development

[hexed knot]

I know how to press alt tab

[twilit jungle]

The quality depends on your image (and image scale) not the view.

[acoustic imp]

Ehh, it was fun making my own

Also I think it’s looking good, also @slender glade

Thoughts ?

[hexed knot]

Teslaman the goat of hacking together shit

[slender glade]

looks better now

[slender glade]

lmfaoo

[acoustic imp]

@radiant idol

[twilit jungle]

Well keep in mind table views and cells are going to look different on different devices.

[acoustic imp]

I Alr tested on iPad and I’m using auto layout

[radiant idol]

that's... not a good thing

[slim bramble]

I have 2 monitors now but I used to have 20 windows opened

[acoustic imp]

Dw, I think I did this correctly

[slim bramble]

you think

[placid kraken]

how much do you actually need to type for member pro btw

[slim bramble]

30

level 30

[placid kraken]

the jump looks so huge

wdym level 30

theres levels???

[granite frigate]

yes

slash xp

[slim bramble]

also @radiant idol I found calls to layoutSubviews in teslaman's rewrite 💀

[acoustic imp]

I HAVTN PUSHED YET

[slim bramble]

you should

[placid kraken]

oh ok im level 22

[radiant idol]

bro

[slim bramble]

Idk mate

[placid kraken]

layout subviews isnt always bad tho what

i use it for ```objc

• (void)layoutSubviews {
  [super layoutSubviews];

  for (UIView *view in self.subviews) {
  if (view != self.contentView) {
  [view removeFromSuperview];
  }
  }
  }

[radiant idol]

calling layoutSubviews is just not a good idea

[slim bramble]

for comparison I have sent 8k messages to get mem pro

[radiant idol]

always call layoutIfNeeded instead

even apple docs says that

[placid kraken]

ok so a little over double me

i see

i dont really care about my thingie i was just curious

https://cdn.discordapp.com/emojis/1085292303628910723.webp?size=48&name=nyaboom~7&quality=lossless

[acoustic imp]

#development message

[slim bramble]

- (void) layoutSubviews {
  while(true) [self layoutSubviews];
}```

🔥

[placid kraken]

thats literally equal to

function a() {
  a();
}

what are you doing

youre calling self not super

[slim bramble]

it's gonna kill memory

[placid kraken]

it will but why do you want this

[radiant idol]

this better not be something he wrote

[slim bramble]

idk I'm just sending random shit

[acoustic imp]

stop

[slim bramble]

No

[acoustic imp]

delete that folder

[slim bramble]

I'd kill him right away

[placid kraken]

%hook UIView

https://cdn.discordapp.com/emojis/1019692218564489349.webp?size=48&name=trolley~2&quality=lossless

[radiant idol]

oh

[acoustic imp]

that one tweak...

[granite frigate]

huh

[slim bramble]

You joke you joke but someone hooked UIViewController yesterday

[granite frigate]

what tweaks do that?

[acoustic imp]

i fg, its the one lower tewak

[acoustic imp]

https://github.com/0xkuj/LowerNotifs/blob/main/Tweak.x line 137

[acoustic imp]

yea

[slim bramble]

Bro should go to hell for that

[acoustic imp]

but look what what he does that

[acoustic imp]

look below it

lmao

[slim bramble]

how useless

[indigo peak]

Harmony discord tweak did this

My friend is learning iOS tweaking and he asked how to add custom properties and this was the example I provided

@interface Cock : NSObject
@property (nonatomic , strong) int length; // normal property
@property (nonatomic, strong) int girth; // custom property
@end

%hook Cock
%property (nonatomic, strong) int girth; // actually making a custom property
%end

[acoustic imp]

W

[indigo peak]

ok replace that with NSNumber

(He doesn’t know the difference)

[acoustic imp]

@grave sparrow like my prefs ?

ok 👍

ok

thx

[warped sparrow]

This is really nice 😃

[acoustic imp]

thanks 👍

[proper reef]

Is there any tool capable of extracting a fully working framework from DSC?

[slim bramble]

DSC ?

[proper reef]

dyld_shared_cache

[slim bramble]

oh

I'd love too

@radiant idol is it good to have 50 vars for preferences

or their is an optimized way of doing it ?

[acoustic imp]

50+ *

[radiant idol]

thats fine

[slim bramble]

memory goes bim boom bye bye

[radiant idol]

??

[hasty ruin]

dictionary

[radiant idol]

its honestly far less overhead than creating a whole object for it

so

[slim bramble]

enums ?

yeah

that could work

[radiant idol]

.

[indigo peak]

if your memory is going boom from 50 bytes of memory being used for bools then maybe it’s time to switch to a phone that was release in the last 10 years

[slim bramble]

No it's not going boom, I'd just like my tweak to be the most memory efficient possible

[restive ether]

https://github.com/blacktop/ipsw

[proper reef]

the frameworks extracted with this did not work for me

[timid furnace]

no

[proper reef]

welp

[restive ether]

oh you said fully working frameworks

i read that wrong

[proper reef]

yeah I need to put frameworks on a ramdisk

and ramdisks can't be big enough for a shared cache

[restive ether]

what are you trying to do with that

[proper reef]

diagnostic ramdisk for a DTK

[steady nest]

you can't extract working stuff from dsc

only up to iOS 8 or 9

[acoustic imp]

why cant i do this ?```customCells.m:131:7: error: no visible @interface for 'swichCellTwoImages' declares the selector 'presentViewController:animated:completion:'
[self presentViewController:alertController animated:YES completion:nil];

``` ```objc
@interface swichCellTwoImages : PSSwitchTableCell
@end
@implementation swichCellTwoImages
-(void)setSelected:(BOOL)arg1 animated:(BOOL)arg2{

UIAlertController *alertController = [UIAlertController alertControllerWithTitle:@"Title"
                                                                        message:@"Message"
                                                                 preferredStyle:UIAlertControllerStyleAlert];
[self presentViewController:alertController animated:YES completion:nil];

}
@end```

PSSwitchTableCell is a decendant of UIView ?

[indigo peak]

yeah but presentViewController:animated:completion: is a method for UIViewController

not UIView

[acoustic imp]

oh

[indigo peak]

can the iphone/tool template not be compiled for rootless?

[acoustic imp]

fiore is there a way to see when a swich cell is like swiched ?

[placid kraken]

yes there is

well

kinda

[indigo peak]

((UISwitch *)[self control]).on

[placid kraken]

yea that

[acoustic imp]

but how would u see when it chnaged?

[indigo peak]

@interface SixteenPlayerPrefsSwitchCell : PSSwitchTableCell
@end

@implementation SixteenPlayerPrefsSwitchCell

- (id)initWithStyle:(UITableViewCellStyle)style reuseIdentifier:(id)identifier specifier:(id)specifier {
    self = [super initWithStyle:style reuseIdentifier:identifier specifier:specifier];

    if (self) {
        if ([specifier propertyForKey:@"switchColor"]) {
            [((UISwitch *)[self control]) setOnTintColor:hexStringToUIColor([specifier propertyForKey:@"switchColor"])];
        }

        NSLog(@"This switch is %@", ((UISwitch *)[self control]).on : @"on" ? @"off");
    }

    return self;
}


@end

[placid kraken]

UISwitch *toggle = [[UISwitch alloc] initWithFrame:CGRectZero];
toggle.transform = CGAffineTransformMakeScale(1.3, 1.3);
toggle.translatesAutoresizingMaskIntoConstraints = false;
toggle.on = enabled;
[toggle addTarget: self action:@selector(handleToggle) forControlEvents:UIControlEventValueChanged];
[self.contentView addSubview:toggle];
``` this is how i do it but i add a custom switch

[indigo peak]

ok specify you want to detect when a switch is toggled

^

[placid kraken]

you then add handleToggle on your class

for the @selector

[indigo peak]

[((UISwitch *)[self control]) addTarget:self action:@selector(handleToggle) forControlEvents:UIControlEventValueChanged];

would prob work

[acoustic imp]

k

[placid kraken]

this syntax is fucking horrible to read

😭

[indigo peak]

copium

[acoustic imp]

im confused

[indigo peak]

good

[acoustic imp]

whats (UISwitch *) ? is that a refernce to the swicth? like could that be specifier? here objc if([specifier propertyForKey:@"swichCellTwoImages"]){ [((UISwitch *)[self control]) addTarget:self action:@selector(handleToggle) forControlEvents:UIControlEventValueChanged]; }

?

i give up this is dumb

[torn cloud]

use your slave to fix it

[indigo peak]

what are you trying to even do

[slim bramble]

fr

[acoustic imp]

trying to make it so in the plist you put to sfsymbols. would would be for when the swicth is on and one for when its off.

[versed wasp]

how would I go about doing a tethered iOS 16.x downgrade

i remember mineek got it working

[indigo peak]

uh just detect the when you set the preference

[acoustic imp]

oh thats smart

[indigo peak]

inside your root controller

[acoustic imp]

yea

but then how wouldi set the image

[indigo peak]

call [self reloadSpecifiers];

and then inside your code where you set the image

do a check

if enabled

or not

[acoustic imp]

also where in the rootlist cont

[indigo peak]

idk whatever your prefs rootlistcontroler is

sixteenPlayerPrefsRootController

or whatever

[acoustic imp]

no like in the file

where

[indigo peak]

bruh what

in a new method

[acoustic imp]

whats the method?

setWHAT

[indigo peak]

setPreferenceValue:specifier:

[acoustic imp]

not there

[indigo peak]

- (void)setPreferenceValue:(id)arg1 specifier:(id)arg2 {
  [super setPreferenceValue:arg1 specifier:arg2];
  
  [self reloadSpecifiers];
}

[indigo peak]

yeah

you have to make it youself

...

@sonic totem whats up

[sonic totem]

accident

[indigo peak]

bro accidentally typed out "Fiore" and pressed send

[acoustic imp]

@slim bramble

[slim bramble]

this

hook it

[acoustic imp]

yea but i dont wana hook prefs

[slim bramble]

you don't have the choice

[acoustic imp]

i could just not do it

[slim bramble]

yea

[indigo peak]

thats not a hook...

[acoustic imp]

?

[sonic totem]

yeah typo fr

[slim bramble]

Oh fr

yeah

if it's in prefs

[sonic totem]

Accident sry

[indigo peak]

send your sixteenPlayerPrefsRootController.m file

[sonic totem]

Cat walked on my keyboard

[indigo peak]

real

[sonic totem]

Also @indigo peak you are a liar

[indigo peak]

sorry

[sonic totem]

Saying you won't code today

COLLAB !

[indigo peak]

woah woah woah

i never said i wasnt going to

i said i didnt yet

yet

[radiant idol]

go away alfie you're note welcome here. ORANGE NAME PREFERRED

[sonic totem]

I'll make Dopamine 3.0 and you make a new tweak exclusively to be released with Dopamine 3.0

[sonic totem]

I can ban you

[indigo peak]

eta when alfie nightwind and icraze

biggest shitshow of a project ever

[radiant idol]

MODS

[sonic totem]

That's why you're not invited

[radiant idol]

GENIUS ABUSE

[slender glade]

Alfie would be the one cleaning the code up

[sonic totem]

You'd only make it worse

[indigo peak]

aw shucks

[sonic totem]

🔥🔥 so real

[indigo peak]

LMAO

[slender glade]

Alright who is censoring me AGAIN

[indigo peak]

permissions aboose

@radiant idol

[slender glade]

AGIN

AGAIN

[sonic totem]

iCraze wouldn't even contribute either

[slender glade]

😭😭

[indigo peak]

nah

he would

but

it would be like

at the very end

and the entire project wouldnt wokr without it

itll be something stupid

%hook Class
- (int)blah {
  return -1;
}
%end

[radiant idol]

drm

[indigo peak]

and that will determine it woreking

na just think ab it

dream team right there

[sonic totem]

Unfortunately I can't see deletion logs I don't think @slender glade

[indigo peak]

nightwind for code
me for prefs
icraze for drm
alfie for emotional support

[sonic totem]

Such an L for me

[sonic totem]

Alfie for fixing Nightwind's code*

[slim bramble]

W

[sonic totem]

What if I go dark

[slim bramble]

I will force you not to

[sonic totem]

iCraze DRM is suboptimal at best, I broke it in 5 minutes

Fr tho

[indigo peak]

[sonic totem]

Fiore x Alfie x Nightwind would be insane

[radiant idol]

prove it, send in DMs

[sonic totem]

I don't rlly think iCraze deserves to be on the team

[kind herald]

nobody to send cat gifs

L team

[tepid olive]

What about me

[indigo peak]

bro wants to be included

[sonic totem]

Stop trying to push your way into the Dopamine 3.0 team !

[kind herald]

but

[tepid olive]

Alfie knows me

[sonic totem]

[kind herald]

I think cat gifs

[sonic totem]

Dogs >>

[kind herald]

would be a nice addition to the Dopamine 3.0 team

[tepid olive]

Actually fish are better

[indigo peak]

https://tenor.com/view/dance-happy-dog-reaction-dogs-gif-19659302

[sonic totem]

??? WHY ARE THESE THE SAME VALUE

[kind herald]

https://tenor.com/view/eat-eet-cat-likes-corn-cat-gif-15984022

[tepid olive]

I don't see anything the same here

[indigo peak]

wat yu wokrin on there

[sonic totem]

Wait is Python being Python

[tepid olive]

Ew python

[sonic totem]

I just needed an interpreter

[tepid olive]

Fair

[indigo peak]

weather is proving to be more and more difficult every day 😭

[tepid olive]

I should make a tweak with my experience gained from making the majority of a Jailbreak

However idfk what to make lmao

[sonic totem]

It was indeed a Python issue

[sonic totem]

Secret PPL haxx

[tepid olive]

Lmao

Fiorr

[topaz yew]

pmap be like

[indigo peak]

could you not p on my map

🙏

[topaz yew]

so real

[elder scaffold]

Secret KTRR haxx

[sonic totem]

[sonic totem]

Leak!!

[radiant idol]

wait till you try and deal with the MediaRemote framework

[robust flower]

hi guys, i have an idea of a tweak but i think its a little bit difficult for me.

[hasty ruin]

@sonic totem us three got the tweak pretty much done without you

you're off the team.

[robust flower]

my idea is to integrate the Ai to IOS. like in the research menu

but i have absolutely no idea of how can i do that

[sonic totem]

:(

[slender glade]

Research menu?

[robust flower]

yes on your home page

[slender glade]

Oh

[robust flower]

i don't know the name in english because i'm french

[slender glade]

U talking about that spotlight

[robust flower]

yes !

[slender glade]

Yeah should be least

[robust flower]

yes exactly

[slender glade]

easy*

[robust flower]

maybe yes but i'm a begginer and thats my first tweak, and i don't know how to do that

and i need a free generative ai api

[slim bramble]

@robust flower si tu as besoin tu peux me dm

[acoustic imp]

is there a like cell.leftImageView for sliders cells ? im trying to set the tint color of it

iv looked thru the propertys but cant find one

[robust flower]

merci bcp

[acoustic imp]

Do i need the text, if I have the icon ?

[slim bramble]

remove the dots

plz

🙏

[acoustic imp]

K

[placid kraken]

its portrait btw

[acoustic imp]

😭

[torn cloud]

alfie is a genius no way

congrats

[sonic totem]

Thanks fr

[radiant idol]

Portrit mode

[sonic totem]

Loads of people have congratulated me didn’t even realise it was a big thing lol

[radiant idol]

I'm disgradutalating you

[sonic totem]

I’m refunding Jade

Now respond to the message you just got sent

[radiant idol]

i'm refunding trollstore

[sonic totem]

TrollStore is free because we are so kind

Jade….

[torn cloud]

dev slander

[radiant idol]

FR

unbelievable

[torn cloud]

sorry nightwind

[kind herald]

"because we are so kind" yet trollstore for 17.0 exists but it can't be installed. it is just taunting us. that's mean

[sonic totem]

TAKE THAT L @radiant idol

[sonic totem]

Fr tho Nightwind could dox me at any given moment so it’s okay

[torn cloud]

@radiant idol are you british?

no?

[sonic totem]

I wouldn’t drop a 0day

[sonic totem]

Armenian

[radiant idol]

okay

[sonic totem]

Didn’t see that

Was checking group

[radiant idol]

ԵՍ ՀԱՅ ԵՄ

[torn cloud]

Respectable

but SIT DOWN

[tepid olive]

Alfie doesn't do kernel exploits

[torn cloud]

britain better

[torn cloud]

i love exploiting the kernel

it's genuinely fun

[tepid olive]

True

[torn cloud]

alfie what was that

[sonic totem]

Someone is deleting my messages

[kind herald]

trollstore poc for the 2 vulnerable devices on my network eta

[sonic totem]

I am being silenced

[tepid olive]

icraze

[slim bramble]

icraze

[torn cloud]

icraze

[slim bramble]

Lets check for icraze

icraze checker is running

[sonic totem]

So real tbh

[crisp frost]

Exploiting the kernel is easier than exploiting iboot although we need a iboot exploit far more than a kernel exploit

[slim bramble]

hmmm

intresting

[tepid olive]

I wouldn't say this is entirely true

[torn cloud]

yeah its not him

[sonic totem]

😹😹

[slim bramble]

so real

[torn cloud]

icraze is not present at this time

[crisp frost]

Which part?

[tepid olive]

(doesn't even work)

[sonic totem]

And how much did TrollStore cost?

[tepid olive]

An entrypoint

[slim bramble]

lmfao

[torn cloud]

what's wrong with it

[sonic totem]

I find bootchain stuff easier tbh

[tepid olive]

While it might be easy to find a bug in iBoot, an entrypoint is a different story

[sonic totem]

Less complicated

[torn cloud]

aren't iBoot exploits extremely uncommon

[slender glade]

yes

[torn cloud]

me trying to understand a single line in ChOma

[crisp frost]

Yes, if you know where to look ( e.g checkm8 )

[slim bramble]

iBoot-latest-master.zip

[torn cloud]

codesigning is not for me

[slender glade]

LMFAOO shut your ass up nightwind

[tepid olive]

wrong reply

[torn cloud]

nightwind got silenced 💀

wtf

[tepid olive]

??

[kind herald]

mods mute nightwind

[slim bramble]

L

[crisp frost]

Oh I just realised my message was stupid

I meant finding a new vulnerability

[timid furnace]

retreat to #1189739986707288154

[tepid olive]

oh no it definitely is 100%

[sonic totem]

Yeah true but I just find that bootchain has less things to think about (e.g. mitigations)

[slim bramble]

Unknown

[torn cloud]

orange name only? 🤔

[slim bramble]

frfr

[timid furnace]

no

[sonic totem]

Sorry Dhinak

[crisp frost]

The boot chain is far more sophisticated than the kernel tho

[kind herald]

#1186023633919942736 skill issue

[torn cloud]

[sonic totem]

Yes true but still

[radiant idol]

@sonic totem you suck poo poo

[tepid olive]

the source code is so ass bruh

[sonic totem]

Idk I’ve never done kernel exploitation so that’s probably why

[tepid olive]

you would think it would be all pretty and the best in the world

[torn cloud]

taking this out of context

[sonic totem]

Nah it’s ez

[tepid olive]

since it runs on billions of devices

I think the main issue with iBoot exploitation is the lack of entrypoints

but no

[radiant idol]

ez unlike your code because you write spaghetti code

[crisp frost]

Yeah once you know where the vuln is it can be easier to exploit, but try finding a new one for arm64e fire bloom devices

[torn cloud]

for you maybe

[tepid olive]

The only entrypoint is DFU for the most part

[sonic totem]

Yeah I have 0day fr 👍 dm for source code 🔥

[kind herald]

dming right now

[crisp frost]

Posting on Reddit

[sonic totem]

Even ROMs have Firebloom now @crisp frost

[radiant idol]

alfie is being edgy and using default discord pfp

[sonic totem]

If I had a good picture I’d use it

[sonic totem]

IMG4?

[kind herald]

https://media.discordapp.net/attachments/1173999926171148289/1174006418739826698/image0.gif

use this

[torn cloud]

wouldn't a BootROM for arm64e require a SEP exploit too?

[sonic totem]

Yes

To be usable

[torn cloud]

bruh moment

[kind herald]

just disable SEP

[sonic totem]

Unless you used seprmvr64!!

[kind herald]

[crisp frost]

Depends on what u define as usable

[sonic totem]

For a jailbreak

For pwned restore that’s different

[torn cloud]

and apple don't even accept bug bounties for BootROM level exploits

[crisp frost]

I mean you can still boot pongoOS / Linux without a sep exploit theoretically

[torn cloud]

eta wen

i need the .sh

[sonic totem]

Correct I did it on a passcode-set iPhone X

[torn cloud]

cba to partition it manually

[hasty ruin]

i bet xi does

[sonic totem]

Probably if you told them you had a 0day

[crisp frost]

seprmvr64 with iOS 17 sep is apparently broken tho..

[sonic totem]

They just don’t encourage research into them

[sonic totem]

NO!!

They beat us

[torn cloud]

who is xi

[hasty ruin]

jinping

[brazen timber]

i mean if you had a bootrom zero day why would you tell it to apple

[placid kraken]

someone pin this for future reference pls

[brazen timber]

sell it zerodium for a couple million

[torn cloud]

money

[brazen timber]

they would give you 3.50

[hasty ruin]

fr

[crisp frost]

Zerodium php back door

[torn cloud]

couple million?

no way

[sonic totem]

Yes way

[crisp frost]

Some security researcher should drop a img4 design flaw

[cinder beacon]

aint no way theyre gonna pay a few milllion, i dont think its THAT useful to them

[torn cloud]

go back to sipping your yorkshire tea

[sonic totem]

iH8Sn0w is under a Cellebrite NDA

[placid kraken]

how much would apple pay for a hardware-level exploit like checkm8

[brazen timber]

bootrom zero days are too rare to be on their site but they pay 2 million for ios zero clicks

[sonic totem]

It definitely is if you have a SEP 0day too

[slim bramble]

Some security researcher should drop checkm9

[radiant idol]

nerds

[brazen timber]

so a bootrom zero day is like

[radiant idol]

im too lazy to google

s

[brazen timber]

double digit millions

[radiant idol]

so

[brazen timber]

at least

couple is too low

[torn cloud]

why tf do they pay 2M for android exploits

[sonic totem]

Also @torn cloud if you had an IMG4 bug SEP wouldn’t be an issue

[radiant idol]

what is the difference between unichar and char because im too lazy to google it

[brazen timber]

android exploits are rarer and they have fewer of them

[slim bramble]

fun fact axiomx didn't really got paid for checkm8

[placid kraken]

char is max 255, unichar is an extension

[brazen timber]

he found it via diffing

no?

[sonic totem]

Because it was an n-day

[radiant idol]

wha

[brazen timber]

it was already patched in a12

when he found it

[slim bramble]

oh mb

[placid kraken]

char is 8bit, unichar is 16 bit

[torn cloud]

cool

[placid kraken]

utf8 and utf16

[radiant idol]

oh ok

[crisp frost]

ok I have everything to generate blobs except for keys who here can give me prod s8003 tss privkey

[hasty ruin]

i can give you a rune key

[sonic totem]

DMs

[torn cloud]

AxiomX is a beast, bro joined github, found a bootrom, made it public then dissapeared

[brazen timber]

you can also read this is android is more secure

[sonic totem]

Found two BootROM bugs in fact

[hexed knot]

Apple gave me 25k for the shit i submitted

[slim bramble]

he didn't dissapeared

[torn cloud]

you mean alloc8?

[sonic totem]

One was (technically) a 0day, one was an n-day

[torn cloud]

what

[sonic totem]

Yes

[tepid olive]

no shit !!

[tepid olive]

which makes sense

[sonic totem]

W

[sonic totem]

He’s still around

If you know where to look

[torn cloud]

not really, why would they not accept a bounty for something that is the very basis of the operating system?

[slim bramble]

W, continue to extract money from them

[torn cloud]

oh right

[slim bramble]

make them go bankrupt

[tepid olive]

because you have to go out of your way to exploit it

[torn cloud]

what did you find?

[brazen timber]

it wouldn't be part of their bug bounty program

[crisp frost]

To discourage people

[sonic totem]

You just need physical access

[brazen timber]

like they would probably make an exception

[torn cloud]

L apple

[brazen timber]

anyways they are not paying more than zerodium will

[torn cloud]

what is zerodium gonna do with a bootrom

[tepid olive]

Who's zerodium

[sonic totem]

Ethics though

[hexed knot]

Ion think 25k is affecting them much

[torn cloud]

security company

[brazen timber]

fuck ethics bro your life is too short

[sonic totem]

Need that bag

[torn cloud]

fr

[brazen timber]

they sell it to governments

[sonic totem]

Yeah but if you knew your exploit was going to be used to pwn innocent people it would be on your mind

[brazen timber]

to blow up nuclear reactors in iraq and stuff

[brazen timber]

no i wouldn't care

[hexed knot]

Whos “you”

Idgaf

[brazen timber]

fr

[crisp frost]

What if you just sell it to zerodium and disclose it to Apple and get the double bounty 🔥🔥

[torn cloud]

wait isn't that how operation triangulation became a thing? like the guy was hacked or something

[tepid olive]

it's gonna happen anyways

[crisp frost]

joking ofc

[sonic totem]

Yes

[brazen timber]

LMAOO

[sonic totem]

Too late

[torn cloud]

WHAT

[brazen timber]

im joking

[timid furnace]

prob sued

[sonic totem]

I need to get a CVE

[tepid olive]

or sell it to nso group and get triple but the bug is used to genocide palestinians

[brazen timber]

zerodium only sells to NA and european governments

[tepid olive]

yeah cuz apple NDA

[torn cloud]

W man, he went out of his way to make PPLRW public

[timid furnace]

no, you probably sign a contract when you sell it

[torn cloud]

keep cooking

[brazen timber]

yeah + nda from zerodium

[crisp frost]

Well you’re a security researcher just find a loophole in the contract

[sonic totem]

Tbh it itself was a really interesting chain and I think that’s why

[timid furnace]

[sonic totem]

Buffer overflow in clause 18

[torn cloud]

how is the bug used to kill people? elaborate

[torn cloud]

yeah

[tepid olive]

@sonic totem recovery iboot exploit or KTRR bypass with operation triangulation

[hexed knot]

Neura link exploit

[sonic totem]

iBoot

[torn cloud]

like i know the NSO group are a bunch of assholes and are garbage

[sonic totem]

iBoot exploit = KTRR bypass

[tepid olive]

but it's recovery iboot, not secureROM iboot

[pearl sail]

Congrats a being a genius @sonic totem

[sonic totem]

It’s still a KTRR bypass

[tepid olive]

true

[sonic totem]

Thank you !

[hexed knot]

Wassup @pearl sail

[torn cloud]

[sonic totem]

If it’s a 0day it’s almost as good as a BootROM exploit anyway

[pearl sail]

Hello

[tepid olive]

except apple wouldn't pay me for either

[tepid olive]

recovery iboot bug still gives you untethered haxx

[hexed knot]

How u been

[sonic totem]

Not necessarily

[tepid olive]

in most cases yes

[sonic totem]

USB bug?

[tepid olive]

ok only that

[pearl sail]

Ok got a new tv to replace my 20 year old one

[tepid olive]

recovery iboot bug would have to be discovered on iOS 16.2 though because I have a singular arm64e device

[hexed knot]

How big

[tepid olive]

im talking about like the HFS one from iOS 5 or the xerub iOS 7 one

[pearl sail]

65

[sonic totem]

True

[crisp frost]

Need another log4shell-type vuln that works like everywhere

[hexed knot]

Good shit

[crisp frost]

Log4shell was fun

[pearl sail]

Any bigger would look awkward

[hexed knot]

65 is such a good size

[crisp frost]

My friend opened calculator on my pc

[tepid olive]

I don't have money for more devices

[sonic totem]

Imagine having friends that know this stuff

[crisp frost]

Nah he’s a big skid

[sonic totem]

No one I know irl has ever heard of TrollStore

[torn cloud]

still pisses me off how the KTTR bypass is completely useless, you can't even write to memory smh

[tepid olive]

it's not useless

[pearl sail]

I gotta figure out good setting for anime on this TV tho

[tepid olive]

it can still be used as a temporary KTRR bypass

[sonic totem]

It’s not surprising considering KTRR has like zero attack surface

[torn cloud]

writing to cache could be feasible ig

but you'd have to find a way to not make cache flush

[tepid olive]

you can temporarily disable cache writeback

[crisp frost]

iPhone dram modchip wen

[torn cloud]

fr?

[tepid olive]

apple has a register for it

[torn cloud]

that's cool

wait what does KTTR stand for i can't find it anywhere

[tepid olive]

we need a team xecuter for Apple shit

[sonic totem]

Kernel Text Read-only Region

[tepid olive]

Imagine a jb on the AVP

[radiant idol]

kernel text readonly region

[tepid olive]

kernel text something

[topaz yew]

i remember that 🥹

[torn cloud]

cheers

[hexed knot]

What brand did u get

[sonic totem]

[crisp frost]

Ok but soldering on a modchip just to get full access to A PHONE is crazy

Just buy a android at that point

[sonic totem]

Soldering a modded SEP

[tepid olive]

how's it any different than doing it on a nintendo switch

or an xbox 360

just buy a PC

[crisp frost]

Nintendo switch is more understandable

[kind herald]

checkm9 mod chip for newest iPhone 15 Pro Max

[tepid olive]

those are game consoles and you want to run unlicensed software onto it

[torn cloud]

wouldn't the device just panic upon boot

[tepid olive]

just buy a PC

[pearl sail]

Sony

[sonic totem]

Idk

Probably

[crisp frost]

Just re flash the bootrom

[sonic totem]

Exactly

[tepid olive]

what if i can afford a switch and a pico modchip but not a $2000 pc

[sonic totem]

rmsigchks.py

[acoustic imp]

in my tweak contributions tab do i need to inclued what the dev/person helped with or can i just link to their twitter/GH

[tepid olive]

can you afford the soldering iron, microscope, heat gun, and all other tools necessary as well

[sonic totem]

@crisp frost I remember my first big project was trying to get ipwndfu working on M1

[torn cloud]

yeah i remember a customer in the shop i work in came in with a 5s that had a broken camera, we put a 5c camera into it and it panicked upon boot with the We are hanging here!. idk if it's related.

[sonic totem]

Spent like two months and got nowhere

[indigo peak]

i just saw the file in dms sorry

went to the dm req pile

[tepid olive]

go to a high school stem lab

[sonic totem]

Lies

[sonic totem]

Hm idk

[acoustic imp]

its fine, i jus worked on sm else

[pearl sail]

That depends on how rich your district is tbf

[torn cloud]

it's a Apple moment i guess

[sonic totem]

Okay I have homework due at 9am tomorrow

[tepid olive]

guys I need to know

[crisp frost]

Sounds cool.. but why tho if there’s so many alternatives

I mean you can possibly even just put the ipwndfu payload in gaster and pwn via gaster and then continue with the ipwndfu api

[sonic totem]

I wish I could drop out and do sec research full time

[torn cloud]

that reminds me so do i lmao

[sonic totem]

ipwndfu payload does not work with gaster I tried

[tepid olive]

temporary KTRR bypass to bypass PAC, or recovery iboot exploit

[sonic totem]

There was a custom overwrite/payload option in Achilles v1

[crisp frost]

oh 😔

[torn cloud]

finishing uni first isn't too hard though tbf

[sonic totem]

IBoot because it does the former two anyways

[tepid olive]

ok

[crisp frost]

We need this in Achilles v2

[sonic totem]

I’m not going to university smh

[torn cloud]

how come

[tepid olive]

consider it done (in a year)

[sonic totem]

I can add it with some compilation flag

[acoustic imp]

@radiant idol ?

[tepid olive]

how much is corellium

[sonic totem]

I don’t think it’s useful

[acoustic imp]

(he helped alot that y i ask him)

[sonic totem]

$3/hour base rate

[torn cloud]

too much if you want to make it useful

[tepid olive]

oh

[torn cloud]

and that's only for arm64 devices

[radiant idol]

depends on what you want

[torn cloud]

arm64 only

[tepid olive]

because I only have a singular arm64e device

[torn cloud]

it could be tbf, but gl in whatever you go on to do

[crisp frost]

Btw Alfie what do you think of my checkra1n 1337 payload reimplementation ( idk if that’s the right word ), basically a checkm8 payload capable of booting pongoOS. I started working on like a few weeks ago and then forgot about it ( its not really close to booting pongo tho, currently it local boots the device with verbose boot )

[tepid olive]

I'd rather do something that gets me money though

[acoustic imp]

i choose? most tweaks im looking at have sm. but idk what id say for you and fiore, icraze, yan, comrad. it was mostly like general questons

[tepid olive]

so I can buy actual stuff

[sonic totem]

What?! I NEED SOURCE ACCESS!

[torn cloud]

do both fr

balance is key

[sonic totem]

I’ve been wanting to write one of those myself but haven’t had the time

[radiant idol]

ok well if i were you i'd add as much detail as possible (make sure to spell that right though)

[sonic totem]

Local boot with verbose is epic wow

[acoustic imp]

i type in gramarly first 👍 , and k

[crisp frost]

Sure I’ll add you once I make a repo ( it’s currently just on my MacBook )

[torn cloud]

can't you just do -v in boot args though

[sonic totem]

Legend legend

[crisp frost]

yeah but this is local boot

[sonic totem]

Yes but you need to load a custom iBoot from recovery mode to do that

[torn cloud]

ah

ok

[crisp frost]

As in secureROM -> verbose boot

No external files need to be uploaded

[sonic totem]

Well custom iBSS -> iBEC

[crisp frost]

Damn I’m so tired

[torn cloud]

is that what Nathan's script does

since it boots the device in verbose mode

[crisp frost]

Nathan’s script does a remote boot

[torn cloud]

ohh

[crisp frost]

E.g loading files via usb

[tepid olive]

Is it like the dora one

as in the loader to load checkra1n on a phone

to jb another phone

[crisp frost]

Please don’t mind the skidded Achilles code that’s somewhere in there

[sonic totem]

Legally I have to have source access then

[crisp frost]

Removing Achilles code rn

[tepid olive]

oh that's right alfie, a while ago I meant to ask something

but I forgor

lmao

[sonic totem]

Which code is it I’m curious

[sonic totem]

No that uses all the checkra1n payloads

Mineek wrote custom ones

[tepid olive]

oh wait I think it was something about uhhh writing a custom sepos

I remember somebody told me to ask you because you had tried before or something

[crisp frost]

Well it was like the “base” of the checkm8 exploit ( although your code is currently unused as I switched to other currently not in a public tool checkm8 exploit code, I just never bothered to remove it Fr )

[sonic totem]

Oh W

All OSS checkm8 tools are based on gaster at this point anyways

[crisp frost]

I wanted to test reliability between exploits iirc

[tepid olive]

I believe it was to have proper functionality on tethered downgrades?

[torn cloud]

is blackbird ever gonna go OSS lmao

[sonic totem]

It is?

[tepid olive]

wdym it is isn't it

the code is literally in pongo

[torn cloud]

what

uh

I’ve been told lies

[sonic totem]

Oh yeah

Mineek got that working

[torn cloud]

by someone else

brb

[crisp frost]

Yeah openra1n is based on gaster although the code in my thing is not. Idk if I can even share that code so I may have to port it to gaster before making a repo and sharing with you

[tepid olive]

whattt

[tepid olive]

but did they write a custom sepos?

[faint stag]

this is the reason why i turn off requests now lol

[torn cloud]

kfd moment

[tepid olive]

I wanted to write a custom sepos as well

I don't remember why though lmao

[river plank]

Can you help me, please? 🙏

[sonic totem]

Why can’t you share that

[torn cloud]

reboot and try again

[sonic totem]

No it was loading a custom one

[river plank]

Ok

[tepid olive]

I see.

[crisp frost]

It’s private code

[tepid olive]

I don't actually have any functional A10 devices, I have an iPhone 7 but its icloud locked lmfao

[crisp frost]

( the exploit )

The other stuff I made myself so I should be fine sharing

DAMN I really need to sleep now

[torn cloud]

you do realise there are ways

[sonic totem]

Private code or private haxx?

[tepid olive]

I don't even know where the iphone 7 came from tbh lmao

[sonic totem]

You can just share the payload if that’s easier

[tepid olive]

just appeared in my closet one day

[crisp frost]

Well yeah but for my thing to work it requires changes to how the exploit runs

[tepid olive]

what, like cryptic's thing?

I forgot what it was called

oh hookra1n

[river plank]

The error continues, do I change the Landa?

[crisp frost]

Alright I’ll give you more info if you want to tomorrow Alfie I really need to sleep now it’s 22:40 and normally I go to sleep around 22:00 on a school day

[torn cloud]

yeah try it

[tepid olive]

wrong channel

[crisp frost]

No that’s different

[tepid olive]

yeah that modifies the payload

I mean I can't even do checkm8 related stuff anymore because my PC is AMD

[sonic totem]

Ah interesting

[sonic totem]

No worries go sleep

[tepid olive]

anyways time to focus on exploiting @faint lion again

[kind herald]

GIR is already broken

[brazen timber]

type really quickly

[visual meadow]

ok so question

[brazen timber]

easy

[visual meadow]

how would i override this and just make it an image:

[tepid olive]

(GIR's vulnerable to ReDOS in multiple places lmfao)

[topaz yew]

i fucking hate swift what is this

its so long

😭

[visual meadow]

swift symbols my beloved

[topaz yew]

i mean its not like i have a choice

[tepid olive]

Dock is swift?

[visual meadow]

yes afaik

[tepid olive]

I always thought it was Carbon

[topaz yew]

pretty much yeah

[visual meadow]

what are you trying to do to the dock

[tepid olive]

Like the menu bar

[topaz yew]

nah

[topaz yew]

move the actual window, and stuff with the desktop picture

[visual meadow]

mines transparent lol

ellekit mac is W

please ignore how many apps i ahev

[tepid olive]

Jfc

[topaz yew]

this is my windowserver hooking with my stuff

[visual meadow]

you can just build with theos for this lo

[tepid olive]

Anyone a fellow yabai user?

[visual meadow]

its just regular tweak

[topaz yew]

build what with theos

[visual meadow]

a tweak as normal as if it were an ios device

but instead its a mac

lol

[topaz yew]

ah yeah you could switch the target to macos

[visual meadow]

yeah thats what i did

[topaz yew]

im doing some other things tho thats why i have my own build system

[slim bramble]

HUH

how can you live with all that

[tepid olive]

guys does any browser support quantifiers on lookbehind assertions?

[visual meadow]

idk people are different

some of those apps i havent even opened

[slim bramble]

Zefram

[topaz yew]

holy shit zefram gave me malware

[visual meadow]

mfw pspawn.dylib optool

launchd

🙏

[slim bramble]

THE DAY HAS FINALLY COME WWWWW

[visual meadow]

i had to port it to theos though

[topaz yew]

man one time i hooked the windowserver and fucked up my shit all my windows were in a little box and i couldn't move them

[visual meadow]

oh shit my bad

thank your

[faint stag]

i looked at the docs for the mangler and it killed me

[topaz yew]

[indigo peak]

[kind herald]

[visual meadow]

i just got eneko working in carplay

🙏

[faint stag]

imagine pulling up with the anime video wallpaper playing

[gentle grove]

die

🎲

[indigo peak]

can someone send me a high resolution nfr

[kind herald]

nfr?

[tepid olive]

have we figured out how to set persistent cryptex nonce

[indigo peak]

nfr == frcoal

[kind herald]

oh

[tepid olive]

@faint timber

[kind herald]

just take the webp from the emoji

https://cdn.discordapp.com/emojis/784338955759517696.webp

[indigo peak]

I’m on mobile rn

[kind herald]

oh

well

I sent the link to it

[faint stag]

yeah but that maxes out at 128

lol

[visual meadow]

somebody send a video so i can demonstrate it working

[faint stag]

bro asked for high resolution

[faint stag]

128 is not high resoution

[indigo peak]

.

[faint stag]

the things that happen in #development man

[indigo peak]

@grave sparrow

[kind herald]

amazing

[acoustic imp]

is this simulator?

[visual meadow]

yes carplay simulator

you can plug phone into mac and it shows up

[acoustic imp]

ohh

so you get virtual carplay??

[visual meadow]

basically

[indigo peak]

yeah I put my mac in my car bc I can’t afford CarPlay

[kind herald]

I thought you had to use one of the simulator iPhones to get CarPlay simulation

this is the first time I've gotten it to work

troll

[faint timber]

close but not yet but also useless with the apfs corruption issue

will probably add blob saving but also useless since it probably uses entanglement

[native merlin]

hello, i'm really starting to make a tweak, just wanted to know. is control center part of springboard? (com.apple.springboard) or is it something else?

[slim bramble]

yes

[kind herald]

can you create your own Snowboard extension?

[slim bramble]

yes ?

[kind herald]

okay

[slim bramble]

oh

probably I'm not sure

[faint stag]

springboard is basically the entire ui
(app switcher, status bar, control center, lock screen, home screen, volume hud, home bar)

u get the point

https://github.com/MTACS/iOS-17-Runtime-Headers/tree/main/PrivateFrameworks/ControlCenterUI.framework

[native merlin]

Alright, thank you sm for telling me :))

[indigo peak]

@native merlin This is an extemely simple CC tweak that makes your cc look like this

https://github.com/donato-fiore/CCBorder

[faint stag]

it's all layoutSubviews 😭

[indigo peak]

can we mute Nathan for ghost ping

[indigo peak]

yeah and

it gets the job done

[visual meadow]

no i was thinking about saying something

[indigo peak]

all it does it change colors

[visual meadow]

but then

didnt

[indigo peak]

doesn’t add subviews or anything

[native merlin]

agree

xD

[indigo peak]

all I said was simple, I didn’t say well coded

[native merlin]

i'm trynna make a new button for CCSupport or something like that cuz I couldn't get what I want online and I think it's gonna be "pretty easy" compared to complex tweaks. All I wanna do is add a switch to the "vibration" setting in accessibility settings, since this is a system toggle I think I'm not gonna struggle that much.

[acoustic imp]

@radiant idol

[indigo peak]

all I did was put CoolCC in ida and reconstruct it

don’t hate me pls

[radiant idol]

what is wrong with you

[visual meadow]

someone fix the home modules

🙏

[acoustic imp]

u do it

[visual meadow]

i tried

[indigo peak]

☹️

[native dune]

W song

[faint stag]

max volume is crazy

[acoustic imp]

no its not

[indigo peak]

in the gym

[indigo peak]

rate the EQ settings

[acoustic imp]

Spotify?

[indigo peak]

yeah

[indigo peak]

yeah

insta win?? No

there’s instawin darts, cup pong and golf

there’s also darts aimbot now

Like you can chose where they go

what is a girl not gonna block you if you win or sum

[vivid dew]

women are temporary

the boys are forever

[acoustic imp]

@indigo peak W song

[indigo peak]

stalker

[hasty ruin]

nah man that album is fucking ass

[cinder frigate]

How can I compile/repackage a package to be compatible with roothide?

[acoustic imp]

iv only heard flododed... and JWR

[tepid olive]

anyone applied for corellium free trial

how long did it take for them to reply back

the first time i tried they never replied back to me

tried under a new email this time

[acoustic imp]

What SFsymbol is this

[placid kraken]

"slowmo"

[acoustic imp]

thank you 🙏

[solid warren]

I here can i download?

iMessage games right?

[indigo peak]

yeah

for jailbreaks you can get it on my repo

https://donato-fiore.github.io/repo

for trollstore/roothide you can get it from here:
https://github.com/donato-fiore/TrollStoreGameSeagull/releases/tag/v2.1

[radiant idol]

If you’re trying to use this as a respring icon, i would stay cautious because some people theme their SF Symbols and it may not match up

[acoustic imp]

i would ask how to do that but il figure it out

[hasty ruin]

No self promo

[radiant idol]

It’s in Bolders Reborn

[acoustic imp]

ok, thanks

[restive ether]

oh wow it’s coolCC again

[radiant idol]

Who even made the original

It’s like one of those tweaks that everyone knows but no one remembers who made

[[CoolCC]]

[faint lion]

CoolCC

This tweak makes ControlCenter cool!

Author

4nni3

Version

1:3.1

Price

Free

Repo

BigBoss

Bundle ID

com.4nni3.coolcc

Powered by Canister · Feb 20, 2024, 1:30 AM

[radiant idol]

Never heard of the guy

huh

[restive ether]

think he was just a one and done

[radiant idol]

Yeah

[hasty ruin]

Holy shit no he made something cursed

[indigo peak]

coolXX is his pride and joy i guess 😭

[acoustic imp]

can use what it has, give creddit ofc, and chnage it to how i want it?

[hasty ruin]

no just skid it

[acoustic imp]

ok

[restive ether]

this dude is legit

[restive ether]

me and that guy used to talk a lot is he still around

[hasty ruin]

The OG bolders guy?

[restive ether]

yes

[hasty ruin]

nah

[restive ether]

f

[hasty ruin]

don’t think so anyway

idk his name

but he didn’t update his tweak

so

[restive ether]

candizo i think

something like that

[hasty ruin]

💀

[restive ether]

[[bolders]]

[faint lion]

Bolders

Bigger bolder folders!

Author

candoizo

Version

1.2.2-2

Price

Free

Repo

candoizo's repo

Bundle ID

ca.ndoizo.bolders

Powered by Canister · Feb 20, 2024, 1:35 AM

[restive ether]

i was close

he’s canadian

i helped him do a lot of the testing for masq before it came out

good times

[indigo peak]

does anyone know any relatively simple xpc servers/daemons that are open source on github

[native dune]

I always forget you used to jailbreak

[restive ether]

yeah i had bad taste too

not as bad as some people but not the best either

definitely tacky by today’s standards at least

[hasty ruin]

if only someone would help nightwind test… his tweaks look like he’s never touched ios!!

[indigo peak]

i can only find libsandy, which is like good code but kinda complex

[hasty ruin]

(love you nightwind :)))

[restive ether]

what a noob

[hasty ruin]

fr

[placid kraken]

who is nightwind

[radiant idol]

Go ahead