Swift.
#development
radiant idol
olive peak
i understand thanks
burnt perch
Hi guys, does someone know if theres a compiled version of NodeJs for ios ?
The procursus repo show the npm package who requieres nodejs, but node is not in the procursus repo
left lantern
if anyone knows if this is because of roothide pathing, let me know how to appropriately fix :3
burnt perch
Ive just found it, but its compiled for rootfull only… what do i need to do to compile it for rootless?
No no… i have a problem with my storage rn. I have a 128gb macbook pro… can someone compile rootless nodejs pls ????
topaz yew
if i theoretically replaced springboard with a CoreTrust version of springboard... what would cause it to hang and not launch?
topaz yew
i thought i had platformized everything by giving CS_PLATFORM_BINARY from the csops functions hooks? or is that not the same
topaz yew
yes
crash logs lead nowhere... and i can't remember what console.app output but i couldn't find anything useful
sonic totem
crash logs lead nowhere... and i can't remember what console.app output but i co...
Did you have crash logs though?
topaz yew
Did you have crash logs though?
Yes, i think i need to try a different way
sonic totem
What did they say?
olive peak
this isnt wrong right, i dont get any logs but it has a lot of xrefs in ida
willow lance
Actually replied this message
thank you! I’m trying now
umm… IOSurface kwrite doesn’t seems to work on ios16.
elder scaffold
This is basically why I only target arm64
Well, kread is not correct, even for arm64.
The existing 4-byte read primitive via IOSurface adds the value 4 bytes ahead and outputs it.
💀
willow lance
I think only kread doesn’t work on iOS16 arm64e, but it not right
Idk is it possible, but I’ll try to use infoleak bug to get krw with few offsets
olive peak
%init in your constructor
yes i do init
torn cloud
anyone know what the issue with kfd on 16.5.1 is and where it is? trying to make a commit but don't know where to start.
topaz yew
whyyyy
timid furnace
...
torn cloud
what
timid furnace
Were you seriously going to try to run exploit code in the simulator
torn cloud
yes
topaz yew
tf...
torn cloud
it won't work will it 
topaz yew
timid furnace
olive peak
does anyone know why this might be crashing directly at initializaation
hexed knot
Do you know anything about exploits or darwin or the vulnerability being exploited
torn cloud
not really, trying to start making projects so i get a grasp of things
right now i'm clueless and don't know where to start
torn cloud
And what do you know already
very very basic C
torn cloud
What kind of projects
i was looking at how kfd doesn't work on 16.5.1
but the problem is i don't have a physical device
and i don't know jack shit
what should i start with then
torn cloud
i'm capt
proper reef
unless you're capt
is that why zefram bootloops
radiant idol
yes
torn cloud
wtf does that mean
hexed knot
what should i start with then
Idk making tic tac toe maybe
radiant idol
wouldnt the *OS internals book be helpful for that
hexed knot
Kernel file descriptor
torn cloud
wouldnt the *OS internals book be helpful for that
is there a ebook lying around the web by any chance
torn cloud
i'll check
hexed knot
Or job
radiant idol
good luck lol
torn cloud
thanks
hexed knot
Its a popular book so its definitely online
timid furnace
If you only know extremely basic c you should probably learn about pointers and memory
torn cloud
k
timid furnace
First
hexed knot
Yeah make tic tac toe nd shit
torn cloud
If you only know extremely basic c you should probably learn about pointers and ...
ok i have a few books lying around
proper reef
If you only know extremely basic c you should probably learn about pointers and ...
wait is pointers not considered extremely basic c
timid furnace
No
torn cloud
ok, thanks for the help
hexed knot
Extremely basic c is for loops
radiant idol
variables, constants, for loops, while loops, functions and their signatures, etc
proper reef
Extremely basic c is for loops
ok but i constantly forget for loops but never forget pointers so is it?
hexed knot
Yes
timid furnace
How do I make a command line tool I only know how to make swiftui apps
hexed knot
If you forget for loops thats a big you problem
timid furnace
ok but i constantly forget for loops but never forget pointers so is it?
pointers are not simple for a significant amount of people
burnt perch
How can i compile nodejs from the procursus repo and make a rootless package ?
timid furnace
How do I click buttons
hexed knot
How can i compile nodejs from the procursus repo and make a rootless package ?
Im sure the readme tells you how
torn cloud
ios
proper reef
How do I click buttons
Swift UI is very button oriented isn't it?
burnt perch
Im sure the readme tells you how
The procursus general readme ?
hexed knot
Sure?
timid furnace
Swift UI is very button oriented isn't it?
Yea but that's on iOS it's different from clicking buttons on macOS y'know
torn cloud
i was talking about testing kfd, i needed a 16.5.1 device but i dont have one
proper reef
Yea but that's on iOS it's different from clicking buttons on macOS y'know
swiftui runs on macos too
torn cloud
anyway i'll just use the jailbroken device i have
timid furnace
hexed knot
Damn u should’ve let him find it
timid furnace
swiftui runs on macos too
But they look different so it must be different
timid furnace
Just assume you need like 5gb or something
burnt perch
Ok thanks
hexed knot
Procursus on macos is a blessing
timid furnace
You're basically gonna have to build all the dependencies as well
burnt perch
No way, there arent prebuild binaries ?
proper reef
anyways in other news i am even closer to getting xcode to work correctly
timid furnace
It's smaller now
hexed knot
2 more days until my bday yall
timid furnace
Only like 10gb if all you need is xcode + iOS
proper reef
me with my 100gb xcode install
burnt perch
Yes i have it
topaz yew
xcode 
native orbit
variables, constants, for loops, while loops, functions and their signatures, et...
no, str_patcher is an example of extermely simple c
proper reef
xcode <:frcoal:784338955759517696>
what wrong with xcode
hexed knot
Alot
radiant idol
no, str_patcher is an example of extermely simple c
no, str_patcher is an example of a lazy developer who wont fix the code
yes youre right
native orbit
~~no, str_patcher is an example of a lazy developer who wont fix the code~~
yes ...
deleting repo 
radiant idol
the 10k of 0x0 refs are whats wrong sir
native orbit
the 10k of 0x0 refs are whats wrong sir
where
radiant idol
uh
proper reef
ok do i seriously have to run my xcode over a network share
proper reef
ok do i seriously have to run my xcode over a network share
welp guess i literally do
cloud yacht
Install Xcode to a ram disk
proper reef
Install Xcode to a ram disk
how do i get the xcode onto that ram disk
cloud yacht
Assuming you have like 128gb of ram
cloud yacht
how do i get the xcode onto that ram disk
Download it
proper reef
i have an xcode installation already setup how i want it tho
burnt perch
I was talking about the dependencies. I would use the prebuilt one for node if there was one. There isn’t one rootless
burnt perch
But thanks for all, i think i can do it
proper reef
aaaaaand running it over the network share did a bus error LOL
radiant idol
<:literallyfrcoal:1140485992743186594>
ok that emoji legitimately made me laugh
good job
not chuckle
laugh
proper reef
welp guess i literally do
nvm just decided to rsync it over and wait 20 years
native orbit
@radiant idol patcher is fine, it's the finding strings that broken again
radiant idol
ah lovely
well yea i pushed the changes anyway if you wanna use that one to test with the actual deb instead of single dylibs
native orbit
bet
hasty ruin
the 10k of 0x0 refs are whats wrong sir
radiant idol
this is all Rune's fault smh
hasty ruin
proper reef
i am almost done being useless
native orbit
@radiant idol try push
radiant idol
alright
is there no way to pin github repos on your gh homepage smh
annoying to have to scroll to find it every time
hexed knot
Yes
native orbit
bookmarks bro
native orbit
how
native orbit
macos moment
native orbit
indigo peak
@radiant idol vcam has memory leaks 💀💀
indigo peak
took discords 250 mb of memory down to <90 and then it crashed 💀
radiant idol
lmfao
indigo peak
270mb -> 200mb in like 3 seconds
native orbit
oh nah 💀
indigo peak
idk how I rewrote the actual vcam portion in swift so I didn’t have to worry about memory management issues
hasty ruin
%hook swiftui
-(instancetype)init { return nil; }
%end
how to double your available memory
unpatched ios 15/16
proper reef
unpatched ios 15/16
wait is it patched ios 17?
hasty ruin
untested
proper reef
ah ok
radiant idol
@hasty ruin works fine
radiant idol
lol
hasty ruin
yes
radiant idol
ok now time to delete
hasty ruin
native orbit
eta rune code
hasty ruin
now fix patcher
indigo peak
I gotta figure out licensing for vcam 
hasty ruin
eta rune code
native orbit
bro needs the code 
hasty ruin
nexus
native orbit
orion
native orbit
might work now?
radiant idol
even they havent been able to figure it out
native orbit
yeah its cooked
radiant idol
since it was symlinked then de symlinked then symlinked again idek
native orbit
bro should just recompile
radiant idol
frfr
proper reef
////////Xapps/
native orbit
/var/jb////////Xapps/
proper reef
that's 8 slashes
radiant idol
😭
I think
it turned
/Applications -> /var/jb/XApps
but then failed to convert back
proper reef
what is 'it'
radiant idol
so it turned into //////XApps
radiant idol
what is 'it'
cant say here
proper reef
oh its the xina dopamine thing ok i see
radiant idol
yes yes
hasty ruin
pearl sail
@grave sparrow Tell your mother to clean up better please
cloud yacht
I gotta figure out licensing for vcam <:supershocked:1130249630127501432>
Unlicense
brazen timber
I gotta figure out licensing for vcam <:supershocked:1130249630127501432>
Proprietary
topaz yew
Pro tip: look at it on a computer
brazen timber
wow
topaz yew
radiant idol
thats better
proper reef
so what'd you do to trigger it
topaz yew
so what'd you do to trigger it
nightwindi right
radiant idol
wat
topaz yew
i couldnt tell who he was talking to
proper reef
nightwindi right
did nightwind cause the springboard crash?
native orbit
no
topaz yew
yes
cloud yacht
did I tell you all about the website I built so I could transfer crash logs from my iPhone 4 to my pc?
hasty ruin
filza webdav:
cloud yacht
but then I have to browse the filesystem
radiant idol
did I tell you all about the website I built so I could transfer crash logs from...
lmao what
send a screenshot or something
I have to see this
young meteor
so you're saying to upload a 100GB file 
cloud yacht
it will get OOMed
actually over the www it probably will get timed out
also I think my reverse proxy would block a file that large
you know what go nuts
olive peak
i dont understand the crash log
harsh junco
you know what go nuts
On my way to upload piracy
olive peak
say where
Exception Codes: 0x0000000000000001, 0x0000000040000000
VM Region Info: 0x40000000 is not in any region. Bytes before following region: 3303636992
REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL
UNUSED SPACE AT START
--->
__TEXT 104e98000-104ea0000 [ 32K] r-x/r-x SM=COW ...p/binary
Termination Reason: SIGNAL 11 Segmentation fault: 11
Terminating Process: exc handler [37814]
this?
is there any sensible data
the issue is a sex fault
hexed knot
Fix ur stroke game then
granite frigate
just send the whole thing
native orbit
oh so that's how you hook variadic functions
you should see how you have to do arb calls to variadic functions 
olive peak
why not is it bad
does that call the function twice
i thought its just the original value
native orbit
do you have an example
not on hand, but i do on my laptop somewhere
olive peak
oh so like other hooks
radiant idol
alr lol
olive peak
i cant really do anything against this can i
native orbit
what you even trying todo
olive peak
hook that function
indigo peak
method* 
olive peak
method* <:tr:811294817350582384>
in my head its still the same thing dont even try to change that
native orbit
method* <:tr:811294817350582384>
radiant idol
OOP sounds
olive peak
method needs instance and function not or something like that
olive peak
but like what is the goal/purpose
see which files it checks for existing
harsh junco
OOP sounds
OOPfr when
indigo peak
@olive peak
https://developer.apple.com/documentation/foundation/nsstring/1497275-stringwithformat#discussion
check that method
radiant idol
Logos should support variadic method hooking:
https://github.com/theos/logos/pull/52
harsh junco
Logos *should* support variadic method hooking:
https://github.com/theos/logos/p...
OOP
native orbit
see which files it checks for existing
hook something that is for checking files then
olive peak
thats great since it has 5000 xrefs
olive peak
hook something that is for checking files then
my mind wasnt braining sorry
radiant idol
Logos *should* support variadic method hooking:
https://github.com/theos/logos/p...
looks like you have to handle %orig by youself though
indigo peak
%hook NSString
- (instancetype)initWithFormat:(NSString *)format locale:(id)locale arguments:(va_list)argList {
NSLog(@"format: %@", format);
NSLog(@"arguments: %@", arguments);
return %orig;
}
%end
idfk
native orbit
you gotta loop through it
indigo peak
isnt instancetype an nsstring
yes
The following Objective-C code fragment illustrates how to create a string from myArgs, which is derived from a string object with the value “Cost:” and an int with the value 32:
va_list myArgs;
NSString *myString = [[NSString alloc] initWithFormat:@"%@: %d\n"
locale:[NSLocale currentLocale]
arguments:myArgs];
The resulting string has the value “Cost: 32\n”.
olive peak
why do you always put [MyTweak]
indigo peak
so that you can filter in console.app
hexed knot
you have to grep something
radiant idol
but you can already
tell that to low level devs who like putting [*] before every line for some reason
cloud yacht
The following Objective-C code fragment illustrates how to create a string from ...
ChatGPT?
native orbit
stdeez
hexed knot
STDIN
sonic totem
tell that to low level devs who like putting `[*]` before every line for some re...
Nah this is an elite logging method
radiant idol
Sure sure
native orbit
[*] [-] [i] [+] the four horsemen of logs
native orbit
nah you just do a rage printf
radiant idol
Lmfaooo
harsh junco
[ ]
round gyro
[ ]
kind herald
hasty ruin
`[*]` `[-]` `[i]` `[+]` the four horsemen of logs
[!]
native orbit
[]
harsh junco
@radiant idol explain
radiant idol
.
cloud yacht
[webshade-core]
magic hazel
hey, i made a modded ios 6 ipsw (decrypted the rootfs), tried to restore via itunes and pwndfu and it said it was incompatibile?
tepid olive
All of a sudden im starting not to trust Nightwind
magic hazel
when trying to use redsn0w it says "unable to parse"?
radiant idol
All of a sudden im starting not to trust Nightwind
good
you shouldnt
im at your back door btw
open it so i can come in
tepid olive
im blowing up my house
magic hazel
west bloom
would anyone now how to fix this error?
topaz yew
i would also love to know 
frank fossil
would anyone now how to fix this error?
Hook csops or os_variant_has_internal_content, with the latter you will get this funny text
topaz yew
Hook `csops` or `os_variant_has_internal_content`, with the latter you will get ...
what do i use to hook? ellekit?
ive tried fishhook which seems to do nothing, ellekit seems to just not want to find the symbol for some reason?
frank fossil
what do i use to hook? ellekit?
Yes, you need to make sure your tweak is loaded before SpringBoard. To do so:
int (*SBSystemAppMain)(int argc, char *argv[], char *envp[], char* apple[]);
int main(int argc, char *argv[], char *envp[], char* apple[]) {
dlopen("/var/jb/Library/MobileSubstrate/DynamicLibraries/Tweak.dylib", RTLD_GLOBAL | RTLD_NOW);
void *handle = dlopen("/System/Library/PrivateFrameworks/SpringBoard.framework/SpringBoard", RTLD_GLOBAL);
SBSystemAppMain = dlsym(handle, "SBSystemAppMain");
return SBSystemAppMain(argc, argv, envp, apple);
}
Tweak being the hook for these...
frank fossil
You can’t use fishhook as functions are in dyld shared cache
In your tweak constructor, you need to enable JIT (it’s ok to use fork in dylib)
bool os_variant_has_internal_content(const char* subsystem);
%hookf(bool, os_variant_has_internal_content, const char* subsystem) {
return true;
}
#define CS_DEBUGGED 0x10000000
int csops(pid_t pid, unsigned int ops, void *useraddr, size_t usersize);
int fork();
int ptrace(int, int, int, int);
int isJITEnabled() {
int flags;
csops(getpid(), 0, &flags, sizeof(flags));
return (flags & CS_DEBUGGED) != 0;
}
%ctor {
if (!isJITEnabled()) {
// Enable JIT
int pid = fork();
if (pid == 0) {
ptrace(0, 0, 0, 0);
exit(0);
} else if (pid > 0) {
while (wait(NULL) > 0) {
usleep(1000);
}
}
}
}
Once you get SpringBoard working, I’ll give you code to enable stage manager for real
topaz yew
LFG
topaz yew
dumb question but how do i get theos to use ellekit instead of mobilesubstrate?
its been a bit since i last used theos...
nevermind i see...
native dune
`[*]` `[-]` `[i]` `[+]` the four horsemen of logs
i use [!] sometimes i think
topaz yew
is ellekits "MobileSubstrate" linked to libinjector or libellekit?
ashen birch
[ERROR] [WARN] [INFO] go brazy
torn oriole
Y’all nerds need this
https://www.answeroverflow.com/about
Hell nah
Discord integration
topaz yew
failure in sharedInstance of <FBServiceFacilityServer:0x21aa952f8> (FBServiceFacilityServer.m:88) : must have a valid domain for com.apple.frontboard.system-service : bootstrapConfiguration = <BSServicesConfiguration: 0x2832720c0> {
Domains = (empty);
}``` hmmmi might kno why...
unique wedge
<@712923899142078464> you ever get anything like this?
whats sbshim?
topaz yew
whats sbshim?
springboard shim
unique wedge
Yes, you need to make sure your tweak is loaded before SpringBoard. To do so:
``...
this one?
shrewd smelt
Y’all nerds need this
https://www.answeroverflow.com/about
Our main bot barely works my brother in christ
torn oriole
Our main bot barely works my brother in christ
They need to split moderation into a separately hosted bot fr
unique wedge
not exactly, but sort of
just dlopen, no exec*(), right?
topaz yew
just dlopen, no exec*(), right?
yes
unique wedge
yes
/System/Library/CoreServices/SpringBoard.app/SpringBoard is platformized executable binary,
obviously the sb process we run (either sbshim or re-signed SpringBoard) is not platformized,
this breaks many assumptions in iOS code
possible solution is:
1: unsandbox
2: add some entitlements required if the any operation fails
3: hook some check functions, such as os_variant_has_internal_content etc..
topaz yew
possible solution is:
1: unsandbox
2: add some entitlements required if the any ...
i did hook os_variant_has_internal, ill try unsandbox
unique wedge
possible solution is:
1: unsandbox
2: add some entitlements required if the any ...
2 is more critical
unique wedge
my shim and springboard have the same entitlements
the same entitlements are obviously not enough
topaz yew
true
topaz yew
btw whats your ios version?
16.4.1
topaz yew
sort of
timid furnace
nice
torn oriole
Fire
frank fossil
my shim and springboard have the same entitlements
You need unsandbox, get-task-allow for JIT and platform-application
hexed knot
import std;
int main() {
std::println("helloooo");
return 0;
}
c plus plus version 23
radiant idol
```c++
import std;
int main() {
std::println("helloooo");
return 0;
}
```
this is starting to resemble swift
they better not be doing weird things with syntax
native orbit
they better not be doing weird things with syntax
literally c++'s main thing
native orbit
inb4 they remove ;
radiant idol
like?
native orbit
func decl
native orbit
anything they do with C is fucking awful
radiant idol
fair enough lmao
timid furnace
@granite frigate did you ever figure out how to screw with cr_label through kfd?
trying to do so myself now
ashen birch
can someone tl;dr the differences between a normal rootless jb and the trollstore roothide bootstrap thingy
timid furnace
if i recall correctly, can't inject into platform binaries rn
also i don't think c hooks work
frank fossil
ashen birch
if i recall correctly, can't inject into platform binaries rn
(dumb question) is springboard not platformized? or what am i seeing abt tweaks working there
ashen birch
i c
gentle grove
brazen timber
C++ syntax is hell
if c++ syntax is hell rust syntax is hades himself bro
radiant idol
lol
native orbit
haskell syntax 
native orbit
catch22
frank fossil
you forgot CoreTrust 2 exists
native orbit
how u gonna platform
frank fossil
Bypass launch constraint by hooking launchd
frank fossil
the namecache hack way?
^
You don’t need CS_PLATFORM_BINARY set in kernel, just bypass launch constraint
west bloom
@topaz yew was you able to fix respring loop when screen turns on?
topaz yew
<@990491019407659019> was you able to fix respring loop when screen turns on?
that was a one off
frank fossil
forgot Pojav been using such method for a year?
topaz yew
i cant get it working
frank fossil
i cant get it working
You should check console for possible amfi error
or springboard itself
topaz yew
<@712923899142078464> you ever get anything like this?
only thing i get
frank fossil
Are you sure it has enough entitlements?
W^X is enough for tweak injection
there’s no need both W and X at the same time
topaz yew
what did you add? i added <key>com.apple.private.security.no-sandbox</key>
frank fossil
iOS 17.2.1?
topaz yew
and everything else it normally has
frank fossil
why not beta2?
frank fossil
what did you add? i added <key>com.apple.private.security.no-sandbox</key>
Add platform-application and get-task-allow
frank fossil
wait it seems you didn’t put your shim into SpringBoard.app copy
since it doesn’t have Info.plist it can’t read stuff
frank fossil
lldb is allowed to do this because it has restricted entitlements
sounds reasonable
still, nobody is targeting stock iOS because the CoreTrust exploit isn’t even there
granite frigate
<@413331641109446656> did you ever figure out how to screw with cr_label through...
no
frank fossil
In your tweak constructor, you need to enable JIT (it’s ok to use fork in dylib)...
Like I never said this could work on latest iOS
aka “stock”
topaz yew
@frank fossil thanks! it works like a charm
timid furnace
no
I'm getting a panic which I think is because I'm modifying proc_ro
i am not sure what to do about that
my theories require a kcall primitive
idk where I'm getting that from
dora has been providing some valuable advice though
i will see what they say
timid furnace
arm64
timid furnace
idk where I'm getting that from
i can rip it from kfd-on-crack maybe
granite frigate
kfd on crack has kcall yeah
timid furnace
are you on arm64 or e
e is probably worse as you need a PPL bypass. i think i might just give up on that and use vnode shenanigans instead
my objective is just installing trollstore so
radiant idol
<@712923899142078464> thanks! it works like a charm
So SB is no longer crashing?
granite frigate
e is probably worse as you need a PPL bypass. i think i might just give up on th...
the thing for swapping launchd can probably be used to swap anything
granite frigate
So SB is no longer crashing?
yes she loaded in a custom SB
timid furnace
the thing for swapping launchd can probably be used to swap anything
wdym
the new one or the old one
topaz yew
So SB is no longer crashing?
i even got the little message
topaz yew
the thing for swapping launchd can probably be used to swap anything
hey shhhh
granite frigate
oh
timid furnace
new = works on 16.2+
granite frigate
idk
timid furnace
(i might be off by a version)
native orbit
its 16.2 it changed
timid furnace
ok yea
maybe then
i am not sure
kinda feel like if it worked people would have done it way earlier
granite frigate
yeah i think so too
timid furnace
but arm64e is for later ig
this raises the question though
what do existing jailbreaks do
native orbit
dopamine src bro
frank fossil
i even got the little message
Stage manager Tweak.x
The main thing here is to trick SpringBoard into thinking it’s running on iPad, other hooks are from tweaks enabling Medusa for resize to work
- Side effect: causes status bar style changed to iPad
- To allow stage manager: Add a Number key
qeaj75wk3HF4DwQ8qbIi7gwith value 1 to mobilegestalt - To toggle: make a shortcut
timid furnace
what about unspellable tool
radiant idol
eta wen Bolders Reborn
timid furnace
what about unspellable tool
uses kcall
radiant idol
sander why
native orbit
test orion rootless patch edition
topaz yew
lmfaoooo
radiant idol
And as a final test you could test Jade
topaz yew
i dont have that
west bloom
And as a final test you could test Jade
I Wil test it
radiant idol
i dont have that
I’ll give you a copy
topaz yew
I’ll give you a copy
well lets get bolders working first
topaz yew
Ima go sleep though
night
wicked summit
gm
topaz yew
awww hell nah springboard is tweakin
lean ermine
begging for someone to bring this to end users
lean ermine
<:troll:794397046706667530> awww hell nah springboard is tweakin
when you respring after replacing launchd does it ever end up respringing back to the normal springboard?
torn oriole
d33z
lean ermine
oh wow what's that 😄
granite frigate
begging for someone to bring this to end users
evelyne is going to innit
lean ermine
evelyne is going to innit
but for some reason she is waiting for 17.0
which i mean she has a right to do
but still lol
just want to delete beta popup :-p
cloud yacht
<:troll:794397046706667530> awww hell nah springboard is tweakin
Add Eliza to it
topaz yew
Add Eliza to it
idk what that is
cloud yacht
A tweak of mine
cloud yacht
Rootless or roomful?
topaz yew
rootless
frank fossil
<:troll:794397046706667530> awww hell nah springboard is tweakin
wen eta
topaz yew
LOL
torn oriole
wen eta <:trol:831188670848565289>
Avg jailbreak setup
cloud yacht
do you have the dylib
topaz yew
whats it supposed to do
faint lionBOT
Powered by Canister
topaz yew
yah
cloud yacht
on iPhones I think it is wihtout LPM on
crisp frost
@topaz yew are you replacing launchd with the chroot method to make a systemhook-type situation, which you then use for tweaks? I haven't really been in the scene of TS2 springboard tweaks lol
cloud yacht
I'm not sure if it would work on the new battery with percentage
topaz yew
<@990491019407659019> are you replacing launchd with the chroot method to make a...
no, but there is systemwide hook
just doing stuff when springboard is spawned though
cloud yacht
honestly its pretty neat we can get springboard hooking working
crisp frost
just doing stuff when springboard is spawned though
so your systemwide hook checks for com.apple.springboard and then dlopen's a tweak dylib?
sonic totem
so your systemwide hook checks for com.apple.springboard and then dlopen's a twe...
I think it hooks posix_spawn(p)
crisp frost
I think it hooks posix_spawn(p)
ohh right
topaz yew
yes
crisp frost
DYLD_INSERT_LIBRARIES
topaz yew
DYLD_INSERT_LIBRARIES
nope
topaz yew
that doesnt work here i dont think
granite frigate
but just add in load command
crisp frost
that doesnt work here i dont think
is there any public implementation of the "new" method? Or should I build one myself
want to expirement with it
sonic totem
Nothing public yet
topaz yew
is there any public implementation of the "new" method? Or should I build one my...
just change path in posix_spawnp
or do you mean the actual launchd stuff
crisp frost
the launchd stuff
topaz yew
eh i wanna finish that before i make it public, but you coud ask ev maybe
its namecache
though
cloud yacht
honestly if I could get springboard hooking working, I could probably have most of the tweaks I ususally use working
sonic totem
It will later on
crisp frost
eh i wanna finish that before i make it public, but you coud ask ev maybe
I'll just try to make one myself then ig
evelyne will never give it 😅
cloud yacht
There might've been changes with the battery with the new percentage display
frank fossil
i cant get to load springboard
how far did you reach
granite frigate
how far did you reach
sigabrt - sbinitializer
assuming it's the platform check
i already added in load command for dylib
topaz yew
i dont think Duy did load command
topaz yew
tru
frank fossil
I did load command of tweak only (haven’t tried dlopen), springboard is dlopened
cloud yacht
Wait since this is using the trollstore bug, does it work "untethered" or do you still need to kickstart it
granite frigate
i'm not sure why the tweak isn't working
frank fossil
Again, to reminder: be sure to load your tweak, not Ellekit
granite frigate
Wait since this is using the trollstore bug, does it work "untethered" or do you...
needs krw
granite frigate
Again, to reminder: be sure to load your tweak, not Ellekit
the tweak loads in ellekit though
frank fossil
the tweak loads in ellekit though
It won’t if safe mode is on (/var/mobile/.eksafemode)
granite frigate
how do i load a tweak without ellekit???
frank fossil
You load the tweak, it chain loads ellekit
granite frigate
i mean Yeah i don't dlopen or include ellekit in load command
i don't even get the hook to print or do anything
for all I know it doesn't even work
and idk why
frank fossil
Or you should add both to be safe
olive peak
so i hooked an objc function from the app i load my tweak in but i dont get any logs even tho the function gets called 100%
lime pivot
so i hooked an objc function from the app i load my tweak in but i dont get any ...
judging by that function signature it's probably a Swift class, meaning that's an ObjC bridge class. it'll only be used if called from ObjC, not directly from Swift
olive peak
judging by that function signature it's probably a Swift class, meaning that's a...
i dumped it using ktool
lime pivot
right, but that doesn't mean it's actually used
olive peak
i looked at the function in ida
i hooked the fileexistsatpath
and it got called with the strings inside the function
lime pivot
if called from Swift, it's not going to call it through ObjC, meaning your hook never gets called, because you're hooking ObjC not Swift
and there's no straightforward way to hook Swift directly unfortunately
spare stone
Hey I have a question, what's the difference between FrontBoard, BackBoard, and SpringBoard?
radiant idol
so i hooked an objc function from the app i load my tweak in but i dont get any ...
What app is this
slender glade
is there a way to disable the cover sheet slide thing
like
the ability to slide to go back to the LS
proper reef
is it true that iOS 17.3b2 added zefram
slender glade
I actually have no idea
capt jb i think but it became a joke
cursive rampart
What is Zefram
malware
vale oxide
can someone take a look at this? https://we.tl/t-rqaFHl8nyS
i cant figure out what type of hashes these are
its a xml file with no extension
oh their sha hashes nvm
hasty ruin
What is Zefram
Zefram is malicious software, commonly referred to as malware, that is specifically designed to hack Apple devices such as iPhones and Macs. This malware has the capability to compromise the security and privacy of Apple users by infiltrating their devices and extracting sensitive information. The purpose of Zefram is to gather sensitive information such as login credentials, financial information, and personal data, which can then be used for malicious purposes such as identity theft and financial fraud. Zefram uses various techniques to spread and infect Apple devices, such as phishing scams and software vulnerabilities. It is highly sophisticated and can evade traditional security measures, making it difficult for Apple users to protect themselves against this threat. To stay protected, Apple users should regularly update their devices and be cautious of suspicious links and emails. Additionally, it is recommended to use robust security software to detect and prevent attacks from Zefram and other similar threats.
native orbit
i thought it was an ios 14 jb
sonic totem
can someone take a look at this? https://we.tl/t-rqaFHl8nyS
i cant figure out wh...
Base64 encoded, either a SHA1 hash or a truncated SHA256 hash
Most likely the latter though
sonic totem
Zefram is malicious software, commonly referred to as malware, that is specifica...
Interesting
spare stone
i see, thank u 🙏
native orbit
when you looking at symbols in a macho and see some starting with _$s 
primal perch
it's real though innit
its real but its more of a tweak injection platform than a jb
granite frigate
i mean you can have a jailbreakd with krw that ct signs everything
you can also just bypass the platformisation requirement
primal perch
me and the homies disabling SIP,SSV and doing amfi_get_out_of_my_way=1 on mac, jb solved
@hasty ruin
granite frigate
real
native orbit
we dont fuck with amfid here fr
hasty ruin
primal perch
i dont disable any of those because i dont need to fr on mac you can already launch whatever you want with JIT too
sonic totem
its real but its more of a tweak injection platform than a jb
Arguably its very close to a jailbreak
System-wide injection, custom launch daemons, jailbreakd
slender glade
if i want to add a hook to the status bar everywhere, do i put com.apple.UIKIt in the tweak plist?
primal perch
you could argue that yeah
in my opinion a jailbreak is more about getting to the state where you can run all of those where previously you never could (getting root/kernel access, breaking sandbox etc) but to most people in this community theyre the same thing
slender glade
if i want to add a hook to the status bar *everywhere*, do i put com.apple.UIKIt...
okay nvm i'm not supposed to
granite frigate
krw can be done with handoff to jbd, sandbox is dead with entitlements
primal perch
facts
native orbit
ios could never
sonic totem
in my opinion a jailbreak is more about getting to the state where you can run a...
I mean, you can still get root/kernel access as well as unsandboxing
So it's not all that different
Just no PPLRW
primal perch
I mean, you can still get root/kernel access as well as unsandboxing
root/kernel on what
modern ios jailbreaks?
granite frigate
on the krw/ct thing
topaz yew
me and the homies disabling SIP,SSV and doing `amfi_get_out_of_my_way=1` on mac,...
so real
sand shell
how to get offsets for iphone x ?
topaz yew
how to get offsets for iphone x ?
primal perch
i mean yeah i wasnt disagreeing. that bypasses previously present restrictions so i would consider it a jb
sand shell
<:trol:831188670848565289>
hm
sonic totem
root/kernel on what
This new Evelyne thing
native orbit
cross ref a kcache you already have offsets for too, makes it easier
elder scaffold
hi
native orbit
hello
sand shell
cross ref a kcache you already have offsets for too, makes it easier
ima try
slender glade
anyone know what BulletinBoard is for?
I thought that was UN
so is UN the frontend framework
primal perch
UN is the backend
slender glade
oh
slender glade
you can also try counting your offsets
lool
primal perch
(i have no idea i havent done ios shit in a long time)
topaz yew
i did that for a while
primal perch
based on naming though bulletinboard sounds like itd be the shit that draws it
lets allow the asian to enlighten us
inshallah capt
slender glade
@grave sparrow so if i wanna hook the function whenever a notif is shown to the user, i'm looking for somewhere in BulletinBoard right? BBServer I presume
native orbit
<@434097922762735618> so if i wanna hook the function whenever a notif is shown ...
hook publishBulletin iirc
slender glade
hook `publishBulletin` iirc
my goat my hero my gyatt staturnz
vale oxide
Base64 encoded, either a SHA1 hash _or_ a truncated SHA256 hash
can i use these to modify the files in an app cause its a react app
native orbit
might not exist anymore idk it been a while lol
sonic totem
can i use these to modify the files in an app cause its a react app
Yes but you’ll need to codesign again
slender glade
might not exist anymore idk it been a while lol
whatt apple would never change their priv apis and break code
native orbit
every ios update says otherwise
vale oxide
Yes but you’ll need to codesign again
this is an already built app so would that change things
sonic totem
this is an already built app so would that change things
You can codesign a built app
slender glade
dude one day they're gonna remove -[UIImage applicationIconImageForBundleIdentifier: format:scale:] and every single tweak and somehow facebook is gonna break it's gonna be funny as hell
vale oxide
You can codesign a built app
and how would i go about that and would i need a mac
primal perch
ok so yea i was completely wrong
slender glade
bet
primal perch
dude one day they're gonna remove `-[UIImage applicationIconImageForBundleIdenti...
fr
thats le joke
slender glade
does he know
it's trying to find Cephei in a non rootless path for my pref bundle
what da hell do i do
preferenceloader
am i not supposed to use PreferenceLoader from pro
no cause cephei is obv not at /System/Library/Frameworks
so it's failing
why would my bundle dictate where cephei is
oh
TARGET := iphone:clang:latest:14.0
SYSROOT=$(THEOS)/sdks/iPhoneOS16.5.sdk
include $(THEOS)/makefiles/common.mk
BUNDLE_NAME = Preferences
Preferences_EXTRA_FRAMEWORKS = Cephei CepheiPrefs
Preferences_FILES = UENRootListController.m
Preferences_FRAMEWORKS = UIKit
Preferences_PRIVATE_FRAMEWORKS = Preferences
Preferences_INSTALL_PATH = /Library/PreferenceBundles
Preferences_CFLAGS = -fobjc-arc
include $(THEOS_MAKE_PATH)/bundle.mk
oh
I added
THEOS_PACKAGE_SCHEME = rootless
and now it works
:3
slender glade
code written by #development member
granite frigate
like cocoatop shows that my dylibs are injecting into springboard but none of the tweaks work
i don’t have any clue what’s going on
i’ve codesigned everything with ctbypass
only springboardhook works, because I inserted a load command for it
sonic totem
and how would i go about that and would i need a mac
There’s various tools (codesign, ldid, zsign) so take a look
vale oxide
There’s various tools (codesign, ldid, zsign) so take a look
and if i didn’t code sign would it just straight up not work
primal perch
chad
native orbit
granite frigate
one has money
visual meadow
Anyone know how i would decrypt a dylib from another app?
Kinda want to make like a patcher of some sorts to inject tweak into app store app
For trollstore
slender glade
fr
@lime pivot deadass how do u have motivation to still do jb stuff after like 13 years
faint stag
Anyone know how i would decrypt a dylib from another app?
dylib? frameworks are encrypted too?
slender glade
how the helldo u set the amountOfLines for a PSTableCell
turbid fjord
code written by <#688124600269144162> member
Did you see my watchtube memory usage? Lol
Started with this
Forced it to this
slender glade
man what the FUCK
turbid fjord
It was only loading 30 images
Well the images were the cause it was loading other stuff
slender glade
It was only loading 30 images
that UIImage(data:) blowjob GOES CRAZYYY
turbid fjord
I did manage to reduce it to this by sticking in a few lazy V stacks
But that isn’t a solution I want
slender glade
I did manage to reduce it to this by sticking in a few lazy V stacks
my god
sonic totem
and if i didn’t code sign would it just straight up not work
Correct
sonic totem
Kinda want to make like a patcher of some sorts to inject tweak into app store a...
Why not just inject without decrypting?
turbid fjord
Kirb pointed out I probably need to downsample my images but SDWebImage doesn’t seem to have a SwiftUI friendly way of doing it lol
visual meadow
Why not just inject without decrypting?
Wont that not work?
vale oxide
Correct
found this https://newosxbook.com/tools/jtool.html
sonic totem
Thanks to my latest ChOma commit
vale oxide
o tool ported to linux
turbid fjord
my god
Yeah idk what’s up with it. Instruments didn’t find any memory leaks or anything of use so I’m fairly sure it’s just an issue with me loading the images lol
visual meadow
You can use arbitrary Team IDs
No i mean i decrypt dylib and resign with teamid
I thought tou had to decrypt dylib
sonic totem
No i mean i decrypt dylib and resign with teamid
You can inject into App Store apps with just opainject now
visual meadow
I dont want to have to manually use opainject tho
sonic totem
Decryption isn’t your problem here then
You could just integrate opainject directly into your app?
primal perch
mashallah
slender glade
I wanna make my own notif logger so bad but it's already been done ARGHHHH
im still doing that shit anyways
visual meadow
@sonic totem damn it does work
i just resigned dylib and added rpath into it
without decrypting
time to make a patcher
hasty ruin
nathan widevine crack real
sonic totem
<@512299379479281666> damn it does work
Yep
The whole time I thought it wasn’t possible because I thought that it solved an error I was having
hasty ruin
sonic totem
When I was originally testing the CoreTrust bug
sonic totem
But thankfully we don’t need to use iCraze’s team ID anymore
sonic totem
but it was another bug
Still have no idea what that bug was lol
timid furnace
No more gta car tracker malware
sonic totem
But it just disappeared
hasty ruin
sonic totem
No more gta car tracker malware
Wait until you see iPlistGen
hasty ruin
No more gta car tracker malware
14.0-15.7 users
hasty ruin
Wait until you see iPlistGen
not mine lol
sonic totem
Huh
proper reef
LOL simject is trying to find ldid with xcrun?
faint stag
LOL simject is trying to find ldid with xcrun?
well yeah xcrun is exactly what should be looking for it
especially because it can be filtered to a given toolchain or sdk
but as capt said, it searches $PATH and standard directories for binaries as well
proper reef
well yeah xcrun is exactly what should be looking for it
especially because it c...
yeah i realized i had to reopen a shell
seriously it can't run in a vm?
(vma2 VMs cannot login to apple id)
slender glade
@grim sparrow the year is 20XX. Print is now an intermediary XPC function. Every UIView is a _UIRemoteView. UIView cannot be hidden anymore, the setHidden function has been deprecated and you must instead use a private function.
proper reef
(vma2 VMs cannot login to apple id)
hopefully exporting an iOS developer certificate will work?
olive peak
the weird thing is, when i hook fileexistsatpath i get the different strings but hooking the function itself i dont get any logs
- is function rihgt
topaz yew
+ is function rihgt
- are class method
-are instance methods
faint stag
some of these apps are ancient
yeah but every jb detection on the planet keeps using them in their file lists
unreal
faint stag
why are we still searching for filter plists from specific tweaks when you can check for the folder? beats me
except they did
hasty ruin
just started taking a look at smth in ida whilst loading into a game
anti cheat kicked me
RE discrimination fr
topaz yew
LOL
faint stag
debugger detection!
same reason why some apps just terminate if you try to process them with frida
hasty ruin
same reason why some apps just terminate if you try to process them with frida
but i didnt do anything to the game itself
proper reef
oh no i got detected for having blackra1n nooooooo
native orbit
ive seen a macOS app exit if you had a terminal open
proper reef
ive seen a macOS app exit if you had a terminal open
which macOS app is this
torn cloud
except they did
isn’t blackra1n for iphoneOS 2 or something 💀
faint stag
like i said, they keep adding to the list
instead of considering how old things are
torn cloud
lmao
faint stag
but i didnt do anything to the game itself
they will go as far as checking dyld for libs so i don't put it past them for just looking at processes 💀
but hey, you should know that
you randomize hestia's dylib name
hasty ruin
which macOS app is this
that one sep utility app does it lmao
native orbit
yeah that one does to lol
proper reef
that one sep utility app does it lmao
well yeah its made by someone who is apparently notorious for scamming
brazen timber
ive seen a macOS app exit if you had a terminal open
a bunch of video games will close if you have ida pro or x64dbg open
lol
cod will ban u for it
granite frigate
which macOS app is this
the sep tool for blackbird downgrade also does it
oh
sorry
torn cloud
the sep tool for blackbird downgrade also does it
barely even works rn
only supported for A9 and A8 I think
A10 will get support s0n
native orbit
cod will ban u for it
some games ban you for just having something like HxD installed
brazen timber
some games ban you for just having something like HxD installed <:fr:71250665152...
deserved
if you use hxd i'd ban you too
non 010editor / imhex user
olive peak
the checks are wild
procss scanning is stupid
indigo peak
some games ban you for just having something like HxD installed <:fr:71250665152...
Fortnite won’t let you play if you have IDA running
proper reef
yay i finally got simject to insert bootloop_simulator.dylib
young meteor
bootloop_simulator? so nexus?