development

[frosty gale]

console doesn't really give me an better info to go off of

[native orbit]

the 🟢 emoji in kfd would just kill it

[timid furnace]

ok logging after i run orig works

good enough

also i am slightly confused how the value of this pointer is 3

but ok

[native orbit]

they gave u RTLD_SELF fr

wait

that's negative

close enough

[timid furnace]

ok i don't get it

what is the type of the argument

if it is an object passed by reference

[orchid fulcrum]

by A LOT of sim card changing i managed to get 2fa code and icloud wipe worked !!! so happy right now thanks everyone @lean ermine @slim bramble @timid furnace

[naive kraken]

damn good to hear

screw the icon cache though :/

[orchid fulcrum]

yeah. do you know if it actually has to do with icons/themes or was it probably because i enabled tweak injection to system apps like preferences

also cant seem to have/install apple apps like maps/tips etc (all of them except photos settings phone imassage safari and camera)

[lean ermine]

glad to hear it

[naive kraken]

That's weird, when the device is wiped, nothing should persist

[sonic totem]

For 16GB RAM I’ve seen people need up to 400k

[slender glade]

Oh man you don’t know how much I laughed while writing the article

It was like edging

Explained some of the macho stuff in basic way

Then just used a private api because I felt funny

Look I was gonna write a parser for it with the dyld and macho APIs but I felt really lazy

🥹

[slim bramble]

Yes !!!!! I’m so happy that it worked !!!!

[orchid fulcrum]

I have this problem though. I cant jailbreak and most of the apple apps cant be installed

Spawning jbctl failed error 85

[orchid fulcrum]

Does the error mean anything for you ?

[slim bramble]

what happens when you click the apps to install them ?

[orchid fulcrum]

Unable to install please try later

[slim bramble]

you might want to try another restore from settings

idrk

Do you perhaps have trollstore

you can probably go to /var/ and check if a dir named jb is there

[orchid fulcrum]

That didnt work sadly

[orchid fulcrum]

Cant install as i dont have tips

[slim bramble]

you are not forced to use tips

[orchid fulcrum]

Is there a way to install to mesages or safari maybe ?

[slim bramble]

yes

[orchid fulcrum]

I really just have the most basic ones. Maybe i can try on safari

And use brave or something

[slim bramble]

This is very weird tho

[orchid fulcrum]

Seems to still be an iconcache issue to me. Look at watch apps icon for example

[slim bramble]

opa is probably your best bet to get that solved

[slim bramble]

also how did you install dopamine ?

[naive kraken]

that just means you need to enable dev mode

[slim bramble]

don't dopamine has to be installed with TS too ?

[orchid fulcrum]

Ahh true i forgot it got disabled

[orchid fulcrum]

I thought the ipa was meant to be sideloaded

[slim bramble]

Well dopamine has special entitlements

so that's why I'm unsure

[orchid fulcrum]

Like i mean there is a tipa and an ipa on releases. Not that they are too different but still he could have just uploaded one od them. I also remember the reddit release post said something like installing with trollstore is recommended (implies its not a must)

I just tried as i couldnt get trollstore anyway

[slim bramble]

That's why I'm unsure 🤷‍♂️

[naive kraken]

sideloading does work

[slim bramble]

oh there we got the answer

[naive sedge]

anyone know how to solve sem_open occasionally returning EEXIST despite calling sem_unlink right before?

[tepid olive]

Not yet

[naive sedge]

Is there a way to protect against kernel panics when kreading?

When I try and read the semobject is when it panics, do I need to strip PAC or something?

[faint timber]

get on with it we are waiting 🙏

[faint stag]

i mean, you're using a physical uaf exploit to read kernel memory
you can't eliminate panics but you can only improve reliability if possible

[naive sedge]

ah, the issue is stupid swift structs and it not lining up properly

ok, I got the task pointer

[naive sedge]

so wait, is T1SZ_BOOT 17 or 25 on m1?

and to strip the PAC from a pointer, I just need to do ptr & PTR_MASK right?

[native orbit]

ptrauth_strip

[sonic totem]

Run a kernelcache through https://github.com/opa334/XPF (it can be compressed and will still work) and it should hopefully find relevant offsets

If it doesn’t work with the macOS kernel you can use an M1 iPadOS kernelcache and the value should be the same

I think it’s 25 though

[orchid fulcrum]

just looking for an opinion. do you guys think iphone is usable without all the apple apps

and widgets*

[tepid olive]

you don't have access to the removable apps which is honestly fine

[orchid fulcrum]

These are the only ones left 😐

Better then updating i guess

[naive sedge]

I assumed that didn’t work for kernel pointers, and besides I’m in Swift

[indigo peak]

[hasty ruin]

send them this

[naive sedge]

so wait, does sem_close not properly close the file descriptor

I keep running into problems

like sem_open fails because it ran out of file descriptors

[faint stag]

well this is a reimplementation of kfd

[lean ermine]

you can uninstall app store w fs access

and settings if you want

and messages

and phone

and everything

[indigo peak]

he sent me some code and this was in it
sscanf([correctView cStringUsingEncoding:NSUTF8StringEncoding], "%p", &arg0);

[lean ermine]

lol

[hasty ruin]

.

[orchid fulcrum]

I am not trying to uninstall i want to normal install 😭😭

[lean ermine]

lol

[faint stag]

i mean maybe
you can test if the fd is still open

kfd just does this though

void kwrite_sem_open_deallocate(struct kfd* kfd, u64 id)
{
    /*
     * Skip the deallocation for the kread object because we are
     * responsible for deallocating all the shared file descriptors.
     */
    if (id != kfd->kread.krkw_object_id) {
        i32* fds = (i32*)(kfd->kwrite.krkw_method_data);
        assert_bsd(close(fds[id]));
    }
}```

(no, there's no kread_sem_open_deallocate because kfd uses this function for it. that function is defined in kread but it just returns)

[native dune]

wtf where did everything go

uicache -af if jailbroken maybe

[orchid fulcrum]

.

[native dune]

whats the issue with jailbreaking

[orchid fulcrum]

Will try. This is for rebuilding iconcache right. I tried that from trollstore

[naive kraken]

what happens if you delete tips and try to reinstall it from app store

[native dune]

trollstore uicache probably should've fixed it

[naive kraken]

your best bet is to check syslog

[orchid fulcrum]

Doesn't work

[naive kraken]

^

[native dune]

how did you even get to this point what happened

[orchid fulcrum]

That is outdated i can jb now

[native dune]

o

[orchid fulcrum]

I will thanks

[tepid olive]

relevant: #jailbreak message

[orchid fulcrum]

Well thats me too 😄

[native dune]

o

[timid furnace]

also humor me

ls -lsa /var/tmp/```

once you can get to a shell

[slim bramble]

Bro got a respring loop from dopamine

after removign his pin code on sim he got the phone to an icloud reset

after setting it back up he was left with this

[naive sedge]

Uhh

So

Somehow I seem to have permanently borked my file descriptor limit

On macOS

[orchid fulcrum]

Bootloop. Wish it was respring 😩

Not really from dopamine tho

[naive kraken]

it was a respring loop that persisted even when the jailbreak was not active

due to icon cache corruption

[orchid fulcrum]

Isn't respring loop something that looks like a respring ?

[naive kraken]

that's also why the remote wipe works

[native dune]

How do you even trigger that

[naive kraken]

because anything not SpringBoard is still running

[native dune]

Yes but if springboard can’t start it’ll be stuck at the Apple logo

[orchid fulcrum]

Ahh

[naive kraken]

idk, there are multiple ways to corrupt the icon cache that the system cannot recover from on it's own

because apple wrote shit code

icon cache is horrendous

it's a miracle it even works at all

[turbid fjord]

same can be said for anything apple makes especially with SwiftUI

[faint stag]

lol i forgot macOS has launchconstraints too

only launchd can execute it
w

[hasty ruin]

capt on his way to promote his rootkit

[faint stag]

this was eraseassistant
i think i was able to launch it fine from a terminal in ventura but not sonoma

[torn cloud]

dumb question: if i rewrite Fugu14 do i have to give credit to Linus Henze in every file

or is that not neccesary

alright

yeah i'm planning on doing that

MIT i think

[restive ether]

MIT probably

[young meteor]

yeah it is MIT

https://github.com/LinusHenze/Fugu14/blob/master/LICENSE

[torn cloud]

yh

anyway i'm gonna disappear

wish me luck

[tepid olive]

does anyone know what versions are affected by this? seems some people have luck with 16 and others don't, i know 17 just completely broke. https://github.com/verygenericname/SSHRD_Script/issues/271

[faint stag]

maybe the best thing to try is to see if you can verbose boot

eg, run palera1n

[timid furnace]

there was some issue where if you mismatch ramdisk and installed OS version and try to mount you'll break your install

i forgot the details

[faint stag]

is that a cryptex moment

[timid furnace]

but it is recoverable through restore obviously

[timid furnace]

no apfs

[tepid olive]

yeah restore did fix it

it would just trigger some sep panic and refuse to boot properly

[faint stag]

ok that makes sense tho

[timid furnace]

iirc 16.4+

[faint stag]

since you have to init sep to mount /var

man

[tepid olive]

it was some 15 ramdisk on 17.2 following seprmvr64

[timid furnace]

yea that was probably the cause

[tepid olive]

i should do it again with a 17.2 ramdisk

nah i wanna try to stay on 17.2 but it's an honest shame i cant use sshrd

what tool do people use to tethered boot 17.2 because blobs are useless to restore to same fw apparently

[tepid olive]

also i have questions
how would you jailbreak a 17.2 tethered boot, does palera1n work? and also would sshrd still theoretically function properly with something like dualbooting

ig wrong channel but not something everyone would know at the top of their head

[faint stag]

palera1n wouldn't work unless you had a build of it that would chain it with the tethered boot

[tepid olive]

oh so im screwed nice

[faint stag]

sshrd would still work
but the mount script would mount the wrong partitions

you'd have to adjust for the one you want

[torn cloud]

for re-writing a kernel exploit, is it better to rewrite into C or obj-c?

or is it down to personal preference

[faint stag]

i mean it could be whatever you want but obj-c may be easier to integrate if you're already using it in the project

[torn cloud]

yeah i'm planning to use obj-c for the exploits

no offense to LH but what bright idea immeraged in his head to make a untethered iOS 14 jailbreak IN SWIFT

it's the worst language to write anything apart from a UI in

another thing is i don't have a test device, so i'll have to use Xcode (if that even works?)

[sonic totem]

If you’re (re)writing an exploit without a test device you will run into issues pretty quickly

[steady nest]

(personal opinion)
fugu14 was great at the time, but its exploits (maybe apart from the kernel exploit) have been overshadowed by newer releases and would be much easier to implement

• kfd works on 14.x while fugu's driverkit bug only up to 14.5.1
• dmaFail is a pretty easy and effective PPL bypass that doesn't require a PAC bypass
• fastpathsign as a coretrust bypass
  

[acoustic imp]

#update_fugu

Also fun fact, did you know that after a userspace reboot if spring board hangs, and is killed, instead of showing the loading thing it shows the apple logo

[elder scaffold]

PAC bypass:

[topaz yew]

@frosty gale hey im here too incase you dont wanna talk over twitter

you can add me if u wanna

[frosty gale]

Bet

I’ll pm you

[sonic totem]

But Fugu14 DriverKit bug has 100% reliability

[steady nest]

but its exploits (maybe apart from the kernel exploit) have been overshadowed

[sonic totem]

[steady nest]

[sonic totem]

If you can get kfd to 95%+ reliability and you implemented a custom launchd you could have a REAL untether

Even realer than vanilla Fugu14

[sonic totem]

This would be a 14.x untether too

Fugu14++

[torn cloud]

will xcode work?

[steady nest]

the simulator?

[torn cloud]

yes

[steady nest]

no, it's not a real device

[torn cloud]

damn

[sonic totem]

The simulator is just your macOS kernel at the end of the day

[visual meadow]

that moment when open exploit app in simulator and mac restarts

[lean ermine]

100x easier to implement fsuntether

and only twice as long boot times!

[torn cloud]

got to hunt on eBay then i guess

[tough shadow]

why am i getting this error

[steady nest]

no

100x easier launchd haxx

[steady nest]

what part of it isn't clear for you

[tough shadow]

Am trying to install ldid

[torn cloud]

would kfd even work with fugu14 though

[steady nest]

kfd works on 14.x

[torn cloud]

no, i mean since fugu14 uses its own untethered kernel exploit

[steady nest]

https://github.com/TheRealClarity/haxx you can use this for installd haxx

[tough shadow]

how?

[torn cloud]

epic

[tough shadow]

compile it

[steady nest]

you can use 15.4.1's coretrust haxx from fugu15 (weaponized and linked above) + dmaFAIL as a PPL bypass + fugu15 installd bug and you won't require fugu's amazing but complicated shenanigans

[tough shadow]

yes

[torn cloud]

alright i'll look into it

thanks

[tough shadow]

14.0

[torn cloud]

since i don't want to deal with ios-install.py smh

[steady nest]

what's your target by the way

writing a jailbreak?

[tough shadow]

what do i do here? @grave sparrow

[torn cloud]

i'm looking to finish fugu14 and make it an actual full untethered jailbreak

[lean ermine]

i believe u :3

[steady nest]

i see

[lean ermine]

make it happen pls!

[torn cloud]

yeah

[steady nest]

fugu15's coretrust and installd bug + launchd haxx + kfd might be more feasible

[torn cloud]

that would be iOS 14-14.8.1 only correct?

[steady nest]

also adapting dopamine v2 to 14, although I have no idea how much work that'd be

[tough shadow]

?

[steady nest]

@naive kraken thoughts? I know 14.6? and above would need an oldabi solution (not sure if you implemented one already on d2.0)

[torn cloud]

yeah i'm not gonna be able to do that

[sonic totem]

Wait until you find out that Fugu15 uses the same method

[torn cloud]

that's... what i'm talking about?

[sonic totem]

typo

I meant Fugu15

[torn cloud]

what the hell? fugu15 uses that as well

my god

[tough shadow]

yea

[sonic totem]

Yes

They didn't patch it

[indigo peak]

bro accidentally leaked Fugu17

[sonic totem]

Well the improperly patched it

[torn cloud]

yeah i'm gonna try tinkering with clarity's launchd haxx

[sonic totem]

rm -rf /Users/alfie/Fugu17

[tough shadow]

what do i do now?

[tough shadow]

rm -f /Users.alfie/Fugu17/Fugu17.xcodeproject

[sonic totem]

I mean it doesn't matter anyways because you can just install it through TrollStore

[sonic totem]

.xcodeproj*

[tough shadow]

sorry forgot

[limpid pumice]

huh

[limpid pumice]

oh

i see

[lean ermine]

u can install launchd throught trollstore

wtf

[sonic totem]

Change it!

[limpid pumice]

There

[radiant idol]

capital*

[torn cloud]

yeah, but would completely rewriting fugu14 be more feasible or dmaFail + coretrust + launchd stuff work better/be more reliable

[sonic totem]

No I mean the ios-install.sh script is useless because you can just install Fugu14 via TrollStore

[lean ermine]

oh

[limpid pumice]

how to make crypto miner in objc?

[tough shadow]

@grave sparrow

[lean ermine]

i feel as though the biggest hurdle would be 100% kfd reliability

[torn cloud]

where's the .ipa though

[tepid olive]

Wen eta Sora dev role

[torn cloud]

when you make a untethered jailbreak iso 17

[limpid pumice]

W thanks. new addition to iota : )

(im kidding)

[sonic totem]

Most reliable you'd get is

• Install via TrollStore to get unsandboxing perms / use DriverKit bug if necessary
• Use dmaFail (also 100% reliable) for PPL bypass
• Replace launchd with fastPathSign-ed launchd shim
• Make launchd re-exploit on boot, get PPLRW and then profit from there on

[radiant idol]

i hate CGPoint

[indigo peak]

is that OOP

[sonic totem]

Had to add that just in case

[lean ermine]

and please implement hold volume up to boot normally or boot safe mode

lol

[radiant idol]

definitely

[tough shadow]

will 15.6.1 have a ppl and pac bypass btw?

[sonic totem]

It has a PPL bypass

[indigo peak]

guys do NOT download iota, @limpid pumice is adding bitcoin miner

[tepid olive]

If I send my almost finished jailbreak from before dopamine 2 was released do I get dev role

[limpid pumice]

oh 100%. someone would have taken it out of context

[limpid pumice]

I KNEW IT

[tepid olive]

It also has PAC bypass vulnerability

[tough shadow]

but how does fugu15 not support 15.6.1?

[tepid olive]

There's a CVE for it

[sonic totem]

No... and to think I even beta test it

[indigo peak]

i was gonna send it in ioter but with the r's in there i didnt wanna risk it

[young meteor]

the fugu15 ppl bypass is only up to 15.4.1

[sonic totem]

There's been a couple but no one has released a full bypass

[lean ermine]

ppl fugu15 is not the ppl that 15.6 has

[blazing warren]

if it is implemented

[lean ermine]

dmafail would have to be adapted to fugu15 for 15.6 to support

[sonic totem]

Because the Fugu15 chain doesn't support iOS 15.6.1

[tepid olive]

True

[limpid pumice]

https://tenor.com/view/tense-table-smash-mad-gif-13656077

[lean ermine]

true

[limpid pumice]

true

[indigo peak]

average fioreware™️

[torn cloud]

that's not easier than it sounds...

typo

[sonic totem]

Yeah I know

But still

That's what you'd want

[lean ermine]

u got it

[torn cloud]

yeah

welp

[lean ermine]

i'll give u five bucks if u do it

[tough shadow]

huh?

[torn cloud]

read

[tough shadow]

What am i supposed to do?

[torn cloud]

...

[limpid pumice]

i wonder

[torn cloud]

cstdio is not a valid header file

wdym

[sonic totem]

Works on my machine

[tough shadow]

imagine replaceing the fugu15 ppl bypass to the ppl bypass in 15.6.1

[torn cloud]

it's better tbf

doesn't need a PAC bypass either

[torn cloud]

because of Kaspersky haxx

[sonic totem]

Yes, that's what Dopamine 2.0 does

[sonic totem]

Because of nation state haxx**

[tough shadow]

What tool does dopamine use in 15x to jailbreak

[torn cloud]

also fugu14 only supports up to 14.2 - 14.5.1 which is annoying

[sonic totem]

Wdym 'tool'?

[torn cloud]

why does it not support 14.0 - 14.1.1 smh

[lean ermine]

he means exploit

[sonic totem]

It uses kfd and dmaFail

[lean ermine]

isnt it all dmafail now

[sonic totem]

Kernel exploit didn't work iirc

[tough shadow]

Thats it am downloading fugu15 and replacing the ppl bypasses

[sonic totem]

But.. why

[lean ermine]

yes because all you have to do is replace it

it will just be drag and drop

[tough shadow]

I want to make it support 15.6.1

[lean ermine]

probably rootful obsession

[tough shadow]

no its going to be rootless

[sonic totem]

Dopamine supports 15.6.1

[lean ermine]

use dopamine...

fugu15 with dmafail is just dopamine without code to bootstrap

lol

[sonic totem]

It does bootstrap but is missing some key features

[tough shadow]

dmafail supports 15.6.1?

[sonic totem]

But it technically installs Sileo

[lean ermine]

interesting

[sonic totem]

Yes, Dopamine supports 15.0-16.5.1

[lean ermine]

lol

[tough shadow]

Also its going to be rootless

[lean ermine]

anterograde annesia

[tough shadow]

am really bored so why not

[sonic totem]

Are you... making a jailbreak?

Because Fugu15 on its own will not give you a jailbreak

[lean ermine]

preaching to the choir

[tough shadow]

what is FuFuGuGu

[tepid olive]

Wen eta sora dev https://github.com/jonahnm/Telescope

And @topaz yew

[sonic totem]

You’ll have to figure that out

[tepid olive]

(Jailbreak that was being worked on before dopamine 2 released)

[brazen timber]

bros branch name is meow

https://tenor.com/view/skull-gif-23663947

[tepid olive]

[hasty ruin]

https://tenor.com/view/urmom-gif-23293768

[brazen timber]

fr

[tepid olive]

Well it’s because it’s based off of meow16

[tough shadow]

I see its a package

[topaz yew]

so real

[sonic totem]

Okay

But look at the code

[native orbit]

any1 know how to login to older xcode versions? (like 6-8)

[tough shadow]

shit_map

[naive sedge]

so wait, the entire reason I would need to implement dynamic patchfinding, assuming I just wanted to swap vnodes, is for proc_object_size?? (to go from kernel task to kernel proc)

is there anything else necessary?

and we just need to find the start of any proc, since they're all linked together?

[tough shadow]

libass

[naive sedge]

what makes proc_object_size change?

[elder scaffold]

me

[primal perch]

💯

[naive sedge]

wait

so for the kernel proc

does it point to itself?

like the next proc pointer

wait a sec

yes here we go

so the kernel, uniquely

will have a null next pointer

and a signed parent pointer pointing to itself

so if we search for pointers pointing to 16 bytes before themselves

...are pointers guaranteed to be aligned in the proc struct?

I think it works!

[tough shadow]

what is wrong with my ipod

[naive sedge]

if anyone is curious

func findKernelProc(kread: KReadPrimitive, ktask: UInt64) -> UInt64 {
    // Search backwards until we find a signed pointer which points to 2 UInt64s before itself
    var addr = ktask
    while addr > ktask - 0x1000 {
        addr -= 8
        let val = kread.kread64(addr: addr)
        // is a signed pointer
        if val < PTR_MASK || val > PAC_MASK {
            continue
        }
        let ptr = unsignPAC(val)
        //print("Found potential kernel_proc: \(hex(addr))")
        if ptr == addr - 16 {
            print("Found likely kernel_proc: \(hex(ptr))")
            let pid = kread.kread32(addr: ptr.advanced(by: 0x60)) // sanity check
            if pid == 0 {
                print("Found kernel_proc: \(hex(ptr))")
                return ptr
            }
        }
    }
    return 0
}

[tough shadow]

Any script to trigger kernal panic

[naive sedge]

?

kernel panicking is easy? I literally have to try and prevent it from panicking

[tough shadow]

what does this do?

[naive sedge]

I'm rewriting libkfd in pure swift

and trying not to require patchfinding since that would be annoying

[tough shadow]

what could this do btw?

[naive sedge]

uh, ideally whatever libkfd can do? install trollstore is probably the easiest

[tough shadow]

For what verisons?

[naive sedge]

iOS 16ish

[tough shadow]

dont they already have one

[tepid olive]

Who do I ping to ask lol

[tough shadow]

idk

[tepid olive]

Eh I'll just wait until I make a tweak

[wooden yarrow]

wtf using masks as a actual value for comparison

i mean i guess it works

but really should be a AND + nonnull check

tr

[granite frigate]

Uh just ask a mod

Waittt no way its out

lfg

🙏

[tepid olive]

No it isn’t

I just released source as is

[granite frigate]

I mean isn’t that

out

😭

[tepid olive]

Sort of?

[radiant idol]

how far did you get it working

can you bootstrap

[tepid olive]

Not really lol

I mean sorta but not really

[radiant idol]

I see

[thin valley]

🎁 I bought you a copy of OneSettings! https://chariz.gift/onesettings/4HDTKDRPGG94XTYWYACT

[naive sedge]

hey what makes usecount on a vnode go up

my problem is that my write primitive doesn't work if usecount is 0

so how can I organically make it go up

[tepid olive]

Danke

[placid kraken]

@indigo peak

ive had something a bit personal to deal with lately

but i had a little bit of time before i did what i did, this has been a thing for a while i just forgot to commit it

so i got libsandy to work

[indigo peak]

W

[frail cedar]

reposting from #general because i realized it makes more sense here but

Given that the coretrust bugs allow us to resign any system process, could we not just modify a process of your choice with a tweak directly?

like just inject Spectrum into the SpringBoard binary, CT resign it, swap it in the rootfs (can't have SSV) and have spectrum all the time

or are there limitations I'm not seeing

preferenceloader wouldn't work i think (unless you modify the Preferences bin..?) and process that require no sandbox would also not work

but for some stuff it would work i think?

idk

im not sure if there's a way to just merge a dylib and a compiled binary

just ideas i had

[lean ermine]

reinstall settings app with preferenceloader dylib, problem solved

[lean ermine]

outside of springboard this is how roothides bootstrap achieves system app injection for everything else

[frail cedar]

that's what im currently working on except my macbook decided to enter eternal sleep

so i had to unplug and replug the battery

[lean ermine]

roothides bootstrap backs up system ipas you inject to and signs them then installs them

[frail cedar]

interesting

what does it use to inject?

[naive sedge]

so, does anyone have any ideas on how to debug the simulator freezing when I try and redirect folders by tampering with vnodes

[lean ermine]

no idea

i think technically ellekit

[granite frigate]

can’t swap it in the rootfs because launchd will kill it if it’s not a platform binary

[frail cedar]

platform-application?

[granite frigate]

no

CS_PLATFORMISED csflag

[lean ermine]

but you can replace launchd in memory to launch a custom springboard

someone should implement that!

[granite frigate]

would be like a fake jailbreak

[lean ermine]

yeah true no point

[granite frigate]

🤔

[frail cedar]

springboard specifically is off limits but other apps are fine?

[lean ermine]

failbreak

[naive sedge]

like if I change vnode_v_data suddently all attempts to access that file just cause the process to get stuck

[frail cedar]

is this why SB injection wasnt possible with CT2

[granite frigate]

i mean for user apps roothide does this…

[frail cedar]

initially

[granite frigate]

for system apps no

[frail cedar]

what's wrong with system apps - same problem?

[granite frigate]

yes

[lean ermine]

kfd is what allows you to replace launchd, but ct2 lets you sign replaced launchd and everything else to run it

[frail cedar]

that or boot an ssh ramdisk

and swap it

not sure

if that would work

[granite frigate]

kfd works in the simulator?

[frail cedar]

i was bored at work and thinking

[naive sedge]

yeah, uses the macos kernel

[granite frigate]

wow

[lean ermine]

lol

[naive sedge]

maybe it's getting confused because of that I'll try real device

[granite frigate]

what macOS version does landa work until

[frail cedar]

are there any checks on launchd's status as a binary? could you create your own, swap it with an sshrd, and then just use custom launchd?

[granite frigate]

um

have you heard of serotonin

[lean ermine]

lmao

[granite frigate]

[frail cedar]

i know Nothing about how it works

i know it exists

[granite frigate]

yeah

so

[frail cedar]

but i have no reason to use it

[granite frigate]

it does what you describe

[lean ermine]

it works by

[frail cedar]

does it replace the actual binary though

[lean ermine]

yes

in memory

[granite frigate]

no silly

[lean ermine]

SHIT!

[frail cedar]

yeah not in memory

the file on disk

[lean ermine]

no

[granite frigate]

no

[frail cedar]

thats what i mean

[lean ermine]

that would break sep

[frail cedar]

could you do that

[granite frigate]

that would just be haxx

[granite frigate]

what

[frail cedar]

What

[lean ermine]

SORRY

SAID SOMTHING STUPID!

[frail cedar]

ssv?

what if you're on ios 14

[lean ermine]

ye

[granite frigate]

haxx from nick chan does this

[frail cedar]

doesnt it swap analyticsd though

[primal perch]

gex

[granite frigate]

you can swap launchd

[primal perch]

https://tenor.com/view/gex-money-winking-gex-enter-the-gecko-ps1-gif-24648318

[granite frigate]

alfie did this

[primal perch]

@hasty ruin

[frail cedar]

no development for me ik

macbook said no

[granite frigate]

https://alfiecg.uk/2023/02/25/Getting-untethered-code-execution-on-iOS-14.8.html

ssh ramdisk to swap it

exactly like you said

you /could/ have it load taurine on boot, iirc someone tried this but failed somewhere bc taurine didn’t like it when launchd was not real

[frail cedar]

i need to get a ct2 cert

my sign.p12 is still ct1

[lean ermine]

is that a thing lol

[frail cedar]

its just what i named the p12 i pulled from TS

[lean ermine]

need

[frail cedar]

oh it seems that the new bug doesn't use a p12

guess ill stick with my ct1 p12 since it works on 15.4.1 anyway

[granite frigate]

build choma and run ct_bypass

[frail cedar]

i dont have a working mac rn

my macbook wont boot

[granite frigate]

[frail cedar]

my iphone enabled sleep mode

[lean ermine]

wut happen

[frail cedar]

via a magnet in the case

and it wont leave

[lean ermine]

lol

hold power longer

[frail cedar]

i tried unplugging battery

nothing

[frail cedar]

i held it for 2 minutes

[granite frigate]

sounds fucked

[lean ermine]

is it intel

[frail cedar]

im hoping it's just dead

battery is old af

[lean ermine]

must be intel

[frail cedar]

15" mid 2012

[lean ermine]

w magnet lid

yea

time to upgrade anyways

[frail cedar]

hoping i get enough money at graduation to get an m2 mbp

dream config is 16" 16/1tb but i probably wont be able to afford that

[lean ermine]

if u dont wanna wait u can get m1 air for like 500 if ur crafty

[frail cedar]

i dont want an m1 air for 500

[lean ermine]

lol

my m1 air is my lil buddy

i lov him

[granite frigate]

i wish my m1 air had more ram and storage

[lean ermine]

same but i dont care too much

i havent had an issue w 256

[frail cedar]

I hate ldid with a passion

[lean ermine]

and the ram issue is overblown imo

ppl will get so mad if u say 8gb is fine on m1

but it really is lol

[frail cedar]

its fine unless you use xcode

[granite frigate]

i do get mad

trying to run 3 xcode simulators at once is...

[lean ermine]

i use xcode frequently

[frail cedar]

if you use xcode it's not ok

especially with sims

[granite frigate]

i once used 16gb swap

[lean ermine]

but i dont use sim

[frail cedar]

with 8gb i always hit pagefile

always

[lean ermine]

i never use sim lol

[lean ermine]

this is wild

[frail cedar]

see I have to

[lean ermine]

whats ur tbw

[frail cedar]

i cant just

[lean ermine]

have u checked

[granite frigate]

tbw?

[frail cedar]

pop an apple tv on the table next to me

[lean ermine]

terabyte written

[frail cedar]

tera bytes written

[granite frigate]

dunno

[lean ermine]

expected ssd life for m1 is around 150 tbw

[granite frigate]

when the ssd dies i have a reason to buy a m1 pro

[lean ermine]

it wont die

[granite frigate]

bummer

[frail cedar]

swap preferences binary
it crashes
go to check crashlogs
crashlogs are in settings
settings crashes

oh i forgot to give my new binary execute perms i am stupid

[lean ermine]

do this

im curious what urs is

im at 7 tbw but im not a power user

[granite frigate]

that website looks interesting

[lean ermine]

lol

[granite frigate]

💀

[lean ermine]

the gist is just install smartmontools

i couldnt remember the name

lmao

new screenshot cos i doxxed myself in that other one

[lean ermine]

not that bad

[granite frigate]

i've only had it for a year

well, not even a year

10 months

[lean ermine]

person before u mightve done more than you

[naive sedge]

afaict it actually works on iOS!

[granite frigate]

it's brand new

[lean ermine]

fr

nvm then

lol

[naive sedge]

so maybe it was broken on macOS because it's different offsets

[lean ermine]

thats pretty heavy usage but it still won't fail

150 tbw is a low estimate

[granite frigate]

offset issue likely

[lean ermine]

yours most likely wont actually fail until like 250 at least

[granite frigate]

what are you trying to swap

[naive sedge]

vnodes

[granite frigate]

uh like what folders

[lean ermine]

and you can do ssd upgrade for like 200 if you want from someone like dos dude

[naive sedge]

oh, a temp folder and the folder to put trollstore in

[granite frigate]

ah

[frail cedar]

my iphone is confused

"monday february 21"

[granite frigate]

TS installer in swift playgrounds?

[naive sedge]

yea

[granite frigate]

👀

[lean ermine]

interesting

lol

[naive sedge]

I'm trying to make it universal and not require offsets that change

for example my kproc trick

[granite frigate]

now I want to try making one, but I don't have any devices supporting playgrounds

[lean ermine]

does playgrounds have a sim?

ive never used it

[granite frigate]

are you using a kpf for landa?

that's cool

[naive sedge]

yeah I rewrote all of libkfd in pure swift

and by pure I mean pure

[lean ermine]

pure.. kfd

[frail cedar]

yippee

[naive sedge]

I mean pure as in I don't even have an objc compiler

[frail cedar]

posix error 85 after trying to swap bin ary

[naive sedge]

so can't cheat and use a bridging header

[frail cedar]

bootstrapping failed it says

oh well i will go to bed

[granite frigate]

damn that sucks

i can't just have a button in swift that runs my objc stuff

[naive sedge]

welllll

you can just use this

and exploit it

and have it install your objc code

😛

[granite frigate]

yeah True

[faint stag]

it is not
what kind of MacBook pro in 2024 has 8gb of memory shared with graphics

[lean ermine]

i have a 2020 m1 air

8gb is fine on that

2024 pro should probably not have 8 tho!

[faint stag]

what if i told you

[lean ermine]

i know it does

but on my 2020 m1 air its not an issue

lol

[faint stag]

never launched xcode once but I'll quickly have issues once i open enough stuff
i have a 2020 m1 pro and I'm still confused to why it exists

like, the only important difference is the battery compared to an air lmao

[lean ermine]

lol

if you put thermal paste on the cpu casing on m1 air it gets practically the same performance as the m1 pro

ive got some thermal paste leftover for a rainy day in case i ever wanna do it lol

[granite frigate]

no amount of performance can give you more ram

[lean ermine]

tru

[faint stag]

and swap can't solve all your issues

[naive sedge]

and I have no clue why, but I noticed the exploit works a lot better when running in the "App Preview" mini window then when launch in a new Swift Playgrounds window

like it has trouble spraying the pages when in a new window... more kernel ram usage? idk

anyway it can list directories now, just a few more things to actually write the TrollStore app

[faint stag]

what do we name this install method
trollgrounds?
seems too easy

[granite frigate]

are you going to use trollstar's method?

[naive sedge]

yep

[granite frigate]

sweet

🔥

[naive sedge]

all kfd vnode modifications are reset on reboot, right?

[granite frigate]

yes

well, most

do not fuck with mobilegestalt

i bootlooped with that before

[tepid olive]

the silly

[primal perch]

macbook “pro”

point and laugh at the people that bought that

[ashen birch]

fr

pro series M SoCs on top

[primal perch]

💯

my m1 base with 16gb ram is more pro than that machine can ever be with 8

[ashen birch]

i swear my m1 pro mbp gets more use as a mac mini than an actual macbook now

lmao

[primal perch]

mines a glorified chromebook for school

i just larp about needing 16 on the go but realistically would never notice a difference with chrome and google docs

maybe with xcode once in a while

[slender glade]

@granite frigate NEW PFP… WHAT THE FUCK!

What’s up #jailbreaknation

[granite frigate]

bruh like 3 people told me that

😭

[slender glade]

YEAH CAUSE UR NOT SUPPOSED TO CHANGE YOURS

[granite frigate]

😭

[slender glade]

Do you guys have any ideas of things to make

[granite frigate]

i was gonna ask

im a very idealess person 💀

[slender glade]

SAME

I’m just an implementation person

[granite frigate]

thats cap for you tho

[slender glade]

Lmfao what’d you do

[granite frigate]

you're working on somethign like alwwawys

[slender glade]

Nah 😭

[granite frigate]

deviceSubtype set to ipad

so it tried to load ipad frameworks or something

[slender glade]

I haven’t really worked on anything in the past like few weeks

[granite frigate]

anyway no apps loaded so I tried to reboot

[slender glade]

wtf

[granite frigate]

the end

[slender glade]

💔💔

[granite frigate]

😭

[slender glade]

@granite frigate hop on persona

[granite frigate]

😳

[slender glade]

HOP ON

[granite frigate]

i cant find my switch

💀

fire

[slender glade]

💔

[sonic totem]

try deleting SystemVersion.plist

[sonic totem]

Aren’t kfd overwrites persistent on /var?

[granite frigate]

uh

I forgot

but idts

[sonic totem]

They 100% are because otherwise TrollStore installation wouldn’t work

[granite frigate]

if you reboot, the kfd overwritten tips app stays as TrollStore?

[sonic totem]

Yes

[granite frigate]

it didn't for me

[sonic totem]

[granite frigate]

dunno

[sonic totem]

Maybe it’s inconsistent

Wasn’t there a difference when you force rebooted vs regular shut down

[granite frigate]

Not sure

[sonic totem]

The way TrollStore installer works is overwrite Tips with kfd -> reboot to get rid of cached code signature -> open on fresh reboot

But I’ve seen some people say it works without rebooting

So I think it’s dependent on whether the signature has been cached

[granite frigate]

I've tried like dozens of times and kfd installation via TrollStar never worked

Dunno

[sonic totem]

Took me like 10 attempts

But the one that worked was:

• Shut down
• Power on
• Leave idle for 5 minutes
• Unlock
• Leave idle for 2 minutes
• kopen

[lime pivot]

https://fxtwitter.com/sebjvidal/status/1760954194133995685

someone discovered OnBoardingKit lol

[graceful gate]

Took them long enough

[sour pumice]

https://www.reddit.com/r/TweakBounty/comments/1axys6j/20161_change_notification_location_on/

[brazen timber]

@primal perch https://vxtwitter.com/NotNite/status/1760878056766333044

[granite frigate]

chat i have to learn angular and host a workshop on it within a month

is this doable

[torn cloud]

if you don't take any showers, yes

[granite frigate]

i'm assuming I'll just be teaching the basic stuff up till making a todo

because idk otherwise

💀

[brazen timber]

why angular of all frameworks

[granite frigate]

because it's a google student club

and the options were node express or angular

[brazen timber]

skull

[naive sedge]

So, I wrote the trollstore helper over Weather app using playgrounds, but it doesn’t launch

Is that because I don’t respring?

[granite frigate]

cached code signature

try that method I guess

[faint stag]

doesn't hurt to do so

[naive sedge]

Ok will try and respring

[placid kraken]

which part

okay i can finally push the flora update that sat in my local git for the past few days

[placid kraken]

https://github.com/acquitelol/flora/releases/tag/1.0.1-dev can anyone on ios 14/15 test this, especially on ipad? (and show me what the preference pages look like if possible?)

it works on my own device but i havent had the chance to test on any others

[slim bramble]

Shouldn't I be able to read the apticket ? (A14, 14.6)

[fathom snow]

person on r/unixporn made a intel/arm macos tweak injector https://github.com/CoreBedtime/ammonia

is quite funky

use at own risk

[granite frigate]

@topaz yew nice injector

[fathom snow]

Schweet

They are a huge nerd

[granite frigate]

😭

why

[sonic totem]

@naive sedge I replied in HD but the only way to remove cached signature is to reboot

[restive ether]

@grave sparrow it’s over for you buddy

[kind herald]

interesting

[topaz yew]

thanks it could be better

[young meteor]

seems to work

[placid kraken]

does exporting and importing work

try exporting, clearing prefs, and importing

[young meteor]

app icons will untheme themselves for a second when closing the app

[young meteor]

it does

[placid kraken]

thats a tint color, im not sure which color actually influences that

it seems this sf symbol does not exist on older ios

what ios are you on?

[young meteor]

15.1

[primal perch]

chad

[placid kraken]

ok ty

wait does it work in other apps too

i know ipad doesnt have a calculator

wait nvm

that video shows notes thats fine

[young meteor]

huh

theres the crash log

[hasty ruin]

you just got your details logged

[young meteor]

but i already installed jade

[slim bramble]

https://media.discordapp.net/attachments/688122301975363591/1077671431875346494/caption.gif

[torn cloud]

@grave sparrow what's the point of bragging that i made a macOS tweak injector

if you're not gonna make it public

[hasty ruin]

trollery

[frosty gale]

Cinema

[torn cloud]

have you consumed your daily intake of 20 digestives with 5 pints of PG tips yet iCraze?

[faint stag]

ran out of memory
i think some recursion is occurring
it's literally the same thing over and over lmao

wtf

[hasty ruin]

sadly not

[placid kraken]

i hate github markdown oh my god

in my local preview, the table of screenshots looks great

[faint stag]

why

[placid kraken]

meanwhile github

skulley~1

[faint stag]

that looks

fine

what's wrong with it

[placid kraken]

the different sizes really annoys me

wouldve been better if it was scrollable like the preview

[faint stag]

oh

are all the images the same res

[placid kraken]

yes

same res, same width

github just decides to do that though

because its github

[faint stag]

you could just be funny

and do inline styling

[placid kraken]

i already do

[torn cloud]

absolutely disgusting behaviour

more of a reason why you should add me on snap

and send me toe pics

[sonic totem]

Don’t make that mistake

[faint stag]

then ig you just have to adjust width accordingly

[sonic totem]

Trust me.

[torn cloud]

why

reason

[sonic totem]

You don’t wanna know

[faint stag]

or just make your own table

[torn cloud]

i do wanna know

[torn cloud]

tell me

what did he send you

[faint stag]

wtf

[torn cloud]

joking

i never said that

[placid kraken]

thats how i made them horizontally scroll in the preview, theyre all the same width already

[granite frigate]

/snipe

[torn cloud]

how much

name your price

wtf

[faint stag]

why is every div overflowing
if it's one table

[placid kraken]

tbh idk

[young meteor]

how many corvettes would you get

[torn cloud]

it's not that valuable

L capt

i did not expect this from you

[topaz yew]

zefram malware

[torn cloud]

deeply dissapointed

[torn cloud]

fr

anyway time to work on a ios 14 untethered jailbreak

(when i get a test device)

[young meteor]

wen eta rootless ios 14 jb

that'd be funny

[torn cloud]

what would be the point

[torn cloud]

@sonic totem WHAT THE FUCK

EXPLAIN THYSELF IMMEDIATLY

[young meteor]

sillyness

someone made one for ios 12

[torn cloud]

oh yeah

[slim bramble]

ooc

icraze slow today

[young meteor]

misinformation

[slim bramble]

No ?

[faint stag]

and if you're going to use width on the parents of the images, you might as well just fit-content?
or use max-width on the img itself

[torn cloud]

correct information you mean

[placid kraken]

github markdown is very sanitized i dont think you can use fit content

[slim bramble]

yes

always

[torn cloud]

fr

[faint stag]

well the preview option is there ig

max width should work tho

[placid kraken]

the issue is that it wont become scrollable horizontally

[faint stag]

the table should scroll then if it's too wide

[placid kraken]

yeah thats what the overflow-x is for

but instead of scrolling it squishes the children

[faint stag]

that should be applied to the table itself then

not the table items

[placid kraken]

its applied on the container of the table

[torn cloud]

@slim bramble have you done with 16player DRM or is eta still son?

[placid kraken]

the table items dont have that anymore

[slim bramble]

I have fixed the main issues on the drm

now I just have to do the server

[torn cloud]

dumb question: what does the drm even do?

[placid kraken]

oh yeah i applied for a seller account on havoc to put flora on there for free

[slim bramble]

Check that you didn't pirated

[sonic totem]

I’ve explained multiple times

I sent eggplant instead of thumbs up by accident

[slim bramble]

It's ooc

[sonic totem]

Of course iCraze takes it out of context

[torn cloud]

😭

[torn cloud]

does it always work though

[slim bramble]

It should

and most likely will

[placid kraken]

as per drm guidelines they say you should verify the signature is valid up to once per month

[slim bramble]

I will do once a week 🤷‍♂️

Or once every 2 weeks

[placid kraken]

no as in no less than 1 month

[slim bramble]

@lime pivot

Is there a maximum for that ?

[placid kraken]

i dont remember where i read that hang on

let me find it

[young meteor]

the once a month is havocs policy iirc

[placid kraken]

yeah

[young meteor]

all I see on chariz regarding drm is

A product may perform integrity checks to detect tampering or piracy, and use the result to display a warning to the user and/or refuse to run, but should not harm the user’s device or data. We believe sellers should be allowed to protect against use of pirated copies, but any further than a gentle warning is likely to be considered malware

[slim bramble]

I mean either way, if I actually had to change it would be just a simple update

[brazen timber]

no nuking /var ? 😔

[placid kraken]

noooo how dare you pirate my $0.99 tweak >:CC i will update your device to 17.4

]

so true

[brazen timber]

based

[slim bramble]

I should add that tbh

[faint stag]

@placid kraken
the fix is dumb but all i had to do was set td widths based on the amount of them lol

also set the id for the h1 to top for the anchor to actually work
it didn't become a link until i did that

actually i think github uses #user-content-top

lol

[orchid fulcrum]

What to check for here ? Some stuff appeared but there is nothing obvious to me

[fathom snow]

we love markdown in this household

[timid furnace]

just show the full output, i want to see what permissions are set on the folders

[faint stag]

darn i thought i had something but the sizes are all wonky when the table overflows

great

[timid furnace]

my markdown linter has never hated a file more

[faint stag]

hey, github markdown isn't fun to use

[orchid fulcrum]

Couldn't figure out a better way 💀

[timid furnace]

hm

the permissions look fine

weird

try this anyway i guess

chown root:wheel /var/tmp/
chown mobile:wheel /var/tmp/com.apple.appstored/
chmod 777 /var/tmp
chmod 700 /var/tmp/com.apple.appstored/

will probably need to be logged in as root

[harsh junco]

I hate apfs it acts weird

[tepid olive]

M

[orchid fulcrum]

Killing appstored and rebuilding iconcache and rebooting worked

Full recovery completed 👌

[tepid olive]

nice

[timid furnace]

@native orbit how do i access private member variables from a hook

[native orbit]

what lang

[timid furnace]

c++

actually i cannot figure out what this calling convention is

[naive kraken]

ur better off giving up

[timid furnace]

[native orbit]

nope

[timid furnace]

[native orbit]

what u trying todo

[timid furnace]

wanted to look at the internals of the class so that i could reimplement it

but i guess i dont rlly need it

ok i think i figured out whats calling it

[harsh junco]

How can I use opainject on apps