depend on xpc lol

[naive kraken]

yes

launch daemons are never explicitely started

they just start when something sends a message to them

[hollow wraith]

How early in the chain would the untether run?

[naive kraken]

instantly

but the exploit would only be ran in a later boot task or something idk

[steady nest]

was thinking on that

[hollow wraith]

Interesting

[granite frigate]

booting to a taurine logo would be sick

[naive kraken]

actually

[steady nest]

add dylib to launchd, dyld interpose the func that launches boot tasks, launch taurine, profit?

[naive kraken]

resign launchd with get-task-allow, modify dependencies to include library, library launches kfd, uses ptrace to get CS_DEBUGGED and then you can theoretically just dlopen the Taurine launchd payload and give it KRW

like that would be pretty much it as far as I see it

would be instant and done before any other processes need to launch

[steady nest]

amfid would be pre-pwned in that case, just dyld_insert_libraries amfid_payload