development

[sonic totem]

We’ve tried symlinks / hardlinks

We tried symlinking /var/mobile/Media/TrollHelper (AFC upload directory) but you can’t execute any binaries in /var apart from /var/containers

[frail spade]

is there an equivalent for cowabunga lite windows?

[sonic totem]

We’ve tried messing with the CodeResources file to exclude the main binary from signature checks

We’ve tried sneaking in binaries but they always get set to read-only

Not really sure what else to try

I think step 1 would be figuring out how to get a binary past installd and not have it set to non-executable

[sonic totem]

Not sure, sorry. I’d imagine there is but I’m not certain

installd uses lchmod and fchmod to prevent the use of symlinks

[lime pivot]

even better, preparing Apple Watch for development

(I have never written an Apple Watch app)

[lime pivot]

yeah we used that one a long time ago 🙃

[sonic totem]

Doesn’t even let you symlink Info.plist 😪

Oh well, worth a try anyway

[unkempt magnet]

It doesn't let install system app through usb :/

It seems like only installable through appstore, so maybe I have to find how to hijack that systemapp download url..

[sonic totem]

Even so, it will still check code signature even if we could

[timid furnace]

Already tried

it's pinned

[unkempt magnet]

then.. I'll wait for release kernel exploit.

[sonic totem]

I might try some other stuff but I won’t spend hours and hours on it

[wind ravine]

i still wanna get the dirtycow exploit working

bc even with an install method u still cant hide the home bar

[timid furnace]

no one has any clues on how to exploit it though unfortunately

[wind ravine]

it looks reasonable with the steps zhuowei laid out

its just threads mismatching object copying

i tried to look into it but i couldnt figure out how vm_object works

[crisp frost]

Anyone happen to know why task_for_pid returns KERN_SUCCESS but the task port is -1? This is with TrollStore 2 if that matters

[sonic totem]

Are your parameters correct?

[naive kraken]

because ur not platformized but the port ur trying to get is

or you lack some entitlement

[crisp frost]

(the target process is springboard) this also happens with opainject so I doubt it's a entitlement issue however when I was working on a jailbreak with kfd I just simply spawned a dropbear shell ( no platformization ) and then opainject would succeed, the only real difference was that opainject was in the trustcache instead of signed with the ct bug, could that make a difference? ( this is all on arm64 )

[naive kraken]

yes that is what makes the difference

[crisp frost]

could that be in some way fixed or worked around with only TS2? Or should I just run kfd -> platformize myself and work from there

[naive kraken]

no that can't be fixed

[crisp frost]

alright

[granite frigate]

ian beer’s talk on the original MDC bug is pretty interesting

a lot of it flew over my head but at least i now sort of know what a vm_object is

[sonic totem]

Yeah I sent that to Lemin

Definitely great for learning the basics

I watched it to get a basic idea of the whole VM layer

[granite frigate]

the part where shadowing comes in gets me confused lol

[sonic totem]

Yeah same for me

Although I watched it like 11pm and I was tired

Might watch it again today

[serene hawk]

hi, i'm trying to fetch preferences values with cephei, however when trying to fetch values from a third party app i get: "Could not contact preferences IPC server! (Error 1102)" does anyone know a fix for this?

[inner yoke]

Hi, I have an iPhone 8 with all this shsh2, I want to try the supported arm64 jailbreaks, I can downgrade and test, please let me test 😅

[sonic totem]

You can’t

[inner yoke]

😅

[sonic totem]

Apple has extra mitigations preventing you from downgrading

[inner yoke]

Currently I can downgrade to 15.x without much problem

[sonic totem]

You can’t

SEP won’t be compatible

[inner yoke]

yes, i can downgrade successfully, i downgraded successfully

[sonic totem]

What?

Using futurerestore?

[inner yoke]

yes

[sonic totem]

When did you do this

[inner yoke]

Maybe you misunderstood, the device I downgraded was iPhone 8

it is checkm8

[velvet path]

@sonic totem it's possible for home button checkm8 devices to downgrade to 14.x/15.x but you need to dump activation tickets in advance

[sonic totem]

Oh fr? I had no idea

Oh wait, isn’t that the OrangeRa1n method?

[velvet path]

!t sepbb it's linked on the linked chart somewhere

[faint lion]

sepbb

Currently you can restore to the following versions with the latest SEP, baseband, and U1 (if on A13 or newer non-SE iPhone's) for your device: (someone correct this its still worded like the old tag is still here)

For restores on devices that support iOS 15 and Wi-Fi only iPads, you currently must use the latest beta version of FutureRestore, see /tag futurerestore for a link.

Added by Tanbeer#4750 | Used 1,720 times · Jul 17, 2021, 2:35 PM

[velvet path]

yes

[sonic totem]

Oh fair enough, I completely forgot that that existed

[ashen birch]

i mean copying activation tickets over activating in OS is nothing new

they just wrote a guide on how to

[sonic totem]

I see

Interesting anyways

[inner yoke]

on a11 iphone8 can only downgrade, the lowest downgrade is 14.3

You can also downgrade without shsh with downr1n, but it is tethered

[faint stag]

file descriptor chmod? yeah that's actually clever

[sonic totem]

Yeah it first uses lchmod because it doesn’t follow links, and then fchmod to make sure it has a file descriptor

Not necessarily in that order

[odd timber]

If A11 has PPL then why doesn't an A11 jailbreak require a bypass if checkm8 isn't used?

[sonic totem]

It doesn’t

Apple just got their own Platform Security Guide wrong lol

[odd timber]

LMAO

thanks, i been wonderin about that

[sonic totem]

They also claim something about macOS which is wrong too I think

And some stuff about SEP

[odd timber]

that

[sonic totem]

Yeah

When macOS does in fact have PPL on Apple Silicon Macs

[odd timber]

https://tenor.com/view/chuu-loona-shrug-chuu-shrug-face-palm-gif-18112815603128552700

[harsh junco]

guys how do i compile img4tool

[sonic totem]

Welcome to the tihmstar dependency ring of hell 😤🔥💯

[torn oriole]

fucked up libplist

compile latest from limd repo and install

[harsh junco]

already did that

[torn oriole]

Did you make clean and autogen img4tool again

[faint timber]

its pretty simple

there are multiple places a lib can be installed

even if you install the new libplist its highly likely the old copy is installed in a different path

so obviously you are going to use the search feature to find and delete the old one...

[sage kite]

package managers generally install in /usr/lib, compiling from source generally install into /usr/local/lib

[faint timber]

also linux gnu arch dir

[harsh junco]

im compiling it on windows with mingw64

[topaz yew]

oh u poor baby

[faint stag]

oh yeah i tried that too
got stuck on libgeneral

i think

[twilit jungle]

I never understood why people struggled to compile tihmstar's source... like just get his computer and press compile.

[radiant idol]

def shift_commands(commands, amount, within, shifts):
    for (Command, props) in shifts:
        for (_, cmd, _) in commands:
            if not isinstance(cmd, Command):
                continue
            for p in props:
                v = getattr(cmd, p)
                setattr(cmd, p, shift_within(v, amount, within))

what the hell does this python syntax mean

this is why I hate python

[faint stag]

i mean you could do the same in other languages. readability here is just up to whoever wrote it

[radiant idol]

no yeah I know

its just so wordy that at this point its hard to read

I especially dont understand these

[faint stag]

probably should look at the usage

[timid furnace]

shifts is an array of two item tuples

(command, props) is unpacking them

[radiant idol]

the what

[timid furnace]

have you not used swift

[radiant idol]

no

[timid furnace]

ok then just think of it as immutable list

[radiant idol]

like an NSArray array?

[timid furnace]

so instead of having to do

for item in list:
    # item is a 2 item list
    first = item[0]
    second = item[1]

if it's always going to be a fixed size, you can unpack it in the for loop

for first, second in list:
    # stuff

[radiant idol]

oh

ok

but like

why

[timid furnace]

why not

[radiant idol]

that just makes it overcompilcated imo

anyways

that helps

thank

[timid furnace]

idk this is pretty simple for me to understand

anyways the second line is the same

_ just means ignore

[radiant idol]

I mean yeah I get it now but still

[radiant idol]

ok that part I dont get

wdym "ignore"

[timid furnace]

so you only want the second item in the tuple (index 1)

[radiant idol]

oh

ok

[hexed knot]

How

Pythons the best of the simple languages

Pretty good syntax sometimes

[timid furnace]

_ can be anything actually

ie.

_ is just the convention to indicate "i don't care about this variable"

[radiant idol]

I don't like reading/writing python

oh ok

[faint stag]

idek python but yeah that's obviously 4 arrays for types of commands

i decided to just look on github for where shift_commands was used because that helped me understand

[radiant idol]

https://alexomara.com/blog/adding-a-segment-to-an-existing-macos-mach-o-binary/

this is the thing i'm getting it from

[faint stag]

yeah and someone used that within a project

[radiant idol]

I see

well I'm trying to port it to C/Obj-C

I just dont really get the syntax of python

I also do not like the weaktypedness of python

[faint stag]

swift can be just the same i guess

except that actually compiles to something

[radiant idol]

yeah

[timid furnace]

well swift is strongly typed

its just that it guesses most of the time

you provide the type almost the rest of the time

and it just gives up for the rest

[radiant idol]

objc supremacy

[timid furnace]

ok but objc is fake typing

[radiant idol]

true

id moment

[timid furnace]

yes

[faint stag]

compiler assumes a lot of things, doesn't it

[radiant idol]

how do I convert this to objc

no tuples in objc

def shift_within(value, amount, within):
    if value < within[0] or value > (within[0] + within[1]):
        return value
    return value + amount

just an arr?

hm

int shift_within(uint64_t value, uint32_t amount, ? within)

[timid furnace]

what calls shift_within

[radiant idol]

this

which I also need to convert to C/Obj-C

more in favor of C

[timid furnace]

within is a tuple

(linkedit_fileoff, linkedit_cmd.filesize)

looks like two ints

[radiant idol]

so I guess I could just make that one arg into two?

[timid furnace]

idk up to you

you should probably understand what it's doing rather than doing a straight port

because this won't translate terribly well

[radiant idol]

yeah true

the documentation is almost nonexistent unfortunately

I think its shifting the load_commands in the header to make space for the new load command for the new segment

I can't understand for the life of me why the guy would choose to do this in python

[faint stag]

well we know exactly what commands it's supposed to shift, they're listed anyway
it's supposed to shift offsets that can reference the modified segment
updating the header and inserting new commands is done after all this but the macho lib in use here makes that easier ig

[radiant idol]

hm I see

[topaz yew]

besides trollstore is there anything else the coretrust bug can do

like what are its capabilities, is what im asking

interesting indeed

[ashen birch]

so i ru n get tpf0 n have jb ???

[topaz yew]

real

[ashen birch]

shut up capt

where's the gif at

[visual meadow]

https://media.discordapp.net/attachments/688124600269144162/1176315581956370523/zefram.gif?ex=656e6c41&is=655bf741&hm=923dff8908696274cb59d9ba03793f219523cea5c137ecd9c13380bcab4c88a3&

[frank fossil]

is this why executable pages die on fork? In vm_map_remap

[naive kraken]

no that problem is much deeper

[indigo peak]

@hasty ruin @radiant idol have either of you tested trolldecrypt and ran into any issues?

[hasty ruin]

i've had it just not do anything after it freezes the UI

cant remember which app it was though

or if i could reproduce it

[indigo peak]

hm weird

[hasty ruin]

no alert or anything

[indigo peak]

anything else?

no crash on the file view or anything

[hasty ruin]

that's it I believe

[indigo peak]

no missing icons

[hasty ruin]

nope

nope

[indigo peak]

okay

[radiant idol]

i havent

[hasty ruin]

did i ever show you the WIP rune banner

[indigo peak]

damn

some people are getting some issues that i havent been able to replicate

[cloud yacht]

I did but you ignored me

[indigo peak]

where

what

[cloud yacht]

#development message

[indigo peak]

oh shit

sorry

yeah thats the issue im trying to fix now

[cloud yacht]

Do you need info?

[radiant idol]

no

[hasty ruin]

ty for icon again (ignore the fact that its a shit screenshot of the icon)

[radiant idol]

yea np

make the corner radius bigger for the icon

• make "Rune" bigger

[cloud yacht]

I've never made a banner for any of my apps

[hasty ruin]

hm true

[cloud yacht]

Icons were hard enough

[hasty ruin]

more round?

[radiant idol]

yes

slightly

also if you can, use continuous corner radius

[cloud yacht]

Should change the device screenshot to the page for nexus

[hasty ruin]

does xd support that

[radiant idol]

not sure

there seems to be some weird artifact with the corner radius

[native orbit]

how much rune gonna cost

[hasty ruin]

it was a shitly cropped screenshot

didnt have the icon on my laptop

[radiant idol]

br

dont do that

[hasty ruin]

https://havoc.app/package/nexus i dont think nexus' was too bad

[native orbit]

bl

[hasty ruin]

well yeah its not final

[cloud yacht]

I meant making my own icons was difficult enough, that I didn't want to do a banner

[radiant idol]

I made my banner

hold on

[cloud yacht]

I just don't have banners

[hasty ruin]

fart

[radiant idol]

and the screenshots

[radiant idol]

imagine not being able to use markdown correctly

[cloud yacht]

Like what would I do for Eliza or unlocked

[hasty ruin]

bro has so many iphones!!!!

[radiant idol]

fr

[cloud yacht]

Wait

[timid furnace]

how much do you make off of nexus

is it enough to buy development devices

[hasty ruin]

definitely

[timid furnace]

ok i need tweak ideas

[cloud yacht]

Nice

[radiant idol]

frcoal

[hasty ruin]

not right now, though it hasnt been updated in like 6 months

[cloud yacht]

Audio mixer

[radiant idol]

remake activator

"ez"

[timid furnace]

activator 2

[cloud yacht]

Honestly activator usage in the shortcuts app

[native orbit]

make nexus 2

[hasty ruin]

good idea

[cloud yacht]

Nexus for iOS 7

[radiant idol]

why not
just
update
it

[hasty ruin]

the lockscreen sucks

[native orbit]

just release it as the exact same as nexus and charge $5

[hasty ruin]

i get depressed having to open that fucking directory

[radiant idol]

what

[hasty ruin]

i hate it

[radiant idol]

what x2

[cloud yacht]

I have a terrible tweak idea that will not make any money that I was debating making

[radiant idol]

what is the idea

im concerned if i even wanna hear it now

[native orbit]

need infiniboard back

[hasty ruin]

sets label x pos to 0
label has no left padding

you'd think the text would be on the very left right?

WRONG!! it's like 5-10px away from the edge

[radiant idol]

trolled

[cloud yacht]

Ok so basically take the ringer switch and make it behave like the iPod lock switch. Basically if ringer is locked, turn off screens and don't let it turn back on until it's unlocked

[hasty ruin]

glad they rewrote it in ios 16

less glad that it's even worse

in terms of user experience too

[radiant idol]

LMAO

[timid furnace]

that's not a bad idea

[radiant idol]

interesting

[cloud yacht]

Honestly just nuke the Lock Screen and then make your own from scratch

[radiant idol]

Ding source code may help

[timid furnace]

so basically input lock

[cloud yacht]

I think someone linked it in another server

[hasty ruin]

just stop the screen turning on at all

no need to change LS shit

[native orbit]

you can do that without a tweak

just smash the phone

[cloud yacht]

I meant for nexus 2

https://media.discordapp.net/attachments/709389160011661344/1162880097854955622/IMG_1852.mov?ex=657e24fc&is=656baffc&hm=edf11f91b4d7d1a6ca1b6465dd8ea7905a4810ff260b50ab672e94e16e43fb56&

[hasty ruin]

oh right

i basically do now

which is just pain

[cloud yacht]

Probably more stable than modern ios

[hasty ruin]

modded apple device :/

not intended behaviour

[indigo peak]

@cloud yacht i think i found a fix :)

[cloud yacht]

It still has the OFW on it

But the OFW is garbage compared to rock box

Rock box even has a manual

[indigo peak]

@cloud yacht can i dm you a build to test?

[cloud yacht]

Yeah but I can't test until I get home in about 15-30 minutes

[hasty ruin]

i love discord cdn

[cloud yacht]

Honestly dumping random data into bots dm's goes hard

[hasty ruin]

horts

[radiant idol]

horts

[cloud yacht]

No this apple device is running normal unmodded apple software

[fiery seal]

that would stop the Nexus Moment when you pull ur phone out and NEXUS SETTINGS had already appeared while it was in your pocket cause you were touching your phone, the screen happened to turn on at that time, and nexus thought you wanted to mess with settings

[visual meadow]

Does anyone here know if any daemons, besides these (https://newosxbook.com/ent.jl?ent=com.apple.private.security.storage.AppBundles&osVer=iOS16), can write to app bundles?

[hasty ruin]

disable whilst locked mf

[fiery seal]

oh thanks i didn't know that was an option

[hasty ruin]

[fiery seal]

it does say "disable whilst locked", not "disable settings whilst locked"

[hasty ruin]

text too big

[radiant idol]

while*

[faint stag]

i mean i thought that's what powercuts was for

[acoustic imp]

@hasty ruin why,for nexus settings, didn’t you make it that like pup up and out window thing. Like it opens then makes the window behind it smaller… this thinge

(The music windows thing would be nexus settings and Apple Music app thing is the LS )

[frail spade]

hmm

i tried overwriting /var/mobile/Library/FrontBoard/applicationState.db with a partial backup to see if it would restore the state of the app switcher

but it doesnt seem to affect it

are there any other places where the app switcher state could be stored?

[proven urchin]

whitename moment

[indigo peak]

@hasty ruin I’ll merge your pr tm, just fixed some bugs in latest release

[frank fossil]

I have finally got my very terrible way to fix fork() to run CLI tools

• Enable JIT using ptrace(PT_ATTACHEXC, forkedPID)
• Copy the whole MachO binary to a new memory map, in order to ensure any address-relative instructions continue to function
• Set RX for __TEXT region in the new MachO memory
• In child’s SIGBUS handler, change pc to the new executable region

[visual meadow]

Wow

[torn oriole]

No but you see it’s better because the kernel didnt do it

[unkempt magnet]

Awesome!

[topaz yew]

how do i create a platform binary

[sonic totem]

Give it the platform-application entitlement

[naive kraken]

don't use signals for communicating though, they have side effects and some tools will break due to them

instead use file descriptors like Dopamine

also can't you remap something executable on top of the existing r-- mapping?

[frank fossil]

It always fail with KERN_NO_SPACE

[naive kraken]

hm

probably because both the child and the parent are backed by the same memory

[harsh junco]

what now

[topaz yew]

thanks

[indigo peak]

have you know i fixed the issues

[hasty ruin]

W

[slender glade]

I had some fun using some of the camera related AVF apis for this, which were the main purposes of this demo https://github.com/NSAntoine/Shiranui/blob/main/Shiranui/UI/CameraScannerViewController.swift

I also did not realize how much info it could detect lol

[granite frigate]

micro pdf417

https://cdn.discordapp.com/emojis/1087137076555821128.webp?size=48&name=WHAR&quality=lossless

[radiant idol]

SERENA IS BACK

[hasty ruin]

Nocturne*

[blazing warren]

boobies and faces

[indigo peak]

fun fact: pdf417 is the barcode type for US drivers licenses

[granite frigate]

interesting

and something i'll never use

[indigo peak]

that’s why it’s a fun fact

[granite frigate]

is this a public API? i have some ideas for swift student challenge using this

i just realised i was blind

sorry

[cloud yacht]

That's neat

[harsh junco]

i dont think so?

[indigo peak]

bite your apple

[hasty ruin]

https://tenor.com/view/letter-r-gif-9063762

your*

[tepid olive]

What

[harsh junco]

that helped, thaks

[drifting heron]

🙃

[frail cedar]

How does one spawn a binary on ios 4.3 so that you can read stdout

I'm guessing NSTask?

[visual meadow]

https://tenor.com/view/letter-h-gif-9063752

[tepid olive]

https://tenor.com/view/lettere-gif-27129156

[zenith compass]

oh

[frail cedar]

hoe

[tepid olive]

How did you say that

Bro what

[young meteor]

https://tenor.com/view/letter-e-gif-9063749

[native dune]

https://tenor.com/view/letter-t-gif-9063764

[brazen timber]

https://tenor.com/view/letter-r-gif-9063762

[native dune]

https://tenor.com/view/letter-a-dancing-gif-9063745

[young meteor]

https://tenor.com/view/letter-n-gif-9063758

[zenith compass]

https://tenor.com/view/letter-u-gif-9063765

[brazen timber]

https://tenor.com/view/letter-c-dancing-gif-9063747

[blazing warren]

https://tenor.com/view/leslie-jordan-leslie-belly-dancing-belly-dance-dancing-gif-1078436988087063427

[tepid olive]

https://tenor.com/view/letter-f-gif-9063750

https://tenor.com/view/universitario-de-deportes-trinchera-norte-garra-crema-gif-24103257

https://tenor.com/view/letter-c-dancing-gif-9063747

https://tenor.com/view/k-discord-discord-k-orange-k-spinning-k-k0r8z-gif-22812675

https://tenor.com/view/letter-y-gif-9063769

https://tenor.com/view/alphabet-lore-gif-6043160532631328617

https://tenor.com/view/universitario-de-deportes-trinchera-norte-garra-crema-gif-24103257

https://tenor.com/view/letter-b-dancing-gif-9063746

https://tenor.com/view/letter-i-gif-9063753

https://tenor.com/view/letter-t-gif-9063764

https://tenor.com/view/letter-c-dancing-gif-9063747

https://tenor.com/view/letter-h-gif-9063752

[zenith compass]

i think we should stop

[tepid olive]

White name

[zenith compass]

whoa are u being racist to me just because i have white name?!?!!

[tepid olive]

Yes

[young meteor]

based

https://tenor.com/view/letter-n-gif-9063758

[ashen birch]

mem+ is the new whitename

[next wadi]

there's too many mems

we shouldve stopped at one

[tepid olive]

[frank fossil]

@opa334 apparently bold text uses gpu to accelerate so any unsandboxed app without GPU access will crash. Maybe TrollStore should check and add additional iokit entitlements for it

[primal perch]

tbh yea

mem ed is like baseline competency for this server

[ashen birch]

clemmed = genius

[turbid fjord]

“Baseline” yeah
We have some member ones who can be a bit

[frank fossil]

I tried it in parent process before fork() but it was the same. Also, I’ve tried deallocating it beforehand but any map/remap to the address straight out crashes the process.

[naive kraken]

yeah

I believe the processes share the same page table

So that's why you can't change the area where it was originally mapped

[frank fossil]

How would I do this? I’d have to relocate everything to the copied region, but things like callbacks are not possible to relocate without signal handling

[naive kraken]

oh

I misunderstood then

[frank fossil]

also please check this out

[naive kraken]

it's up for apps to figure out

it doesn't happen with stuff that's sandboxed

[frank fossil]

yeah but, the usual fix would be add some IOKit access to be same as sandboxed app

[minor cargo]

i just got a 2016 macbook pro. ima install sonoma on it with open core and then learn swift and c++ and c

[tepid olive]

https://tenor.com/view/letter-p-gif-9063760

[turbid fjord]

https://tenor.com/view/letter-a-dancing-gif-9063745

[tepid olive]

papy

[fiery seal]

https://tenor.com/view/letter-a-dancing-gif-9063745

[tepid olive]

https://tenor.com/view/letter-n-gif-9063758

https://tenor.com/view/letter-a-dancing-gif-9063745

https://tenor.com/view/red-alphabet-letter-dancing-letter-l-cartoons-gif-12084376

[blazing warren]

[indigo peak]

https://tenor.com/view/letter-s-gif-9063763

https://tenor.com/view/letter-e-gif-9063749

https://tenor.com/view/letter-x-gif-9063768

[blazing warren]

🍆 💦🍑

[tepid olive]

i should call her

[reef remnant]

Anyone who can help me with Theos? After updating Xcode and Theos my tweaks don’t appear on my phone. They compile without errors…

[tepid olive]

https://tenor.com/view/letter-j-dance-gif-9063754

[cloud yacht]

True

[minor cargo]

not me i’m smort

@naive kraken what security research company do you work for?

[naive kraken]

Cellebrite

[robust radish]

would you recommend the company / is it a decent place to work remote from ?

[naive kraken]

yes

If you're interested in a job there, you can DM ih8sn0w or guyru_ on Twitter

[robust radish]

Nice, thanks. Yeah I saw guyrus tweet the other day and have been considering applying

[minor cargo]

maybe when i’m 18 i’ll apply.

[pearl sail]

Hmm are you allowed to have a public opinion about the current conflict going on?

[naive kraken]

As long as it doesn't involve the killing of your coworkers or the destruction of Israel, I would assume so

[pearl sail]

Interesting

[robust radish]

definitely a good interview icebreaker question

[unkempt magnet]

How much effort did you need to apply here?

[naive kraken]

None, they reached out to me

[unkempt magnet]

Oh

[rigid glen]

Anyone here attending 37c3?

[naive kraken]

yes

[rigid glen]

Great, let’s meet!

[minor cargo]

definitely gonna not answer the question

[tepid olive]

@naive kraken sorry for the mass pings but what experience/skills would I need to apply to a company like cellebrite?

I’m in college studying computer science and cyber security and im decent at programming

Also have some certificates

[indigo peak]

what’s the odds I get a job from gameseagull 🤣

[primal perch]

basically that but finish your degree and you will have a good chance

[naive kraken]

publish cool projects or find bugs and get CVEs

https://github.com/opa334/sandbox_extension_generator for reference this is the project that made them consider me

[timid furnace]

@sonic totem did Security.framework always check all slices

damn

i can't prove it but i think i know the issue

[steady nest]

tbh I couldn't find the explicit check for number of slices on xnu src

so it doesn't seem like a number of slices problem (maybe...?)

[unkempt magnet]

That might be one of your effort, nice.

[timid furnace]

My explanation doesn't reconcile with it being fixed for arm64 in 15.5 and arm64e in 15.7

But

I think on the newer versions security.framework checks all slices instead of skipping the ones with matching subtypes

[steady nest]

that wouldn't make sense since it's the kernel that's refusing execution

[visual meadow]

I diffed ios 17.0 vs ios 17.2b4 security and there were no changes

[steady nest]

it passes installd's checks

think of it in a different way

duplicated slice of the same file

it gets past installd but doesn't execute, why

[timid furnace]

Does it?

I don't think it did for me

Even if I pretended to be arm64 Security.framework saw the slice as arm64e

I need to retest while documenting though, I was testing a bunch of things at the same time

[steady nest]

it did

[timid furnace]

Which version

[steady nest]

17

[timid furnace]

Wtf

[steady nest]

https://github.com/opa334/ChOma/tree/main/tests/fat_create use this

give it the same mach-o twice

[timid furnace]

I've been using lipo and editing the fat header

[steady nest]

[timid furnace]

I'm eating dinner right now but I'll test in a bit

While I have you though

[visual meadow]

I was using pwnify from fugu14 and then just editing the subtype to 00 lol

[timid furnace]

Do you know what -50 from sec.fw is

I got it a lot from my testing

[steady nest]

err

I think that's the general error unfortunately

[timid furnace]

My best guess is that is security.fw trying to parse funny signature

[timid furnace]

Yea src wasn't very helpful

[primal perch]

[indigo peak]

@hasty ruin how do i merge pull requests on github 💀

i dont use github

oh god dgh0st is typing

[twilit jungle]

Git merge

[indigo peak]

either this will be a useful reply

[twilit jungle]

[indigo peak]

or sarcastic

its a 50/50

i guess the coin landed on heads, hes being useful

[timid furnace]

bruv

just go to the pr page

and click merge

[twilit jungle]

[indigo peak]

well i meant bc i updated the repo

like

[timid furnace]

it will still cleanly merge

[indigo peak]

timeline:
1.0
pr was made
1.1
ill merge

okk

[timid furnace]

if there are conflicts then it wont cleanly merge

but there are no conflicts

[indigo peak]

i was scared smth was gon happen

since it was old file

tyy

[timid furnace]

yw

also remove your binary from your repo

[indigo peak]

oh in Payload

whoops

[timid furnace]

ye

[indigo peak]

whoops

all good now

ty @timid furnace

[timid furnace]

np

[indigo peak]

@twilit jungle this u?

[twilit jungle]

Nah you missed:

#development message

[zenith compass]

bro what the fuck

it's endless

[twilit jungle]

Definitely not

All wise ones have seen the end

[tepid olive]

Iv’e seen the end

im a champion

[severe stream]

ive seen it before

[timid furnace]

@steady nest you're right

hm

[pearl sail]

All the wise ones do meth

[visual meadow]

right about what lol

[timid furnace]

^

[visual meadow]

oh yea i tried on 16.6.1 it does

its weird tho

either way it doesn't run because it has 2 of the same archs in the binary

it does that even if you try to run it on macos

[steady nest]

about

[visual meadow]

.

[tender plaza]

Is there a arduino patch for the r4 wifi board, for setting up the usb host library.patch?

[primal perch]

wtf

dghost in dev

exceedingly rare

[pearl sail]

not rarer than seeing actual development happening in #development

[granite frigate]

i was thinking of how i can automate signing a dylib to inject into an app

so you’d have to

1. read the .app mach-o binary
2. find the team id from it
3. fastpathsign your dylib with it
4. profit?

[indigo peak]

yeah

but youd have to manually inject everytime

[timid furnace]

Figured out where i fucked up

i didn't account for CTv1 vs CTv2

CTv1 passes security.framework, CTv2 does not

[timid furnace]

i don't think there's a way to get past installd

On 15.7+, the only way to get past installd is by making your CPU type and subtype exactly equal to a validly signed binary. Otherwise, installd will find the other slice and try to validate it. This is fine for CTv1 (well it depends, if the slice is picked as the one for resource validation it fails, otherwise it skates by fine, I think, haven't really tested), but it chokes on parsing the CTv2 signatures

[sonic totem]

No

It checked the first one

The idea is that installd will check exactly the same slice as the kernel

Thus they only need to check one slice

[sonic totem]

You would have to replace the team ID

But essentially yeah

But fastPathSign does all that anyway

[timid furnace]

If you make your CPU type and subtype exactly the same though, the kernel will reject it

CPU type/subtype comes into play in 4 cases in the kernel, at least from what I see

1. FAT binary is checked for duplicate type/subtype pairs. if there are duplicates, EBADMACHO
2. Each arch is graded and the best one is picked
3. The mach header's CPU type and subtype are compared to the FAT header. if they are not equal, EBADARCH
4. (not really relevant) The arch is graded again, but the capability bits of the subtype is removed. If it's not allowed, EBADARCH

so basically the slice that is selected for execution has to match what it's purported to be in the FAT header

[sonic totem]

But installd will always pick the same arch when grading now

So you might be right in the sense that there are no FAT bugs anymore

[timid furnace]

i don't think installd is grading

[sonic totem]

(In terms of an installd bypass)

[timid furnace]

from what i understand it's a logic bug

[sonic totem]

It chooses the best slice

[sonic totem]

This one with three arm64 slices?

It’s intended behaviour

[timid furnace]

in terms of whether to validate the code signature?

what is installd grading for?

[sonic totem]

It just chooses the first, best slice to validate. The kernel will choose the same slice as they use the same grading standards. Hence, there is no need to validate any other slice as they will never be run.

[timid furnace]

But it does validate every slice

on 15.7+

[sonic totem]

It doesn’t if they are the same architecture

[timid furnace]

if they are the exact same CPU type and subtype, yea

[sonic totem]

That’s the problem

There might not be any bugs

[timid furnace]

and this includes capability bits

[sonic totem]

Yeah they have to be literally identical

[timid furnace]

yea

fwiw I'm pretty sure I found the change fixing it

did you find it?

[sonic totem]

Fixing which bug?

[timid furnace]

I guess the arm64e one

[primal perch]

https://tenor.com/view/family-guy-peter-griffin-horn-music-dance-gif-17514572

[sonic totem]

I think it was in internal_NXFindBestFATArch inside libmacho.dylib?

Essentially it just had different logic to the equivalent function in the kernel

So they’d grade FAT slices differently

[timid furnace]

I argue in favor of this

sec

[sonic totem]

Wdym

[timid furnace]

(cleaned it up a bit for better diffing)

Basically, the first check is now for an exact match, rather than an match ignoring caps

this eliminates the scenario where the prior slice has invalid caps but a valid signature (making it acceptable to Security.framework, as it doesn't care about caps), but the secondary slice has valid caps but an invalid (to Security.framework) signature

and then I think it iterates using findArch or something idk. i was having a lot of trouble tracing it through the code

[granite frigate]

installd bug? what iOS are you diffing between

[timid furnace]

this was basically the only relevant code i could find that had FAT handling so i figured it was this

[timid furnace]

installd calls out to Security.framework

this is a diff between

• iOS 15.5 = Catalina 2022-004 = macOS 11.6.6 = macOS 12.4
  • Security-60158.120.9 (macOS 12.4)
• iOS 15.7 = iOS 16.0 = macOS 11.7 = macOS 12.6 = macOS 13.0
  • Security-60420.40.34.0.1 (macOS 13.0)

[sonic totem]

Hmm

I think this might be unbreakable

I don’t see how there could actually be a bug

Because now it’s identical to the kernel’s checks

[granite frigate]

has the kernel's checks changed between the 2 versions? where is that done normally

[timid furnace]

xnu

hasn't changed afaik

[sonic totem]

No

They changed Security.framework to match the kernel

[granite frigate]

i mean yes, like where specifically? sorry i couldn't find it

[sonic totem]

Kernel function is called fat_getbestarch_for_cputype or something

[timid furnace]

my Security.framework theory is also kinda supported by the logs: for example, armv7/arm64/arm64 (where both arm64 are identical)

debug    22:09:26.967025-0500    installd    0x6809157f0 is a fat file with 3 architectures

valid

but it only pulls out two slices

debug    22:09:26.969422-0500    installd    89472 signing bytes in 6 blob(s) from /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.DFZ9lw/extracted/Payload/Runner.app/Runner(arm64)
debug    22:09:27.159755-0500    installd    85416 signing bytes in 6 blob(s) from /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.DFZ9lw/extracted/Payload/Runner.app/Runner(armv7)

but say you have armv7/arm64 with bogus cap/arm64

debug    00:47:19.134438-0500    installd    0x680809f70 is a fat file with 3 architectures

valid again

but it pulls out all 3 slices

debug    00:47:19.136636-0500    installd    89472 signing bytes in 6 blob(s) from /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.bFflSs/extracted/Payload/Runner.app/Runner(arm64)
debug    00:47:19.329511-0500    installd    85416 signing bytes in 6 blob(s) from /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.bFflSs/extracted/Payload/Runner.app/Runner(armv7)
debug    00:47:19.418576-0500    installd    40820 signing bytes in 4 blob(s) from /var/installd/Library/Caches/com.apple.mobile.installd.staging/temp.bFflSs/extracted/Payload/Runner.app/Runner(arm64)
default    00:47:19.418947-0500    installd    MacOS error: -50

(dies)

[sonic totem]

How have you got these debug logs

[timid furnace]

bsd/kern/mach_fat.c
bsd/kern/kern_exec.c
bsd/dev/arm/kern_machdep.c

[sonic totem]

But also interesting

[timid furnace]

all 3 relevant files

[timid furnace]

console

[granite frigate]

thanks https://cdn.discordapp.com/emojis/1077203069718245467.webp?size=48&name=prayge&quality=lossless

[sonic totem]

Huh

I’ve never seen those before

[timid furnace]

not enabled by default

[sonic totem]

Oh right

I turned that off

[sonic totem]

So what’s the difference when it pulls out all three slices

Oh the capabilities

[timid furnace]

yea

[sonic totem]

I think we need to look elsewhere

Tbh

[timid furnace]

here are my results

logs available on request because i am too lazy to collate them

[timid furnace]

agreed

[timid furnace]

nice little side note: installd does actually grade but it's just to see if you have any runnable slice or not. it uses sysctl to call out to the kernel function. if there's no runnable slice it'll give you the app needs to be updated prompt, the one for 32-bit apps

[timid furnace]

also because caps doesn't change grading for arm64 you can't use this for TrollHelper on 15.5-15.6.1 on arm64

meaning the first arm64 slice is what will run, and since CTv2 doesn't pass Security.fw it can't be the first slice, so rip

[sonic totem]

Worth a try anyway, thanks for all your research lol

How much do you know about DDIs?

[timid furnace]

Lol it helped me understand it very well

[timid furnace]

I fiddled with it for a bit back when MDC was a (more popular) thing

I got root exec but gave up on it once i realized i was screwed by the sandbox, but CTv2 changes things

You need MDC in order to use a custom DDI though, so I don't see the point (wrt TrollStore install)

[sonic totem]

I wonder if that’s not the case

If there’s another way

[severe stream]

what would this mean?

[timid furnace]

Which part

Do you want the general explanation or the more technical one

[sonic totem]

@timid furnace DMs for a sec?

[severe stream]

I mean what can't be used?

[sonic totem]

The old CoreTrust bug

No what

The old installd bug with the new CoreTrust bug

[timid furnace]

Yea

[severe stream]

owh

[velvet path]

could this be used for arm64 14.x (which has CTv1) or no?

[timid furnace]

I haven't checked but someone said they introduced the arm64v8 grading changes in iOS 15

So for 14 both would have to be arm64, which the kernel will complain about

Idk I'll check the kernel tomorrow

[velvet path]

alternatively part of me would be wondering if there's a sandbox bug that could be used alongside something like TIMDC

because right now the only way to get TS on arm64 14.x is either:

• sshrd stuff
• jailbreaking

it's mildly amusing given that arm64 15.0-15.4.1 and arm64e 14.x work fine, but not arm64 14.x

[timid furnace]

need to retry tccd on 14

pretty sure that it persisting was cap

on the other hand unsure if 14 even has the exploitation vector for it

[velvet path]

does the tccd bug exist on 14.x?

[timid furnace]

idk

it's not really a bug

it's moreso find and replace something in the binary and congrats you have an all encompassing sandbox token

it's kinda like if you could overwrite amfid's checks and just make them return true. you can't protect against that, it's not really a bug

(you can't though)

[velvet path]

by it persisting, do you mean the tccd change or the tips change or what?

[timid furnace]

tccd change

[velvet path]

what issues does it even cause if it persists

[timid furnace]

won't work unjailbroken

broken code sig

[naive kraken]

CTv1 does not pass Security.framework

[naive kraken]

you can't fastPathSign with anything but GTA Car Tracker currently though

[granite frigate]

oh I assumed i was doing something wrong because it seems like it gets killed when i use a roothelper to spawn it

[naive kraken]

The iOS 14 kernel will not run arm64v8 slices, this is why the arm64 install method does not work on iOS 14

[granite frigate]

is there any way to get it working? what's currently hardcoded to make it only work with car tracker

[faint timber]

yoooooo

gimmeeeee some slicessss

quit hording all the pizza

[timid furnace]

i got past installd so idk

[timid furnace]

^

Idk i didn't look into v1 that much after realizing i was using it instead of v2

[blazing warren]

https://x.com/xvonfers/status/1731721821605568776?s=46

[tepid olive]

Are we expecting a 17.0 kernel exploit from google project zero at all?

[granite frigate]

i don't think a LPE is a kexploit

[sonic totem]

There was an exploit in the chain

But they will probably only analyse the actual vulnerability

Highly unlikely that they’ll release a full exploit as there isn’t a need

[granite frigate]

developing an exploit based off a vulnerability seems so daunting i wish i was good enough to do that

[sonic totem]

The first time you do it will probably be really difficult

But I guess as you do it more and more it will get easier

[granite frigate]

there are obviously a lot more things I have to learn before i even get to that point

[sonic totem]

It would be enough to install TrollStore though I think

Because then you could spawn a binary as root

Oh wait you’d need to unsandbox too I think

[granite frigate]

well the coretrust bug works so that wouldn't be an issue?

[sonic totem]

Yes but you won’t be running in a CoreTrust signed app if you’re installing TrollStore

So who knows

[granite frigate]

oh, right

[sonic totem]

The original TrollStore installer did it all with a kernel exploit, but that was when you could get root and unsandbox yourself with just kernel r/w

[ivory ginkgo]

How do you make jailbreak exploits?

[sonic totem]

Good question

[twilit jungle]

[visual meadow]

does it open tho or is this just 2 of same arch slice thinf

thing

[timid furnace]

it does not help

[visual meadow]

damn

find anything interesting overnight?

[timid furnace]

i learned more about (the) installd (bug)

that's basically it

the conclusion is that installd is no longer vulnerable to FAT attacks

[visual meadow]

damn it

[eternal rain]

where can i find bootstrap binaries

for arm64e

[ashen birch]

what version

[eternal rain]

ios 17.0

im experimenting with trollstore rn

[ashen birch]

you can compile procursus yourself

besides that thats it

had a brainfart meant proc

[eternal rain]

does it require any dependencies

other than the basics like libgc or whatever

[eternal rain]

thats enough for me i just need some basic binaries like sudo for now

or even neofetch

nothing crazy

[ashen birch]

build dependencies yeah

honestly i'd say building from linux is ur best bet

if you're building from *OS you have to be bootstrapped with procursus

[eternal rain]

ok thats good since i got gentoo

[ashen birch]

https://docs.procurs.us/Development/Building/Linux.html

[eternal rain]

thank you

ill try this when i get home

should i compile the toolchain or everything

oh nvm

[minor cargo]

i wish they updated for macOS

[ashen birch]

there should be a precompiled one no?

[eternal rain]

i couldnt find any

[minor cargo]

i love procursus

[ashen birch]

thats why i kinda stopped using it (i mean i can't really talk, i'm literally a maintainer but)

[eternal rain]

macos sucks anyways imo

[minor cargo]

is development stopped on it or something?

[eternal rain]

it’s basically linux with a paywall

[granite frigate]

hackintosh:

[minor cargo]

true but i like it

i just like the UI

[eternal rain]

yea that’s fair

[ashen birch]

not officially just it's not a priority for us rn

[ashen birch]

its linux but user friendly

[minor cargo]

okay

[minor cargo]

exactly

[eternal rain]

yea without the masochism ig

[ashen birch]

"but but but linux is user friendly" give a grandma a laptop with ubuntu and a laptop with macos

she'll understand macos more

which wont be saying a lot she prob wont understand either very well but

[eternal rain]

man my grandma doesn’t even know how to use the settings app

[minor cargo]

i gave my grandma a chromebook

she just uses facebook so it works for her

[ashen birch]

tbh smart

why spend so much on something that'll be used for so little

[minor cargo]

exactly

i even turned on the bigger curser to make it easier for her to see

[eternal rain]

thats nice

my grandma has an old phone too which she uses for only like 4 apps

her phone still runs better than my school computers somehow

[minor cargo]

ikr

0.0001 ghz processor

[eternal rain]

fr

my school computers lags on google docs

and has like -300 gb of disk space

[minor cargo]

my main computer has 256gb

so i would kill for 300gb

but i use arch

so it’s okay

[eternal rain]

nah its like negative 300 gb

has no disk space

[minor cargo]

oh

lol

well i use arch

btw

[eternal rain]

arch user spotted

im a gentoo user so basically arch but with a different package manager

i got a friend with windows and has 8 tb of disk space

this dude managed to use it all

my install takes like 60 gb maybe

[granite frigate]

8tb of homework is crazy

[eternal rain]

thats what im saying @ebon thistle @ebon thistle @ebon thistle @ebon thistle @ebon thistle

oops accidentally pinged him

keyboard glitched

phone got hacked

[minor cargo]

🤮

i mean

🤑

[eternal rain]

🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑🤑

i just update while i sleep

and im canadian so i need the extra heat from compiling to heat the house up

[minor cargo]

💀

[eternal rain]

sooooo hea

arch is a good distro tho

i used it as my first distro i think

my install was garbage tho im glad i nuked my system and reinstalled it later

[minor cargo]

if u big dum = archinstall

if u big smort = regular install

[eternal rain]

i used regular install but it was so bad

then i tried enabling secure boot and i somehow broke my motherboard

[minor cargo]

then so it again

[ebon thistle]

Hey, do me a favor and go junp off a cliff you cunt

Jump* shit

[minor cargo]

😆😆😆

[eternal rain]

my bad dawg

[minor cargo]

has anyone made a poc of CVE 2023-41993? or is anyone even working on it?

[sonic totem]

Is that the kernel exploit?

[tepid olive]

https://github.com/po6ix/POC-for-CVE-2023-41993

[minor cargo]

oh alright

[indigo peak]

how do would i sign a dylib with the team id (i ran ./make_cert.sh <TEAM_ID>)
basically: whats the ldid command to sign dylib with p12 cert

[naive kraken]

ldid -K<path/to/.p12>

[indigo peak]

ldid -K<path.p12> <pathdylib>?

[indigo peak]

ldid.cpp(3316): _assert(): flag_S || key.empty()
libc++abi: terminating due to uncaught exception of type char const*
zsh: abort      ldid -Kvictim.p12 tweak.dylib```

[visual meadow]

need -s

ldid -Kvictim.p12 -s tweak.dylib

[indigo peak]

% ldid -Kvictim.p12 -s tweak.dylib
ldid.cpp(3316): _assert(): flag_S || key.empty()
libc++abi: terminating due to uncaught exception of type char const*
zsh: abort      ldid -Kvictim.p12 -s tweak.dylib

real

[visual meadow]

what about -S

ldid -Kvictim.p12 -S tweak.dylib

[indigo peak]

no error

seemed to work

¯_(ツ)_/¯

[faint timber]

Always sign a dylib with S because it’s not supposed to have ents

[indigo peak]

@naive kraken i generated victim.p12, signed my dylib, put it into the Resources folder of my app, called int ret = spawnRoot(opainject(), @[[NSString stringWithFormat:@"%d", pid], [[NSBundle mainBundle].bundlePath stringByAppendingPathComponent:@"tweak.dylib"]], &output, &error);
and then got a dlopen error saying that the team id doesnt match

not valid for use in process: mapping process and mapped file (non-platform) have different Team IDs)
even tho ik its the right team id for the pid

any ideas?

should I have the app sign the dylib on runtime using the p12 and trollstore ldid and THEN call opainject?

[native dune]

What are u trying to do

Inject a tweak into an app?

[sonic totem]

Are you using the new CoreTrust bypass?

You need to sign the app and dylib beforehand using the bypass

Just install it using TrollStore

You might have to pre-sign the dylib, idk how ldid will work if it’s not in the standard path, but fastPathSign2 should work once ldid has pseudo-signed it

[naive kraken]

no clue

[indigo peak]

yeah I’m on ts2

[indigo peak]

I was trying to inject a dylib into an AppStore app using opainject, so like I said before, I signed the dylib with the proper team id BEFORE I put it in resources, and then I packaged the app and tried running opainject, and it said the team ids dont match

[steady nest]

you can't use a custom certificate

use the one in the trollstore repo

[indigo peak]

wdym why not

[indigo peak]

and wasn’t the victim.p12 on the ts repo made with the script I made mine with?

[steady nest]

because the cms blob is designed specifically for the certificate in the repo

[indigo peak]

so then how is opainject gonna work if you can’t specify a teamid for the dylib

[granite frigate]

am i tripping

[steady nest]

what does the teamid have to do with the certificate lol

[indigo peak]

I remember opa said like a year ago thay you have to sign the target dylib with the same team id as the target application is signed with in order for opainject to work

[steady nest]

adhoc sign the app with alfie's fork of ldid

it has the team id option

[indigo peak]

on device, or before packing the ipa

[steady nest]

before ct_bypass

[indigo peak]

so it has to be done on device?

[steady nest]

https://github.com/alfiecg24/ldid

[restive ether]

he should’ve up streamed this

[indigo peak]

cant compile

#include <openssl/opensslv.h>```

[visual meadow]

you dont macintosh

[indigo peak]

im on mac

[visual meadow]

oh

what mac

[indigo peak]

like

real mac

[visual meadow]

arm

or

intel

[indigo peak]

m2

[indigo peak]

Symbol not found: _ASN1_OCTET_STRING_free
  Referenced from: <5AFB45A8-1FC3-3D52-BE6D-1CF7DC8A4F3A> /Users/fiore/Downloads/ldid (built for macOS 14.0 which is newer than running OS)
  Expected in:     <no uuid> unknown
zsh: abort      ./ldid

real

[visual meadow]

what macos r u on

[indigo peak]

Ventura 13.3 (22E252)

why cant i compile tho

makes no sense

[hasty ruin]

Ventura lol

[visual meadow]

install procursus idk

it used openssl procursus for me

[indigo peak]

how

[pearl sail]

What

That OpenSSL should not be needed it is nothing special

[indigo peak]

i give up

nothing i try works

[faint stag]

yeah i'm trying to compile and i can't get it to use libcrypto

from procursus that is

lol

[pearl sail]

[indigo peak]

a func/meth like this isnt hookable right

__int64 static L10n.Payment.balanceMeals.getter()
{
  return static L10n.welcomeExplore.getter(
           &one-time initialization token for balanceMeals,
           &static L10n.Payment.balanceMeals,
           &unk_64488,
           one-time initialization function for balanceMeals);
}

its ida disassembly

im assuming its swift

[urban moon]

One way is using libundirect I guess

[primal perch]

meth

you can easily hook it assuming its not blocked out by some protection like KTRR or KPP

its just not gonna be easy cus it doesnt look like objc runtime

[indigo peak]

its in an apps framework directory

so id imagine its not protected lol

[primal perch]

yeah

everything is hookable

you might have to handspin assembly so good luck but its doable

[indigo peak]

and itll work normally even tho its in a framework?

and not the main binary

[primal perch]

yea

you just have to MSHookFunction the right address

if it works symbolically great

if not, its mapped in the processes memory so find the images runtime base address using dyld functions then add the static image offset using IDA/hex edtior

[indigo peak]

hmmm

okay

is that it? MSHookFunction only option?

bc it would be nicer for trollstore

but

yeah

[primal perch]

static patching

literal 0 runtime overhead

[native orbit]

until an update gets released

[primal perch]

[tepid olive]

[indigo peak]

@grave sparrow what would i even use for the symbol name

void MSHookFunction(void *symbol, void *replace, void **result);

[twilit jungle]

Not a name

[indigo peak]

__int64 static L10n.Payment.balanceMeals.getter

do i include the __int64 & static?

or is it just L10n.Payment.balanceMeals.getter

[native orbit]

the address

[indigo peak]

_$s14NovusSharedKit4L10nO7PaymentO12balanceMealsSSvgZ

so that

oh yeah

i remember doing this before

didnt succeed

but i remember doing it lmao

[native orbit]

swift symbol moment

[indigo peak]

@grave sparrow what image do i use for MSFindSymbol

do i hardcode the path to the framework binary?

[visual meadow]

One of my iPhone 12 on iOS 17 now

[indigo peak]

W app in the bottom row

2nd column

how does it work on iOS 17

[tepid olive]

Troll decrypt my favorite

[visual meadow]

Let me see

[indigo peak]

W

[primal perch]

forn

[indigo peak]

@grave sparrow ok i used NULL and i found the symbol, i found the address, but idk how to define the replacement function

[cloud yacht]

any code I write has runtime overhead

[indigo peak]

@grave sparrow

#include <substrate.h>
#include <Foundation/Foundation.h>

typedef long long __int64;
// __int64 static L10n.Payment.balanceMeals.getter
static __int64 (*balanceMeals_getter)(void *self, void *_cmd) = NULL;
static __int64 balanceMeals_getter_hook(void *self, void *_cmd) {
    __int64 result = balanceMeals_getter(self, _cmd);
    NSLog(@"[boost] balanceMeals_getter_hook: %lld", result);
    return result;
}


%ctor {
    void *balanceMeals = MSFindSymbol(NULL, "_$s14NovusSharedKit4L10nO7PaymentO12balanceMealsSSvgZ");
    NSLog(@"[boost] balanceMeals: %p", balanceMeals);
    if (!balanceMeals) {
        NSLog(@"[boost] balanceMeals not found");
        return;
    }

    MSHookFunction(balanceMeals, (void *)balanceMeals_getter_hook, (void **)&balanceMeals_getter);
}

it crashes :c

[indigo peak]

it crash with no mshook as well

[primal perch]

womp womp

[ashen birch]

bro the fuck is this https://developer.apple.com/ibeacon/

[radiant idol]

the screenshots in the manuals are from like

iOS 10 lol

[faint timber]

2014 is not iOS 10

[faint stag]

apple was using bluetooth low energy all the way back then
wild

[radiant idol]

ah mb didn’t look at the dates

wild