development

[frank fossil]

means you can only modify symbol table and not instructions

[fluid lintel]

But APPstore has the Dynamic-codesign entitlements this entitlements is not usually associated with JIT?

[frank fossil]

It doesn’t

only WebContent has dynamic-codesigning iirc

[worldly ether]

@frank fossil can you help me plase?

please*

[fluid lintel]

A but seeing the entitllemnts with jtool I saw that it has this entitlements.

[frank fossil]

even if AppStore has it, it has nothing to do with user apps

[frank fossil]

what

[worldly ether]

this one:

[fluid lintel]

A ok clear. So if I consider another app in which I enable jit. How do I hook a function by not writing the hook function in the process?

[worldly ether]

when i build instaspring it just crashes but the ipa provided with it says "fix"

what did they do to it

[frank fossil]

No idea, I checked the code and all it does is xpc_crasher TouchDeliveryPolicyServer

[frank fossil]

Use opainject to load your library to the process, I’m not sure what you’re talking about not writing, hardware breakpoint stuff?

[worldly ether]

yeah ik

it works on ios 14-16

but on ios 17 it crashes

if i build it from source

[frank fossil]

yeah because xpc_crasher is fixed

[worldly ether]

but the precompiled version from github works

[worldly ether]

and what can be the fixed line for it???

[frank fossil]

Add unsandbox entitlement and steal TSUtil.m#L210-L281

[worldly ether]

do you have any ideas? @frank fossil

[worldly ether]

what the

[worldly ether]

im not that skilled

@frank fossil the fixed version ipa and the source compiled one are not so different in size

idk what could be added

[fluid lintel]

ok I'll try, thank you. So in system apps like AppStore you can't enable JIT, or rather even if I enable it I can't do anything with it.

[acoustic imp]

Bc I’m lazy, but now realize it’s a lot easier to read stuff with caps

[serene hawk]

anyone knows a way to invoke control center?

[radiant idol]

[[%c(SBControlCenterController) sharedInstanceIfExists] presentAnimated:YES]; I think it’s this if I remember correctly

[serene hawk]

thanks :))

[slim bramble]

https://twitter.com/earth_updates/status/1752266658519892107

Earth Updates (@Earth_Updates) on X

❗️⚠️❗️ Earth Update ❗️⚠️❗️

• Java is now the only language

Twitter · Jan 30, 2024, 9:45 AM

W

[tepid olive]

Uhoh

[fluid lintel]

I don't know why I get this error when I try to enable jit, could you give me some advice?
System Policy: launchd(1) deny(1) system-debug children

[frail cedar]

oh this annoying guy

[fluid lintel]

Sorry?

[ashen birch]

NOOOOOOOOOOOOOOOOOOOOOOO

https://tenor.com/view/dead-gif-24973773

me asf

[timid briar]

system out print jumpscare

[ashen birch]

https://tenor.com/view/cats-scared-jump-frightened-shocked-gif-3545690

[timid briar]

True

[cloud yacht]

Man I'm too lazy to push the shift key

[indigo peak]

I remember in like 2nd grade my friend typed in caps lock

but he still typed normal sentences

like

“Hi How Are You”

he just released shift at the start of a word

and held shift for the rest of the word

It still haunts me to this day

[sonic totem]

How are you trying to enable JIT?

[fluid lintel]

With ptrace using PT_TRACE_ME

I also tried the PT_ATTACHEXC flag. I don't get that error but ptrace gives me -1

[tepid olive]

Does anyone know precisely how long it takes for the CPU to write a dirty cache line back to dram?

[harsh junco]

Libimobiledevice in Java

ibootpatcher in Java

[languid gyro]

does runtimebrowser work with Bootstrap and Serotonin?

[lean ermine]

anyone know what might be causing this

just trying to build a tweak (intended for ios 14) and have libsona installed but for some reason am getting this

my makefile

it was in the normal libs dir, wasnt in rootless but adding the rootless dylib still doesnt fix

[lean ermine]

yea i think so

[indigo peak]

@primal perch got it to work without memory patching

it uses some

uh

questionable code

like rosie level code

(imp_implementationWithBlock)

[indigo peak]

https://github.com/donato-fiore/GameSeagull/blob/main/Utils.m#L28-L59
is this even needed anymore

like arent there like shims or something built into libhooker or whatever

like where MSHookMessage/Memory works on libhooker

[slim bramble]

@radiant idol hey uhh is throwing all preferences into it's own class a good idea

rather than using static

[radiant idol]

Wdym

[slim bramble]

Basically this

[radiant idol]

oh

yea that’s fine

[slim bramble]

Ok nice

[radiant idol]

Call it by a unique class name tho

It can’t be something that was already taken

[slim bramble]

Preferences.m

[radiant idol]

That is very generic

It can’t be something that iOS (or other apps) already use

[slim bramble]

Oh mb I'll add trolley stuff

I'm completely rewriting 16player lol

[indigo peak]

you can still name your methods how you have them, like loadPreferences
but def name the class smth different, something like 16PlayerPrefs

[slim bramble]

You can't start classes by digits ;)

Dw I fixed it

[indigo peak]

SixteenPlayerPreferences

[slim bramble]

😟 how do you know

[indigo peak]

bc "You can't start classes by digits ;)" so just spell out 16 lol

[slim bramble]

[faint timber]

iOS16ClassName

[slim bramble]

fr

[faint timber]

[slim bramble]

💀

Bro getting the null

[cloud yacht]

name your class c75214e7-a6af-4d48-bc7e-670af6fb68e2

[ashen birch]

NOOOOOOOOOOOOOOOOO

capstone/keystone has java bindings that is very feasible

[slim bramble]

That would actually be fun to do

[ashen birch]

hell you could even do it in ruby or js if you wanted

[slim bramble]

python iBootPatcher 🔥

[slim bramble]

rat.exe

[ashen birch]

go to the repo in my nickname

[compact thunder]

possibly a very cool thing that I found on my drive which I haven't turned on in a few years

[compact thunder]

🪤

[blazing warren]

https://tenor.com/view/malware-spyware-ransomware-faxalot-gif-23230130

[slim bramble]

💀

[slim bramble]

JARVIS malware 💀

[ashen birch]

best iboot patcher 💯

[compact thunder]

I only send semtex fanmail

[slim bramble]

it works at least ?

[compact thunder]

my pdfs are safe

[blazing warren]

icreaze stark

[slim bramble]

icrazeware is ratted

[ashen birch]

https://github.com/m1stadev/eyepatch/blob/b84129398235d56bda8ab801cd88c45c5f0480ca/eyepatch/iboot/iboot64.py#L113 name another iboot patcher that lets you inject prints

[ashen birch]

ofc

[slim bramble]

Pretty

looks clean.

Now make it in assembly

[ashen birch]

ew where’s ur syntax highlighting

[slim bramble]

Dark Reader did a goober

[primal perch]

hell yea

[cloud yacht]

disable dark reader on github and enable native dark mode

[slim bramble]

Teslaman's code :

[slim bramble]

Dw, I just hadn't setted it up for Arc

[indigo peak]

It uses the same math scoop discovered, but figured out how to do it without memory patching

[slim bramble]

I'm slowly switching to arc

[cloud yacht]

arc?

[slim bramble]

You never heard of it?

https://arc.net

[cloud yacht]

Automatic refrence counting

[slim bramble]

💀

[harsh junco]

[slim bramble]

Yeah fr never noticed

[sonic totem]

Anyone here have experience with multi-threading (bugs)?

[torn cloud]

of course it's in python

[cloud yacht]

never heard of it, nor does it even look like I can use it

[slim bramble]

👀

[sonic totem]

My program crashes

[torn cloud]

just debug it

[cloud yacht]

also I don't really want to use a closed source browser

[torn cloud]

fr

[slim bramble]

W explanation

[sonic totem]

pthread_mutex_lock(mutex) == 0

[cloud yacht]

just switch to the main thread when doing any logic

[sonic totem]

Idk how to debug that

[torn cloud]

[sonic totem]

There shouldn’t be a thread running when that error hits

[harsh junco]

Webapp patcher

[torn cloud]

mutex lock operation moment

[slim bramble]

printf("%i \n", pthread_mutex_lock(mutex)); ?

[sonic totem]

But which mutex

[sonic totem]

But I don’t have a mutex that I’m locking lol

[torn cloud]

so it doesn't return 0?

[sonic totem]

Idk where it’s coming from

I don’t call that function, it’s done elsewhere

[slim bramble]

Perhaps you have a backtrace ?

[sonic totem]

OH

It’s a libusb issue

[slim bramble]

💀

[sonic totem]

Ugh

https://stackoverflow.com/questions/76226163/allow-application-to-access-specific-usb-device

Exactly the same issue

With a Raspberry Pi

[torn cloud]

lmfao

isn't libusb only used in linux?

or am i thinking of libimobiledevice?

[slim bramble]

No ?

[torn cloud]

nvm

[slim bramble]

both can be run on *

[sonic totem]

There’s literally no USB functions called in the timeframe that it crashes

[slim bramble]

Are you cooking Achilles ?

[sonic totem]

Yea

Achilles Linux support

[harsh junco]

[cloud yacht]

a chille

[slim bramble]

Achilles windows support ETA

[harsh junco]

GNUs

[torn cloud]

wen windows support

[harsh junco]

Libusb

Zadig

[slim bramble]

@sonic totem https://github.com/merbanan/rtl_433/issues/1793

Perhaps there's something to extract from there

[sonic totem]

It’s a raspberry pi issue man

Why

[slim bramble]

you running it off a pi ?

[sonic totem]

Need someone with a regular Linux PC to test them

[sonic totem]

Yeah

[slim bramble]

Can boot arch

[cloud yacht]

I am running linux rn

[sonic totem]

You’d need libusb and libimobiledevice

And a checkm8 device

[slim bramble]

Alr I'll boot arch

I have *

[cloud yacht]

I won't have a checm8 device for ~4.5h

although its charging port is super jank

[ashen birch]

@sonic totem by any chance is it a pi 3

iirc there’s some issue with it’s usb stack

it’s also why check doesn’t support it

or at least they had a working impl at some point but never a pub release with it working

i wonder how much 1337.x changes that

[sonic totem]

It’s a Pi 5

:/

[fluid lintel]

What is this entitlements for?
<key>com.apple.private.amfi.developer-mode-control</key>.

[sonic totem]

Turning developer mode on/off

@slim bramble @cloud yacht latest Achilles commit should support Linux

[fluid lintel]

A ok. I thought it might be related to my ptrace problem.

[slim bramble]

I'lll try

just finished bulding libimobiledevice

@sonic totem what should I try

[sonic totem]

Either signature check removal or booting Pongo

Well both ideally

[torn cloud]

is Achilles just checkra1n but open source?

or is it more than that

[sonic totem]

Similar

It can boot PongoOS, jailbreak (with provided ramdisk and binpack and KPF) or disable image signature checks (like gaster)

[torn cloud]

cool

uh alfie

[sonic totem]

Yea

[torn cloud]

what happened to reverse engineering the image stack and finding a untethered bootrom?

you removed it from your blog

[sonic totem]

Still going mate

[torn cloud]

niceee

good luck

[sonic totem]

I just wanted to make my blog more bland

Less words

More mysterious like @hasty ruin

[torn cloud]

right

[sonic totem]

I’m balancing like 4 projects rn that’s all

[slim bramble]

@sonic totem you have to wait for my phone to finish charging for some reasons it wasn't

[hasty ruin]

british

[sonic totem]

No problem

[slim bramble]

I'll compile the rest of libimobiledevice

in the meantime

[sonic totem]

Thank you

Gonna try jailbreaking with p1

[torn cloud]

and what

[slim bramble]

phone booting

👀

[torn cloud]

british = the best

i'll spill my tea all over your nexusware

and throw my biscuits at your runeware

[hasty ruin]

i agree

[sonic totem]

Successfully jailbroken with Achilles-Linux 🔥🔥

[hasty ruin]

https://media.discordapp.net/attachments/688121419980341282/1139608104447791256/capt.gif

[slim bramble]

@sonic totem do achilles have dfuhelper ?

[sonic totem]

Yes

[faint timber]

If you need dfu helper you get zero bitches

[slim bramble]

ok just need to figure out why ideviceenterrecovery not work

[faint timber]

It requires pair 14.5 and later

[slim bramble]

nvm good oll way better

[slim bramble]

arm64 14.8.1

[sonic totem]

I swear you use an A11 device

[tepid olive]

is A14 theoretically vulnerable to PACMAN, seeing as it uses the same cores as M1?

[faint timber]

I’ve done dfu on every device pretty much most annoying is 5s no issues with a11 or a9

[tepid olive]

(very random, i know)

[sonic totem]

I’m getting initproc exited while booting

[elder scaffold]

initproc exited

[slim bramble]

@sonic totem

Bad news

[sonic totem]

Yes

Why

[faint timber]

[slim bramble]

Achilles: ./os/threads_posix.h:46: usbi_mutex_lock: Assertion `pthread_mutex_lock(mutex) == 0' failed.
[1]    40678 IOT instruction (core dumped)  ./Achilles -p

[sonic totem]

NO

NO

[faint timber]

You should compile on docker debian buster slim it’s the best for older linux

[sonic totem]

But I need to checkm8

[slim bramble]

irecv_copy_nonce_with_tag_from_buffer: WARNING: couldn't find tag SNON in string GANG:KJC HAXX:Axi0mX ETA:son ????????????

[sonic totem]

W

Run Achilles again

It will get to PongoOS

[slim bramble]

yes

[sonic totem]

Half a W

So it’s not a raspberry pi issue

It’s not a bulk transfer issue

[sonic totem]

lol clearly you got PWNED!

[slim bramble]

I need pongoterm

do achilles has that yet ?

[sonic totem]

Not yet

It’s planned

[slim bramble]

W

Well

fix

[harsh junco]

GANG:KJC HAXX:Axi0mX ETA:son

[slim bramble]

linux achilles

[sonic totem]

I’ve found the issue

[slim bramble]

What's the culprit ?

[sonic totem]

Well

I’ve narrowed it down

It happens during the exit of the program

[slim bramble]

Maybe you forgot to end a communication ?

or smth like that

[sonic totem]

Fixed it

[slim bramble]

Push

[sonic totem]

In a sec

It’s still there

When booting Pongo

I might have fixed it

Fixed

@slim bramble pushing soon

[harsh junco]

Is Achilles 12-14 or 12-16

[sonic totem]

Wdym

[harsh junco]

iOS support range

[sonic totem]

7-17

[harsh junco]

Oo

[sonic totem]

Theoretically

[slim bramble]

I'm ready to test

[harsh junco]

Need proc for 7-10

[sonic totem]

Okay

There’s some bug

Which causes overwrite sending to fail

AKA success rate is low

[slim bramble]

:(

[sonic totem]

We good don’t worry

I’ll fix it

[slim bramble]

:p

[sonic totem]

Ugh this is annoying

Success rate seems to be like 1/5

Oh wait

Hm

Might’ve found the fix

@slim bramble try latest

No check the latest now

[crisp frost]

@sonic totem when eta stage2 reimplementation instead of stealing from checkra1n!!

[sonic totem]

When checkra1n goes open sourced!!

[crisp frost]

fr

[sonic totem]

Didn’t you decompile and recompile a 1:1 copy of the T8015 YoloDFU

[hasty ruin]

2020!

[crisp frost]

yes, for s8003, t8010 and t8015

[sonic totem]

I didn’t add A6 support to Achilles just because I’m hating on armv7

[crisp frost]

it recompiles 1:1 but It's not really clean code

[sonic totem]

Oh wow

Assembly or C?

[crisp frost]

asm

[harsh junco]

At the same time when GNU Hurd will be fully complete

[sonic totem]

Me and Clarity will solve this though with untethered Image3 haxx eta son !

[crisp frost]

Posting on reddit

[sonic totem]

Let the eta kids flow

I’ll delete Twitter

[steady nest]

Would love to do it <6 months but

[sonic totem]

Life is life

I’ll find a vulnerability in my sleep

[crisp frost]

I thought of the fix for ios 10 seprmvr64 right before going to sleep

[sonic totem]

Nah one of us will do it tbh and it’ll probably be you

[harsh junco]

delete humanity from yourself

[crisp frost]

I almost forgot it the next day

[sonic totem]

I remember figuring out how to fix checkm8 when I was asleep

When I wrote Achilles v1

And it worked

Like I dreamt about the fix and it worked

[slim bramble]

fix but no boot

checkra1n -p

💀

[acoustic imp]

Yes

[sonic totem]

Huh

[slim bramble]

dw

[sonic totem]

Did it work or not

[acoustic imp]

is ther a way in the tweak to see if another tweak is installed?

@radiant idol how do i do the thing you told bibi abotu with like getting then storing a referance so somthing?

[torn cloud]

i wouldn't think so

however i am working on rewriting it into C

[torn cloud]

and besides, PACMAN currently only works on macOS atm due to needing to use a custom kext

which iOS/iPadOS will not let you do

[tepid olive]

ah.

[torn cloud]

yeah

[tepid olive]

was just curious

[torn cloud]

do you want to see the rewrite i'm working on?

it's not very good lol

[tepid olive]

nah it's ok

[torn cloud]

k

[slim bramble]

yeah

[sonic totem]

W

[blazing warren]

Y

[acoustic imp]

would this work?

it deos not

so when the animation finshes it sets the view to hidden

bc that doesn't animate ? like alpha

ios sets alpha to 1 when the LS updates anything

but doesnt chnage the hidden prop

[acoustic imp]

so animate to hidden then set to hidden = good

how would i like just not set it, bc it needs an 'else'

nil ?

no but it will just set it anyway

when the animation runs

and wount animate

i could just ad 2 lines

like this

but it does tho

ok

full block*

[hasty ruin]

hidden = yes on the first one

[acoustic imp]

shoot

thx

[hasty ruin]

also you want to set hidden to no before setting alpha to 1

[acoustic imp]

@hasty ruin so i shoudl do it like this?

See

No fade/animation

[hasty ruin]

no

[acoustic imp]

how should i do it?

[indigo peak]

or .hidden = finished

💀

[acoustic imp]

thx

[hasty ruin]

when hiding:

• in animation block: set alpha to zero
• in completion block: set hidden to yes

when showing:

• set hidden to no
• in animation block: set alpha to 1

[acoustic imp]

it just doesnt work

[ashen birch]

dfu helper legit quicker tho

bc of special timed reboot cmd

[faint timber]

I have reset cable tho

[ashen birch]

the actual helper yeah

[ashen birch]

good 4 u then smh

[acoustic imp]

can somone help?

[hasty ruin]

You spelt flashlight wrong

[acoustic imp]

🙈

thx

[wind ravine]

why are status bar elements not showing up in flex

[acoustic imp]

fixed spelling but same error

any ideas?

@radiant idol ?

[acoustic imp]

Nvm I got it

Finally …

Had to hook every set alpha method there was

aslo can you %groupd method hooks ?

[tough shadow]

Why am I getting errors?

[restive ether]

maybe because you’re using something that’s been depreciated since ios 3

[tough shadow]

What do I use?

[restive ether]

something not depreciated since ios 3

[tough shadow]

Heres my code

[tough shadow]

Can you show me?

[indigo peak]

no

[tough shadow]

Am using this guide

[restive ether]

too busy smoking

[indigo peak]

based

[indigo peak]

i quit weed for 2024

i miss

[restive ether]

fuck does this tv actually not have WPA3

[indigo peak]

@radiant idol yeo what sf-symbol should i use for this

the pref is "Auto Cup Pong"

i was also thinking "Auto Cup Pong Button" or "Auto Shoot" or "Auto Shoot Button"

[restive ether]

dork

[acoustic imp]

@granite frigate do you wana try 16player?

[indigo peak]

captinc is typing...

prepare for the captlations

[native dune]

chatgpt has taught me more than my math teacher

[indigo peak]

preach

[acoustic imp]

quite real

[indigo peak]

@grave sparrow 🙏

there is no cup sfsymbol

[acoustic imp]

ask chat gpt

[indigo peak]

ik

theres tea cup

wine glass

water bottle

but no like just cup

[radiant idol]

Idk I don’t remember all the sf symbols off the top of my head

[acoustic imp]

?

[indigo peak]

cmon, if __ can expect me to remember every iOS header and framework off the top of my head you can at least remember all icons

[tough shadow]

Can you update your code thank you from your guide

[indigo peak]

i was thinking the breaksignal

[radiant idol]

It works fine

Your setup is wrong

[tough shadow]

Theos setup?

[acoustic imp]

mug?

[radiant idol]

Idk something there is wrong

[indigo peak]

have you ever been to a party and they playin pong w a mug

[tough shadow]

I have my own repo

[indigo peak]

only time youd see that is at a retirement home

[acoustic imp]

[indigo peak]

yes, we know

we remember this

[tough shadow]

Forgot to use this icon

[indigo peak]

@radiant idol well could you at least help w the name?

of the preference toggle

[acoustic imp]

me too, need help

[radiant idol]

I woke up like 10 mins ago let me think straight first and I’ll help

[native dune]

🔥

[tough shadow]

It’s up to date

[indigo peak]

take your time

[radiant idol]

READ. THE. ERRORS

[acoustic imp]

its like me but worse

[indigo peak]

a lot worse lol

[radiant idol]

You actually somewhat comprehend what you’re doing

[indigo peak]

^

and if we tell you something you actually try to learn from it

instead of dry pasting it into vscode without knowing what it does

[acoustic imp]

iv **did **that

[indigo peak]

@grave sparrow @radiant idol

closest thing to a cup

lol

[acoustic imp]

do this one tho

well

(wheres the cuppong video, i need a refernce)

[indigo peak]

@acoustic imp

[tough shadow]

How do I remove this?

[acoustic imp]

cant you just do custom images?

jus like grab the model/imag of the cup and use that?

[acoustic imp]

#jailbreak

[indigo peak]

@tough shadow if you read the error, it says its deprecated as of iOS 3
not sure if you know what deprecated means, but it means no good
and iOS 3, not sure if you know was a while ago
just google "textColor deprecated" or SOMETHIGN like that to find a fix

and also, the code you sent does not inclde the location of the error, so actually try starting with that first

[tough shadow]

In my repo

[indigo peak]

im using <key>iconImageSystem</key> in cephei

[acoustic imp]

oh

thers a like cell left image or sm

[indigo peak]

no

all systemImages

iconImageSystem Optional. Supports displaying a system image as the cell icon, as specified below.
leftImageSystem Optional. Supports displaying a system image as the icon to the left of a PSSliderCell’s slider control, as specified below.
rightImageSystem Optional. Supports displaying a system image as the icon to the right of a PSSliderCell’s slider control, as specified below.

[granite frigate]

uh ok

i'm on 16 though

sorry

[acoustic imp]

oh, nvm then

[tough shadow]

It’s in my repo

[granite frigate]

actually I do have a SE1

havent touched it in months

[acoustic imp]

its fine, i meant to like maybe daily drive it or sm but nvm

[granite frigate]

oh nah

iun got any

[acoustic imp]

bc i mostly fixed the like right now bugs, but i need like daily driving testers more or less

i have 2 on ios 15

if u wana mess w it il send u the deb

[granite frigate]

dm ig

wont daily it but I can try fucking around

[indigo peak]

maybe

[tough shadow]

How do I delete this from my repo?

[native dune]

what

[tough shadow]

It’s in my repo

How do I delete it

[native dune]

the delete button

[tough shadow]

Will this delete my Sileo?

[native dune]

isnt that literally what you just asked

[tough shadow]

I mean I don’t won’t anyone to see this

[native dune]

so... delete the debs off your repo??

[tough shadow]

It just deleted my Sileo

[tough shadow]

Yes I did that

[native dune]

well did you delete the package off your device

[tough shadow]

Yes

Now I have to rejailbreak

[native dune]

well what did you think was going to happen

[tough shadow]

Delete my Sileo

[tough shadow]

It’s not even in my github

[native dune]

rebuild your repo

[tough shadow]

With what?

[native dune]

idk do u have a build script

[tough shadow]

No

[native dune]

so how did you get it on your repo in the first place

[tough shadow]

Ohhhh

Yes

[tough shadow]

Got my sileo back

[slender glade]

Fascinating conversation

[frail cedar]

I am not sure what I just read

[sudden heron]

any cryptobro online that is familiar with AES128? When I try to decode the decrypted token back into utf-8 I get an invalid byte error

Does this mean the key I'm using is wrong?

because the token itself looks similar enough to the working version

[faint timber]

https://github.com/Cryptiiiic/SEPROMPanicDecrypt/blob/main/main.py
https://github.com/Cryptiiiic/aes_nonce/blob/main/aes_nonce.py

[sudden heron]

oh you have the right username

[faint timber]

ironically not related

[sudden heron]

this mode doesn't use nonces

[faint timber]

doesn't matter im saying use it as exampler for preperly getting the token back

[sudden heron]

it's a different mode of AES lol.

[faint timber]

Doesn’t matter the output is bytes

[fluid lintel]

Do you think using this method it is possible to start all processes with the CS_DEBuGGEd Flag?
https://github.com/mineek/Serotonin/blob/main/RootHelperSample/launchdshim/launchdhook/main.m

[willow lance]

Is there anyone who confirmed ppl bypass on A15/A16 iOS16.5.1?

I’ve got dma with 37c3 bug on iPhone SE2 16.6b1 and iPad mini 6, but on iPhone 13 mini, I cannon even halt and unhalt

[lyric heron]

xina posted it on twitter

[steady nest]

on 16.5.1?

[willow lance]

Do you know the version of xina’s device?

[lyric heron]

#announcements message isn't it this

[steady nest]

the question was specifically a15 and a16 on 16.5.1

[steady nest]

and the answer seems no, there seems to be some issue

[willow lance]

Thanks!

@naive kraken I don’t mean to ask you to release something, but could you tell me did you solved this issue? Thank you

[naive kraken]

no

I only discovered it yesterday >.<

from first look it seems PPL bypass is unexploitable on 16.5.1

writes either fail or you get GFX panic

[willow lance]

Oh my gosh…

[naive kraken]

ah wait

there is also some A15/A16 specific logic that is not in my gist

I'm not 100% sure about the 16.5.1 thing yet

[willow lance]

Speaking about register on 0x206150020, there is no problems. I can set to 1

[slim bramble]

What is tte about 🤔 and why do people always dereference it to a bunch of 41s ?

[willow lance]

41s are “A” in ASCII

When writing in tte, we can know that it worked or not by looking at panic log

[sonic totem]

It’s just tradition to overwrite an address with 0x41 (‘A’)

Easy to see in panic logs + unlikely to be there for another reason

[velvet path]

is there an easy way for somebody to test it?

I know somebody who has an iPhone 12 on 16.5.1

[willow lance]

https://github.com/m1zole/meow16-kfd-pub
how about using this?
(do not forget to press on button!)

[velvet path]

so what would process of testing PPL Bypass be?

[sonic totem]

Build the app + install it presumably

[velvet path]

well yes but what would you do from there - I assume it would be:

• make sure it’s toggled to on
• kopen (with landa)
• I guess press finder?

or am I wrong on that

[sonic totem]

Finder might be to do with the TrollInstaller part of the app

Just kopen I guess

I’ll try now

[willow lance]

Yes!

[velvet path]

ok, let me send to the person I know with an iPhone 12 on 16.5.1

[sonic totem]

Okay my device has run out of battery so I can’t

[willow lance]

You may got error about IOConnectTrap6 when building

Just a minute

[velvet path]

I don’t even think they’re awake at the moment to be honest

[sonic totem]

Anyone happen to have the lockdown mode settings symbol on hand?

This

[hasty ruin]

Think it’s an sf symbol

[radiant idol]

I’m not sure if it’s in there, but if you have FLEX installed, look through PKIconImageCache in the “Runtime Explorer” thing

[sonic totem]

I can just recreate it this way I think

Rounded rectangle + image

[radiant idol]

The main Settings page’s icons are there, I know that

[sonic totem]

It’s in Sw*ft too

[radiant idol]

wa

[sonic totem]

Sw*ftUI

[radiant idol]

where

Why is it sw*ft

[sonic totem]

I have no choice

[hasty ruin]

I feel like the real icon is optically centred

[sonic totem]

Yeah me too

But idk if that even matters tbh

This won't be what they're looking at

How about this

[hasty ruin]

Yeah that’s good

[willow lance]

/System/Library/UserNotifications/Bundles/com.apple.LockdownMode.bundle/Icon.png

[slim bramble]

Oh ok !

[fluid lintel]

But on iOS 16 a binary can't be run from inside /private/var/mobile?

[faint stag]

sandbox will kill it

if it's in containers it will allow execution
which is why roothide uses that (but also to avoid some detection)

[wind ravine]

can u diff headers?

[ashen birch]

this isn’t limited to iOS 16, iirc execution in /var has been limited for a while

(besides containers obviously)

[fluid lintel]

Okay thanks for the advice. In your opinion using a hook on Launchd is it possible to assign the CS_DEBBUGED flag to a process I run?

[ashen birch]

that is something i have no knowledge about

[fluid lintel]

https://github.com/mineek/Serotonin/blob/main/RootHelperSample/launchdshim/launchdhook/main.m
Here if I understand correctly it puts the CS_Platform. Couldn't cs_debbuged also be inserted?

[timid furnace]

it is hooking the result of the csops system call for that process

it won't affect how the kernel actually sees it

[restive ether]

if you put CS debugged on everything i think you just get banned from apps lol

[timid furnace]

launchd complains if stuff isn't platform, that's why it's being hooked to always think things are platform

[fluid lintel]

Ok thanks

[sonic totem]

@willow lance I see you retweeting this

[thin musk]

hii

[void quail]

Is there a way I can inject a dylib during runtime of an app? Or before an app runs?

[slim bramble]

Using a tweak you can

[void quail]

Which?

[olive peak]

does ellekits mshook now work on jailed? i tried it some time back and it didnt even hook

[slim bramble]

A custom made

to do whatever you want to do

if you just want to inject a dylib into an app you can look on google

their is plenty of tools

[void quail]

That's what I did, but tools like opainject dont work

[slim bramble]

Do you want it to be injected at runtime ?

[void quail]

Either that or before runtime

I don't want to do any patches on the ipa though

[slim bramble]

oh

Do you have access to the sources of the library you are talking about

[void quail]

library?

You mean the dylib I want to inject?

if so then yes, I created the dylib

[slim bramble]

yeah dylib stands for Dynamically Linked Library

[void quail]

then what do you mean by this?

[slim bramble]

Perfect is it a theos project ?

[void quail]

yes

using iphone/Library

[slim bramble]

oh

[void quail]

Is that not what I'm meant to do?

[slim bramble]

Are you jailbroken ?

[void quail]

yes

[slim bramble]

You might want to use iphone/tweak

copy paste the code their

And then you set target bundle id to the app you want to hook

At least that's what I would do

[void quail]

so I can't inject dylibs? And have to use tweaks?

[slim bramble]

maybe there is a better way of doing it

[slim bramble]

it's an easier way of doing it, that way it automatically injects 🤷‍♂️

[void quail]

I sorta wanted to stay away from having to manually install multiple tweaks

I was going to make something to inject a collection of dylibs onto an app

[slim bramble]

you can probably use dlopen

[wind ravine]

UH

[void quail]

oh wait

with a tweak?

[wind ravine]

does github make ur email public?

[void quail]

if you allow it to, yes

[slim bramble]

yes sorta

[wind ravine]

i didnt allow it to

i set it to private

how did someone get my personal email

[void quail]

would this still require a tweak? Or can I just make an app that does that?

[slim bramble]

you can see anyone's email by doing git log

[void quail]

data breach or

[slim bramble]

Well what do you want to inject to ?

[void quail]

I want to inject to an app based on the PID provided

[timid furnace]

What email did you configure with git on your computer

[void quail]

or just, from a dropdown of the list of apps you have installed

[timid furnace]

If you don't use the anonymous github one, then yea it'll be visible in commit logs

[slim bramble]

oh

[hasty ruin]

time to rewrite your git history

[wind ravine]

the fricking github site is broken

[hasty ruin]

[wind ravine]

FUCK THE GITHUB SITE

[timid furnace]

No, you just leaked it yourself

[hasty ruin]

Fr

user error doesn’t mean a site is bad

[wind ravine]

no

the website isnt working

[slim bramble]

@wind ravine check your dms

[void quail]

well its either that or typing in the name of the app since I could probably search the PID from there anyways, like for example for filza I would type Filza

[hasty ruin]

if your personal email is that gmail one, I can confirm it’s in your repos @wind ravine

[wind ravine]

BRUG IT WASNT EVEN MY PRIMAYR

[tepid olive]

My real name and location is in my GitHub profile, same with email, cuz you have to do that if you want student developer pack

[hasty ruin]

It’s whatever you used with git config

the GitHub website’s option only controls commits made through that

[tepid olive]

Which you can use completely bogus stuff with btw

[slim bramble]

You need to check noth

[hasty ruin]

Just use the noreply GitHub one fr

[tepid olive]

Mine has me real name cuz I use the GitHub login manager with git

[void quail]

How does Misaka do dylib injection?

I seen they have a dylib injector

[tepid olive]

It doesn’t

[slim bramble]

I don't think it does

[tepid olive]

It just puts them into an ipa

[void quail]

what is this for then?

[young meteor]

lemins club penguin got hacked 😔

[tepid olive]

Lmfao

[hasty ruin]

oh that’ll be an opainject wrapper then

[tepid olive]

Yeah

[wind ravine]

i never played club penguin

[void quail]

How does opainject work? I did try installing it and running through NewTerm but it never worked

[tepid olive]

You can’t use it on semi jb

[wind ravine]

stop

[young meteor]

haveibeenpwned says the email was in there ¯_(ツ)_/¯

[hasty ruin]

dylib needs to be signed with the same team ID as the target process

[tepid olive]

Or in the trustcache

Wtf autocorrect

[void quail]

what if I decrypt the IPA then?

and change the bundle

[tepid olive]

Stop exposing my damn project

[wind ravine]

man why cant i catch a break

everything about me has been doxxed

even my house address

[void quail]

?

what

[slim bramble]

good luck mate

[tepid olive]

Nothing

[void quail]

trustcache?

[slim bramble]

google it

[sonic totem]

A list of cd hashes that are automatically approved during code signing checks

CD hash is a hash of the code directory, which is a list of hashes for every 0x1000 bytes in the binary

This means that every binary will have a unique cd hash

[tepid olive]

Yes

[faint stag]

i mean if you're decrypting it you might as well just load substrate and the tweak

[tepid olive]

oh btw

is anyone here experienced with XNU IPC?

Basically I need to know if a daemon's IPC is handled differently in the kernel

I couldn't find any evidence of that

but something is different

[void quail]

would I be able to just add a folder in the substrate that would load the dylibs? Or would I really have to individually make and install tweaks?

[faint stag]

you'd have to patch the app

[tepid olive]

why are you asking here?? this is for development stuff 😭

[faint stag]

which is what tools like sideloadly/esign do

lmao

[sonic totem]

Arguably this is development stuff

[void quail]

i never used those before lol

[tepid olive]

ok fair enough

[sonic totem]

#jailbreak won’t tell you how to inject dylibs

[tepid olive]

yeah that's true lmao

[void quail]

i dont mind doing that, as long as I can inject them

[faint stag]

just look at azule

[void quail]

are you not able to say the name

[faint stag]

well then, decrypt the ipa and you can export a modified one with sideloadly

[tepid olive]

(specfically the is_table , for some reason the is_table of my daemon is completely empty even though I'm allocating ports)

[faint stag]

no the script i was referring to is named azule

[void quail]

havent used sideloadly before so i was looking to see what advanced options and got this (not my screenshot)

[slender glade]

🫶 ❤️

[void quail]

are you saying i should do the tweak injection? because thats not really what I want to do

[faint stag]

but you asked how to inject a library

that's one way to do it

[void quail]

i want to inject a collection of libraries

[faint stag]

you can

just add them all

[tepid olive]

like I can't find anything not even in the XNU source on github that indicates daemons are any different in this manner

[void quail]

i have to do this everytime?

like, I cant just go to filza and add a dylib?

[faint stag]

well every time you want to make a new ipa yes

[faint stag]

no

because existing dylibs aren't built to work sideloaded

both the library and the apps binary has to be patched

[tepid olive]

ohhh wait

is it because it's running under launchd lmao

[faint stag]

doesn't xpc go through launchd

i was about to say

[tepid olive]

yeah for a daemon it might be different

ugh so does that mean I have to grab the kernel object from launchd's ipc_space instead of my daemon

whatever

except uh

it works fine in an app

doing the same thing

And reading the table size, I get 0x8

yeah I know

PLUS I'm exposing two bootstrap services in addition to the mach port I'm trying to grab

[faint stag]

with a jb this can be done at runtime because we have control of dyld (the dynamic linker) and launchd
so we can just load a library when the process spawns

[slender glade]

bro is humbling daemons

nsurlsessiond killed his grandma 💔

[void quail]

semi-jb too? or just jb?

[faint stag]

just jb

serotonin+bootstrap works by patching
and then signing with the ct bug

[tepid olive]

uint64_t pr_task = get_selftask();
    NSLog(@"Got pr_task!");
    usleep(500);
    uint64_t itk_space = unsign_kptr(kread64(pr_task + 0x300));
    uint64_t port_index = MACH_PORT_INDEX(port_name);
    NSLog(@"Got itk_space!");
    usleep(500);
    uint64_t is_table = kread64_smr(itk_space + 0x20);
    NSLog(@"Got is_table!");
    usleep(500);
    uint64_t entry = is_table + port_index * 0x18;
    uint64_t object = unsign_kptr(kread64(entry + 0x0));
``` it panics where it tries to get object

not sure what's going wrong lmao

[tepid olive]

(with kaddr not in kernel)

[slim bramble]

Do someone know why Theos is fucking renaming my PreferenceLoader file 💀

I am getting trolled

[tepid olive]

unless its because I'm disabling Jetsam, even though that would make no sense

[faint stag]

check the other makefile? idk

[slim bramble]

what about it ?

[faint stag]

what's in it

[void quail]

so then would there be a way to patch the app each time a dylib is added?

[slim bramble]

the main makefile ?

[void quail]

like through a tweak or something

[tepid olive]

no

semi jailbreaks DO NOT have that capability

[void quail]

or by manually using theos to compile

[slim bramble]

trolling git

[faint stag]

you'd need to patch both the app and the dylib
the only way i could think of is having a daemon watching the fs and patching when new files are added

this is not an option with a semi jb lol

[tepid olive]

there's no way jetsam would be causing this, right?!

[void quail]

not having a daemon watch the fs, i meant like, having an alternative app to check for new files and such when the user requests it

[tepid olive]

I didn't think so

[faint stag]

well that's the same thing but with extra steps

[void quail]

exactly

[faint stag]

but then at this point

you're doing the same thing

as esign

lol

[void quail]

ive never heard of esign

[faint stag]

minus the reinstall

[void quail]

i mean

ik it but

[tepid olive]

yeah idk what to do

[void quail]

i basically want to do that, so i dont have to like, manually patch it and such

[tepid olive]

unless iOS has some specific behavior

for daemons

(which would be really weird)

[timid furnace]

whats the issue

[tepid olive]

mah daemon's is_table is empty

[timid furnace]

wat

[tepid olive]

yeah idfk

[faint stag]

app like that doesn't exist. so right now all you can do is

• decrypt ipa
• patch app and tweaks
• sign and install

or

• patch app with app enabler
• install tweaks normally

[timid furnace]

oh its a field in a struct

[tepid olive]

yeee

it's part of the ipc_space

cuz I need to lookup a port's kernel object

[timid furnace]

ios version

[tepid olive]

16.2

[timid furnace]

that sounds familar

[tepid olive]

why

[timid furnace]

reasons

[tepid olive]

hm

anyways do you know the issue

[timid furnace]

your code looks lifted from kfund

correct?

[tepid olive]

like it doesn't-

no

I made it

[timid furnace]

kread64_smr looks familiar

[tepid olive]

the libkfd I didn't make myself though

however I did make that function

[timid furnace]

yea so you're using kfund kread64_smr, ok

[tepid olive]

YES because those offsets work not in a daemon

[timid furnace]

device?

[void quail]

app enabler?

[tepid olive]

uh well because UH well ok it's [REDACTED]

[faint stag]

do you only have trollstore or do you have serotonin?

[void quail]

i have both

[timid furnace]

?

[tepid olive]

sorry, r/jailbreak would go into a frenzy if I told you lmfao

[timid furnace]

[tepid olive]

yeah that's why

[timid furnace]

i dont get it

[tepid olive]

I DMed them the device

[faint stag]

there should be something called appenabler in the bootstrap app

[void quail]

Ohh you mean that

the "enable tweak for app"

[timid furnace]

i still dont get why this device is special but ok

[tepid olive]

DMed more info

[timid furnace]

yea i saw

anyways

[faint stag]

yeah, that does basically what you want
(with a few minor side effects) but yes

[tepid olive]

all of that is besides the point

[timid furnace]

every day i am thankful for appledb being indexed on google

[faint stag]

seo on top

[timid furnace]

i still have to add in "appledb" but still

thank god

[tepid olive]

the point is, is that I have an issue, that seems to be completely arbitrary

like there's no reason it shouldn't be working, and there's no info as to why it couldn't be working

so like ¯_(ツ)_/¯

[timid furnace]

2c41537 still cracks me up

anyway

your is_table value is probably wrong

[tepid olive]

but then why does it work not in a daemon

[void quail]

would the second option be a better idea then? except like, develop an app to handle all the tweak installing based on files in a directory if they werent already installed? (ik Sileo, Zebra, and others exist, but want to handle things differently)

[faint stag]

you already have bootstrap

[void quail]

or would it just be better to patch the ipa

[timid furnace]

placebo

[tepid olive]

plus it does the same thing if I try to read the daemon's is_table from a normal process

[timid furnace]

read it for a bunch of processes and see how often it works

[tepid olive]

but if in that process I use the same offsets and everything, then it works

[faint stag]

once ellekit is installed and the app is enabled you can just load tweaks from jbroot/Library/MobileSubstrate/DynamicLibraries

man

[void quail]

oh really

do tweaks load automatically from there? or

[faint stag]

yes

[void quail]

okay great

never mind then

[timid furnace]

is there supposed to be a Library in here

[faint stag]

yes

[tepid olive]

well actually

hmm

[timid furnace]

ok thank god

was thinking roothide changed something in their build

[tepid olive]

could it be because I explicitly define MachServices?

in the daemon plist

[timid furnace]

no

[tepid olive]

although again, that doesn't make sense

[timid furnace]

again

try it on a bunch of different processes

i think you'll notice something

[tepid olive]

wdym??

what would I notice

also I can't do that

panics if it fails

[faint stag]

but yeah that would resolve to /var/mobile/Containers/Bundle/.jbroot-$(jbrand)/Library/MobileSubstrate/DynamicLibraries

lol

[tepid olive]

perhaps I should try using allproc to find it??

[faint stag]

long ass path 💀

[tepid olive]

if that's still a thing

nvm

I might see the issue

[agile wing]

hey everyone, is there a guide to get started?

also will Linux work? I know apples a bit picky about using macs for dev

[tepid olive]

depends on what you want to dev

if it's tweaks, then linux is fine yeah

[agile wing]

alright cool

where would I start reading?

[tepid olive]

https://theos.dev

[agile wing]

cool thanks

[void quail]

yes

[faint stag]

for tweaks it'll work fine
though developing an app will be a bit more time consuming

[unique wedge]

binaries with specific entitlements can run in /var/(mobile). But the kernel blocks mmap so it cannot load any libraries in /var/(mobile), this can be solved with some kernel hacks, but there is no guarantee Will be available in a future ios version. ref to jakejames' rootless writeup: github.com/jakeajames/rootlessJB/blob/master/writeup.pdf

[unique wedge]

ye, binaries in /var/containers/Bundle/ can be executed and are sandboxed by default.

[timid furnace]

does that mean binaries that are not executed from /var/containers are not sandboxed by default?

binaries without any unsandboxing entitlements

[faint stag]

i mean, outside the sandboxed dirs you'd need to ct sign still don't you

else you'd get killed 9 due to codesigning

[timid furnace]

sure, but theoretically, what if i signed validly but with a developer cert and dropped it somewhere outside of /var/containers

[faint stag]

sandbox should still block reads and writes to sandbox dirs i believe
at least without the entitlement

anywhere else should just work unless it's a permissions issue

[timid furnace]

hm

[faint stag]

could probably test that with a semi-untether

since checkra1n has sandbox destruction built in

[timid furnace]

well, not even

you just need TS

[faint stag]

true
jb would make the first few steps easier tho

[timid furnace]

Filza to drop the binary wherever you need and a terminal app to call posix_spawn

[faint stag]

hmm
maybe build bash (or zsh even), sign it
then just use scripts for whatever you want to test maybe?

but forking tho if that's an issue
and that would need a few calls to other binaries anyway

though if [[ ]] has some pretty useful test options

[tepid olive]

@naive kraken Oh actually, I've had this issue and fixed it! In the normal pplrw.m we use (kfund's), A15 and A16 are broken because they're missing something from Xina's coresight (there's an extra register in there you have to write if you're on A15 and A16.)

[naive kraken]

that's not the issue

we have that

[tepid olive]

Alright

just thought it might be, because I encountered this on 16.5 where writes wouldn't work unless I added that

[lean ermine]

anyone know how appex files are packaged with apps/how to sideload them

[tepid olive]

sorry for the ping in that case then