development

[tepid olive]

is it possible to statically link ellekit

[radiant idol]

for once chatgpt said something helpful

[tepid olive]

Prolly a bad idea

but

[acoustic imp]

but sould i use setClass or hook layoutsubviews ?

[tepid olive]

because I need to hook something, before procursus is initialized

[timid furnace]

what the fuck do you need object_setClass for

[tepid olive]

mobilesubstrate

hooking library?

[agile wing]

what are you trying to do?

[acoustic imp]

not hooking layoutsubviews

[radiant idol]

apparently he only needs to change stuff only in one instance of a class

but like theres many other ways of doing this

[radiant idol]

honestly object_setClass is more cursed than hooking layoutSubviews

[tepid olive]

I guess I can use another hooking library tho

[acoustic imp]

yea, basically i want to override the positioning of two views

[radiant idol]

that's fine

you can use layoutSubviews for that

that's what it's for

[tepid olive]

https://github.com/Rprop/And64InlineHook I could probably just use this

[acoustic imp]

but, the other place that would be help full is removing like little gliches in the border radius for the artowrkView

[tepid olive]

I've used it before

[timid furnace]

have fun

[tepid olive]

me?

[timid furnace]

yes

[tepid olive]

I mean could I just like

use opainject to inject ellekit before I inject my dylib

[timid furnace]

or you could just link it normally..

[tepid olive]

I don't know iOS's link paths!

[acoustic imp]

@grave sparrow like fixing this

[tepid olive]

because I'm doing this before the dyld patching

[acoustic imp]

what? it would work, and unless i hook layout subview to apply the radius, it does this

its a UIImageView

[tepid olive]

wait meta made fishhook??

[radiant idol]

yes

[tepid olive]

amazing

I can't use it anyways because it only works for hooking functions with symbols

I don't think I can use And64InlineHook cuz CFI/PAC

the problem is I need to hook a function before MobileSubstrate or any dynamically linked hooking library is available

no during process execution

(opainject)

nooo

I want to hook launchd

I inject my tweak using opainject

but there aren't any hooking libraries available at this point in the jailbreak flow

because I'm making a jailbreak, WITHOUT jbd because opa said launchd is the new way

why is that so damn hard to understand

[radiant idol]

cuz it’s capt

[tepid olive]

lmao

y'all aren't very helpful, I'll just figure it out myself

I literally just told you oh my god

what does this have to do with userspace reboot

the launchd hook is being used instead of jailbreakd, as opa TOLD ME that's the better way to do it

because it's what I'm doing?!

no the problem is

is this is before fakelib

I don't know iOS's link paths

where dyld searches for dynamic libraries??

[timid furnace]

[tepid olive]

oh my god

[timid furnace]

do you not understand how linking on *os works at all

[tepid olive]

you

dyld

is the dynamic linker

[timid furnace]

i think you should learn how linking on *os works

to summarize, where to find dylibs is specified in the binary

[restive ether]

wait until you find out about rpath

questionable

[tepid olive]

ohhh

I see

sudo install_name_tool -add_rpath /var/jb/baseboin/ Jupiter.dylib

so basically just this

and it'll let it search in that path, correct

[timid furnace]

yes and no

[tepid olive]

oh does it not allow symlinks

Alot of things don't like symlinks

especially in *os, at least in my experience

[timid furnace]

here is my tweak

    /var/jb/Library/MobileSubstrate/DynamicLibraries/Dahlia.dylib (compatibility version 0.0.0, current version 0.0.0)
    /usr/lib/libMobileGestalt.dylib (compatibility version 1.0.0, current version 1.0.0)
    @rpath/CydiaSubstrate.framework/CydiaSubstrate (compatibility version 0.0.0, current version 0.0.0)
    /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1292.100.5)
    /System/Library/Frameworks/UIKit.framework/UIKit (compatibility version 1.0.0, current version 4218.1.100)
    /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 1775.118.101)
    /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)
    /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 905.6.0)

ok i cut out a bunch of useless stuff

anyways

it will only search that rpath you add for stuff that specifically references rpath

aka @rpath/CydiaSubstrate.framework/CydiaSubstrate

otherwise it will just use the file path explicitly specified

[tepid olive]

ah

[radiant idol]

@rpath ftw

[timid furnace]

yea but that's just /S/L/F etc so pretty irrelevant

the fallback stuff is basically never used in today's world

[tepid olive]

so can I just directly tell it where the library is, because it should always be in the same place

[timid furnace]

ye

[timid furnace]

you can

generally the consensus is rpath

idk why actually

[tepid olive]

that wouldn't work because the env is already set, because the tweak is being loaded with opainject

once a program is fed the environment, you can't change it, right

[tepid olive]

so, like this sudo install_name_tool -add_rpath @rpath/var/jb/baseboin/ Jupiter.dylib

[timid furnace]

well

the rpath is the path that can change

the path after that is fixed

[tepid olive]

ohh

so. this sudo install_name_tool -change @rpath /var/jb/baseboin/ Jupiter.dylib

[timid furnace]

so i can add these rpaths

• /usr/local/lib
• /var/jb/usr/local/lib
  etc

and if i specify the dylib name to link to as as @rpath/libabc.dylib

then it will search for /usr/local/lib/libabc.dylib and /var/jb/usr/local/lib/libabc.dylib

[tepid olive]

ohhhhh!

alright

[radiant idol]

see

@rpath rocks

[timid furnace]

arguably if this is going to be for the jailbreak process just hardcode it

idk up to you

[tepid olive]

yeah lol

because if I do that then I also don't have to rename ellekit's dylib

sudo install_name_tool -change MobileSubstrate.dylib /var/jb/baseboin/ellekit.dylib Jupiter.dylib so something along these lines

/Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate (compatibility version 0.0.0, current version 0.0.0) this is the line I want to change, right

[radiant idol]

you can specify a couple rpaths

and it'll check each one

at least from what i understand

I know it's used in repack-rootless.sh but there are prob a lot of other cool uses for it

never hurts to have cool features ig

[tepid olive]

which dylib? this one, right libellekit.dylib

there's multiple and idk which one I need 😓

yeah that seems to be the right one

[tepid olive]

anyone know what the panic CS_KILLED initproc exited means?

ohhh

wait

It does that because it isn't launched as debugged

I'm guessing

alright

[topaz yew]

jit

[tepid olive]

I know how to fix it lol

[radiant idol]

anyone have any clue where the dsc is on iOS 17

[visual meadow]

/private/preboot/Cryptexes/OS/System/Library/Caches/com.apple.dyld

[radiant idol]

thanks

[hasty ruin]

i deleted this file and my device is buggin

please help

[hasty ruin]

(i was running out of storage and this file was really big)

[visual meadow]

Sir you cant delete that

Its mounted from a dmg

[hasty ruin]

apfs exploit

[tepid olive]

guys, I'm trying to send an XPC message to launchd, but it just gives me an I/O error

anyone know why

[granite frigate]

#development message

[tepid olive]

well yes I knew that

I basically just copy pasted code from dopamine

and I'm not launchd

soooo

this is literally the code ```c
struct _os_alloc_once_s {
long once;
void *ptr;
};

struct xpc_global_data {
uint64_t a;
uint64_t xpc_flags;
mach_port_t task_bootstrap_port; /* 0x10 /
#ifndef _64
uint32_t padding;
#endif
xpc_object_t xpc_bootstrap_pipe; / 0x18 */
// and there's more, but you'll have to wait for MOXiI 2 for those...
// ...
};

extern struct _os_alloc_once_s _os_alloc_once_table[];
extern void *_os_alloc_once(struct _os_alloc_once_s *slot, size_t sz,
os_function_t init);

xpc_object_t launchd_xpc_send_message(xpc_object_t xdict) {
void *pipePtr = NULL;

if (_os_alloc_once_table[1].once == -1) {
pipePtr = _os_alloc_once_table[1].ptr;
} else {
pipePtr = _os_alloc_once(&_os_alloc_once_table[1], 472, NULL);
if (!pipePtr)
_os_alloc_once_table[1].once = -1;
}

xpc_object_t xreply = nil;
if (pipePtr) {
struct xpc_global_data *globalData = pipePtr;
xpc_object_t pipe = globalData->xpc_bootstrap_pipe;
if (pipe) {
int err = xpc_pipe_routine(pipe, xdict, &xreply);
if (err != 0) {
AppendLog(@"Error on sending message to launchd! %s",xpc_strerror(err));
usleep(500);
return nil;
}
}
}
return xreply;
}

and then I just get I/O error

do I need special entitlement?

@granite frigate

[faint timber]

is 472 correct

[tepid olive]

¯_(ツ)_/¯

[sudden heron]

What are some good debuggers that can run directly on iOS to show the unmangled assembly?

[faint timber]

lldb

[sudden heron]

thanks

[primal perch]

@grave sparrow

[faint timber]

we bout to run this town

bust out the lldb goats

[faint timber]

I'VE ONLY GOTTEN MORE FUCKED SINCE OUR LAST MEETING COUNT

TWICE THE FUCKED DOUBLE THE FALL

https://tenor.com/view/good-twice-pride-double-fall-gif-8046560

I now can't feel my arms and hands

[faint stag]

mangling? bro is debugging swift

[harsh junco]

I’ll steal this

[placid kraken]

new safe mode in sileo

no way

[slim bramble]

Fake

[harsh junco]

What

[placid kraken]

this i guess lol

it didn't look like this before

[harsh junco]

ellekit 1.1.1 thing

[placid kraken]

oh

[fluid lintel]

Can anyone tell me how to extract sandbox profiles starting from an ipsw?

[granite frigate]

i remember Corellium had a sandblaster fork to extract them for iOS 17 betas, but idk

[fluid lintel]

Okay thank you very much. One more question but task_for_pid doesn't work on iOS 16 anymore?

[sonic totem]

It was Cellebrite

[fluid lintel]

Yes yes I found it later I will try. Now I was trying to figure out why task_for_pid doesn't work. In xnu it says it must be a privileged process, I start my process with root, like trollstorehelper does

[granite frigate]

Oops thanks

I was trying to find it and couldn't lmao

Damn i wonder how hard it'd be to intern there

[sonic totem]

Not too difficult if you try hard at projects and make yourself known

[steady nest]

show code

[granite frigate]

I mean coming from TS dev... how hard was it to go from making regular apps to finding a CT bug from diffing lol

[sonic totem]

It wasn’t really that though

Making apps -> diffing CoreTrust took about a year

I also wrote Achilles and published a blog post on that

[fluid lintel]

this spawn with root, and then kern_return_t kr = task_for_pid(mach_task_self(), pid, &task);

can it be related to the fact that I am starting my process from inside private/var/mobile ?

[steady nest]

the tfp code

do you have tfp-allow

[fluid lintel]

yes i have this entitlements:
<key>com.apple.system-task-ports.control</key>
<true/>
<key>com.apple.system-task-ports.token.control</key>
<true/>
<key>com.apple.system-task-ports</key>
<true/>
<key>task_for_pid-allow</key>
<true/>

<key>com.apple.security.get-movable-control-port</key>
                <!-- Allows for task_get_special_port(..TASK_KERNEL_PORT..) -->
            <true/>

[steady nest]

get-task-allow

[fluid lintel]

In my process yes, the process from which I want to get the task port no

[steady nest]

you're missing the entitlement here though

[fluid lintel]

I have this entitlements

[steady nest]

on the child process?

[fluid lintel]

yes in the process run as root, from this process I would like to take the Springboard task port for example

[steady nest]

can you try a non-plat binary

that should be the issue

[fluid lintel]

a so if my binary is not platform I can't take task ports of platform processes ?

[steady nest]

i believe so

[fluid lintel]

but in ios 15 it wasn't like that. and even in XNU I don't see this control.
IN XNU:
/*

• Routine: task_for_pid_posix_check
• Purpose:

•        Verify that the current process should be allowed to
  

•        get the target process's task port. This is only
  

•        permitted if:
  

•        - The current process is root
  

•        OR all of the following are true:
  

•        - The target process's real, effective, and saved uids
  

•          are the same as the current proc's euid,
  

•        - The target process's group set is a subset of the
  

•          calling process's group set, and
  

•        - The target process hasn't switched credentials.
  

• Returns: TRUE: permitted

•        FALSE: denied
  

*/

/*

• Routine: task_for_pid
• Purpose:

•    Get the task port for another "process", named by its
  

•    process ID on the same host as "target_task".
  

•    Only permitted to privileged processes, or processes
  

•    with the same user ID.
  

•    Note: if pid == 0, an error is return no matter who is calling.
  

• XXX This should be a BSD system call, not a Mach trap!!!

[steady nest]

you can check that with a non-platform binary

[fluid lintel]

yes of course, which one do you say to test on ?

[steady nest]

any

as long as it's not a platform binary

[slender glade]

👁️

[acoustic imp]

its beter to have less %hooks in tweaks right?

[fluid lintel]

the same error

[steady nest]

can you geteuid and be sure you're 0

that's very weird

[steady nest]

yes

[limber karma]

@limpid pumice do you hve any snapchat tweaks?

[fluid lintel]

my uid e my guid is 0

[fluid lintel]

From what other path could I start it to check if this is the problem ?

[steady nest]

from the /var/jb symlink since that'd be outside var

do check the console app logs though, there might be a clue there

[sonic totem]

Inside /var/containers/Bundle

[granite frigate]

/private/preboot/hash/your-binary

or ^

[tepid olive]

hrtowii

you

never responded

I'll ask again; Why when sending a message to launchd the same way launchctl does it, why do I get an I/O error?

[radiant idol]

depends

but generally yes

[acoustic imp]

like instde of hooking somthing just to hide it, do it from the super view wich is a "needed" hook

[tepid olive]

#import "server.h"
%hookf(void *,xpc_server_thing,void *a1,void *a2,xpc_object_t msg,void *a4) {
    if(!server_hook(msg)) {
        return %orig;
    } else {
        return 0x16;
    }
}
void initme(void *addr) {
    %init(xpc_server_thing = addr);
}
``` my hooks

lmao

[acoustic imp]

[radiant idol]

i have no idea what that means

[radiant idol]

spinlock panics yay

[tepid olive]

what??

[radiant idol]

C func hooks

cause spinlock panics

[tepid olive]

they do?

[radiant idol]

yeah

[tepid olive]

why

[radiant idol]

idk if the issue is fixed on iOS 16 though

[radiant idol]

uhh

hold on

[tepid olive]

It doesn't happen to me

I haven't gotten a singular spinlock panic

[radiant idol]

I mean one or two hooks should be fine I guess

[acoustic imp]

https://github.com/opa334/Dopamine/issues/274

[radiant idol]

the more c func hooks you have, the greater the cahnce

[radiant idol]

yea that

[tepid olive]

Didn't opa say it was just an iOS 15 issue tho

[radiant idol]

¯_(ツ)_/¯

[acoustic imp]

like i instead of %hooking the volume bar to hide it, i could just hide it from its superview hook

[radiant idol]

i mean it doesnt really matter that much

[tepid olive]

fair enough

hMMM

still confuzzled as to why I/O errors

but

¯_(ツ)_/¯

[fluid lintel]

I don't think it depends on the path, on preboot I can't write, on /var/containers/Bundle, I get the same error

[tepid olive]

don't tell me what to do

[radiant idol]

wat

[tepid olive]

it's telling me getsegbyname is deprecated

[radiant idol]

oh

tragic

make your own impl then

trolle

[tepid olive]

nah it doesn't matter it still works lol

[radiant idol]

bad

also

either use camelCase or snake_case

writingvarnameslikethisisunreadable

[tepid olive]

I don't follow naming schemes, I'm too lazy

although there's probably a VSC extension to do it for me lmao

[radiant idol]

honestly probably yeah

[tepid olive]

@timid furnace May I asketh a question

[harsh junco]

iOS 15+

[radiant idol]

this should be the official forkfix icon

[indigo peak]

question
if theres entitlements that require a dev account to sign with, and i sign with a free acc will the installed binary on my phone have those dev acc entitlements?

[slender glade]

oh

nvm

i misread

[tepid olive]

lmao

[sonic totem]

It wouldn’t install

[slender glade]

yea

[indigo peak]

so if its signed with a free account then the dev entitlements would be removed?

[tepid olive]

alfie can I ask u question

[sonic totem]

The binary can have any entitlement as long as the provisioning profile has them too

[slender glade]

i meant to say if u sideloaded w the free acc then u'd have the free acc entitlements and vice versa

[granite frigate]

No it wouldn't let you install it

[sonic totem]

It just wouldn’t let you install the app with those entitlements

[sonic totem]

Sure

[granite frigate]

I tried adding some dev account entitlement and it just refused

[sonic totem]

Imagine not having a developer account

Only good use is sideloading

[acoustic imp]

debatable

[tepid olive]

Do you know why when I send a message to launchd the same way as launchctl does, why it gives me an I/O error?

[slender glade]

mf just called me out

[hexed knot]

Who said u can talk 😭😭

[slender glade]

CGRect *rect = [[CGRect alloc] init];

[tepid olive]

(this launchctl https://github.com/ProcursusTeam/launchctl)

[acoustic imp]

real

[indigo peak]

hmm tryna figure out how gameseagull for regular sideload

[sonic totem]

No idea sorry

[indigo peak]

and tryna patch the need for the team id

[tepid olive]

aw man :(

[sonic totem]

[radiant idol]

CGRect ***rect = *&[[CGRect alloc] init];

[sonic totem]

Hmm

Maybe it’s an iOS limitation

[tepid olive]

I told my beta testers it'd probably be ready this weekend but I didn't realize I'd get stuck here

[slender glade]

bro misunderstands pointers 💔

[radiant idol]

let me be

[tepid olive]

why do you make it a pointer and then dereference it

[radiant idol]

why not

[tepid olive]

what's the point

other than using up resources what is the point

[hexed knot]

CGRect *rect = [[CGRect alloc] initWithFrame:CGRectMake(20,20,20,20)];

[sonic totem]

@indigo peak send me an ipa i can test with enterprise cert

[radiant idol]

thats the point

[slender glade]

talk ur shit

[indigo peak]

https://github.com/donato-fiore/TrollStoreGameSeagull/releases/tag/v2.1

[slender glade]

bro this mf

[tepid olive]

NW

[sonic totem]

Block

[slender glade]

BRO

[acoustic imp]

how can i tell if a view exsists other than like if(self.view)

[acoustic imp]

web discord

[tepid olive]

Nightwind is such a goofy goober

[hexed knot]

@slender glade what is personal 3 reloaded

[tepid olive]

@granite frigate I know u did a bunch with launchd, do u know

[slender glade]

its oop

[radiant idol]

advanced placement

[slender glade]

remake of P3

[hexed knot]

Is persona 3 good

[slender glade]

yes

[granite frigate]

Uh nope!

[tepid olive]

mAN!

[slender glade]

its amazing, magnificent

[indigo peak]

bros really using discord in a browser

kekw

[acoustic imp]

@radiant idol , and other than if(view with tag 888)

[tepid olive]

apparently I'm just having some weird issue!

[slender glade]

do u have a problem

[acoustic imp]

yes

[radiant idol]

if (self.view)

[hexed knot]

Im tryna get into some of those anime story games like persona and danganronpa

[acoustic imp]

#development message

[slender glade]

play p5r or p3r first

[hexed knot]

I been replaying all the yakuza games for lad infinite wealth

[radiant idol]

if (self.view != nil) or if (self.view != NULL)

[slender glade]

p3r is on gamepass so...

[slender glade]

bro just do if (self.view) lol

[hexed knot]

Why not 1-2-3-4-5

[torn cloud]

if (self.view) { // Code to be executed if self.view exists // Use 'self.view' within this block } else { // Code to be executed if self.view is nil }

the most objc i know

[slender glade]

nah persona doesnt work like that

the first game is from 1994 and doesnt play out well now

[radiant idol]

if (!(!(!(!(self.view == nil))))) this is the other way that I know

[hasty ruin]

mfs DRM'd the soundtrack 💀

[brazen timber]

big mistake

[hasty ruin]

it's an exe

[acoustic imp]

ok, this also might eb a fior/christian question but, rember how you like add your own view property to a view. Does that property only show up when you add it in the hook?

[brazen timber]

lmao what

💀

[slender glade]

yea its a separate app

[hexed knot]

Then how tf ima know what happened first

[slender glade]

for the collectors ed

[slender glade]

each game plays out on its own they're not connected

[hexed knot]

Word

[brazen timber]

does persona use nexus drm

[radiant idol]

@indigo peak / @hexed knot this is a @indigo peak / @hexed knot question

[slender glade]

97% of reviews are positive lol

[radiant idol]

yes

[brazen timber]

gg my pc abt to get bootlooped

actually over

[indigo peak]

yes
when you do %property

[hexed knot]

Ok its a @indigo peak question

[indigo peak]

only way for it to actually exist

[acoustic imp]

muchas gracias

[hexed knot]

@slender glade so 5 or 3 first

[indigo peak]

because if you just define it in the interface it and try to access it, youll crash

[radiant idol]

no

itll go perfectly fine

fr

no crashes

(try it)

[indigo peak]

it will crash

[hasty ruin]

ofc nightwind says that

[indigo peak]

trust me

[acoustic imp]

i trust fiore

[hexed knot]

God damn bruh

60 dollars

70 dollars

Guess ima get gamepass and play on my pc

Who the fuck pirates pc games

[tepid olive]

bad idea

[tepid olive]

fr

[acoustic imp]

Aaron!!!!!!!!!!

[radiant idol]

trust capt instead

[slender glade]

Whichever u can get access to the easiest

But I’d prefer 5 royal first

[tepid olive]

even worse idea

[slender glade]

Yea I just use gamepass lol

[hexed knot]

If i bought it id play 5 royal😛

But yea ima get gamepass and play 3 reloaded

[slender glade]

bet

[tepid olive]

yup

[hexed knot]

Dis game is the shit tho

I bought it physical

[fluid lintel]

what is a difference between task_name_for_pid vs task_for_pid?

[hexed knot]

Jus gotta finish yakuza lad then i can play it

[tepid olive]

task names and tasks are different

a task name is probably literally the name of the task lmao

[sonic totem]

iCraze can’t even put that into perception

[hexed knot]

@indigo peak u listen to ji?

[indigo peak]

only a couple songs

[slender glade]

💀

[fluid lintel]

having the task name is not possible to get the task ?

[indigo peak]

mainly this one

[hexed knot]

Type shit

[slender glade]

Sega getting a little too excited bro 70$ for new games

[tepid olive]

the task is an object represented by a number that lets you read and write it's memory and stuff like that

[tepid olive]

that's the new norm

[topaz yew]

what task are you trying to get

[slender glade]

well that’s too much imo

[tepid olive]

I agree but even nintendo is doing it lol

[brazen timber]

me when game quality is significantly worse and games now cost more

[tepid olive]

literally

and now it's impossible to crack games cuz denuvo

[hexed knot]

Nah im cool with the 70 its worth it in this case, just fuck them for locking new game+ behind a 15 dollar paywall

[brazen timber]

first the erode the real value of games and now they increase the nominal cost too

[topaz yew]

wen eta actually good game

[brazen timber]

getting double dipped

[brazen timber]

crazy transphobic russian women:

[slender glade]

Oh AND some achievements are locked behind the dlc which is stupid

[fluid lintel]

I would like to get SpringBoard, but task_for_pid does not work on any process even having both entitlements and uid 0

[tepid olive]

yeah literally only empress

[granite frigate]

empress the goat

but shes insane

[harsh junco]

And

[brazen timber]

u have to be a lil insane to crack denuvo

i get it

[topaz yew]

whats your ultimate goal with springboard's task?

[granite frigate]

not a liil

like a. lot

[hexed knot]

Yup

[tepid olive]

apparently

[hexed knot]

Sega definitely took infinite wealth too serious but

RGG released an amazing game

[brazen timber]

the italians are gone too

literally only empress left

[tepid olive]

and empress only cracks the games they're interested in

[brazen timber]

or games that make her popular

[tepid olive]

yeah

[brazen timber]

apparently she hates rdr2 but cracked it twice cuz it made her famous

[fluid lintel]

just going to read objects in memory, I don't have a specific goal I'm just studying how ios 16 works, but I can't understand why task_for_pid doesn't work

[tepid olive]

yeah lmao

[hexed knot]

How could someone hate rdr2

Such a good game

[brazen timber]

fr

goty was stolen

[tepid olive]

my dad just bought rdr2 yesterday and he says it's amazing

[hexed knot]

Best rockstar game

[tepid olive]

I'm more of a square enix guy

[hexed knot]

Do they even make new games

[tepid olive]

I'm willing to pay for square's games

[brazen timber]

square enix needs to hire people to come with titles instead of ai

'triangle strategy'

'harvest villa'

[tepid olive]

One of the only AAA publishers I'll pay for

[hexed knot]

Last square enix game i can recall that isnt ff or some other shitty game is life is strange true colors

Amazing game

[tepid olive]

Last square enix game I can recall that isn't FF is KH3

Still waiting on updates on KH4

they announced it like 3 years ago and haven't said anything since

probably cuz they've been focusing on FF7 Rebirth

which I preordered a while ago

[hexed knot]

Damn i should replay life is strange true colors lowkey

I bought that one physical too

[brazen timber]

i've never played a ff game but considering there's like 20 it's definitely not their final fantasy

those mfs are living

[tepid olive]

Neither have I

[hexed knot]

Frl

[tepid olive]

lmao

[hexed knot]

Apparently its really good but idek what it is

Which one do u play

[tepid olive]

but I had to preorder FF7 Rebirth because it looked really amazing

[tepid olive]

Start with FF7 afaik, it's the first of the modern ones iirc

although we're on

FF XIV rn

(16)

[sonic totem]

When you submit an app to TestFlight/App Store do you send the source?

[acoustic imp]

can i %group method hooks ?

[tepid olive]

good question

I mean I'd assume so

[granite frigate]

No, they just want the binary

[tepid olive]

really?

[sonic totem]

Okay thought so

[granite frigate]

Yh

[indigo peak]

custom "Lets play 8ball! message"

[sonic totem]

It’s been a while since I’ve submitted something

[topaz yew]

so real

[indigo peak]

[granite frigate]

I mean would facebook really submit their src to app store

[acoustic imp]

ur him

[granite frigate]

Wrong reply but yh

[indigo peak]

oh shit uhhhh

filter

fuck

[topaz yew]

[acoustic imp]

[tepid olive]

is there a list of all the initproc error codes somewhere?

[sonic totem]

True

[timid furnace]

@sonic totem is it better to do type manipulation in ida and then start hand editing, or should i do it straight from hand editing

[sonic totem]

Type manipulation?

[indigo peak]

better

[timid furnace]

fixing up types

[sonic totem]

Also imagine affording IDA

[tepid olive]

fr

[timid furnace]

ie. IDA thinks pointer is one type, it is actually another type

[acoustic imp]

better

[sonic totem]

Oh hm

I just guess

[timid furnace]

no i mean

[sonic totem]

If it’s a struct

Try figuring it out by hand maybe

[timid furnace]

there's only two structs here

[tepid olive]

I take an educated guess based on symbols given

[timid furnace]

it's just is it faster to change the type in ida or to edit it in the source

[indigo peak]

1 last time

:D

[timid furnace]

i think i'll just do it in the source

[sonic totem]

Source?

[timid furnace]

decomp source

[sonic totem]

Oh

Probably in IDA

Change type and then export source

[timid furnace]

i already started editing it and shoving all of these macros into an enum for IDA is going to take a while

[tepid olive]

like if I know what types a function call takes, and it passes one of the arguments into another function, and I have that symbol

[brazen timber]

protip edit structs in the local types view

[tepid olive]

then I can easily infer the type

[brazen timber]

not the structures view

the local types view is much better

[tepid olive]

imagine having IDA Pro

[sonic totem]

Fr

I need

[timid furnace]

yea but that doesn't help me when all these constants are defined as macros

[tepid olive]

Ghidra sucks

[brazen timber]

IDA ON TOP.

[tepid olive]

[timid furnace]

alright back to crying in decomp i go

[brazen timber]

what r u re'ing

[timid furnace]

stuff related to arm64 installd bug

[brazen timber]

oh

you can create a type library ig

[timid furnace]

the problem isn't that i don't know which type it is

the problem is ida doesn't know and picked the wrong type

[tepid olive]

ghidra:

[brazen timber]

fr

[timid furnace]

ie

it thinks v82 is fat_arch*

it is actually fat_arch_64*

sizeof(fat_arch_64) == 32

[brazen timber]

that looks like a struct

[timid furnace]

that is what i mean by fixing all the types

[tepid olive]

gimme IDA

or suffer the consequences

[timid furnace]

but doing this in ida, reexporting, and then fixing up all the constants is going to take too long

so i will just do it by hand

[brazen timber]

i know what you meant

but i dont think there's a quicker way to do this

[timid furnace]

there's only 8 instances

it's fine

[tepid olive]

I've scoured the internet but apparently noone uses IDA on mac

[brazen timber]

true then

[tepid olive]

(wait I can just use wine)

[harsh junco]

Jtool

[brazen timber]

the latest version of mac ida leaked is 7.0

use 8.3 in wine

oui

[tepid olive]

I use jtool lmao

[brazen timber]

in linux everything works including the debugger

idk abt mac

[tepid olive]

I'm only on mac cuz XCode

this is a hackintosh

[tepid olive]

(wait oh no does wine work on AMD hackintoshes)

[faint timber]

I’m only on Mac because it’s the only correct choice

[tepid olive]

yeah and I'm also on mac cuz app support of Windows, but still *nix

[brazen timber]

yuck

i use wsl for that

[harsh junco]

jtool is cool

[tepid olive]

I don't like windows

[indigo peak]

and?

[torn cloud]

how much money do you have

[hasty ruin]

ida 100% discount:

[brazen timber]

abt 1.8 million on ida licenses right there

[torn cloud]

piracy

[brazen timber]

false

i paid that

[torn cloud]

you have a lot of money

imagine not using open source

[sonic totem]

Didn’t work

[indigo peak]

rip

[sonic totem]

Like it installed

But other people can’t see it

[fluid lintel]

But are you sure that with fastpathsign all signature entitlements are enabled?

[sonic totem]

You have to sign with the entitlements

There’s a couple that are restricted

See TrollStore README

[torn cloud]

hackintosh

[tepid olive]

yup

[indigo peak]

someone needs to have a talk with the dev of gamepigeon

[sonic totem]

Heard he’s a scammer

Idk that’s what iCraze told me

Had to change original message

Too mean

[radiant idol]

I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing I hate diffing

[tepid olive]

yeah

[broken mantle]

Yes. I still use Wine for my Hackintoshes.

[sonic totem]

Me when CoreTrust

[fluid lintel]

OkOk taskforpid is not blocked. But it doesn't work

[radiant idol]

Alfie how do I see the actual side by side diff between two matched functions from two bins in Ida

I think I’m dumb

[sonic totem]

BinDiff

[radiant idol]

Yes I have that

But how do I actually see them side by side

Do I just open another window with the other bin or what

[steady nest]

no arm decompilers

[indigo peak]

does anyone know what happened to my ida?
i used the exact same version of ida to decomp both these binaries, one was 1-2 years ago and the other was recent
it happens on any binary now, not just this particular one

is the old one ^

is the new one^

[sonic totem]

Export the .BinExport for the two bins

Create a new diff in BinDiff

And see

[radiant idol]

oke

let me see how that goes

[tepid olive]

you could also use google's thing

[brazen timber]

7.7 arm decompiler + https://github.com/x0rloser/ida_dll_shim

🥱

[tepid olive]

https://github.com/google/bindiff

[steady nest]

BANGER REPO

[sonic totem]

That is what we are talking about

[tepid olive]

oh lmao

[tepid olive]

frfr

[radiant idol]

Can I not view pseudo code in bindiff? :(

I can’t read asm

[timid furnace]

old binary or old screenshot?

[indigo peak]

thats the old binary in the same ida

[timid furnace]

yea

welcome to objc optimizations

get newer ida

[indigo peak]

i need crack

like ida crack

[timid furnace]

[indigo peak]

not crack drug

well

actually

either will do

someoen sent me 8.3.7 crack but idk if i trust it lmao

[brazen timber]

it is real

[timid furnace]

wtf is 8.3.7

[brazen timber]

yeah it's 8.3 lol

[indigo peak]

im slow

its .7z

LOL

8.3

😭

[brazen timber]

but ida doesn't sign binaries and all pro versions are watermarked so hashes are diff

no way to easily verify that doesn't have some juicy malware

[radiant idol]

so now to figure out what the actual diff is

[brazen timber]

run it in vm or gamble

[indigo peak]

so its actually 8.3

im just kinda dyslexic apparently

[sonic totem]

No

Best you can do is find the function in IDA and copy pseudo

[indigo peak]

guess im gambling

[tepid olive]

frfr

[torn cloud]

i need ida pro

where do i get it

like for free

[sonic totem]

You get it as part of a job

Or you find it yourself

[brazen timber]

if u can't google for ida pro u dont deserve ida pro

[torn cloud]

all the copies are for windows

[brazen timber]

it's simply the rules

[torn cloud]

i did

all for windows

i looked on the bay as well

none for mac

[brazen timber]

yeah because the latest leaked version for other operating systems is 7.0

use 8.3 in wine

[torn cloud]

k

[slim bramble]

what os ?

[brazen timber]

bro read like 3 messages above

😭

[slim bramble]

😭

[orchid fulcrum]

`- (BOOL)isSelected {
if([vibrationDefault boolForKey: @"silent-vibrate"]){
return NO;
}
else{
return YES;
}
}

• (void)setSelected:(BOOL)selected {

  if (selected) {
  // Your module turned selected/on, do something
  [vibrationDefault setBool:NO forKey:@"silent-vibrate"];

  } else {
  // Your module turned unselected/off, do something
  [vibrationDefault setBool:YES forKey:@"silent-vibrate"];
  }

  [super setSelected: selected];
  }`

ccsupport tweak. would this on its own handle the selection ?

because it doesn't when i test. the suite is "com.apple.springboard"

[orchid fulcrum]

or must i use NSNotificationCenter ?

[indigo peak]

@timid furnace how do i move my 7.7 decompilers to 8.3

the crack doesnt have arm decompilers

[brazen timber]

#development message

[brazen timber]

the decompilers are in plugins

hexarm

hexarm64

smth like that

[indigo peak]

worked

thanks

[acoustic imp]

🎉🎉

@radiant idol

[indigo peak]

good use of snapper for the vid

[hasty ruin]

gg

[indigo peak]

i wouldnt have known othwerwise

[sonic totem]

I don’t get it

What’s the point

[indigo peak]

blind

mf

captinc is typing

inshallah

[acoustic imp]

🔫

(oops piarcy)

[indigo peak]

he has the funny s name tweak

[sonic totem]

Can i pirate Nexus then??

[indigo peak]

can i pirate typecentry

[tepid olive]

lmao

[indigo peak]

i wanna try to crack nexus

but i cant find a deb

and i am not paying for it

[sonic totem]

iCraze DRM is bulletproof

[indigo peak]

this sucks

[acoustic imp]

its manually obfuscated to

[indigo peak]

fuck new ida

[tepid olive]

Register dump:
 rip:00006ffffd026be0 rsp:000000000041f958 rbp:0000000000000000 eflags:00010246 (  R- --  I  Z- -P- )
 rax:0000000002f38b20 rbx:000000000041fd70 rcx:0000000000000000 rdx:00000000fbffffff
 rsi:0000000000000000 rdi:0000000002f38b20  r8:00000000bfffffff  r9:0000000000ac01e0 r10:000000000000000b
 r11:0000000000000080 r12:0000000000000000 r13:0000000000000000 r14:0000000000000000 r15:0000000000000000
Stack dump:
0x0000000041f958:  00000001401218fe 000000000041fd70
0x0000000041f968:  0000000000000000 0000000000000080
0x0000000041f978:  000000000041faa0 0000000000000000
0x0000000041f988:  0000000000000000 0000000000000000
0x0000000041f998:  000000014011ff38 00000000ffffffff
0x0000000041f9a8:  00000000ffffffff 000000000041faa0
0x0000000041f9b8:  0000000000000000 000000000156a6b0
0x0000000041f9c8:  0000000000000001 0000000002f94b70
0x0000000041f9d8:  0000000000000007 0000000000000007
0x0000000041f9e8:  00006ffffd3a6928 0000000140297da8
0x0000000041f9f8:  0000000000000000 0000000140297d38
0x0000000041fa08:  0000000000000100 0000000000000000
Backtrace:
=>0 0x006ffffd026be0 in qt5core (+0x1c6be0) (0000000000000000)

wine why do u do dis to me

[topaz yew]

@grave sparrow dyk anything about macos framebuffer

how to write to it

[radiant idol]

Nice

[indigo peak]

i made an app for writing to the framebuffer in iOS but its ppl-protected

i think

either that or i suck at coding

[sonic totem]

You can do it with CoreTrust bug

Serotonin does it

[tepid olive]

PPL can't exist on MacOS afaik

[sonic totem]

Verbose boot

[sonic totem]

It exists

[tepid olive]

wait really

[sonic totem]

Yes

[topaz yew]

yah

[tepid olive]

ohhh wait I'm thinking of KTRR

[indigo peak]

i did it in ios 15 lol

[sonic totem]

Apple Platform Security Guide is wrong

[sonic totem]

Also exists

[tepid olive]

oh

[indigo peak]

oh wait

[tepid olive]

oh so appl lied to me

[indigo peak]

thats what im thinking of too

ktrr

not ppl

whoops

[visual meadow]

They changed framebuffer a lot in 16

[sonic totem]

wait until you realise you can’t create an IOSurface for the framebuffer on A15+

[acoustic imp]

SPTM

[sonic totem]

No

DCP

[acoustic imp]

oh

whats that

more security?

[sonic totem]

Display CoProcessor

[acoustic imp]

oh

is it A15+ ios 15+ ?

[indigo peak]

I was manually writting the bytes to the vinfo struct

[sonic totem]

LOL

[sonic totem]

Idk

Just didn’t work for me on A15/16.3

[indigo peak]

tf you mean LOL

[sonic totem]

Just an L

For you

[visual meadow]

(L)OL

@sonic totem siguza responded to whatever you were talking about

Lol

[tepid olive]

ayyy I got it to work

[topaz yew]

i guess the alternative to controlling the screen is stripping down the default environment and make room for my own stuff

[radiant idol]

i hate iOS 17.0 i hate iOS 17.0 i hate iOS 17.0 i hate iOS 17.0 i hate iOS 17.0 i hate iOS 17.0 i hate iOS 17.0 i hate iOS 17.0

[sonic totem]

Yea just seen it

Not that important

[sonic totem]

Me when i had [REDACTED] but it wouldn’t work

[tepid olive]

I love [REDACTED]

[kind herald]

!

[tepid olive]

shoo

[kind herald]

Oh dear

[radiant idol]

me when apple changed like 2 cells in the settings app so it broke my tweak

[tepid olive]

go out of development

[kind herald]

oh no

[radiant idol]

only TWO

???????

[kind herald]

nexus

[radiant idol]

IDA is on crack

[ashen birch]

yes !

[radiant idol]

are you drunk again

uh huh

[steady nest]

a14 also has dcp

and you're able to create iosurfaces on those

also for a15, it's what's used for stable krw isn't it

[sonic totem]

Wait

It might have been A14 and up that broke

[sonic totem]

Yeah but an IOSurface for the framebuffer idk

[steady nest]

hum, idk

if anything, something broke with newer versions

I couldn't create IOSurfaces on iOS 8 and 9 either, but could just fine on 10 and above (same device and all)

[topaz yew]

spaces, dock, mission control, all have to go bye bye (though i should be able to disable most of this via hooking the dock itself)

[tepid olive]

I go bye bye

[topaz yew]

so real

[tepid olive]

fr

[orchid fulcrum]

Can someone help plz. Cant find anything about how to use ccsupport

[acoustic imp]

L

[placid kraken]

do you hardcode every cell????

[radiant idol]

what

[placid kraken]

why else would apple adding more cells break your tweak other than if you hardcoded the cell ids lol

[radiant idol]

because

those cells have been there

since

like

ios 13

but

apple only changed those two cells t use a different kind of cell

idk

its stupid

[placid kraken]

i love apple

i love being stuck in an ecosystem i cant leave anymore

😊

[harsh junco]

Get all your photos

All ic drive shit

[placid kraken]

no its not that

[harsh junco]

?

[placid kraken]

its that i cant drop another £1200 on a windows machine and another £1000 on a samsung phone

maybe when i turn 16 and get a job lol

[fluid lintel]

Could this method although old work on iOS 16?
https://newosxbook.com/articles/PST2.html

[primal perch]

capt likes men

[placid kraken]

correct

[vivid dew]

@restive ether you buying?

[fluid lintel]

Debugserver with trollstore cannot be used?

[restive ether]

i’m interested

[visual meadow]

Is this still available?

[harsh junco]

You COMPLETELY miss the point of #development . #development is not “ @slim bramble @acoustic imp hey how do I do this .” #development is not HD’s intellectual discussion. #development is not, StackOverflow or Theos server. #development is a place for people to be monsters – the horrible, senseless, uncaring monsters that they really are.
Capt types a message and we laugh. Nightwind loses his sanity we laugh.
Developer leaves we laugh, and ask for more. Weird code, swift, capt – we laugh. 1984, assembly, OOP, *phobia, and baseless hate – we laugh. We are mindless “me-too”ism; we are irrational preference; we are pointless flamewars; we are the true face of the r/jailbreak.

[acoustic imp]

?

[ashen birch]

yappin

[blazing warren]

You COMPLETELY miss the point of #development . #development is not “ @slim bramble @acoustic imp hey how do I do this .” #development is not HD’s intellectual discussion. #development is not, StackOverflow or Theos server. #development is a place for people to be monsters – the horrible, senseless, uncaring monsters that they really are.
Capt types a message and we laugh. Nightwind loses his sanity we laugh.
Developer leaves we laugh, and ask for more. Weird code, swift, capt – we laugh. 1984, assembly, OOP, *phobia, and baseless hate – we laugh. We are mindless “me-too”ism; we are irrational preference; we are pointless flamewars; we are the true face of the r/jailbreak.

[ashen birch]

anyways

use my tools

i dont feel like listing them out

kthx

[slim bramble]

https://tenor.com/view/yapping-yapping-level-today-catastrophic-yapanese-gif-13513208407930173397

[acoustic imp]

me asking how to do sm started the OOP thing lol

(a while ago)

[slim bramble]

You gotta see what I'm adding

[ashen birch]

"iboot patcher in python isn't real, it can't hurt you"
iboot patcher in python: https://github.com/m1stadev/eyepatch/blob/master/eyepatch/iboot/iboot64.py

[slim bramble]

eta lua eyepatcher

[ashen birch]

dn

unironically that'd be way more annoying to do

are there even be lua bindings for capstone

[slim bramble]

asm patcher

:

[restive ether]

yes

[ashen birch]

ok nvm prob not hard then

[restive ether]

i actually have no idea but i’m assuming someone’s wasted their time doing it

[ashen birch]

actually huge trolling: fuck capstone bindings, just require an internet connection and export disassembly to armconverter's API

that'd be so godawful slow

[slim bramble]

tf is capstone

😭

[ashen birch]

disassembler

i use it in eyepatch

(along with keystone, an assembler)

[slim bramble]

JABA

JAVA

TF IS NODEJS DOING THERE 😭

[ashen birch]

those lua bindings are old as shit they probably don't even work with 5.x

[slim bramble]

java :

[ashen birch]

aren't there java bindings in upstream

[brazen timber]

please stfu

LOL

[slim bramble]

????

[ashen birch]

https://github.com/capstone-engine/capstone/tree/next/bindings/java

[slim bramble]

their website is outdated af

[ashen birch]

very

[faint timber]

lets update it more

[ashen birch]

their docs are also mid

[faint timber]

need to get the ball rolling on py apple

[ashen birch]

mf i've already been pulling a sisyphus

[faint timber]

cuz at this point I really don't want to use limd anymore

well I don't really know py all too well and I'm taking a py class this simester so that may help

[ashen birch]

dub

@faint timber you want an invite to equinox repo

[faint timber]

sure

[ashen birch]

https://github.com/m1stadev/equinox/invitations

i wanna talk to doronz sometime about maybe splitting up pymd3 into a few projects bc it's really starting to get bloated

[faint timber]

tss can use mine

just over 300 lines of code

super lightweight

ima move servers

[radiant idol]

does simject

still work

on M1

[ashen birch]

@next wadi you care if i archive applereleases repo or do u want me to just transfer it to you

[faint stag]

how many people are on that dev team anyway, they can't seem to keep up
also:

• ci is there but doesn't have all the targets
• packages maintained by other people and are out of date

[ashen birch]

literally just niklas iirc

[faint stag]

wtf

[tepid olive]

stfu

[radiant idol]

v8

[tepid olive]

what

what is ARMv9

@radiant idol what do you think apple is gonna call ARMv9-A when they eventually switch to it

arm64 OMEGA

arm64p

[kind herald]

arm65e

[tepid olive]

yeah but it's still arm64

not arm65

also the next arch

would be arm128

because it's always multiplied by 2

[radiant idol]

Exactly that

[tepid olive]

I doubt it

[slim bramble]

arm64x

[tepid olive]

maybe

[granite frigate]

arm64f

[kind herald]

amd64e

[hexed knot]

Whos the orange name who has diabetes

[tepid olive]

you

[hexed knot]

@pine holly i might have diabetes

[next wadi]

idrm

Whatever u wanna do big dog

[native dune]

whats this

[ashen birch]

python futurerestore

[tepid olive]

what is

"Apple Core Cluster"

[faint timber]

https://community.arm.com/support-forums/f/architectures-and-processors-forum/5615/what-s-the-difference-between-core-processor-cluster-and-cpu-in-arm-architecture

[tepid olive]

I see

so a cluster of apple cores

@faint timber you know what the "ok2pwrdwn" register does, right

[faint timber]

exactly what the name suggests

[tepid olive]

yes but what does that actually, like do

[faint timber]

not needs really though only boot cpu has the mask to prevent power down

completely powers off the core

[tepid olive]

ah

[faint timber]

but its only really needed for boot core

you can use the pmgr core mmio

[tepid olive]

like I'm trying to find where this is actually used ARM64_REG_ACC_OVRD_disL2Flush4AccSlp

but it's only used in the deep sleep routine it seems

but would that mean I can only use it in that state

[faint timber]

doesn't matter if its used or not or does it?

[tepid olive]

I guess not

but I'm not entirely sure if it'd do what I want it to do

maybe I should ask one of the Asahi devs

[faint timber]

wym what you want it to do

[tepid olive]

well

what I want it to do is disable L2 cache flushing

I know it says it does that

[faint timber]

mhm

[tepid olive]

I just don't want to put time into doing anything with it before I know if it'd work lmao

[faint timber]

thats kinda the point

you should do it

[tepid olive]

true

except

I'm not entirely sure how lmao

cuz like I can't find any documentation on this

[faint timber]

ones the bits

ones the msr

[tepid olive]

yes

[faint timber]

read from the msr, & in the bits

write the new value

[tepid olive]

yeah but how do I read from the msr in userspace lmao

[faint timber]

golb

[tepid olive]

golb

[faint timber]

you can write to mmio right?

[tepid olive]

does golb work on arm64e

[tepid olive]

yes

[faint timber]

then you don't need the other golb stuff

just the exec which can be done with coresight mmio

if it doesn't work so be it

but can't hurt to try

[tepid olive]

see the thing is though