development

[hasty ruin]

I removed one of the released ones

The singing one

Forget the name

Last night

[pallid totem]

Insane

[indigo peak]

icraze regularly goes through the apps

[reef trail]

she said?

[indigo peak]

most of them get rejected

[reef trail]

i like that one

[pallid totem]

i forgot how to spell unbelieveble

how

unbelievable

i think

idk

[hasty ruin]

Yeah

[indigo peak]

bro definitely typed it into google to spell check

[pallid totem]

oh i forgot an a

unbelieveable

[pallid totem]

bro how

how'd u know

[indigo peak]

guys BHTikTok++ v1.9.3 released

[pallid totem]

mods

[hasty ruin]

BHReels

[pallid totem]

(thanks)

[kind herald]

Finally can get past this tik tok ban

[indigo peak]

https://www.reddit.com/r/jailbreak/comments/1hzp5kw/bhtiktok_v193_released/

[pallid totem]

finally

Does this version of TikTok still work when it will be banned in the US?

wait isn't it

considered piracy

[indigo peak]

i'm only spreading the news as to what i got a notification for on my apple watch

[stray viper]

No

As it’s not a preinjected ipa

[indigo peak]

gameseagulltrollstore

[hollow oar]

That’s not the meaning of ріrасу

[pallid totem]

their first line in the release tab:

[hollow oar]

License dictates everything

[stray viper]

Yeah so don’t download the ipa

[indigo peak]

you got banned on tiktok?

[stray viper]

According to this server’s guidelines around piracy it isn’t

[kind herald]

No i was joking about the us tiktok ban

[indigo peak]

the US is banning tiktok?

[kind herald]

Apparently

[hollow oar]

Still ріrасу since no written permission to modify unauthorized contents to Tiktok

[indigo peak]

damn

i dont use tiktok

so i rlly dont care

[hollow oar]

Same

[indigo peak]

ill be missing my occasional tiktok shopping spree

when i get Ryze gym stuff for 44% off

[stray viper]

By that logic jailbreaks them selves are piracy

[indigo peak]

like once a year

[hollow oar]

In what way

Jailbreaking is legal

[stray viper]

If modifying an app’s memory is considered piracy then so is jailbreaking

[velvet path]

ok hold on

what is this argument even about

[pallid totem]

pircay

[stray viper]

He says a TikTok deb is piracy

[hollow oar]

No license allowing you to modify unauthorized contents to Tiktok

So yeah

[velvet path]

that’s not how piracy works lol

[stray viper]

Maybe tos violation

But not piracy

[indigo peak]

143 hz

[velvet path]

it might violate TikTok ToS yes

but it’s not piracy itself

now if they gave out an ipa? yeah that’s piracy

[indigo peak]

GameSeagullTS

[hollow oar]

The release tab on their repo:

Wrong reply

[indigo peak]

[velvet path]

the latest release that I see doesn’t link an ipa (feel free to point it out to me though, I might’ve missed it)

[stray viper]

I mean if you don’t use the preinjected ipa it isn’t piracy

[hollow oar]

Skull

[stray viper]

It says it’s in telegram

[velvet path]

let me check again

[stray viper]

But the GitHub only provide tweaks

[indigo peak]

i havent seen anything

@velvet path

[velvet path]

hmm

that might be an issue

[reef trail]

is it that bad tho

[indigo peak]

v.1.5.0

[velvet path]

but the deb/dylib themselves aren’t

[velvet path]

it’s linked in latest too

Let me ask about it

[indigo peak]

its linked in all of them except "Initial Release" lmao

[acoustic imp]

@fading shell

[velvet path]

ok nuked

thank you for the report

[light owl]

np

[kind herald]

np

[hollow oar]

Gone

[stray viper]

What was nuked?

[velvet path]

the Reddit post

To clarify: the issue isn’t the deb/dylib, it’s the link to the telegram with the ipa

[stray viper]

Oh

At least I’m right

[hollow oar]

I wasn’t talking about the dylib/deb in the first place?

whar

[stray viper]

You replied to my post saying it’s not a preinjected IPA

[acoustic imp]

is this just a moment?

[hollow oar]

(This was towards the iPA)

[cloud yacht]

I'm trying to build my tweak for simulator but I'm getting
/Users/shorty/theos/makefiles/common.mk:167: *** The "iphonesimulator" target is not supported on the "macosx" platform. Stop.

My makefile ```makefile
#export ARCHS = x86_64

TARGET := iphone:clang:latest:12.0

INSTALL_TARGET_PROCESSES = SpringBoard Prefrences
export TARGET = iphonesimulator:clang:16.4:12.0

include $(THEOS)/makefiles/common.mk

TWEAK_NAME = Eliza

Eliza_FILES = Tweak.x
Eliza_CFLAGS = -fobjc-arc

include $(THEOS_MAKE_PATH)/tweak.mk
SUBPROJECTS += elizaprefrences
include $(THEOS_MAKE_PATH)/aggregate.mk

[severe stream]

simulator:clang:16.4:12.0 instead should work

[pallid totem]

make files

[cloud yacht]

seems to be building now

Warning: unable to build chain to self-signed root for signer "Apple Development: ******** (A682MLFXVY)"
/Users/shorty/Eliza/.theos/obj/iphone_simulator/debug/Eliza.dylib.9f8f30ac.unsigned: errSecInternalComponent
make[2]: *** [/Users/shorty/theos/makefiles/instance/library.mk:51: /Users/shorty/Eliza/.theos/obj/iphone_simulator/debug/Eliza.dylib] Error 1
rm /Users/shorty/Eliza/.theos/obj/iphone_simulator/debug/Eliza.dylib.9f8f30ac.unsigned
make[1]: *** [/Users/shorty/theos/makefiles/instance/library.mk:37: internal-library-all_] Error 2
make: *** [/Users/shorty/theos/makefiles/master/rules.mk:146: Eliza.all.tweak.variables] Error 2

[severe stream]

broken/expired cert (?)

[cloud yacht]

Cert should be fine. I just built an app in xcode with it

There are 2 certs could it be trying to use the wrong one?

the second is not in keychain

[timid furnace]

check your keychain

[cloud yacht]

idk how to do that

[timid furnace]

go to your keychain and look for that cert

is it in there

[timid furnace]

the one mentioned here

[harsh junco]

Skill issue

[timid furnace]

or just disable codesigning with theos

you don't really need it anyway

[cloud yacht]

Seems to be there

[cloud yacht]

for simject?

[timid furnace]

yes

Add export TARGET_CODESIGN_FLAGS = --sign '-' because for some reason Theos insists on signing everything for sim using an Apple Development cert

[cloud yacht]

actually would it make a difference if I was logged in via ssh

ok that worked

[pallid totem]

make a make file then that makes a file

[harsh junco]

Literally theos

Ooo

@pallid totem what if you

[cloud yacht]

is there a script or smth to make installing tweaks into simject easier?

[harsh junco]

https://www.gnu.org/software/make/manual/make.html

@pallid totem read this

[cloud yacht]

actually this won't really matter as I'm not building a traditional tweajk

[timid furnace]

if you use my fork make install should work

[cloud yacht]

okay thanks

[pallid totem]

develeoper: doesn’t read documentatiinn

EVIL develeoper: READS documentatiinn

[sonic totem]

https://youtu.be/IXBC85SGC0Q?si=A9wBiWYGi_ibd9Id

[kind herald]

Very interesting, Alfie.

[fading shell]

Aren't you supposed to be studying

[acoustic imp]

verry nice vido @sonic totem

[sonic totem]

Failure in this exam is inevitable

[acoustic imp]

(click view message if ur gay)

[kind herald]

@shut stag Your developer is abusing permissions

[acoustic imp]

[indigo peak]

[acoustic imp]

(alfie blocked me)

[cloud yacht]

ok so I am doing cursed stuff anyways I'm trying to load substright apis. I was able to get it to laod using
pub static SUBSTRATE: Lazy<Library> = Lazy::new(|| unsafe { Library::new("/opt/simject/usr/lib/libsubstrate.dylib").unwrap() });
but using just libsubstrate.dylib and /opt/simject/usr/lib/libsubstrate.dylib don't work. What woulkd b the proper way to figure out the path of substraight?

(also dlsym(RTLD_NEXT, CString::new("MSFindSymbol").unwrap().as_ptr() as *const i8)); didn't work

[hasty ruin]

teslaman please get off wilson’s account

[cloud yacht]

unfortuantly it's me

[manic forum]

i wanted to try something with swift but theos isn't too interested

error: 'swift-support': Invalid manifest (compiled with: [...compile flags...])

How can I fix this

I haven't tried anything and I'm all out of ideas, I don't know swift

[pallid totem]

based

[slim bramble]

Is this zig ??

Wtf is this

[harsh junco]

X64_86 asm or arm64 asm

[wooden yarrow]

you mean x86_64

because x86_64 is a 64 bit extension to the (80)x86 architecture

[harsh junco]

Wh^W I have either dementia or im [hard r]
You didn’t answer the question

[wooden yarrow]

arm64 ofc

x86_64 sucks ass

[harsh junco]

Why

[wooden yarrow]

too complex

i enjoy RISC archs more

[harsh junco]

I love complex things

[cloud yacht]

Oh yeah this is rust

Using this crate https://docs.rs/libloading/latest/libloading/

[slim bramble]

go to hell

@hasty ruin we need to remove him from ono :/

rust tweaks is a crime

[cloud yacht]

Fair enough

[shrewd moth]

💀

[fading shell]

what is your point here

what are you even trying to say

[reef trail]

thats someones comment on reddit

[shrewd moth]

just kidding

[reef trail]

i saw it this morning

[reef trail]

😂😂😂😂😂😂

[fading shell]

yeah but why the reply to my message and "💀"

[reef trail]

🤷‍♂️

[cloud yacht]

💀

[shrewd moth]

it was when we discussed that developing tweaks is not hard and take little time when we talked about sergy meteoric learning curve

you said you invested little time in glance

so I thought it will be funny

[fading shell]

not little

4 months is not little imo

[reef trail]

i agree

[shrewd moth]

Not what you said

[reef trail]

thats a fairly long time

why resurrect a pointless argument from ages ago

[shrewd moth]

you said "4 months from first tweak to develop glance and most of the time was other unrelated private project"

[reef trail]

yeah

[shrewd moth]

When you tried to justify the fact learning developing tweaks is easy

so not 4 months

[reef trail]

what

[shrewd moth]

potato

anyway was just joking

and I remembered our discussion after reading that comment

that's it

[harsh junco]

Can I statically link uikit?

[reef trail]

huh

what are you trying to do

[harsh junco]

Something ver cursed: run an app in an environment where there is no uikit and a bunch of other frameworks

[reef trail]

uhh

why

what env

[harsh junco]

nonui

[reef trail]

mods

uhh

idk

maybe?

but i doubt it'd work

see what happens if you set XXX_LINKAGE_TYPE to static in theos

[harsh junco]

I mean, if i static link everything…

[reef trail]

and then explicitly link uikit

[harsh junco]

Hm k

[harsh junco]

This is not hd

[lean ermine]

Free money tweak idea: Use airpod pro 2 stems to scrub forward/backward in media

[light owl]

Worst tweak idea

[lean ermine]

https://tenor.com/view/wrong-drumpf-trump-stupid-gif-6220235

[trail nimbus]

imagine muscle memory wants to increase volume for good part of the song and then just scrubs it away

[cloud yacht]

I've had worse

[lean ermine]

Two airpods

Make left one volume and right one scrub

Or other way around

https://tenor.com/view/fire-writing-gif-24533171

[light owl]

Then what if i only use one airpod

[lean ermine]

House exploding gif

Alternative to house exploding gif is a control center toggle to toggle functionality

But that's sort of convoluted

There is a third solution that would be really cool but probably hard to implement

Where if you start with a swipe up it then takes the next few inputs as controlling volume

and if you start with a swipe down it takes the next few inputs as controlling media position

Maybe I'll quit my job to make this happen...

[tepid olive]

you like 0 privileged levels and unproper mitigations?

[indigo peak]

2 airpods, 2 different audios

[lusty jacinth]

is this a tweak

[lusty jacinth]

also idevice cartel and mommy asmr 🔥 @thorn hound

[hollow oar]

Mommy Fox ASMR is crazy 💀

[kind herald]

Don't knock it until you try it

[hollow oar]

?

[kind herald]

?

[hollow oar]

What do you mean by this

[lean ermine]

NEED

[granite frigate]

NEED

[harsh junco]

Yes

[reef trail]

They are referring to the fact that you should at least try "Mommy ASMR" before you criticise it. As they assume you're unfamiliar with the subject

[pallid totem]

[pallid totem]

on the left i’ll play subway surfers + one of those slime videos and on the right its going to play family guy

[granite frigate]

i said what i did bro

[cloud yacht]

still don't have that figured out but I'm tryng to hook somethign now but it's not likeing me.

 40 #[no_mangle]
 39 #[allow(non_snake_case)]
 38 unsafe extern "C" fn luaL_loadbufferx(
 37     state: *mut LuaState,
 36     buf_ptr: *const u8,
 35     size: isize,
 34     name_ptr: *const u8,
 33     mode_ptr: *const u8,
 32 ) -> u32 {
 31     log::info!("hi dad");
 30     let rt = RUNTIME.get_unchecked();
 29     rt.apply_buffer_patches(state, buf_ptr, size, name_ptr, mode_ptr)
 28 }
 27  
 26  
 25  
 24 #[ctor::ctor]
 23 unsafe fn construct() {
 22     panic::set_hook(Box::new(|x| unsafe {
 21         let message = format!("lovely-injector has crashed: \n{x}");
 20         log::error!("{message}");
 19     }));
 18  
 17  
 16     //let rt = Lovely::init(&|a, b, c, d, e| RECALL(a, b, c, d, e));
 15     //RUNTIME
 14     //    .set(rt)
 13     //    .unwrap_or_else(|_| panic!("Failed to instantiate runtime."));
 12     log::info!("hi mom");
 11     //log::info!("{:?}", dlsym(RTLD_NEXT, CString::new("MSFindSymbol").unwrap().as_ptr() as *const i8));
 10     unsafe {
  9         let symbol = ms_findsymbol(core::ptr::null_mut(), CString::new("_luaL_loadbufferx").unwrap().as_ptr() as *const char);
  8         //let new = std::mem::transmute(&luaL_loadbufferx);
  7         //let new = luaL_loadbufferx;// as *const std::ffi::c_void;
  6         let new: *const std::ffi::c_void = std::mem::transmute(luaL_loadbufferx as *const ());
  5         log::info!("symbol: {:?} new: {:?}", symbol, new);
  4         ms_hookfunction(symbol,
  3             new,
  2             core::ptr::null_mut());
  1     };
81  }

not entierly sure the cause of this issue

[pallid totem]

[cloud yacht]

I can confirm that my new function at least looks like a pointer

ok at this point I want to make sure this actually is possible

[cloud yacht]

ok actually I tried building my test tweak ```objc
#include <UIKit/UIKit.h>
// int (luaL_loadbuffer) (lua_State *L, const char *buff, size_t sz,

%hookf(int, luaL_loadbuffer, void *L, const char *buff, size_t sz) {
NSLog(@"shitass luaL_loadbuffer called with buffer: %s", buff);
return %orig;
}

%ctor {
%init(luaL_loadbuffer = MSFindSymbol(NULL, "_luaL_loadbuffer"));
NSLog(@"shitass Loaded symbol");
}

so maybe simject is being weird

man I need to get my hands on a physical device

[orchid fulcrum]

possible ?

[orchid fulcrum]

also why can't i show my UIWindow above springboard ? tried window levels of 2001 and -5

[thorn hound]

no, it's perfectly normal and acceptable

[hollow oar]

Interesting

[slim bramble]

you should go to hell

dont add rust brainrot onto ios 😭

[pallid totem]

+1

[torn oriole]

Ironic coming from frenchwarez ngl

[manic forum]

i can't believe i'm agreeing with the french

[torn oriole]

No

Don't

[pallid totem]

same

[torn oriole]

There's still time

[pallid totem]

rust bad

[torn oriole]

To turn it on him

[wooden yarrow]

based

[acoustic imp]

OSX-KVM user spotted

[cedar stag]

bro I DO NOT CARE

[native orbit]

fr shit so stupid lmao

[drifting heron]

tweak idea for someone: https://vxtwitter.com/bank5ia/status/1501399537834889217?t=6hsBiOtlcionKTRBw_PmQg

[wind ravine]

i cant seem to get my tweak to run on the sim

even just a simple change didnt work

flex works

what am i doing wrong

[wind ravine]

how did u compile for simulator?

[reef trail]

change iphone to simulator in your target

[wind ravine]

i did

look at my screenshots

[reef trail]

well then you've compiled it for the simulator 🤷‍♂️

[wind ravine]

its not working tho

[reef trail]

did you follow all this? https://github.com/akemin-dayo/simject

[wind ravine]

does the sim need rootless?

[wind ravine]

yes

[reef trail]

should be rootful afaik

make sure to clean when switching between rootful and rootless builds

[wind ravine]

i cleaned and it still isnt working

[reef trail]

i'm not sure then sorry, never used simject

[timid furnace]

did you do resim? did you check console for logs?

[severe stream]

same goes for my side, except the preference bundle isn't showing up anywhere

[wind ravine]

the example tweak doesnt even work

[worn briar]

Trollbox had this and some others have also made methods of doing this

[timid furnace]

did you check console for logs?

[wind ravine]

theres nothing there

no errors or warnings relating to it

[timid furnace]

how did you install simject

[wind ravine]

tje script

[timid furnace]

bruh

[timid furnace]

/opt/simject is basically /var/jb

you put your dylib at /var/jb/example.dylib

[wind ravine]

where was i supposed to put it?

i did what the readme said

[timid furnace]

the script installs a fork of simject and some other stuff

[wind ravine]

yea

it installs flexing and that works

[timid furnace]

this is not normal simject

[wind ravine]

wdym

[timid furnace]

idk what readme you were sent

[wind ravine]

simject readme

[timid furnace]

this is a fork

it turns it into rootless

theres no docs

[wind ravine]

ye

i followed on dinak's repo

[wind ravine]

i set to rootless and it still didnt work tho

[timid furnace]

you need to put it in the proper directory

/var/jb/Library/MobileSubstrate/etc

except /var/jb is /opt/simject

[wind ravine]

o

o wait u are dinak

[timid furnace]

yes

lmao

[wind ravine]

also why is flex select so much worse on the sim than real device

[indigo peak]

@wind ravine
did u use this script?

[wind ravine]

yes

[indigo peak]

@wind ravine

export TARGET := simulator:clang:17.2:14.0
export ARCHS = arm64 x86_64

INSTALL_TARGET_PROCESSES = SpringBoard

include $(THEOS)/makefiles/common.mk

TWEAK_NAME = TestTweak

$(TWEAK_NAME)_FILES = Tweak.x
$(TWEAK_NAME)_CFLAGS = -fobjc-arc

include $(THEOS_MAKE_PATH)/tweak.mk
SUBPROJECTS += $(TWEAK_PREFS)
include $(THEOS_MAKE_PATH)/aggregate.mk

setup:: clean all package
    @echo "Copying files to simulator..."
    sudo cp .theos/_/Library/MobileSubstrate/DynamicLibraries/$(TWEAK_NAME).dylib /opt/simject/Library/MobileSubstrate/DynamicLibraries/$(TWEAK_NAME).dylib
    sudo cp .theos/_/Library/MobileSubstrate/DynamicLibraries/$(TWEAK_NAME).plist /opt/simject/Library/MobileSubstrate/DynamicLibraries/$(TWEAK_NAME).plist
    @echo "Respringing simulator..."
    resim

this is what i use for makefile

make setup

[timid furnace]

use theos fork and make install

or idk

[indigo peak]

your theos fork broke my shit when i tried using it

[timid furnace]

[wind ravine]

how do i get the child of an object?

like i hook to this top class and on a function i want to change a property of its child

[cloud yacht]

I mean we already have some

If it makes you feel better I didn't write most of this code

[fading shell]

subviews?

[wind ravine]

ye

how would i get that

[indigo peak]

.subviews

_UIAnimatingLabel *targetLabel = nil;

for (UIView *subview in self.subviews) {
    if ([subview isKindOfClass:%c(_UIAnimatingLabel)]) {
        targetLabel = subview;
        break;
    }
}

if (!targetLabel) {
    NSLog(@"Failed to find target label.");
    return;
}

[wind ravine]

oh

%c

[indigo peak]

you can use NSClassFromString or objc_getClass as well

[orchid fulcrum]

first time seeing use of fast enumeration 🔥

[wind ravine]

how do u set the frame?

this isnt working

neither does this

[slim bramble]

Which method did you hook?

[wind ravine]

_correctedDateFormat

[slim bramble]

is it even called

[wind ravine]

yes

i fixed it

[acoustic imp]

XY Problem, what are you trying to do

[acoustic imp]

%c() >>>

[radiant idol]

that just resolves to objc_getClass

[reef trail]

yeah but shorter

[wind ravine]

flex on the simulator selects a different view than on real device

[reef trail]

cos the sim isn't 1:1

[acoustic imp]

?

what is your end goal

[wind ravine]

trying to show people how to make basic tweaks

[acoustic imp]

uhm, leave that to nightwind tbh

dont show them cursed code, dont need another me

[wind ravine]

its not cursed

[acoustic imp]

hook didAddSubView and %prop that thang

[worn briar]

seek help

[cloud yacht]

Can you call NSLog/print to the console from raw c?

[native orbit]

yes

[slim bramble]

@hasty ruin send the %property Tesla man meme

[reef trail]

why do you love %prop so much

i hardly use it

actually i dont think i've ever used it

[wind ravine]

what is causing this while compiling for simulator?

works with regular sdk

[reef trail]

share your makefile

you likely need to change latest to the sdk version you have installed

otherwise theos will use xcode's sdk

which obviously wont have the Preferences framework in

[wind ravine]

i dont have an sdk for the simulator

[sonic totem]

There's a Preferences.framework for the simulator (iirc?) in Dopamine

[reef trail]

[wind ravine]

@acoustic imp i think the clock has an update cap

https://cdn.discordapp.com/attachments/809628073896443904/1329130635801006204/Simulator_Screen_Recording_-_jailbreak_-_2025-01-15_at_11.50.19.mp4?ex=678938dd&is=6787e75d&hm=217b8778302a15f42aec48897fb08bade2853a1bb1344e1dcceb602c56dff9d4&

it randomly gets delays, even with the exact time offset

[harsh junco]

Why would anyone want this

[wind ravine]

making it for someone

i think its drifting a little bit

[wind ravine]

i found the issue........

im gonna kms

[cloud yacht]

Would anyone with a jailbroken device, a copy of balatro and some time be able to test something for me?

I belive you get it with apple arcade

[velvet path]

hi

[cloud yacht]

Rootless or rootful?

[velvet path]

14.6 so rootful

[cloud yacht]

ok install this then launch the game

After that see if you can find the mods folder

• You should be able to find it with filza by going in the apps manager, clicking the i beside balatro, clciking Data then Library > Application Support > Balatro (theres a chance its in a different folder like game or love) > Mods.
• You can also find it in the terminal with the command find /private/var/mobile/Containers/Data/Application/ -name lovely after running the game with lovely once

[torn oriole]

You can get it from either Apple Arcade or a standalone App Store app

[velvet path]

this just causes Balatro+ to crash

[cloud yacht]

Crash to home or crash screen

[velvet path]

home

[cloud yacht]

does the mods folder exist?

[torn oriole]

I forget you can crash balatro to a handler

[velvet path]

no

[cloud yacht]

oof

send crash log

[torn oriole]

I'll give it a go on regular balatro in a sec

(Assuming the bundleid is the same ig)

[cloud yacht]

it uses the executable name

so it should be fine

[torn oriole]

Nvm need a rootless build thank

[cloud yacht]

not sure if rootless will work

don't have a rootless test device rn

[torn oriole]

Seems completely inert rn

Game runs and no data has been created

[velvet path]

AA issue probably I assume

[torn oriole]

Mm

[hasty ruin]

I asked French for a deb once and he gave me rootful then went to bed (I needed rootless)

Was faster to fix the Hugo phone and use rootful

[torn oriole]

French moment

[cloud yacht]

If you go to filza app manager hit i on balatro and click bundle what shows up?

[torn oriole]

The balatro data

[cloud yacht]

send screenshot

[cloud yacht]

show indside balatro.app

[cloud yacht]

ok thats named as expected

do you have flexall/flexing installed?

actully idk if that would help

[torn oriole]

@hasty ruin

[torn oriole]

I can grab it

[cloud yacht]

how did you check for the files?

[torn oriole]

Wdym

[cloud yacht]

you said no data was created

how did you check?

[torn oriole]

find and poking through the Balatro bundle

[cloud yacht]

it would be the balatro data but yeah if find didn't find it it's probably not there

[indigo peak]

wtf is Balatro

[cloud yacht]

game

[hasty ruin]

[torn oriole]

Status bar

Resets every respring

[hasty ruin]

Lemme see if my iPad has the bug

[torn oriole]

I’m on 16.3.1

[granite frigate]

chronic balatro addiction has hit me

[hasty ruin]

Are you starting the video in landscape

[torn oriole]

Yes

[hasty ruin]

Bug is present on iPadOS 17

[torn oriole]

Apple moment

[hasty ruin]

swiftui era apple :/

[torn oriole]

Ironically seems to be fixed on iPadOS 18

[velvet path]

doesn't seem to exist on 14

[cloud yacht]

man i have no idea how to get useful info from this

[cloud yacht]

@velvet path can you try with this build and send me the crash?

@torn oriole can you try this build as a sanity check (it should just crash)

[torn oriole]

It does not

[cloud yacht]

:/

which device are you using

[torn oriole]

iPad 8

[cloud yacht]

wonder if it's an arm64e thing

[lusty jacinth]

I bought it a bit ago but everyone who has told me about it is making me scared to play

[granite frigate]

dude do not fucking play it

i have destroyed my productivity

like at first ur like

ok this is pretty fun

then you get addicted and spent the next 3 hours on it

[wooden yarrow]

legal mind drugs

[cloud yacht]

@velvet path are you by any chance able to install cr4shed and get me a crash log from that?

[reef trail]

#development message

[cloud yacht]

this is a analatics log not a cr4shed log

[reef trail]

does it matter

cr4ashed just formats it, no?

[cloud yacht]

it puts more useful info in it

[reef trail]

lazy

what info do you need

[cloud yacht]

like what function its crashing in

[reef trail]

0   liblovely.dylib                   0x000000010571c33c 0x105714000 + 33596
1   dyld                              0x00000001011db880 0x1011c0000 + 112768
2   dyld                              0x00000001011dbc84 0x1011c0000 + 113796
3   dyld                              0x00000001011d5a8c 0x1011c0000 + 88716
4   dyld                              0x00000001011d3960 0x1011c0000 + 80224
5   dyld                              0x00000001011d3a2c 0x1011c0000 + 80428
6   dyld                              0x00000001011c686c 0x1011c0000 + 26732
7   dyld                              0x00000001011cef70 0x1011c0000 + 61296
8   libdyld.dylib                     0x00000001a65f3f60 0x1a65ed000 + 28512
9   TweakInject.dylib                 0x0000000100f3a9ac 0x100f34000 + 27052
10  dyld                              0x00000001011db9fc 0x1011c0000 + 113148
11  dyld                              0x00000001011dbc84 0x1011c0000 + 113796
12  dyld                              0x00000001011d5a8c 0x1011c0000 + 88716
13  dyld                              0x00000001011d3960 0x1011c0000 + 80224
14  dyld                              0x00000001011d3a2c 0x1011c0000 + 80428
15  dyld                              0x00000001011c292c 0x1011c0000 + 10540
16  dyld                              0x00000001011c8550 0x1011c0000 + 34128
17  dyld                              0x00000001011c1258 0x1011c0000 + 4696
18  dyld                              0x00000001011c1038 0x1011c0000 + 4152

my guess is that 0x000000010571c33c 0x105714000 + 33596 is the crashing line

[cloud yacht]

ok wait how does arm64e work?

do I need to build seperatly for it?

[reef trail]

the roothide thing or apple's?

[cloud yacht]

apples

[reef trail]

no

its an abi

theos handles it all for you

[cloud yacht]

I'm not using theos

[reef trail]

what are you using

https://theos.dev/docs/arm64e-deployment

might help you

[cloud yacht]

rust

[reef trail]

uhh

https://doc.rust-lang.org/nightly/rustc/platform-support/arm64e-apple-darwin.html

[cloud yacht]

I know I just rebuilt rust from source on a 2011 mac

[reef trail]

wait nvim @cloud yacht use this one https://doc.rust-lang.org/nightly/rustc/platform-support/arm64e-apple-ios.html

didnt realise they had it

[cloud yacht]

yeah right that one

[radiant idol]

cr4shed doesn't really work properly on iOS 15+, just use the OSAnalytics tweak on PoomSmart's repo alongside KrashKop to produce VERY similar results

[cloud yacht]

@torn oriole are you able to give this build a try

[reef trail]

and then for arm64 use aarch64-apple-ios

[cloud yacht]

Yeah thats what I was using before

which is why it worked find on my device

[torn oriole]

Sure gimme a sec

[slim bramble]

is this your new rust bull shit

[cloud yacht]

Yes

[slim bramble]

When are you coming out ?

[ocean raptor]

Hey bros

[slim bramble]

Hello Cameron.

[ocean raptor]

Who are you? Everyone in this server changes there name every 2 weeks so I can never remember who people are

[kind herald]

ipod

[slim bramble]

rootfs

[ocean raptor]

Ok maybe I just don’t know you lol

[cloud yacht]

Of what?

[pallid totem]

hes the frenchie

maybe that helps u

[acoustic imp]

Bibifire*

[cloud yacht]

Is that a valve second?

[pallid totem]

yrs

[torn oriole]

My fault I had to go places and forgor

Will try in like 20m

[cloud yacht]

🙏

it's okay I got busy anyways

[cloud yacht]

@torn oriole When you got a moment you can try this build it should be universal

[torn oriole]

still seems to do nothing to balatro

[cloud yacht]

do the file exist?

#development message

[torn oriole]

nope

no find results either

[cloud yacht]

does this build work? #development message

[torn oriole]

no

[cloud yacht]

at this point I almost wonder if I somehow fucked up the dylib path

[torn oriole]

same behavior

[cloud yacht]

run find / -name liblovely.dylib

[torn oriole]

theyre in the appropriate places

arent you supposed to be filtering for bundles

since when could you filter just raw executables

[cloud yacht]

Eliza does

but executabnle nicer cause any rajndom love app shoudl get targeted unless they rename the execuable like balatro

I'm so confused why it isn't hooking

whats the result of running ls -l /var/jb/Library/MobileSubstrate/DynamicLibraries/liblovely*

[torn oriole]

both files are there

[cloud yacht]

what do the perms look like

wondering if that could somehow be an issue

(even though it doesn't seem to be on rootful)

[torn oriole]

well i changed their perms to root:wheel like theyre apparently supposed to be and it didnt change anything so

[cloud yacht]

I will havbe to see about making sure those are root wheel but for now ¯_(ツ)_/¯

I wonder if it is something with how rootless works

it sucks I don't have a test device rn

there isn't a rootless iOS 14 jailbreak is there?

[radiant idol]

no

[ocean raptor]

Balatro mods??!!

I am addicted to Balatro

I wonder if supercharge can inject into Apple Arcade apps…

[cloud yacht]

yes

it works on the steam version already

also I do belive this is a rootless issue

I think it's using a hard coded path for substraight

[ocean raptor]

Yeah I saw that desktop Balatro has mods, cool that you got it to work on iOS

[cloud yacht]

well it doesn't seem to be working too well

[ocean raptor]

Are all Balatro mods written in lua? So only the injector needs to be ported?

[cloud yacht]

crashes uniexpicably on rootfull and does nothing on rootless

[cloud yacht]

Yeah pretty much

also I bet this is the issue

[ocean raptor]

Send your GitHub

I wanna see how this works

[ocean raptor]

Do you have crash logs?

[cloud yacht]

#development message

[cloud yacht]

https://github.com/WilsontheWolf/lovely-injector/tree/ios

[ocean raptor]

Tell bro to delete all his other tweaks lol

[cloud yacht]

true

[ocean raptor]

Does this thing support macOS?

[cloud yacht]

the steam version yeah

app store doesn't work due to build differences

the ios fork might work with ellekit mac

[ocean raptor]

Ok, so I guess the question is, what is different between the lua in steam and App Store versions that would cause injection issues

[cloud yacht]

lua is statically linked on app store dynamically linked on steam

[ocean raptor]

I’ll have to look at how this lovely injector works

But I’ll have to look at the code on my computer screen, cause my phone screen is not cutting it

[cloud yacht]

yeah makes sense

I would look at the upstream code if I was you mines a mess and guts a lot of the injecting stuff

[ocean raptor]

That’s a big difference

What lua version?

[cloud yacht]

luajit

5.1 iirc

[ocean raptor]

iirc luajit only supports 5.1, cause the author didn’t like the newer version lol

I wish I had a Mac lol

Does Balatro+ work on Intel Mac?

[cloud yacht]

¯_(ツ)_/¯

the balatro mods also work on the windows version of balatro

[velvet path]

just says requires macOS 11.0 or later

[ocean raptor]

I don’t own Balatro, I have it from Apple Arcade

Is signing into my iCloud account on a hackintosh to install Apple Arcade games a bad idea?

[cloud yacht]

¯_(ツ)_/¯

[ocean raptor]

Actually I’ve got some palera1n compatible devices

[cloud yacht]

I somehow broke the building

its just stopped making the dylib

idk how I managed that

[native dune]

as long as you've set up a proper smbios it should be fine

[cloud yacht]

I forgot to save the file

[cloud yacht]

@torn oriole when you got time

Also rootful build since a lot has changed

[lusty jacinth]

substraight 🗣️

[kind herald]

As long as your serial number shows up as whatever dortania’s guide recommends you’re fine

I’ve never gotten executed by Apple for signing into a hackintosh when doing it right

[slim bramble]

me when substract address with aslr

[slim bramble]

@hasty ruin tell him

[ocean raptor]

Real

I guess I need to actually learn rust

[manic forum]

[acoustic imp]

CC @sonic totem

[ocean raptor]

I’m going to learn as little rust as possible

[manic forum]

this is what i said when i started using kotlin a week ago

kotlin is nice but i hate everything about android

this was unrelated to anything about rust i'm just generally unhappy about having to write android code

[slim bramble]

2 coming outs soon in rjb

[wooden yarrow]

fire

[harsh junco]

@wooden yarrow when are you coming out

[manic forum]

hey @slim bramble

have you seen miside

it's a very fun and enjoyable game you'd definitely love

[harsh junco]

Or are you a hidden/secret trans

[manic forum]

you said you loved russian anime games right

[wooden yarrow]

if i would have came out i would have done so like 4 years ago

[olive peak]

Has anyone here used lief to add a custom segment to a MachO Bin? I am trying to do so. However when branching to the new segment (which has rwx perms) the program crashes from a bad access exception with error code 2 and i cant figure out why

[ocean raptor]

You can’t have W|X

Because of W^X

[faint timber]

You need to set it up as rw, when you are done writing, changes perms to rx

[indigo peak]

Why did you ping Alfie with the message “control center”

[pearl sail]

Fucking Android development is so ass idk why people want to develop for it

[orchid fulcrum]

for real

the project structure and gradle is crazy

mfw src/main/java/com/whaterver/whatever

[olive peak]

Thanks a lot!

[orchid fulcrum]

also you wanna use c instead of java ? good luck

[ocean raptor]

[pallid totem]

i wanted to learn rust but i didnt slowly want to turn into that so i didnt

however i made my first rust app so im automatically a coming out now

[wind ravine]

trying to install this on second macbook, it keeps saying failed to install simject, no such file or directory for cp /usr/local/bin/resim

[manic forum]

android studio hides that so it isn't that big of a deal

but it's still annoying

[manic forum]

ikr

so i wanted to make an app with a bottom navigation bar right

on ios you just create a uinavigationcontroller, put view controllers in it and boom bottom navigation bar / tab bar

from what i understand you're expected to instantiate the bar and manage the transitions yourself

and it's really annoying

i'm sure there's a good reason behind these design choices but based on my current knowledge it all seems annoying

[wind ravine]

nvm im stupid

[cloud yacht]

Does ellekit have some debuggijg stuff to see if a tweaj is being loaded?

I know libhooker logs each tweak it injects

[slim bramble]

yeah by default it prints out Loading tweak {name}...

I'm pretty sure

or maybe that's only LH

[cloud yacht]

Not sure I didn't think I saw it in simject. I can ask my tester to give it a try after

[slim bramble]

What are you even doing

😭

Trying to get orange name ?

[cloud yacht]

Trying to debuf why it's not doing anything in rootless

[ocean raptor]

why do you want to debuff it?

[cloud yacht]

cause I can't spell

[acoustic imp]

Like CC email thing

[indigo peak]

Adobe creative cloud?

That cc?

[acoustic imp]

https://cdn.discordapp.com/emojis/1165545028215644261.webp?size=60&quality=lossless

[indigo peak]

https://github.com/EthanArbuckle/simforge

[acoustic imp]

Oh just delete that part in the script

Then compile resim and make an alias and point it to the exec

[indigo peak]

pint

[acoustic imp]

@indigo peak what happened with 18cc an 16p ?

[indigo peak]

shit tweak

that’s what happened

[acoustic imp]

18cc ?

I haven’t speant much time on making it “work”

[indigo peak]

use your thinking cap

[acoustic imp]

I’m in England atm

Not at home

Mac book proly dead

oh well

[orchid fulcrum]

its shit anyway why backport

[acoustic imp]

I’m not back porting the shit pages

[cloud yacht]

does anyone have a A11 or lower rootless jailbreak that would be willing to test smth for me

[faint timber]

sure

[cloud yacht]

okay do you own balatro?

[faint timber]

no... so nvm I guess

[cloud yacht]

No that's fine I have a test IPA as well

[faint timber]

🅱️iracy

[cloud yacht]

no it's a love project i built

same engine

https://cdn.discordapp.com/attachments/1288906099180699661/1293362453496991765/lovely-test.ipa?ex=678b97e6&is=678a4666&hm=761affe95644572cbdf612160cadb68b4c25b4462009908bfe36c8933d0e2dcb&

install these and then open the app and send me a screenshot

[cloud yacht]

@faint timber

[ocean raptor]

How do I decrypt an app lol

[reef trail]

use trolldecrypt or smth

[ocean raptor]

Send apt repo

[acoustic imp]

Google:

[ocean raptor]

Nvm I figured out what trollstore is

[faint timber]

If you want to decrypt all the plugins and frameworks you will need frida + bagbak

[ocean raptor]

I only needed the main binary decrypted

[proud geyser]

is it possible to save safari private windows cache through extensions?

in a file and then load the same cache through extension at later time

[indigo peak]

How Tesla felt saying this instead of someone saying it to him

https://tenor.com/view/dog-mask-gif-10635347690073820963

[placid kraken]

LMAO

[ocean raptor]

this won't work btw lol

[cloud yacht]

Why not?

[kind herald]

Because u stink

[ocean raptor]

because MSFindSymbol can't find stripped symbols

[cloud yacht]

They aren't stripped?

Well they could be for baaltro possible and if so that'd rough

But that IPA isn't cause I've been using it on my machine

But even then it should crash instead of just doing nothing?

[ocean raptor]

ellekit MSFindSymbol is bugged I think lol

[cloud yacht]

Oh possibly

I'm using libhooker locally

[ocean raptor]

I think it gets stuck and watchdog kills it

[cloud yacht]

Hmmm well I've been reported nothing happening

Not even in thing making its logs directory which should happen before it's hooking

I'm not sure if it's a rootless or an arm64e thing

(Or something else)

[acoustic imp]

https://tenor.com/view/druski-gif-18348698948575815487

[ocean raptor]

Time to write a symbol finder

[ocean raptor]

@grave sparrow have you written anything that scans live code pages to get a symbol based off of some sentinel instructions?

[indigo peak]

funny enough gameseagull has a patch finder which might be helpful

https://github.com/donato-fiore/GameSeagull/blob/40543762420adf6a6607c6dc1c804396db21ba34/Utils.m#L5-L26

that's a modified version just to scan until it finds a function

[ocean raptor]

What does bh_ stand for

[indigo peak]

Boyer–Moore–Horspool algorithm

[robust radish]

I use capstone when I have to do this

[ocean raptor]

Seems pretty heavyweight for what I need lol

I’ll probably just end up using memmem()

[indigo peak]

is the bh algorithm too much too?

or not what ur looking for?

[robust radish]

Its probably the most lightweight disassembler library that exists (that’s worth using)

assume you only need 1 arch; you would just build the lib with arm64 support

[ocean raptor]

Yeah I only need arm64 so I’ll just embed the bytes I need directly

[robust radish]

I’m usually aiming for precision mnemonic and operand parsing / identification. if memmem gets it done then why not

[indigo peak]

i've only had to do that once, for TweakInspect-IDA, but i just used ida's api

[robust radish]

Ih8sn0w’s iBoot patch finder is a good reference for that type of resolution

Nice. I’m only slightly side eyeing you for coupling a purposely disassembler-agnostic tool to a specific disassembler backend

I added my version of the Ida script to the repo

[robust radish]

minimal usage example. try it, it’s cool https://github.com/EthanArbuckle/crashreportdetails/blob/main/Tweak.x#L125-L132

[faint timber]

what capt said + you literally need to fakeroot when building the deb why are you not using theos?

not only is your deb packaged as mobile user, its not even codesigned...

tf u doing lol

wtf is mobile:wheel

[proud geyser]

is this possible anyone????

please

[ocean raptor]

Capt?

[faint timber]

discord bug dw

[cloud yacht]

Heres the neat thing, I unfortuantly have to use rust for this, so I can't (don't know how) to get theos to build it. I just kinda read the docs for deb files and looked at one theos made and wrote a shell script to build the deb file. Can I use theos to package it for me without building? Also yeah I should code sign it

Also should I fake sign each slice or just the combined binary?

[native orbit]

ldid will handle the slices

[cloud yacht]

okay

how can I tell if ellekit is injecting my tweak?

[faint timber]

what I mean by theos is dm.pl

[cloud yacht]

I crashed it using flex and I don't see my dylib in the list of images

[cloud yacht]

Wasn't aware of it. Looks useful https://theos.dev/docs/dm.pl

[faint timber]

this is how I would fix it

[faint timber]

fyi its just a "dpkg-less" version of dpkg-deb

[cloud yacht]

Okay sweet thanks

This is what I was doing https://github.com/WilsontheWolf/lovely-injector/blob/ios/crates/lovely-ios/build-deb.sh

will tweak it

I manually fixed the perms and fake signed it on my iPad and it just doesn't seem to inject at all

like it should be creating a file for logging in the apps sandbox

but it's just not

oh wait is that the wrong path?

seems it is symlinked so probably not an issue

[faint timber]

jailbreaks have used usr/lib/TweakInject/ for a long time(early coolstar jailbreaks) since rootless just uses ellekit, /var/jb/usr/lib/TweakInject/ is fine

might be better to keep the og now that I think of it

[cloud yacht]

Ok I modifed it, it shold be packaged correctly and fake signed. However, it still seems to have no effect on rootless (but works fine with rootful)

It should upon injection of any process make a folder at /Library/Application Support/game/Mods/lovely/log in the processes sandbox and write logs into this file. However running a quick find on my iPad doesn't find said folder (and manually going to where I know it should be I can't find it)

as a sanity check I cleaned any old folders that matched from some testing of stuff a while back, user space rebooted then launched my target app.

nothing

Tried forcing it into a process and i think I did something wrong

I must've done my rpath wrong

[faint timber]

yah cuz thats literally not rpath bruh

why not just have rootful and rootless use rpath

[cloud yacht]

idk I had issues with it on rootful (didn't have my rootless test device at the time) and so I just left rootful as it was

I think I have been specifiying rpath wrong this entire time and since I didn't have a rootless test device I just didn't realize

well hmmmm it complains if I change it to not be rpath

so something is accepting it

and it's now injecting

man

thanks for the help

[faint timber]

your substrate tbd probably is hardcoded, modify it to rpath @cloud yacht

[cloud yacht]

nah it's fine

I'm using the rootless one

I jsut passed the wrong args to the compuler

[faint timber]

yah its clang linker flag not clang

[cloud yacht]

I may be stupid

To be fair I've never done more for compiling a rweak than make package before

[faint timber]

start with the basics lol

[cloud yacht]

as the saying goes, "I did this not because it was easy, but because I thought it would be easy"

[orchid fulcrum]

why are you using rust anyway

[icy escarp]

um how do i assemble a literal pool style ldr instruction for arm

like a pc relative load

ldr x14, [pc, #8]

also seen it like ldr x14, =0x1234123412341234

[wooden yarrow]

https://developer.arm.com/documentation/100069/0606/A32-and-T32-Instructions/LDR--PC-relative-

for arm64 it would be https://developer.arm.com/documentation/100069/0606/Data-Transfer-Instructions/LDR--literal-

[tawny river]

does anyone know why GIR just dies if you try to add a new tag?

example of a failed command

[harsh junco]

Why root

[tawny river]

its not really important for me what it runs on as its on a shitty linux vps for that bot specific anyway but may that hint to the actual issue causing it?

[sonic totem]

What is code 257?

Thread 1: EXC_BAD_ACCESS (code=257, address=0x10367e174)

[wooden yarrow]

appears to be (EXC_MASK_BAD_ACCESS | EXC_MASK_MACH_SYSCALL)? edit: nope, see my message below

[sonic totem]

Yep, seems to be, ty

I don't think the code actually matters but

I was running out of ideas

I only get the bad access if I do the write in assembly, whereas if I do it in C it just hangs lol

[wooden yarrow]

nope, apparently it's not

upon further research that's not how those codes work

so i did some further research and got EXC_ARM_DA_ALIGN for 0x101

@sonic totem "EXC_ARM_DA_ALIGN: The crashed thread tried to access memory that isn’t appropriately aligned. This exception code is rare because 64-bit ARM CPUs work with misaligned data. However, you may see this exception subtype if the memory address is both misaligned and located in an unmapped memory region. You may have other crash reports that show a memory access issue with a different exception subtype, which are likely caused by the same underlying memory access issue."

[sonic totem]

Yikes

Type of stuff that happens when I write an exploit ‼️

It’s a really cursed issue but I think the AMCC rejects the write or something

[wooden yarrow]

hm

[sonic totem]

Because I’m trying to write to kernel __DATA

Which is mapped as writable

And it’s in my page table

[wooden yarrow]

#779151007488933889 message also siguza mentioning the planes that i found lol

[wooden yarrow]

hm

[sonic totem]

But then staturnz managed to write to __DATA with the exploit so it’s definitely my issue lol

This is with KPP even so KTRR won’t stop me

[wooden yarrow]

"located in an unmapped memory region" makes me think ur pagetables might not be working right but idk

[sonic totem]

It lets me read them

Just not write

Okay now I get error code 2

...and now back to the hang

Oh well, I'll find a way

[wooden yarrow]

KERN_PROTECTION_FAILURE

[sonic totem]

Yeha forgot VM_PROT_WRITE

[stray viper]

Can anyone compile jitterbugpair for arm64 Linux please?

[hollow oar]

https://github.com/nythepegasus/StaticJitterbugPair

[stray viper]

Are you sure it’s compiled for arm?

[hollow oar]

It’s a static build

[stray viper]

Will try building it then

[drifting heron]

TrollBox and others don't allow animated images

[cloud yacht]

Porting a rust project to ios

[stray viper]

Doesn’t work and doesn’t compile

[hollow oar]

show

Plus, there’s already a build in GH actions

[stray viper]

Wdym show

[hollow oar]

Show output/terminal

[stray viper]

Even if I run the precompiled binary it just says illegal instruction

[stray viper]

It just says illegal instruction

[hollow oar]

Do you have libc installed?

[stray viper]

I installed libc-dev in apt

So I guess so

[hollow oar]

Is usbmuxd running

[stray viper]

Umm

I don’t think so

[hollow oar]

Then start usbmuxd

Do you even have usbmuxd installed?

[stray viper]

I do but how do I start it?

[ocean raptor]

systemctl

[stray viper]

Doesn’t work it wants to be run through systemd

[hollow oar]

systemctl is part of systemd

It’s the core component

Do you not have systemd?

[stray viper]

Uhh wait I think I need to run it as sudo

Nvm seems like it’s a problem with my terrible Linux environment

[hollow oar]

Skull

What distro are you using

[stray viper]

Oculus os with a Ubuntu environment running inside it

Told you it was terrible

[hollow oar]

Crazy

Bloatware distro

[acoustic imp]

@warped sky

^

[icy escarp]

What’s the machine code for that kind of instruction? Armconverter and capstone can’t figure it out… I also need to control where the literal is stored.. thinking it’s gonna be an ldr and a jump, then 8 bytes of address

[cloud yacht]

@torn oriole Would you be able to give this build a try for me and see if it gets a crash log (or somehow doesn't crash)

https://cdn.discordapp.com/attachments/1324835018299670558/1330117007735259188/systems.shorty.lovely-injector-0.6.0-iphoneos-arm64.deb?ex=678d783f&is=678c26bf&hm=08124436606201ae7a637ec8133903ec71c3e69eeec5ca6bf8ba95a17058c118&

[indigo peak]

?

[icy escarp]

Now try 64 bits immidiate

It translates to ldr x?, #4

[indigo peak]

have you consulted a generative language model?

[warped sky]

🤝💛

[ocean raptor]

Can we get #quickactionsforsileofeatured trending?

[timid furnace]

[faint timber]

it definitely injects and doesn't crash

[cloud yacht]

For the lovely test?

Yeah it is confirmed working

But i had a tester who ran it on balatro and it crashed but they didn't get a log

[faint timber]

but lovely test is broken

[cloud yacht]

Was hoping it was either a fluke or I could get a log

[faint timber]

it spam flips orientation making it so I can't go to home screen

[cloud yacht]

thats a new one

[faint timber]

must be a one off

can't reproduce

[cloud yacht]

I don't know what I would be doing that could cause that

[faint timber]

maybe its a skill issue on tester

[cloud yacht]

I'm kinda hoping so

but it could be build difference causing weird issues

[faint timber]

have you confirmed the dylib is actually injected on their end

[cloud yacht]

yeah it's making logs now

seems to be crashing finding the symbol for _lua_loadbufferx

(not _lua_loadbuffer)

removing the second hook doesn't seem to effect the game (though it works fine without it for the test app)

[faint timber]

you might want to try using the image param for msfindsymbol

[cloud yacht]

not sure what i would even give to it

but my tester did report it being really slow to load so if it is searching all images that could maybe be the cause of that

[faint timber]

literally read substrate docs

[cloud yacht]

I mean how do I know which image has my symbol

[faint timber]

there is another substrate function to grab an image pointer of course

[cloud yacht]

yeah I found this https://www.cydiasubstrate.com/api/c/MSGetImageByName/

but the issue is I don't know what the name of the image with my symbol would be

or how to find it

I do have a debugger attatched

[faint timber]

well is it in main binary?

[cloud yacht]

probably

[faint timber]

nm binary | grep _luaL_loadbufferx

[cloud yacht]

yeah the symbols showed up

so can I just get my argv and pass it to MSGetImageByName?

[faint timber]

probably not

something like ns main bundle executable is better

[cloud yacht]

great now i get to learn how to call obj c from not objc code

now is not the time for that though, Im going to sleep

[faint timber]

oh I forgo

theres a way easier way

[faint timber]

int image_index = -1;
for(int i = 0; i < _dyld_image_count(); i++) {
  if(strstr(_dyld_get_image_name(i), "Balatro.app/balatro")) {
    image_index = i;
    break;
  }
}
if(image_index < 0) {
  printf("Failed to find image: (Balatro.app/balatro)!\n");
  return;
}

obviously replace with the actual app name

[cloud yacht]

Okay

I'll have to adapt it to work with multiple different image names but that shouldn't be too hard

[faint timber]

then you call dyld get image name with the index

[faint timber]

.app might work unless the dumbass app hosts .app's inside the .app...

highly unlikely so should be safe enough

[cloud yacht]

I think it should be okay

[faint timber]

strstr(_dyld_get_image_name(i), ".app/");

[cloud yacht]

man it would be nice if I had a copy of balatro to test on

[faint timber]

^

[acoustic imp]

[tawny river]

real

[icy escarp]

Dladdr should work well

You can dl_frame or something like that

*fname

[native dune]

Apple Arcade free trial?

[acoustic imp]

@indigo peak does flex work in apps in the sim ?

[harsh junco]

How tf am i supposed to build apple-oss-distributions/Security when there is no xcode project

[pallid totem]

How tf am i supposed to build apple-oss-distributions/Security when there is no xcode project

[indigo peak]

haven’t tested it

[acoustic imp]

It does, libflex just wast being injected

[cloud yacht]

Someone with interest in the project has purchased an iTunes gift card for me to get the game (but it is stuck in limbo rn)

[acoustic imp]

😭, ask that one guy on twitter

The Apple TV guy

Flex3 beta or wtv guy

[wooden yarrow]

https://x.com/ryanchenkie/status/1880730173634699393 rare mac malware occurance

Ryan Chenkie (@ryanchenkie) on X

⚠️ Developers, please be careful when installing Homebrew.

Google is serving sponsored links to a Homebrew site clone that has a cURL command to malware. The URL for this site is one letter different than the official site.

X · Jan 18, 2025, 9:33 PM

[torn oriole]

I think they've since resolved this

Can't seem to see the sponsored url

[lean ember]

Anyone here experienced wit Xcode and xnu?

[reef trail]

am i tripping or are those urls the same

except the www prefix

[thorn hound]

weird google ad thing

it went to brewe.sh (the one with malware)

[reef trail]

why is google hiding the real url

or is this some xss exploit or smth??

[thorn hound]

lol

[timid furnace]

https://agora.echelon.pl/notice/AqFeAnRZ4GStl0lfjE

how is this allowed??????

Note: Google allows the ad sponsors to specify an URL that will be displayed on the ad (original brew.sh here), but the click takes you to the malware domain brewe.sh.

That's how Google ads work because there are often tracking links. Google will audit this within 24 hours of links being changed but it was likely an established account that got hijacked with these 2fa spam messages

:/