im overwriting system colors so that needs a respring anyway no? i dont think that can be respringless because all of the elements which have already rendered wont rerender when the color changes
#development
placid kraken
slender glade
You listen for a notification with a string, and you set string in the postNotification value of the specifier
slender glade
im overwriting system colors so that needs a respring anyway no? i dont think th...
Oh yeah you’re right lol
This is like ig more general thing for the notif
slender glade
Good luck on ur project
placid kraken
tyy !!
faint stag
im overwriting system colors so that needs a respring anyway no? i dont think th...
no that doesn't need a respring
you're just hooking uikit
placid kraken
ah
if i change like, for example, systemBlueColor, how would i tell uikit to rerender the elements that use systemBlueColor then?
hexed knot
faint stag
if i change like, for example, systemBlueColor, how would i tell uikit to rerend...
they will use it when they load
is what i mean
placid kraken
yea ofc but that means that you would need to reopen your apps etc for the colors to apply properly no?
slender glade
10 sales within the first hour! Thank you #CreamerNation
faint stag
yea ofc but that means that you would need to reopen your apps etc for the color...
yeah, you'd have to
placid kraken
i think a respring is better because it would reapply all the colors regardless
but im not sure
ux is always better when you dont need to respring
slender glade
Yeah a respring is the ideal solution here
hexed knot
Just respring
faint stag
respring is better since it would kill stuff
hooking uikit and trying to set the colors from prefs would be bad
very bad
placid kraken
respring is better since it would kill stuff
hooking uikit and trying to set the...
i mean thats kinda what im doing
faint stag
no
i mean an apply button that sets the color for existing elements
rather than doing so when elements load
placid kraken
ah i see
hexed knot
You should do pkill -f *
placid kraken
in my code i essentially wanted to make it where prefs are loaded dynamically and then all the "systemXyzColor"s are swizzled and return the color from prefs instead of the original color, where the original color is the default
theres definitely a better way though
placid kraken
lol yea i think theres around 40
im not manually writing out every swizzle and every pref and every default
faint stag
use an array?
placid kraken
you would still need to write them out in the array lmao
faint stag
no
tawdry storm
10 sales within the first hour! Thank you #CreamerNation
#creamer
faint stag
you would still need to write them out in the array lmao
there's a set amount of colors so you'd have an array with the names and then you'd do system+ x + color or whatever
lol
slender glade
System colors iirc are defined in an asset catalof file
native dune
10 sales within the first hour! Thank you #CreamerNation
creaming
placid kraken
System colors iirc are defined in an asset catalof file
they are but i dont want to read carfiles
placid kraken
either way for now im doing it the way fiore showed me yesterday
unsigned methodCount = 0;
Class uiColorClass = object_getClass(NSClassFromString(@"UIColor"));
Method *methods = class_copyMethodList(uiColorClass, &methodCount);
for (unsigned int i = 0; i < methodCount; i++) {
Method method = methods[i];
SEL selector = method_getName(method);
NSString *name = NSStringFromSelector(selector);
if ([name hasPrefix:@"system"] && [name hasSuffix:@"Color"]) {
__block UIColor *(*originalColorWithCGColor)(id self, SEL _cmd);
MSHookMessageEx(
uiColorClass,
selector,
imp_implementationWithBlock(^(id self) {
return colorFromHexString([preferences stringForKey:name]);
}),
(IMP *)&originalColorWithCGColor
);
}
}
free(methods);
thattt is bad
placid kraken
lol yea
placid kraken
theres definitely a better way though
thats what i mean by this
slender glade
Oh keep ur current meth then
misty cradle
?? What did I do
misty cradle
He always be living
slender glade
?? What did I do
Kitten drama
slender glade
Kitten
misty cradle
Oh LITTEN
shrewd smelt
litten joined yelled at serena for making a better hersion of ve
misty cradle
LOOOOOL
shrewd smelt
then deleted her messages and left
misty cradle
I didn’t start that drama on accident ??
It was on purpose tf
I wanted to call her out
🗣️
hexed knot
Litcord
misty cradle
all she do is copy tweaks and lie
tawdry storm
🗣️
visual meadow
i put ssh into it now lol
placid kraken
i might actually just use a hardcoded array
that way i can share it between the prefs and tweak and i dont need to call class_copyMethodList twice
slender glade
all she do is copy tweaks and lie
All bisexuals do after 1991 is eat hop chips and lie
slender glade
i might actually just use a hardcoded array
true!
placid kraken
if i use xi i can preprocess it into a %hook call right?
misty cradle
All bisexuals do after 1991 is eat hop chips and lie
Those are women. Not bisexuals.
slender glade
Wtf is xi
placid kraken
hang on lemme get documentation
slender glade
Those are women. Not bisexuals.
Same thing
misty cradle
true..
placid kraken
yea i was right
slender glade
Those are women. Not bisexuals.
versed tulip
Who’s winner
slender glade
Oh that’s the first time I hear abt that
placid kraken
that means i can technically make a %hook that uses my custom values
although
i cant iterate with the c preprocessor
hmm
ok how do i make subpages in prefs
slender glade
PSLinkCell
placid kraken
oh
blazing warren
Senri works very fine ☺️
slender glade
Where the detail parameter is the class of the vc u wanna push
slender glade
Senri works very fine ☺️
🫡🫡
placid kraken
its starting to look like java classes atp lol
FloraSystemColorListController
next we get FloraSystemNormalCGColorListControllerFactoryFactorySingletonDelegate
ocean raptor
if i use `xi` i can preprocess it into a %hook call right?
vi is better
placid kraken
whats vi
indigo peak
that way i can share it between the prefs and tweak and i dont need to call clas...
you can technically do smth like this (please dont actually do this)
@interface FloraShitClass : NSObject
@property (nonatomic, strong) NSArray *shitArray;
+ (instancetype)sharedInstance;
@end
@implementation FloraShitClass
+ (instancetype)sharedInstance {
NSMutableArray *shitMutableArray = [NSMutableArray array];
static FloraShitClass *instance = nil;
static dispatch_once_t onceToken;
dispatch_once(&onceToken, ^{
instance = [[FloraShitClass alloc] init];
unsigned methodCount = 0;
Method *methods = class_copyMethodList([UIColor class], &methodCount);
for (unsigned int i = 0; i < methodCount; i++) {
Method method = methods[i];
SEL selector = method_getName(method);
NSString *name = NSStringFromSelector(selector);
if ([name hasPrefix:@"system"] && [name hasSuffix:@"Color"]) {
[shitMutableArray addObject:name];
}
}
instance.shitArray = [shitMutableArray copy];
free(methods);
});
return instance;
}
@end
slender glade
you can technically do smth like this (please dont actually do this)
```objc
@in...
DUDE.
faint stag
i did find and replace like 7 times for this
slender glade
you can technically do smth like this (please dont actually do this)
```objc
@in...
I think god should kill you
indigo peak
that looks too hellish
but this looks fine to you?
export type AllValues<T extends Record<string, any>, U extends unknown> = T extends { all: true; } ? U[] : U;
native dune
but this looks fine to you?
`export type AllValues<T extends Record<string, any>...
what the fuck is that
indigo peak
average objc code
placid kraken
but this looks fine to you?
`export type AllValues<T extends Record<string, any>...
ive done worse
export type SingleModuleByProperty<T extends any[]> = T extends [...any, infer O extends SearchOptions]
? AllValues<O, AnyProps<{ [k in Exclude<T[number], Record<string, any>>]: any }>>
: AnyProps<{ [k in Exclude<T[number], Record<string, any>>]: any }>;
what the FUCK
placid kraken
you can technically do smth like this (please dont actually do this)
```objc
@in...
also i dont think u can do this between projects lmfao
indigo peak
wdym
placid kraken
actually you can just import the header
indigo peak
yeah 
thats why i made it a class
with a shared instance
bc thats the whole point
placid kraken
lmao
oh btw atria still randomly crashes springboard with bluetooth enabled
i say randomly because sometimes the apps open fine other times they respring
placid kraken
do i search for Springboard as the process
faint stag
yes
placid kraken
ughh now its not doing it
wait
ok this is how you do this right?
<dict>
<key>cell</key>
<string>PSLinkCell</string>
<key>label</key>
<string>System Colors</string>
<key>detail</key>
<string>FloraSystemColorListController</string>
</dict>
actually what am i saying i have docs for this
yea
whats isController
do i need it
faint stag
i had a tweak i wanted to make a while back but i gave up on prefs cause i didn't know how to load a list of filenames in a linked cell
radiant idol
do i need it
Yea
placid kraken
i had a tweak i wanted to make a while back but i gave up on prefs cause i didn'...
i mean idk im loading them like this
_specifiers = [NSMutableArray array];
unsigned methodCount = 0;
Class uiColorClass = object_getClass(NSClassFromString(@"UIColor"));
Method *methods = class_copyMethodList(uiColorClass, &methodCount);
for (unsigned int i = 0; i < methodCount; i++) {
Method method = methods[i];
SEL selector = method_getName(method);
NSString *name = NSStringFromSelector(selector);
if ([name hasPrefix:@"system"] && [name hasSuffix:@"Color"]) {
id colorInstance = [UIColor performSelector:selector];
NSString *hexColor = [self hexStringFromColor:colorInstance];
PSSpecifier *specifier = [PSSpecifier preferenceSpecifierNamed:name
target:self
set:@selector(setPreferenceValue:specifier:)
get:@selector(readColorPreference:)
detail:nil
cell:PSLinkCell
edit:nil];
[specifier setProperty:[HBColorPickerTableCell class] forKey:@"cellClass"];
[specifier setProperty:BUNDLE_ID forKey:@"defaults"];
[specifier setProperty:hexColor forKey:@"default"];
[specifier setProperty:name forKey:@"label"];
[specifier setProperty:@true forKey:@"showAlphaSlider"];
[specifier setProperty:name forKey:@"key"];
[_specifiers addObject:specifier];
}
}
free(methods);
``` but this is very temporaryso many things are errored by Springboard i could never find the one im looking for
torpid beacon
So i'm reading through the launchd process discovery post and am curious, how do devs get access to the full filesystem without being jailbroken?
Are you guys ripping memory from the board? getting it out of an IPSW?
granite frigate
we don't get full filesystem access lol
torpid beacon
are there public dumps?
granite frigate
can't even write to most directories because of SSV
torpid beacon
we don't get full filesystem access lol
how did Alfie get access to /sbin/?
granite frigate
how did Alfie get access to /sbin/?
you search through the vp_namecache of /sbin to find launchd
then afterwards you kwrite to it to change v_name and vnode_id
torpid beacon
right, but how did you guys get to /sbin?
granite frigate
you have TrollStore
torpid beacon
ohh i need to learn more abt trollstore
faint stag
so many things are errored by Springboard i could never find the one im looking ...
meant the crash log not the syslog lol
granite frigate
then afterwards you kwrite to it to change v_name and vnode_id
doing this will redirect execution of launchd to any arbitrary binary, normally this isn't useful because codesigning kills it anyway
torpid beacon
wanna learn more just dont know where to go other than here lol
granite frigate
but the coretrust bug allows it to be run
placid kraken
meant the crash log not the syslog lol
oh
torpid beacon
but the coretrust bug allows it to be run
Does coretrust have a whitelist? how does it get around coretrust validation
granite frigate
Does coretrust have a whitelist? how does it get around coretrust validation
it whitelists app store apps
so there's a bug in coretrust validation where you can include your own app signature, then the signature of an app store app afterwards
torpid beacon
ahhhh i see
granite frigate
doing so will cause coretrust to think it's an appstore app binary and allow it to run
tldr basically
torpid beacon
right right
how does that tie into /sbin/ and launchd?
is launchd signed like an app store app?
granite frigate
yes
faint stag
funny how apple had to fix this sort of thing for installd and it comes up yet again
granite frigate
the different slices thing was cool
placid kraken
now how the fuck would i go about resetting the preferences back to default
torpid beacon
yeah yeah how can you read it
thats what im missing
and how do you modify launchd if its read only
faint stag
yeah yeah how can you read it
if you couldn't read it then how would it load lol
that goes for any file
torpid beacon
if you couldn't read it then how would it load lol
well but from a user standpoint
like how do you read it
or any dev
KFD?
memory rips?
granite frigate
krw
placid kraken
yea i think thats where kfd comes into play
granite frigate
read/write to kernel memory
torpid beacon
ok ok
granite frigate
it's like hexediting shit in games to cheat and get infinite ammo
torpid beacon
lol
faint stag
whats krw?
like the post says, arbitrary kernel r/w (read/write) can allow for the modification of vnodes
so you could redirect calls for one file to another location
in this case we point to a modified version of launchd
torpid beacon
how do you do that? do you get kfd?
placid kraken
does anyone have an objc springboard crasher i wanna implement a respring button
torpid beacon
like the post says, arbitrary kernel r/w (read/write) can allow for the modifica...
yep
the process of reading (and/or writting) is where im confused
i get now that it comes from kernel memory
are you dumping that memory from kfd?
faint stag
the process of reading (and/or writting) is where im confused
well you would use an exploit such as kfd
placid kraken
does anyone have an objc springboard crasher i wanna implement a respring button
my typical method of doing it doesnt work sksks
- (void)respring {
NSTask* task = [[NSTask alloc] init];
[task setLaunchPath:ROOT_PATH_NS(@"/usr/bin/killall")];
[task setArguments:@[@"backboardd"]];
[task launch];
}
sidenote: real jailbreaks avoid running the kernel exploit multiple times and provide interfaces for reading and writing to kernel memory
vnodebypass takes a similar approach to this, for example
torpid beacon
sidenote: real jailbreaks avoid running the kernel exploit multiple times and pr...
interesting
why do they avoid the exploit?
frail cedar
oh I have it
faint stag
why do they avoid the exploit?
instability
torpid beacon
instability
i see
harsh junco
to sign up?
App Store one
faint stag
i see
you have to cleanup after exploits or else you risk leaving memory in unsafe states
and since these methods are not 100% successful, you could end up panicking the kernel eventually
torpid beacon
you have to cleanup after exploits or else you risk leaving memory in unsafe sta...
ah
and why would you have to rerun the exploit for the launchd patch?
faint stag
and why would you have to rerun the exploit for the launchd patch?
because we aren't modifying the real launchd
once the kernel restarts, it'll just point back to the original one
torpid beacon
ah
faint stag
we only make changes in memory, so it only works after it's been run
torpid beacon
but the kernel restarts on userspace restart right?
faint stag
no
slender glade
No
torpid beacon
so doesnt checkm8 use the same mechanism?
oh
when does kernel restart?
whenever it wants?
slender glade
That’s the whole point of a user space restart
faint stag
so doesnt checkm8 use the same mechanism?
checkm8 patches the kernel before boot
torpid beacon
full restart ≠ userspace restart?
slender glade
Correct
slender glade
I don’t think you can do a user space reboot on stock
torpid beacon
yeah
granite frigate
sidenote: real jailbreaks avoid running the kernel exploit multiple times and pr...
honestly landa can be retried as many times as you want
but this is true
granite frigate
I don’t think you can do a user space reboot on stock
you need some ents yes
torpid beacon
ents?
granite frigate
entitlements
torpid beacon
ah
torpid beacon
honestly landa can be retried as many times as you want
and whats landa?
granite frigate
exploit method in kfd
torpid beacon
is that the launchd pointer?
granite frigate
no
torpid beacon
oh ok
granite frigate
sidenote: real jailbreaks avoid running the kernel exploit multiple times and pr...
I do want to implement libkrw in the future
but i have 0 clue how to do it
need dimentio and shshd fr
slender glade
Np it’s normal, we should actually document this lol
torpid beacon
haha
so @granite frigate the reddit post says
However, because we have a patched launchd, you can just inject a payload into any system binary (such as a launchd daemon) and effectively have a proper jailbreak.
Is this the libkrw thing?
torpid beacon
okay
torpid beacon
so <@413331641109446656> the reddit post says
> However, because we have a patc...
are they referring to the patched launchd daemon when they talk about an injection target?
granite frigate
no so basically
we have a launchd hook
we can change any function in launchd to do whatever we want
so for the purposes of springboard only, we hook whenever any binary is spawned and check if its path matches SpringBoard's
torpid beacon
we have a launchd hook
ok so what is the hook
granite frigate
if it does, change it to our own
torpid beacon
what does a hook mean here
granite frigate
the thing is that we can generalise this hook to any binary
slender glade
what does a hook mean here
Changing what an existing function does
While being able to call the original version
torpid beacon
Okok
slender glade
For launchd this usually means hooking and changing posix_spawn, the function for spawning binaries
granite frigate
honestly I feel like this thing is really hacked up
slender glade
For example, some patching is done to let the binary run its own child processes
torpid beacon
honestly I feel like this thing is really hacked up
im starting to get that idea 
granite frigate
you have to clone every binary and coretrust sign it to inject into it
torpid beacon
yeah
granite frigate
and so why is 17 not supported? coretrust patched?
- no krw exploit
- launch constraints
- apparently a "userspace PAC bypass" is needed
I'm not sure about point 3
sonic totem
2 and 3 aren't an issue
faint stag
instead of directly injecting into the normal one
wouldn't doing this trigger PPL
granite frigate
2 and 3 aren't an issue
idk how to get around them 
sonic totem
Workaround has been found for 2, 3 isn't that difficult in reality if you know what you're doing
granite frigate
Workaround has been found for 2, 3 isn't that difficult in reality if you know w...
i'm going to assume this is kept private
sonic totem
i'm going to assume this is kept private <:trol:831188670848565289>
Yeah of course :p
granite frigate
man
placid kraken
oh great my iphone went into safemode and all my apps crash
indigo peak
why does imessage have so many ways to enter a chat 😭
placid kraken
yea um for some reason flora now puts me in safemode
and i cant access sileo to delete it because it crashes
in safemode**
faint stag
gotta love being semi jailbroken
torpid beacon
now this is probably a really stupid question but is there any way to read all of the filesystem when jailbroken
faint stag
now this is probably a really stupid question but is there any way to *read* all...
yes
step 1: escape sandbox
faint stag
step 2: gain root privileges
granite frigate
gn chat
placid kraken
im gonna have to reboot for this
placid kraken
i hate everything
faint stag
step 2: gain root privileges
though, if you have kernel privileges already then both of these become easier
y'know, until apple throws more things behind PPL
torpid beacon
does this ```
<key>com.apple.private.security.no-sandbox</key>
<true/>
allow apps to access the full FS? run unsandboxed, etc? this seems broken lolsandbox is a funny extension to the kernel that restricts apps from accessing files outside their containers and also kills binaries executed outside containers without the proper entitlements
torpid beacon
right
torpid beacon
does this ```
<key>com.apple.private.security.no-sandbox</key>
<true/>
```
allow...
but then this
because thats in the app entitlements correct?
faint stag
well yes, it's an entitlement but how it works kinda does break things
torpid beacon
well yes, it's an entitlement but how it works kinda does break things
like what? could that be used to exploit and read (or write) memory/storage?
sonic totem
now this is probably a really stupid question but is there any way to *read* all...
When jailbroken?
Easy
torpid beacon
alfie i just became your biggest fan lol
sonic totem
Just add all the entitlements that Filza has
torpid beacon
whats good
frail cedar
like what? could that be used to exploit and read (or write) memory/storage?
it lets you access the filesystem outside of your bundle, data, and group containers
sonic totem
alfie i just became your biggest fan lol
How so? 
torpid beacon
it lets you access the filesystem outside of your bundle, data, and group contai...
sounds foolproof
faint stag
it lets you access the filesystem outside of your bundle, data, and group contai...
which is not actually the entire fs
just anything owned by mobile really
frail cedar
ye
torpid beacon
ok so if you have that whats the problem? cant you sign yourself?
with trollstore?
frail cedar
Yes
with only TS, installd will reject you, but that's why TS doesn't go through installd normally
torpid beacon
which is not actually the entire fs
just anything owned by mobile really
is the stuff you need to get access to for root access not owned by mobile?
torpid beacon
i mean like
indigo peak
You will be like me in a year’s time
scam im older and still suck
frail cedar
anything outside of /var/mobile with no-sandbox you won't be able to write to, but you'll be able to read it
granite frigate
You will be like me in a year’s time
a year? that's p fast
torpid beacon
the stuff that needs to be edited
granite frigate
i still suck fr
torpid beacon
anything outside of /var/mobile with no-sandbox you won't be able to *write* to,...
ah
frail cedar
if you want to write outside of /var/mobile you'll need a root helper
torpid beacon
thats what i was wondering
granite frigate
roothelper is another pain thing
sonic totem
a year? that's p fast
I started properly developing in late 2022 ¯_(ツ)_/¯
sonic totem
scam im older and still suck
:(
granite frigate
hmm
frail cedar
roothelper is another pain thing
That's why I ditched trollstore support for Spartan
granite frigate
I started properly developing in late 2022 ¯\_(ツ)_/¯
I don't have a set date where i started properly developing
idk
in and out ig
torpid beacon
anything outside of /var/mobile with no-sandbox you won't be able to *write* to,...
but this could be in place of krw exploit for ios 17 right?
frail cedar
No
torpid beacon
hush bot
faint stag
is the stuff you need to get access to for root access not owned by mobile?
all files have permissions
user processes are all ran as mobile
some files or directories may be owned by root (or another user) and can only be read or written to by the root user
torpid beacon
or does trollstore need krw
sonic totem
I don't have a set date where i started properly developing
I was doing SwiftUI (
) development before jailbreak stuff
sonic totem
or does trollstore need krw
No
frail cedar
filesystem rw and krw are completely different
granite frigate
I was doing SwiftUI (<:salute:814573854793007184>) development before jailbreak ...
funny how I start the total opposite
torpid beacon
also if launchd will reject you whats the point of being signed anyway? isnt the point of launchd to just check signatures?
faint stag
also if launchd will reject you whats the point of being signed anyway? isnt the...
launchd doesn't do signature checks at all
frail cedar
for full filesystem rw (on 15+) you'll need
- patched kernel so iOS doesn't refuse your remount command
- a root helper
sonic totem
@granite frigate by definition, a CoreTrust bypass is a PPL bypass, as CoreTrust is part of PPL now - so technically, I found a PPL bypass 
granite frigate
wait what
torpid beacon
filesystem rw and krw are completely different
so what cant you write to if you have write access to kernel
sonic totem
also if launchd will reject you whats the point of being signed anyway? isnt the...
CoreTrust bypass is the answer
frail cedar
so what cant you write to if you have write access to kernel
krw means you can read from and write to the kernel's memory
sonic totem
You’re automatically approved
sonic totem
coretrust is ppled?
Yeah it’s part of PPL in iOS 16 afaik
torpid beacon
krw means you can read from and write to the kernel's memory
ok
sonic totem
No more amfid 
frail cedar
Interesting
granite frigate
No more amfid <:supershocked:1130249630127501432>
how are dev signed apps check
they don't go through amfid?
granite frigate
huh what
sonic totem
AMFI is different
granite frigate
then what do they go through?
placid kraken
sorry
nono the issue is that i made a lot of changes and i have NO CLUE what is causing it to go into safemode
sonic totem
It goes trustcache -> CoreTrust -> developer-signed
granite frigate
its 5am
frail cedar
nono the issue is that i made a lot of changes and i have NO CLUE what is causin...
if you have cr4shed it can tell you what methods were running
before crash
sonic totem
I’m claiming that I wrote a PPL bypass 
placid kraken
if you have cr4shed it can tell you what methods were running
how where
the logs in analytics are gibberish
frail cedar
Yeah they are
torpid beacon
CoreTrust bypass is the answer
so CoreTrust bypass lets you get around not being signed
which means you could run outside of sandbox
meaning you can Read the entire fs and write inside of /var/mobile
which means you could dump the contents of your fs
which means you have some level of access to efficiently look for exploitable code (?)
frail cedar
You need cr4shed for nice formatting
frail cedar
ye
faint lionBOT
Powered by Canister
frail cedar
placid kraken
ah ok
frail cedar
shows you this
granite frigate
exploitable code isn't jack in userspace
frail cedar
very very handy
torpid beacon
exploitable code isn't jack in userspace
why not? (go to bed)
granite frigate
i mean that's prolly wrong
sonic totem
so CoreTrust bypass lets you get around not being signed
which means you could r...
Looking for exploitable code is not a benefit
granite frigate
but it's not really useful in itself
torpid beacon
ah i see
sonic totem
You can download the entire filesystem from an IPSW
torpid beacon
oh
granite frigate
XNU is oss too
sonic totem
Also yeah, if you’re looking for exploitable code, look in the kernel
granite frigate
the kernelcache can be analysed too
frail cedar
rootfs is unencrypted since 12 too
sonic totem
Exploitable code that runs in userspace is basically useless
frail cedar
so you don't have to pull encryption keys
sonic totem
From a jailbreaking standpoint
torpid beacon
but kernel is patched xnu right
granite frigate
Exploitable code that runs in userspace is basically useless
good for install methods I guess
installd trol
frail cedar
kernel is XNU
sonic totem
Unless it lets you reach a kernel vulnerability
frail cedar
XNU is iOS' kernel
sonic totem
good for install methods I guess
Only good use case 
Except there will likely not be an installd bypass again
frail cedar
we need psychic paper 3
torpid beacon
right but isnt the XNU that IOS uses patched up and closed source
frail cedar
No
torpid beacon
oh
frail cedar
Not afaik
sonic totem
right but isnt the XNU that IOS uses patched up and closed source
It’s highly similar
But yes it’s closed source
primal perch
torpid beacon
It’s highly similar
how highly though and how do we know the difference
torpid beacon
https://media.discordapp.net/attachments/688124600269144162/1192854330261377154/...
isnt uikit web only
faint stag
so CoreTrust bypass lets you get around not being signed
which means you could r...
you can do funny stuff like decrypt and mess with apps but not much else
frail cedar
isnt uikit web only
..no
torpid beacon
you can do funny stuff like decrypt and mess with apps but not much else
aw ok
sonic totem
how highly though and how do we know the difference
There’s some extra security additions for iOS
frail cedar
uikit is iOS' original framework for creating a UI
torpid beacon
you can do funny stuff like decrypt and mess with apps but not much else
dont most tweaks sit in that space tho?
decrypting stuff and messing with apps
sonic totem
As macOS is inherently different as a security model
frail cedar
it dates back to OS 2.0
torpid beacon
oh wow
faint stag
dont most tweaks sit in that space tho?
decrypting stuff and messing with apps
the libraries might
but you also need a way to load them
frail cedar
Though apple made many significant changes around iOS 4
torpid beacon
the libraries might
but you also need a way to load them
ah
frail cedar
So most OS2 apps don't work properly on 4+
placid kraken
um guys i think im screwed
as soon as i bootstrap none of my apps work
i cant delete the tweak
ok none of my apps except for bootstrap itself
frail cedar
?
I don't remember exactly, but with the release of iOS 4 apple now had two screen resolutions and so some things that used hardcoded positions died
Also, audio doesn't work sometimes
Not sure why
placid kraken
oh fuck i see why
frail cedar
Apps built pre iOS 4 sdk do not usually have audio on ios 10
faint stag
ah
which can be done with the ct bypass
which is why things like roothides bootstrap works for tweak injection
placid kraken
everything that has tweaking enabled doesnt work
and that includes sileo
bootstrap doesnt let me disable tweaking in sileo
ummmmm
torpid beacon
doesnt cydia work in safe mode?
placid kraken
where do i get cydia from
faint stag
you don't
placid kraken
sileo and zebra both crash
young meteor
you can always search for the dylib in filza and manually delete it
torpid beacon
idk i havent jailbroken in a few years
placid kraken
you can always search for the dylib in filza and manually delete it
oh true
young meteor
i had to do that when i installed cylinder reborn
cylinder remake works fine though
primal perch
isnt uikit web only
i think it’s a web framework too but im shit posting about the ios one
placid kraken
where exactly are packages stored
frail cedar
Apps built pre iOS 4 sdk do not usually have audio on ios 10
One of the apps I am trying to revitalize uses a custom UIAlert dismiss animation and that freezes the entire app when it's dismissed on iOS 4
faint stag
where exactly are packages stored
/var/containers/Bundle/Application/jbroot-whatever
frail cedar
Now that I know how to theos I should stop trying to hex edit the binary and start just method hooking the IAP stuff
@primal perch do you have IDA with an objc decompiler
frail cedar
i don't have 8.3
primal perch
idk what an objc decompoler is tho
placid kraken
/var/containers/Bundle/Application/jbroot-whatever
oh i need to be jbed for that ok
frail cedar
send send send
primal perch
it’s just the standard decompiler
faint stag
oh i need to be jbed for that ok
well no
primal perch
lemme boot up my pc
ashen birch
7.0 old as shit
frail cedar
yes it isssss
placid kraken
nvm found it
ashen birch
i have a copy of 8.3 with decompilers from 7.7
primal perch
use that one
my 8.3 doesn’t have the 7.7 decompiler i got it from the source and im lazy
placid kraken
where in jbroot are tweaks stored?
faint stag
I'd assume it's just there to avoid apps reading where jbroot is
since sandbox would say no
that's actually kinda clever tho
ashen birch
idk if its just an issue with me or what tho bc sometimes when i try to decomp larger functions ida just freezes & does nothing
on wine in macOS & vm in windows
frail cedar
i'm just trying to RE the IAP class of an app from 2010, doubt it's too complex (gone from app store and most of the game is paywalled)
faint stag
where in jbroot are tweaks stored?
Library/MobileSubstrate/DynamicLibraries
most likely
frail cedar
i have a copy of 8.3 with decompilers from 7.7
can I have
ashen birch
lemme throw on server hold
frail cedar
🔥
frail cedar
same
ashen birch
im not sure if it has armv7 actually let me check
primal perch
lol
ashen birch
why can't it decompile arm then
frail cedar
bro got the full loadout
primal perch
full package
native dune
million dollar ida install
primal perch
fr
frail cedar
no RISC though
primal perch
riscv overhyped anyway 💯
frail cedar
if riscv is so good, where's riscvi
native orbit
fr
frail cedar
i should try and compile nano for airports
ashen birch
ashen birch
@frail cedar @primal perch
ashen birch
wtf is dmca.sh
idk this was the site i got it from
primal perch
word
hasty ruin
https://dmca.sh/WinO6/VIquZiBE36.7z
native dune
https://cdn.discordapp.com/attachments/1169461256386785290/1170517092223680552/c...
hes driving
hasty ruin
young meteor
average carbridge user
ashen birch
https://cdn.discordapp.com/attachments/1169461256386785290/1170517092223680552/c...
didn’t yall literally pin the url to cryptic’s copy of ida in this channel
i doubt he gives af atp 💀
hasty ruin
i doubt he gives af atp 💀
no he does 
primal perch
didn’t yall literally pin the url to cryptic’s copy of ida in this channel
capt did
then cryptic changed that url to respond this is why we cant have nice things thanks capt
or something like that
hasty ruin
placid kraken
guys its real
placid kraken
does anyone have a respring objc snippet
acoustic imp
look on github
hasty ruin
smth smth adamdemasi.com
primal perch
typedef NS_OPTIONS(NSUInteger, SBSRelaunchActionOptions) {
SBSRelaunchActionOptionsNone,
SBSRelaunchActionOptionsRestartRenderServer = 1 << 0,
SBSRelaunchActionOptionsSnapshotTransition = 1 << 1,
SBSRelaunchActionOptionsFadeToBlackTransition = 1 << 2
};
@interface FBSSystemService : NSObject
+(instancetype)sharedService;
-(void)sendActions:(id)arg1 withResult:(id)arg2;
@end
@interface SBSRelaunchAction : NSObject
@property (nonatomic,copy,readonly) NSString * reason;
@property (nonatomic,readonly) unsigned long long options;
@property (nonatomic,retain,readonly) NSURL * targetURL;
+(id)actionWithReason:(id)arg1 options:(unsigned long long)arg2 targetURL:(id)arg3 ;
-(id)initWithReason:(id)arg1 options:(unsigned long long)arg2 targetURL:(id)arg3 ;
-(NSURL *)targetURL;
-(NSString *)reason;
-(unsigned long long)options;
@end
void respringDevice()
{
SBSRelaunchAction *restartAction = [SBSRelaunchAction actionWithReason:@"RestartRenderServer" options:SBSRelaunchActionOptionsFadeToBlackTransition targetURL:nil];
[[FBSSystemService sharedService] sendActions:[NSSet setWithObject:restartAction] withResult:nil];
}```right at the top https://github.com/NightwindDev/BoldersReborn/blob/main/BoldersRebornPrefs/BoldersRebornListControllers.mm
brazen timber
https://dmca.sh/WinO6/VIquZiBE36.7z
the actual leak did not come with an installer
primal perch
must link FrontBoardServices SpringBoardServices
brazen timber
either someone packaged it into an installer for no reason or this is north Korean spyware
the actual 8.3 leak also only had decompilers for x86 and x86-64, rest are from 7.7 and 7.5
primal perch
yeah its probably both
the ideal way to ship these would be unadultered installer with valid sha256 cert and then teaches you how to patch that
but then the crackers cant make money off ur botnet'd pc so
radiant idol
right at the top https://github.com/NightwindDev/BoldersReborn/blob/main/Bolders...
this is a little overkill though fyi
brazen timber
nah it's cuz the unalterened installer requires a password, and is encrypted and watermarked
acoustic imp
this is a little overkill though fyi
but it works in tweak settings so 👍
radiant idol
yes yes
brazen timber
and hexrays doesn't sign them
brazen timber
pro isnt
primal perch
seems dumb
acoustic imp
Yay or nay
radiant idol
typical nightwind...
i mean
read the code and you'll see what i mean
hasty ruin
Yay or nay
you do not need ida
acoustic imp
you do not need ida
ik, but y not
brazen timber
seems dumb
they give u sha in the email
primal perch
stick with the actual 8.3 leak if you want something slightly more trustworthy
but really run any pirated exe in a vm
brazen timber
from the scene group ^
acoustic imp
but really run any pirated exe in a vm
ik , i didnt run it
brazen timber
but I don't think the actual 8.3 leak is malicious
acoustic imp
tiny10 vm ready to launch
brazen timber
same group also releases binja
with unmodified installer and keygen
since they don't watermark
primal perch
chads
brazen timber
probably just trying to not get their source for the leaks banned from purchasing
ashen birch
the actual leak did not come with an installer
the actual leak did have an installer
placid kraken
right at the top https://github.com/NightwindDev/BoldersReborn/blob/main/Bolders...
this doesnt respring me either
ashen birch
it was a custom one though
acoustic imp
try the trollstore one
placid kraken
okok
ashen birch
and either way if you're not running cracked IDA in a VM you deserve to get hacked
acoustic imp
or insta spring idk if it OS
placid kraken
my original is this idk
- (void)respring {
NSTask* task = [[NSTask alloc] init];
[task setLaunchPath:ROOT_PATH_NS(@"/usr/bin/killall")];
[task setArguments:@[@"backboardd"]];
[task launch];
}
😭
acoustic imp
me no know oop so i no help
faint stag
why are we still killing backboardd
primal perch
and either way if you're not running cracked IDA in a VM you deserve to get hack...
fr
faint stag
just run sbreload
acoustic imp
@placid kraken TrollStore's ```objc
void killall(NSString* processName, BOOL softly)
{
enumerateProcessesUsingBlock(^(pid_t pid, NSString* executablePath, BOOL* stop)
{
if([executablePath.lastPathComponent isEqualToString:processName])
{
if(softly)
{
kill(pid, SIGTERM);
}
else
{
kill(pid, SIGKILL);
}
}
});
}
void respring(void)
{
killall(@"SpringBoard", YES);
exit(0);
}
NSTask is broken on Dopamine fyi
primal perch
no
brazen timber
the actual leak did have an installer
if you count the guys that stole the release lol
I remember looking at the nfos
acoustic imp
@hasty ruin how do i get the nexus beta that doesnt have the anoying thing when you hold down on buttons on the LS, nexus pops up
acoustic imp
Thoughts ? Ik its not exactly like iOS 16 but I think it’s close enough
@warped sparrow @gaunt stone
gaunt stone
Thoughts ? Ik its not exactly like iOS 16 but I think it’s close enough
You won’t believe it
But I’m actually stealing the design of iOS 16 Lock Screen music player for a minecraft mod
😭
acoustic imp
Thoughts ? Ik its not exactly like iOS 16 but I think it’s close enough
@radiant idol what do u think?
gaunt stone
Btw do it still halve the battery ?
acoustic imp
huh?
gaunt stone
Whta r u gona do with it in Minecraft ?
Basically a Spotify player directly in mc
radiant idol
looks alr i guess lol
acoustic imp
alr 🥲
gaunt stone
I want eta for repo !
gaunt stone
🙏
gaunt stone
Or release it on havoc
acoustic imp
but its far from where i want it to be and my objc are far from where i want them to be lol
gaunt stone
Good luck getting approved as a marketplace seller
Idrk if it’s that hard but they still ask for a portfolio and various projects so idrk
Maybe others could explain if it’s easy to get in or not
acoustic imp
oh so im not uploading to havoc bc i have none
ok il try to make a GH repo ig, not sure how to, but i started one but it deosnt rly work
gaunt stone
Idrk maybe wait for someone with a seller account to tell you
gaunt stone
ok il try to make a GH repo ig, not sure how to, but i started one but it deosnt...
Just steal a template
acoustic imp
ik but idk how to make it "mine"
acoustic imp
k il try
acoustic imp
ik i have this https://github.com/TeslaMan3092/repo but dont add it yet
gaunt stone
I know but I’m actually too braindead and too lazy to read debian’s guide
That’s what I said above
gaunt stone
Edit the Release file
.
acoustic imp
how do i make it show up for rootless tho ?
what am i missing for this to show up in sileo ?
Name: 16player
Depends: mobilesubstrate, firmware (>= 15)
Conflicts: ch.mdaus.utils, com.johnzaro.perfectmusic13, com.p2kdev.tinywidget
Version: 1.0.0
Size: 18914
Architecture: iphoneos-arm64
Filename: ./debs/com.teslaman3092.16player_1.0.0_iphoneos-arm64.deb
Description: IOS 16 ish Music Widget on LockScreen!
Maintainer: teslaman3092
Author: teslaman3092
Section: Tweaks```@radiant idol ?
radiant idol
no clue
indigo peak
hang on
acoustic imp
👍
hasty ruin
dpkg-scanpackages
indigo peak
i have this script
acoustic imp
k, will this work on windows?
indigo peak
if youre using wsl
acoustic imp
am not
indigo peak
<@755485349060280351> try that
https://github.com/mstg/scanpkg
@acoustic imp or read this 💀
acoustic imp
um
hm
how do i get dpkg-scanpackages on my mac?
@indigo peak ?
nvm
@gaunt stone
@warped sparrow
Has 2 know “bugs”
But lmk if it works for u
ashen birch
https://github.com/m1stadev/eyepatch someone stop letting me make shit in python
faint stag
https://github.com/m1stadev/eyepatch someone stop letting me make shit in python
i mean realistically you'd either being doing python or c for something like this
ashen birch
Tru !
faint stag
# fuck brew (the package manager)
pour a glass
acoustic imp
# fuck brew (the package manager)
it works tho 🤷♂️
hasty ruin
TIL
frail cedar
what else is there?
sbrew
brew but in swift so it doesnt run slower than a 486 trying to compile gentoo
visual meadow
Is there a way to fix this hook from doing this
`%hook SBFullScreenFluidSwitcherRootSwitcherModifier
- (Class)_defaultMultitaskingModifierClass {
Class c = NSClassFromString(@"SBGridSwitcherModifier");
return c;
}
%end`
cloud yacht
wait why does your watch app look like that?
frail cedar
wait why does your watch app look like that?
theme
cloud yacht
oh
native dune
Is there a way to fix this hook from doing this
`%hook SBFullScreenFluidSwitcher...
These animations are too fast fr
Not iOS like
!
wicked summit
gm
primal perch
gm
urban moon
is there a fat bootstrap libraries? arm64+arm64e?
i think procursus only comes with thinned libraries?
also, will arm64 binary runs on rootless fine? (never use a rootless jailbreak before)
slender glade
Senri code A4W2XJ6JMWHDW9PYCWMY
crisp frost
Senri code A4W2XJ6JMWHDW9PYCWMY
thanks gamer
wooden yarrow
Senri code A4W2XJ6JMWHDW9PYCWMY
btw if ur a dev can u just give out codes for free or do you have to purchase them
slender glade
Free
slender glade
thanks gamer
🫡
drifting heron
@slender glade congrats on the release
slender glade
Thanks!
drifting heron
I’ll be the first to purchase once the new iOS 16 JB comes out
slender glade
no way unlimited chariz gift code generator (asking the devs)
Yup making one rn
drifting heron
🫡
slender glade
I’ll be the first to purchase once the new iOS 16 JB comes out
💪💪
primal perch
gaunt stone
<@1071451982826573865>
Rootful 🙏
placid kraken
NSTask is broken on Dopamine fyi
I'm on serotonin so im assuming you mean dopamine or anything newer
ill try the ts method
slender glade
Yup
slender glade
I’ve shown extensive proof to her that I’ve not copied her tweaks, frankly this is none of your business and your intervention is much as useless as whatever you contribute to this community anymore
You’re upset more than the people who were affected
I hacked into the accounts of 2 discord mods
And I dumped their DMs
Not sure why you think I’m ashamed of this
And I’m sorry for changing my name as my identity changes
Perhaps you could’ve screamed at me for this in DMs? Or I guess just be like last time and delete every single one of your DMs once the conversation was done
It was 2 years ago and I don’t really care anymore (no one actually does)
If you say so lol
placid kraken
if you think they were really that ambitious about leaking things wouldnt you have considered antoine couldve had a message logger installed?
slender glade
Don’t interact
placid kraken
true true
placid kraken
yea um ill just leave this to you guys
slender glade
The entire thing, head to toe is open source
placid kraken
byebye
slender glade
You don’t care for the sake of those who I hacked or anything to do with morals, you just came here to waffle lol
slender glade
byebye
I’m done too I’m gonna go on the bus in a sec
I do have a sense of regret for what I’ve done, I’m just not ashamed and don’t try to hide it because it’s just something dumb I did at 15 that everyone moved on from
If you’re lying about me installing a message logger what is making you speak about morals 😭
?
Why would Antoine log discord messages
are you dumb
placid kraken
???
slender glade
They were clearly talking about the software
placid kraken
Antoine is not a discord message logger
placid kraken
unless youre willing to say that discord messages are all NSLogged into the console by discord
slender glade
I’d assume you would before you speak on any of them dumbass
slender glade
unless youre willing to say that discord messages are all NSLogged into the cons...
maybe they’d do this in the future #incompotency
lol
Okay sure
placid kraken
maybe they’d do this in the future #incompotency
lmfao i wouldnt put them up to that bc logging every message like that would be HORRIBLE for perf
theyre dumb but not that dumb
slender glade
lmfao i wouldnt put them up to that bc logging every message like that would be ...
You know they used to add like 800+ UIGestureRecognizers to every DCAvatarView it was crazy
placid kraken
your argument was that antoine that the same name as a "discord message logger" which is incorrect. please get your facts right before trying to argue like this
slender glade
your argument was that antoine that the same name as a "discord message logger" ...
Don’t interact
I appreciate it 🫡 but ignore them
placid kraken
yea i have to go for realsies now byeee
turbid fjord
I ain’t read half of this but by this logic everyone should be in prison forever because they have a history of doing a crime
Do people not reform? Do people not deserve second chances?
primal perch
slender glade
Do people not reform? Do people not deserve second chances?
Watch out if u use my PRISON software gremlins will crawl out of your ass
turbid fjord
Oh
wooden yarrow
Do people not reform? Do people not deserve second chances?
a discord user lived in a low trust society for their entire life. this is what happened to their brain.
turbid fjord
I want an official control center API soooooo bad
So do I
turbid fjord
They’re clearly running out of ideas so idk why they haven’t done it
Because they don’t want antoineware
slender glade
Because they don’t want antoineware
💀
placid kraken
im not even part of rjb i only started being active here recently
your message was ambiguous
either way lets end this here its a pointless argument
slender glade
@native dune @shrewd smelt hit tweet https://twitter.com/coreserena/status/1746160166607708630?s=21&t=VDAjphbfWMLnkC85ldm9mA
warped sparrow
<@1071451982826573865>
Nice!
slender glade
warped sparrow
@acoustic imp it still doesn't go to the edges. (iPhone X 15.4.1)
placid kraken
<@581573474296791211> TrollStore's ```objc
void killall(NSString* processName, ...
enumerateProcessesUsingBlock is a pretty lengthy function
placid kraken
but it worked !!
oh and the native color picker ended up working too
so i can get rid of my dependency on alderis
slim bramble
<@755485349060280351> it still doesn't go to the edges. (iPhone X 15.4.1)
What’s the name of that font 🙏
visual meadow
Is there a way to fix this hook from doing this
`%hook SBFullScreenFluidSwitcher...
anyone
hasty ruin
SBAppSwitcherSettings (I think, something like that) has a switcherStyle property. set that to 2 to get grid switcher
try that instead of changing the class yourself
@visual meadow
visual meadow
SBAppSwitcherSettings (I think, something like that) has a switcherStyle propert...
So %orig(2)
An i think righr
Am
visual meadow
in setSwitcherStyle:
uh
turns out
thats what i had lol
and thats what cuases that issue
i just remembered
hasty ruin
switcherStyle
slim bramble
Hi nathan
hasty ruin
hello bibi fire
visual meadow
hello bibi fire
%hook SBAppSwitcherSettings
- (void)setSwitcherStyle:(long long)style {
%orig(2);
}
- (void)switcherStyle:(int)arg0 {
return 2;
}
%end```no
hasty ruin
```
%hook SBAppSwitcherSettings
- (void)setSwitcherStyle:(long long)style {
%ori...
getters return a value
so they’re not voids
check the headers fr
slim bramble
Btw whats your tweak for time and date in status bar ?
I mean I could make my own but cba
warped sparrow
What’s the name of that font 🙏
Quicksand
slim bramble
thanks
visual meadow
bro and that bug is there
frr
@hasty ruin help me sir
nvm
that code actually works 💀
the one i sent earlier
never mind .
it does the same exact thing .
granite frigate
castswitcher does the same thing
just look at its src
I compiled it and edited it for myself
visual meadow
just look at its src
whgere
granite frigate
guess something broke on 16
harsh junco
why is there so many ways to do the same thing
Why not
placid kraken
idk it seems to work fine for me on lynx but i never went on landscape mode to try it
native dune
<@574669003755356162> <@1088593923661893703> hit tweet https://twitter.com/cores...
Nice
I don’t think I’ve had a tweet above 300 likes
Lmao
slender glade
I don’t think I’ve had a tweet above 300 likes
i pump out bangers as often as blue checkmarks pump out bait tweets
native dune
Real
slender glade
during futurerestore times i think r my most banger tweets
futurerestore era m1sta was actually a diff person
ashen birch
Really Was .
slender glade
FR era in general feels like it was 20 years ago
wheres the pic of the wolf looking out
I still remember FutureRestore 194.
ashen birch
FR era in general feels like it was 20 years ago
you two years ago:
granite frigate
the pages incident
ashen birch
yall brought it up earlier not my fault it popped up in my head
slender glade
the pages incident
yeah memory pages :3
slim bramble
eta cryptex1 bypass 🙏 https://cdn.discordapp.com/emojis/874713490890321930.webp?size=48&name=troll&quality=lossless
ashen birch
hell no
slender glade
yall brought it up earlier not my fault it popped up in my head
lmfao idrc abt people memeing abt it tbh
slender glade
eta cryptex1 bypass 🙏 https://cdn.discordapp.com/emojis/874713490890321930.webp...
we're well over this man
FR is dead 😭 let that shit go
ashen birch
ok being realistically i wouldn’t even be surprised if it was similar to apnonce setting
slim bramble
FR is dead 😭 let that shit go
Sadly....
ashen birch
but even still
hasty ruin
you two years ago: <:uhh:696449618539708548>
😭
ashen birch
dude nobody has cryptex tickets
i don’t think we ever had tsschecker ever saved them by default
hasty ruin
slender glade
I think the 2nd biggest factor is like, nobody really gives a fuck to save FR anymore
slim bramble
dude nobody has cryptex tickets
is it even possible to save them ?
ashen birch
ofc it is
slender glade
is it even possible to save them ?
it's too late for that now lol
slim bramble
nobody has made a thing to download them ???
slender glade
you'd have to modify TSSChecker a bit
but also like
when Cryptic had it on life support and brought it back to life 5 different times in 2 years
it was time to let it go
ashen birch
hell i’m literally making python fr and i’m just telling ppl it won’t work with restoring ios 16+ sep https://vxtwitter.com/_m1sta/status/1744437632954757196?s=46
slim bramble
No but like is the request to grab them known ?
slender glade
hell i’m literally making python fr and i’m just telling ppl it won’t work with ...
goat
ashen birch
No but like is the request to grab them known ?
bro yes
slender glade
No but like is the request to grab them known ?
yes
ashen birch
idevicerestore wouldn’t work without it