#development

1 messages Ā· Page 125 of 1

lean ermine
#

i'm building a safari extension from source and struggling to include the appex

naive kraken
#

this specific thing seems like it doesn't work on 16.5.1

#

like it causes GFX panics apparently

#

so maybe <=A14 work on 16.5.1

tepid olive
#

Ah, weird, sometimes I'd get the occasional GFX panic, but it usually wouldn't happen

faint stag
#

well once you get the ipa, appextensions should just be in the payload as PackageName/PlugIns/extension.appex
with an info.plist and a nib or other files

hence the name, extensions have to be built with a main app binary as well

lean ermine
#

it is included.. dunno why it isnt showing up šŸ˜¦

#

is this a trollstore limitation?

#

these show up for like a single frame

#

openyoutube and unagent

#

unagent is what i am trying to sideload

#

openyoutube is just another app extension im guessing is sideloaded with youtube++

#

does trollstore not support app extensions

#

i see it does not as they are system apps

#

interesting

faint stag
#

well

#

you can temporarily switch to user registration

lean ermine
#

do they work until reboot or do they not work

#

opa made a comment on this reddit saying they dont work

#

lol

faint stag
lean ermine
#

it does not work

#

kinda sad i wonder if there is any way around

unique wedge
#

yes, binaries in paths other than /var/containers/Bundle/ will not be sandboxed by default (such as preboot), but the kernel will refuse to execute binaries without unsandbox entitlements in /var/ (including /var/containers/), this is my test result on ios15. but I am not sure what the policy is for /Applications/ in rootfs since we cannot modify it on ios15.

lean ermine
#

do they not work because they aren't signed with the main binary or because of a system app incompatibility

faint stag
lean ermine
#

makes sense

#

rip

#

guess my cert is still valid for like 2 months

unique wedge
#

and due to the system policy of the kernel, the platform binary cannot spawn the binary in /var/, so the daemons/apps in /var/ will not be able to launch. this can be solved by re-signing the system binary.

#

and another interesting thing is that if the app is registered in /var/, then launchd will use xpcproxy to launch the app.

lean ermine
#

yea sideloading w cert fixed it

#

maybe i do need appsync lol

faint stag
#

yeah i mean

#

sideloading with a cert is how apple intends development to be done

lean ermine
#

go figure

#

lol

#

seems like this app cant even change my user agent anyways so i guess it didnt matter anyways lol

#

anyone know if there is a tweak to change user agent on safari :p

#

on ios 16

faint stag
lean ermine
#

it is i can't find any free one though

faint stag
lean ermine
#

thats what i just built

#

doesn't work and seems to not work for anyone else in the app store reviews

#

not sure why though

#

probably something to do with ios 16

faint stag
#

then you're probably limited to just browsermask

lean ermine
#

dam 3.99 but does seem to be what i need lol

#

ty logos linted

faint stag
#

or a browser that's not safari

#

actually could've thought of that yeah

lean ermine
#

orion would be a much simpler solution i just got hyper fixated on using safari lol

#

also does anyone in here know if there is a vnc server that works on newer ios? veency exists but i'd be astounded if it still works after 6 years of no commits

faint stag
#

but it's been patched up like 3 times over since the ios 14 release

lean ermine
#

interesting

restive ether
#

i use that UA switcher it absolutely works

lean ermine
#

what ios are u on wtf

restive ether
#

17.4

lean ermine
#

bruh

#

is the github version outdated i wonder

faint stag
#

i mean the commits are only from a few months ago

lean ermine
faint stag
#

well then it's working

restive ether
#

what a dick move to give it a one star

faint stag
#

the agent string isn't the only way to detect a device like they say

lean ermine
#

i was using a user agent checker and it wasn't showing any difference but ill try again

faint stag
#

nor is it reliable

lean ermine
#

yeah it doesn't change for me :/

restive ether
#

definitely works

IMG_3283.png
lean ermine
unique wedge
#

a symlink to /usr/lib/TweakInject

restive ether
#

you didnā€™t restart safariā€¦

lean ermine
#

i did

restive ether
#

did you even enable the extension?

lean ermine
#

yep

#

no need to patronize lol

restive ether
#

then you definitely set it up wrong

lean ermine
#

ok

timid furnace
lean ermine
#

@restive ether

unique wedge
timid furnace
#

got it

faint stag
#

and ellekit builds off libhooker which is why we still have tweakinject trol

timid furnace
#

wat

faint stag
#

isn't ellekit fully compatible with libhooker functions

timid furnace
#

same with substrate and substitute

faint stag
lean ermine
timid furnace
#

i lied no substitute shims

#

but same with substrate

faint stag
#

and the /usr/lib/TweakInject folder was just what libhooker used then symlinked for compat reasons

lean ermine
#

reboot fixed the app

restive ether
lean ermine
#

its 4:30 brother u got bigger enemies than me

restive ether
#

thatā€™s later than usual

lean ermine
#

go to rehab

restive ether
#

why would i do that

#

city boys we up

native dune
#

Proc soc on top

lean ermine
#

nebula do u know if ur tweak ding has the ability to use mute module in control center while the mute switch has its own function šŸ‘‰šŸ‘ˆ

#

currently if its set to force either way the mute module cant change mute status

tepid olive
#

@sonic totem ok so your idea did something, because now when panicking, instead of AMCC PLANE1 or AMCC PLANE2 it's always AMCC PLANE0

sonic totem
#

Very interesting

#

The writeback is still happening though

#

Presumably

slim bramble
#

AMCC ? PLANEX ?

#

What are those ?

sonic totem
#

AMCC = Apple Memory Cache Controller

tepid olive
#

yeah

slim bramble
#

Oh

#

thanks

tepid olive
#

oh no I'm about to be scolded

#

(jk)

tepid olive
#

even though I'm constantly reading it in a while true loop in a seperate thread

#

perhaps at some interval it's forcibly written back?

sonic totem
#

Quite possible

#

I don't know enough about this to be sure

tepid olive
#

although interestingly

#

it says the panicked task is my task

#

Actually it would normally say that

sonic totem
#

yeah

tepid olive
#

maybe I can somehow freeze the AMCC

naive kraken
#

or is it instant?

tepid olive
naive kraken
#

it would not

#

a standardized API to get the root path

#

roothide has it's own thing

#

I will get to that really soon

tepid olive
# 
 dma_perform(^{
        uint64_t thing = 0xfffffff00832be94 + get_kernel_slide();
        dma_writevirt32_premapped(thing, (uint32_t *)&mov_x2_afce);
        dma_writevirt32_premapped(thing+4, (uint32_t *)&paciza_x2);
        dma_writevirt32_premapped(thing+8, (uint32_t *)&str_x2_x0);
        dma_writevirt32_premapped(thing+12, (uint32_t *)&ret);
    });
    uuid_generate_time(ourbuf);
    ksigned_afce = (void *)kread64_kfd((uint64_t)ourbuf);
    NSLog(@"Signed afce: %p",ksigned_afce);
    pthread_cancel(posixThreadID);
    asm("IC IALLU");
#

(I overwrite uuid_generate_time)

#

the IC IALLU is to invalidate all the instruction caches

#

although I'm not even sure whether or not that instruction works in userspace yet

naive kraken
#

can't think of anything rn

#

Rootless V2 will likely have a "libroot" that jailbreaks ship

#

then there will be a .a that people can link (This is very small and only handles finding libroot and dlopening it) and preprocessor macros to convert paths

#

and this will be integrated into theos

#

I have no clue how roothide does anything currently

tepid olive
# tepid olive ```objc dma_perform(^{ uint64_t thing = 0xfffffff00832be94 + get_kernel... 
void *preventwritebackthread(void *notusing) {
    NSLog(@"Entered the writeback prevention thread!");
    uint64_t _uuid_generate_time_addr = 0xfffffff00832be94 + get_kernel_slide();
    uint64_t start = 0xfffffff00832be94;
    uint64_t end = 0xfffffff00832c018; // Also static for testing purposes.
    uint64_t size = end - start;
    NSLog(@"Size: %d",size);
    sleep(1);
    void *gotome = malloc(size);
    bool hasalreadyprinted = false;
    while(true) {
        kreadbuf_kfd(_uuid_generate_time_addr, gotome, size);
    }
}
#

wait

#

I forgot to remove a sleep

#

I bet that's the issue lmfao

topaz yew
#

@willow lance save us

tepid olive
#

lmao what

willow lance
#

Iā€™ve interested in this bug for a several years and I want to find it!
Because of this bug is faster than any other bugs

topaz yew
tepid olive
#

for the record, this is mostly an experiment

#

I just want to see if I can sign a pointer in the kernel lmao

#

if I can then kcall

#

if not then

#

oh well

naive kraken
#

the problem is we don't know if there is any way to revert the writes without panicing

#

so even if you could get kcall it wouldn't be for very long šŸ˜›

tepid olive
#

well invalidating the cache should do that

#

invalidating the cache marks everything as "invalid" which means they can't be written back, so the cache gets reset without writing to the DRAM

tepid olive
#

(or written to)

velvet path
#

technically roothide and rootless (even after rootless v2 is implemented) will be different things in regards to what paths they use to my knowledge

tepid olive
naive kraken
#

roothide will still be it's own strap

tepid olive
#

and AARCH64 conventiently has the instruction IC IALLU which invalidates all instruction caches

velvet path
#

it's still a separate thing to rootless even after rootless v2

tepid olive
#

which (should) theoretically make it so it doesn't get written back and the cache is reset

velvet path
#

RootHide and rootless v2 are not the same things whatsoever

naive kraken
#

I think you have a misunderstanding of what roothide is

#

Dopamine 2.0 does not do anything to hide the jailbreak on it's own

#

That will only be used by external packages

#

The bootstrap itself has it's own idea of what the root path is

#

yes

#

Yeah but after the arch merge is done I think it should be an option

tepid olive
naive kraken
#

I even offered tuan to integrate it as an option into Dopamine later

tepid olive
#

I can't get it to do anything lmao

naive kraken
tepid olive
#

ah I see

cloud yacht
#

wait is a rootless v2 strap able to load rootless v1 packages?

velvet path
#

then what are you doing? I'm confused.

cloud yacht
#

or do we need to rebuild all our packages?

hasty ruin
naive kraken
#

rootless yes

velvet path
cloud yacht
#

yeah I haven't done roothide

tepid olive
#

this time I got a kernel data abort, what?

cloud yacht
#

(nor do I care too)

#

thats neat then

#

won't get some thing of people hacling packages to work on the new format and getting bugs

#

I'm assuming rootless v2 packages don't work on a rootless v1 strap (aka current dopamine/pailra1n)

sonic totem
tepid olive
#

anyways I should probably just suck it up and just figure out why the is_table is empty on daemons lol

radiant idol
#

RH is the nuclear option for when nothing else works, so I guess it would be nice to have as an option

hasty ruin
#

Would be the best gif

tepid olive
sonic totem
tepid olive
#

I'm just kidding

hasty ruin
sonic totem
#

Better start researching this stuff

hasty ruin
#

fucking poshie

cloud yacht
naive kraken
#

looks good

tepid olive
#

ugh we're making another jb standard?

#

Does that mean I have to adjust my (in progress) jb?

naive kraken
tepid olive
#

alright

cloud yacht
radiant idol
#

i hope this is the last time it changes though, the amount of fragmentation is getting a little annoying

tepid olive
#

should probably delete that message before the whitenames see it...

velvet path
#

so iphoneos-arm64 roothide will still be an option?

naive kraken
# tepid olive alright

and it will be backwards compatible, rootless v2 packages will still work on rootless v1

tepid olive
#

oh alright cool

naive kraken
#

(just not on roothide)

cloud yacht
#

oh neat

sonic totem
cloud yacht
#

so its backwards compatible both ways

sonic totem
#

How am I posh

hasty ruin
tepid olive
#

uhm

#

I appear to be getting a kernel data abort near the address I'm writing to for some reason

sonic totem
#

Wait this server has AutoTSS?

naive kraken
tepid olive
#

not sure

#

it's closer to the kernel base than where I'm writing to, but

radiant idol
#

no

naive kraken
#

no

radiant idol
#

RH has had its own fork of theos, that's why the adaption rate isn't that great

sonic totem
naive kraken
#

I will PR rootless v2 into theos when it's done

tepid olive
#

0xfffffff0118c7e94 this is where I'm writing to
0xfffffff0112db548: this is where I'm getting the kernel data abort

#

idk if they're related

naive kraken
#

sorta yeah

velvet path
#

for non-bootstrap packages yes

radiant idol
#

I really just hope this is the last time this happens, it's getting annoying with all the arch changes, hard to keep up :P

sonic totem
#

So Iā€™m not sure

tepid olive
#

but wouldn't it be like a kernel instruction abort, if it was something related to what I was doing?

sonic totem
#

Yes ā€œundefined kernel instructionā€ I believe is the panic log youā€™re looking for

tepid olive
#

yeah

naive kraken
#

uh

#

idk yet

sonic totem
#

If you overwrite with a bad instr

naive kraken
#

I think it will be the same

#

ideally people that already updated for rootless will only need to recompile

tepid olive
#

my way of getting them to my pc

sonic totem
#

@tepid olive I canā€™t remember for certain but I feel like kernel data abort can happen with kfd

tepid olive
#

yeah that's probably the issue lol

sonic totem
#

If you can reliably trigger it though then itā€™s probably not

tepid olive
#

yeah it happens everytime

#

I wonder if it's because I write and constantly read at the same time?

#

maybe it doesn't like that

sonic totem
#

Shouldnā€™t be the issue

#

Youā€™re on separate threads right?

tepid olive
#

yeah

sonic totem
#

Then I doubt thatā€™s the issue

tepid olive
#

should I try just overwriting stuff with 41 to see what happens lol

sonic totem
#

Agreed

#

Or like some magic value

#

Also Iā€™m surprised Iā€™ve never seen you around, you seem to know your stuff šŸ˜…

#

How long have you been working with iOS?

tepid olive
#

uhm

#

like 2 weeks

#

lmfao

sonic totem
tepid olive
#

but I have background in Nintendo Switch RE

sonic totem
#

I need to step up my game

sonic totem
#

Was gonna say

#

Learning all that in two weeks would be a challenge

tepid olive
#

yes it would've been, thankfully I already had AARCH64 ASM memorized

#

I've also read like alot of iOS security research writeups in the past 2 weeks

sonic totem
#

Ah Nice

#

What have you read?

tepid olive
#

Some of the *OS internals books, the Fugu15 writeup, coolstar's jailbreak presentation, the PACMAN writeup

#

uh

#

some other stuff

#

a bunch of Project Zero writeups

sonic totem
#

Very nice

#

Fugu14 writeup is also nice

#

Siguzaā€™s blog is great too

tepid olive
#

oh yeah I've read some of them too

#

the KTRR and the APRR ones I believe

sonic totem
#

Thereā€™s a KTRR one

#

Yup

#

Siguza has a repo for this

tepid olive
#

oh yeah and I've also read through some XNU source and the KTRW source as well as Fugu15 source, Fugu14 source and async_wake source, taurine source, undecimus source

sonic totem
#

Learning a lot very quickly then

tepid olive
#

and I think voucher_swap source?

sonic totem
#

I really need to get into kernel exploitation

tepid olive
#

PAC is my worst enemy

sonic totem
#

Even just messing around with kfd + PPLRW

tepid olive
#

that's the big thing I've gathered so far lmao

sonic totem
#

I mean

#

PPL is more of an enemy tbh

tepid olive
#

yeah, but PAC is more of an annoyance

#

than an actual roadblock

sonic totem
#

PAC you only need if you want to kcall

naive kraken
#

But I don't have the time for it lol

sonic totem
#

Yeah but you already know what youā€™re doing :P

tepid olive
sonic totem
#

I need to familiarise myself with how stable r/w and PPLRW works

tepid olive
#

like OOL mach messages

prime ingot
#

guys I know how to uninstall ios

sonic totem
#

Unless you need kcall for a subsequent PPL bypass

tepid olive
#

I mean in my first week of doing this, I achieved iOS 16 arm64e trustcache injection

sonic totem
#

Oh my

#

Very nice work indeed

tepid olive
#

thank ye

sonic totem
#

Did you take a page out of the existing Dopamine source?

tepid olive
#

eh actually more DNAJB

sonic totem
#

Ah of course yes

#

Forgot that that existed

tepid olive
#

actually KpwnZ has been working with me alot

sonic totem
#

There were some trustcache offset changes between 15/16 iirc

sonic totem
tepid olive
#

yeah, I also had to ask them how to patchfind the pmap_image4_trust_caches offset

#

because I searched for days

willow lance
#

Iā€™ve made it

#

Due to school, I cannot push it

naive kraken
tepid olive
tepid olive
sonic totem
tepid olive
#

because that's what it used to be called

willow lance
sonic totem
#

Ah very nice

tepid olive
#

alright lets see this panic log

#

not a single 41 in sight

sonic totem
tepid olive
#

it probably is because I read and write at the same time

#

except there's no other time to start the thread

#

I would need to time it to perfectly line up when I finish writing

#

wait what

#

I get kernel data abort even when I don't do them at the same time???

#

oh

#

wait

#

it doesn't seem to like me precalculating the ECC hashes

slim bramble
velvet path
#

@marble perch so would it be fair to say/confirm that RootHide will transition to rootless v2 based on what has been said here or is that still not finalized and could change depending on how things go?

tepid olive
#

lemme try just jumping to this address and seeing what's there

wind ravine
#

how can i get flex to select something that it cant?

#

i tried looking through headers but i cant find what i need

tepid olive
velvet path
#

to both you and @unique wedge: would I be in the clear to announce this now that this is seemingly definitely happening

#

that's the goal

slim bramble
wind ravine
#

that doesnt work

#

it doesnt appear in the views

#

nor in a snapshot

slim bramble
#

Click full hierarchy ?

wind ravine
#

its like it ignores the status bar stuff entirely

tepid olive
#

what the fuck is this decompilation lmao

image.png
wind ravine
#

is it possible to diff headers?

slim bramble
#

Idrk then šŸ¤·ā€ā™‚ļø

wind ravine
#

i just wanna remove these damn page dots

radiant idol
wind ravine
#

problem is

#

idk which header its from

#

idk the class name

slim bramble
#

@radiant idol when do you sleep ?

radiant idol
#

uh

#

like

#

2 am

tepid olive
slim bramble
radiant idol
#

EST

slim bramble
#

Ohhh

tepid olive
#

Right now I'm also not sure of all the things that uh PPL protects

#

I know it protects page tables

fiery seal
#

If the PPL bypass still hasn't been tested fully on 16.5.1 <=A14, and public help with testing is still available, @ember cypress has offered to test with their iPhone 12PM on 16.5.1. I'm not familiar with the current state of testing, so apologies if this isn't necessary

tepid olive
#

I know it protects the trust cache

wind ravine
#

why does flex not work well on ipads

tepid olive
unique wedge
slim bramble
#

Maybe this will help you

velvet path
# unique wedge what?

@marble perch to avoid miscommunication, do you want to summarize everything to tuancc

unique wedge
velvet path
#

@unique wedge this looks like a good tl;dr of what the plan is though

unique wedge
#

rootless v2?

velvet path
#

yes

#

RootHide using rootless v2

unique wedge
# velvet path yes

opa hasn't released it yet, and I don't know much about the specifics of it

cloud yacht
#

what if we had a rootless v2 thread?

#

Might be nice to have a spot for discussion about it, especially if its still being worked on

unique wedge
velvet path
#

using iphoneos-arm64 with the definable root path

unique wedge
velvet path
ashen birch
radiant idol
#

wat

ashen birch
#

since basically no 17.x arm64 devices

velvet path
unique wedge
ashen birch
#

okay nvm then

#

i def havenā€™t paid much attention

radiant idol
#

this stupid arch naming scheme is such a pain

velvet path
#

also I donā€™t even think thatā€™s supposed to be public fr

ashen birch
#

in todo iirc

velvet path
ashen birch
#

meh itā€™s limited to proc contributors

#

i only view [redacted] as private

acoustic imp
#

help, it just randomly started doing this

image.png
ashen birch
#

anyways w/e forget i said anything

unique wedge
ashen birch
acoustic imp
velvet path
radiant idol
acoustic imp
#

oh ok

#

but it wokred like few minutes ago

unique wedge
#

rh will definitely provide rootless v2 compatibility, just like it is currently compatible with most rootless v1 packages, but in what way it will be implemented, I can only figure it out after the implementation of rootless v2 is finalized.

tepid olive
hasty ruin
unique wedge
radiant idol
#

how many times are we gonna change the arch bruh

#

not all rootless devices are arm64e

velvet path
radiant idol
#

yes

#

a couple ipads

velvet path
#

iPadā€™s, Apple TVā€™s, a HomePod

radiant idol
#

iphoneos-arm-rootless would've been a far better solution

#

but welp

unique wedge
velvet path
unique wedge
unique wedge
radiant idol
#

roothide already burned the iphoneos-arm64e arch, trying to reuse it would be a pain

#

idk im not the one in charge of this

velvet path
#

they believe itā€™s not burned or something

#

I donā€™t know whatā€™s up with that

radiant idol
#

it's burned, idk why people would think it isnt

velvet path
radiant idol
#

I just dont get why some people are so insistent on changing core aspects of jailbreaking

#

how many times can we change the arch

velvet path
#

I mean arch would make sense if it was actually used properly

#

but it hasnā€™t since like iPhoneOS 3 or iOS 7 depending on how you look at it

radiant idol
#

the names are so misleading

#

it's sad

tepid olive
radiant idol
#

thats a whole another story

velvet path
tepid olive
#

arm64e is just apple's name for the v8.3 revision of armv8 lmfao

velvet path
#

(more like itā€™s a mess but whatever)

tepid olive
#

why make it a different arch

radiant idol
#

look at the theos server

#

and

#

from:nightwinddev iphoneos-arm64e

#

grab a cup of popcorn

#

and read

tepid olive
#

I've got better things to do

radiant idol
#

rip

tepid olive
#

like switching disassemblers

#

to cutter

#

because ghidra sucks because it's written in Java and Java sucks

faint timber
#

nope, wrong

tepid olive
#

I want to use binja

#

but I don't have $75 woeis

faint timber
#

but java doesn't suck

tepid olive
#

it does to me

#

if you want a language like Java, just use C#

faint timber
#

never touched c# really

tepid olive
#

it's much faster

#

its runtime (.NET) is anyways

faint timber
#

java isn't as slow as people think it is

tepid olive
#

Ehh.

#

Java doesn't have C interop does it

hasty ruin
faint timber
#

it has a bad binding system but it does exist

tepid olive
#

C# has a good one

#

although I guess you could make the argument that Java is more cross platform

fiery seal
#

java is fine

tepid olive
#

but nowadays with .NET Core, C# is just as cross platform

#

one nice thing about cutter though is that it automatically identifies classes

#

and their names somehow

velvet path
#

Iā€™m confused what you mean by this

unique wedge
#

yes i don't want to be in rush now

#

It depends on the implementation of rootless v2, if it provides less compatibility, or full compatibility is difficult, then using a separate arch may be a better choice

velvet path
#

I guess my point is to suggest that we should make an announcement that that is the plan in order to potentially reduce the number of developers who are hardcore adopting iphoneos-arm64e as if it is the definitive future when itā€™s probably not

velvet path
unique wedge
velvet path
#

basically as long as the package is updated to support rootless v2, it should technologically be able to support current traditional rootless and updated RootHide

unique wedge
velvet path
velvet path
#

the point is that the goal is that RootHide can use rootless v2 and support all rootless v2 packages

unique wedge
# velvet path we know RootHide is more than just what rootless v2 will offer

there are some differences in rh, 1) path expression in the configuration file, 2) bootstrap's access to rootfs 3) the way tweak and bootstrap interact with paths 4) PATH environment variable 5) jailbreak root path that is re-randomized every time 6) tweak the persistent storage of paths
so I said that only after the implementation of rootless v2 is finalized, then we can evaluate how to make it compatible with rh

unique wedge
lean ermine
velvet path
#

this isn't true

#

Dopamine 2.0 will support existing rootless packages

unique wedge
# velvet path Dopamine 2.0 will support existing rootless packages

oh bad, there is another problem there, dependencies package.
for example, now I have ported libsandy/preferenceloader to rh, and some tweaks that have been updated for rh already work correctly based on them. so what should we do when rh is compatible with rootless v2?

tepid olive
#

hey @naive kraken hope you don't mind me asking a question, but why in Dopamine, do you launch jailbreakd using XPC messages to launchd instead of launchctl? Is there a specific reason, or is it just personal preference

naive kraken
#

codesigning is still active

#

besides y'all are living in the past

tepid olive
#

Huh, I wonder why my jailbreakd loads fine with launchctl lmao

unique wedge
naive kraken
#

jailbreakd??? what do you mean

IMG_0024.png
tepid olive
#

oh I just have a seperate launchctl binary embedded into my bundle that gets signed with the main binary with trollstore lol

tepid olive
#

you get the point

velvet path
steady nest
unique wedge
steady nest
#

or is bootstrap here not the procursus bootstrap but some other thing

tepid olive
#

Except I'm still trying to figure out why my daemons ipc_space is empty, like, are its mach ports managed by launchd or something?

#

(I have read some things that say that, but I could just be misunderstanding)

velvet path
naive kraken
tepid olive
#

ah I see

#

that's a good idea, I was only doing it this way to keep with the standard dopamine set lol

velvet path
#

random question: does dnajt use jailbreakd or launchd

tepid olive
#

I should probably use launchd though

steady nest
velvet path
tepid olive
#

I assume you insert a hook dylib into trustcache, use opainject to inject into launchd, and do stuff from there, right?

velvet path
#

anything to do with rootless v2/roothide/archs is the hardest thing to follow in existence

tepid olive
#

Also I don't think I'm supposed to be compiling jbd with theos

#

not that that's related

#

Like I mean what are the benefits of using launchd over jbd?

steady nest
#

launchd is pid 1 and the "parent" of userland in iOS

naive kraken
tepid olive
naive kraken
#

jbd is no longer feasible in iOS 16

tepid olive
#

Yeah I may have noticed that

naive kraken
#

too many processes can't contact it

tepid olive
#

I just was trying to keep a standard lmao

#

alright I'll do the "new way"

velvet path
#

standards are a foreign concept at this point

naive kraken
#

but WebContent cannot even contact launchd on iOS 16 -_-

velvet path
naive kraken
tepid olive
#

WebContent can't contact anything, isn't it like the most locked down userspace process

#

has it's own pac stuff and everything

velvet path
#

so basically webcontent injection is just dead?

naive kraken
naive kraken
#

you could still make it work

#

it'd just be very hacky

void quail
#

does bootstraps automatic tweak injection require a decrypted ipa to have the tweak be injected?

velvet path
#

I guess it's time for the hacky solution

naive kraken
#

maybe it works over raw mach, I haven't tried that yet

#

because it's one specific check that fails

#

it might be something where WebContent can send messages but cannot receieve them

void quail
naive kraken
#

and because of XPC being bidirectional it fails

tepid olive
#

just patch it out, isn't WebContent's PAC bruteforcable if you have root access?

naive kraken
#

you can't really patch it out

#

it's sandbox

tepid olive
#

oh true

unique wedge
#

we should still maintain compatibility with existing rh tweaks, obviously it's difficult to ask everyone to rebuild all packages at once

velvet path
#

that's just probably not going to happen and is not reasonably feasible

hasty ruin
sudden heron
#

leave the daemons alone

lime pivot
#

I don't think it is yet

velvet path
#

iirc it isn't

unique wedge
#

but not all rootless v1 packages will be updated to rootless v2 immediately. If the rh user installs a rootless v2 dependency package(such as libsandy), the installed rh tweak may be broken, and if this tweak has not been updated for rootless v2, then users will not be able to use this tweak in anyway

velvet path
#

I think you're confused

#

rootless v2 and rootless v1 are iphoneos-arm64

#

current roothide is iphoneos-arm64e

native dune
#

balls

velvet path
#

this entire blob here

#

oh

unique wedge
#

so in this case rh users will not be able to smoothly migrate to rh v2, they will have to completely uninstall the installed environment and reinstall and configure everything

#

and there is still a problem. If a dependent package has not been updated for rootless v2 (some dependent packages may be closed source), then developers will not be able to update to rootless v2 for tweak

velvet path
#

pretty much any dependency package that has been updated for rootless is actively maintained

#

so that really isn't an issue other than maybe the first little bit

velvet path
#

either way the goal is to move off of iphoneos-arm64e - even if the arch was just changed to iphoneos-arm64-rh and nothing else it would still be the same way

ocean raptor
#

Someone give me the cliff notes once this discussion finishes pls, I donā€™t want to read allat

#

Ok šŸ‘

cloud yacht
velvet path
#

rootless is not changing arch-wise

void quail
#

do tweaks (bootstrap using ellekit) work with signed apps from app store or do I have to decrypt the ipa and install it through TS? When I tried making a tweak with a filter for an app, it doesn't seem to be "injected" or ran

acoustic imp
#

any logs?

#

and you enabled tweak injection into the specific app?

void quail
void quail
#

idk if im creating the tweak incorrectly, I do see that these modules are loaded in the app though:

roothideinit.dylib
bootstrap.dylib
libroothide.dylib
libinjector.dylib
roothidepatch.dylib

but I dont see any mention of my tweak there, unless thats intentional?

lean ermine
tepid olive
#

NƵ

opal quiver
subtle scaffold
#

Theoretical question: in order for other places in the world to access the EU side-loading, would it require the use of basic bypasses (profiles, supervision,etc) or would it require the use of exploits (Kernel, CoreTrust,BootRoom,etc)?

timid furnace
#

(which makes it practically useless, except if they only check for stuff at install time and not at every launch)

radiant idol
#

Every launch sounds brutal

granite frigate
unkempt magnet
#

CVE-2024-23208 PoC

sonic totem
#

yeah

#

pretty cool

slim bramble
#

Damnnn

sonic totem
#

If youā€™re manually injecting

serene hawk
#

i got the pointer address to a swift ivar, however when trying to use the address explorer in flex the app crashes

#

anyone knows whatā€™s wrong there?

radiant idol
#

I think thatā€™s just a swift L

slim bramble
#

Idfk

radiant idol
odd timber
#

šŸ‘€šŸ‘€

serene hawk
#

@radiant idol

hasty ruin
#

fuck swift

radiant idol
#

I donā€™t think youā€™ll be able to grab that

serene hawk
#

alright thanks though

#

i hate swift

steady nest
#

no

#

stop it

tepid olive
#

Yeah it isn't lmao

granite frigate
#

what

#

??

hasty ruin
odd timber
radiant idol
odd timber
fluid lintel
#

But one is a race condition the other is a memory management error. They are exploited in very different ways.

odd timber
fluid lintel
#

šŸ‘

radiant idol
odd timber
granite frigate
#

:p

#

KFD is a physical use after free that uses a uaf that points to physical memory to set up krw primitives
MDC is a race condition in the vmap layer of iOS that allows you to write to read-only mapping. it doesn't do anything else

#

if you want to learn more about the MDC bug, ian beer has a talk about it

granite frigate
# granite frigate

one part that i'm curious about is what kernel data structures actually have pointers to physical memory addresses

#

all of kfd is related to the l3 page table

odd timber
#

And technically what we've just seen isn't an exploit so to speak. It's just proof that it can be exploited

slender glade
granite frigate
#

Man

tepid olive
#

Execute code with kernel privileges?

#

That's different than both kfd and MDC

#

That's called a LPE

#

I think

uneven pulsar
#

is it an LPE or a krw

tepid olive
#

Fairly sure it's an LPE

odd timber
#

MDC's was executing code with kernel privileges according to apple

uneven pulsar
#

anyway the exploit doesnā€™t work on ios

#

yet

#

it will work soon tho

tepid olive
#

I could make it work on iOS rn

uneven pulsar
#

some things extra needed

tepid olive
#

But idk what the exploit is useful for

uneven pulsar
tepid olive
#

@sonic totem what does apple mean by code with kernel privileges? Just root, or is it like code running in the context of the kernel

#

I'm assuming it's just root

#

If it's code running in the kernel, you likely need root for it to work, however if it is code running in the kernel it could be useful for jailbreak on older versions

odd timber
sonic totem
#

Idk what itā€™s on abour

#

Hold on Iā€™m playing guitar

uneven pulsar
tepid olive
#

Something that the compiler missed PAC instructions on

uneven pulsar
#

this thing

odd timber
#

Then again, I wouldn't be surprised if apple screwed up the entry to begin with. They screwed up their own description of PPL.

tepid olive
naive kraken
tepid olive
#

What, that's so stupid

#

Running code with kernel privileges is different than kernel memory access lol

uneven pulsar
uneven pulsar
#

very normal

#

they silently patch landa in 16.7

sonic totem
odd timber
#

without even a second RC either

sonic totem
#

Interesting

uneven pulsar
tepid olive
#

Yeah itā€™s probably krw

#

The fix was improved memory handling

uneven pulsar
#

if itā€™s true

tepid olive
#

That doesnā€™t mean itā€™s useful for TrollStore btw

#

It could very likely be that it requires root privileges

uneven pulsar
#

until the exploit becomes public

#

if not we have other exploits as well

tepid olive
#

The exploit is public wtf are you talking about

odd timber
uneven pulsar
#

never gonna happen

odd timber
#

and even if they did, we dunno if it's powerful enough for krw

tepid olive
#

@sonic totem if this is krw, this could be good for krw handoff, as it appears it works only using a file descriptor

uneven pulsar
#

read the important bit

odd timber
#

it aint an exploit

tepid olive
#

Oh it doesnā€™t exist in 16.x?!

uneven pulsar
#

only 17.0-17.2.1

tepid olive
#

Also Iā€™m a security engineer so shut up

#

It is an exploit, a poc means it was exploited

#

A poc is proof that it can be exploited

sonic totem
tepid olive
#

No?

sonic totem
#

A PoC means that it was triggered

tepid olive
#

I guess I have a misunderstanding

tepid olive
sonic totem
tepid olive
#

Iā€™m not gonna do any work with it because it isnā€™t useful for me

sonic totem
#

Yeah

odd timber
sonic totem
#

Itā€™s interesting either way

tepid olive
#

It was introduced in 17.0 so yeah

#

The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

#

Itā€™s krw

sonic totem
#

Itā€™s a use-after-free

tepid olive
#

Oh, Google has mislead me

odd timber
#

is it a P-UAF tho

sonic totem
odd timber
#

cause isn't physical UAF needed for krw?

uneven pulsar
#

What's the difference?

tepid olive
#

Oh also

odd timber
tepid olive
#

Nvm

sonic totem
#

Theyā€™re just

#

Easier to exploit

odd timber
#

Good to know

tepid olive
#

What does this mean

#

An attacker that has already achieved kernel code execution may be able to bypass kernel memory mitigations.

#

What does Apple mean by that lol

odd timber
tepid olive
#

It could be

robust totem
#

if u find a ppl bypass do you need to also find a sptm bypass for a15+ devices on ios 17+?

steady nest
robust totem
#

oh

odd timber
robust totem
#

so ppl bypasses wont work

#

on a15+

steady nest
robust totem
#

so lets say we found like a krw for ios 17.0.1+ and a ppl bypass too

odd timber
tepid olive
#

PPL is a micro kernel running inside of the kernel

robust totem
#

we gotta find a sptm bypass for devices above a15?

tepid olive
hasty ruin
robust totem
#

real

steady nest
hasty ruin
# steady nest uname -a?

Darwin iPhone 22.2.0 Darwin Kernel Version 22.2.0: Mon Nov 28 20:09:56 PST 2022; root:xnu-8792.62.2~1/RELEASE_ARM64_T8120 iPhone15,3 arm Darwin

#

šŸ‘

steady nest
#

šŸ”„

sonic totem
hasty ruin
#

Seratonine yeah

steady nest
#

šŸ”„

sonic totem
#

Lit

blazing warren
#

Dopatonin

odd timber
#

Dopaxine

sonic totem
#

lol

#

Wen eta

hasty ruin
#

wen eta

odd timber
#

ios 18 untether wen eta

visual meadow
odd timber
#

i fone

hasty ruin
steady nest
hasty ruin
#

Ty

faint stag
visual meadow
#

once someone gets krw with that poc, hopefully, im gonna try and get serotonin working

#

My friend with 11 pro max is on 17.0

steady nest
#

doubt that'll happen

hasty ruin
#

you should use krw to get keyboard tweaks working

steady nest
#

easy

sonic totem
#

zone_require woeis

visual meadow
#

damn

sonic totem
#

Just gotta wait for Dopamine 2.0

#

Thatā€™s my only hope

ashen birch
#

damn i just realized my phone wasnā€™t charging overnight im at 5%

#

L

steady nest
#

and types

tepid olive
#

Zone_require is fine when all you need to do is get a kalloc though

steady nest
tepid olive
#

Well if youā€™re just trying to abuse something to allocate some kernel memory, it doesnā€™t matter

steady nest
#

uh, how so

#

the issue here is you can trigger the uaf but can't reliably fill that exact spot in memory with controlled data

ashen birch
#

is this anything new or no

steady nest
#

i've seen that link like 39 times today

ashen birch
#

sick

fluid lintel
#

But task_for_pid on ios16 does not work. I started a process as root with task-for-pid_allow. But the task_for_pid function always gives me -1 and I don't see any error logs

granite frigate
#

that'll happen

#

are traditional (not puaf) uafs even worth trying to work on anymore? I was thinking about it and it doesn't seem worth it to trial and error with kalloc_type

#

like that apple blog post about sockpuppet showed that almost deterministic exploit was reduced to 8% reliability because of kalloc_type

sonic totem
drifting heron
#

I love how 120Hz iPhones max out at 80 Hz fr

hasty ruin
sonic totem
#

Delete them!!

hasty ruin
sonic totem
#

Ā£20 or I just run which pac on my device

#

Math isnā€™t mathing iCraze

indigo peak
#

what tweak should I make now

#

update calculatorhistory

cloud yacht
#

make mud splasher

sonic totem
#

Nexus16

blazing warren
odd timber
#

Delete the /var folder

#

instant jelbrek

sonic totem
blazing warren
timid briar
#

The dang PowerPoint transition

serene hawk
#

now fiore has a tweak idea

#

bootloop master

#

Customize the iOS Nexus Bootloop Experience

drifting heron
#

there's 2 ways you can force 120 Hz in iOS

indigo peak
#

I hate when people ask me to do stuff like this because I donā€™t have the physical resources for that

drifting heron
#

but they never stay

drifting heron
ashen birch
hasty ruin
drifting heron
void quail
# sonic totem If youā€™re manually injecting

I'm not manually injecting, I made a tweak that has a filter for the bundle id of the app, and I enabled tweaking for that app. It's just that it doesn't seem to be hooking anything, and I'm not seeing any logs.

indigo peak
slim bramble
#

Can you listen to NSDistributedNotificationCenter.defaultCenter without hooking layoutSubviews ?

faint stag
#

what does that have to do with layoutSubviews

faint stag
slim bramble
#

?

faint stag
#

why are you hooking layoutSubviews lol

slim bramble
#

So I can throw it inside ctor ?

slim bramble
faint stag
#

i mean

#

that method works

#

but there's probably a better way to do that

slim bramble
#

yeah but battery bim boom bye bye

hasty ruin
#

should remove the observer before adding

#

to avoid duplicate listeners

radiant idol
#

It did not work without layoutS unfortunately

#

I would like to avoid it too

#

But

#

ĀÆ_(惄)_/ĀÆ

faint stag
#

i can see why i guess

#

if you're looking at an ancestor then yeah subviews might come into play

onyx ember
drifting heron
#

start screen recording to see actual 120 Hz

onyx ember
drifting heron
#

I mean the display supports 120 Hz and the latest update supposedly finally goes up to 120 Hz

#

so I guess it's not an issue anymore

onyx ember
drifting heron
#

I think they fixed it in 17.2 or 17.3

granite frigate
#

are you fr

drifting heron
#

I'm actually for real lol

#

you can use this chinese app to test

#

it has a Hz measurement pip window

#

once you start screen recording you'll see it start to hit 120 Hz but without it you'll see like 80 max on the homepage and in apps

#

and you can also easily tell šŸ¤·ā€ā™‚ļø

sonic totem
#

?? since when does Xcode do this

Screenshot_2024-02-02_at_18.52.13.png
tepid olive
#

@sonic totem I might know why the constant reading didn't work

#

I did it in a while true loop, so it still has to evaluate whether true is true

#

I should've done it in a for(;;) loop

#

Because that doesn't have to evaluate anything

void quail
sonic totem
#

Yeah quite possibly

#

Wait what?

#

I thought it was showing two devices called ā€œAlfieā€

#

Itā€™s letting me run it as arm64/arm64e?

tepid olive
#

Another thing is that I used virtual addresses to read it, using mapped physical addresses would be faster

sonic totem
#

lol

#

Typical Xcode

tepid olive
slim bramble
#

Now that I booted Arch

#

new issuesā„¢ļø

#

error: '/home/bibi_fire/theos/sdks/iPhoneOS13.7.sdk/usr/include/mach-o/module.map' as a module map name is deprecated, rename it to module.modulemap [-Werror,-Wdeprecated-module-dot-map]

#

Funā„¢ļø

hexed knot
#

Maybe rename it to module.modulemap

slim bramble
#

Thats what I'm doing

tepid olive
#

wait @sonic totem what if the compiler is inserting cache maintenance instructions into my code?

sonic totem
tepid olive
#

I can check with ghidra

sonic totem
#

But your program shouldn't interact with kernel cache immediately

tepid olive
#

the cache is a general CPU cache

#

L2 specifically

#

but compilers might insert the instructions to ensure execution order

sonic totem
#

I was only half-focused

torn cloud
#

i believe itā€™s due to ensuring proper execution

#

but idk

steady nest
brazen timber
#

mods :/

spare stone
#

oops forgot rule 3

#

sorry

tepid olive
#

I didn't find any anyways lol

#

only the one I put on purpose

tepid olive
#

@sonic totem I've encountered a new error

#

*panic

#

pmap_enter_options_internal: page locked down

#

now why that's happening: idk

sonic totem
#

Hmm

#

If opa sees these messages he will probably have an idea

tepid olive
#

probably

# 
/* The regular old kernel is not allowed to remap PPL pages. */
            if (__improbable(ppattr_pa_test_monitor(pa))) {
                panic("%s: page belongs to PPL, "
                    "pmap=%p, v=0x%llx, pa=%p, prot=0x%x, fault_type=0x%x, flags=0x%x, wired=%u, options=0x%x",
                    __FUNCTION__,
                    pmap, v, (void*)pa, prot, fault_type, flags, wired, options);
            }

            if (__improbable(pvh_get_flags(pai_to_pvh(pai)) & PVH_FLAG_LOCKDOWN_MASK)) {
                panic("%s: page locked down, "
                    "pmap=%p, v=0x%llx, pa=%p, prot=0x%x, fault_type=0x%x, flags=0x%x, wired=%u, options=0x%x",
                    __FUNCTION__,
                    pmap, v, (void *)pa, prot, fault_type, flags, wired, options);
            }
sonic totem
#

So you need PPLRW

tepid olive
#

except I am doing PPLRW

#

maybe PPLRW doesn't let you read?

sonic totem
#

It does

tepid olive
#

I mean I'd think so

#

yeah

tepid olive
torn cloud
#

are the PPLRW pages allowed to be accessed by DMA in the first place though?

tepid olive
#

yes

#

usually I can write to them

torn cloud
#

weird

torn cloud
#

or am i asking a dumb question

tepid olive
#

Well, I mean unless I somehow have to like

#

uh

#

read data with MMIO

#

but afaik you can only write data with that

torn cloud
#

oh right

torn cloud
sonic totem
torn cloud
#

ohhhhh

#

that's cool

tepid olive
#

but this isn't only PPL protected

#

it's also KTRR lockdowned

# 
* Marking a pv_head_table entry with any bit in this mask denotes that this page
 * has been locked down by the PPL.  Locked down pages can't have new mappings
 * created or existing mappings removed, and all existing mappings will have been
 * converted to read-only.  This essentially makes the page immutable.
torn cloud
#

yeah that's what i was about to say, the pages are read only unfortuantly

tepid olive
#

but then how did oct0xor

torn cloud
#

who?

tepid olive
#

boris

sonic totem
#

Extra haxx needed

tepid olive
#

seems so

#

well

#

although I was writing before

#

what happened lmao

# 
    NSLog(@"Entered the writeback prevention thread!");
    uint64_t _uuid_generate_time_addr = vtophys_kfd(0xfffffff00832be94 + get_kernel_slide());
    uint64_t start = 0xfffffff00832be94;
    uint64_t end = 0xfffffff00832c018; // Also static for testing purposes.
    uint64_t size = end - start;
    NSLog(@"Size: %d",size);
    // sleep(1);
    bool hasalreadyprinted = false;
    dma_perform(^{
        for(;;) {
            physread64_mapped(_uuid_generate_time_addr);
            physread64_mapped(_uuid_generate_time_addr+sizeof(uint64_t));
        }
    });
    return 0; // Shouldn't ever be reached.
}
``` unless this is causing it?
torn cloud
tepid olive
#

yeah

#

what if I mask out the bit

#

I can modify PPL page entries

torn cloud
#

not a bad idea

#

try to make incremental modifications though, so you can track it if any issues rise

tepid olive
#

yeah

torn cloud
#

also to avoid bricking the test device troll

tepid olive
#

this is all for a PAC bypass

#

just to see if I can

torn cloud
#

what firmware?

tepid olive
#

I just need temporary KTRR bypass

#

enough time to just sign a pointer

tepid olive
torn cloud
#

nice

tepid olive
#

I'm seeing if I can get this working for my upcoming jailbreak

torn cloud
#

but can't you already write to cache with the KTTR bypass

torn cloud
tepid olive
torn cloud
#

oh

tepid olive
#

it gets flushed way too fast though

tepid olive
tepid olive
#

but while it's in the cache