#development
sonic totem
timid briar
lol
granite frigate
any guesses for when 17.4 release will... release
sonic totem
Okay time for me to do my maths homework
sonic totem
any guesses for when 17.4 release will... release
Next Tuesday
granite frigate
quoting you on that next tuesday
sonic totem
bet
granite frigate
"Alfie internal apple leaker"
sonic totem
"Alfie internal apple leaker"
Stay quiet and I'll get you your TSS private key
timid briar
I’m joking!!! Do what u want I’m just being a silly guy!!!
sonic totem
I’m joking!!! Do what u want I’m just being a silly guy!!!
Trying to frame me 
No haxx for you
Just hrtowii
timid briar
lol
timid briar
Real
granite frigate
throw in some extra 0s in there
sonic totem
No it's the #development discount
faint timber
No one be haxxing more than me
sonic totem
Prime Linus 🔥
slim bramble
Selling a CoreTrust bypass
You are monetizing our CT bypass now
sonic totem
"our"?
sonic totem
i'll believe it when i see it
slim bramble
Bypassed fr
faint stag
imagine decryption without having to read memory 
elder scaffold
need kok3shi9 v5.0
slim bramble
imagine decryption without having to read memory <:prayge:1136785950027042917>
isn't that what clutch do but for ipa ?.
placid kraken
The oct in Nocturne stands for BINARY
sonic totem
YES!
slender glade
The oct in Nocturne stands for BINARY
I’m nb tho 🧐
sonic totem
unpatchable
Quite literally the opposite
TSS key leak is unpatchable
iBoot exploit is very patchable
steady nest
TSS key leak is unpatchable
also a disaster
lyric heron
the key is used to sign firmware ye?
sonic totem
also a disaster
Fr
sonic totem
the key is used to sign firmware ye?
Correct
lyric heron
why
steady nest
how does your phone know which key to accept
lyric heron
oh
steady nest
if you're able to sign it locally, why'd you need the apple server?
steady nest
nothing stops you from doing it
sonic totem
it asks apples server
If that was the case you could very easily proxy it and send back a controlled key
lyric heron
<@363298519941120000> key is defined in the ROM
but the key is quantum resistant
or smt like that
right
sonic totem
Idk for sure
steady nest
no
restive ether
not that one
sonic totem
Apple ask you not to disclose anything while it’s being reviewed afaik @torn cloud
So I wouldn’t send stuff here
torn cloud
my bad
torn cloud
So I wouldn’t send stuff here
also i fixed krw.c and compiled it, should i send them the executable?
or is there no need
sonic totem
Does it work?
torn cloud
Does it work?
can't test it
i mean they can probably compile it themselves so there's no need
torn cloud
work for tweaks
bro went from haxx to tweak dev
tepid olive
tepid olive
cool
radiant idol
meanwhile I’m getting my first CVE
what kind of exploit? 🤔
radiant idol
oh cool
torn cloud
currently getting reviewed
radiant idol
congrats
torn cloud
idk if it’ll get me anything
placid kraken
$20 and a kinder bueno
sonic totem
currently getting reviewed
(Spoiler: it takes months)
sonic totem
I’m really not
torn cloud
my ass cannot wait that long in anticipation
placid kraken
torn cloud
$20 and a kinder bueno
fingers crossed
sonic totem
It either gets closed after a week or so, or stays in review for months
torn cloud
It either gets closed after a week or so, or stays in review for months
wait if it’s in review for months is that good
like is that a sign they want to give you the bounty
or will they pull a uno reverse at the last second and close it
sonic totem
No
placid kraken
what does the shell execution bug actually achieve
sonic totem
They fix the issue, post security notes and then put it into bounty review
placid kraken
it’s a bug
can you get krw or something
sonic totem
<:uhh:696449618539708548>
I wouldn’t get your hopes up
torn cloud
can you get krw or something
not a actual part of the kernel, I’ve made a PoC but I doubt it works
sonic totem
If it can’t do any substantial damage to a system, they won’t shell out
placid kraken
apple should implement a gatekeeper and sip protection system like macos but for ios
sonic totem
They do
torn cloud
If it can’t do any substantial damage to a system, they won’t shell out
at least I’ll have a CVE in my name right?
sonic totem
It’s called “you can’t install IPAs from the internet”
placid kraken
why cant you disable it like you can on mac
sonic totem
at least I’ll have a CVE in my name right?
That’s assuming you even get a CVE
slim bramble
alfie grab my free code
torn cloud
That’s assuming you even get a CVE
yh
slim bramble
before it's too late
torn cloud
shouldn’t get my hopes up ig
kind herald
https://tenor.com/view/xqc-linux-aplay-urandom-random-gif-26003711
what does this do
sonic totem
They tend to be pretty steep unless you can provide an actual exploit for iOS/macOS
tepid olive
@native orbit ```
rror: undefined symbol: _sel_registerName
note: referenced by /Users/sora/Tweaks/meniscus/zig-cache/o/ec050c1003f5e17e559dc37b2094e3e1/libmeniscus.dylib.o:_sel.Sel.registerName
error: undefined symbol: _objc_getClass
note: referenced by /Users/sora/Tweaks/meniscus/zig-cache/o/ec050c1003f5e17e559dc37b2094e3e1/libmeniscus.dylib.o:_class.getClass
error: undefined symbol: _objc_msgSend
Or show that it could be used harmfully
slim bramble
<@1054895265347276840> ```
rror: undefined symbol: _sel_registerName
note: r...
#import <objc/runtime.h>
tepid olive
#import <objc/runtime.h>
it's zig
slim bramble
L
torn cloud
Or show that it could be used harmfully
well if this doesn’t get me shit then I guess it’s time to read Siguza’s guide on ARM assembly and reverse engineer the whole kernel 
hexed knot
Man why are u using zig
tepid olive
I like zig
faint timber
just be self taught prodigy
tepid olive
Trying to learn a new language
placid kraken
iPHONE ULTIMATE EXPLOIT 2024 FOR TODAY ROOT FLEXING ARM 💪 💪 💪 BIG VULNRERABILITY CAN HACK NEW JAILBREAK 2025 OPA334 ALIFECG R/JAILBREAK 😍 😍 😍 😍 😍 😍 😍 KERNEL READ WRITE NOT FAKE
primal perch
iPHONE ULTIMATE EXPLOIT 2024 FOR TODAY ROOT FLEXING ARM 💪 💪 💪 BIG VULNRERABILITY CAN HACK NEW JAILBREAK 2025 OPA334 ALIFECG R/JAILBREAK 😍 😍 😍 😍 😍 😍 😍 KERNEL READ WRITE NOT FAKE
torn cloud
just be self taught prodigy
easier said than done
orchid fulcrum
Is this a good idea
torn cloud
iPHONE ULTIMATE EXPLOIT 2024 FOR TODAY ROOT FLEXING ARM 💪 💪 💪 BIG VULNRERABI...
iPHONE ULTIMATE EXPLOIT 2024 FOR TODAY ROOT FLEXING ARM 💪 💪 💪 BIG VULNRERABILITY CAN HACK NEW JAILBREAK 2025 OPA334 ALIFECG R/JAILBREAK 😍 😍 😍 😍 😍 😍 😍 KERNEL READ WRITE NOT FAKE
faint timber
easier said than done
just takes 6+ years
torn cloud
mods
torn cloud
just takes 6+ years
at least I’m starting early ig
torn cloud
mods should ban for that
fr
faint timber
mods should ban you
faint timber
be you
placid kraken
oh
sonic totem
just takes 6+ years
Worth it if you start earning the big bucks
torn cloud
Worth it if you start earning the big bucks
true
placid kraken
ive earned at least $0.99 from flora !!!!!
vivid dew
Is this a good idea
can you buy me a 300 lira gift card
placid kraken
elon musk is giving a generous $7 to help children in need
kind herald
you’ve earned more than that
98 cents
primal perch
elon musk is giving a generous $7 to help children in need
orchid fulcrum
can you buy me a 300 lira gift card
No why lol
placid kraken
you’ve earned more than that
technically not false i said at least
torn cloud
flora is on the front page of havoc lol people are gonna be buying that shit
torn cloud
technically not false i said at least
faint timber
more money in breaking shit apart than creation
placid kraken
so true
sonic totem
Break this IMG4 parser apart Cryptic
placid kraken
flora is on the front page of havoc lol people are gonna be buying that shit
true
vivid dew
No why lol
to spend on turkish products
i'll give you 5 usd so you can buy a house with it
orchid fulcrum
Oof
torn cloud
more money in breaking shit apart than creation
didn’t Linus henze get like something in the 6 figures for finding the fugu15 bugs
orchid fulcrum
Is this a good idea
Alfie do you have an insight
faint timber
no idea
frosty gale
REAL
sonic totem
Alfie do you have an insight
Don’t do it
sonic totem
didn’t Linus henze get like something in the 6 figures for finding the fugu15 bu...
Easily
sonic totem
An entire exploit chain + a code-signing bypass + two installd bugs
torn cloud
I wonder how he did it
sonic totem
At least 300k
placid kraken
I wonder how he did it <:hm:1158412406167457802>
wizardry
sonic totem
Probably more
native orbit
<@1054895265347276840> ```
rror: undefined symbol: _sel_registerName
note: r...
do a Cimport for objc/runtime.h, and link with CoreFoundation
primal perch
I wonder how he did it <:hm:1158412406167457802>
not spending 20hr/week on discord probably helps to boot
orchid fulcrum
Don’t do it
Fair. Probably takes a lot more than a tweak to fix icon cache monstrosity
frosty gale
Isn’t BootROM exploits like 1mill
torn cloud
not spending 20hr/week on discord probably helps to boot
true
placid kraken
not spending 20hr/week on discord probably helps to boot
truest thing ive heard all day
torn cloud
Isn’t BootROM exploits like 1mill
Apple don’t do bounties for bootrom exploits anymore
other companies do
sonic totem
Fair. Probably takes a lot more than a tweak to fix icon cache monstrosity
It will bootloop you
frosty gale
Thought I saw one cyber company buying them for 2mill
sonic totem
Thought I saw one cyber company buying them for 2mill
More
placid kraken
i have biology revision to get to have fun doing nerd stuff guys
frosty gale
3mill *
frosty gale
Depends on the BootROM exploit
Untethered
orchid fulcrum
It will bootloop you
Really ? Cant tell if its a joke or not 😄
sonic totem
IMG4 bug people would pay 10+ million probably
torn cloud
Untethered
10 mil
frosty gale
DANG
torn cloud
tepid olive
do a Cimport for objc/runtime.h, and link with CoreFoundation
now it's saying tis
sonic totem
Really ? Cant tell if its a joke or not 😄
Yes a corrupted icon cache will bootloop you
tepid olive
pub usingnamespace @cImport({
^~~~~~~~
/Users/sora/Tweaks/meniscus/zig-cache/o/f65250e61f5993ba877ba09a113faf26/cimport.h:1:10: error: 'objc/runtime.h' file not found
#include <objc/runtime.h>
^
I wonder why theres no cve's for rom/iboot
sonic totem
It’s fixable with a Find My restore
frosty gale
I wonder why theres no cve's for rom/iboot
Apple trynna keep it shush 🤫
tepid olive
```/Users/sora/.cache/zig/p/1220c94dbcdf5a799ce2b1571978ff3c97bab1341fe329084fcc...
lib.linkLibC();
lib.addFrameworkPath(.{ .path = "/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/System/Library/Frameworks/" });
lib.addLibraryPath(.{ .path = "/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/usr/lib" });
lib.addSystemIncludePath(.{ .path = "/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS.sdk/usr/include" });
lib.linkSystemLibrary("objc");
lib.linkFramework("Foundation");
lib.root_module.addImport("objc", objc.module("objc"));```not sure why tho
sonic totem
I wonder why theres no cve's for rom/iboot
Apart from that one bzero bug from 14.0(?)
primal perch
gooning
torn cloud
I wonder why theres no cve's for rom/iboot
Apple want to discourage people from finding them and exploiting them ig
sonic totem
That wasn’t even a CVE even
orchid fulcrum
It’s fixable with a Find My restore
Yeah i have already went trough that i was just wondering if that tweak i sent could be a precaution against it happening once more.
sonic totem
How much is a untether like Fugu14
Afaik like 1mil
sonic totem
No not 1mil
frosty gale
800k
steady nest
I wonder why theres no cve's for rom/iboot
checkm8 got a cve
frosty gale
If Fugu14 was 0click it would be 1mil
Couldn’t it have been? If others worked on it more
slim bramble
there's a way to make it 0 click
NSO hello
sonic totem
Persistence + 100% success rate kernel exploit + PAC/PPL bypass
sonic totem
there's a way to make it 0 click
frosty gale
there's a way to make it 0 click
Yeah, we were talking about it a few weeks ago
steady nest
i actually mean it
sonic totem
iCrazeWare™️
primal perch
iCrazeWare™️
slim bramble
there's a way to make it 0 click
You should tell me in dms ngl
steady nest
the chain exists and is weaponized already
sonic totem
i actually mean it
No I’ve seen it I think
slim bramble
iCrazeWare™️
sonic totem
I saw some demo video
frosty gale
I saw some demo video
Yep
sonic totem
Yeah i have already went trough that i was just wondering if that tweak i sent c...
Don’t install
orchid fulcrum
You should tell me in dms ngl
Do NOT tell this guy
steady nest
No I’ve seen it I think
Twitter
orchid fulcrum
Don’t install
Alright thanks 👍
slim bramble
https://twitter.com/jeffssh/status/1690845469495132160/video/1
Yeah that’s NSO
sonic totem
https://twitter.com/jeffssh/status/1690845469495132160/video/1
That’s the one
Did the blog post ever release
frosty gale
That’s the one
I thought I remembered seeing one on device before
slim bramble
frosty gale
<:hm:1158412406167457802>
Uh oh…..
@slim bramble paid? https://x.com/bibifiredev/status/1764779018660811101?s=46
Twitter
slim bramble
<@448800441690619915> paid? https://x.com/bibifiredev/status/1764779018660811101...
Yes
In the precipitation I forgot to tag @acoustic imp
frosty gale
Is there an option to not have the blur?
frosty gale
Could I test?
frosty gale
Fair fair
slim bramble
6 testers and 2 devs
frosty gale
Can’t wait then, congrats though on the future release!
slim bramble
Thanks
steady nest
Did the blog post ever release
forcedentry
tepid olive
```/Users/sora/.cache/zig/p/1220c94dbcdf5a799ce2b1571978ff3c97bab1341fe329084fcc...
I can't
A
young meteor
stop doing weird shit and just use objc or swift
tepid olive
no
kind herald
no swift
kind herald
Sir, you can now leave this server
no
primal perch
vivid dew
<:boo:718369340495495198>
going to force feminize you specifically
primal perch
hasty ruin
going to force feminize you specifically
hbd big man
primal perch
hbd big man
young meteor
hbd big man
vivid dew
hbd big man
pussy in bio
vivid dew
hbd big man
feet in bio
slim bramble
hbd big man
vivid dew
hbd big man
cock in bio
acoustic imp
wha
slim bramble
Ask <@755485349060280351>
. @acoustic imp
acoustic imp
. <@755485349060280351>
i repsonded in dms
young meteor
cock in bio
ok here is 9000 dollars
frosty gale
Banger
acoustic imp
This is what it can look like minimized
placid kraken
looks good
acoustic imp
acoustic imp
looks good
Thanks 👍
placid kraken
awaiting the 50,000,000 safemodes that will happen on release (its inevitable)
acoustic imp
It’s iOS 14/15
young meteor
awaiting the 50,000,000 safemodes that will happen on release (its inevitable)
flora nexus
slim bramble
awaiting the 50,000,000 safemodes that will happen on release (its inevitable)
(It won’t trust)
placid kraken
im pretty sure flora has safemoded a lot less than you think
placid kraken
(It won’t trust)
(we'll see)
slim bramble
(we'll see)
My drm is too fire to safemode
cloud yacht
My drm is too fire to safemode
Can't wait for all the bootloops
young meteor
im pretty sure flora has safemoded a lot less than you think
0 times 💪
placid kraken
My drm is too fire to safemode
the drm:
if (!base64decode(key).isValid()) {
bootloop();
}
@hasty ruin is rune suposed to be dismissible on the LS ?
acoustic imp
where airply/device selector button?
Hidden 👍
slim bramble
the drm:
```objc
if (!base64decode(key).isValid()) {
bootloop();
}
```
It’s way more complex than you think
tepid olive
this should be equivalent to __attribute__((constructor)) according to mach-o format
const __init linksection("__DATA,__mod_init_func") = init;
export fn init() void {
const NSString = objc.getClass("NSString").?;
var StringInst = NSString.msgSend(objc.Object, "alloc", .{});
StringInst = StringInst.msgSend(objc.Object, "initWithUTF8String:", .{"TEST"});
}
And a lot more safer than you think
placid kraken
And a lot more safer than you think
that's what i thought too
flora literally hooks UIColor what issues could that possibly cause
acoustic imp
placid kraken
yet here we are
cloud yacht
if(goingToSafeMode()) {
dont();
}```reeal
kind herald
```objc
if(goingToSafeMode()) {
dont();
}```
@radiant idol does this work for the version of jade I use
placid kraken
who knew there could be so many issues with a simple UIColor hook
of all things, fucking chinese handwriting keyboard crashing apps
slim bramble
who knew there could be so many issues with a simple UIColor hook
At least I’d be cool if my drm doesn’t safemode
It shouldn’t
acoustic imp
dissapearing now *
slim bramble
(iCrazeware stolen code)
slim bramble
dissapearing now *
No
acoustic imp
i got do HW 😭
slim bramble
"shouldn't" !!!!
It’s icraze stolen code
cloud yacht
dissapearing now *
*Only available in certain regions, must be 18+, must have a valid credit card, contact your doctor before using this product
placid kraken
i believe you but consider getting people to test it on a variety of devices, ios versions, and bootstraps
not that i can use it anyway im on ios 16
slim bramble
i believe you but consider getting people to test it on a variety of devices, io...
We have 6 testers
acoustic imp
all on dif devices, prettymuch
slim bramble
And I have a few devices on different versions
placid kraken
We have 6 testers
are they on different bootstraps
cloud yacht
it should delete icrazedrm files so the nexus always bootloops
acoustic imp
are they on different bootstraps
dopa, u0, tarine, palera1n
slim bramble
are they on different bootstraps
Everyone uses procursus ngl
placid kraken
dopa, u0, tarine, palera1n
ok that's good i guess
kind herald
We have 6 testers
do you have any on iPadOS 14.8.1 with an iPad air 4 with Taurine or an iPad 5 on iPadOS 14.8 with unc0ver or an iPhone 6s on iOS 15.7.4 running dopamine
slim bramble
dopa, u0, tarine, palera1n
No typo speedrun any%
cloud yacht
if your not using procursus and your on like iOS 13+ what are you doing?
acoustic imp
if your not using procursus and your on like iOS 13+ what are you doing?
no ios13 support
cloud yacht
there
acoustic imp
the player is completly dif anyway
slim bramble
acoustic imp
im not the person to ask
slim bramble
Didn't odyssey use procursus?
Most likely
radiant idol
z
acoustic imp
z
slim bramble
Binger is dead
kind herald
z
slim bramble
z
cloud yacht
maybe checkra1n's stap
kind herald
is there even a non procursus strap above 14?
roothide
slim bramble
Non procursus users are weird ngl
cloud yacht
does it go above 14?
acoustic imp
does xina not use procursus
ios13 bootstrap
lean ermine
roothide uses procursus
slim bramble
EWWWWW
slim bramble
Roothide goofy anyway
lean ermine
fork of procursus but its still procursus
cloud yacht
tbf I use not procursus on my iPhone 7
kind herald
my iPhone Xr runs unc0ver
slim bramble
Ewww
cloud yacht
my iPhone Xr runs unc0ver
what iOS?
lean ermine
my iphone runs ios
kind herald
(it’s the only jailbreak for iOS 12.4.1)
acoustic imp
L
cloud yacht
unc0ver on iOS 12 is acceptable
kind herald
it’s honestly good
slim bramble
Undecimus
kind herald
I have Sileo installed and the exploit doesn’t fail a lot
orchid fulcrum
Is there a way to get internal settings like that one misaka tweak. (Which didnt work for me at the time btw)
cloud yacht
(it’s the only jailbreak for iOS 12.4.1)
checkra1n
kind herald
checkra1n <:troll:794397046706667530>
A12
slim bramble
I have Sileo installed and the exploit doesn’t fail a lot
Physpuppet never panicked me
acoustic imp
Is there a way to get internal settings like that one misaka tweak. (Which didnt...
jade i think @radiant idol
orchid fulcrum
jade i think <@799410351207612426>
What 💀
radiant idol
jade i think <@799410351207612426>
are you stupid
radiant idol
lol
cloud yacht
on an iPhone Xr
checkra1n is still a jailbreak for iOS 12.4.1 though
kind herald
checkra1n is still a jailbreak for iOS 12.4.1 though
true
slim bramble
How 2 get one settings beta ?
radiant idol
n0
orchid fulcrum
Oh okay i can test if you need
acoustic imp
I have not told you, but like follow retweet
hes not
orchid fulcrum
Oh okay i can test if you need
Or i would also love to know the way if u are willing to share
brazen timber
Didn't odyssey use procursus?
yeah before procursus became procursus it was a coolstar thing iirc
acoustic imp
I have already convinced 1 Brit
he actully ameraninian 🤓
slim bramble
he actully ameraninian 🤓
I’m talking about the other Brit
Who makes bootloop common
cloud yacht
tbhey should make procusus for 32 bit devices
slim bramble
tbhey should make procusus for 32 bit devices
acoustic imp
tbhey should make procusus for 32 bit devices
kind herald
procursus for ios 7
acoustic imp
oops
acoustic imp
what
hasty ruin
what
indigo peak
drop me the
rune drm files
‘sir
please
I just thought of a website to make
“Drop me the ____” generator
and it just uses Nathan’s image and just replaces the text
with whatever you enter
tepid olive
I need simple tweak idea
respring button in lockscreen when you hold the power button
tepid olive
then complicated tweak
disable instagram reels
native dune
theres a tweak for that already
native dune
idk
lean ermine
respring button in lockscreen when you hold the power button
squidgesture
fire tweak
lean ermine
it's closed source so no need
apparently respring isnt an action tho
kinda cringe
u can set it to open an app though and then set it to a respring app, almost works
tepid olive
https://github.com/BandarHL/BHInstagram/compare/main...asdfzxcvbn:BHInstagram:ma...
🔥 🔥 im going to pr removal of the option from the menu bar
tepid olive
apparently respring isnt an action tho
cephei has a function
lean ermine
oh you can set it to shortcuts in squidgesture
then just make a respring shortcut
ez pz
tepid olive
any other suggestions?
lean ermine
make a tweak that moves notification banners to the bottom of the screen 🔥
lean ermine
lmao
acoustic imp
make a tweak that moves notification banners to the bottom of the screen 🔥
use lower
lean ermine
is it for ios 16?
acoustic imp
no 15>
acoustic imp
its like not what ur thinking of tho lol
lean ermine
lol
acoustic imp
16Player has peices of it in it
lean ermine
where it at
lean ermine
i mean like notif banners
lean ermine
so they show up at the home bar location instead of the top
acoustic imp
make a tweak that moves notification banners to the bottom of the screen 🔥
im blind ....
lean ermine
lolol
tepid olive
no hidden costs™️
lean ermine
thx
tepid olive
@lean ermine just send me a notification rq
ping me
or someone
actually
I canping myself
@tepid olive
that didn't work
lean ermine
<@211288740004495360> just send me a notification rq
use shortcuts
just make notification pop up after 3 sec delay
tepid olive
how
tepid olive
figured it out
lean ermine
damn.. i was about to send my icloud shortcut exploit link...
tepid olive
lol
lean ermine
i believe there is an open source tweak for ios 14 that does the notif at bottom thing
acoustic imp
Lower… wtf is this
tepid olive
nvm
lean ermine
make sure ur doing the normal show notification one not the popup option or whatever the other one is
tepid olive
wait wdym
lean ermine
like this one
tepid olive
yeah
alr
@native orbit how do I find the selector for a method that isn't in apple's documentation
acoustic imp
can you dump headers of an app ?
acoustic imp
uhh so it need tweak injection ?
tepid olive
???
acoustic imp
like the app cant have JB detection
acoustic imp
i wana dump headers for clash royal wich has a JB bypass
acoustic imp
I don't think you understood my question
probly not
native orbit
<@1054895265347276840> how do I find the selector for a method that isn't in app...
wym
slate isle
does anyone know how to build an update for trollstore that i made? i installed brew and the libarchive thing and its failing with
nroot@localhost:~/TrollStore/TrollStore$ make
> Making all for application TrollStore…
==> Copying resource directories into the application wrapper…
==> Compiling TSAppInfo.m (arm64)…
In file included from TSAppInfo.m:1:
/home/nroot/TrollStore/TrollStore/TSAppInfo.h:9:9: fatal error: 'archive.h' file not found
#import <archive.h>
^~~~~~~~~~~
1 error generated.
make[3]: *** [/home/nroot/theos/makefiles/instance/rules.mk:278: /home/nroot/TrollStore/TrollStore/.theos/obj/debug/arm64/TSAppInfo.m.596e176a.o] Error 1
make[2]: *** [/home/nroot/theos/makefiles/instance/application.mk:50: /home/nroot/TrollStore/TrollStore/.theos/obj/debug/arm64/TrollStore.app/TrollStore] Error 2
make[1]: *** [/home/nroot/theos/makefiles/instance/application.mk:41: internal-application-all_] Error 2
make: *** [/home/nroot/theos/makefiles/master/rules.mk:146: TrollStore.all.application.variables] Error 2
@naive kraken the tutorial on your github is extremely vague could you help me out here to try and compile or maybe say how you do it?
i cant seem to build libarchive to get the .h file
timid furnace
it should build automatically if you have libarchive installed through brew
this is not needed
brew shell --prefix or something is in the makefile
yes
-I$(shell brew --prefix)/opt/libarchive/include
limpid pumice
Hey @grave sparrow. Do you know how to MSHookMemory / patch instructions?
faint timber
isn't it self explanatory
limpid pumice
Cool, a buddy of mine is a little frustrated with getting a bypass working. He isn't in the server right now and wanted me to ask for him but I will have him join and hit you up.
icy escarp
Oops that’s me I’m here now
indigo peak
Hey <@434097922762735618>. Do you know how to MSHookMemory / patch instructions?
yes
gameseagull mshookmemory go CRAZY
limpid pumice
oh you could have talked to fiore @icy escarp
orchid fulcrum
People be hooking memory and i still cant hook classes 😦
kind herald
luz
indigo peak
ultra mega cool guy?
genuinely a good guy
icy escarp
How do I hook functions by address on rootless? Is that possible
I just want to patch out some memory address
A wee tad bit of control flow tampering
kind herald
unc0ver mentioned
indigo peak
bro why am i getting filtered in #development
icy escarp
https://github.com/WyattGahm/UKGBypass/blob/main/Tweak.xm
That control flow didn’t know what hit it
indigo peak
https://github.com/WyattGahm/UKGBypass/blob/main/Tweak.xm
uh try D65F03C0 instead
icy escarp
Oh no the comment is wrong it’s a different instruction whoops
Like I said this used to work but it doesnt
indigo peak
frfr
icy escarp
In the snippet I sent I feel like I got it? Still confused
It hasn’t worked on dopamine 2, tried patching several apps
indigo peak
@grave sparrow whats the difference in
offset + _dyld_get_image_vmaddr_slide(0);
and
(void *)((unsigned char *)_dyld_get_image_header(0) + offset);
Yes I’ve pulled addresses from ida and binja, using dopamine 2, patch was assembled using armconverter.
indigo peak
armconverter my beloved (not a fan of the UI change)
icy escarp
Hehe
icy escarp
When I’m in binary ninja the subroutine names and addresses are static right?
indigo peak
just make a patch finder
icy escarp
Shit you’re right
indigo peak
Shit you’re right
this is an amalgamation of a bunch of projects (not my own) put into 1 lmao
icy escarp
Gameseagull fire
sonic totem
GameSeagull got open sourced?
kind herald
I still suck at 8 ball with game seagull . would not buy 0/10
sonic totem
its been open sourced
???
indigo peak
fym
cant tell if youre trolling rn
its been opened source since v1.0.0
may 8th 2021
sonic totem
I thought you said you didn’t want to release the binary patches
indigo peak
I thought you said you didn’t want to release the binary patches
thats the trollstore version
gentle grove
Twitter
grim sparrow
https://x.com/thekitze/status/1764733415155523814?s=20
ive never heard of this, what is it?
hasty ruin
^
brazen timber
fr
slate isle
it should build automatically if you have libarchive installed through brew
yeah that worked but now its saying this
nroot@localhost:~/TrollStore$ make -C ./TrollStore FINALPACKAGE=1
make: Entering directory '/home/nroot/TrollStore/TrollStore'
> Making all for application TrollStore…
==> Copying resource directories into the application wrapper…
==> Compiling main.m (arm64)…
==> Compiling TSAppDelegate.m (arm64)…
==> Compiling TSAppInfo.m (arm64)…
In file included from TSAppInfo.m:2:
/home/nroot/TrollStore/TrollStore/TSCommonTCCServiceNames.h:10:48: error: initializer element is not a compile-time constant
static NSDictionary* const commonTCCServices = @{
^~
1 error generated.
make[3]: *** [/home/nroot/theos/makefiles/instance/rules.mk:278: /home/nroot/TrollStore/TrollStore/.theos/obj/arm64/TSAppInfo.m.0b72d69c.o] Error 1
make[2]: *** [/home/nroot/theos/makefiles/instance/application.mk:50: /home/nroot/TrollStore/TrollStore/.theos/obj/arm64/TrollStore.app/TrollStore] Error 2
make[1]: *** [/home/nroot/theos/makefiles/instance/application.mk:41: internal-application-all_] Error 2
make: *** [/home/nroot/theos/makefiles/master/rules.mk:146: TrollStore.all.application.variables] Error 2
make: Leaving directory '/home/nroot/TrollStore/TrollStore'
naive kraken
yeah that worked but now its saying this
```
nroot@localhost:~/TrollStore$ make ...
your toolchain is probably too outdated
slate isle
your toolchain is probably too outdated
i literaly just installed theos on my linux server
naive kraken
i literaly just installed theos on my linux server
I mean clang or whatever
slate isle
apt update?
naive kraken
no clue
serene hawk
why is theos packaging my framework to /var/jb/var/jb...
kind herald
just for fun
hasty ruin
Show makefile
serene hawk
uhmm
it was this initially: ```TARGET := iphone:clang:latest:15.0
ARCHS = arm64 arm64e
PACKAGE_VERSION=1.0
include $(THEOS)/makefiles/common.mk
XCODEPROJ_NAME = Lottie
ifeq ($(THEOS_PACKAGE_SCHEME), rootless)
Lottie_XCODEFLAGS += SWIFT_ACTIVE_COMPILATION_CONDITIONS="ROOTLESS"
Lottie_XCODEFLAGS += LD_DYLIB_INSTALL_NAME=/var/jb/Library/Frameworks/Lottie.framework/Lottie
Lottie_XCODEFLAGS += DYLIB_INSTALL_NAME_BASE=/var/jb/Library/Frameworks/Lottie.framework/Lottie
else
Lottie_XCODEFLAGS += LD_DYLIB_INSTALL_NAME=/Library/Frameworks/Lottie.framework/Lottie
Lottie_XCODEFLAGS += DYLIB_INSTALL_NAME_BASE=/Library/Frameworks/Lottie.framework/Lottie
endif
Lottie_XCODEFLAGS += DWARF_DSYM_FOLDER_PATH=$(THEOS_OBJ_DIR)/dSYMs
Lottie_XCODEFLAGS += CONFIGURATION_BUILD_DIR=$(THEOS_OBJ_DIR)/
include $(THEOS)/makefiles/xcodeproj.mk
after-stage::
ifeq ($(THEOS_PACKAGE_SCHEME), rootless)
mkdir -p ./.theos//var/jb/Library/Frameworks
cp -r $(THEOS_OBJ_DIR)/Lottie.framework ./.theos//var/jb/Library/Frameworks/Lottie.framework
else
mkdir -p ./.theos//Library/Frameworks
cp -r $(THEOS_OBJ_DIR)/Lottie.framework ./.theos//Library/Frameworks/Lottie.framework
endif
before-all::
rm -rf $(THEOS_STAGING_DIR)/Library/Frameworks/
rm -rf $(THEOS_OBJ_DIR)
rm -rf $(THEOS_STAGING_DIR)/var/jb/Library/Frameworks/```
serene hawk
yeah sorry i messed some things up
it's prob because of the after-stage, however when i remove after-stage and before-all and then run make, the deb is just empty. the theos staging dir also only contains the control file and not any other contents
slim bramble
It took me 1h to realise I sent requests async and that’s why I couldn’t pass the data on to the main thread 😭
hasty ruin
slim bramble
<:shitdev:790744816807575595>
A shame I can’t redact that ngl
slate isle
now im getting
nroot@localhost:~/TrollStore$ make -C ./TrollStore FINALPACKAGE=1
make: Entering directory '/home/nroot/TrollStore/TrollStore'
> Making all for application TrollStore…
==> Copying resource directories into the application wrapper…
==> Compiling TSAppInfo.m (arm64)…
TSAppInfo.m:971:31: error: use of undeclared identifier 'commonTCCServices'; did you mean 'CommonTCCServices'?
NSString* displayName = commonTCCServices[serviceID];
^~~~~~~~~~~~~~~~~
CommonTCCServices
/home/nroot/TrollStore/TrollStore/TSCommonTCCServiceNames.h:3:15: note: 'CommonTCCServices' declared here
NSDictionary* CommonTCCServices() {
^
TSAppInfo.m:971:48: error: array subscript is not an integer
NSString* displayName = commonTCCServices[serviceID];
^~~~~~~~~~
2 errors generated.
make[3]: *** [/home/nroot/theos/makefiles/instance/rules.mk:278: /home/nroot/TrollStore/TrollStore/.theos/obj/arm64/TSAppInfo.m.0b72d69c.o] Error 1
make[2]: *** [/home/nroot/theos/makefiles/instance/application.mk:50: /home/nroot/TrollStore/TrollStore/.theos/obj/arm64/TrollStore.app/TrollStore] Error 2
make[1]: *** [/home/nroot/theos/makefiles/instance/application.mk:41: internal-application-all_] Error 2
make: *** [/home/nroot/theos/makefiles/master/rules.mk:146: TrollStore.all.application.variables] Error 2
make: Leaving directory '/home/nroot/TrollStore/TrollStore'
@naive kraken
naive kraken
you modified the code in an attempt to fix the issue but did it wrong?...
slate isle
you modified the code in an attempt to fix the issue but did it wrong?...
yes
//
// TSCommonTCCServiceNames.h
// IPAInfo
//
// Created by Luke Noble on 30.10.22.
//
#import <Foundation/Foundation.h>
NSDictionary* CommonTCCServices() {
return @{
@"kTCCServicePhotos": @"Photo Library",
@"kTCCServicePhotosAdd": @"Photo Library (Add)",
@"kTCCServiceCamera": @"Camera",
@"kTCCServiceMicrophone": @"Microphone",
@"kTCCServiceAddressBook": @"Contacts",
@"kTCCServiceCalendar": @"Calendars",
@"kTCCServiceReminders": @"Reminders",
@"kTCCServiceWillow": @"HomeKit",
@"kTCCServiceGameCenterFriends": @"Game Center Friends",
@"kTCCServiceExposureNotification": @"Exposure Notifications",
@"kTCCServiceFocusStatus": @"Focus Status",
@"kTCCServiceUserTracking": @"User Tracking",
@"kTCCServiceFaceID": @"Face ID",
@"kTCCServiceMediaLibrary": @"Apple Media Library",
@"kTCCServiceMotion": @"Motion Sensors",
@"kTCCServiceNearbyInteraction": @"Nearby Device Interaction",
@"kTCCServiceBluetoothAlways": @"Bluetooth (Always)",
@"kTCCServiceBluetoothWhileInUse": @"Bluetooth (While In Use)",
@"kTCCServiceBluetoothPeripheral": @"Bluetooth (Peripherals)",
@"kTCCServiceLocation": @"Location"
};
}
new code
oh i think i fixed it
its building so far
damn
==> Linking application TrollStore (arm64)…
Undefined symbols for architecture arm64:
"___isOSVersionAtLeast", referenced from:
-[TSSettingsListController viewDidLoad] in TSSettingsListController.m.0b72d69c.o
ld: symbol(s) not found for architecture arm64
clang-11: error: linker command failed with exit code 1 (use -v to see invocation)
make[3]: *** [/home/nroot/theos/makefiles/instance/application.mk:50: /home/nroot/TrollStore/TrollStore/.theos/obj/arm64/TrollStore.app/TrollStore] Error 1
make[2]: *** [/home/nroot/theos/makefiles/instance/application.mk:50: /home/nroot/TrollStore/TrollStore/.theos/obj/arm64/TrollStore.app/TrollStore] Error 2
make[1]: *** [/home/nroot/theos/makefiles/instance/application.mk:41: internal-application-all_] Error 2
make: *** [/home/nroot/theos/makefiles/master/rules.mk:146: TrollStore.all.application.variables] Error 2
make: Leaving directory '/home/nroot/TrollStore/TrollStore'
you need some additional stuff to compile availabilities on linux
I don't remember what it was called though
fossil umbra
I tried asking this question in Genius Bar but no response and I think it might be more suited for development
I want to flash a rom on a SOIC8 chip with a soic8 chip clip and wanted to know if the iPhone can interact with a ch341a programmer over lightning to usb
slate isle
I don't remember what it was called though
ill ask in theos
slender glade
ill ask in theos
#ifndef __APPLE__
int __isOSVersionAtLeast(int major, int minor, int patch) {
NSOperatingSystemVersion version;
version.majorVersion = major;
version.minorVersion = minor;
version.patchVersion = patch;
return [[NSProcessInfo processInfo] isOperatingSystemAtLeastVersion:version];
}
#endif
add this
slate isle
```objc
#ifndef __APPLE__
int __isOSVersionAtLeast(int major, int minor, int pat...
where?
slate isle
the file
didnt change anything, i think i still need the compatabilities thing or whatever
gentle grove
Twitter
slender glade
https://x.com/tsoding/status/1764958211705045052?s=46
the api design is very human.
slim bramble
@hasty ruin
slender glade
Surely not
IT IS
slender glade
funniest part of it all
could've written a nice cross platform in java
no they went for js
just insane lol
grim sparrow
I bet some PM went java and js must be similar
grim sparrow
It’s quite humerous
slender glade
It’s quite humerous
also quite saddening the js takeover of mobile apps
lean ermine
<@270540064512147456> minecraft launcher is electron
you couldnt tell LOL
lean ermine
open the app
load web browser launcher
press play minecraft on secret web browser launcher
slender glade
i got real responsibilities and ur telling me abt minecraft secret web browser launcher
man shut up
lean ermine
LOL
timid briar
Prism launcher >
odd timber
sonic totem
Yes
sonic totem
The CVEs have no credits
Although you can guess what the bugs are from the descriptions
torn cloud
Although you can guess what the bugs are from the descriptions
guessing work is fun
lol
sonic totem
kernel memory protections
torn cloud
> kernel memory protections
KASLR?
torn cloud
hmmm
torn cloud
What protects kernel memory from being written to
KTTR?
sonic totem
It’s not KTRR no
torn cloud
KTRR is to write to `__TEXT_EXEC`
i forgor
torn cloud
It’s not KTRR no
uhh final guess, KIP?
slim bramble
uhh final guess, KIP?
slim bramble
Are you gonna try all of them
sonic totem
uhh final guess, KIP?
What’s KIP?
slate isle
```objc
#ifndef __APPLE__
int __isOSVersionAtLeast(int major, int minor, int pat...
that worked and i got a little further
==> Signing TrollStore…
bash: line 1: ../Exploits/fastPathSign/fastPathSign: No such file or directory
make[2]: *** [/home/nroot/theos/makefiles/instance/application.mk:49: /home/nroot/TrollStore/TrollStore/.theos/obj/debug/TrollStore.app/TrollStore] Error 127
rm /home/nroot/TrollStore/TrollStore/.theos/obj/debug/TrollStore.app/TrollStore.60e94b38.unsigned
make[1]: *** [/home/nroot/theos/makefiles/instance/application.mk:41: internal-application-all_] Error 2
make: *** [/home/nroot/theos/makefiles/master/rules.mk:146: TrollStore.all.application.variables] Error 2
I’ve never heard of that
sonic totem
There’s SIP on macOS?
slim bramble
but a ripoff
torn cloud
kernel Integrity Protection Ig
yh that
sonic totem
Anyways @torn cloud it’s PPL
slim bramble
Anyways <@1191045453207314532> it’s PPL
Damn you gave it away
:c
@sonic totem
it's a thing
tepid olive
substrate.MSHookMessageEx(objc.getClass("NCNotificationShortLookView").?.value, objc.sel("viewDidLoad").value, viewDidLoadHook, &ogviewdidload);
tepid olive
```src/root.zig:18:77: error: expected type '?*cimport.struct_objc_class', found...
why is it erroring
it found the type it expected
slim bramble
Oh that’s just KTRR
Yeah I think it's KTRR
slim bramble
imagine if it wouldve been a sptm bypass
sonic totem
Yeah I think it's KTRR
Nah I think it’s KTRR
slim bramble
sonic totem
imagine if it wouldve been a sptm bypass
¯_(ツ)_/¯
sonic totem
guess im updating anyway lol
Why
slim bramble
Oh
sonic totem
This is your best chance
sonic totem
I am right
Because the screenshot you sent says it was introduced in A10
Which KTRR was
And KPP was A9
And KTRR uses the MMU/AMCC
slim bramble
The description of the thing made me think it's KTRR
slim bramble
And KTRR uses the MMU/AMCC
Yea
sonic totem
The description of the thing made me think it's KTRR
But you said KPP 
sonic totem
I see
slim bramble
But you said KPP <:PointAndLaugh:912489315781734452>
Where
slim bramble
@sonic totem ngl you should follow that awesome guy on twitter https://twitter.com/BibiFireDev
Twitter
He seems very cool
sonic totem
Not if you ask me to
slim bramble
Not if you ask me to
orchid fulcrum
While you guys are talking already i have a stupid af question: Is finding UaF's just as simple as detecting code where they forgot to assign null to pointers after deleting the memory ?
sonic totem
While you guys are talking already i have a stupid af question: Is finding UaF's...
Well that’s the premise but it’s more difficult than that
You have to ensure that it is actually used after it’s free’d
And the effects of that
And whether you can exploit it or even trigger it
orchid fulcrum
I see thx 👍
orchid fulcrum
You have to ensure that it is actually _used_ after it’s free’d
What do you mean by "its actually used "tho. Like used in the code that comes after the free() or used by something else ? Kinda confused on why/how would they use it after they free it
slim bramble
You have to ensure that it is actually _used_ after it’s free’d
how do you recognize free ?
mov r0, 0x0 ?
sonic totem
What do you mean by "its actually used "tho. Like used in the code that comes af...
For example, the main bug in checkm8 is that the pointer to the global 'data' buffer for USB transfers is free'd, but then you can avoid the code path that sets the pointer again and continue writing into the free'd buffer
sonic totem
mov r0, 0x0 ?
No that's the NULLing of the pointer
You'd have to find the free() function
But would probably be something like
ldr x0, my_buffer
bl _free```Maybe ldr is wrong idk
adr maybe
slim bramble
I forgot what ldr is for
native orbit
load
slim bramble
I don't know my arm asm 😭
slim bramble
oh smh ldr is mov
sonic totem
what
slim bramble
Idk I've read that 🤷♂️
sonic totem
isn't adr PC-relative
native orbit
prob would be like
adrp x0, #123
add x0, x0, #1337
ldr x0, [x0]
what does that do
native orbit
adrp gets page aligned addr
sonic totem
ah right
native orbit
add is adding the offset from page to the buffer
slim bramble
prob would be like
```asm
adrp x0, #123
add x0, x0, #1337
ldr x0, [x0]
```
This reminds me I gotta learn arm asm
slim bramble
why the `add x0, x0, #1337`
1337
sonic totem
I see
acoustic imp
😭
slim bramble
<:hm:1158412406167457802> when eta drm server not repsond with gargbage
Actually soon
if I don't take in consideration testing
acoustic imp
indigo peak
@hasty ruin
serene hawk
if you need help setting up drm i’d be happy to help @indigo peak
slim bramble
if you need help setting up drm i’d be happy to help <@396496265430695947>
You made drm's in the past ?
serene hawk
You made drm's in the past ?
did one for an upcoming tweak of mine but not going to implement it
indigo peak
You made drm's in the past ?
nah he’s just sayin jus to say it
native orbit
it generates the same types twice
it should header guard?
indigo peak
if you need help setting up drm i’d be happy to help <@396496265430695947>
If you wouldn’t mind
I just asked icraze bc his drm is bulletproof
slim bramble
did one for an upcoming tweak of mine but not going to implement it
I have one almost down
tepid olive
it should header guard?
it must not be working then
but like
it generates the types without error
serene hawk
I have one almost down <:hm:1158412406167457802>
https://github.com/yandevelop/Havoc-DRM-Middleman also did this for starters
serene hawk
I just asked icraze bc his drm is bulletproof
yeah true
i had a pretty secure concept
slim bramble
https://github.com/yandevelop/Havoc-DRM-Middleman also did this for starters
Idk i cooked my shit from scratch
sonic totem
<@883412614699446283>
Drop them. Now. 
serene hawk
it just lacked clean code 🤠
tepid olive
errors like: error: expected type '?*cimport.struct_objc_class', found '?*cimport.struct_objc_class'
slim bramble
https://github.com/yandevelop/Havoc-DRM-Middleman also did this for starters
Ewwww php
ewww
native orbit
errors like: ```error: expected type '?*cimport.struct_objc_class', found '?*cim...
what how lol
tepid olive
<:hm:1158412406167457802> what how lol
there's actually an issue on zig's github page
tepid olive
apparently it somehow generates the same type twice if you import the same header twice
slim bramble
as i said, starters reference. easy code
You could have made it in python
tepid olive
<:hm:1158412406167457802> what how lol
except the solution they provided doesn't work in this situation
I mean I could just cast
but that's kinda cursed
acoustic imp
@radiant idol https://www.reddit.com/r/jailbreak/s/vNpgMlG4QZ
indigo peak
<@799410351207612426> https://www.reddit.com/r/jailbreak/s/vNpgMlG4QZ
Pov Nathan with geometry dash
marble jacinth
why is binary ninja not responding
sonic totem
why is binary ninja not responding
Make sure to use legit Binja
marble jacinth
~~Make sure to use legit Binja~~
🤫
visual meadow
Pov Nathan with geometry dash
Ok
slim bramble
why is binary ninja not responding
Memory leak simulator 2024 you forgot
radiant idol
<@799410351207612426> https://www.reddit.com/r/jailbreak/s/vNpgMlG4QZ
lmfao
marble jacinth
Memory leak simulator 2024 you forgot
ah yeah
(it was using 27gb of ram)
(its using 15gb rn)
slim bramble
(its using 15gb rn)
add like 60gb of swap ngl
marble jacinth
i have 80gb of ram
next zenith
is force unwrapping in swift a bad idea
i just used it to calculate where and where not is a bad position to put a window
and uh
it compiled
so idc
kind herald
add like 60gb of swap ngl
1TB swap better