development

[radiant idol]

Ղարաբաղը հայկական է

[acoustic imp]

😭

[cloud yacht]

sig digs go brrrr

[radiant idol]

sig digs

[tepid olive]

'murica

[radiant idol]

i feel like you're gonna dox yourself in one of these

[tepid olive]

nah

I've already doxxed myself

all my personal info is on my GitHub page lmfao

[radiant idol]

write all of it

[radiant idol]

stop

[tepid olive]

n o

ok fine

[radiant idol]

i did not need that info in my brain

[tepid olive]

ok here's one development related

[radiant idol]

Fire Weather 🔥 😎

[tepid olive]

idfk what fire weather is

me playing leaked TOTK be like

another development related one

[acoustic imp]

@indigo peak idea for bird poop, with ur like custom mesage thing

[indigo peak]

not birdpoop but yeah go on

[tepid olive]

shit I almost sent an image of my license plate

[radiant idol]

@indigo peak send an image of ur handwriting

i wanna see

[indigo peak]

uhhhhhh

hang on

[acoustic imp]

so like when you are about to send it(a game, move) make a alert view pop up eith the text that it will auto send with in it, then user could just eddit it or press send

[radiant idol]

go do your spanish hw

[faint timber]

there was water on my screen it started recording my voice and uploaded it then wouldn't let me delete it because of touch feedback

[tepid olive]

hey guys look

[acoustic imp]

good idea but no

[tepid olive]

my exact location!

[tepid olive]

!!!

[radiant idol]

thats math

show some written stuff

like

a sentence or something

[tepid olive]

1x+2x= you're mom

I did it wrong on purpose

[indigo peak]

I don’t have a pencil or paper w me rn

[radiant idol]

smh

[indigo peak]

I’m at the gym buddy

[radiant idol]

opinions

[tepid olive]

why don't I have a singular image of my handwriting

I hate macos

[acoustic imp]

haha L macos

[indigo peak]

@acoustic imp so what’s your idea

[acoustic imp]

@indigo peak

[tepid olive]

wen eta XCode for Linux

[acoustic imp]

fr

[tepid olive]

I mean

I can just use

https://looking-glass.io

[indigo peak]

i aint readin allat

[tepid olive]

oh wait it only supports windows

a

[acoustic imp]

when user go

make alertview

pop up

text = what it would say

user goes

haha i chnage

they chnage

[ashen birch]

hope not fr

[acoustic imp]

then press ok

OR

they go

ok

send

[tepid olive]

what is zefram

[acoustic imp]

with default text

[cloud yacht]

darling supports the command line tools of some older xcodes

[acoustic imp]

@grave sparrow

[tepid olive]

me wishing reactOS was completed

oh ok

sounds boring

can it fix wine

[cloud yacht]

wine is open source

[tepid olive]

can it fix AppleHV on ryzentoshes

[hasty ruin]

it will give you AppleHIV on any system

[tepid olive]

actually

I wonder

if

reactOS is fine for development

[acoustic imp]

3/4 done with spanish hw

[topaz yew]

when i cracked rosetta injection i felt like a god

good times

[faint timber]

have an m1 project in the pipeline

[tepid olive]

I hate macos

wine literally is borked

[next wadi]

zefram experience

[tepid olive]

rosetta

imagine having an ARM mac

😭

[hasty ruin]

apple silicon 💪 🧊

[faint timber]

I have both

[tepid olive]

I want one

except I have no moolahs

[acoustic imp]

#get used M1

[faint timber]

pretty good deals for refurb m1 pro

[tepid olive]

no like

I have $2

I really want that want M1 macbook pro with touch bar

this one https://www.ebay.com/itm/116059657499

well except not with the damage

but ykyky

[acoustic imp]

just get a M1 pro and Frankenstein it

no scren

[faint timber]

pro is way better

[tepid olive]

I like it tho

my dad had an intel mac with one

I really like it

[faint timber]

I like that because thats what Im used to

I came from the t1 mac

huge shitbook

[tepid olive]

lel

[faint timber]

butterfly and og touchbar

terrible machine

[tepid olive]

I'm running an intel hackintosh T480 as laptop, and ryzentoshed custom machine for desktop

(T480 is nice, it's just really slow, cuz its old)

[faint timber]

take all the overkill specs of 2020 excluding gpu thats my ryzentosh

[tepid olive]

my ryzentosh is overkill specs of 2020, GPU-Wise

CPU wise it's normal 2019

[faint timber]

its a waste for gpu don't need much to run mac at 4k

[tepid olive]

My GPU was a hand me down sooo

[faint timber]

I bought it on ebay for 80$

[tepid olive]

Radeon RX 6800 XT

I want a real macbook

not my stupid hackintosh

[indigo peak]

yeah basically

easily top 3

not an argument for that

don’t sleep on goodbyes

true

nothing after 2020 should be in the top 3

ehhhhh

barely an exception

THOUSAND BAD TIMES MENTIONED

🗣️🗣️

bro I love Hollywood’s bleeding

like the whole album

hmmmmm

for me, no order

hmmmm

Circles, Better now, goodbyes, stay, sugar wraith, congratulations, take what you want, die for me, thousand bad times

something like that

now do the same for Eminem

Eminem was my top artist for like 3 years straight on Spotify

do you listen to any new shit or just old

makes sense

https://open.spotify.com/track/4xs1uoAjiWAEecX9yKGSF6?si=phZ85aepQ8mpUoBVQ1kqJQ

slaps

(newer but one of my favorites)

🗣️🗣️

def not

yes

good rephrase

ok but hear me out capt

I know your favorite

of all time

coldplay

[acoustic imp]

Starboy & heartless at 100% volume >>>

FR

[ashen birch]

capt you’re supposed to be making some shit we’ll make fun of

get to work

we don’t not pay you for nothing

[indigo peak]

so many 1s

[ashen birch]

shut up gir

rxtard

[indigo peak]

real

you have to enable it

in Watch settings

and then press the crown and side button at the same time

what’s annoying tho

is that screenshot action is the same as pausing and resuming a workout

[topaz yew]

with the library stuff? i went a different route

oh well yeah that's standard

mach ports arent standard? wym

they are part of macos

[cloud yacht]

tbh I use the screenshot all the time to record time's

like if I'm starting work, screenshot, and then when I have down time I can put the time in

[lean ermine]

anyone know what would happen if i tried symlinking a ct bug signed binary on a usb mountpoint on a low storage device as a means of running an app off of a usb drive

e.g. i have a 64 gb ipad on 17.0 with trollstore and am curious if this is possible

[indigo peak]

if the new CVE (2024-23208) runs using sockets and whatnot
whats to stop someone from making a new implementation of PhysPuppet from KFD or SockPuppet for actual krw

or am i just dumb

obv i know its easier said than done

but reading the writeup for kfd, it didnt seem that bad

[timid furnace]

it's just a UaF, it's not a physical UaF

zone allocation changes make this very hard to exploit in modern versions iirc

https://x.com/binary_fmyy/status/1753405768672661835

风沐云烟 (@binary_fmyy) on X

Unluckily,it only makes my iPhone and Mac panic and I can't complete the KR/KW. If anyone is able to bypass the mitigation of "zone", you can try to exploit this uaf vulnerability.

Twitter · Feb 2, 2024, 1:11 PM

and that's from the reporter

[indigo peak]

so after kfd they implemented changes in zone allocation?

or am i misunderstanding

[timid furnace]

no, kfd didn't affect it

the class of exploits kfd uses are physical use after frees

zone_require happened in iOS 13

oops

anyways

[timid furnace]

this new vuln is not a physical use after free, it's just a normal one

zone_require is a protection against normal ones

[indigo peak]

and assuming both SockPuppet and PhysPuppet were both physical after free

[ashen birch]

sockpuppet isn't

[timid furnace]

physpuppet is the kfd one right

[indigo peak]

yes

[timid furnace]

physpuppet is a puaf

[ashen birch]

in fact apple even did a blog post on how sockpuppet's reliability would be affected by zone_require

drops from like near-100% to 8% or sth

[timid furnace]

i think physpuppet has phys since it is physical (as compared to not physical)

[indigo peak]

but then again, if zone_require was introduced in iOS 13
and SockPuppet was an iOS 12 thing, obv it would be different

[timid furnace]

PUAF is an acronym for "physical use-after-free". As opposed to a normal UAF, which stems from a dangling pointer to a virtual address (VA), a PUAF originates from a dangling pointer to the physical address (PA) of a memory region.

you know the difference between physical and virtual address right

[indigo peak]

yes

[timid furnace]

yea

[indigo peak]

at least kind of

[timid furnace]

zone_require is a mitigation at the virtual address level, basically

[indigo peak]

physical != slide

virtual is slid

right?

[timid furnace]

well

it's not slide as in ASLR/KASLR slide or anything like that

it's just a addressing layer on top of the physical memory

[indigo peak]

alr got it

[timid furnace]

where's capt when you need him

anyways

[ashen birch]

busy figuring out how to make zefram better (he's adding more bootloops)

[timid furnace]

with virtual memory, you can divide it up into different zones

so this zone is used for socket objects, this zone mach ports, etc

[indigo peak]

ohh

makes a lil more sense now

[timid furnace]

zone_require stops you from transferring an object in one zone to one in a different zone (because generally you're not guaranteed that your UAF is going to be in the same zone as your next level of exploitation)

https://www.corellium.com/blog/using-corellium-kernel-hooks-to-disable-exploit-mitigations#:~:text=and run it%3A-,zone_require,-In iOS 13.0

explained a bit more here

physical use after frees are at the physical addressing layer though. so you can just do shenanigans until that virtual page ends up at that physical address that you have control of

at least from what i understand

this should be covered more in https://github.com/felix-pb/kfd/blob/main/writeups/exploiting-puafs.md and https://github.com/felix-pb/kfd/blob/main/writeups/physpuppet.md

as always smarter people feel free to correct me bc i sound like i know what i'm talking about but i don't

[indigo peak]

real

this is a LOT of reading

but is also interesting at the same time

so i might look into this further

at least on a research perspective

[cerulean ether]

Hola ese

[timid furnace]

the shenanigans are better explained here

https://github.com/felix-pb/kfd/blob/main/writeups/exploiting-puafs.md#what-to-do-after-a-puaf-exploit

[indigo peak]

ok im def reading more on this tmrw

ty

as long as everything you said so far was correct, you did a good job explainign

[timid furnace]

it's probably mostly correct with the finer details of the latter parts being maybe questionable

don't have much experience with the lower level stuff

[indigo peak]

neither do i

i uh

barely know what a pointer is

so

yeah

[timid furnace]

One Day™️

oh yea learn more about memory and stuff

[indigo peak]

i feel like theres some holes in my coding knowledge

like i made a framebuffer writting app

managed to get my own offsets in ida

and then i cant figure out how to hook a C function

[timid furnace]

i mean

with a hooking library or your own code?

[indigo peak]

with a lib

[timid furnace]

oh

[indigo peak]

i mean its an overexaggeration but you get the point

[timid furnace]

yea

[granite frigate]

um wasn’t that a different thing

[timid furnace]

https://security.apple.com/blog/what-if-we-had-sockpuppet-in-ios16/

somewhat

[indigo peak]

bro 😭

iphone flip 15 👍

[granite frigate]

@indigo peak physical memory and virtual memory are different things, aslr is another thing on top of virtual memory

[timid furnace]

when you talk about slide it's ASLR

[granite frigate]

like i’m not 100% sure about this because I just watched some youtube but the diff is that virtual memory is another layer of abstraction for applications that divvies up physical memory to every application

[granite frigate]

oh now I get it

thanks 🙏🙏🙏

were there any kr/w exploits written for iOS 14+ that use a uaf vulnerability

there has to be one

multicast_bytecopy?

[timid furnace]

https://github.com/ModernPwner/cicuta_virosa

also mcbc i think yea

[granite frigate]

both of them use ipc_kmsg

[soft siren]

anyone here who can help me with args for an app

[tepid olive]

incomplete version

of it

[sonic totem]

I mean, technically checkm8 gives you kernel r/w

[tepid olive]

as in incomplete backport

the offsets were wrong and i believe the cleanup function needed some work

[granite frigate]

oh ic

no I just have a skill issue understanding how stuff works so i wanted to see how other stuff worked

doesn't amtter the ios

[tepid olive]

it aint rlly hard once you do it for a bit

i realized i dont like sec research

so i stopped

[granite frigate]

why didn't you like it

[tepid olive]

the starter tool that everyone recommends you to learn how to rev (ghidra) is trash

[granite frigate]

lol

[tepid olive]

i shared a binja license with someone

so i moved to that and it was a much better experience

2. its hard to get into sec research in 2024

[granite frigate]

it can't be like the tooling sucking or something

like what sucks about sec research for you so you stopped

[tepid olive]

now everyone mitigates everything

[granite frigate]

oh yeah

[tepid olive]

esp in apple's *os

pre-ktrr era of iOS (iOS 9 or so) would have been the perfect timing

3. assembly is hard

[granite frigate]

i feel like most researchers are experienced people who started off early when it was easier to pwn iOS lol

[timid furnace]

me chilling on x86 macOS

[tepid olive]

i would usually use the binja C decompiler and when i absolutely had to i would use the disasm

its mid tho

Does the compiled Poc made by halo https://github.com/fmyyss/XNU_KERNEL_RESEARCH cause kernel panic on A17 too I tried compile it to see if it could cause a kernel panic on mine but I kept getting Thread 1: EXC_BAD_ACCESS (code=1, address=0x0)

4. information of stuff (like new mitigations) is all private knowledge on how it works/etc now, starting in iOS 15+

[granite frigate]

it works for me on 17.0

[tepid olive]

On A17 ?

[granite frigate]

16

shouldn't matter

[tepid olive]

Idk who this dude is but he said he couldn’t get it to work

[granite frigate]

I talked to him a few days ago

[granite frigate]

yeah I noticed public info on exploits are now all private or so outdated

why though'

its annoying

[faint timber]

get good

[granite frigate]

thanks

[tepid olive]

its worth more then it was ios 9 era

I’ve lost faith in google at this point there never gonna do a write up on the one they found

i read about evasi0n6 & 7 bugs and it's chained with like 20 different bugs

[granite frigate]

do you think learning from older stuff will make it easier to get good at newer stuff

[tepid olive]

the closest we have to dat is the codesigning bugs from taurine lmfao

[timid furnace]

It might be easier to understand newer stuff if you understand older stuff + how said older stuff was mitigated

So you understand what xyz barrier is and how it came to be

[faint timber]

kernel only like 3 bugs the rest is the userland stuff because app installing did not exist until 9

free dev cert came out in 2016

[tepid olive]

Can someone explain Sptm to me , my understanding is it’s a new security measure in A17

@granite frigate what i did was i wrote my own "developer" jb for 14 - which just straps a proc binpack with ssh

it taught me a lot

and made me realize fuck jailbreaking

[granite frigate]

real

what are you cooking now tho

[tepid olive]

im tryna learn OpenGLES i want to make my own game

[timid furnace]

(I feel like I am missing some context on who this person is)

[granite frigate]

[tepid olive]

someone who use to hang out in hack different 2021-mid 2023

[granite frigate]

wait before you started making it did you have like a lot of prior knowledge

[timid furnace]

Several names come to mind

[granite frigate]

or did you just wing it

i want to make a jb for ios 11 because I don't want to use electra

[timid furnace]

Honestly even if you cobble together code from different places

[granite frigate]

I don't want to do that

like that's what I want to avoid

[timid furnace]

Often times you'll end up debugging enough to learn what it does

[tepid olive]

iOS 11 lowk useless to learn to hack future iOS versions

IMO

[granite frigate]

because I can paste code together i won't learn anything

[timid furnace]

I guess

It depends on your approach to stuff

[sonic totem]

@timid furnace will test compile your PR today and maybe just get everyone to test a new TrollStore build

Just in case it brings around any issues

(Which i doubt it would)

[timid furnace]

Nice

Pro tip diff fastpathsign with latest ct_bypass, inspect and adjust the file as necessary

And then diff fastpathsign with choma pr

Makes it easier to identify what changed

[sonic totem]

Yeah i forgot it existed twice the other day and spent like half an hour figuring out why my TrollStore changes weren’t working

[timid furnace]

Lmao

[granite frigate]

no way that PR looks awesome

i can throw in any app binary and it'll sign according to that app store cert?

[timid furnace]

Arguably Ts should be redesigned to just use ct bypass from the submodule directly

[timid furnace]

Well

Rn the app store code directory to use is still hardcoded

But you can take whichever one you want and replace it

And it'll work

[tepid olive]

@granite frigate if you want to get into that career path/hobby though i would get a binja license with the student discount ($75), use https://github.com/0cyn/ksuite or binja_kc, and mess around with it and figure it out on a symbolicated 16 kernelcache

i personally learn from messing around with a language creating stuff with it then trying to learn the language

[granite frigate]

how do I symbolicate a kcache

[timid furnace]

There's not much of a point in using your own code directory except for two things

• app store cert expires
• macOS support

Esp since it was figured out you can use any team id

[granite frigate]

I suppose

[tepid olive]

you dont symbolicate it

[timid furnace]

Partially

[tepid olive]

^

[granite frigate]

I can't like "add" symbols to a stripped kcache?

I mean that wouldn't really make sense ig

[timid furnace]

Only through manual analysis

[granite frigate]

ok nvm

which beta is that

oh so it's a secret

[timid furnace]

Why draw attn to it

[tepid olive]

i thought everyone knew that

my bad

[torn cloud]

the question is; are you ever gonna release it

after the memes

[tepid olive]

zefram

[torn cloud]

you can buy cheap ones off eBay, I bought mine for like £250

[tepid olive]

@granite frigate do you have experience writing C/C++?

[torn cloud]

C++

never again

[granite frigate]

learning C rn

i don't know cpp

[tepid olive]

are you actually learning it tho like how strings are memory values

[torn cloud]

don’t even go near cpp

[tepid olive]

blah blah blah

[torn cloud]

it’s horrible

[tepid olive]

strcpy is death

[granite frigate]

like pointers, some memory management

[torn cloud]

do you know how to create unsigned pointers on ARM?

[granite frigate]

no lol

[torn cloud]

not that hard tbf

[granite frigate]

noted

[torn cloud]

the function is just uint64_t

[granite frigate]

I don't even know how assembly works

[torn cloud]

lol I don’t know much either

[granite frigate]

severe skill

[timid furnace]

I know 0 arm asm

I know extremely little x86 asm

And unfortunately I know mips

[torn cloud]

can’t wait for Y10 so I can finally choose what I want to do in school

[timid furnace]

Fuck mips fuck at&t syntax

[torn cloud]

instead of doing random shit

[faint timber]

obviously its entirely programmer dependent

[tepid olive]

i know the bare minimum linux arm64 asm

[faint timber]

if the programmer said its signed, the signed asm instructions are used

[timid furnace]

Signing in this context means pac right

[faint timber]

applies in both cases

pac an literal signed vs unsigned

they are completely different concepts

same applies, programmer decided

still didn't specify what you were asking

[primal perch]

facts

intel syntax clears

[dense plume]

16.7.4

[primal perch]

16.7.4

[slim bramble]

POV : I test stuff

[hasty ruin]

No %orig

[slim bramble]

Good job you spotted it

[grim sparrow]

Why layoutSubviews

[slim bramble]

because I have no other choices ?

[grim sparrow]

layoutSubviews is called a lot, there is usually a more efficient method to use

[slim bramble]

in my case there is not

[grim sparrow]

Could you not just hook the setter of context

[slim bramble]

I have tried

no results

but I have found a better way for this

but I still need the layoutSubviews

[wooden yarrow]

is it not just ellekit or whatever

trol

[slim bramble]

https://media.discordapp.net/attachments/688122301975363591/1084316846863421520/zeframdemo.gif

[wooden yarrow]

does it not do the same thing

same functionality

what differentiates your product from the competition

so can it do things ellekit can't

so then what are those things

oh cool

[ashen birch]

yapper

[twilit jungle]

[brazen timber]

ok but do I need to disable SIP

[serene hawk]

that swift hooking would be really interesting

[hasty ruin]

you forgot to link the #development chain

[twilit jungle]

[slender glade]

كاب

[torn cloud]

memes got to your head

[timid furnace]

yes

[brazen timber]

cringe

[wind ravine]

how do i update a hook that they changed the name of in a new ios without breaking it for older versions

[lean ermine]

proof ？

o lol

anyone know if that would work tho? symlinking a binary to external storage mnt point to save space?

[tepid olive]

Hmm

[lean ermine]

ill try it later

well ive got a 64 gb ipad and am curious if i could save space with the binding of isaac app. by doing so

idk what the storage makeup is like tho

[tepid olive]

Hi

Hi

Whoops

I already said that

Are there any Asahi devs here

[gaunt helm]

unlikely...?

[tepid olive]

Oh

[timid furnace]

Group hooks

[wind ravine]

o ok

ae i have to figure out how to get this working first tho

[wind ravine]

how exactly do u use it?

[slim bramble]

%group ios15

// Your hooks

%end

%ctor {
  if (isOnIO15()) %init(ios15);
}

[wind ravine]

got it

[timid furnace]

yup

more fleshed out example:

%group iOS15Abc
%hook Abc
// do stuff
%end
%end

%group iOS14Abc
%hook Abc
// do stuff
%end
%end

%hook AlwaysTheSameDef
// do stuff
%end

%ctor {
  %init; // initializes stuff not in a group
  if (@available(iOS 15.0, *)) {
    %init(iOS15Abc);
  } else {
    %init(iOS14Abc);
  }
}

hope that helps

[slim bramble]

I'll also add this : https://theos.dev/docs/logos-syntax

[wind ravine]

ae they completely reworked it

i cant figure it out rn

[slim bramble]

What are you trying to mlake ?

[wind ravine]

trying to fix my lock animations tweak on ios 16+

i tried getting it to work with a few different functions but it didnt work

[placid kraken]

you will make it work on serotonin

https://cdn.discordapp.com/emojis/803337858818768967.png?size=48&quality=lossless&name=A_HuTaoPat&quality=lossless

[wind ravine]

if i can figure out how

[lean ermine]

easiest way would be to straight up symlink the .app folder

i dont have a usb or adapter w me so ima test if it works just to my documents folder

[timid briar]

Isaac

[lean ermine]

real

[placid kraken]

patiently waiting for icleanerpro to be a thing on serotonin

smh

[lean ermine]

the terminal version works

i cleared like 20 gbs two days ago

[faint stag]

that's uhh

probably not going to work

[lean ermine]

idk newterm is limited to roothide fs so i cant try it rn

hungry also

ill try later

[faint stag]

even without roothide it would be an issue

because there's only a few places execution is allowed

documents isn't one of them lol

[lean ermine]

that makes sense

[faint stag]

also it's not actually limited, it's sorta how roothide works
to access the real rootfs instead of being in jbroot, cd /rootfs

[lean ermine]

i know it isnt limited but im on my lunch break and didnt care to elaborate lol

but ty

[visual meadow]

I hate to tell you this

I've tried this on 17

[lean ermine]

aw

[visual meadow]

The binary would not execute

[lean ermine]

that isnt too surprising

glad to know you tried it though

[lean ermine]

although for the binding of isaac i think the heavy stuff are just the data folders and not the binary

so i may still mess around w this

[faint stag]

not surprising since a symlink just points you elsewhere
and you can't execute anything in /var unless it's in a bundle

[sonic totem]

Sandboxing would forbid it

[visual meadow]

I couldnt even set the exec bit on it

[sonic totem]

oh

[visual meadow]

I was using an hfs usb

[acoustic imp]

@warped sparrow

[torn cloud]

kixrd come here

teslaman is going to touch you

[acoustic imp]

So basically my tweak seems to have broken a jb

[torn cloud]

[warped sparrow]

Hey

[warped sparrow]

Hi 👋

[warped sparrow]

Wdym

[acoustic imp]

@indigo peak , pleas help

[torn cloud]

anyone knows how to actually implement the PPL bypass we have in exploit code? working on bringing PACMAN support to iPadOS M1 SoC's via krw however i have no idea on how to do it :/

[indigo peak]

L

[acoustic imp]

i think it was ur code tho

[indigo peak]

oh

sucks

womp womp

[acoustic imp]

😭

this thing

[indigo peak]

ok and how does hat break your jailbreak

[acoustic imp]

idk its my guse

ask @warped sparrow

[indigo peak]

all it does is checks if a file exists

[acoustic imp]

🤷‍♂️

[warped sparrow]

https://cdn.discordapp.com/attachments/1196864923200921630/1204507143253000292/TESLAMAN_FIX_YO_TWEAK.txt?ex=65d4fbb1&is=65c286b1&hm=2717f4de01bb9c93949f22d8e743678fe2fab3a03f2ca5d3dcbc19e1a735a5f4&

[placid kraken]

i opened this chat and this was the first thing i saw

i regret coming here

[torn cloud]

lol

[orchid fulcrum]

This problem goes away if i change initWithSuiteName from @"com.apple.springboard" to some other one like @"com.apple.Preferences"

(And change the key too)

@naive kraken @sonic totem so sorry for the tag but do you guys have an idea why that may be ? Does springboard preferences have some sort of protecion or someting ?

[acoustic imp]

@timid furnace can you help me try to fix mine an @warped sparrow JB, my tweak seems to have broken them

mine seems to be fine now but kixrd's isnt

hes stuck in safemode

even after he removed my tweak

[timid furnace]

how are they exiting safe mode

and what jailbreak is this

[acoustic imp]

meowbreak

and idk how they r respringing

@warped sparrow how were you resprining

hes got an iphone X

[warped sparrow]

Using sbreload

[acoustic imp]

@timid furnace

[timid furnace]

no

[warped sparrow]

And whatever ellekit uses to respring when you press exit safemode

I trued both

Tapping on the status bar

[timid furnace]

the only way to exit safe mode is from the status bar

[warped sparrow]

And pressing the button

[warped sparrow]

Yeah it didn't work

[timid furnace]

uninstall your other sb tweaks

[acoustic imp]

he treid disabling them thru icleaner

[warped sparrow]

Wait

[acoustic imp]

but it didnt work

[warped sparrow]

I disabled

But used sbreload

Lemme try statusbar

[acoustic imp]

My JB is good 👍

[warped sparrow]

It worked but wtf is causing safemode

[acoustic imp]

ok

now do what you do to get back in safemode and

sed the new crashlog

thx @timid furnace

[timid furnace]

AppData.dylib

what is that

[warped sparrow]

Oh lawd

Alr lemme remove it

i just use it to downgrade apps

Because no rootless appstore++

Please dont judge my tweaks i got all sorts of crap installed

[acoustic imp]

@slim bramble 16player didnt break kixrd's jb

[acoustic imp]

use the app

[timid furnace]

isn't there TS appstore++

[slim bramble]

there is 😭

[acoustic imp]

yea that what i meant

[slim bramble]

yikes

Your tweak still fucked

[warped sparrow]

Only if it had a search bar

It would be good

[acoustic imp]

yea i have a feeling it was that line

[warped sparrow]

I got too many apps

[acoustic imp]

it in alphabetical order

[warped sparrow]

Didn't work

I removed it

Then used ellekit to exit safemode

[timid furnace]

removed it how

[acoustic imp]

u used status bar?

[warped sparrow]

Through sileo

[warped sparrow]

Yup

[timid furnace]

bruh

[warped sparrow]

whut

[timid furnace]

you need to reenable in icleaner before removing tweaks

otherwise it doesn't get cleaned up properly

[warped sparrow]

i didn't disable it in icleaner

[timid furnace]

anyways, send the new crash log

alright

[acoustic imp]

@timid furnace are userspace reboot suposed to take a long time?

mine are like 2+ mintues

but i do have alot of tweaks

[acoustic imp]

lynx

[warped sparrow]

@timid furnace

[warped sparrow]

oh what

[timid furnace]

hold on a sec

send tweak list

i think i've seen this before

[acoustic imp]

what was the casue of it before?

[warped sparrow]

Nah

[warped sparrow]

Shit i got a few pircay installed

[acoustic imp]

its what ever

[timid furnace]

what foxfort tweaks do you have

[warped sparrow]

Translomatic

and uhhh

I think thats it

[acoustic imp]

jus search fox in sileo

[warped sparrow]

Yeah thats it

Translomatic

Krashkop

[timid furnace]

hm

just uninstall tweaks until it works

[warped sparrow]

😭😭

[timid furnace]

there's no fix atm

[acoustic imp]

?

[timid furnace]

need a jb update

[acoustic imp]

oh

do you know what the issue is?

[timid furnace]

hooking stuff causing page invalidation

[acoustic imp]

ah

[timid furnace]

try to get rid of anything related to Shortcuts first

[acoustic imp]

like tweaks that run shortcuts?

[warped sparrow]

Like Apple shortcuts?

[timid furnace]

yes

[warped sparrow]

I dont think i have anything related to shortcuts

[timid furnace]

¯_(ツ)_/¯

[warped sparrow]

What would be related to shortcuts

[timid furnace]

ok then just get rid of anything doing C hooks

[warped sparrow]

Uh

What would use a c hook

I know nothing

[acoustic imp]

like what tweaks?

[timid furnace]

how am i supposed to know

[warped sparrow]

Whats zaire.dylib?

[acoustic imp]

@warped sparrow send tweak list

[warped sparrow]

Alr

https://pastebin.com/raw/YzDUQaF0

@acoustic imp ^

[warped sparrow]

Use /raw

[warped sparrow]

Press it again

@acoustic imp

[acoustic imp]

[warped sparrow]

Its disabled

[acoustic imp]

thru its prefs or choicy

also you need to remove it

[warped sparrow]

Icleaner

[acoustic imp]

remove from sileo

[warped sparrow]

Oh no

The version im using works

like no safmode

So it aint that anyway

[acoustic imp]

just remove it

[warped sparrow]

Alr

[acoustic imp]

@timid furnace could you help me try to get this down. Iv already tried backup, icleaner, phone factory reset

[slim bramble]

TWEAK PLZZZZZ

I WANT THAT

[acoustic imp]

its misaka

[slim bramble]

oh 💀

[acoustic imp]

oh its removed to

[acoustic imp]

@radiant idol you should add this to onesettings or make a tweak to show it

@slim bramble you could jus chnage the file

sense ur on ios 14

but it might f other thing tho

[warped sparrow]

It was fucking a-font

[acoustic imp]

ohyea a-font has C hooks

dont use afont

use like misaka if you really need it

[lean ermine]

is that real lol

[radiant idol]

i'll take a look

[acoustic imp]

perferably seperate tweak

[placid kraken]

orrrrr

snowboard

[slim bramble]

how

tell me

the haxx

[acoustic imp]

for fonts

[slim bramble]

oh 😭

[placid kraken]

you use the fonts extension with font debs

how do you think i have my font

[slim bramble]

I thought you were referring to smth else

[acoustic imp]

any way to tell why a tweak is hanging spring board

or casing a respring loop?

[slim bramble]

still stuck there ?

[acoustic imp]

no, i added/chnaged sm

its like with urs

[slim bramble]

my idea is probably remove hooks until it stfu

[acoustic imp]

sigh, why cant my phone jus be normal

[slim bramble]

oblit_in_progress=5

[acoustic imp]

real

It was this

stupid artfull comptability shi

@slim bramble all good 👍

i was being dumb

@radiant idol does adding things to the %ctor increase time ?

[slim bramble]

ctor is init

when the tweak is first loaded

it is ran once

until respring is restarted

[worldly ether]

hey guys just wanted to show yall my first ever ios application hope you like it https://springo.vercel.app/

[radiant idol]

nice, is the code open source?

[indigo peak]

inb4 discord token logger

[cloud yacht]

how hard is it to make an a tag for a button?

[worldly ether]

i knew i forgot something

tbh i'm insecure about my code and stuff

and i also don't have access to my macbook rn

[worldly ether]

lmao

but trust me i'm surprised i even achieved this

i have literally no reason to put anything malicious inside it

and also the knowledge lmao

[radiant idol]

we all are

get over it

nah jk

[worldly ether]

it is confirmed to work on iPhone 15 17.4

[worldly ether]

i'm very happy rn

[worldly ether]

lol

so yeah if people trust me i'm really thankful to them

if not then not

i respect it

[indigo peak]

nah I’m just messing with ya

[worldly ether]

funfact: i used chatgpt to help me mess around and find a glitch or smth to get it working

[worldly ether]

oh okay

it's actually storyboard lol

obj-c

[tepid olive]

icraze lurking

[acoustic imp]

not me

[sonic totem]

As usual

[tepid olive]

@sonic totem is it a bad idea to make my jailbreak support rootful or rootless

because it shouldn't be that hard to add rootful support

[sonic totem]

Rootless

Just go with rootless

Less to clean up if someone screws it up

[tepid olive]

fair

[radiant idol]

make a patcher fr

[tepid olive]

well I meant

make it a user option

[radiant idol]

ik

i said

[tepid olive]

like a switch

[radiant idol]

rootful -> rootless patcher

[tepid olive]

no

[radiant idol]

why

[tepid olive]

anyways time to install different wifi chip so I can use windows 8

[acoustic imp]

@ somone, how can i make a subview have a property on its superview. the 'superview' is also a view i add

like this, the %hook'ed 'UIView' is a view i add

mb for @

[faint stag]

so if you already know what's using the space then why not delete stuff like logs

lol

[acoustic imp]

the logs are like 1GB, im saying ios only knows about like a few GB

so other stuff is jb or sm

[faint stag]

well ios knows about more because how else would it list it

[faint stag]

it can get very large without a jb ever being installed once

your jb is not to blame

[acoustic imp]

JB folder is 3GB so its abit but it could also be random on thing tweak put in /var somwhere

[acoustic imp]

but tweaks or sm TS thing could be

[faint stag]

sounds normal to me
i mean a bootstrap+tweaks+themes

[acoustic imp]

ik but the 3GB + what 12GB ioas was reporting doesn't equal the 30 it says

[faint stag]

ts apps should appear in the list like user apps tho

they still have containers

[acoustic imp]

ok yes but not all TS apps exist in just theri containter

[kind herald]

what’s the difference between iOS 14 and iOS 15 tweak development? is there anything that would prevent an iOS 14 tweak from working on iOS 15 as long as it’s rootless?

[acoustic imp]

any way i can like see what folder are taking up the most?

[acoustic imp]

i mean IOS 14 and 15 are different like any major IOS version chnage

[faint stag]

ncdu (if that even is compiled)
df
or filza but that's probably a bit slow

[faint stag]

of course there is
ios 15 is an entirely newer cfversion
libs can be deprecated, methods can exist in other places, headers removed etc
rootless is one thing, actually having code that works on 15 is another

[acoustic imp]

how in filza?

[radiant idol]

apple's methods are funni

[faint stag]

iirc you can tell filza to calculate dir sizes and then just sort

[acoustic imp]

thats anoying

can i just get a cli that shows all the folderd and how big they are

[faint stag]

i gave you two commands

[faint stag]

and i did say it would be slow

easiest is ncdu but there isn't a rootless one that i know of

[acoustic imp]

there is

[granite frigate]

filza → sort by size → search rootfilesystem

idk

[acoustic imp]

its on procurse jus installed it

[faint stag]

yeah that's what i suggested as well lol

[radiant idol]

hm I'm looking for this in FLEX

cant find it

[faint stag]

it's not going to be there unless releasetype is internal for systemversion

lol

just hook settings when it reads the plist ig

[radiant idol]

well I was assuming there would be some BOOL there

[faint stag]

well maybe
but that's going to be in some function somewhere

[radiant idol]

hm probably

[acoustic imp]

header dumps?

[faint stag]

nah

[acoustic imp]

this is not 64GB

[faint stag]

it's gonna be part of the settings binary i'd asume

[radiant idol]

im too lazy to put it into IDA and see

[acoustic imp]

🧢

ncdu lying

[faint stag]

can ncdu even read all the dirs tho

would have to run as root in that case because mobile can't read all

[acoustic imp]

ohh

[acoustic imp]

jb is 4.2gb *

[radiant idol]

1.3 GB for mine

[acoustic imp]

3.4*

me when pinamine

whats this ?

[faint stag]

this is sorta self-explanatory

also nice piracy

[faint stag]

media from itunes store

[acoustic imp]

ohyea, i should delete that

[acoustic imp]

ok, but why is it 7 GB 😭

[faint stag]

look in it lol

i was referring just to purchases

[acoustic imp]

its just like a bunch 50MB ish folders

[faint stag]

also photodata is photo metadata and the database for photos

[acoustic imp]

@faint stag everything seems normal but then why is sys data saying there is like 20GB of nothing?

[faint stag]

tbh even i myself doesn't know what it's counting as system
but, you can take a good guess if you do some math

[acoustic imp]

even if i do the math that still doesn say what or where it is

[faint stag]

yes but you can eliminate things

[acoustic imp]

ik what you mean but like even then it still doesnt add up to 30GB

[faint stag]

it's probably safe to assume that it includes other partitions too as system

[acoustic imp]

ah

can i check thoes on rootless?

[faint stag]

yeah

ofc

[acoustic imp]

where r they/how?

[faint stag]

just run mount

or df -h like i did

[faint stag]

note that sizes are in SI units
var is pretty much going to be the same size as the disk minus iOS itself
wait, you only have 402mb left in var wtf

well, to be more accurate, 402mb left for /private
since both preboot and var are mounted there

your issue lies somewhere within user data then, since we already established that jb is like 4gb

[acoustic imp]

ok where should i look tho

and with what

[timid furnace]

install du

[faint stag]

iOS itself (mounted at /) is 7.5gb
/usr stuff is like 4.2
subtract those from the total of 59 and you get 47.3. just about the size of private

[faint stag]

yeah that's what we're using, though they also have ncdu

[faint stag]

just du -h /private
should list a ton of stuff in order

[acoustic imp]

it did

[faint stag]

start from the beginning of it

[cloud yacht]

You can pass that to sort can't you?

[timid furnace]

du -sh /private/* | sort -h

[acoustic imp]

i cant scroll

[faint stag]

i think -h is already recursive

[timid furnace]

-h is human

[faint stag]

no i meant the output

but ik

[cloud yacht]

s is summary

So it's just the ones you say

[timid furnace]

-s is summary so the resulting output will be each folder in /private

more manageable

[acoustic imp]

alot of this

[cloud yacht]

Someone needs to port kdirstst to iOS

[faint stag]

expected

because sandbox

[acoustic imp]

this is really slow

so im missing like 15gb

what is using that 15gb 😭

@faint stag how can i like see?

[indigo peak]

[timid furnace]

no

now run ```du -sh /private/var/* | sort -h

[faint stag]

du -sh /private/var/* 2>/dev/null | sort -h
not required but extra steps just to exclude the errors

lol

[acoustic imp]

still mising my 15gb

[faint stag]

what 15

[acoustic imp]

/var + /preboot = 35GB ish

so its really more like 25GB

35 - 60 = 25

[faint stag]

ios itself is 7gb (base rootfs) don't forget that

[acoustic imp]

but still, theres alot of storage left on the tabel

close to 20GB

[restive ether]

usually just app caches

[faint stag]

except, that should exist in /var

one would hope

the counter from df does show private as like 47gb total and they have like 401mb left

[acoustic imp]

@restive ether ?

@radiant idol if i dont **need **to use media remote api should i not?

like should i try not to use it?

[radiant idol]

the less api's, the better

usually

[acoustic imp]

ok 👍 , no more media remote API 🎉🎉

question

if the `image' is going to ever be nil and this method get called, it still run the if statmeant thing as 0 right?

[radiant idol]

?????

[acoustic imp]

like if the "image" is nil, it will do the else?

[radiant idol]

depends on whats in the actual if

[acoustic imp]

ok

so if i want an action for when its nil i should have a if(image == nil) ?

[radiant idol]

if (!image)

[acoustic imp]

so then this is fine?

[cloud yacht]

Just like play a video on iMessage I'd doesn't have an image

[radiant idol]

talking to teslaman is like drinking ten shots and then trying to have a sensical convo with someone

[acoustic imp]

oh yea, i should just test it

[radiant idol]

.

[acoustic imp]

Works great 👍 just need to smooth out the fade animation

@radiant idol why is it like being choppy/jumpy?

[UIView animateWithDuration:0.5 delay:0 usingSpringWithDamping:0.7 initialSpringVelocity:0.2 options:0  animations:^{
                self.artworkWallpaperImage.alpha = arg0 == 1 ? 1 : 0 ;

        } completion:nil];```

this should work right?

[radiant idol]

im gon

d

doidfakrho;e

i dont

know

wokfep'a

[acoustic imp]

also i should do = arg0;

im dumb

[tough shadow]

Apple drinking poison

[acoustic imp]

that one jb

[cloud yacht]

iOS 17 barely tries on the animation btw

[vivid dew]

this is so deep wow

[harsh junco]

How do I MobileGestalt?
MD5 MGCopyAnswer{hi} -> then base64 it?

[orchid fulcrum]

Guys i cant read and change keys from com.apple.springboard. But other suites like com.apple.Preferences work fine

Why ?

[acoustic imp]

Ok, I should Try on the animations

[slender glade]

dlopen the MG dylib and then dlsym MGCopyAnswer, it's signature is CFPropertyListRef MGCopyAnswer(CFString str);, so type cast it to a function pointer of that type, and then to base64 it, you'd want to cast the call to it to a CFStringRef, and then google how to base64 a CF/NSString

typedef CFPropertyList (*CopyAnswerFunction)(CFStringRef);
void *gestaltLib = dlopen("/usr/lib/libMobileGestalt.dylib", RTLD_LAZY);
CopyAnswerFunction MGCopyAnswer = (CopyAnswerFunction)dlsym(gestaltLib, "MGCopyAnswer");
CFStringRef answer = (CFStringRef)MGCopyAnswer(CFSTR("YourKey"));
// now you have your value in the answer variable. do whatever you want with it

[slim bramble]

I'll yoink that rq

[slim bramble]

https://newosxbook.com/articles/guesstalt.html

[slender glade]

I want the books so bad

but im not paying 70 dollars

and im not pirating online either

[slim bramble]

W

[fluid lintel]

https://github.com/ixty/xarch_shellcode
i have seen this project for linux, which seems to work even if it is very old, do you know if there is something similar for ios/OSX, the idea would be to create a Mach-o and to be able to convert it into shellcode. do you think it is possible ?

[serene hawk]

i've sideloaded a decrpyted ipa to a jailed iphone but the app crashes there (even with nothing injected into it) its just the vanilla ipa basically. what is the issue? it seems that it crashes because of 5 libswift_Concurrency.dylib 0x1a8bc7ac5 completeTaskWithClosure(swift::AsyncContext*, swift::SwiftError*) + 1 but when i sideload the same ipa on a jailbroken iphone, it works flawlessly. does anyone know why this happens?

[willow lance]

sock_port2 and kfd will enable us to jailbreak almost all versions on arm64 devices!

[sonic totem]

Open sourced yet???!

[steady nest]

unfortunately sock_port2 doesn’t work for all of 12

it’s patched in 12.4.1 and as such, we need kfd there too

[willow lance]

Not yet since some offsets still incorrect

[sonic totem]

👍

Need a patch finder lol

[willow lance]

I’ll port kfd for 12.3 and 12.4.1~

https://x.com/htrowii/status/1694786814480109961?s=46

sacrosanctuary (@htrowii) on X

mfw too stupid to get kfd to work on ios 12

Twitter · Aug 24, 2023, 7:00 PM

[steady nest]

it’s failing there

although kread worked?

[sonic totem]

We need a new jailbreak for iOS 12 fr

Open-sourced

[willow lance]

I think it will work too, but no clue