development

[placid kraken]

i would buy it

i already own bigsurcc and jade even though I only use jade

[acoustic imp]

@indigo peak with troll dycryptor why don’t u have it open the path of the downloaded ipa in filza? Doesn’t filza have path sceme or sm ?

Also why isn’t the format .tipa

I wanna airdrop it

[tepid olive]

hmm

prolly yeah

[placid kraken]

i await for the next #development message

from dgh🙄st

[tepid olive]

huh?

who's dghost

I'm confused

[placid kraken]

basically they made a super long chain of message links

took me like 5 mins to click all the way back

[tepid olive]

ohhh lol

[placid kraken]

either way my jade is looking so good right now

[tepid olive]

so probably would also be a bad first tweak then

[placid kraken]

imo yeah

[tepid olive]

hmmm

tryna think

[placid kraken]

try something simple first, maybe make it so you can hide the search text in the app library at the top

something basic

well idk if you have experience with %hook/logos

if you do then you can try some more complicated things, maybe try to lower the y position of the notification centre

[tepid olive]

mayhaps

[placid kraken]

and make it customizable in preferences

[tepid olive]

WAIT

notifications in control center

like android

[placid kraken]

that would be really cool but youd need to add integration for the cc tweaks lol

[radiant idol]

The CC is the most cursed thing on the planet

[tepid olive]

or like

[placid kraken]

maybe you can add it as a custom module that, when tapped, opens a page with some of your notis?

[tepid olive]

swipe down control center

[tepid olive]

I can do that

[placid kraken]

because all of the custom cc options let you add stock modules

[tepid olive]

when I first used ios

I was like

WHERE THE FUCK DO I SEE MY NOTIFICATIONS

[placid kraken]

if you just add it as a mock-stock module then it would work

[placid kraken]

wasnt it stolen from jailbreaks anyway

[tepid olive]

I figured it out and I was like, why do I have to go back to the lock screen to see them

[placid kraken]

also i havent bought rune, but to me it looks like what the app switcher looked like on my ios 5.1.1 first gen ipad

is that the intention?

to look like the old app switcher?

like the old app switcher even had music controls and stuff like that if you swiped left instead of right

[twilit jungle]

One of the best modular implementation you’ll see in iOS.

[tepid olive]

oh yeah

I remember that

or well

I know it

from ios 5

[placid kraken]

lol yea

i still have my ipad somewhere in my room

maybe ill jailbreak it again

[tepid olive]

I have an iphone 4 on ios 5

downgraded though

[placid kraken]

its a 64gb ipad

[radiant idol]

I disagree but you’d know better than me so

[placid kraken]

part of the screen doesnt work anymore (it doesnt even look broken it renders things fine it just doesnt respond to touches anymore)

i have to rotate to tap in that region

[twilit jungle]

What else is designed better to easily add more modules?

[placid kraken]

imo, the whole PSSpecifier api

with a cellClass to define your own custom class on top of the base things if you need more functionality

[gilded ivy]

where did theos create the tweak folder?

[twilit jungle]

Sure thats decent but its only works well when the data is mostly static. Anytime you have a dynamic list as the data you are reimplementing most of what PSSpecifier api provides.

[placid kraken]

not necesarily you just end up defining the specifier via code rather than a plist

- (PSSpecifier *)generateSpecifierWithName:(NSString *)name parsedName:(NSString *)parsedName hexColor:(NSString *)hexColor {
    PSSpecifier *specifier = [PSSpecifier preferenceSpecifierNamed:parsedName
                                                            target:self
                                                                set:@selector(setPreferenceValue:specifier:)
                                                                get:@selector(readPreferenceValue:)
                                                             detail:nil
                                                               cell:PSLinkCell
                                                               edit:nil];

    UIImage *originalImage = [UIImage systemImageNamed:@"paintpalette.fill"];
    UIImageSymbolConfiguration *symbolConfiguration = [UIImageSymbolConfiguration configurationWithScale:UIImageSymbolScaleSmall];
    UIImage *paletteImage = [originalImage imageByApplyingSymbolConfiguration:symbolConfiguration];

    [specifier setProperty:[GcColorPickerCell class] forKey:@"cellClass"];
    [specifier setProperty:hexColor forKey:@"fallback"];
    [specifier setProperty:@1 forKey:@"style"];
    [specifier setProperty:parsedName forKey:@"label"];
    [specifier setProperty:BUNDLE_ID forKey:@"defaults"];
    [specifier setProperty:paletteImage forKey:@"iconImage"];
    [specifier setProperty:name forKey:@"key"];

    return specifier;
}

but i do get what you mean

[sacred cosmos]

Very basic noob here trying to install theos on linux - I have theos installed and some patched sdks, but I think I am missing a toolchain. There's nothing on the theos wiki about a toolchain, but there is also no mention about sdks. Am I missing something? Thanks!
(Also forgot to mention that the iphone dev wiki had a toolchain from coolstar, but it seemed to be for ios 14)

[twilit jungle]

Thats still static. The color picker is just modifying what is displayed which is a good example of customization provided by the API.

I meant more so when you’ve got X number of cells, and that X changes at runtime. AppList is a good example of that, if something like that, but for any dynamic list, was in PSSpecifier API then it would be best modular design.

[misty cradle]

@radiant idol

what was the command for building for rootless again

[radiant idol]

Who

Idiot

Smh

[misty cradle]

i keep forgetting

😭

[radiant idol]

“make … THEOS_PACKAGE_SCHEME=rootless”

[misty cradle]

thx da 🐐 no 🧢

[twilit jungle]

[radiant idol]

now go fix akara

[misty cradle]

hello 🙂 👋

[twilit jungle]

[misty cradle]

nothing to fix .. besides enabling custom feature for my themers 😍

[misty cradle]

what are we developing today

[radiant idol]

nerd fr

[twilit jungle]

#development message

[radiant idol]

Imagine only developing one tweak

[misty cradle]

No sir.

[twilit jungle]

[placid kraken]

you can with [self reload]; and [self reloadSpecifiers] which calls the specifier getter method again, but yeah thats definitely not ideal in some cases

[twilit jungle]

Right but you are reimplementing the API at that point.

[placid kraken]

fair

[tender harbor]

Is anyone able to help correct an error with a package I tred to convert to rootless? Getting the attached errors

[tough shadow]

Devs update your tweaks to support iOS 17.3 A11

[acoustic imp]

AAAAAAAARRRRROOOOON

[naive sedge]

@naive kraken when I overwrite an app, and it stops launching, but then it doesn't open (tapping on it literally does nothing) even after reboot, what does that mean??

still having the EPERM issue so I don't have my first pick of apps to use, so I used the Numbers app, is that not 'System' enough to pass signature validation or something? Not sure how that part works

[naive kraken]

it has to be a removable system app

I don't think numbers is one

[naive sedge]

can you list them

or tell me how I can figure out which ones are

and does it have to be removed + reinstalled for it to work, or will installed from factory work?

[naive kraken]

/System/Library/AppSignatures

[naive kraken]

I'm the wrong person to ask

[gilded ivy]

yeah no this stuff is too complicated for me

[naive sedge]

errr

so

News is one of them

I tried it

and it said it overwrote it

but it didn't stick

so uh hrm

[naive sedge]

who knows more about this stuff?

I feel like I'm soooo cloose

yet it doesn't work

very frusturating

[naive kraken]

anyone that's actually made an installer, I presume

[naive sedge]

don't know how to contact whoever that is

[acoustic imp]

@verbal cedar

i think they made one

@timid furnace , they probly know

[gilded ivy]

any help? this seems to go on for a long time when compiling to rootless?

[acoustic imp]

idk

#import <Foundation/Foundation.h> try replacing it with this

@gilded ivy ik its the same thing bbut idk

maybe try using an older SDK

[naive sedge]

Also I found out how to make kfd more reliable

Open many apps first

If you open too many Springboard will have a resource shortage and respring, just close one app and keep doing that til you get the perfect number

For me it’s about 6 apps

Sometimes it works better if I open those 6 apps then purposely respring, then try it

You have to balance it such that RAM usage isn’t increasing during the exploit (by making it close to full) so that PPL isn’t grabbing more pages and panicking

[gilded ivy]

it could not build it?

[acoustic imp]

same error?

[timid furnace]

that's some random person

[acoustic imp]

oops it is

oh hes not in this server

[timid furnace]

@naive sedge kfd is a fickle beast and it's hard to help you without knowing exactly what you're doing. The functions in kfund have been working fine for this and didn't need any special modification in order to replace apps

[acoustic imp]

i think he trying to get KFD troll installer working in swift playgrounds on ipad

[acoustic imp]

ios version

[placid kraken]

this is why i regret adding random repos

wtf does this even do

"my ball"

[naive sedge]

I'm rewriting libkfd in pure Swift and running it inside a Swift playground

for whatever reason, when I implemented the overwrite file function, it cannot overwrite system applications, it just doesn't take effect

[grand tide]

good tweak get it

[naive sedge]

I assume that it is taking effect when I try and overwrite normal apps, because I am no longer able to launch them, even after reboot

also I get the EPERM issue with seemingly no rhyme or reason

[faint stag]

best tweak
!!!

[hexed knot]

What is this

[young meteor]

it adds on your screen

and it moves

[visual meadow]

good tweak get thank you

[lunar ginkgo]

hi

[young meteor]

hi

[lunar ginkgo]

im tryna make my first tweak

do you think i should use swift

or another

im on windows

[young meteor]

@hasty ruin what are you teaching your child

[lunar ginkgo]

grrr

help me

[grave orchid]

I’m scared, he doesn’t know what is root

[lunar ginkgo]

shhhh

hi guys

[lunar ginkgo]

how do i go to code it now

[young meteor]

put code in the Tweak.x file

profit

[lunar ginkgo]

is it the tweak name.x

or just tweak.x

i just cant find the file

[young meteor]

it is just Tweak.x by default

[young meteor]

that is not how you open a file

[lunar ginkgo]

lol

jk

[young meteor]

https://github.com/NightwindDev/Tweak-Tutorial you should go through nightwinds guide first

[lunar ginkgo]

ty

now what

[young meteor]

‘make package’ for making a deb

[lunar ginkgo]

nah i wanna open the code

[young meteor]

you’re on windows? just use visual studio code

https://code.visualstudio.com/

[lunar ginkgo]

i have vs code

how do i open the file tho

im special

[young meteor]

on the top bar or something there’s file, click that, open folder and go to wherever you made that folder

[lunar ginkgo]

i dont see the file

even in ultrasearch

[young meteor]

well how am i supposed to know where you put it

[lunar ginkgo]

i didnt put it anywhere

i ran this

then cded

into

aneuirsm

imma prob rename it to ruletete

roolete

then ran make

[primal perch]

wtf

minicraze

[lunar ginkgo]

im stupiood

im not like my father 😦

[naive sedge]

ok so it looks like part of the problem is that I get EPERM for many files, not just apps

and I think that has to do with those file's permissions, not something special

I guess normal app store apps are marked as readable by all users? just outside the sandbox?

very strange behavior but I made an explorer that lets me poke around, I can read all directories but files I get EPERM if I just bring in their parent directory

also

occasionally I get the panic invalid state for namestream inode

[wheat bobcat]

does anyone know how i link a user installed library in a preference bundle (rootless)

since it looks like it's searching in /usr/lib only

[ocean raptor]

rpath

[twilit jungle]

true

[exotic spire]

@indigo peak old fiore moment

[indigo peak]

real

[indigo peak]

must be curse of binding bc I can’t get rid of it

[kind herald]

you should get that checked out

just saying

[wheat bobcat]

ong I tried that and it didn't work but tried it again bc you said and it works now

thanks ig

[gentle grove]

bruh

[gentle grove]

why are you trying to get rid of your penis

[kind herald]

bottom surgery

[tough shadow]

Guess what

[torn oriole]

Mfs installing flex thinking they’re the hottest mf on the block

[tepid olive]

atp jus start prayin on peoples downfalls

[slim bramble]

why is bro using svc

[slim bramble]

frfr

[placid kraken]

@indigo peak its time

[slim bramble]

@placid kraken WWW flora

[placid kraken]

🙏🙏🙏

[placid kraken]

now i have to add per app theming for like message bubbles in messages and things like twitter

[slender vortex]

could anyone with a healthy device that does not look like this send the output of df -h on their device? I am trying to debug where tf my storage is going

[left phoenix]

Bruh

[tepid olive]

any smarty pants know what's going on here? i understand the rest of the script but as soon as it gets to the pic sent im like huh https://github.com/haxi0/Derootifier/blob/master/Derootifier/repack-rootless.sh because i know the rest of the script deals with changing around the directories to be that of rootless+ellekit but is this modifying the binaries or something (i think that's what otool is for?) to be rootless or am i dumb

[acoustic imp]

@placid kraken flora respring hangs my phone 😢

[placid kraken]

as in it spinlocks???

https://github.com/acquitelol/flora/blob/main/Tweak/Utilities.m#L79-L84 this is all im doing

this is how i "should" respring

https://adamdemasi.com/2019/08/25/respring-the-right-way-followup.html

according to this

[acoustic imp]

No like I installed, respring and it spun then like froze spinning then keeper spinning, and kept doing that till I held volume up button

To go to safemode

And no crash logs we’re generated

[radiant idol]

Let’s remember that you also have like 928484932847949327240 tweaks

[placid kraken]

nightwind is that the right way to respring

is there a better way

should i just do sbreload

ughhh sbreload takes me to the home screen not the app prefs

[torn cloud]

yeah once i get a test device ill test it

[radiant idol]

İ do sbrelpad and killall springböard as a faılbacl

[placid kraken]

oh that word is blocked

[radiant idol]

Contains a filtered word

Probably

[placid kraken]

+ (void)respring {
    extern char **environ;
    pid_t pid;

    const char *args[] = {"sbreload", NULL};
    posix_spawn(&pid, ROOT_PATH("/usr/bin/sbreload"), NULL, NULL, (char *const *)args, environ);
}

[radiant idol]

Doesn’t work on Xina v1 unfortunately

[native dune]

sbreload is on most modern jbs

u can also just killall -9 SpringBoard

or backboardd

[radiant idol]

Don’t do -9

That immediately kills it

Bad

[hasty ruin]

Oh no

Anyway

[placid kraken]

like this?

const char *args[] = {"killall", "backboardd", NULL};
posix_spawn(&pid, "/usr/bin/killall", NULL, NULL, (char *const *)args, environ);

[radiant idol]

kill sb instead

[placid kraken]

hmm alright

[hasty ruin]

Nah

Fuck backboardd

[placid kraken]

but would that take me back to tweak prefs are respringing

[hasty ruin]

ruined my month

[acoustic imp]

@placid kraken what’s in your like %ctor

[placid kraken]

quite a lot

[radiant idol]

Rüınəd yöür rüne

[placid kraken]

https://github.com/acquitelol/flora/blob/main/Tweak/Flora.x

mostly just nsuserdefaults init and the main UIColor hooks

[acoustic imp]

Omg it’s def that

[placid kraken]

wha?

[acoustic imp]

When I put a if file exists in 16player %ctor it didn’t like it

[placid kraken]

i dont have a fileExists anywhere

i dont init NSFileManager

[radiant idol]

access >>

[placid kraken]

if it breaks when respringing i have a feeling the respring method is bad

nightwind is the process name springboard or springboardd

for passing as an arg to killall

[acoustic imp]

No flora never even got loaded into SB

Ib tried killall SB

SB reload

[acoustic imp]

SpringBoard

[placid kraken]

oh right

[placid kraken]

you do have all the dependencies right?

[radiant idol]

Iööı ay my tüeak code

[placid kraken]

husk

which tweak

[radiant idol]

Böldərs Rebörm

[placid kraken]

that kills backboardd

[radiant idol]

Öööööööööö

Bəd

[placid kraken]

wtf

[radiant idol]

https://github.com/NightwindDev/SileoRespringFix

[placid kraken]

am i doing it wrong??

extern char **environ;
pid_t pid;

const char *args[] = {"killall", "SpringBoard", NULL};
posix_spawn(&pid, "/usr/bin/killall", NULL, NULL, (char *const *)args, environ);
``` nothing happens

[acoustic imp]

[acoustic imp]

Looks at nights search dots code

Or eggnotch

(Not by night wind)

[radiant idol]

ROOT_PATH

[acoustic imp]

/var/jb/use/bin

[radiant idol]

İdıot

[placid kraken]

that one also kills backboardd

[acoustic imp]

U killed backboard in bolders reborn

[indigo peak]

rootless?

[placid kraken]

oh right

[acoustic imp]

It does?

[radiant idol]

/usr/bin/killall röötfül
/var/jb/usr/bin/killall rööyləss

[acoustic imp]

Root path shit doesn’t work

[radiant idol]

Ön Xina v1 yəs

[acoustic imp]

U Gota do sm if rootless/rootfull trickery

[acoustic imp]

[radiant idol]

Rəst ıt ıs sbrrload

[placid kraken]

yeah killall SpringBoard works but it takes ages to get back into ios

maybe i need some other arguments

+ (void)respring {
    extern char **environ;
    pid_t pid;

    const char *args[] = {"killall", "SpringBoard", NULL};
    posix_spawn(&pid, ROOT_PATH("/usr/bin/killall"), NULL, NULL, (char *const *)args, environ);
}

like it takes longer to respring than backboardd

[acoustic imp]

ROOT PATH WORKS FOR YOU 😡

[placid kraken]

..yes???

[radiant idol]

Üpdəyt yöür theös

[acoustic imp]

🙄

[placid kraken]

why tf are you typing like that 😭

[acoustic imp]

Bc he’s night

He’s feeling goofy today

[radiant idol]

Bekaiz i canf ssm to cjanhd it yp tje english ksubpard

[acoustic imp]

Oh L

Funny how I understood that

[indigo peak]

yeah ironic actually

[acoustic imp]

Very

[radiant idol]

Ğm Iso qiote exhsustsd

[acoustic imp]

Go back to bed

[radiant idol]

Nö

PİRACİ

[acoustic imp]

I can’t use flora.

It doesn’t ever load SB

it hangs…

[acoustic imp]

[placid kraken]

thats.. very strange

[acoustic imp]

I can try disable all tweaks one sec

But is one killall SB and one sbreload ?

[placid kraken]

first one is killall SpringBoard second one is killall backboardd

[acoustic imp]

Do not kill backboard

Use killall SB

yes it may be faster but don’t

[placid kraken]

lol all of nightwind's OS tweaks do it, i wont tho

[acoustic imp]

(Idk I havnt treid)

[radiant idol]

Bəcəuz im simb

[acoustic imp]

Indeed

[steady nest]

use sbreload

[warped sparrow]

YES SAME

[radiant idol]

Use sbrelpad excepy on xina v1

[warped sparrow]

WELL

i get safemoded

[placid kraken]

its ios 14+, are there any rootless jbs that dont have sbreload???

[warped sparrow]

Its got to do with foxfortutils

[warped sparrow]

Nope

[radiant idol]

Xina v1’s sbreload ıs brölen

[warped sparrow]

xina

[placid kraken]

does anyone actually use xina v1, like are there alternative bootstraps?

[warped sparrow]

xina v1 loves to make everything hard

[warped sparrow]

i think most people switched to v2

[radiant idol]

there are söme peöpel on it

[warped sparrow]

Because its the same iirc but just no hackiness

[placid kraken]

how do i check if the jb is xina v1

is there some file created during bootstrap

[torn cloud]

@warped sparrow baba

[radiant idol]

I have the çhek in Böldərs Rebörn

[placid kraken]

oh ok

[torn cloud]

why is bro yapping with the ü and the ö

[warped sparrow]

Azerbaijan

Alphabet

Or something like that

[radiant idol]

İ cənt seem tö çnage tö thə əngliş keybpad

[torn cloud]

W

[placid kraken]

your check uses backboardd and no root path macro

is xina v1 rootful?

[warped sparrow]

LMAO

[radiant idol]

İ think Xina v1 üöiıd patch tjay

[placid kraken]

just say people on xina v1 cant use the tweak ✅
@warped sparrow

LMAO

i dont have the dev role so its not me

nightwind secretly uses xina v1

LOL

did you say something

[torn cloud]

icraze is here

[warped sparrow]

icraze is better than nightwind

[placid kraken]

guys its capt inc

obviously

[torn cloud]

icraze is a curry muncher

[placid kraken]

WHAT

[torn cloud]

im pakistani

[warped sparrow]

naw icraze loves his fish and chips

[torn cloud]

I can say that

[warped sparrow]

And his jacket potatoes

British

[placid kraken]

remember when the word roothide was blocked here

[warped sparrow]

its funny because i just finished munching curry ✅

[torn cloud]

well well well

the paki is eating curry

how am i not surprised

[warped sparrow]

Is flora on havoc?

[torn cloud]

It was?

[placid kraken]

yeah

[warped sparrow]

W

[torn cloud]

Apply for dev role

[placid kraken]

but its still OSS

[placid kraken]

where

[warped sparrow]

W

[warped sparrow]

Modmail

just ask

[torn cloud]

mod

???

[warped sparrow]

W because i got no money

[torn cloud]

kixrd got deleted

Lol

[warped sparrow]

i give up

[torn cloud]

racisim??

fr

[placid kraken]

thats the idea !!!

[warped sparrow]

W rosie

[tepid olive]

@torn cloud ```swift
static func map(phys: UInt64, size: UInt64) throws -> UnsafeMutableRawPointer? {
let port = try getSurfacePort()
let surface = try KRW.rPtr(virt: try KRW.ourProc!.task!.getKObject(ofPort: port) + 0x18 /* IOSurfaceSendRight -> IOSurface /)
let desc = try KRW.rPtr(virt: surface + 0x38 / IOSurface -> IOMemoryDescriptor */)
let ranges = try KRW.rPtr(virt: desc + 0x60)

    // Write the desired address and length to the ranges entry
    try KRW.w64(virt: ranges, value: phys)
    try KRW.w64(virt: ranges + 0x8, value: size)
    
    // Change the whole object to the correct size
    try KRW.w64(virt: desc + 0x50, value: size)
    
    // Clear task and some other stuff
    try KRW.w64(virt: desc + 0x70, value: 0)
    try KRW.w64(virt: desc + 0x18, value: 0)
    try KRW.w64(virt: desc + 0x90, value: 0)
    
    // Set wired (physical addresses are by definition wired)
    try KRW.w8(virt: desc + 0x88, value: 1)
    
    // Set this to be a physical memory descriptor
    let flags = (try KRW.r32(virt: desc + 0x20) & ~0x410) | 0x20
    try KRW.w32(virt: desc + 0x20, value: flags)
    
    // Finally, clear _memRef so it's reconstructed
    try KRW.w64(virt: desc + 0x28, value: 0)
    
    // Map!
    guard let surf = IOSurfaceLookupFromMachPort(port) else {
        return nil
    }
    
    // Leak surface to keep mapping
    _ = Unmanaged.passRetained(surf)
    
    return IOSurfaceGetBaseAddress(surf)
}

here

[torn cloud]

Ooh

[tepid olive]

this explains how it works

[radiant idol]

Sw*ft

[placid kraken]

censorship

[tepid olive]

real

[torn cloud]

This would be better if it was in objc

I’ll rewrite it when I get home

[tepid olive]

it's from Fugu15, not my fault linus was obsessed with Swift XD

[torn cloud]

No offence to Linus but what was going though his head when he thought “let’s write two jbs in swift”

Like wtf

[tepid olive]

because technically speaking, if you know what you're doing, Swift is a much better language

[torn cloud]

I’ve only ever used swift for some basic UI

So I can’t comment

[granite frigate]

whatever goes through Linus head also nets him thousands in cve bounties

[torn cloud]

True

[tepid olive]

I should find a kernel bug

[torn cloud]

Wait thousands??

[tepid olive]

yummy yummy money

[torn cloud]

That’s crazy

[tepid olive]

apple pays alot

[granite frigate]

I mean... a full blown exploit chain for iOS 15 would pay a pretty penny

[tepid olive]

apple is very serious about security lol

[granite frigate]

landa alone was 70k

[torn cloud]

It’s like 50k minimum for a kernel bug right?

[tepid olive]

somewhere around that I think

[torn cloud]

Kind of a good thing for researchers

[tepid olive]

If I got that much money, I'd build the ultimate threadripper machine

complete with a 4090

[granite frigate]

I'd like to say i want to find one but in reality i'm still a skid

[torn cloud]

You sure that’s a good way to spend the money 😭 buy a M3 max mac or something

[tepid olive]

yes

[torn cloud]

lol

[tepid olive]

I'm an AMD guy

[north meadow]

can I send here a link of a CVE a guy sent

on reddit

[torn cloud]

Tbf my goal in life is to find a CVE before I’m 18

So I got 4 more years left

[tepid olive]

I'm 15

😭

Except I have experience in reverse engineering

[north meadow]

17.3

[serene hawk]

how would i use ROOT_PATH_NS in swift?

[granite frigate]

It's over for me im 18 in 6 months wtf

[tepid olive]

[torn cloud]

Better get to work then

[tepid olive]

real

[granite frigate]

Dunno where to even start

shits crazy

[torn cloud]

You need to learn assembly ig?

[native dune]

you can probably import rootless.h with a bridging header

[serene hawk]

yeah right

[tepid olive]

yeah, I conveniently used to do nintendo switch security research

[serene hawk]

thanks

[tepid olive]

same architecture lmao

[torn cloud]

Nintendo uses ARM?

What

[tepid olive]

yes

the switch is ARMv8

how did you not know this

the switch uses a maxwell nvidia GPU

with an ARM processor

because nVidia made an SOC

[granite frigate]

where does that take place

reswitched?

[tepid olive]

I did security research for a game

Splatoon 2

I found an anti cheat bypass

[torn cloud]

Meanwhile my parents want me to focus on school

[tepid olive]

never reported it though because I was I think 11

[granite frigate]

is it still there?

[native dune]

mf was doing security research at 11

[tepid olive]

the game is discontinued

[native dune]

its over for me

[torn cloud]

Crazy

[tepid olive]

it wasn't then though

[acoustic imp]

Is that the Jade issue lmao

[tepid olive]

replaced with splatoon 3

[granite frigate]

why do you think splatoon 3 would have a different anticheat from splatoon 2

[tepid olive]

because

there was this one person

who found it after me

[granite frigate]

bruh

[tepid olive]

who abused the shit out of it

[acoustic imp]

Lmao

[torn cloud]

lmao

[tepid olive]

they went by "haxxie"

[granite frigate]

I can't if I have school

[torn cloud]

Can relate

[granite frigate]

I mean it sounds like a bad excuse but i always have to do my groupmates' work to not fail

[acoustic imp]

Why would you need to do that

[granite frigate]

clearly lots of other students also have better experience than me in security

[torn cloud]

My parents think that making haxx is making me more distracted from school 😭

[tepid olive]

here's an example of their abusing https://www.youtube.com/watch?v=szKgfMaPZxc

[granite frigate]

my parents don't know im doing anything about this

[torn cloud]

Just have a academic comeback whilst also reverse engineering XNU

Not hard if you find balance

[torn cloud]

Frcoal

[granite frigate]

that sound was... loud

[acoustic imp]

Killall backboard

[north meadow]

what do you guys think about this https://www.reddit.com/r/jailbreak/comments/1azrcmg/tcc_exploit_17173/

[granite frigate]

you make the latter sound very easy when I don't know anything or where to start

lol

at most i've only just skimmed through random files in the github

[torn cloud]

learn some assembly ig, I have a ebook on my computer I’ll send it to you one min

[granite frigate]

sure

[serene hawk]

i don't even know myself lol. some library is purely swift and i thought it'd be easier writing the tweak in swift instead of creating a wrapper class around it to use it from obj-c. but its a pain tbh lol

[granite frigate]

lottie 😭

[serene hawk]

yeah

managed to compile it now

[sonic totem]

Same fr

But time running out

[visual meadow]

This airaw tweak on chariz says 404 when i try and download 1.6.2, and it says its free for some reason lol

[torn cloud]

At least you’ve found something lol

[sonic totem]

I need a 0day though

[tepid olive]

[acoustic imp]

Jus pirate it

[sonic totem]

@granite frigate my grades are suffering lately

[tepid olive]

alfie

how much did you get for trollstore

[visual meadow]

Nah I'm not a sad person

[granite frigate]

Blud at least you found something

[acoustic imp]

Your a genius how

[visual meadow]

@sonic totem what did you find?

[sonic totem]

Its free

[tepid olive]

whattt

[sonic totem]

[visual meadow]

Or was it what you told me abt before

[young meteor]

$0 cause he didn’t find the bug originally

[acoustic imp]

, I just don’t have PayPal 🥲

[tepid olive]

ohh right

[sonic totem]

??

I'm talking about the CoreTrust bug

[north meadow]

alfie

[visual meadow]

Ohhh

Ok

I just went into this chat lol

[north meadow]

did you see the reddit post

[sonic totem]

?

[visual meadow]

Go get that zero day 🙏🆙🆙

[acoustic imp]

Wel u didn’t find it, u like reverse engineered it

Right ?

[sonic totem]

I am aware

[north meadow]

like do you think it might be something?
https://www.reddit.com/r/jailbreak/comments/1azrcmg/tcc_exploit_17173/

[sonic totem]

Yeah we'll see

[sonic totem]

No

[torn cloud]

actually he patchdiffed

[sonic totem]

No PoC, no details

[north meadow]

understandable thanks

[granite frigate]

The fact you found something just from diffing means that you're like a genius fr

[sonic totem]

We have no clue what parts of TCC it gets around

[sonic totem]

NO

[tepid olive]

should I find a 0day

[sonic totem]

It wasn't that difficult

I'm not genius

[visual meadow]

The changes were also minuscule too lol idk

I looked and had no idea what actually changed

[tepid olive]

I would like to build my dream threadripper machine

[sonic totem]

... there was loads of changes

[acoustic imp]

Actually 🤓☝️

[young meteor]

curious

[sonic totem]

Most of the changes were in the struct

And CMSBuildPath iirc

It's been a while

Proper write-up pending but it was more than just "use two signer infos"

[tepid olive]

oh right

I'd have to write a write up

[granite frigate]

was the choma explanation correct

[acoustic imp]

@placid kraken I disabled all my 1 million tweak and flora is fine now, so it’s a me issue 😭

[tepid olive]

😓

[sonic totem]

Which one

[granite frigate]

Github readme

[tepid olive]

too bad I can't just make a PoC

right, apple does require a write-up

[sonic totem]

This?

[granite frigate]

Ye

[sonic totem]

That's vague

But correct

[torn cloud]

How are you even supposed to make a PoC when there’s no details of the bug in the first place lmao, when you look on apples website the CVE explanation is so vague 😭

[sonic totem]

There's more to it than that

[placid kraken]

nyaboom~7

[tepid olive]

no I mean

of a bug I find

[torn cloud]

Ohh

That’s easier ig

[acoustic imp]

I just have a bad feeling I’m gona enable all tweaks and it will be fine

[tepid olive]

and usually wrong

like kernel code execution being used to describe landa

[sonic totem]

@granite frigate proper writeup in the next ~3 months

Because of that thing that I'm also doing

[torn cloud]

I mean at that point you just kind of have to start reverse engineering

Since Apple is useless

[sonic totem]

?

[tepid olive]

in the CVE

for landa

it says kernel code execution

lmao

[sonic totem]

But it's a kernel bug

[tepid olive]

yeah but kernel code execution != kernel bug

well, in apple's mind it is

[sonic totem]

"`Kernel code execution" means having access to kernel memory

in Apple terms

[tepid olive]

yeah, in apple terms

not normal terms

[sonic totem]

A real kernel code execution bug would be a PAC bypass

[tepid olive]

kernel code execution to me would mean executing kernel code

yeah

[sonic totem]

Or KTRR bypass

[granite frigate]

goldfish memory strikes again...

[acoustic imp]

Also is this intended ?

[sonic totem]

That thing that I might submit

[tepid olive]

another thing I could do

[granite frigate]

Ah

[sonic totem]

yeah

[tepid olive]

is make dmaFail work as a KTRR bypass

I have a few ideas

[torn cloud]

How is that supposed to happen

[placid kraken]

i dont think so, but i also think that might not be flora causing that

[granite frigate]

There was a bit of lore the other day

[sonic totem]

With my thing?

[tepid olive]

except the problem is, why

spinlock isn't an issue anymore

at least not afaik

[granite frigate]

No, the possible KTRR bypass

[sonic totem]

Oh right

Okay I've procrastinated studying for about 8 hours

[torn cloud]

You’re talking about the one where you can only r/w to cache right?

[sonic totem]

Time to start

[tepid olive]

yeahhh

[granite frigate]

Yes

[tepid olive]

but there's some ways I can think of to work around it

like just not letting cache be written back

but that would have performance tolls

[torn cloud]

Worth it tbf

I mean the bypass entry point was patched in 16.6 I believe

[tepid olive]

or maybe doing this, and then inserting code into the kernel, but inside the kernel I maybe do something else to have KTRR bypass after writing cache back

[torn cloud]

Or was it 17.0

[tepid olive]

16.6

[torn cloud]

Yeah

[tepid olive]

likely not possible tho

I do know a theoretical way to stop cache writeback

[acoustic imp]

@placid kraken I don’t think this is suposed to be like this

[tepid olive]

but I just don't think a KTRR bypass is worth it

what benefits would it bring atp

[granite frigate]

Bring back hypervisor

[acoustic imp]

Kernel trolling

[torn cloud]

mov r0, #10 mcr p15, 0, r0, c6, c2, 0 ldr r0, =(0xxxx) //REGION_BASE mcr p15, 0, r0, c6, c1, 0 // DRBAR mcr p15, 0, r0, c6, c1, 1 // IRBAR ldr r0, =(0x18 | 0x1) // REGION_SIZE mcr p15, 0, r0, c6, c1, 2 // DRSR mcr p15, 0, r0, c6, c1, 3 // IRSR ldr r0, =(0x1301) // Shareable Device mcr p15, 0, r0, c6, c1, 4 // DRACR mcr p15, 0, r0, c6, c1, 5 // IRACR

[tepid olive]

well that's M chips only though

[tepid olive]

no, apple has a register

to disable cache writeback

for sleep

[granite frigate]

Where is this?

[torn cloud]

stack overflow post

[tepid olive]

lmfao

[torn cloud]

would you need krw to disable it ? Or is it embedded in the kernel

[tepid olive]

this

in full words talk

that's saying

[torn cloud]

hm

[tepid olive]

ARM64 Register Apple Core Cluster Override Disable L2 Cache Flush for Apple Core Cluster Sleep

(Flush == Writeback)

[lunar ginkgo]

can someone give me a snippet for code that works in objective c 16.5? i wanna make sure my theos code is working right

[torn cloud]

This is a bitmask to disable L2 cache flush right? For accelerated sleep

[tepid olive]

^^

[torn cloud]

Looks neat

How did you figure it out

[tepid olive]

uh

[torn cloud]

Look at some oss tweaks

[tepid olive]

asahi

linux

I really want to ask the asahi team if they know what the register actually does

[torn cloud]

Oh

[tepid olive]

but idfk how to contact them lmfao

[granite frigate]

IRC?

[lunar ginkgo]

bru

[tepid olive]

what's IRC

I genuinely don't know lmao

[granite frigate]

https://tenor.com/view/getting-old-man-saving-private-gif-13333225

[tepid olive]

sorry

:(

uh oh

sourceforge

is dying

what's a good starting point for utilizing data in the Shortcuts app. like where are the shortcuts stored or smth

0 reddit posts

[placid kraken]

@radiant idol well done

are you sure you wanna shut down? because that shuts down your device

[radiant idol]

yes

it does indeed shut down your device

[ashen birch]

to any nerds that know the answer: is it possible to set nonce using a kfd-type exploit (puaf?)

[minor vortex]

and if we get this, we'll have a new trollstore available? (or not)

[acoustic imp]

Some people would do it then be like wtf

[timid furnace]

maybe

what do you need for dimentio to work

[acoustic imp]

@placid kraken also I narrowed it down to 10 tweaks now

1 in there is bad

[granite frigate]

tfp0

[timid furnace]

it seems like dimentio supports libkrw and stuff though

[torn cloud]

uh wouldn’t that trigger KTTR

[granite frigate]

dimentio

:3

[timid furnace]

so i think you might be able to just directly plug it in to kfd?

[torn cloud]

oh yeah

W 0x7ff

[sonic totem]

Yes

[granite frigate]

app idea

[timid furnace]

[sonic totem]

TrollNonce did a similar thing but also used entitlements

Depends on target version

[acoustic imp]

@radiant idol @radiant idol @radiant idol

IT WAS SEARCH DOTS LMFAO

[torn cloud]

wait does dimentio work unjailbroken

[acoustic imp]

@placid kraken

[granite frigate]

krw

[sonic totem]

You need krw

[torn cloud]

alr

[radiant idol]

L

[acoustic imp]

@warped sparrow i figured it out, do u have search dots installed ?

[granite frigate]

can't I just skid TrollNonce and throw kfd in it

[warped sparrow]

Nope

[acoustic imp]

damit

[granite frigate]

would that work

[warped sparrow]

https://tryitands.ee/

[granite frigate]

looks like the nonce settings and krw is in the roothelper

[placid kraken]

LMAO

[acoustic imp]

real

[minor vortex]

It would be incredible really

[torn cloud]

nightwind slander

[acoustic imp]

fr

time to fix it

[sonic totem]

Yeah I guess

But it’s unlikely may I say

[sonic totem]

Probably

[granite frigate]

how has no one else done that

[sonic totem]

No demand

Nonce is useless for 16.x-supported devices

[granite frigate]

I suppose it's not useful for now

and Dopamine has libkrw so you can just run dimentio jailbroken

[sonic totem]

Should work yes

[hexed knot]

any nonces in chat

???

[sonic totem]

You don’t wanna say that

[granite frigate]

oh

realisation

[sonic totem]

https://en.m.wikipedia.org/wiki/Nonce#:~:text=Nonce%2C a slang term chiefly,offenders%2C especially ones involving children

[hexed knot]

Ngl i don’t know what a nonce was until recently

I thought it just meant like a fool

[acoustic imp]

can i run python on iphone

[native dune]

0x1111111111111111

[hexed knot]

Yes

[granite frigate]

Same

[minor vortex]

You think there's a 99% chance we'll never get TrollStore? 😢

[granite frigate]

there will NEVER be another coretrust exploit AGAIN.

[sonic totem]

[sonic totem]

Probably yes

I know i most likely won’t find a bug

[granite frigate]

https://tenor.com/view/lie-lie-detector-cap-you-are-lying-stop-lying-gif-12198388917433403789

[sonic totem]

Correction: I most likely won’t release a bug

[minor vortex]

Okay RIP, I'm sad, fuck Apple

[sonic totem]

@granite frigate I’ll tell you though

[granite frigate]

Real

[sonic totem]

Please apply for TrollStore 3.0 beta ASAP

[lunar ginkgo]

hey

does anyone know how to hook into volume ui?

using obj c

i cant figure it out really

[hexed knot]

Find the header for the ui component and %hook

[tepid olive]

does no one know 😭 damn

[hexed knot]

Nobody using shortcuts

[tepid olive]

shortcuts + ssh

=

awesomeness

[torn cloud]

because of the eta kids?

[sonic totem]

Partly but also I’d like a 0day to keep to myself for a while

But mostly because I doubt I’d even find a bug in the first place

[torn cloud]

You’re a smart guy you’ll find one lmao

[granite frigate]

^

[lunar ginkgo]

i cant find the header

[sonic totem]

[ashen birch]

should just be kernel r/w

[ashen birch]

*KTRR also idk

[sonic totem]

Still, REing CoreTrust is not something that makes me happy at all

[torn cloud]

try using Flex

[steady nest]

can vouch

[lunar ginkgo]

what is that 😭

sorry

[torn cloud]

allows you to get properties of certain UI things

[lunar ginkgo]

link?

also is there a way to run a dummy device on windows

or is that just xcode

[torn cloud]

bro is using windows

[lunar ginkgo]

yes

i am

[torn cloud]

if you can’t afford a Mac at least use Linux

smh

[lunar ginkgo]

bro my pc is 2k

[torn cloud]

then dualboot

[torn cloud]

Xcode simulator is trash for anything apart from tweak dev

[torn cloud]

GYATTT

[lunar ginkgo]

LOL

all this and cant even find my hooks

[slim bramble]

clean ngl

[lunar ginkgo]

so how do i get flex

[torn cloud]

https://github.com/FLEXTool/FLEX

[torn cloud]

this would be perfect if you had a MacBook on the side

[lunar ginkgo]

macbook bad

[torn cloud]

also I’m not a fan of the black white keyboard combo

[lunar ginkgo]

my pc solos

[lunar ginkgo]

yeah i changed it

[torn cloud]

you’ll need it for iOS dev, otherwise you’re gonna be in pain

trust me

[torn cloud]

nice

anyway back on topic

get flex installed

and grab header properties

[lunar ginkgo]

ok

lemem try

im not very smart

this is gonna be hard

wait

where tf do i find ios simulator @torn cloud

[torn cloud]

you need a Mac

[lunar ginkgo]

aw man

do u have one?

[torn cloud]

yeah

[lunar ginkgo]

can u find the header for me

🙏

[torn cloud]

when I get home yh

[lunar ginkgo]

how long (i am very pateincese)

[torn cloud]

s0n

[lunar ginkgo]

ok

[torn cloud]

like half hour maybe

[lunar ginkgo]

👍

i gotta go somewhere at 3:30

so

we good

[torn cloud]

Uh what’s your timezone

[lunar ginkgo]

est

[torn cloud]

you’re in the states?

[lunar ginkgo]

yes

[lunar ginkgo]

yes

[torn cloud]

so it’s like 1pm for you?

[lunar ginkgo]

yes

in 1 minute

what about u

[torn cloud]

gonna be 6pm in 1 min

in the uk

[lunar ginkgo]

ok

[radiant idol]

my console app just stopped working

what the hell

[lunar ginkgo]

ENGLISH!

yay!

[lunar ginkgo]

@ me when u can

[torn cloud]

yeah my mums making me do stuff

might take a while

[lunar ginkgo]

dont worry

i have

a long time

[torn cloud]

👍

[faint stag]

another gmk67

[lunar ginkgo]

Yes

[faint stag]

at least you got the good quality cheap keycaps

[lunar ginkgo]

I was gonna get qk75n

Or zoom75

[faint stag]

i have a neo65 on the way

i did own a gmk67 board before
(the via compatible one from epomaker; ek68)

strange that you replied smh

[lunar ginkgo]

😮

[faint stag]

wait let me send what i got now

[lunar ginkgo]

😮

[faint stag]

left is the epomaker th66 with some clones of pbtfans vior (though it's colored more like pyga but has the effect like vior)
and the right is a keychron v1 with a similar style set but with red legends and none of the sparkles lol

ever since pbtfans have been doing tripleshot there's been clones of the "semi-transparent top layer" style keycaps

[acoustic imp]

Yummy

Ok so am gona asume you know nothing

[lunar ginkgo]

yeah kinda

[acoustic imp]

So like you know what OOP stand for right ?

[lyric mica]

singa kohaku

fish

[acoustic imp]

ObjectOrientedPrograming

@lunar ginkgo

[lunar ginkgo]

yes

[acoustic imp]

Ok

So whT do you think that means

What*

Like what do you think you have to do to change something

Think

[exotic spire]

Bro giving out the Zero to Hero Masterclass in discord #development

[acoustic imp]

(I’m trying to see what u already know)

[lunar ginkgo]

hmm

i think it means

objects

and its focused on objects

[acoustic imp]

Yea

[lyric mica]

matrix corsa

standing on bidness

[acoustic imp]

So basically everything in iOS is an object

[lusty jacinth]

Hot

[acoustic imp]

Think of objects as a product that came off an assembly line

[lunar ginkgo]

tuff keeb

[lunar ginkgo]

yes

[acoustic imp]

(You know what an assembly ly line is right?)

[lunar ginkgo]

yes

im not

THAT dumb

[acoustic imp]

Ok

[lunar ginkgo]

i have assembly line in palworld

🙂

[acoustic imp]

So you know how on an assembly line the product has a blue print for how it’s made, the size, shape, color, etc

[acoustic imp]

Idk what that is but ok 👍👍

[acoustic imp]

?

[lunar ginkgo]

yes

[acoustic imp]

So In objc the “blueprint” is the class

In*

[lunar ginkgo]

ok, so that would be like Tweak.x?

[acoustic imp]

So the class is the blue print for the products/objects

[acoustic imp]

No

[placid kraken]

liar oop stands for

Onever
Ogonna
Pgive
(you)
(up)

[acoustic imp]

Do you have flex ?

@lunar ginkgo

[lunar ginkgo]

not yet

i dont have mac

im on windows

[acoustic imp]

U don’t need a mac/pc to get flex

It’s on PSs repo

[lunar ginkgo]

ok

hold up

[faint lion]

:( Your command ran into a problem

That repository isn't registered with Canister's database.

Note: The bot maintainer will be pinged about this error automatically.

:( Your command ran into a problem

That repository isn't registered with Canister's database.

Note: The bot maintainer will be pinged about this error automatically.

[acoustic imp]

[[flexlist]]

[faint lion]

FLEXList

FLEXList is a wrapper tool for FLEX Tool

Author

Netskao

Version

1.3-8

Price

Free

Repo

BigBoss

Bundle ID

netskao.flexlist

Powered by Canister · Feb 25, 2024, 7:23 PM

[acoustic imp]

^^^

[lunar ginkgo]

yep

added

it aint showin up

i had bigboss before

im on 16.1.1 dopamine

[acoustic imp]

ok

so flex is installed and working?

[lunar ginkgo]

no

its not showing up

do i gotta derootify

or is there one alr

[acoustic imp]

ur not on dopa?

[lunar ginkgo]

i am

[acoustic imp]

ok one sec

[lunar ginkgo]

does libFLEX work

[acoustic imp]

il just send u the deb

[lunar ginkgo]

ok

[acoustic imp]

yea u need it

[lunar ginkgo]

and FLEXing?

[acoustic imp]

yea