#development
1 messages · Page 129 of 1
msr's don't really have mmio's except in rare cases
you are writing to coresight only
well yes
cpus[cpu_cnt++].utt_dbgwrap_base_off = 0x2040000;
cpus[cpu_cnt].ed_base_off = 0x2110000;
cpus[cpu_cnt++].utt_dbgwrap_base_off = 0x2140000;
idk where to find these
oh yeah right devicetree
RX and TX
CYC: S3_5_c15_c5_0
ACC: S3_5_c15_c6_0
what about it
DBGDTR_EL0: S2_3_c0_c4_0
DBGDTRRX_EL0: S2_3_c0_c5_0
DBGDTRTX_EL0: S2_3_c0_c5_0
what's the difference between the cyclone and the core cluster tho, is the cyclone just one core, the core cluster is all of the cores?
cyclone is the codename
yes
there are two types cores for older devices
PCORE and ECORE
but there might be a subset for different ecores and pcores on newer devices
ah
hm
A13
it exists according to db
why is armconverter telling me "invalid operand"
because armconverter doesn't have everything man
is that even valid
I think
I've never seen that before
it works if I do
MSR S3_5_c15_c6_0,X0
oh wait
do I need the hex encoding of the register
oh no
it has to be a general purpose register
wtf u on
Oh shit man
Alright, let's imagine your computer is like a magical kitchen where it can cook up secret recipes. In this kitchen, there's a special cookbook that helps it make yummy dishes, but the cookbook is kept in a secret drawer.
Now, imagine the drawer is like a special way your computer talks to its cooking tools. Inline MMIO (Memory-Mapped Input/Output) is like having a little window on the drawer. When your computer wants to use a specific recipe from the cookbook, it looks through this window and tells the cooking tools what to do.
You in the hospital rn?
Ahh I read what you were saying, if you had Type 1 you wouldn’t be low like that. So you can prob rule type 1 off the table. Almost always get diagnosed when your blood sugar is too high
I know how MMIO works
it's just CoreSight specifically
well more system registers
I don't really mess with system registers too much
Same difference more or less
It’s a similar mmio but direct arm silicon mmio baked in
still confused?
kinda lol
get to work!
Naw i was
I passed out and hit my head ona kitchen counter
Got my bloodwork done today and doctor said at worst i have diabetes
I still think worst is like hiv or aids
But i dont think i have that

Oh lord
Idk I think I would rather aids over diabetes..
can confirm
trol
hm .
don't u access mmio instead of sysregs
idk
not all msr's have an mmio counterpart
I know of one case it exists, a8 but not sure if it came to be for newer
@wooden yarrow or am I wrong?
oh ur talking about coresight not dbgwrap
i mean
idk much about either
so
.
Coresight is only used here to execute said msr if possible
If there was an mmio that would be used instead
But it’s only known for a8 not a13
I realized that I am in the platform apps is not working, and it gives me -1 as a result of both task_for_pid and pid_for_task.
I was able to list all the active task ports in the system but I can't map them to the process
to your knowledge is it possible by having the task port to derive the task_name?
binaries converted to dylib must be ldid signed before fastPath sign
are ppl still using the XINA version, which uses the rootful debs?
_CFURLRequestCreate this method is present in the sdk tdb's but i can't find the signature anywhere. can any of you tell me how it is called ?
you should probably be using NSURLRequest instead
but yeah CFNetwork (framework) is what you want
@naive kraken
What is the difference?
https://gist.github.com/opa334/1a2e7fd17e63e117c5bf83afb8a6dce3#file-pplrw-m-L176
https://github.com/zhuxinlang/zhuxinlang.github.io/blob/main/GPU_CoreSight.m#L170
it's the same
I cannot show you log for now, but Xina’s ppl set to new value, but yours one doesn’t change
Can you look at my problem please ? İts about ccsupport
One above what u replied to

huh, you are right, if value & 0x1000000000000000 == 0 then value &= ~0x1000000000000000 does nothing
Or at least some info on what methods ccsupport call automatically would be nice
you invert in setSelected but not in isSelected
I did that too same issue
besides all of this doesn't have anything to do with CCSupport, this is Apples API
The API being ControlCenterUIKit right ?
And its private so there are no docs am i correct
yes
Just like how we all laugh at zefram
Damn fast 1984
zeframware
frcoal
is zefram even going to be released at this point 💀
capt keeping it to himself after the memes
OpaCraft
lol
@faint timber HMMMM
i need to learn assembely lol
apart from the driver names on the side idk what this is 💀
This is a case of RTFM
what's that
Read the Fucking Manual
ios...doesn't come with a manual
Arm????
lmao
ok, i read the manual, i'm looking at the Apple Power Management driver?
except
I'm not entirely sure
where the actual function is
this just calls a function inside the vtable
pacxplorer is your friend
seems to be manipulating registers and loading values from memory?
that's the most i could interpret
also why is it in ApplePMGR???
trolling
could it be setL2CFlushTimeout?
that's how drivers work?
no, yes I know that
I'm just confused as to why they put in in PMGR out of all places
looking at asahi
l2c does indeed stand for L2 Cache
kinda obvious
well yeah, but for all I know apple could be just trying to trick me lmao
there's actually multiple interesting functions
Hey, what differences is there between how springboard works on iOS 14 and 15
what are you cooking 👀
i've noticed that apps don't get killed on respring on iOS 15 compared to iOS 14
I love spirnboard
:D
but only somethimes I think
no all apps are killed on 14
I don’t know if this is the right place to ask (since it’s a more advanced question) but is there a way to simulate/cause a full storage bootloop?
no matter what
I want to try something
no on 15, they are sometimes killed
oh ok
springboard 
on 15+ they are killed if there is not enough memory for the necessary processes to reinit after sb dies (i think?)
me hate
do y'all think it's better to temporarily overwrite a whole function to sign a pointer in the kernel, or if it's better to just modify the normal kcall IOSurface function, to just not check signature
(again this is only going to be for at most a few seconds)
Why would you want to fuck your phone ?
else I can send a command ofc
try both, see which works better
Long story short, a friend’s iPhone is doing it and I found a method online for fixing it. I want to test it to see if it works
I don't know if you can simulate it, but I know a way to provocate it
whatever takes more effort and uses more lines of code is probably better practise.
What is it?
that's my theory anyway
Signing the ptr might be more stable because I can cache the signed pointers
dd if=/dev/urandom of=funny.raw
let that run a while
and reboot
whatever code that is more readable/maintainable is probably better, unless one method provides another improvement that greatly outweighs this (such as way faster, or way less resource usage)
(won't have to do the jank whatnot as many times)
I can check rq
how else do you think random syscalls work
as in save them for later use?
knowing apple, probably the secure randomness chip™️
W
yeah, just sign all the kernel functions I need beforehand, and then I won't have to do it at a critical stage of the jailbreak flow
problem is that her device is an iPhone 11 on iOS 13 lol
what's your idea
well to be more specific, she found it online
get to work!
wine on mac is so annoying
if I paste anything anywhere
it completely locks up
and I have to kill it
but I need XCode
nah
use assembly
I guess I could run linux with a mac VM for XCode
hand make the ipas from scratch
you can't hand make a zip file
you can but it'd take hours upon hours for what would take your computer nanoseconds
ok
not for me
me when theos
im literally on a ryzentosh
latest unofficial wineskin winery
how can I tell if a tweak is installed from within in my tweak? like how could i tell if artfull was installed?
probably the dylib
would i just search the dylid DIR ?
or maybe it has some class you can find?
it does thanks
tbh idk
its got a method it adds to a view i hook
I'm confused
if a tweak is currentyl injected
gcenx's right
idk use some objc method to check for its existance
mhm
its like @slector or sm i fg
il ask chat gpt

ping capt
take a look at advanced britghness slider
he'll wrtie an essay about what to do, why it works and some related resources
i asked here, u were here 
where exactly
although
what is slightly confusing
is what timeout means here
They just check for a class
does it mean, like if it takes too long to flush the cache
but I mean you could use dpkg
il jus see if this exists
how long to wait from when a dirty cache line is created to flush
👍
I thought you were asking
how to tell if a tweak was installed while your tweak was running
yes but this works to
but, how do i know that artfull will link initialize its methods before i check
hm
@faint timber does cellebrite's ida_kernelcache usually lock up for a bit after reaching a specific address?
when rewriting code, should i keep original copyrights?
if the original code was under the MIT license
unless it's a carbon copy
it's essentially the same but in C
some things are different
i'm gonna give credits anyway
if you rewrote it in a different language, you can just give credit to the OG authors and give your thing the same license, but it can have your own copyright
to avoid problems
k
I don't think I have that installed
also you're talking about PACMAN, right
pacxplorer literally says it needs it 
rewrite of jprx's pacmanattack
pacman is so weird
fr
it's the most jank of jank exploits ever
and the fact it needs a custom kext ruins everything
it technicalllllly doesn't
@acoustic imp
#include <rootless.h>
bool artful_installed = [[NSFileManager defaultManager] fileExistsAtPath:ROOT_PATH_NS(@"/var/lib/dpkg/info/com.nahtedetihw.artfull.list")];
the kext is to write sysregs
wait
you can do that with our PPL bypass
it would be limited to certain ios version then
there
but i have no clue how to actually use a PPL bypass in code
this will work on rootfull ?
ok
that's the issue
I'll make a PR if you want
yes, thats the whole point for the ROOT_PATH_NS
👍
it makes it work on rootless & rootful
although only A15 should theoretically be vulnerable (other than M1) as it uses the same cores as M1
although other ones could be vulnerable
@acoustic imp
basically, if the device is rootless, it takes the input path into ROOT_PATH_NS and makes it start with /var/jb
and if its rooful, it just keeps the path as is
and if you were gonna check for multiple tweaks, not just artful
you could do something like this
i've dmed it to you
feel free to do whatever
k, and is this suposed to be plist ?
(asuming yes)
bool hasPackage(NSString *packageIdentifier) {
return [[NSFileManager defaultManager] ROOT_PATH_NS([NSString stringWithFormat:@"/var/lib/dpkg/info/%@.list", packageIdentifier])];
}
oh ok
@indigo peak , do i just copy paste the file or do i need to update theos?
rootful :
also
@acoustic imp
edited
muschas gracias
is there a way i can set a child view to be behind the superview?
Like so the Button background would be behind the actual button
nvm
im silly
🎉
Kendrick Lamar
put them in groups and conditionally initialize them
u cant
?
u can only put like the entire hook in a group
Then make an entire hook for one method and put it in a group
split it up
so its fine if i have %hook smview twice ?
Yes
yes
%group a
%hook car
- (void) honk {
}
%end
%end
%group b
%hook car
- (void) beep {
}
%end
%end
no
what you cannot do is group inside hook
%hook car
%group a
- (void) honk {
}
%end
%group b
- (void) beep {
}
%end
%end
this used to be legal but logos became more strict
👍 , thats what i thought to do first
yeah thats what dhinak said
will do
idk why they removed this
would've saved a bit of redundant code
well in that case I don;t think it matters
also cause often more complex tweaks, your hooking multiple things or different classes
and probably simplifies logic
cause technically you could have an empty hook if both groups are false
which idk how that owrks
you know what it broke for me
PreferenceLoader

casually breaking the number one most used tweak
oh well
which reminds me i need to push a preferenceloader update
just use old logos to compile prefrenceloader
um actually cydia substrate is the number one most used tweak 🤓 ☝️
um actually nexus is the number one most used tweak
🤓 ☝️
its a function so yes
substrate isn't a tweak
🤓 ☝️ 🤓 ☝️ 🤓 ☝️ 🤓 ☝️ 🤓 ☝️
???
like can I see the calling happening in the psuedocode
yes its called vtable/function pointers
ah
sorry ;-;
The main problem now
is the regmap thing
I need to reverse it's structure
so I can write to it
@tepid olive What are you cooking?
temporary KTRR bypass
temporary so I can use it as a PAC bypass
why are you spamming emotes

He’s probably getting censored by icraze
lel
AARONNNNNNNNNNNNNNNNN
@tepid olive Wait, the ktrr bypass comes from APMR ?
no
Then why were you looking into it earlier ?
because to use the KTRR bypass at all
I need a way to temporarily disable/delay L2 cache flush
Tf lol
when it gets flushed
AMCC blocks it and panics
I wish I could see what uses this timeout
so I know it's function
Oh makes sense
but when it's in cache it's used by default instead of main memory
because main memory accesses are slower
What do you intend to use the PAC bypass for ?
well I'm developing a jailbreak, so that obv
For which versions ?
while I'm almost already done without a PAC bypass, I wouldn't mind a PAC bypass
And devices
Damn
Good job
Do you plan on opensourcing it ?
yes
tbh someone should make a lib for managing the lock screen ui thing
like the order and looks ot things
and make it easy to add stuff and move them
I want to destroy your preferences loading
My class better
Smh
and casues my a respring loop
OOP : Object Oriented Programming
yeah but not everything has to be an object
tbh just hook sprinboards init and overwrite it starting so it doesn't respring loop
fr
In that case let’s just stay with static shit all over the place
ok
I feel like you're more inline with the class since you're a java dev
just make a struct or smth idk I don't oop
Yeah
if you put it in one file you dont need to throw static everywhere
1984 of Kirbistan back smh
java's approach of OOP is overkill
I used an object before so am I an OOP?
Not really you can do non oop in Java
show me
you are a dog with a Christmas hat
thats what you are
my bad wait
The entry method is even static
a folf
That does not mean you use the object
yes but it is still in an object
Not exactly
that is the definition of OOP, you put stuff in objects and separate
putting your main func in a Main class is OOP
I can put stuff in functions and seperate
It’s static
are functions oop?
public static void main(String[] args)
#include <stdio.h>
int main(int argc, char **argv) {
printf("main in C\n");
return 0;
}
^ this is not OOP, no classes involved
That’s the entry
what is String
certainly not a primitive type
trolled
you might be able to even call that an Object!
can you even do that
Multidimensional arrays
And no it will not work
Oh wait nvm it’s probably possible with a bit of trolling
A bit of JNI
And 🔥
Or probably not idfk I’m tired
public class Main { // encapsulated in a class
public static void main(String[] args) { // This is a method in a class. yes, it's static, but that's allowed in OOP!!!
System.out.println("Hello world");
// `System` is a class
// `out` is a property of system, and also a class
// println is a method inside whatever class `out` is
}
}
C is not intended to be OOP
I don’t consider it as overkill
If I applied my java logic on my objc
@acoustic imp would kill me
who says he doesnt already want to
@acoustic imp ?
But classes would reduce my code amount by so fucking much
use structs!!
I think I legit could / 2 my code size
💀 💀
nah, i just want to do everything my self. but i need to learn to like let other ppl do/work on the things i work on
also you do know that you dont have to make everything a property right
you can uh
use ivars
frcoal
Last time I used ivars I almost punched my monitor
(Theos was not happy)
oh
Objc is the biggest mess I’ve ever seen
@interface SomeClass : NSObject {
@public
NSString *someIvar;
NSArray <NSString *> *anotherIvar;
}
@end
// ...
SomeClass *someClassInstance = [SomeClass new];
someClassInstance->someIvar = @"Something";
someClassInstance->anotherIvar = @[
@"Item 1",
@"Item 2"
];
kvc ftw
nooo its such a mess nooo
go back to java then :)
No
I love apple typos Cecking in with launchd immediately
I came to iOS for a reason
to terrorize us with java
I left mc cheating community
icraze
you got the hook working?
wheres this even at
SBStaticView *view;
view = nil;
I failed to deref a pointer to 0x0
...you can do this lol
get a better time zone
NSString *str;
str = @"rootfs is bad at programming";
NSString *nsString = @"NSString";```
.UTF8String be coming thru
NSString ***_NSString = &&&@"NSString";
Bro creating a pointer to a pointer to a pointer
this does have valid usecases
*&*&*&*&*&*&*&*&*&*&*&*&*&*&*&*&*& ftw
it'd have to be &&& btw
I’ve never went further than **
Making one pointer to an NSString into 3 of them is undefined behaviour
actually pointers are always unsigned
Why did I got censored ?
because you can't have a negative pointer
yeah because if I say
He’s there
told you
icraze is actually good a good dev


bending reality to his will
iCensor of Kirbistan
tfw
kopen(0x800);
💀 I’m lazy to write functional code
trelelelel
i will always be a c lang lover
@radiant idol wana look at the new horific code i made
lets see if live share wana work
Such a W

You’ll loose sanity forever
WRITE YOUR TWEAKS ON WINDOWS IM BEGGING YOU
no
STOP USING THAT VM
die die die
TIME TO VNC INTO THE VM
What’s wrong with his shit
horrible
wth, where did vscode go
lmao
(i fixed it)
oh there **was **17 of them
frame math, fine but-
WHAT

its removed now tho
@acoustic imp don’t show the code we gotta make money remember

@topaz yew
@topaz yew
Bro I have an explanation for that
Theos was complaining
!
@topaz yew

MRUNowPlayingView is a UIView subclass
...UIView's dont have viewDidLoad
oops
oh yeah 💀
well i prb chnaged to didmovetowindow anyway
been a while since i done tweaks
Then why would this work ?
when it didnt work
i mean it'll compile
It compiled fine
fixed*
yes but it wouldnt do anything
but theres nothing to hook
bedtime i wanna see your opinions on this code
NIGHT GET READY
NO
Lemme know I have to dig your grave
@acoustic imp PROFANITY????
literally could save characters just by adding a !
real
yes
look at the method name
@radiant idol
holy fuck
🥴
learned this after i made the shit
fair
CGRECT
lmao
this is the worst one
dis baled
comdisbaledbackground
CHECK DMS NIGHT
fixed*
yes
i have layoutSubviews trauma
HE HOOKED DIDMOVETOWINDOW

Crime!
indeed
get a spell check extension
THAT EXIST
YES??
donde esta
bros icraze
ew i dont write bootloopware
what why?
muchas gracias
i misspell stuff because my r key gets stuck sometimes
r
this might be true
i swear the keys move over an inch sometimes
are your sensory senses okay
what sensory senses
idk
ok but why?
so real
well something caused you to send that
yay or nay to starting my spnaish HW ?
just impulse
yay
si no sabes deletrear palabras en inglés, tengo miedo de cómo vas a escribir mal las palabras en español
i got like half of it
translate it
wait where is the rules channel?
r u saying i cant spell
I cna read the middle one
ESCRIBIR IS TO WRITE
si
no i mean show us a written thing
um i fg which i did
cuatro
this is NOT italian
quatre
show any
es malo
nightwinds just gonna use google translate 😭😭
deep L ontop
Ayer, yo tomé la calsses de español, luego la classes de carrera conexión, luego la classe de lengua y literatura, luego la classe de historia, lugar la classe de matematicas, luego la classe de ciencia. Me classe de favorito es la clase de español. hablé a mis amigos en todo de mis classes. Yo comí el salada y las fruta con bebí el agua. Despues de la escuala hací el hipódromo. Ayer, yo acosté a las diez en punto en la noche.
thx deep L
um no
pleeeeease
Its clase not classe
take a guse how good my handwriting it
I WANNA SEE
ok thats the same thing
no u dont 😭😭
PLEASE
my handwriting is bad
no mine is worse than how i speel
no
oh thats like better than mine
maybe i should find my work form last year
Ayer, yo tomé la clase de español, luego la clase de carrera conexión, luego la clase de lengua y literatura, luego la clase de historia, luego la clase de matemáticas, luego la clase de ciencias. Mi clase favorita es la clase de español. hablé con mis amigos en todas mis clases. Yo comí la ensalada y las frutas y bebí agua. Despues de la escuala hice el hipódromo. Anoche, yo me acosté a las diez en punto en la noche.
There u go
teslaman lore
Ok submit your wrong work then
What does this mean😭😭
i can read it 🤷♂️
american students cant write to save their lives
but
ticket, luggage, pilot
i cant really fault him for it since its average
Im a man fuck i look like writing neatly
ticked, lugage, piolet
If i need to write something important i have cursive
😭
show us your average handwriting
lets see
me when: i never learned cursive
its not hard to write something thats not chicken scratch
obvoiulsy I put my homework off until the last minute so I don't have to to write neatly
im also my class is the Guinee pig, the school system tried new spelling/writing sutff
you spelled Guinea wrong
must be left handed
am right handed
oh then you have no excuse
its still average in terms of american handwriting
people cant write
this is false news
they all have ADHD that’s why
😭
handwriting leak
Nah ngl oop has shitty handwriting
thats crazy, but true
Like mines not great but its legible
im scared
@restive ether do you have a job
it looks like it is from a mental asylum
to be fair this was the end of like 4 pages of writing stuff (not full sentences)
Some of yall need to work on ur handwriting
“Quite fishy” 😭😭
Nightwind lets see urs
this is why I have a spell checker on my code
my handwriting is good if im not writing for too long
this is a bit better (not much)
no
this is worse
this is my handwriting in Armenian, will have to write something in english in a sec
I mean I can write neat if I take like forever
lets see if i can find a spare paper
yeh
here's the same text written here
Ղարաբաղը հայկական է
ENGLISH, plz
Damn armenian really just said lets have our alphabet be upside down u and y
When eta Nightwind English handwriting
@hexed knot
Que?
Macedonian
macedonian
@native dune send urs
i dont have any paper i dont think
Macedonia is that one empire that Alexander The Great founded cuz he felt like it
ill send tmr while at school if i can remember
spanish hw time
please
fine
YAY
nah
yes in greek is ne
it is handwriting wdym
mine is readableer than it used to be
readableer
my handwriting
How’s this
also my handwriting
doing better
gime sm to write
what the fuck is this
ingles porfavor
The FitnessGram™ Pacer Test is a multistage aerobic capacity test that progressively gets more difficult as it continues. The 20 meter pacer test will begin in 30 seconds. Line up at the start. The running speed starts slowly, but gets faster each minute after you hear this signal. [beep] A single lap should be completed each time you hear this sound. [ding] Remember to run in a straight line, and run as long as possible. The second time you fail to complete a lap before the sound, your test is over. The test will begin on the word start. On your mark, get ready, start.
yes
get out of this channel
why do you have the most random coursework
looks good
now try