Never gonna happen š¦
#development
sonic totem
Well TrollStore is almost guaranteed
We know that the new CoreTrust bug is just as powerful as the old one
But there is no install method as of yet for any version non-kfd
Except for checkm8-supported devices
naive kraken
for iOS 17 jb? all of them obviously, what kind of question is that lol
no kernel exploit, no pac bypass, no ppl bypass, no sptm bypass
on 17
dreamy mason
I mean there are some exploits that you don't need anymore because you already have them right?
naive kraken
There is a patched PPL bypass
dreamy mason
My English is bad, what I meant is what else you need at this point, other than the exploits you already got
naive kraken
on 17.0 - 17.0.3
but that's not usable without a PAC bypass (and a kernel exploit before that obviously)
dreamy mason
no kernel exploit, no pac bypass, no ppl bypass, no sptm bypass
PPL bypass is the only there's available? Of all those things u mentioned?
Sounds like I'm going to stick to 15.4.1 then, and be happy with Dopamine. Thanks for the reply ā¤ļø
lime pivot
Iām good at ruining things š
steady nest
PPL bypass is the only there's available? Of all those things u mentioned?
nothing is available
sonic totem
PPL bypass was patched, and we know what the bug was, but it doesnāt matter as it cannot be exploited without a PAC bypass
Which will also need a kernel exploit anyways
elder scaffold
Even if everything is found, there is a time lag due to development before jailbreak is possible.
For 15.4.1...6 months?
untold vine
sigh atleast im on 16.2 
maybe some new dev will drop a pac bypass randomly
or some super secret exploit
lmao
dreamy mason
or some super secret exploit
hacker hacks into government pc and leaks all expl01ts they have to the public š
untold vine
hacker hacks into government pc and leaks all expl01ts they have to the public ļæ½...
im from the 3ds exploit days where someone leaked the encryption keys on to pastebin
hey atleast it was not 4chan
sonic totem
Even if everything is found, there is a time lag due to development before jailb...
Fugu15 released on Halloween, Dopamine released in March I think? So yes, 5-6 months even after we had all the exploits and a developer jailbreak.
dreamy mason
@naive kraken are you aware of a issue where the network icon always looks like its searching, but there's no SIM in the device, and jailbreak triggers this but I'm not 100% sure, it's just a guess, I reset my device today and the icon was flat, but after JB it's always looking for some signal even though there's no SIM in my device.
sonic totem
and we dont even have a fugu16 š¢
We wonāt ever get a Fugu16 now that Linus works at Apple
untold vine
We wonāt ever get a Fugu16 now that Linus works at Apple
maybe linus will hate his job and quit
lol
cedar glacier
sorry for late response, it's because i'm not exactly sure if my bios is compromised because i believe that somehow i got compromised and i don't know if it jumped to my bios and the way i'll see is by just reflashing externally lol
cedar glacier
hacker hacks into government pc and leaks all expl01ts they have to the public ļæ½...
more likely: police pc gets hacked, leaks all of pegasus
naive kraken
<@208334999722786816> are you aware of a issue where the network icon always loo...
no clue
Hm
Actually I have the same issue on one test device that doesn't have a sim card
but I never connected it to being caused by dopamine
dreamy mason
Try to reset the device if you have time, but it's a minor problem, but can cause battery problems since it's trying to look for a network or something 
torn oriole
sorry for late response, it's because i'm not exactly sure if my bios is comprom...
Not really how Mac biosās word 
cedar glacier
Not really how Mac biosās word <:troll:794397046706667530>
i do
you can't just flash the fd
you need to add the serial and stuff
torn oriole
Bios can only be āmodifiedā with an Apple signed image tr
cedar glacier
external programmer:
torn oriole
So unless Apple private keys leaked I doubt your bios is compromised
cedar glacier
Bios can only be āmodifiedā with an Apple signed image tr
intel mba2015 13in (macbookair7,2)
no T2
torn oriole
Once itās on the system it doesnāt care
macOS just validates it before deploying the image
cedar glacier
macOS just validates it before deploying the image
i was on linux at time of comprmomise
and /dev/mtd was exposed to userspace
or at least flashrom
torn oriole
Only macOS efi can unlock the rom for flashing
radiant idol
y'all, quick question
what version did apple break support for the old abi? I thought it was iOS 15 but it seems like taurine needs old abi fixes for it to work
torn oriole
Only macOS efi can unlock the rom for flashing
Tl;Dr: gets okay from macOS, stashes ok data, stores image to be flashed on next boot, efi validates this āok dataā and then agreeās to flash the system rom
cedar glacier
Only macOS efi can unlock the rom for flashing
mtd was writable
radiant idol
y'all, quick question
what version did apple break support for the old abi? I t...
I'm making an article thing on it rn so thats why
torn oriole
mtd was writable
I can assure you it wasnāt
cedar glacier
Tl;Dr: gets okay from macOS, stashes ok data, stores image to be flashed on next...
it's mapped into memory lol
spi_nor and mtd modules get autoloaded
torn oriole
It always thinks itās writable but any I/o going into it go nowhere
Source: I own an MBA7,2
cedar glacier
if you're so sure about that go cat /dev/random > /dev/mtd0 and tell me if it's bricked
/j obviously
i wish pc bios had this protection
hmmmm do you think i could desolder the spi bios chip on a pc mobo and intercept the rx pin?
gentle grove
hmmmm do you think i could desolder the spi bios chip on a pc mobo and intercept...
how experienced are you with bga rework
do you have hot air
oh wait its a SOP8 package it looks like
might be doable
what would you do after desoldering it
radiant idol
y'all, quick question
what version did apple break support for the old abi? I t...
ok I think its 14.5
cedar glacier
what would you do after desoldering it
immediately solder wires to float it above the surface, and then intercept the rx pin such that i have to do a physical irl action to connect it
either that or vcc to wp
gentle grove
immediately solder wires to float it above the surface, and then intercept the r...
just solder the wire to the pin you want instead of desoldering the entire thing"
cedar glacier
just solder the wire to the pin you want instead of desoldering the entire thing...
yeah but i need to break contact or i'll send vcc to whatever is supposed to be sending voltage to wp
and that thing might not be made for sinking voltage
gentle grove
yeah but i need to break contact or i'll send vcc to whatever is supposed to be ...
this will work a lot better in your head than it will irl
cedar glacier
this will work a lot better in your head than it will irl
not surprising
do you suggest anything else for retrofitting hardware write protection onto a bios chip
gentle grove
actually you can use kapton tape to cover the pad yohu dont want soldered
that should work actually
cedar glacier
actually you can use kapton tape to cover the pad yohu dont want soldered
except it's already soldered on
so unless i go to the factory and sneak kapton tape in there
and intentionally sabotage my own motherboard
gentle grove
except it's already soldered on
yeah like desolder it
and then wick all the solder off the pads
and then you can kapton tape the pads you dont want sopldered, and then solder the rest
if youre sure thats what you need connection wise
cedar glacier
and then you can kapton tape the pads you dont want sopldered, and then solder t...
yeah but if i legitimately want to update my bios, i would need to go through a lot of effort to enable it again
gentle grove
idk what youre doing
cedar glacier
tldr: it is TOO EASY for some userspace process who has escalated to root to just install a firmware backdoor by flashromming, i want to make it much harder
something like the old bios protect jumpers works
gentle grove
if you know you have the right pins then just install this thing called a switch
and pray the added impedance doesnt mess up the signals
cedar glacier
if you know you have the right pins then just install this thing called a switch
what if it fails closed lmao
gentle grove
what if it fails closed lmao
wdym
cedar glacier
and pray the added impedance doesnt mess up the signals
also an issue
gentle grove
youre worried the switch will break?
cedar glacier
could i just solder a mosfet in between
cedar glacier
youre worried the switch will break?
and fail closed and let everything through
cedar glacier
what are you doing a mosfet for
switch but solid state no?
cedar glacier
which type
gentle grove
but if you want physical control use a switch
idk why a transistor is in the equation
thats just a switch you control with an electrical signal
radiant idol
@velvet path figured you'd know this best, but does unc0ver have embedded patches for old ABI? I'm making an article thing about it in my tweak development tutorial and would just like to have all the facts straight
cedar glacier
but if you want physical control use a switch
i would use a switch to enable a transistor which hopefully has less impedance than a physical switch
gentle grove
i dont think it would be any better
gentle grove
try it and pray
cedar glacier
other than that
gentle grove
bios chip porobably isnt high sensitivity
compared to something like pcie lane for example
hasty ruin
ok I think its 14.5
indeed
radiant idol
workin on it
velvet path
<@305546263578017793> figured you'd know this best, but does unc0ver have embedd...
I don't honestly know - I didn't even know 14.5+ needed oldabi until it was learned that Taurine needed it
radiant idol
Interesting
I'm trying to make an informative thing about it
I'm guessing u0 also has an oldabi patch
velvet path
see Amy thought they did some PAC stuff seeing as the issue you get without the patch is something to do with PAC
but nobody really knows to my knowledge
radiant idol
interesting
but thats only on iOS 14 though, right? I think iOS 15+ needs a much heavier patch compared to iOS 14.5-14.8.1
velvet path
I love how u0 is so closed source
the thing is 14.x can inject it system-wide with no repercussions (and only 2.2MB memory usage total)
radiant idol
doesnt the oldabi fix need to be applied only to SpringBoard and system apps?
radiant idol
doesnt the oldabi fix need to be applied only to SpringBoard and system apps?
appstore apps are arm64 only so no need for new abi
velvet path
indeed, but there's no downside to doing it systemwide on 14.x iirc
radiant idol
yeah
but why is oldabi so unstable on dopamine
thats what i dont get
it hooks dlopen iirc
radiant idol
I see
so let me be clear in my question
if/when the spinlock panics are fixed in Dopamine, oldabi will be more stable, yeah?
I personally havent had much issue with oldabi but it seems like almost everyone else seems to be having issues
velvet path
it would solve the main issue that it has at this point, yes
radiant idol
š
I did notice issues with it installed such as the sharesheets in iOS lagging really badly
but full on panics? not really
velvet path
@radiant idol here's some further discussion on it I guess
radiant idol
thanks
untold vine
give me one ppl bypass and ima open. my legs
give me two pac bypasses and ima give u sum š§
give me three pacbypasses ima explode fugu16
native dune
hasty ruin
cedar glacier
give me a userspace exploit, i'm going to do absolutely nothing with it (why did you give it to me?)
acoustic imp
I did notice issues with it installed such as the sharesheets in iOS lagging rea...
Share sheet is always laggy
Whatās this and can I delete it ?
Is it my iOS version?
But like what is it tho?
Itās in caches
torn oriole
Whatās this and can I delete it ?
Itās one of those files that just speeds iOS up
You delete it, itāll probably come back
acoustic imp
Itās one of those files that just speeds iOS up
Like how ?
Do you have it ?
It got bigger
3mb bigger
@radiant idol can u tell me whatās here for u on ur phone /var/root/Library/Caches/com.apple.coresymbolicationd
Like how big the file is
torn oriole
Allegedly on macOS itās somewhat fine to delete but on iOS it allegedly borks userspace reboots
Are you quite low on storage or smth
radiant idol
remote views not be fucking awful challenge
how do you even find the source of remote views
I've never understood
severe stream
how to fix this funny tweak
==> Compiling DRYPasscodeSubPreferencesListController.m (arm64)ā¦ In file included from DRYPasscodeSubPreferencesListController.m:1: ./DRYPasscodeSubPreferencesListController.h:8:12: error: cannot subclass a class that was declared with the 'objc_subclassing_restricted' attribute @interface DRYAppearanceSettings : HBAppearanceSettings ^ /Users/hg13/Desktop/theos/vendor/lib/iphone/rootless/CepheiPrefs.framework/Headers/CepheiPrefs-Swift.h:339:12: note: class is declared here @interface HBAppearanceSettings : NSObject ^ 1 error generated.
radiant idol
Cephei is weird on rootless
uh
Remove all the CepheiPrefs imports and replace them with this
@import CepheiPrefs;
should work
severe stream
Remove all the CepheiPrefs imports and replace them with this
`@import CepheiPre...
im trying to compile funny obj-c tweak
radiant idol
ik
severe stream
but ill try that
radiant idol
that's valid objc
It's the syntax of importing modules
you can also write it like this #import <CepheiPrefs/CepheiPrefs.h>
but yeah
radiant idol
Interesting
you could just remove all the stuff related to HBAppearanceSettings if you want
it's not strictly necessary
severe stream
it's not *strictly* necessary
yea removing the DBA definition and replacing it with HB seems to work..? now this thing is left (theres more errors after this)
`==> Compiling DRYAppearanceSettings.m (arm64)ā¦
DRYAppearanceSettings.m:3:17: error: method definition for 'init' not found [-Werror,-Wincomplete-implementation]
@implementation HBAppearanceSettings
^
/Users/hg13/Desktop/theos/vendor/lib/iphone/rootless/CepheiPrefs.framework/Headers/CepheiPrefs-Swift.h:419:1: note: method 'init' declared here
- (nonnull instancetype)init OBJC_DESIGNATED_INITIALIZER;
^
DRYAppearanceSettings.m:5:1: error: ivar '_tintColor' which backs the property is not referenced in this property's accessor [-Werror,-Wunused-property-ivar] - (UIColor *)tintColor {
^`
radiant idol
just so you know, you can do
```
this
```
around your discord messages makes it one complete codeblock like
this
ah yea
radiant idol
yea removing the DBA definition and replacing it with HB seems to work..? now th...
interesting, I guess you could try just adding the -Wno flags in your makefile (-Wno-incomplete-implementation and -Wno-unused-property-ivar)
see if that works(?)
acoustic imp
@severe stream if Iām not mistaken they removed what ur like using in cephie 2.0
severe stream
<@405754262082158595> if Iām not mistaken they removed what ur like using in cep...
im compiling an old tweak for someone soooo
radiant idol
<@405754262082158595> if Iām not mistaken they removed what ur like using in cep...
No
HBAppearanceSettings is still in Ceph**ei** 2.0, it's just under a different header file
(it's also written in Swift instead of Objective-C now)
radiant idol
read it more carefully
severe stream
see if that works(?)
seems to actually, now this error. just have to add the -Wobjc flag?
@implementation HBAppearanceSettings
^
/Users/hg13/Desktop/theos/sdks/iPhoneOS15.6.sdk/usr/include/objc/NSObject.h:63:1: note: method marked as designated initializer of the class here
- (instancetype)init
^
1 error generated.```kk
radiant idol
-W means it will throw an error for that warning
-Wno means it'll ignore
severe stream
mhm yea
error: unknown warning option '-Wno-designated-initializers'; did you mean '-Wno-objc-designated-initializers'? [-Werror,-Wunknown-warning-option]
radiant idol
I probably misspelt it
severe stream
yea, ill add the objc
radiant idol
use the one it says
acoustic imp
I probably misspelt it
Twin
radiant idol
at least I dont misspell every second word
severe stream
this tweak is a hot-mess to fix and compile
radiant idol
is it Diary?
severe stream
yep lol
radiant idol
haha
torn oriole
Diary jumpscare
radiant idol
Info regarding the old ABI and ways to not rely on Legacy arm64e Support in your packages:
https://github.com/NightwindDev/Tweak-Tutorial/blob/main/oldabi.md
visual meadow
what is it now, capt
I think he's drunk
radiant idol
probably
radiant idol
I dunno
visual meadow
Cause electra is rlly sucking ass rn
tepid olive
php dev be like
visual meadow
Cause electra is rlly sucking ass rn
lol u0 was like a 1 second exploit success
it was like instant
wicked summit
#include <jailbreak.h>
install_jailbreak();
enable_untethered();
velvet path
Cause electra is rlly sucking ass rn
I somehow havenāt seen issues with it reliability wise
lime pivot
how to fix this funny tweak
`==> Compiling DRYPasscodeSubPreferencesListControl...
I've seen this now twice and I don't get it. why were people subclassing HBAppearanceSettings
that was never supposed to be the intended usage
anyway it doesn't work any more because you can't subclass a Swift class from ObjC
severe stream
anyway it doesn't work any more because you can't subclass a Swift class from Ob...
ahh, not sure why dev subclassed it but either way, compiles fine
lime pivot
you could either just comment out that entire @interface/@implementation and anything that references it entirely if you're just building for yourself, or change the code that inits that class to instead directly init HBAppearanceSettings, and set the values on it with properties
obsidian furnace
hi guys can someone tell me where the error at this shortcut i try to update weight to notion database from input
when i change provided input into a number "10" for example it get updated to the database
but when i run it like this i end up with this error
hasty ruin
@primal perch is a full-time shortcuts dev, he can probably help you out
obsidian furnace
<@726214891970625549> is a full-time shortcuts dev, he can probably help you out
thanks i will wait for his answer
native dune
zealous elbow
<@726214891970625549> is a full-time shortcuts dev, he can probably help you out
I am too
zealous elbow
when i change provided input into a number "10" for example it get updated to th...
It could just be a shortcuts bug
Thatās what it looks like
obsidian furnace
It could just be a shortcuts bug
is there a way to fix it
zealous elbow
Wait
zealous elbow
is there a way to fix it
Remove the quotes around the provided input
See if that works
obsidian furnace
Remove the quotes around the provided input
well thank you it works lol
zealous elbow
Perfect. When quotes are around a number, the server expects a number, but instead receives a string
Just some notes
obsidian furnace
Thanks for the note
zealous elbow
Np
serene hawk
did anyone ever encounter such issue? Received insecure drawing action <BKSInsecureDrawingAction: 0x280640e80> { handler = none; info = <BSSettings: 0x282de7420> { pidToContextInfoDictionary = { 3036 = { 1929741309 = "{(\n \"VC:StandByViewController\"\n)}"; }; }; }; }
radiant idol
did anyone ever encounter such issue? ```Received insecure drawing action <BKSIn...
What are you trying to do?
serene hawk
What are you trying to do?
adding a subview on a view controllers view
serene hawk
yup
radiant idol
did you override the method you need to override to make it display on the LS
i forgot the name
one sec
- (BOOL)_canShowWhileLocked {
return true;
}
oh lol theres a method for that? didnt know that because the view controllers view displayed just fine
radiant idol
think its that
serene hawk
ohh alright let me try
radiant idol
this should be in your VC not your view
serene hawk
that really seems to work, thank you!
serene hawk
thanks again, the only weird thing is that the added subview only takes up half of the screen. as a measure to fix that i've set translatesAutoresizingMaskIntoConstraintsto NO and set up layout constraints, however now the "insecure drawing action" occurs again
serene hawk
viewDidLoad of the view controller where i add the subview
radiant idol
Hm, should work fine
Does the issue also occur if you just set up a frame rather than using AutoLayout?
serene hawk
so its basically this: ``` StellaView *stellaView = [[StellaView alloc] initWithFrame:self.view.bounds];
stellaView.translatesAutoresizingMaskIntoConstraints = NO;
[self.view addSubview:stellaView];
[NSLayoutConstraint activateConstraints:@[
[stellaView.widthAnchor constraintEqualToAnchor:self.view.widthAnchor],
[stellaView.heightAnchor constraintEqualToAnchor:self.view.heightAnchor],
[stellaView.centerXAnchor constraintEqualToAnchor:self.view.centerXAnchor],
[stellaView.centerYAnchor constraintEqualToAnchor:self.view.centerYAnchor]
]];```
nope then its only the issue that the view only takes up half of the screen
serene hawk
yeah i set it to white background color and the whole screen is white then xD
radiant idol
so its basically this: ``` StellaView *stellaView = [[StellaView alloc] initW...
also here, I would not use initWithFrame: if I were you. I'd just do [StellaView new] instead, since we are later using AutoLayout on that view
serene hawk
alright thanks
radiant idol
Doubt that'll make a difference but it's worth a try
serene hawk
i'm not getting that error anymore but i'm also not seeing the view lol
serene hawk
i can not see it, no
radiant idol
interesting
hasty ruin
Captās fault
radiant idol
what if you call viewDidLoad manually on the view controller using FLEX
serene hawk
Captās fault
i wish it was lol
hasty ruin
link
radiant idol
pins
serene hawk
oh wait ok, the view is there but its frame is 0, 0
but the view controllers view also has frame of 0,0 now lol
found the issue
the view of the vc had translatesAutoResizingMaskIntoConstraints set to NO. setting that to YES fixed it for now
thanks though @radiant idol
radiant idol
great
radiant idol
shut up icraze
hasty ruin
š¦
acoustic imp
Icraze did u read the crash log I sent about nexus
hasty ruin
yeah but it doesnt make sense
when did it happen
like what was the device doing at the time
acoustic imp
Nope
It happend at like 4:47 am or sm
Watchdog crashes like 30 min before
Crashed *
blazing warren
ashen birch
fuck it python disasm
ashen birch
woe
dreamy mason
imagine being able to read assembly like its english
u just cheat engine every app and you understand it
ashen birch
imagine being able to read assembly like its english
oh i don't know any assembly
ashen birch
meh
dreamy mason
lets say I make a python script that solves 1 + 1, and I have a OBFUSCATED python script that solves 1 + 1, would they both look the same in assembly?
ashen birch
obfuscate
python
pick one
dreamy mason
u cant obfuscate python? :p
next wadi
no
dreamy mason
lets say java then
would the assembly code look different?
obfuscated code vs non obfuscated code
dreamy mason
it doesnt compile to assembly
Didn't knew that š¬
radiant idol
mhm
ashen birch
and that's what's actually "ran"
i be forgetting with java
cause it still gets "compiled" no?
radiant idol
yeah
ashen birch
yeah i just meant it isn't just straight ran from source code like python is
or maybe it still can be idk
next wadi
according to the collegeboard MIT is interested in me
i have to start coding again i lowkey forgot how to
š
oops!
next wadi
i know
thats the whole problem
i look at the source code to luz and i genuinely get lost now
it made so much more sense when i wrote it
next wadi
nah im cool
radiant idol
no
indigo peak
i look at the source code to luz and i genuinely get lost now
pov me with my unreleased update to calculator history
or legit like
anything Iāve ever written lowkey
next wadi
br
realistically only used it to build mac stuff
thats what i made it for
ĀÆ_(ć)_/ĀÆ
radiant idol
true
next wadi
it did it pretty well for what its worth
š
downloaded this from my zip archive that i have since i deleted it off my computer
silver rampart
>obfuscate
>python
pick one
have u seen anything i've written
hasty ruin
radiant idol
oh my goodness I'm going to have a breakdown
hasty ruin
L
hasty ruin
this is all @grave sparrow's fault
ashen birch
i look at the source code to luz and i genuinely get lost now
me when i stop working on a project for a week (this happens every week)
pearl sail
this is all <@434097922762735618>'s fault
Always
visual meadow
@sonic totem welcome
sonic totem
lol thank you
granite frigate
>obfuscate
>python
pick one
you can convert your python to bytecode itās a real pita
wooden yarrow
gm
wicked summit
gm
wicked summit
you can convert your python to bytecode itās a real pita
All python you run is converted to bytecode
Why obfuscate python when you can just use a different language
Real question though is why obfuscate
timid furnace
any news? 
native dune
?news any
steady nest
guy's banned and stuff starts happening
severe stream
where news
radiant idol
guy's banned and stuff starts happening
LMAO
hasty ruin
free froyo
indigo peak
guy's banned and stuff starts happening
visual meadow
we need to rise up and find install method for 16.5.1-16.6.1/17.0
hasty ruin
we need to rise up and find install method for 16.5.1-16.6.1/17.0
was it you that tried something using DDIs
but even if that works, 17.0 still remains
visual meadow
thats the preferred install method for 15.5-16.5
maybe the mobilestoragemounter thing will work
that one bug
patched in 16.7
indigo peak
how do i get FLEXall to open in simulator
torn oriole
cry
hasty ruin
how do i get FLEXall to open in simulator
[[FLEXManager sharedManager] showExplorer];
radiant idol
[[FLEXManager sharedManager] showExplorer];
dont tell him
hes gonna get rich
by the stupid vcam tweaks
indigo peak
wicked summit
Link it
radiant idol
hide
wicked summit
hit the ld
wicked summit
Preferences
frank fossil
we need to rise up and find install method for 16.5.1-16.6.1/17.0
CVE-2023-41992 certainly
wicked summit
Does Flex need to link against preferences though?
indigo peak
its not flex
different thing
my own tweak
with prefs
but i cant compile for simlator
bc of the preferences
TARGET = simulator:clang:14.5:12.0
ARCHS = arm64
# ...
_PRIVATE_FRAMEWORKS = Preferences
Maybe theos requires a differemt variable for linking with simulator?
Man I haven't used theos in ages
Haven't done iOS development in a minute š
lime pivot
bc of the preferences
you'll need to build an SDK with private frameworks
using the scripts on https://github.com/theos/sdks
granite frigate
we need to rise up and find install method for 16.5.1-16.6.1/17.0
project zero will release soon its ok
ashen birch
you can convert your python to bytecode itās a real pita
yea but fuck that
and also doesnāt that start to become files that have to be used with specific versions of python
hasty ruin
granite frigate
yes
fallen pond
thinking about adding RCS support to imessage. Has anyone here messed around with custom IMService s
that and getting telephony stuff like the SMS identifier are the only parts that are dicey as far as making it impossible
there is an open source implementation of RCS (in java š¤¢, but still) online, but it's for android, and uses google's APIs for low level telephony stuff
frail cedar
ios doesn't have a native java runtime
frail cedar
you'd probably just want to reimplement RCS in objc or swift whatever strikes your fancy
frail cedar
Make the bubbles red or something idk
fallen pond
lol
frail cedar
RGB text bubble
radiant idol
there is an open source implementation of RCS (in java š¤¢, but still) online, bu...
I mean, if you're up for it, technically nothing is impossible
frail cedar
if "a very uncohesive set of ideas in my head" qualifies as a plan
enjoy your RE of coretelephony and associated framework
frail cedar
limneos site probably has headers
ashen birch
if "a very uncohesive set of ideas in my head" qualifies as a plan
thats how all my projects happen so it definitely does
radiant idol
limneos site probably has headers
there's also another site which has relevant C funcs for frameworks
frail cedar
Few people mess with this sort of stuff
frail cedar
yeh i remember that
radiant idol
this has C funcs for frameworks, something that neither Limneos nor Cynder's sites have
topaz yew
i remember my old days of looking at headers
frail cedar
it's handy
radiant idol
yeah
fallen pond
nice
radiant idol
imo this seems like a fun project if you're really interested in it
fallen pond
I am, I haven't really done tweak dev
but I've done tons of reading/watching ios reversing stuff
because its interesting
radiant idol
I have a tweak development tutorial if you're interested, it's kinda basic, looking at the level you're on, but it may get the job done
topaz yew
@fallen pond what languages do you know
fallen pond
mostly rust, c, a bit of swift and objc
topaz yew
noice
fallen pond
if I do this, I'll probably implement RCS in rust and use objc where necessary to delegate between it and ios
radiant idol
sounds overkill to me
but š¤·āāļø
if you're more comfortable with Rust then yeah I guess that may make sense
topaz yew
well i mean then theoretically you could use the rcs anywhere no?
fallen pond
yeah that would be another advantage
fallen pond
if I abstract away the calls to internal telephony stuff
topaz yew
oh well yeah
fallen pond
then yeah it coul be useful as a reference/ for people on other OSes
fallen pond
thanks lol
topaz yew
yeah fr
fallen pond
I need to read up on RCS because I want to know exactly what I need from telephony internals
that and mess with IMServices
fallen pond
hmm, iiuc RCS mostly uses telephony stuff for authentication and is mostly IP based
I could be very wrong though lol
I need to do more than skim the spec
fallen pond
why does this have to be the only open source implementation of rcs on the internet lol
(from the design powerpoint in the repo 
)
radiant idol
Lmaooo
indigo peak
you'll need to build an SDK with private frameworks
i tried running both .sh and .py and neither worked
fiore@fiore-mac ~ % ./create_patched_sdk.sh true
Failed to find sdk for simulator runtime
python3 create_patched_sdk.py
No SDKs were successfully created from DeviceSupport binaries. Falling back to Simulator Binaries
fiore@fiore-mac ~ %
and then if i add the --use-simulator arg, nothing gets outputted, and it just hangs for a couple sec and then finishes w no output
lime pivot
hm
I think it's probably not updated for Xcode 15 making the iOS simulator a separate download
simulator runtime no longer inside Xcode.app
steady nest
To all my fellow developers: IDA Pro 8.3 (Windows again) has leaked
Do not pirate it and do not search IDA Pro 8.3 leak on google
harsh junco
To all my fellow developers: IDA Pro 8.3 (Windows again) has leaked
link 
hasty ruin
To all my fellow developers: IDA Pro 8.3 (Windows again) has leaked
old news smh
I have not had it for like 30 hours already
steady nest
yet you didn't share
topaz yew
do i need a sandbox extension every time i wanna spawn a new process in launchd, or can i reuse them
hasty ruin
visual meadow
Do not pirate it and do not search IDA Pro 8.3 leak on google
Thank you I didn't search and download it
sonic totem
we're using facebook for the ct bypass
We need Zuckerberg's permission, let me drop him a DM
graceful gate
To all my fellow developers: IDA Pro 8.3 (Windows again) has leaked
No ARM š
Well at least objc_msgSend āwrappersā are properly labeled now
It was so painful reversing YT binaries for months lol
timid furnace
To all my fellow developers: IDA Pro 8.3 (Windows again) has leaked
Thank you for the not information
Did decompilers leak
indigo peak
I think it's probably not updated for Xcode 15 making the iOS simulator a separa...
weird, i dont even have xcode 15: Version 14.3.1 (14E300c)
indigo peak
ok so it made me a 16.4 sdk
and its still saying Preferences cant be linked
even when i specify the sdk version in the makefile
and preferences is in the sdk
in private frameworks
topaz yew
@grave sparrow is sandbox_extension_issue_file what im looking for
its just giving null
olive peak
radiant idol
@lapis vessel Don't mean to bug, but any updates on this? Totally fine if you want to keep it private, but a lot of people would enjoy it on newer versions
feral mirage
@lapis vessel yea pls open source
topaz yew
sandbox = suicide
naive kraken
any news?
blazing warren
any news?
pearl sail
Fake news
real nova
lapis vessel
@radiant idol sorry I haven't decided yet
fallen pond
we can't make threads here right
radiant idol
Don't think so, no
fallen pond
ah, sad
I'm going to dig into IMService and i wanted somewhere to rant about it that wouldn't spam this chanel
radiant idol
nah go ahead, this is the place for that lol
native dune
Āænews any?
native dune
security
topaz yew
i have to be using the wrong function or using it improperly or something
tepid olive
i want ios 18 to allow custom web engines
pearl sail
Gets your Apple ID banned
tepid olive
that has to be false
pearl sail
ask tim
hasty ruin
Thatās my email
pearl sail
@grave sparrow donāt fall
cloud yacht
i hate this shit
Just get the no sandbox entitlement
cloud yacht
Thatās my email
Ok I'll send support emails for nexus there
brazen timber
changing my name to Richard Etard
timid furnace
@hasty ruin @grave sparrow does windows ida work well under wine
hasty ruin
yeah
timid furnace
do you use crossover, gptk, or just plain wine
timid furnace
hm
alright
im getting tempted because remoting into my desktop gets annoying sometimes
details
acoustic imp
jus make/use a VM tiny10/tiny11?
deep wolf
how would I detect a change in the boolean isShowingHomescreen from Springboard-Class.h
not 100% sure. looking for the boolean name in the header file doesnt return any other methods
is there a better way to see if it does?
searching for the method setisShowing doesnt give any results either
thats the only one I know about š
topaz yew
do you use crossover, gptk, or just plain wine
i use crossover-wine and wineskin
radiant idol
it might just be called "SpringBoard"
topaz yew
its alright
radiant idol
sucks to be you ig
you are so poop
here it is
lmao
ah
wait
its just a compilation of the rest of the headers
mb
topaz yew
so uh i decided that uh
i would nuke secinit
i want it to be readable for all processes on macos
yeah...
and your generating the extension in launchd?
and consuming it through an environment variable of some sort?
well the parent one yeah
okay
ive bootlooped my mac like 4 times trying to do the extension shit
im like wtf
faint timber
I deleted libz.dylib on my mac and still managed to save it
backups important
I have a linux server hosting smb
this happened years ago on vacation I forget why I accidently deleted it
this was sierra/hs not in shared cache
topaz yew
- rm -rf /usr/local/bin/ammonia
- reboot
- done
make an uninstaller
its so beautiful to see my tweak loaded everywhere
you make a whole fucking kext?
ahhh
torn oriole
@grave sparrow why you making an uninstall md that nobody gonna read
hasty ruin
@deep wolf you can probably just hook methods on the home screen view controller btw
to know whenever it's shown/unshown
hasty ruin
<@434097922762735618> why you making an uninstall md that nobody gonna read
it's a joke about how you never actually get the chance to remove it
visual meadow
@grave sparrow you think itās possible to make a kext that patches kernel on the go instead of installing a custom one
wicked summit
gm
visual meadow
you understand that means you still have to add a kext to the kc
I meant like user kext idk anymore
timid furnace
hexed knot
IM BLACK
visual meadow
Crazy
cursive rampart
radiant idol
Does adding a section at the end of a MachO file not invalidate its codesign?
This suggests that it does https://alexomara.com/blog/adding-a-segment-to-an-existing-macos-mach-o-binary/
radiant idol
Does adding a section at the end of a MachO file not invalidate its codesign?
Th...
Or would this not even matter in a jailbreak tweak context? Say a tweak .dylib is patched via this method, what would happen then?
primal perch
hasty ruin
blazing warren
radiant idol
what if you rebase the strings refs and make them point to the new ones in that new section
hm
so then how would opaās method of patching rootful debs for rootless work then?
right
so you can just resign the macho file and then it should just run like a normal bin?
Ah ok
So thatās not much of an issue then
the issue is actually getting the thing to work lol
ohh I see
through install_name_tool, yeah?
I see
hexed knot
Black
radiant idol
What Iām interested in is the fact that I heard that you canāt modify the size of a bin without corruption, seems like thatās not entirely true?
primal perch
[ Mach-O header]
[ Some free space ]
[ First instruction of the program]
radiant idol
Right
ok yeah that was my next question
can you determine the size of that free space somehow?
young meteor
torn oriole
Society if capt released zefram
primal perch
yeah true
hasty ruin
we need shutup icraze
radiant idol
I have been overloaded with info but thank you, interesting
primal perch
<:uhh:696449618539708548>
young meteor
how could anyone in r/jailbreak have sex
primal perch
oh
young meteor
hasty ruin
young meteor
severe stream
any news?
severe stream
real
timid furnace
found architecture 'arm64e.old', required architecture 'arm64e'
anyone seeing this with latest xcode when trying to compile for old ABI?
bright island
no
steady nest
https://reddit.com/r/jailbreak/comments/184yxa3/app_can_convert_swift_codes_to_ipa_on_ios/ AI is here to save the world
vivid dew
i hope someone puts him out of his misery
visual meadow
https://reddit.com/r/jailbreak/comments/184yxa3/app_can_convert_swift_codes_to_i...
What if the person posting this... is AI
native dune
smartest chatgpt user
ashen birch
AI just replaced compilers holy shit
primal perch
smartest chatgpt user
fr
hasty ruin
Swift too
frail cedar
https://reddit.com/r/jailbreak/comments/184yxa3/app_can_convert_swift_codes_to_i...
Did he... use swift... to compile swift...???
visual meadow
Did he... use swift... to compile swift...???
infinite compilation
visual meadow
Anyone know why this piece of shit crashes almost every day
primal perch
Thread 2 name: Dispatch queue: NSManagedObjectContext 0x9f482db50
Thread 2 Crashed:
0 CoreFoundation 0x1c3aa985c CFDataGetBytePtr + 8
1 ProtectedCloudStorage 0x1e5b759b8 PCSPublicIdentityCreateWithPublicKeyInfo + 52
2 Transparency 0x23863baec -[KTAccountPublicID initWithPublicKeyInfo:error:] + 96
3 Transparency 0x23863c2d0 +[KTAccountPublicID ktAccountPublicIDWithPublicKeyInfo:error:] + 60
4 transparencyd 0x10296041c 0x102880000 + 918556
5 transparencyd 0x10295e9fc 0x102880000 + 911868
6 CoreData 0x1cb188b6c developerSubmittedBlockToNSManagedObjectContextPerform + 156
7 CoreData 0x1cb188650 -[NSManagedObjectContext performBlockAndWait:] + 208
zefram
dull gust
not sure if this is correct place but can someone explain how background processes work on ios?
i suppose when i allow notifications for an app it registers some kind of service which always runs in background. Or does it run no matter if I enabled notifications for an app?
also, what is "background app refresh" exactly, and how it's different from notifications background service
radiant idol
would this be possible on iOS though? I was thinking about that issue
codesign is macOS only, afaikā¦ no?
hasty ruin
would this be possible on iOS though? I was thinking about that issue
`codesign...
ldid -s <binary>
radiant idol
oh ok
restive ether
the one on procursus works on windows even if you wanna go that far
restive ether
yeah
timid furnace
would this be possible on iOS though? I was thinking about that issue
`codesign...
You can codesign on iOS
Code for it is in dopamine
tepid olive
.
radiant idol
You can codesign on iOS
Thanks. ldid -s should do the trick as well though, right?
tepid olive
naive kraken
<@208334999722786816> are you going to work on a fix for m2 ipads
I do not have an M2 iPad
timid furnace
I meant -s
yea that should work
naive kraken
but many people are looking into options for installation now
lyric heron
I do not have an M2 iPad
im willing to test if you have any idea to how to fix it
tepid olive
unfornaute there is a new mdc bug patched in 17.0.2 just no poc
theoretically could that be used for installation on arm64e
visual meadow
i need mickey to dm me on twitter bro
tepid olive
im on 17.0 on arm64e
cloud yacht
Ladies and gentlemen, news
lyric heron
im on 16.5 arm64e and cant install trollstore because of KFD
cloud yacht
I have trollstore but am debating upgrading to 17.0
lyric heron
do it fr
tepid olive
I have trollstore but am debating upgrading to 17.0
do you know of any install methods? nathan said something about ddi i dont know if thats broken on 17.0
lyric heron
longer app support fr
cloud yacht
do you know of any install methods? nathan said something about ddi i dont know ...
Haven't looked into it. It was released like 10 minutes ago
Oh KFD doesn't support 17.0
tepid olive
yeah
boreal hare
Iphone 11promax ios 16.4 cant install trollstore??
fiery seal
indigo peak
@lime pivot so when i run python3 create_patched_sdk.py --use-simulator it generates iPhoneOS16.4.sdk in $THEOS/sdks, so then i rename it to be iPhoneSimulator16.4.sdk and then when i run make, it shows this
==> Copying resource directories into the bundle wrapperā¦
==> Linking bundle tweakprefs (arm64)ā¦
ld: building for iOS Simulator, but linking in .tbd built for iOS, file '/Users/fiore/theos/sdks/iPhoneSimulator16.4.sdk/usr/lib/libobjc.tbd' for architecture arm64```@velvet path about the dopamine not being able to install on TS2 did u make sure that the ipa was stored āon my iPhoneā. I remember being an issue with thing not installing on TS1 with that
velvet path
<@305546263578017793> about the dopamine not being able to install on TS2 did u ...
itās a very known issue at this point
try KFDopamine
acoustic imp
try KFDopamine
Did u read my mesage ?
steady nest
it's an issue with one of dopamine's executables
acoustic imp
it's an issue with one of dopamine's executables
ah
steady nest
we've found the issue
acoustic imp
Itās like not getting signed or sm ?
velvet path
(has to do with oobPCI, causing the CT bypass to just die)
acoustic imp
š
lyric heron
5ā¬ if someone can fix KFD for M2 Ipads 
native orbit
so whens trollstore 3 coming out?
hasty ruin
frail cedar
Anyone still developing
im developing but not well
deep wolf
is (id)_accessibilityTopDisplay; something I can read a state from using a notification or does the (id) mean it isnt a method that can do it and just an object?
gaunt mesa
It's a method
The return type is id
But more likely there's an actual return type and we don't know it
gaunt mesa
Yeah just hooking it and logging %orig will help
It'll show the actual type at runtime if you use NSLog
radiant idol
%hook // <whatever the class is>
- (id)_accessibilityTopDisplay {
id orig = %orig;
NSLog(@"%@", NSStringFromClass([orig class]);
return orig;
}
%end
Yeah that, it's a perfect example
deep wolf
okay sweet. so next question I can't seem to find a straight answer on; how do I view the NSLog stuff? right now im using custom banners to debug because I can't figure that out lol. Im assuming I need to do something with SSH and my pc?
gaunt mesa
Are you on Windows or macOS?
deep wolf
windows
gaunt mesa
Ahh
deep wolf
should I get the hackintosh working again lol
gaunt mesa
So on macOS there's Console.app, but you can do it on windows
If you really want to do this fast tho, just show the NSStringFromClass in the banner š
But the correct way is to use idevicesyslog
And then you can do something like idevicesyslog | grep "[bruh]" and then put [bruh] in your logs
Assuming you are on WSL
deep wolf
yeah i'll probably do that instead š
okay I think i get what you mean, doesnt sound bad
gaunt mesa
It'll be with libimobiledevice
Though I think you need to run that on windows, because WSL doesn't do USB stuff
But idevicesyslog.exe has a --match parameter which does the same thing as grep
deep wolf
ahh ok yeah just download the exe and use it with cmd
gaunt mesa
Should be, make sure the device is trusted and everything
deep wolf
ok cool thank you
native dune
yeah just do idevicesyslog -m whatever
visual meadow
anyone here have a good idea of why that recent mobilesotragemounter patch only changed /var/run/mobile_image_mounter to a system container
thats all it did
patched in 16.7
although i have no idea what that would patch
wind ravine
how do i get objection on a rootless jb?
radiant idol
how do i get objection on a rootless jb?
what
wind ravine
for frida
radiant idol
oh nvm I have no experience with that
primal perch
@torn oriole
radiant idol
Kind of a stupid question but what exactly is a load_command in MachO? I've been reading up on the file structure and whatnot, I just have not completely understood what exactly it is
timid furnace
Kind of a stupid question but what exactly is a `load_command` in MachO? I've be...
They can be various things
Generally they describe where to find XYZ in the binary
Or describe a property of the binary
radiant idol
so there's no one clear definition for it, I'm guessing?
faint timber
an array of information
wicked summit
Each type of load command is different
An important one for jailbreaking is LC_LOAD_DYLIB which instructs to load a dynamic library. Tweaks ultimately are compiled into dynamic libraries with constructors that hook methods
radiant idol
Right
timid furnace
in this binary:
- LC_SEGMENT_64: information about the binary's segments
- LC_DYLD_INFO_ONLY: haha some funny stuff don't worry about it you will reconsider your life choices if you investigate this
- LC_SYMTAB: the location of the symbol table and string table for the symbols
- LC_DSYMTAB: dynamic symbols
- LC_RPATH: paths to consider when looking for a dependency that is prefixed with
@rpath - LC_LOAD_DYLINKER: the dynamic linker to use (basically always dyld)
- LC_UUID: UUID to identify this binary
- LC_BUILD_VERSION: target platform, minimum OS version, and the SDK used for building
there are lots more
that exist
radiant idol
oh okay, I see. so load_command by itself doesn't really have a specific definition, but its various "child" types have various uses in the context of the binary?
not sure if that makes sense :P
wicked summit
If you haven't yet, play around with otool
radiant idol
yeah I'm planning on it
timid furnace
oh okay, I see. so `load_command` by itself doesn't really have a specific defin...
think of load_command as NSObject
wicked summit
The struct load_command itself only has a type and size since each type of load command has different structure/information
faint timber
dylib:
LC_SEGMENT_64: a segment in the mach-o
LC_ID_DYLIB: the path of the dylib mach-o itself
LC_DYLD_EXPORTS_TRIE: exports tree
LC_SYMTAB: symbols table
LC_DYSYMTAB: dynamic symbols table
LC_UUID: unique identifier for the mach-o
LC_BUILD_VERSION: usually minos and sdk version along with what platform: iOS, macOS, watchOS, bridgeOS, tvOS, or SEPOS
LC_SOURCE_VERSION: source code version? probably
LC_LOAD_DYLIB: this is how the dynamic linker, dyld loads dylibs and links their symbols into memory for the mach-o to use
LC_FUNCTION_STARTS: where the TEXT or code starts
LC_DATA_IN_CODE: embedded data in the code
timid furnace
in this binary:
- LC_SEGMENT_64: information about the binary's segments
- LC_DY...
note there are probably more load commands in here, I think the hex fiend template just died on something
radiant idol
dylib:
LC_SEGMENT_64: a segment in the mach-o
LC_ID_DYLIB: the path of the dylib...
Thanks! that's helpful
radiant idol
note there are probably more load commands in here, I think the hex fiend templa...
lol I see
but yeah - trying to dive into some low level stuff
wicked summit
Also check out optool
radiant idol
thanks all, that makes a lot more sense now
radiant idol
Also check out optool
o, what's that?
wicked summit
It's a tool that you can use to edit load commands of a Mach-O binary
Edit/add/delete
radiant idol
oh interesting
faint timber
nothing is more low level than the stuff I do 
wicked summit
You can poke around the source code too
wicked summit
nothing is more low level than the stuff I do <:smirkdevil:786981417334210591>
Are you wiring transistors?
faint timber
vtool, jtool2, otool, and optool are the best for this stuff
faint timber
Are you wiring transistors? <:trol:831188670848565289>
SEPROM RE
faint timber
the sep firmware that's fused into the silicon aka SEPROM
wicked summit
Ah fair enough sick
stiff dragon
try bind mount on iOS 16 but failed with unknown special file or file system. any ideas š
mint island
Just went through some of the replies to opaās tweets (or xās?) and damn wtf is wrong with some people šš
hasty ruin
Just went through some of the replies to opaās tweets (or xās?) and damn wtf is ...
hasty ruin
https://tenor.com/view/dead-chat-dead-chat-xd-kaka-v420-lmao-gif-21778819
sir what does this mean
hasty ruin
sacred orbit
i wonder if its possible to make opainject work with trollstore
stiff dragon
i wonder if its possible to make opainject work with trollstore
process might be killed because of the CS_KILL flag.
sacred orbit
process might be killed because of the CS_KILL flag.
did u try it?
frank fossil
i wonder if its possible to make opainject work with trollstore
Works if process has get-task-allow
sacred orbit
Works if process has get-task-allow
check dms
granite frigate
what's the file path of the Tips app on iOS?
sonic totem
/var/containers/Bundle/Application/$TIPS-UUID/
granite frigate
/var/containers/Bundle/Application/$TIPS-UUID/
I'm assuming i can't just copy paste this
how do you find the uuid of your tips app 
granite frigate
Bummer aight then
sonic totem
Canāt Misaka do this?
granite frigate
- i don't want to install misaka just for trollstore
- i'm bored
i know yall are probably working on a standalone installer but it's for fun anyway
sonic totem
We arenāt working on an installer
I can say that much
A standalone installer may arrive from Misaka team or something
But the main TrollStore team arenāt making one
sacred orbit
@naive kraken can i somehow reload springboard with trollstore entitlements after changing dyld shared cache
naive kraken
bruh how would you change dsc
sonic totem
Probably TS + kernel r/w on arm64 or something?
sacred orbit
bruh how would you change dsc
well the file with the value is in preboot does that work
tepid olive
i haven't been following kfd stuff when it was new but what is the deal with kfd on m1/m2?
granite frigate
t1sz should be 26 instead of 17/25
naive kraken
well the file with the value is in preboot does that work
bruh
naive kraken
that's an easy way to bootloop if your change gets flushed to disk
you cannot inject anything anywhere
due to trust levels and shit
timid furnace
sly knoll
Seems I broke permission of some directory, anyone knows what directory to repair?
I found āTrollStore broke itā in Reddit, is it real?
hasty ruin
what are you trying to do
naive kraken
Seems I broke permission of some directory, anyone knows what directory to repai...
there is no way to fix this other than resetting the device and restoring a backup
sly knoll
Can I restore from Finder backup?
naive kraken
I found āTrollStore broke itā in Reddit, is it real?
idk I was never able to reproduce it (or figure out what the actual underlying error for the bug is)
so afaik this is user error
naive kraken
Can I restore from Finder backup?
yes
rigid glen
Resetting all settings should work, did the trick for me when I messed up permissions on a /var folder
sly knoll
idk I was never able to reproduce it (or figure out what the actual underlying e...
I think I broke it by trying to sideload com.apple.tips
rigid glen
Not wipe, just reset
sly knoll
Resetting all settings should work, did the trick for me when I messed up permis...
huh
let me try
hasty ruin
my balls
granite frigate
https://github.com/wh1te4ever/TrollDecryptor this sounds so cool
sly knoll
Resetting all settings should work, did the trick for me when I messed up permis...
It didnāt work sadly
indigo peak
https://fxtwitter.com/wh1te4ever/status/1729504466796200134?t=DyotnAy5FbYIDX0kjg...
i was gonna make this :c
unkempt magnet
https://github.com/wh1te4ever/TrollDecryptor this sounds so cool
I think I don't have much time to handle this project, just like kfund..
but if anyone grab this code and make more perfect, that would be great!
unkempt magnet
i was gonna make this :c
Cheers
sacred orbit
wtf is this gibberish in xcode