if you don't want to pirate ida (do this) just use ghidra or buy binja student
#development
brazen timber
severe stream
that's like 3 years and a half of apple dev program
primal perch
fr
brazen timber
yeah im also talking about decomp
primal perch
wheres arm then
brazen timber
imagine decomping arm
primal perch
*OS
no arm
brazen timber
if ur serious about re
primal perch
kind of a big problem
brazen timber
you aren't doing arm
primal perch
based
brazen timber
serious about re = looking to do malware analysis or smth
unless u want look at mobile malware lol
primal perch
yes i already amended my statement i was talking about the context of darwin platforms
brazen timber
based
primal perch
binja is great but their arm64 decomp is only like 65% as good in my experience
brazen timber
>*OS
>no arm
see im not a mac user i didn't even know what *os was referring to
brazen timber
ida home also gives u access to support which is nice
primal perch
but if you dont care about wine do just pirate it
i respect binjas model far more too because you buy once you get it on every major OS
unkempt magnet
My jb has been done here~ It was really fun
native dune
nice
knotty igloo
Wow
indigo peak
My jb has been done here~ It was really fun
nice work 
brazen timber
My jb has been done here~ It was really fun
nice work but change that font
velvet path
My jb has been done here~ It was really fun
nice - how functional is it by chance (haven't looked too much into it)
hasty marsh
My jb has been done here~ It was really fun
would be better if you used comic sans font
primal perch
hasty ruin
severe stream
hasty marsh
wooden yarrow
shrewd smelt
torn oriole
unkempt magnet
nice - how functional is it by chance (haven't looked too much into it)
Most of things work but userspace reboot/ldrestart not works.
Only 6s 15.1 works due to hardcoded offsets.
unkempt magnet
Sometimes when open sileo, just panic seldomly
So reliability is not guaranteed, NOT recommend for general users
unkempt magnet
One day, I really hope mineek & serena & hahalosah make perfect jb.. someday will be happen.
hasty marsh
So reliability is not guaranteed, NOT recommend for general users
fix = dont open sileo 
severe ridge
currently attempting to find ios 16.4.1 iphone 8 plus offsets
slender glade
One day, I really hope mineek & serena & hahalosah make perfect jb.. someday wil...
We’re just stuck on dynamic tc :(
It just doesn’t work on our devices, mine and Mineek’s
Once we get dynamic tc working everything else is gonna be easy
elder scaffold
(If it's not finished yet by mid-September,) I might try it.
i can't really do anything right now... 
slender glade
(If it's not finished yet by mid-September,) I might try it.
i can't really do a...
😯
slender glade
My jb has been done here~ It was really fun
Did you have to patch dimentio?
unkempt magnet
No, just needed libjbdrw. That is enough.
faint timber
Did you have to patch dimentio?
Not needed I did all the work for dopamine
However I never fixed kcall
slender glade
Not needed I did all the work for dopamine
slender glade
No, just needed libjbdrw. That is enough.
I see
Once I get dynamic tc working we’re gonna be so back
faint timber
We are in an era where you basically have one jailbroken version per iPhone launch if you are lucky 
slender glade
We are in an era where you basically have one jailbroken version per iPhone laun...
I never thought abt it like that
wooden yarrow
makko
slender glade
nacho
that's the food
@unkempt magnet i'm gonna try staticTrustCacheUploadCDHashesFromArray rather than dynamic
if it doesn't work it's prob a krw issue
slender glade
offsets are the most frustrating part of this fml
slender glade
automate finding offsets
lol
severe ridge
currently attempting to find ios 16.4.1 iphone 8 plus offsets
so far i found one offset
zenith hatch
slender glade
how hard would it be to write a patchfinder for kfund
Oh it’s only like 40 offsets dw
slender glade
so far i found one offset
which one
slender glade
puniqueid (0x48)
lol
severe ridge
maybe i should try this modified script: https://github.com/tihmstar/libpatchfinder/issues/29#issuecomment-1651805769
it won't find vm_pages and vn_kqfilter but it should find the rest
i am on windows and don't know how to compile libpatchfinder so
naive kraken
I wish I could figure out how to run badRecovery from kfd but I just run into weird issues that make no sense 😭
slender glade
I wish I could figure out how to run badRecovery from kfd but I just run into we...
What is it
@lime pivot @restive ether @primal perch https://x.com/coreserena/status/1695769824599720061
Twitter
naive kraken
What is it
fugus pac bypass
slender glade
fugus pac bypass
Ah
wheat grotto
Crazy ? I was crazy once
wooden yarrow
<@239564780271173642> <@272812398308622336> <@726214891970625549> https://x.com/...
average windows user
slender glade
We got dynamic tc #782323285294841896 message
hasty ruin
We got dynamic tc https://discord.com/channels/779134930265309195/78232328529484...
old news, mineek showed it here first
slender glade
old news, mineek showed it here first <:troll:794397046706667530>
We don’t give a FUCK
Also where because I didn’t see it here
hasty ruin
slender glade
https://discord.com/channels/349243932447604736/688122301975363591/1145380916068...
Whatever I’m too excited
Now the biggest obstacle is out of our way
hasty ruin
slender glade
hasty ruin
slender glade
Thanks @hasty ruin
hasty ruin
slender glade
Now no one can unpin it
hexed knot
only messages sent by capt can be unpinned
slender glade
Fr
radiant idol
how dare he say that
unkempt magnet
We got dynamic tc https://discord.com/channels/779134930265309195/78232328529484...
Congratz!
slender glade
how dare he say that
🧌
faint timber
offsets are the most frustrating part of this fml
offsets are the first thing I did to become a jb dev back in 2016
slender glade
offsets are the first thing I did to become a jb dev back in 2016
Damn u old as fuck
faint timber
it's the first rung on the ladder
slender glade
sorry
slender glade
it's the first rung on the ladder
Ic
U hear that @granite frigate
Honestly it’s the most time consuming thing for me
faint timber
once you got offsets you are closer to becoming a security researcher
slender glade
Otherwise everything after getting the offset
Is just a run-debug loop and just testing shit
faint timber
I propose a cool plan for offsets
but I don't have the time or interest
so its up for grabs
slender glade
I propose a cool plan for offsets
What’s up
faint timber
So arm provides Arm Exploration tools with a map for every instruction, instead of doing manual decoding like tihmstar does you can just parse the xml files and make a fully automatic and accurate disassembler. With that you can utilize it to make a good kpf
slender glade
am i the only one that enjoys it lol
Do u also enjoy doing tests
native orbit
like school tests?
native orbit
hell nah
native orbit
its like a puzzle
slender glade
It’s the jb equivalent of a math test u didn’t study for
native orbit
idk i just enjoy shit like that ig
slender glade
💀
granite frigate
Is just a run-debug loop and just testing shit
"iPhone has disconnected"
slender glade
"iPhone has disconnected"
Half the time this happens bc my phone’s port is so easily disconnected
wiggles like a newborn
hasty ruin
capt is vegan
hasty ruin
fr lmao
hasty ruin
primal perch
he's not a vegan just a vegan apologist
arguably worse
slender glade
Congratz!
Unfortunately the only thing that worked rn is re-running the exploit from jbd bc the krw handoff we used didn’t work for this
I don’t think kfund’s works on anything above 15.1+ bc of the checks Apple added
So Mineek and I have to find a getaround or another krw handoff method that would actually work
native orbit
if it works it works 
dry badge
Does anyone know what architecture the S5 chip is? I'm trying to jailbreak the HomePod Mini for personal use and I can modify the OS no problem. My only problem is there is no form of shell in the OS. I currently am trying to get root via launchd. The only was I can think of to have launchd execute something is through a shellscript. As mentioned earlier, there is no form of shell, so I would need to install my own.
naive kraken
So Mineek and I have to find a getaround or another krw handoff method that woul...
page tables
Once I managed to integrate kfd into Dopamine, I may try adding arm64 support anyways
it's just that it will be a massive hassle to get rid of TrollStore and write a new patchfinder
slender glade
Once I managed to integrate kfd into Dopamine, I may try adding arm64 support an...
?
naive kraken
There is nothing in Dopamine that wouldn't work on arm64 except for the patchfinder
slender glade
I see
naive kraken
only problem is that it relies on being installed with TrollStore
which unfortunately doesn't work on 15.5+
slender glade
page tables
Elaborate?
slender glade
Ah
You mean that
I see
Not using if switching to that method would make this work though
slender glade
if it works it works <:shrug:1018220212358746216>
Bad way of thinking for this imo
dry badge
Does anyone know what architecture the S5 chip is? I'm trying to jailbreak the H...
ANy ideas?
Couldn't find it anywhere :/
steady nest
it's just that it will be a massive hassle to get rid of TrollStore and write a ...
"new" or update the current one?
native orbit
Bad way of thinking for this imo
nvm i read it as "we found a workaround" not need to find one
slender glade
lol
native orbit
damn
naive kraken
and I fear there will be a lot of struct offsets that need to be found for arm64 support
native orbit
can use tihmware patchfinder 
hasty ruin
i just realised that rootless lets you have multiple jb setups
bc you can just swap what environment /var/jb points to
native orbit
crane but with jailbreak setup
steady nest
and I fear there will be a lot of struct offsets that need to be found for arm64...
I feel like this would be the most annoying
xerub's pf is a good start
no need to reinvent the wheel ig
ah but that requires a Kernel dump ;_;
native orbit
kcache downloader time
steady nest
huum but you have the whole kernel mapped into your process
naive kraken
huum but you have the whole kernel mapped into your process
no you don't
at the time the patchfinder needs to run you have nothing
but getting access to the kernelcache file is possible
it needs to run post kexploit pre PAC bypass
hasty ruin
crane but with jailbreak setup
fr
native orbit
new icraze tweak
radiant idol
whst
slender glade
and I fear there will be a lot of struct offsets that need to be found for arm64...
The worst part of just about anything
slender glade
bc you can just swap what environment /var/jb points to
Wait you’re lowkey cooking
radiant idol
okay now that's actually kinda cool
hasty ruin
Wait you’re lowkey cooking
right?!
radiant idol
iCraze had a good idea finally
hasty ruin
🗿
slender glade
Bro just got his first ever shower thought
hasty ruin
iCraze had a good idea finally
your ideas are just remaking tweaks from a few ios versions ago
slender glade
your ideas are just remaking tweaks from a few ios versions ago
This is a slur for devs
Ok but like
Half of all existing tweaks
are just bringing in features from other versions
Whether older or newer
hasty ruin
SearchDots and OneSettings ain't reborn's
SearchDots doesn't count, that's apple's idea
(rare)
radiant idol
but there's an App Library option
slender glade
Creativity is not a score to count in jb tweaks imo
radiant idol
native orbit
SearchDots doesn't count, that's apple's idea
so nexus dont count (kinda)
radiant idol
REAL
hasty ruin
has more features than ios 16!
radiant idol
So does SearchDots
native orbit
ios 17 getting close tho
radiant idol
smh
timid furnace
bc you can just swap what environment /var/jb points to
you'd have to ensure that any jailbreak you support doesn't delete other jb-XXXX folders
radiant idol
back me up here guys
timid furnace
but yea, feasible
hasty ruin
Creativity is not a score to count in jb tweaks imo
the dude in #jailbreak reversing some paid tweak and cloning it bc he doesnt wanna pay $3:
hasty ruin
you'd have to ensure that any jailbreak you support doesn't delete other jb-XXXX...
build it into the jb
timid furnace
the dude in <#688122301975363591> reversing some paid tweak and cloning it bc he...
FreeNexus coming soon!
hasty ruin
radiant idol
the dude in <#688122301975363591> reversing some paid tweak and cloning it bc he...
what
lol
timid furnace
~~build it into the jb~~
I mean ngl it would be kinda cool if you had a tweak do it
slender glade
I mean ngl it would be kinda cool if you had a tweak do it
Why a tweak
timid furnace
instead of depending on jailbreak support
slender glade
What would it even hook
timid furnace
theoretically you could switch between whole setups
slender glade
timid furnace
Why a tweak
Not even a tweak just an app really
hasty ruin
AND it'd move people from palera1n rootful
inb4 switching between fakeFS's
timid furnace
theoretically you could switch between whole setups
*jailbreak setups
native orbit
need to get swift to 80% at minium fr
slender glade
I think a cli tool would be best for this
slender glade
need to get swift to 80% at minium fr
What’s this
radiant idol
need to get swift to 80% at minium fr
Obj-C on top
native orbit
What’s this
socket
timid furnace
*jailbreak setups
although currently i don't think there's any overlap between rootless jbs
radiant idol
REAL???
timid furnace
although currently i don't think there's any overlap between rootless jbs
maybe palera1n and wh1te4ever's kfund but that's it
native orbit
Is that the name of your project or is this referring to Unix sockets
project (jailbreak)
slender glade
project (jailbreak)
Oooo
radiant idol
is everyone just making their own jailbreaks nowadays lol
native orbit
everything is swift except for 32 pf and the exploit
slender glade
is everyone just making their own jailbreaks nowadays lol
The 2 people we depended on just left
radiant idol
right 
slender glade
At the same time too
native orbit
ong
slender glade
radiant idol
cat
slender glade
His solution to every issue is to wrap his code in DispatchQueue.main.async {
native orbit
raven peak
Anyone know how to fix “building in iOS but linking in .tbd file” when making a packing with theos on Mac?
hasty ruin
ignore it
timid furnace
Anyone know how to fix “building in iOS but linking in .tbd file” when making a ...
post full line
slender glade
They got so fcking annoying this year with the Xcode beta and basically just broke all tbds
You have to edit them now
hasty ruin
timid furnace
imagine building stuff with new Xcode
hasty ruin
fr
slender glade
Yeah well it’s gonna come haunt your ass soon lol
slender glade
yk the environment switch thing
Uh huh
timid furnace
depends
slender glade
Why would u need to rest tap
native orbit
how many source files is to much in xcode u think
slender glade
restrap
hasty ruin
Why would u need to rest tap
to make a new env
native orbit
it just check for /p/p/jb-* and links it
steady nest
but getting access to the kernelcache file is possible
it’s the best shot tbh, the read prim is too slow
timid furnace
@radiant idol lmao this is still at the top of my search results
radiant idol
lmfaooo
hasty ruin
it just check for /p/p/jb-* and links it
yep
raven peak
post full line
Making all for tweak fb…
==> Preprocessing Sources/fb/Tweak.x.swift…
==> Preprocessing Sources/fb/Tweak.x.swift…
==> Compiling module interface (arm64e)…
==> Compiling module interface (arm64)…
==> Compiling Sources/fb/Tweak.x.swift (arm64e)…
==> Compiling Sources/fb/Tweak.x.swift (arm64)…
==> Compiling Sources/fbC/Tweak.m (arm64e)…
==> Compiling Sources/fbC/Tweak.m (arm64)…
==> Linking tweak fb (arm64)…
ld: warning: building for iOS, but linking in .tbd file (/Users/pain/theos/vendor/lib/iphone/rootless/CydiaSubstrate.framework/CydiaSubstrate.tbd) built for iOS Simulator
==> Generating debug symbols for fb…
==> Linking tweak fb (arm64e)…
ld: warning: building for iOS, but linking in .tbd file (/Users/pain/theos/vendor/lib/iphone/rootless/CydiaSubstrate.framework/CydiaSubstrate.tbd) built for iOS Simulator
==> Generating debug symbols for fb…
==> Merging tweak fb…
==> Signing fb…
timid furnace
yea you should be fine
raven peak
yea you should be fine
where can i find the deb since i dont see it
hasty ruin
just rename to oldjb-hash
native orbit
oh true
timid furnace
where can i find the deb since i dont see it
packages folder
native orbit
<:fr:712506651520925698>
timid furnace
just rename to oldjb-hash
yea this would work
you should also make a new file when switching
.environment_name
slender glade
Yo
If you get root
And you’re an application
Does NSHomeDirectory still return the containerized path
hasty ruin
you should also make a new file when switching
could just keep the main setup as jb-hash
then make other setups
jbsetup1-hash
jbsetup2-hash
etc
hasty ruin
then the environment selector looks for "jb" in folder name (only stock folders are appleinternal, private, system, usr)
timid furnace
otherwise the name would be lost once you set a setup as the active env
slender glade
Then you wouldn’t need to change the dopamine code itself
And could just make a tool to change the symlink
hasty ruin
doesn't matter too much
/var/jb points to pro, so would prob just be nicer to read /var/jb/dotfile to get the name
but yeah
doesnt matter
timid furnace
/var/jb points to pro, so would prob just be nicer to read /var/jb/dotfile to ge...
forgot about that
timid furnace
And could just make a tool to change the symlink
dopamine regenerates the symlink every time
slender glade
Oh
hasty ruin
does palera1n
timid furnace
you need to rename the folder, you don't want to rely on the "find jb-XXX" code being deterministic
timid furnace
does palera1n
idk
hasty ruin
you need to rename the folder, you don't want to rely on the "find jb-XXX" code ...
yeah true
timid furnace
i would work under the assumption that yes
timid furnace
i know the boot manifest hash code is stolen from dopamine because i wrote it
native orbit
Does NSHomeDirectory still return the containerized path
NSHomeDirectory: /var/mobile/Containers/Data/Application/B03B71EF-E825-42F1-9CA9-6199C6B24ED2
Its with system/jbs apps when root is set
timid furnace
so possibly other stuff too
slender glade
NSHomeDirectory: /var/mobile/Containers/Data/Application/B03B71EF-E825-42F1-9CA9...
Aight
native orbit
thats from a userapp with no ents, just root
timid furnace
lemme check loader src
hasty ruin
as im making this on my main device, imma copy my setup to /var/mobile as a backup
you panic surprisingly soon after renaming the boot hash folder
wtf
oh
either the folder name got reverted
or it didnt actually get renamed
naive kraken
you panic surprisingly soon after renaming the boot hash folder
it panics so quickly it cannot flush the change to disk
hasty ruin
oh yeah true
naive kraken
this is also why I removed the remove jailbreak option while jailbroken
timid furnace
how are you gonna switch environments while jailbroken then
naive kraken
keep boot_info.plist in tact
timid furnace
ah
dry badge
Will MacOS not let me mount/flash a modified OS if the digest has changed?
severe ridge
ping me when we find offsets for arm64 devices
plain python
@naive kraken @visual meadow @unkempt magnet I have a suspect on what the issue is with arm64e 14.4+, as well as a potential fix
unkempt magnet
<@208334999722786816> <@227157716106346497> <@499819541291991041> I have a suspe...
Nice
unkempt magnet
So reliability is not guaranteed, NOT recommend for general users
Seems like fixed panic in release version(v1.0-dev1). No more panic so far
pine holly
<@208334999722786816> <@227157716106346497> <@499819541291991041> I have a suspe...
Haha, I didn’t get pinged but still gonna say that’s good news
timid furnace
why are you using cydia
why are you in #development
radiant idol
lets fix cydia
primal perch
why are you using cydia
why are you in #development
blazing warren
why are you using cydia
why are you in #development
hasty marsh
why are you using cydia
why are you in #development
night rover
why are you using cydia
why are you in #development
blazing barn
<@208334999722786816> <@227157716106346497> <@499819541291991041> I have a suspe...
LETS GOOOOOOO, I LOVE YOU (in a friendly way)
granite frigate
Seems like fixed panic in release version(v1.0-dev1). No more panic so far
what was the problem
unkempt magnet
Sometimes when open sileo, just panic seldomly
This
Added some proc check in jailbreakd, now it's okay
hasty ruin
unkempt magnet
Added some proc check in jailbreakd, now it's okay
Nah... it's panic again 😦
Maybe watchdog issue?
raven peak
If I want to remove a button like YT shorts or a banner, could I use the permflex shortcut “@property bool enabled” in swift or do I have to look at the other methods/properties for something similar?
plain python
<@208334999722786816> <@227157716106346497> <@499819541291991041> I have a suspe...
arm64e fix is validated to not cause regressions on arm64 14.3 and 14.8.1
so only question is if it actually fixes arm64e lol
slender glade
I can read but idk why it says that
why would the arch be blank
(mach-o file, but is an incompatible architecture (have 'arm64', need ''))
oh.
==> Warning: Building for iOS 7.0, but the current toolchain can’t produce arm64e binaries for iOS earlier than 14.0. More information: https://theos.dev/docs/arm64e-deployment
ornate frigate
I don't need arm64e
slender glade
you need an older toolchain
ornate frigate
I am compiling for iPhone 8 Plus on iOS 15
torn oriole
`(mach-o file, but is an incompatible architecture (have 'arm64', need ''))
`
Bro built his binary for ""
slender glade
then change the min target from 7 to 15
slender glade
Bro built his binary for ""
he got the secret arch
torn oriole
arm64Pro
slender glade
TARGET := iphone:clang:latest:7.0
change this
to TARGET := iphone:clang:latest:15.0
ornate frigate
to `TARGET := iphone:clang:latest:15.0`
with this, I get
how can I disable arm64e?
slender glade
that's not the issue
ornate frigate
no?
ornate frigate
how? first time doing anything related to jailbreak development
I just installed theos with the command it gave me
slender glade
brew uninstall fakeroot, brew install fakeroot
ornate frigate
should I force it?
Error: Refusing to uninstall /opt/homebrew/Cellar/fakeroot/1.32.1
because it is required by makepkg, which is currently installed.
You can override this and force removal with:
brew uninstall --ignore-dependencies fakeroot
idk
torn oriole
Cause it has the arch, but it thinks it needs a diff one
slender glade
makefile based build systems were a mistake.
torn oriole
What kind of Mac do you have
torn oriole
Hm
ornate frigate
Got it. Any idea how I can fix it so it can compile the thing?
what settings?
that should be off already
faint stag
i don't doubt it
isn't fakeroot used for building some procursus packages anyway
which is the case, so i doubt procursus fakeroot would just be broken lol
ornate frigate
so what do I need to do
visual meadow
<@208334999722786816> <@227157716106346497> <@499819541291991041> I have a suspe...
let's go
slender glade
@hasty ruin someone unpinned the DispatchQueue message and a whole bunch of other ones
Most of the pins kept are capt’s….
hexed knot
@restive ether who is unpinning
Even the hex subtraction img got unpinned
Maybe its not capt
restive ether
what
restive ether
hexed knot
Vote to unpin all capts messages
slender glade
fr
man what the fuck
so
size_t kwritebuf_remote(uint64_t where, const void *p, size_t size){
size_t remainder = size % 8;
if (remainder == 0)
remainder = 8;
size_t tmpSz = size + (8 - remainder);
if (size == 0)
tmpSz = 0;
uint64_t *dstBuf = (uint64_t *)p;
size_t alignedSize = (size & ~0b111);
printf("alignedSize: %zu\n", alignedSize);
for (int i = 0; i < alignedSize; i+=8){
kwrite64(where + i, dstBuf[i/8]);
// read what we wrote to check if writing did indeed work
#if DEBUG
uint64_t read = kread64(where + i);
printf("val: %llu, what we wrote: %llu, same: %s\n", dstBuf[i/8], read, dstBuf[i/8] == read ? "yes" : "no");
#endif
}
if (size > alignedSize) {
uint64_t val = kread64(where + alignedSize);
memcpy(&val, ((uint8_t*)p) + alignedSize, size-alignedSize);
kwrite64(where + alignedSize, val);
#if DEBUG
uint64_t read = kread64(where + alignedSize);
printf("val: %llu, what we wrote: %llu, same: %s\n", val, read, val == read ? "yes" : "no");
#endif
}
return size;
}
this is our kwritebuf_remote impl in jbd after handoff
and it just fails at writing
like
after reading the addresses we wrote
they're 0
fml idk what to even do now
maybe evelyn's handoff is just bad
we can't use wh1te4ever's either because that doesn't work on anything above 15.1
steady nest
we can't use wh1te4ever's either because that doesn't work on anything above 15....
it's been PAC'd, but arm64 doesn't have PAC
it should work as is
slender glade
https://twitter.com/little_34306/status/1696106159118401639?s=61&t=w7e0pCRFpuKjn...
fire
@crisp frost
is that it? just offsets?
i thought there were a couple other checks stopping it
visual meadow
we love pac
visual meadow
nah fuck pac
slender glade
bipolar?
crisp frost
i thought there were a couple other checks stopping it
WHAT
either hahalosah or siguza lied
steady nest
bro
crisp frost
slender glade
'IOSurfaceRoot is dead'
steady nest
mate doesn't know what pac is
crisp frost
this entire time
slender glade
🗿
crisp frost
i would be so mad at hahal;osah
because I didn't try
because I thought it wouldn't work
😭
@slender glade ok let's do this.
slender glade
<@757471890829869076> ok let's do this.
true
crisp frost
I always said it worked
i didn't see it...
slender glade
@crisp frost we're gonna need some offsets tho
crisp frost
@slender glade lemme add you to the repo mineekJB15v2 you try to implement tihmrw ill make a offsetfinder
ok?
slender glade
alr
slender glade
steady nest
i didn't see it...
crisp frost
@slender glade https://github.com/mineek/mineekJB15v2
slender glade
https://discord.com/channels/349243932447604736/1084320818231787552/114245059825...
You don't have access to this link.
slender glade
<@757471890829869076> https://github.com/mineek/mineekJB15v2
let's get this bread
crisp frost
https://discord.com/channels/349243932447604736/1084320818231787552/114245059825...
i feel so stupid now
steady nest
22/07 and 19/08
crisp frost
@steady nest wanna know the best part
I GOT the kernel rw working itself from tihmstar
slender glade
.
crisp frost
I just didn't bother implementing handoff because right at that time hahalosah told me it wouldn't work
slender glade
he TRICKED yo ass
steady nest
I don't want to be mean, but didn't we come to the conclusion they don't know that much about jailbreaking
slender glade
I don't want to be mean, but didn't we come to the conclusion they don't know th...
yeah
slender glade
I didn't know haha told mineek
crisp frost
i'll see what i can do
slender glade
school starts tomorrow so....
yeah get ur ass off mf i'm already on that xcode
steady nest
because me, opa, evelyn said it'd work
slender glade
ev backed out of it
crisp frost
because me, opa, evelyn said it'd work
if I saw that explicitely I would've trusted you above hahalosah, but I didn't see it...
slender glade
said it wouldn't later on on 15.7.1 or whatever
crisp frost
i feel so stupid now
steady nest
said it wouldn't later on on 15.7.1 or whatever
yeah but isn't it patched in 15.7.something
slender glade
kfd itself?
steady nest
if I saw that explicitely I would've trusted you above hahalosah, but I didn't s...
np but the only patch I know of is pac
it's in the mcbc talk or some talk from that time
crisp frost
well the point is that I know that it works now and that we can try getting it now
slender glade
when do u come back from school
crisp frost
when do u come back from school
every day at 15:30 I'm home
crisp frost
I don't see how https://github.com/34306/kfund/commit/b5016ab62a1c6f072cff39c6f6b788614c4b8f32 would work tho
- they didn't change jbd offsets
- off_ipc_port_ip_kobject = 0x58
- this is 100% 0x48 on 15.7.1 6s, so i doubt it's back to 0x58 on 15.7.3
slender glade
I don't see how https://github.com/34306/kfund/commit/b5016ab62a1c6f072cff39c6f6...
who is this
nguyen?
crisp frost
ig ill restore to 15.7.3 and just try it
slender glade
@native gale is this u mf
grim sparrow
Uuuhhhh
Idk
You still didn’t answer my dm
Do it rn it’s causing me much distress
timid furnace
It was info about xina support
hasty ruin
Oh yeah Ofc
@grave sparrow stop unpinning memes smh 
I unpinned that because it was out dated
because things changed between Amy’s theos PR and official support
twilit jungle
slender glade
@grave sparrow why did u join 3 days after my bday
Rejoin my bad
😯
I have a ss of ultra from 2018 but his nick has a word that may get me warned
brazen timber
brazen timber
discord didn't care until like 2020
primal perch
icraze ios
brazen timber
literally 1984
slender glade
discord didn't care until like 2020
Fr someone sent me a video of a child getting blown up in 2018
brazen timber
Fr someone sent me a video of a child getting blown up in 2018
lmfao
slender glade
What did he do
primal perch
slender glade
FREAK
slender glade
nah jk thats fucked
fr it was a Palestinian child I think
How’s that tweak you made
backupmator
Whatever it was called
brazen timber
Fr someone sent me a video of a child getting blown up in 2018
they over compensating in the 2020s for what they didn't do last decade
slender glade
they over compensating in the 2020s for what they didn't do last decade
Lmfao
You did
people had to make tags saying DONT USE THIS MF’S TWEAKS!!!
primal perch
no warranty of any kind disclaimer etc
brazen timber
you asked for it
slender glade
@brazen timber @primal perch @grave sparrow what do y’all get at McDonald’s
primal perch
mcbitchin
brazen timber
i haven't had fast food in like 6 months
slender glade
bruh I’m hungry but a big tasty may be too much but I’d still be hungry after a Big Mac
slender glade
.
primal perch
bell exists and is better
brazen timber
real
slender glade
That’s the phone carrier
brazen timber
>member ultra
member one
slender glade
>member one
member pro
primal perch
im still only level 93 despite being the 13th highest here
severe ridge
and i'm a white name
primal perch
how tf do u get ultra
slender glade
im still only level 93 despite being the 13th highest here
Level 93
slender glade
and i'm a white name
Who invited you here
brazen timber
fr
severe ridge
Who invited you here
i joined it myself
primal perch
discord user stkc
granite frigate
yo wut
slender glade
discord user stkc
Joe
granite frigate
whats up
granite frigate
touching grass actualy
slender glade
touching grass actualy
Bro you were porting kfd to 13 different jailbreaks
severe ridge
i joined it myself
the subreddit's sidebar had the discord link
slender glade
(That’s not an offset)
primal perch
slender glade
Or is it? I’m pretty sure it’s not
granite frigate
it’s not
primal perch
how are mfs still on mojave in 2023
slender glade
how are mfs still on mojave in 2023
Why what r u using
granite frigate
kfd gives u it
the patchfinder for it doesn’t work lol
primal perch
tryna enroll this shit in jamf but i cant cus they are on a 5 year old OS
granite frigate
iosurface one doesn’t at least
primal perch
so i gotta update it
slender glade
the patchfinder for it doesn’t work lol
granite frigate
so ok i go and look at patchfinder64
slender glade
and try to find it in kcache
Did u find it
granite frigate
no
slender glade
oh
granite frigate
:tro
slender glade
It’s ok we all have those days
slender glade
@granite frigate you know what you reminded me of
granite frigate
what
slender glade
one time we were walking in some place in France near some museum
and a bee stung my sister
granite frigate
wow damn you went to france
lime pivot
they just didn't update in 5 years?
I’ve had someone ask why WhatsApp asks them to update, go to their app store and they have like 100 app updates available because they said they don’t like when things update
brazen timber
a bunch of people don't update their phone apps tbh
im sure if more people did companies would be faster to lock out older versions
and then i wouldn't be able to abuse their mobile apis as easily
slender glade
a bunch of people don't update their phone apps tbh
im sure if more people did c...
90% do
bc it's automatic
if iOS version updates weren't automatic, 70% of people would still be on iOS 14 lol
brazen timber
lool tru
granite frigate
if iOS version updates weren't automatic, 70% of people would still be on iOS 14...
i still know one of my friends on ios 14 because he forgot to update
mfs are crazy
brazen timber
i still know one of my friends on ios 14 because he forgot to update
clearly he just wants to use taurine kfd
primal perch
if iOS version updates weren't automatic, 70% of people would still be on iOS 14...
fr
granite frigate
nah he doesn’t know anything about jb
crisp frost
tihmstar kernel rw handoff is being funny
primal perch
when mac updates arent default mfs are still on high sierra and mojave
brazen timber
my friend had a like a 128gb macbook that couldn't update because he had multiple installations of fortnite from 2017 on there
it was just chilling on yosemite
primal perch
timid furnace
10.14.6
I know jamf machines that are in Mojave
*on mojave
Although you should update them anyway Mojave old as fuck
cursive rampart
primal perch
its probably possible but my work said not to bother trying if its <big sur
and i get paid to sit here watching the loading bar so whatever
unkempt magnet
tihmstar kernel rw handoff is being funny
Does it work on iOS 15.7.x?
crisp frost
Does it work on iOS 15.7.x?
I don't actually know, I'm currently on 15.7.1 and it gets stuck here
I guess ill try a older iOS version ( 15.4.1 )
unkempt magnet
- they didn't change jbd offsets
- off_ipc_port_ip_kobject = 0x58
- this is 10...
I see
https://twitter.com/Little_34306/status/1696106159118401639?s=20
I'm now confused he got working jb on 15.7.3...
slender glade
https://twitter.com/Little_34306/status/1696106159118401639?s=20
I'm now confus...
@native gale
crisp frost
@steady nest im actually beyond confused right now, maybe you know more about whether it's 15.2 or 15.7.x?
crisp frost
<@213293185449852929> im actually beyond confused right now, maybe you know more...
yes I asked for permission to share the DM
cool but im confused
whether the usage of "iosurfaceclient kern r/w" is patched in 15.2 or 15.7.x
cedar stag
Is it possible to unsandbox a user app without having to install it to /Applications or /var/jb/Applications in rootless?
I tried numerous entitlements but I couldn’t get it working
faint timber
you just need to read a plist file and call some code from dylib ctor
cedar stag
What plist file?
steady nest
<@213293185449852929> im actually beyond confused right now, maybe you know more...
a) but is it there on arm64
b) explain 6s 15.7.3
faint timber
What plist file?
sandbox extention, then you call consume from dylib
I don't know shit about entitlements
crisp frost
a) but is it there on arm64
b) explain 6s 15.7.3
that 6s 15.7.3 is not real either way, or atleast not from the code in the fork, as there are quite some offsets left unchanged, and some functions are just plain broken (e.g. directly reading ucred and not reading proc_ro -> ucred on 15.2+ )
faint timber
I'm sorry what does apple adding a new iosurface vtable function got to do with primitives breaking
slender glade
I'm sorry what does apple adding a new iosurface vtable function got to do with ...
What
faint timber
steady nest
we clearly know 1) isn't there on arm64
crisp frost
yeah
steady nest
and for 2) I'll have to check the actual handoff code
anyway
the technique described in weightbufs should work
crisp frost
how about tihmstar's desc_race_fun_public / odyssey14 leak thingy
steady nest
yeah that gist is odyssey14 leak
cedar stag
If you’re talking about com.apple.security.app-sandbox, I believe I already tried that
crisp frost
yes
crisp frost
wasn't that like hardcoded in the kernel to deny tfp0 on later iOS
steady nest
yeah but I remember sig saying it's possible
so I'd expect it to be hgsp4 or similar
and I also know giving a send right to a port is way easier
hum looks like it was from a kpp bypass perspective
naive kraken
whether the usage of "iosurfaceclient kern r/w" is patched in 15.2 or 15.7.x
patched in 16.something via PAC
steady nest
looks like there's a check for a fake UC on 15.3
naive kraken
hgsp4 has been dead since iOS 14.
it's still possible to do with PPL bypass / on arm64
visual meadow
Wasn't that like 16.1
unkempt magnet
it's still possible to do with PPL bypass / on arm64
Yeah, arm64 will be possible
naive kraken
Just learn about page tables and do it via pmap->ttep like Dopamine
anyways smith wasn't patched until like 15.7.6 or something
steady nest
I think we're talking about different "iosurfaceclient kern r/w" techniques here
You mean the weightbufs technique?
naive kraken
yeah but I don't get why you would want these beyond the initial exploit
they're slow af
like even slower than dopamine 1.0.*
they should only be used to construct better primitives tbh
slender glade
@crisp frost what’s the plan
cedar stag
I believe the correct one was like no-container?
I’m not at home atm so I got this one from apple’s dev site lol
steady nest
Just learn about page tables and do it via pmap->ttep like Dopamine
huh I took a look and it doesn't look that hard
pmap_map_in does all the magic
you just need gPhysBase and gPhysSize
cedar stag
Thanks I’ll check that when I get home
steady nest
really well done opa
hum maybe use pmap->tte instead and gVirtBase no? since there's no phys prim
could also kcall ml_phys_write_data 
dry badge
when restoring from IPSW is the hash of the file checked? When I try to restore from my custom IPSW I get an error. Sorry if this is a non-trivial question.
cloud yacht
a bunch of people don't update their phone apps tbh
im sure if more people did c...
I don't until something breaks
steady nest
nope
dry badge
no as in there is not or no as in no, there is?
steady nest
no
dry badge
ok
ty
wait then how
without custom software to exploit the vulnerabilities found, how is jailbreaking possible?
cloud yacht
just to tease you
Make it then sell it for like $500 so he has to buy it to get it
hasty ruin
true
hasty ruin
and then i wouldn't be able to abuse their mobile apis as easily
it's actually amazing how funny mobile apis can be
"meh it's running on an iphone, we can just trust all data here"
brazen timber
it's actually amazing how funny mobile apis can be <:troll:794397046706667530>
I love frida
hasty ruin
next wadi
it's actually amazing how funny mobile apis can be <:troll:794397046706667530>
shut the fuck up
dry badge
oh, okay. One more question, sorry:
Is the USB connection open? Can I bypass Finder's restrictions and just flash it directly?
brazen timber
I'm assuming theres no way to bypass that?
You could do it with checkm8
next wadi
bro 😭
brazen timber
But gl if you are asking these questions
hasty ruin
fastest gir reaction
next wadi
how did you even do that
hasty ruin
how did you even do that
the bot is just slow
dry badge
You could do it with checkm8
I don't have a checkm8 compatible chip, or else I would've 😂
ok ty
hasty ruin
about time
severe ridge
fastest gir reaction
yet it responds whenever it sees the words "ios something jailbreak"
dry badge
If I can flash the IPSW, I can just remove the SEP check files.
brazen timber
Look at the message chain
dry badge
right?
brazen timber
Oh I replied to the wrong message
Yeah if you don’t have checkm8 you can’t do anything
ashen birch
https://github.com/m1stadev/Inferius
lol
inferius is dead asf
why do you think its archived
dry badge
If he is determined enough he can revive it 🙏
fr
dry badge
and to think im only doing this to improve siri 💀
brazen timber
Oh I replied to the wrong message
.
dry badge
he said wrong chain
dry badge
nah im tryna do it on a honepod 💀
turbid fjord
Jaidan is incredibly based
elder scaffold
Just buy a iPhone 3GS and you can use alloc8
buy oldBootrom
dry badge
yeah i guess i didnt think ab that
ashen birch
anyways who wanna test python futurerestore
ashen birch
lemme rephrase
who wanna test python futurerestore with a device that doesn't support ios 16
timid furnace
!t sepbb
faint lion
dry badge
wait a minute why is checkm8 compatible with the t8004 and t8010 but not the t8006
arent they the same family of chip
and older and newer, respectively?
timid furnace
Inshallah I think I have blobs
Also @ashen birch did your bot stop saving betas given the beta API is deprecated
ashen birch
yes
timid furnace
Ah
dry badge
Yeah, I know. But how can checkm8 work on a t8010 and not a t8006
isnt t8010 "newer"?
wouldnt it be patched?
timid furnace
It's not linear
timid furnace
T8010 is a mobile chip, T8004/T8006 are watch chips
slender glade
could also kcall ml_phys_write_data <:intjpray:751193136302260394>
Hmmmm
For phys write?
I wonder if that would fix the issue
We’ll need proper handoff first tho cc @crisp frost
Oh nvm I’m r
Well I think kcalling ml_phys with the existing Evelyn handoff may work
Idk this is a huge headache
I’ll look in a bit
naive kraken
@slender glade You need to implement physrw by doing address translation just like already done in kfd (would have to make a wrapper that for every single physical page contained in the read/write, uses the virtual one instead)
Alternatively (if just for handoff), you can also just read the entry from tte and pass that into phystokv, then you know where the corresponding entry points to in virtual address space
slender glade
<@757471890829869076> You need to implement physrw by doing address translation ...
Convert ktophys to work in jbd since it won’t have the kfd struct there?
naive kraken
Convert ktophys to work in jbd since it won’t have the kfd struct there?
you only need this in the kfd process
inside jailbreakd once you gave it the page tables it can do physical r/w using those directly
slender glade
you only need this in the kfd process
But jbd is gonna be the one allocating the page
Oh
naive kraken
and you instead have to implement virt->phys translation
slender glade
and you instead have to implement virt->phys translation
From the jbd side I presume
naive kraken
yes
naive kraken
Guessing it’ll just be a matter of converting the vtophys function
you can literally just copy most of dopamines pplrw.m
slender glade
you can literally just copy most of dopamines pplrw.m
Bet?
slender glade
after you figured out handoff that is
There is Evelyn’s, just the kwritebuf issue but I think if I use the pplrw functions it’d be easily solved
naive kraken
yes...
slender glade
naive kraken
but I encourage you to actually understand page tables before you start playing around with that
slender glade
Bet
visual meadow
Wtf is this meant for
slender glade
Wtf is this meant for
open IDA and find the string
native orbit
having pagetable flashbacks lmao
steady nest
but I encourage you to actually understand page tables before you start playing ...
any resources (besides dopamine) ?
faint timber
Wtf is this meant for
Bro doesn’t know what heartbeats are
steady nest
and what's it doing there
visual meadow
Bro doesn’t know what heartbeats are
Oh
slender glade
yes...
Alright, re-wrote handoffPPLPrimitives for kfd & all, guess i should try call it from the app into jbd w jbd's pid
naive kraken
yes
slender glade
@unkempt magnet Did you have to do the pmap_map_in stuff for your jb?
steady nest
no, it uses tihmstar's stuff
slender glade
no, it uses tihmstar's stuff
fml
steady nest
or did you literally just search through the 8000 pages from the arm manual 😭
slender glade
@crisp frost can u look into this rn im bouta sleep
naive kraken
i mean books/pdf/presentations
no
there is xnu source but that's about it
but page tables aren't rocket science
they're fairly simple
just the flags of entries can be confusing
slender glade
they sure are
slender glade
dudes the <#688124600269144162> moderator
Fr
plain python
https://github.com/Siguza/libkrw
better to use https://github.com/ProcursusTeam/libkernrw instead
steady nest
better to use https://github.com/ProcursusTeam/libkernrw instead
they sent that because it explains why hgsp4 is dead on 14
shrewd smelt
Shut the hell up capt
fiery seal
#sigma #sigmalife #batman #gotham #tomhardy #patrickbateman #literallyme #memes #meme #real #reels #ryangosling #basedmemes
shrewd smelt
Based Memes
primal perch
funny memes but they’re on instagram so they suck automatically
hexed knot
hes sent those like 200 times
primal perch
native gale
I don't see how https://github.com/34306/kfund/commit/b5016ab62a1c6f072cff39c6f6...
My bad, i was not completely remove the palera1n stuffs lmao
btw i can't change my name lmao
Someone really fixing my stuffs and also adding other iOS offsets
