development

[tepid olive]

it's fine

so what I was gonna do is do the thingy, and then after I'm done, invalidate the cache

[torn cloud]

if it was x86 you could use CLFLUSH

unfortuantly not though

[torn cloud]

good idea

[tepid olive]

I don't want it to be flushed

[torn cloud]

wait sorry i read that wrong 💀

nvm

[tepid olive]

do we have like

a binary for the AMCC firmware, although I assume it's burned into the chip

[torn cloud]

not publicly available in the form of a binary image unfortuantly

[tepid olive]

ah

I wanted to see if I could somehow race the AMCC

[torn cloud]

apple moment

[tepid olive]

although tbf this would probably also prevent cache access so

[torn cloud]

are you putting this code on a private repositary?

or just on your computer

[tepid olive]

as of the current moment, yes

[torn cloud]

k

[tepid olive]

will prolly be public at some point

why

[torn cloud]

just wanted to see the code

maybe contribute

[torn cloud]

nice

i'm not as skilled as you regarding exploit dev

but i'll see what i can do

[tepid olive]

k

[torn cloud]

bruh

it's opening the .m in my downloads folder

chaotic

[tepid olive]

lmao

[torn cloud]

uh

[tepid olive]

?

[torn cloud]

it says a lot of headers are missing

[tepid olive]

well yeah cuz it has some private headers

[torn cloud]

oh right

i'll just ignore errors then

[tepid olive]

I wonder if the AMCC has registers

// Core Perfrormance Monitoring Unit Registers.

apple typo

[torn cloud]

@tepid olive isn't pthread_cancel unstable? or are you trying to terminate the thread yourself rather than it naturally exit?

[tepid olive]

I need to terminate it myself yeah

because I put it in an infinite loop

[torn cloud]

k

@tepid olive i cleaned your code up and cleaned the variable scope, tell me if i missed something:

`// Notify that the initial DMA perform is completed
NSLog(@"Outside of initial dma_perform for mapping.");

// Add the virtual-to-physical mapping for _uuid_generate_time_addr
addMapping(vtophys_kfd(_uuid_generate_time_addr));

// Create a new thread for infinite kreading
pthread_t posixThreadID;
int threadError = pthread_create(&posixThreadID, &attr, &preventwritebackthread, NULL);
if (threadError != 0) {
NSLog(@"Failed to start infinite kreading thread. Exiting.");
kclose(_kfd);
exit(EXIT_FAILURE);
}

// Clean up thread attributes
returnVal = pthread_attr_destroy(&attr);
assert(!returnVal);

// Allow some time for the thread to get started
sleep(2);

// Perform DMA write
uint64_t thing = 0xfffffff00832be94 + get_kernel_slide();
dma_writevirtbuf(thing, buf, sizeof(uint32_t) * 4);

// Generate time using UUID function
uuid_generate_time(ourbuf);

// Read the signed value from kernel memory
ksigned_afce = (void *)kread64_kfd((uint64_t)ourbuf);
NSLog(@"Signed afce: %p", ksigned_afce);

// Cancel the infinite kreading thread
pthread_cancel(posixThreadID);

// Invalidate all branch predictors and TLBs
asm("IC IALLU");`

the comments are a bit shit lmao

[tepid olive]

in case you don't notice

[torn cloud]

yh?

[tepid olive]

uuid_generate_time is supposed to be getting rewritten to sign an arbitrary pointer (0xafce in this case)

[torn cloud]

oh

💀

[tepid olive]

they're only 0x4141414141 for testing purposes lol

[torn cloud]

would something like void *arbitraryPointer = (void *)0xafce; uuid_generate_time(arbitraryPointer); be better?

or no

[tepid olive]

no, because the buffer is allocated kernel memory (ourbuf)

atm 0xafce is hardcoded

for testing purposes

[torn cloud]

alr i'll adjust accordingly

[tepid olive]

I wonder if I could just do this With that, it is possible to set TTBR1_EL1 to a custom page table base and remap the kernel onto fresh, writable physical pages outside of the AMCC KTRR range.

doubt it though

however I wonder if I can somehow trick the AMCC into thinking I'm not writing to one of it's KTRR addresses

[torn cloud]

would just adding a & before arbitraryPointer);work since it's signed a memory location specified by the passed pointer?

[torn cloud]

oooh

[tepid olive]

(without remapping)

[wicked summit]

gm

[tepid olive]

hi

[torn cloud]

hello

@tepid olive are you going to make a repositary to put all the code on? since imo it would be easier to commit/do PRs rather than ctrl c + ctrl v code all over #development

[tepid olive]

I have one but again, it's for a jailbreak project lol

[torn cloud]

k

anyway gl with the jailbreak

i'm going to sleep

[tepid olive]

night

[torn cloud]

night

[sonic totem]

May I say it is beautiful?

[tepid olive]

ok so I've been reading some stuff

AMCC is the last KTRR defense line apparently, the MMU is the first line of defense

@sonic totem do you know if something stops you from writing this register RORGNBASEADDR

after you have the DMA that is

[sonic totem]

No clue sorry :/

[tepid olive]

alright

it's ok

[elder scaffold]

Is it possible to write to the lock register?

[tepid olive]

yeah that's what I was thinking

I don't think it is though?

maybe the AMCC protects itself

[elder scaffold]

I feel like if that's possible it's already being used.

[tepid olive]

because all memory accesses have to go through the AMCC

[elder scaffold]

yeah

[tepid olive]

oh you know what might be stopping you

it might be that that they're only properly existing in a certain state of the CPU

[elder scaffold]

idk

btw I feel like I sometimes got insn=0x41414141 when writing to AMCC protected (with disabled MMU KTRR by KTRW

[tepid olive]

you can disable MMU KTRR pretty easily

afaik

[elder scaffold]

I think it's probably cache or something.

[tepid olive]

that isn't protected by anything

at least afaik

it's just a system register

[elder scaffold]

will a bug in DMA make it possible?

[tepid olive]

wdym?

[tepid olive]

well you'd actually have to disable the whole MMU

in this case

which shouldn't be a problem if you're only writing and reading physical addresses

[elder scaffold]

Oh I'm sure that's impossible
Lockdown will be restarted from the AMCC protected area upon CPU reset

[tepid olive]

@elder scaffold ```**(ttbr1_el1 unchangeable)
The instruction msr ttbr1_el1, x0 has been uniqued and exists only in __LAST.__pinst anymore, so I don’t see how you would attack that either.
(Shellcode injection)
Executable range is a subrange of RoRgn, so… that’s a nope from me.
(Turning off the MMU)
Same story as with ttbr1_el1.

apparently turning off the MMU would completely just bypass KTRR, but I feel like somebody has tried that already lol

too bad there's no way to just disable cache writeback

[faint timber]

Unfortunately can’t write to iorvbar above a12

[tepid olive]

I see.

[faint timber]

But you can probably have a lot of power there

[tepid olive]

I literally only need KTRR bypass for like one second

the damn cache just gets written back wayyyy too fast

[faint timber]

I have an idea

Worth looking into

https://opensource.apple.com/source/xnu/xnu-6153.61.1/pexpert/pexpert/arm64/arm64_common.h

The CYC registers might be of some use

[tepid olive]

hmm interesting

[faint timber]

CYC and ACC

[tepid olive]

yeah

hmm so the flushing gets disable on sleep?

interesting

#define ARM64_REG_ACC_OVRD_disL2Flush4AccSlp_mask

[faint timber]

So far I’ve only tested ok2pwrdn

Used it to poweroff bootcpu

[tepid olive]

ah

[faint timber]

Might be more in an updated header

[tepid olive]

not sure, it isn't in latest source I don't think

[tepid olive]

this is prolly what I want though

[tepid olive]

https://github.com/apple-oss-distributions/xnu/blob/1031c584a5e37aff177559b9f69dbd3c8c3fd30a/pexpert/pexpert/arm64/apple_arm64_regs.h#L39 I take that back

it's the same header though lol

[faint timber]

Yep

[tepid olive]

ok so that register is used when enabling deepsleep

arm64_prepare_for_sleep

how would I find where the register is in physical memory though

[faint timber]

I can look when I get home but you will be looking for regmap setup function

[tepid olive]

gotcha

[tepid olive]

I would need to apply this ot all cores though

I think

no actually it might be systemwide

[tough shadow]

?????

[steady nest]

not a great idea

[faint timber]

I believe it’s based on which cpu executes the msr

[tepid olive]

yeah, but I can't use MSRs, so I have to directly write to the MMIO

[faint timber]

If you can write to coresight mmio you can do msr

[tepid olive]

oh

[faint timber]

Check out golb

[tepid olive]

ah I see

but you still need the addresses to map them, no?

[faint timber]

Which addresses

[tepid olive]

for the regist-

oh

[faint timber]

?

[tepid olive]

I see now

would those existing addresses in there still work though?

oh wait

do these registers exist on arm64e

cuz it very specifically checks only for arm64 cores

ah what a convenient function

it's for the ANE

tho

yeah the registers are still there

ml_dbgwrap_stuff_instr(cpu_data_t *cdp, uint32_t instr, uint64_t timeout_ns, dbgwrap_status_t *status)
{
    if (*status < 0) {
        return;
    }

    volatile uint32_t *editr = (volatile uint32_t *)(cdp->coresight_base[CORESIGHT_ED] + EDITR_REG_OFFSET);
    volatile uint32_t *edscr = (volatile uint32_t *)(cdp->coresight_base[CORESIGHT_ED] + EDSCR_REG_OFFSET);
    volatile uint32_t *edrcr = (volatile uint32_t *)(cdp->coresight_base[CORESIGHT_ED] + EDRCR_REG_OFFSET);

    int retries = 0;

    uint64_t interval;
    nanoseconds_to_absolutetime(timeout_ns, &interval);
    uint64_t deadline = mach_absolute_time() + interval;

#if DEVELOPMENT || DEBUG
    uint32_t stuffed_instr_index = os_atomic_inc(&stuffed_instr_count, relaxed);
    stuffed_instrs[(stuffed_instr_index - 1) % MAX_STUFFED_INSTRS] = instr;
#endif

    do {
        *editr = instr;
        volatile uint32_t edscr_val;
        while (!((edscr_val = *edscr) & EDSCR_ITE)) {
            if (mach_absolute_time() > deadline) {
                *status = DBGWRAP_ERR_INSTR_TIMEOUT;
                return;
            }
            if (edscr_val & EDSCR_ERR) {
                break;
            }
        }
        if (edscr_val & EDSCR_ERR) {
            /* If memory access mode was enable by a debugger, clear it.
             * This will cause ERR to be set on any attempt to use EDITR. */
            if (edscr_val & EDSCR_MA) {
                *edscr = edscr_val & ~EDSCR_MA;
            }
            *edrcr = EDRCR_CSE;
            ++retries;
        } else {
            break;
        }
    } while (retries < MAX_EDITR_RETRIES);

    if (retries >= MAX_EDITR_RETRIES) {
        *status = DBGWRAP_ERR_INSTR_ERROR;
        return;
    }
}
``` I just basically want to do what this does for msr, right

the offsets must be the same because they're static here too lmao

[naive kraken]

that's not true for newer chipsets

[faint timber]

bruh is in devicetree don't need to look in source code

[tepid olive]

ah I see

[tepid olive]

I just did

I figured that out lmao

[tepid olive]

Any idea why it’s only showing system installed apps not user I tried to make a plist editor

func loadInstalledApps() {
let systemApplicationsPath = "/Applications/"

    do {
        let apps = try FileManager.default.contentsOfDirectory(atPath: systemApplicationsPath)
        installedApps = apps.filter { $0.hasSuffix(".app") }.map { $0.replacingOccurrences(of: ".app", with: "") }
    } catch {
        print("Error reading system apps: \(error.localizedDescription)")
    }
}

}

[indigo peak]

because only system apps reside in /Applications/

[radiant idol]

ew, sw*ft

[indigo peak]

user apps are stored in /var/containers/Bundle/Application/

[tepid olive]

@faint timber how do I turn msr s3_5_c15_c6_0,x0 into hex

none of my usual tools appear to be working

Thank you I can see my user apps now

[naive kraken]

@faint timber what if I told you that kwritebuf in your libjbdrw has been broken for 10 months?

[tepid olive]

lmao

[naive kraken]

(Doesn't matter though, I will switch to my own package now)

[tepid olive]

oh opa, iOS 16 launchd doesn't use xpc_register anymore, right, it uses bootstrap_register

[naive kraken]

uh idk

[tepid olive]

why is my ghidra so damn broken

[indigo peak]

@primal perch troll

[tough shadow]

How do you get this file when you make a new project with theos? (correct me if am wrong)

[faint timber]

we had this conversation before I just lost interest my bad

[faint timber]

armconverter.com

[tough shadow]

??

[faint timber]

I will do everything in my power to fix it tonight

dinner and homework a priority though

[tepid olive]

I tried!

[tough shadow]

How do you get ipabuild.sh?

[tepid olive]

what

why did it work this time

[tough shadow]

To build a ipa

[tepid olive]

I wasn't talking to you

[tough shadow]

Oh

I really need help

[radiant idol]

you... dont

or maybe you do, idk

what are you trying to do

[tough shadow]

Make an application and compile it to a .ipa

[radiant idol]

just use Xcode

[faint timber]

Might have to use clang then

[radiant idol]

just use Xcode

[tough shadow]

Why?

[radiant idol]

far better tooling for making apps

[ashen birch]

armconverter on top

[indigo peak]

@radiant idol do u know assembly

i need help

captinc is typing...

[ashen birch]

run

[radiant idol]

no

[indigo peak]

aw shucks

well ill ask it anyway to see if someone else cna help

so in ida this is the pseudo code
if ( ((unsigned __int8)sub_10061BF68(v135) & 1) != 0 )
and the instructions are

ADRL            X2, cfstr_Crazy ; "crazy"
BL              sub_10061BF68
TBZ             W0, #0, loc_10023EDD0

and loc_10023EDD0's stub is at 0x10023EDD0

if i wanted to convert the TBZ instruction to hex
would i just put

TBZ W0, #0, 0x10023EDD0
into arm converter?

[ashen birch]

highlight the instruction then go to hex view and copy the hex

[indigo peak]

and then just for testing purposes
could i just keep the same instruction and then change the #0 bit to #1 using mshookmemory

[ashen birch]

and use that

[brazen timber]

or right click synchronize with hex view and then just go to the hex view

[ashen birch]

true

[brazen timber]

or use https://github.com/OALabs/hexcopy-ida and then u can just right click on the instruction and click copy hex

[ashen birch]

i know more binja features than IDA

[indigo peak]

oh shit forgot ab that

[indigo peak]

not a stock feature

[brazen timber]

yeah u need hexcopy

[ashen birch]

no you don’t lol

[pearl sail]

Guys do meth

[ashen birch]

go to hex view

[faint timber]

Highlight then press shift + e

[ashen birch]

and the instruction will be highlighted

[brazen timber]

without going into hex view

[ashen birch]

i’ve done this on stock IDA

[ashen birch]

okay then yeah

[brazen timber]

in dissassembly u can do Ctrl+e

export data

[faint timber]

Hex copy ^

[brazen timber]

after selection

but hexcopy 🙏

[faint timber]

There is a plug-in for easier hexcopy

[indigo peak]

worked

i think

[brazen timber]

yeah i sent it

[faint timber]

https://github.com/OALabs/hexcopy-ida

[indigo peak]

according to armconverter its 806E0736 instead of E01B0036

i have to reboot my pc

shits acting up rn

wtf

[ashen birch]

because ida’s correcting the offset automatically

[indigo peak]

oh yeah makes sense

soooo

should i go off of armconverter

or based off of hexcopy

assuming i should put the stubs address into armconverter

since that doesnt spit back an offset

[ashen birch]

based off hexcopy

[brazen timber]

armconverter is wrong it doesn't have context lol

it can't resolve anything

[indigo peak]

okok

[ashen birch]

bro what

gir go home you're drunk

[brazen timber]

what did bro type

[ashen birch]

what the fuck is it

[indigo peak]

e01b0036

[ashen birch]

pc

???????

[brazen timber]

huh

[indigo peak]

inb4 banned for filter spam

[faint timber]

Race condition

[tepid olive]

what

[ashen birch]

shut the fuck up gir

insn

[tepid olive]

lmfao

s3_5_c15_c6_0

??

[ashen birch]

pc +

[tepid olive]

uint64_t instr_for_read = 0xD51DF600;

wtf

[ashen birch]

the insn

is loading

[tepid olive]

what

[ashen birch]

why is that getting deleted

[tepid olive]

???

LMFAO

why can I say it

[ashen birch]

pc plus 0x37c not 0x10023EDD0

[brazen timber]

it's the plus sign??

ggs

[tepid olive]

oh nevermind

what???

[ashen birch]

jesus fuck

pc

probably?

idek

[brazen timber]

pc +

pc + 0x

[tepid olive]

oh it told me

[brazen timber]

what

[tepid olive]

why

[brazen timber]

screenshot it

[ashen birch]

it's specifically that

[brazen timber]

???

pc + 0x157

specifically those numbers

LOL

[ashen birch]

pee cee plus zero x three seven c

[ashen birch]

shit bot

[tepid olive]

there you go

lmfao

[ashen birch]

what even is that

[tepid olive]

¯_(ツ)_/¯

[ashen birch]

anyways @indigo peak yeah

[brazen timber]

some dev at pornhub japan

[ashen birch]

the asm is relative load ida's just resolving and showing you the full address for simplicity

[tepid olive]

why is that filtered?!

[indigo peak]

sickkkk

i broke it

lmao

[brazen timber]

they specifically hate that guy idk

[tepid olive]

I guess?!

[ashen birch]

okay apparently it's a fakebreak?

[tepid olive]

ohhhh

lmao what?

[ashen birch]

hah

oh baby a double

[tepid olive]

m1sta ur gonna get muted lmao

[ashen birch]

gir can eat my ass

[tepid olive]

fair enough

[tepid olive]

wait developers can pin messages to this channel

[indigo peak]

holy shit im dumb

i forgot

[ashen birch]

ikr

[indigo peak]

bruh

[ashen birch]

i barely found that out a few days ago

[tepid olive]

wen sora for dev

[indigo peak]

memmem for location is just the regular hex
but the patch has to be endian swapped

ughhh

so annoying

but

it works now

[ashen birch]

lmao

[indigo peak]

playin crazy 8 by myself

[tepid olive]

when I release my jailbreak except I've accidentally been putting it off trying to make L2 cache not get flushed!

[ashen birch]

also assuming it's a check you always want to skip over, it'd be better to just change to a branch

[tepid olive]

damn you L2 cache

[indigo peak]

nah i just changed the condition bit from #0 to #1 lol

[tepid olive]

that works

I want binja

ghidra sucks

[ashen birch]

it do but branch would be better

[indigo peak]

nah its for testing only

[ashen birch]

highly recommend its great

oh ok

[tepid olive]

I don't have $75 😭

[brazen timber]

binja is okay

[indigo peak]

this was just so i can play crazy 8 without a full gc

yk

[tepid olive]

well I'm not paying for IDA Pro

[indigo peak]

so i can make more hax

[ashen birch]

name a better decompiler

that isn't IDA

[brazen timber]

no one in #development can afford ida pro.

[indigo peak]

fuck

i need everyone

[tepid olive]

yeah it's crazy expensive

[brazen timber]

and yet

we all have it

[tepid olive]

I don't

[indigo peak]

no if i nop the if statement it will execute the code either way

[ashen birch]

he wants it to branch

so

[tepid olive]

noping statements really likes leading to stack corruption

[ashen birch]

no just change from tbz to branch

[indigo peak]

basically

if ([GameIcon _id]) {
  // display "this gamemis for 3-6 players
  LABEL xxx;
}

[primal perch]

gm reta

[indigo peak]

thats just what it is

[brazen timber]

All the binja binaries are signed + installer hashes provided on the website and the keygen has no malware (there's 0 obfuscation you can RE it yourself)

[tepid olive]

why is nop even a thing? I've never seen a compiler use it

[brazen timber]

👍👍👍👍

[primal perch]

and @indigo peak @brazen timber @ashen birch

[ashen birch]

gm shep

how r u

[brazen timber]

gm 🫡

[indigo peak]

gm

[primal perch]

gud

[primal perch]

alignment and timing iirc

depends heavily ofc

[tepid olive]

(blraa, my worst nightmare)

[indigo peak]

@primal perch did you see
gamepigeon poker 💀

[tepid olive]

isn't that what DMB SY is for

[ashen birch]

installers aren't pub iirc

but theyre not exactly hard to get

[primal perch]

well dmb isnt a nop

its a memory barrier

[brazen timber]

They are on virustotal lol

[primal perch]

lmfao

[ashen birch]

.

[brazen timber]

A VT enterprise subscription is worth it just for all the free software that people upload

more useful for that than the actual malware

all the malware is mirrored to threat intel sites anyway

[primal perch]

i pay for binja because its actually affordable and i like the devs but pirate if you want i guess

[tepid olive]

https://juuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuulia.dev oh my god what the fuck is this domain

[primal perch]

if i could afford ida i would too

like 200k+/yr type shit

[ashen birch]

real

[brazen timber]

fr binja support is really responsive and dev builds are also based

[ashen birch]

okay but does hex rays even care if IDA is pirated by single people atp

[primal perch]

i doubt it

[brazen timber]

i reported a bug they fixed it in less than 24h

[primal perch]

its like photoshop in my mind

[ashen birch]

it's literally the photoshop of decompilers

[primal perch]

fr

[ashen birch]

LMAO

[tepid olive]

no, because they get a shit ton of money from the companies paying them

[ashen birch]

fr

[ashen birch]

exactly

[brazen timber]

They only care if it's companies, my friends job is to do compliance checking for IDA lol

[ashen birch]

just like adobe

[primal perch]

indirectly they want you to pirate because they know its the best

[tepid olive]

I think I'd prefer binja anyways

[primal perch]

then you(r company) have to buy it if you join the RE field

[brazen timber]

no you wouldn't

[tepid olive]

(many people crack IDA with IDA lol)

[tepid olive]

I'm on mac

IDA is ass on mac

[brazen timber]

so

[brazen timber]

false

[primal perch]

its heat on mac

its the same app

[exotic spire]

Is it shep goodbye time?

[tepid olive]

true

[primal perch]

perhaps

[hasty ruin]

what he do

[exotic spire]

It's been a long road my brother

[primal perch]

concatnated

[ashen birch]

use whisky

[primal perch]

gn bros

its joever

[ashen birch]

it's a better wineskin

gm aaron

gir is broken

per usual

[tepid olive]

[primal perch]

[hasty ruin]

losing men to censorship 🫡

[primal perch]

fr

[exotic spire]

God dammit

[brazen timber]

binja has like 2 advantages
and they are better documentation (esp for IL and plugins), it's multithreaded

[exotic spire]

Stop or I will have to warn you for real

And it will be joever fr

[tepid olive]

what

[brazen timber]

in ida if you close all the ui panels analysis will get faster it's still coupled to the ui

[exotic spire]

Talking to @primal perch

[tepid olive]

oh

I thought I was being threatened

[ashen birch]

r u still using 7.0 or sum

[primal perch]

🙏

[ashen birch]

hasn't that issue been fixed for forever

[brazen timber]

im using 8.3

[brazen timber]

it wont get fixed until they put the ui on a seperate thread lol

try it urself

[primal perch]

fr

[tepid olive]

I've also heard hopper is good

[primal perch]

hopper UI/UX is good

hopper decomp is liquid ass

[tepid olive]

ah.

[ashen birch]

hopper has best UI

[primal perch]

fr

[hasty ruin]

@exotic spire i volunteer capt for the rest of time to take the fall for any warns against shep

[ashen birch]

thats fr It .

[primal perch]

native cocoa

[tepid olive]

well tbf IDA is just ancient

[primal perch]

@exotic spire i volunteer capt for the rest of time to take the fall for any warns against shep

[faint stag]

so true

[radiant idol]

@exotic spire i volunteer capt for the rest of time to take the fall for any warns against shep

[ashen birch]

@exotic spire i volunteer capt for the rest of time to take the fall for any warns against shep

fuck

[brazen timber]

watching sora go through 4 dimensional levels of cope rn

[brazen timber]

hopper vs snowman worst decompliation challenge

[primal perch]

lmao

[faint stag]

bro hasn't seen cutter

[tepid olive]

I volunteer MLRO to take the fall for any warns against shep

[tepid olive]

cutter is rizin

[faint stag]

i know

[tepid olive]

which is a fork of radare2

[hasty ruin]

fucking frida-trace panicked my tether boot device

[brazen timber]

[tepid olive]

and radare2 isn't that bad

[primal perch]

hexrays is S
binja is a solid B
ghidra low B or high C
hopper and snowman F

[brazen timber]

lmao

[faint stag]

did you jb with taurine

[ashen birch]

fuck it lets just make a gui for dogbolt

[hasty ruin]

yeah i forgot it doesnt work on cs jbs

[tepid olive]

IDA Pro also has good uh extension support

[faint stag]

taurine and frida does funny stuff idk why

[brazen timber]

best thing abt ghidra is that the decompiler supports a lot of archs

more than ida

[primal perch]

ye

[tepid olive]

ghidra recognizes PAC instructions unlike cutter

lmao

[primal perch]

joe

[ashen birch]

fr

[brazen timber]

binja is being kinda cringe rn tho
they are locking some archs to enterprise only

[tepid olive]

sounds like hexrays

[ashen birch]

fr

what archs

[tepid olive]

probably like RISC-V lmao

[brazen timber]

no not RISC-V

[tepid olive]

or MIPS

[primal perch]

[tepid olive]

or something

[brazen timber]

micromips or something

[primal perch]

oh well idc

but stilli cringe

[ashen birch]

also does anyone know what's allegedly coming in 4.0 i'm not watching through that long ass stream they did

[primal perch]

hexrays in binja

[brazen timber]

yeah we were watching it live in the oalabs patreon vc fr

a lot of ui changes

[primal perch]

thats it

[brazen timber]

risc-v decomp

[primal perch]

oh word

[brazen timber]

some type changes

[ashen birch]

werent they adding some AI shit

[brazen timber]

yeah

[primal perch]

ui is fine to me all id like is far more robust objc support

the module they have now is still mid

[brazen timber]

that's what we were making fun of the whole time

[primal perch]

lmao

[brazen timber]

they have sidekick

[primal perch]

AI shit 😭

et tu vector 35

[brazen timber]

ai function analysis 😭

[primal perch]

actually that could go hard but the buzzword makes me hesitant

the first thing i thought of with chatgpt hype was using it for RE at some point

[brazen timber]

it's hella expensive too iirc

[primal perch]

since >LLM

[ashen birch]

its a subscription no?

[brazen timber]

yeah

[primal perch]

of course it is

[brazen timber]

i dont remember than price but it was north of $60

a month

[ashen birch]

damn

[primal perch]

or app

[tepid olive]

true

[ashen birch]

they better be putting more effort into it than just being a chatgpt wrapper

[brazen timber]

oh on the yt they have timestamps

[primal perch]

(they wont)

[ashen birch]

I Will be Making

Chat Gpt Binja Plugin .

[primal perch]

mashallah

[ashen birch]

i wanna learn binja's API anyways it seems pretty cool

[brazen timber]

bninja has the best API

[primal perch]

real

[ashen birch]

also i swear all these tools that be impl'ing chatgpt be coming up with the names with chatgpt

[primal perch]

python 🔥

[ashen birch]

"copilot" "sidekick"

[primal perch]

ongod

chatgpt creators rn

https://tenor.com/view/rich-gif-24345713

[ashen birch]

openai b making sum bank

[brazen timber]

oh yeah and there's gonna be binja free now

instead of a demo

[ashen birch]

what archs do it support

[tepid olive]

with AARCH64?

[ashen birch]

or well

what r the limitations

i should say

[primal perch]

hopefully just x64

paid 75$ for it and 38$/yr for updates so im content t hough

[brazen timber]

they said same archs as demo (but and I quote "i forget exactly what arches" is said after)

but u can save and load databases

no longer singlethreaded but limited to 4 cores

[ashen birch]

ARMv7

32bit mfers gonna go crazy

"Can only load x86, x86_64, and ARMv7 binaries"

[primal perch]

lol

[brazen timber]

oh and free has no access to any ils except HLIL

[ashen birch]

tbh

fine

[primal perch]

thats good then

[brazen timber]

yeah other ILs are useless if ur not making plugins

[ashen birch]

it's already fairly close to pseudo

[primal perch]

itll improve decompiler

[brazen timber]

nah psuedo c is included

HLIL and psuedo c

[ashen birch]

oh shit

p good then

[primal perch]

i just use hlil

pseudo c just includes like casts and brackets

ive never seen it help much

[ashen birch]

i switch between them

[brazen timber]

hlil better represents disassembly

since c will abstract some info away

like signed vs unsigned comparisons

[primal perch]

-Werror -Wall

[brazen timber]

oh yeah they added nanomips but it's $5000

enterprise only addon

[ashen birch]

i bet my dumbass gonna forget to regen download links before my license expires

[tepid olive]

half the compiler errors are BS imo

[brazen timber]

??

[tepid olive]

nvm

[primal perch]

the unused variable one sucks for deving

but for production its based

[tepid olive]

yeah

[hasty ruin]

yeah true

[frail cedar]

@old geyser damn

182 megs at idle

[old geyser]

on my 512mb of ram laptop it only uses about 20mb

23 technically but 3mb of that is htop

[frail cedar]

nice

i now need to configure port forwarding for 25565

why am i in development.

[hasty ruin]

best channel

that's why

[exotic spire]

Bet

[hasty ruin]

💪

@primal perch spam r

@primal perch spam r

@primal perch spam r

[primal perch]

gm

[shrewd smelt]

r

[tepid olive]

will launchd restart itself in case of a failure?

[faint timber]

could not register fairplay decryption, mremap_encrypted() => -1

ugh the framework is encrypted

[primal perch]

[wind ravine]

is there a way to play audio from a tweak when the device is on silent?

[indigo peak]

ask Nathan, he knows

[primal perch]

troll people by playing gay porn

if pirated

[wind ravine]

my friend wants me to add a toggle for it

[primal perch]

https://tenor.com/view/assembly-x86-nasm-programming-error-gif-24887177

[frosty gale]

hi buddies

[wooden yarrow]

Intel asm jumpscare

[wooden yarrow]

what

enc with fairplay?

[slim bramble]

Sharing it here too

https://twitter.com/0xjprx/status/1753575170101461266

Joseph Ravichandran (@0xjprx) on X

The world's first(?) kernel exploit for Vision Pro- on launch day!

Twitter · Feb 3, 2024, 12:24 AM

[slim bramble]

@radiant idol 😡😡😡😡

💀

[gilded laurel]

and there's people that drive with it on already lmao

[slim bramble]

accident eta s0n™️

[gilded laurel]

more news coverage for apple new device!!! let's goo!!

[slim bramble]

frfr

[robust totem]

wtf why

are they stupid or something

its like wearing drunk glasses and driving

you might as well drink and drive

same shit

[slim bramble]

@gilded laurel found it https://fxtwitter.com/iHateApplee/status/1753756094940291104

Might we worth asking, I need to access that struct. sadly it's anonymous. How can I access it using logos ?

It looks like this on flex

I have tried this but it crashes SB

[gilded laurel]

this is definitely illegal in here

not sure about us laws

you can't really have anything obstructing your vision

[velvet path]

it’s illegal in California it sounds like

and probably most other states

[sonic totem]

But it makes your vision pro

[slender glade]

Idk dude just try like void *

Or id

[slim bramble]

nope

[acoustic imp]

For 16player ?

[slim bramble]

What do you think

[acoustic imp]

Are your completely remaking the player ?

Like removing iOSs stuff

[slim bramble]

No but I had a better idea

[indigo peak]

if it’s illegal in California is illegal everywhere else

[sonic totem]

I definitely know of one thing that’s legal in California but not legal anywhere else

[indigo peak]

exactly my point

if California deems it as too illegal, everywhere it’s illegal

[tepid olive]

I want da fancy orange name

[slim bramble]

same

[tepid olive]

I'll have it soon

hey @sonic totem do you happen to know if launchd will restart itself on an exception, or if I'd have to handle exceptions

[smoky pulsar]

so if i learn that pdf i'll be able to make tweaks?

or are there some other things too

[indigo peak]

well you just cant learn everything from just reading 1 thing

youll learn the basics

and youll use that to learn more

[slim bramble]

Bro is gonna pull a tesla_man

[indigo peak]

nah bro is gonna pull a mud_splasher

[granite frigate]

bro is gonna pull a sacrosanct

[smoky pulsar]

whats the more stuff

[granite frigate]

(do nothing and get dev role for doing nothing)

[slim bramble]

Gimme 🙏

[granite frigate]

real

[radiant idol]

You need to experience the trial and error if making tweaks

[indigo peak]

i mean, its impossible for me to just list everything
youll use what you learned from the guide to build a foundation in which youll work on your own projects and then when you come across something you dont know, you can ask for help, use google or just learn

[smoky pulsar]

sounds like a lot

[indigo peak]

not everything is going to be easy

[slim bramble]

@smoky pulsar I am forcing you to not use layoutSubviews by any form shape or means

[indigo peak]

inb4 “what’s that”

[smoky pulsar]

idek what that is

[slim bramble]

called it

[indigo peak]

[smoky pulsar]

i'll try. i just completed basics of swift

[slim bramble]

something you should never use

or touch

[smoky pulsar]

idk if thats helpful or not

[granite frigate]

for tweaks idk

don't think so

[smoky pulsar]

ight

[slim bramble]

https://media.discordapp.net/attachments/688124600269144162/1189761389858930878/banned2.png?ex=65cd7b24&is=65bb0624&hm=77d8e2074202e80e7d2d4ad7f24d57fb728a30308f5a04f35541281a0c19c511&=&format=webp&quality=lossless&width=654&height=654

[smoky pulsar]

wut why

[tepid olive]

no it can be

orion exists

[tepid olive]

it's just a running joke, dw about it

[indigo peak]

swift is just not a good language in most peoples opinion

[smoky pulsar]

but i like the visual things

[slim bramble]

What about objc

objc is cursed too

[tepid olive]

objc isn't great either

[indigo peak]

never said it was

it’s just

[tepid olive]

it's basically apple's C++

[indigo peak]

a hell of a lot better

[smoky pulsar]

like apollo was made with swift right

[tepid olive]

yeah orion

[topaz yew]

runtime is nice imo

[tepid olive]

fair enough, partner in crime

[slim bramble]

ETA C tweaks 🙏

[smoky pulsar]

did yall learn by urself

[slim bramble]

I forced myself to code

[tepid olive]

you could do it

[topaz yew]

there actually are some tweaks that use c iirc

[slim bramble]

idek how to setup

[indigo peak]

I didn’t really follow any guides
I did have a LOT of help over the years

[brazen timber]

wrong

[smoky pulsar]

wdym by "forced" 😨

[topaz yew]

but whos doing that now

[indigo peak]

that’s really easy

[brazen timber]

c++ is actually good

[tepid olive]

lol

true

[radiant idol]

Yes

[tepid olive]

yes

[slim bramble]

No

[smoky pulsar]

how do u learn? trial n error?

[slim bramble]

C++ is cursed too

[indigo peak]

Yes

[topaz yew]

c++ code can get funky as shit

sometimes

[slim bramble]

the only non cursed language is C

[tepid olive]

also why is objc++ a thing

[smoky pulsar]

whats the secret. i keep getting unmotivated

[topaz yew]

[smoky pulsar]

how do i start doing that

[tepid olive]

my friend once called C, "beautified assembly"

[radiant idol]

You just have to keep going, idk

[slim bramble]

someone got this idea while taking a dump

[indigo peak]

learn the basics first, look at other open sources projects to help guide you, and then when you have an idea of something you wanna do, just try it

[smoky pulsar]

what was ur process

[indigo peak]

see how it goes

[granite frigate]

I don't code often unless i see something that I want and no one's coded it yet

[indigo peak]

if it doesn’t work, try a different approach

[tepid olive]

I code often cuz it's fun

[slim bramble]

do what you want to do

[granite frigate]

coding is painful

[tepid olive]

nah

[indigo peak]

I code bc it’s the only thing im good at

[tepid olive]

fr

I'm good at math and programming

[granite frigate]

im not good at it either

[hexed knot]

So you can use c++ libraries in objective c

[smoky pulsar]

idek how to just try it lol. i only know swift basics

[radiant idol]

I started with a goal and tried my best to achieve it. It was something that I wanted to make, so I was motivated to make it. There were many times where I wanted to give up because my skills weren’t the best at that time, but I just took breaks and came back. Eventually it all turned into a finalized product

[slim bramble]

What was your first tweak ?

[radiant idol]

OneSettings

[smoky pulsar]

yall who reacted that nerd emoji 😭

[granite frigate]

icraze own up

[sonic totem]

Probably iCraze

[radiant idol]

@hasty ruin ‼️‼️‼️

[sonic totem]

LOL

Everyone has the same idea

[tepid olive]

lmao

[hasty ruin]

who’s removing it

[smoky pulsar]

wait so u js "started making it?" like no prior knowledge?

[hasty ruin]

[sonic totem]

Uhh I’m not 100% sure

[radiant idol]

Mhm

[slim bramble]

Here how to know if icraze is here 101

[granite frigate]

the best approach: throw shit at the wall

[sonic totem]

Force an exception and see ¯_(ツ)_/¯

[tepid olive]

I guess I'm about to find out!

[radiant idol]

Yeah

[sonic totem]

Also he deletes my messages

[slim bramble]

Ok icraze is here

[tepid olive]

because that sends a termination signal

[sonic totem]

He’s here

[hasty ruin]

termination??

[tepid olive]

rather than an exception

[sonic totem]

killall -9

[slim bramble]

Sometimes Nightwind also 1984s

[tepid olive]

termination and exceptions are different

[granite frigate]

killall -9 launchd

[smoky pulsar]

how do u eveb start like that

[slim bramble]

installing theos

first step

[tepid olive]

exceptions often lead to terminations unless they're handled

[radiant idol]

Looked at other open source tweaks

Saw what they did

Adapted

Etc

[granite frigate]

it's hard to teach you how to learn

[slim bramble]

frfr

[granite frigate]

if you're stuck learning how to learn instead of programme you should focus on that first

or

throw shit at the wall

[hasty ruin]

Stole*

[smoky pulsar]

and how did u learn the terminologies man. did u just google them one by one

[radiant idol]

Mhm

[smoky pulsar]

thatscrazy

[radiant idol]

That’s how you learn

[tepid olive]

wait

opainject requires cydiasubstrate???

[smoky pulsar]

thats too crazy man

[slim bramble]

Uhhhhhhh I think Nightwind used a lot chatgpt

[granite frigate]

huh no

[smoky pulsar]

i cant do that. i like to learn from the roots

[tepid olive]

or is it just a theos thing

[acoustic imp]

@smoky pulsar just try to make a tweak, and learn as you go, but following guids i helpfull

[radiant idol]

pov I started learning in 2021

[acoustic imp]

https://uroboro.github.io/Learn-Objective-C-in-24-Days-Clone/

[tepid olive]

POV I started learning 2 weeks ago

[radiant idol]

ehhh

[sonic totem]

Jupiter needs it

[slim bramble]

you are definetely the guy to say that

🤓

[smoky pulsar]

i'll try 😔

[tepid olive]

damn you theos

[granite frigate]

POV i started learning years ago and haven't gotten good because i'm inconsistent

[tepid olive]

theos must've inserted it as a dependency

[smoky pulsar]

so do all tweaks use objective c?

[radiant idol]

No

[tepid olive]

even though I don't even do any hooking

[granite frigate]

if you're making a dylib with theos i think it just assumes you're making a tweak and hardcodes to cydiasubstrate

[slim bramble]

there is an assembly tweak

[acoustic imp]

sm use swift, but like OBJC>>

[tepid olive]

can I like

disable that

[granite frigate]

just make a executable and dylibify it idk

[radiant idol]

≈ 97% use objc

[slim bramble]

Still can't believe 99.999999% of tweak devs got braindamage by using swift or objc

[radiant idol]

¯_(ツ)_/¯

[tepid olive]

ohh wait

[smoky pulsar]

its js 1 page?

[tepid olive]

I just have to use the library.mk instead of tweak.mk

[granite frigate]

🔥

TIL that exists

sorry

[tepid olive]

it's ok

[slim bramble]

make do is always the pray command

[acoustic imp]

wha

[tepid olive]

EXC_RESOURCE -> launchd[1] exceeded mem limit: ActiveHard 50 MB (fatal) apparently I have to disable jetsam in launchd too

[granite frigate]

i think palera1n's jbinit has stuff for that

[tepid olive]

nah I know how to do it

I already have the code for it in my stuff

I'm only gonna disable it while doing kopen because that's probably the only thing that uses that much memory

[slim bramble]

@sonic totem wen eta achilles linux fix

[topaz yew]

so real

[tepid olive]

real

[sonic totem]

Not today

[slim bramble]

L

[sonic totem]

I have:

• Family round
• Work tomorrow
• Homework
• Swift Challenge

Also I’d have to get my RPi out again

[tepid olive]

swift challenge

[sonic totem]

Yuh

[tepid olive]

what's that?

[sonic totem]

https://developer.apple.com/swift-student-challenge/

[slim bramble]

plz don't join I want to win :D

[tepid olive]

oh interesting

nah I suck at swift

[sonic totem]

You can get to go to WWDC

[tepid olive]

oh

[sonic totem]

If you’re top 50

[tepid olive]

my parents wouldn't take me

[sonic totem]

It’s paid for

[tepid olive]

I'm also 15, I kinda doubt they'd let me into WWDC lmfao

[slim bramble]

My mom said she would let me go to WWDC if I got a ticket

[sonic totem]

They do

It’s 13+

[tepid olive]

oh really

hmmmmmmmm

[slim bramble]

<=17

[tepid olive]

where is it?

[sonic totem]

What

[sonic totem]

Cupertino

[tepid olive]

that's california, right

[sonic totem]

Yea

[slim bramble]

yeah

[tepid olive]

I'm on the east coast

new yawk

[slim bramble]

I'm in europe

[sonic totem]

I’m in UK

[tepid olive]

literally the other side of the country

ohhhh

lmfao

[sonic totem]

Where

Oh France

[slim bramble]

open my profile

hard huh

[sonic totem]

Thanks to AlfieWare I can see your location

[tepid olive]

I can probably get into WWDC without paying anyways, my dad is part of the industry

or at least a discount

[sonic totem]

It’s not paid

It’s invite-only

[tepid olive]

oh

(they probably wouldn't invite a google employee)

[slim bramble]

@sonic totem is plane ticket paid 🙏

[sonic totem]

I mean you never know

The AltStore developer went last year

[sonic totem]

Yes afaik

“Travel and lodging” it says

[slim bramble]

Damnnnnnnnnnnnnnnnn

[tepid olive]

I suck at swift anyways

[sonic totem]

Fr

[sonic totem]

Je parle français

[slim bramble]

figma and then transform it into swiiftui

they have something for that

[tepid olive]

AMFI: constraint violation /private/preboot/jb-EB23iu9RTRUF3uZ/procursus/baseboin/Jupiter.dylib has entitlements but is not a main binary

bruh

lmao

[sonic totem]

Which version is this

[tepid olive]

16.2

[radiant idol]

t'es un idiote

[sonic totem]

You need to hook launch constraints

[tepid olive]

I see.

[sonic totem]

Probablement parce que j'ai installé Jade

[radiant idol]

oh

[sonic totem]

Checkmate

[tepid olive]

not that I need entitlements

launchd already has the entitlements I need

[sonic totem]

Oh wait

[radiant idol]

Jade est très beau, mais tu es moche

[sonic totem]

Hm

[sonic totem]

:(

Unneeded

[radiant idol]

non

[tepid olive]

yup I do appear to have to handle launchd exceptions

[sonic totem]

Nightwind pretending you’re French

[tepid olive]

[osservice<com.apple.backboardd>:62] termination reported by launchd (2, 10, 10)

[slim bramble]

Figma 🙏

@sonic totem you speak french ?

[sonic totem]

Also Nightwind what are your pronouns because I genuinely don’t know

[slim bramble]

🙏

[sonic totem]

Un peu

[tepid olive]

although this was actually a kfd failure

[radiant idol]

je suis arménien mais je parle français un peu

[radiant idol]

im a guy

[tepid olive]

so it might just be that it panicked

[sonic totem]

Fair

[sonic totem]

Ah, je comprends

[sonic totem]

Noted

[radiant idol]

ok now lets stop pretending we're fr*nch

[slim bramble]

Reading grammatically correct french is actually weird

[radiant idol]

lol

[tepid olive]

what is happening

[radiant idol]

idk

hel

p

[tepid olive]

my screen went black but it hasn't panicked

[sonic totem]

I’m not French so technically I’m not pretending

[slim bramble]

sorry arm*n*an

[radiant idol]

im not either

[radiant idol]

thanks!

[tepid olive]

guys I can't force power down my home button is broken

[sonic totem]

No one understands UK education so I can’t explain it

[tepid olive]

what do I do