#development

1 messages · Page 226 of 1

reef trail
#

surely they could just hide the path

robust radish
#

Yes

cloud yacht
#

Ok bad news I got balatro now and uhhh

faint timber
#

that means its statically compiled in @cloud yacht

#

and likely stripped

cloud yacht
#

yipped another hurtle I need to jump over

faint timber
#

just need to write a patchfinder

cloud yacht
#

So what would that basically just be the replcemenet for MSFindSymbol?

faint timber
#

not at all?

#

its stripped

cloud yacht
#

Okay so are there resources on patchfinders?

timid furnace
#

generally these are all custom designed

#

first figure out what you're looking for in your stripped binary

#

then find markers that will help you find that location programmatically

#

usually people look for references to a string

#

so you find the location of the string, then you find where that location is referenced

cloud yacht
#

okay

timid furnace
#

in other cases the search is for a specific instruction sequence

#

but first you need to identify what you need to find first

#

im assuming its a specific function

cloud yacht
#

yeah 2 of them

faint timber
#

its open source btw @cloud yacht

cloud yacht
#

the engine is yeah

indigo peak
#

@cloud yacht for gameseagull i used a memmem 'fork' that looks 1 method instead of the whole binary to search for mov w8, #0x42700000 which is the stock instruction for the cheat

cloud yacht
#

I'm trying to find whetre the function is

faint timber
#

here is luaL_loadbuffer for arcade

#

sub_10012C258

#

the easiest way to patchfind this is memmem for the =[love \"arg.lua\"] string,
find the xref,
then search for the first bl instruction after the string xref,
lastly resolve the bl to address

cloud yacht
#

oh intresting

#

I'm not sure if loadbufferx is actually nessicary

#

so I would have to use #development message to find the correct image, then use memmem on the image to find the string, then from that fnd the instruction I desire, then resolve it's pointer, which I can pass to MSHookFunction?

faint timber
#

but its safer to just find the image on both regardless

cloud yacht
#

For some reason balatro just crashes on launch for my rootful device and no point writing 2 different implementations

#

Oh yeah I forgot theres a bunch of symbols the tool uses but doesn't patch

#

Although methrul said we can probably just include our own lua and use it's functions for that

#

I'll see how much work finding all those symbols would be

#

Given functions:

  • lua_call
  • lua_pcall
  • lua_getfield
  • lua_setfield
  • lua_gettop
  • lua_settop
  • lua_pushvalue
  • lua_pushcclosure
  • lua_tolstring
  • lua_toboolean
  • lua_topointer
  • lua_type
  • lua_typename
  • lua_isstring
#

but for now I'll just worry about the one's im patchijng

cloud yacht
#

it's not even a tweak thing I don't thiml

faint timber
#

how did you install the app

cloud yacht
#

App Store

faint timber
#

well it tells you why

cloud yacht
#

yeah but i don't know how I would fix it

faint timber
#

you can't easilly unless you patch the app binary itself

cloud yacht
#

yeah not sure how they managed this

faint timber
#

you are just gonna have to disable all calls to ads

#
optool uninstall -p "/System/Library/Frameworks/AdServices.framework/AdServices" Balatro -c LC_LOAD_DYLIB
timid furnace
#

it's prob better to create a stub framework

cloud yacht
#

Ok wtf I am trying to compile a theos project and it's failing with
libfakeroot: connect: Permission denied

#

It's also spewing a bunch of warnings(?)

cloud yacht
#

this is linux

faint timber
#

interesting

cloud yacht
#

what's it connecting to?

#

some kind of daemon?

faint timber
#

are you running native linux

cloud yacht
#

yeah

#

fakeroot is from the system as far as I'm aware

#

fedora 41

#

I probably upgraded from 40 after the last time I ran theos on here

ocean raptor
ocean raptor
ocean raptor
faint timber
#

wait so apple just lets jitted lua on their appstore?

ocean raptor
faint timber
#

but the premium app isn't arcade

ocean raptor
#

Hold on, the jit is disabled on iOS

faint timber
#

how does the lua execute then

ocean raptor
#

Interpreter

#

Luajit has both a jit and interpreter

#

Note: the JIT compiler is disabled for iOS, because regular iOS Apps are not allowed to generate code at runtime. You'll only get the performance of the LuaJIT interpreter on iOS. This is still faster than plain Lua, but much slower than the JIT compiler. Please complain to Apple, not me. Or use Android. :-p

faint timber
#

ah

acoustic imp
cloud yacht
cloud yacht
#

So what is the correct way to get the memory location to search for patch finding? Should i be relying on the result of MSGetImageByName, should I dlopen it with RTLD_NOLOAD (does that matter) and then use the result or is there some other way?

icy escarp
#

i like to use dladdr, it can return the base address of the binary youre targetting

orchid fulcrum
wooden yarrow
placid kraken
#

tsoding does the most cursed shit

reef trail
#

any idea how to tell lldb where my dsc is stored? and what format the dsc needs to be in?

worthy mulch
#

Where do I get developer disk images for frida from Linux for iOS after 17.0.1+ ?
I'm trying to use frida as injected on a jailed device

reef trail
stray viper
#

They are personalised or something

#

They have to be generated for your device by Xcode

#

That only applies for iOS 17+

reef trail
#

yeah but i didnt have to do that for using frida

#

i dont even own a mac

reef trail
worthy mulch
#

so if all I have is linux?

#

that probably means that I'll be unable to connect to a running app, unless I get the app's pid somehow, which I dont' know how to do without trollstore or jb utilities

reef trail
#

i'm on linux too

#

oh you're unjailbroken

#

yeah idk then

#

sorry

stray viper
#

Or hackintosh your machine lol

reef trail
#

i'm using a vm for unrelated reasons, its quite easy to setup

worthy mulch
#

but then how would I be able to generate the customized disk images? currently, i've been using a monterey vm on a proxmox cluster, but that server died over winter break

stray viper
orchid fulcrum
#

this is for lldb rather than frida but the script itself may help for whatever you are trying to do (also prints the PID)

#

afaik you dont really have to "get" the ddi to connect via a debugger, once you mount it its enough
python -m pymobiledevice3 mounter auto-mount
which this should do

worthy mulch
marsh ocean
#

how do i fix this

#

(ubuntu server)

cloud yacht
#

the pipe to a file isn't running as root since your shell is handling it

marsh ocean
cloud yacht
#

you can probably just run sudo -s to give yourself a root shell then run it, or write somewhere your user can access

marsh ocean
#

ookay

#

thanks'

#

how would i use rm to delete all files and folders in a directory except a specific folder

cloud yacht
#

give it all the files in the folder other than the specified folder

#

you probably could use find with exec

marsh ocean
#

i figured it out

#

i had to do shopt -s extglob to enable extglob then do (while in the parent folder) rm -rf !(folder_name_i_want_to_keep)

robust radish
reef trail
#

i have a local copy of my dlc tho

icy escarp
#

Can use the dopamine fakeroot feature on my own tweaks? Is there a method for that or do I have to make a custom build?

#

Want my dylibs to look like they’re coming from a trusted path

orchid fulcrum
robust radish
#

you could patch and rebuild lldb, hardcoding your local cache path

there’s probably an easier way, but I didn’t see it when skimming around the repo

grave orchid
#

How do I install tailwind css

pallid totem
orchid fulcrum
#

you could patch and rebuild lldb, hardcoding your local cache path
@reef trail there you go, no idea where you would find the original path though. I am glad i got a mac instead of dealing with all this tbh

grave orchid
#

I tried

#

Using npm

#

Wait

#

I’m using windows on arm

tepid olive
#

just html

grave orchid
#

Yeah

#

But i need tailwind

#

That sit

tepid olive
#

u can use the tailwind play cdn

#

just import it with script src

#

no build step needed

#

this is the most user friendly way to use tailwind

#

@grave orchid it work?

grave orchid
#

Dunno

#

Oh

#

Import with script

#

Oh

tepid olive
#

add to the head

grave orchid
#

Oh

#

im gonna profit off of this

#

like this?

tepid olive
#

precisely

#

@grave orchid how are you seeing your changes though

#

do you have live server extension on vscode

grave orchid
#

I have that on my main machine

#

but not here

tepid olive
#

are you just opening the index.html everytime u make a change

grave orchid
#

yes 💀

tepid olive
#

oh get the extension

#

it will save a lot of time

#

whatever number it gives u

ocean raptor
#

@robust radish holy crap capstone docs suck

#

I finally figured out how to get this to work again lol

#

only took an hour and a half lol

robust radish
ocean raptor
#

took me 50 minutes to realize that address meant whatever the virtual address of the instruction is, not what location I want to start disassembling within the code buffer

#

lol

robust radish
#

yeah that’s fair

grave orchid
#

So do I do this?

ocean raptor
#

symbol finder done

#

now I just need to make it so that it will run at runtime correctly, but that's for tomorrow me lol

tepid olive
#

no npm needed

pastel dome
#

I don't recommend the script if you gonna make it in production

#

The node package should dynamically create a css only of the classes you use

exotic spire
#

Or whatever your manager is

#

in my case it was vite build iirc

pastel dome
#

Yes... There is a script src too that brings the entire tailwind into one file and it's heavy af.. I'd avoid that @exotic spire

exotic spire
pastel dome
#

Yes.. but am not talking about the build tho

#

And building only uses the classes you use

#

It's dynamic

exotic spire
#

Yeah the project is only 4MB after building

pastel dome
#

It scans all ur js html files

#

While the script uses the entire tailwind library which you always should avoid.. it's only intended for development and u don't use npm

#

Even tailwind Devs say that

exotic spire
#

Oh I see the issue

#

Yeah

#

I agree

pastel dome
exotic spire
#

Yeah that makes no sense really

pastel dome
#

I recently found with a project in php I was working that many frameworks like vite or next whatever.. they always rebuild the tailwind css once u save the project..

In php you had to do manually... I was scratching my head why some classes never worked.. then found out the tailwind css file is made dynamically.. I never knew that

#

We really take hot reload for granted until you work on legacy web app like laravel

reef trail
tepid olive
#

@exotic spire @pastel dome my brothers in christ, if this was a production app with many moving parts then yeah i would not advise the play cdn for tailwind, but on a simple html site like okemos it makes sense, having a build step complicates things. this is like back in the day when you imported bootstrap with script src too. and whats great is you can start building right away, in the future if you want to switch to the build step version of tailwind you can, this just makes it easier to get your project started and get the ball rolling

#

the dev is relatively inexperienced so the other way is a little convoluted for now, it will likely get in the way of progress

exotic spire
#

Configuring all that stuff is better at the beginning

tepid olive
#

so many pitfalls

#

if u didnt npm init ur project

#

you have to go into the package.json and change type to "module", then you have to create a tailwind config in the root folder just so that the vscode extension will activate in ur project

tepid olive
granite frigate
#

for a basic ahh html site just use cdn lol

#

if you wanna build something you’d be using vite which solves it anyway

pastel dome
tepid olive
#

np

manic forum
#

end of a 2 hour debugging session

#

i have depression

wooden yarrow
pearl sail
wooden yarrow
#

average developing experience

sonic totem
pearl sail
#

Are you implying I'm working with a modern competent compiler troll

pastel dome
worthy mulch
#

where would I find the lldb sdk that I need for iOS remote debugging for linux? Currently, whenever I try and connect, it says that it's unable to locate the sdk

cloud yacht
# cloud yacht So what is the correct way to get the memory location to search for patch findin...

Ok so not entirely sure how to do this now?
I did look at dladdr but it seems I need to pass it a function pointer, which means I need a function from the image, which I don't know how to reliably get.
I also found _dyld_get_image_header which seems promising, however, I realized I don't know how to get the length of the image to pass to memmem. Should I just get a large enough length that I know will contain my stuff or is there a smarter way to do it?

#

Also man it's hard to find proper documentation on the _dyld functions

#

so for the mac header I assume sizeofcmds is the size of my binary

#

Looks like the return of _dyld_get_image_header and MSGetImageByName are the same

orchid fulcrum
robust radish
cloud yacht
#

Yeah this is following a discussion from earlier. I need to find a few functions in a stripped binary (context: #development message).

manic forum
wooden yarrow
#

nice

#

i've spent 8 hour debugging sessions not being able to fix a bug NotLikeThis ur better than me

manic forum
robust radish
manic forum
#

(literally no one will use this feature)

cloud yacht
#

I do not know what mh_execute is but it's in the dylib cache (the function is from an apps main binary)

robust radish
#

so the functions you’re looking for are contained in the main executable of an application? Do they contain something unique enough to reliably identify them

cloud yacht
#

Yeah I belive they are unlikely to change (they are public apis from a dependancy's dependancy) and at least a few of them are called with a unique string I should be able to find in the binary

robust radish
#

Last question: are you injecting code into this process directly, or performing the search remotely from elsewhere?

cloud yacht
#

I'm being injected

#

If it helps the main part of the code I'm injecting is open source (though the app I'm targeting is not) and I have an app without stripped binarys to help with testing.
I need to hook 2 functions but theres ~14 functions I need just a reference to to call

orchid fulcrum
#

Uneducated opinion; it sounds like what you want is indeed dyld get image header, and the size for memmem should be the size of the executable (can check it with filza/finder)

robust radish
# cloud yacht If it helps the main part of the code I'm injecting is open source (though the a...

You need the addresses of the strings that can be used to identify the target functions. You can get them by parsing the strings table from the mach header or by doing a blind search starting around the load address of the main executable (the address of the mach header). The most straightforward API for fetching the mach header of the process main executable is _dyld_get_prog_image_header()

To find cross-references to those strings (their usage in the target functions), you can again do a blind search across the address range of the main executable for the literal address of the string, or more efficient, you can parse the LC_FUNCTION_STARTS load command from the main execs mach header. That will give you a list of addresses of every function in the binary, regardless of whether or not it has a symbol name / stripped. That reduces the scope of the search area. If you can roughly gauge (in a disassembler) the distance between the string reference relative to the start of its containing function, that's another way to further reduce search scope (bail out on functions early, don't look at the entire thing)

If you do a blind search, you need to know the end address of the image, so that you know when to stop looking. You can determine that by enumerating segments in the header. The range starts at the address of the mach header, and ends at vmaddress + vmsize of the last-encountered LC_SEGMENT/LC_SEGMENT_64 segment

cloud yacht
#

Thank you I'll take a look

robust radish
ocean raptor
# cloud yacht If it helps the main part of the code I'm injecting is open source (though the a...

What I ended up doing was for a few of the functions, lua_call, lua_pcall and one other I don’t remember, I used just a memmem() for the first few instructions of the functions since they were unique.
For getfield, setfield, settop and a couple others, I did a memmem() for "LUA_NOENV" string then used siguza’s xref() to find the xref and disassembly that function with capstone to grab the like 4 b instructions to those functions, then I did the same with a couple other strings for the rest of the functions

cloud yacht
#

ok I don't understand how the reference to a string in the binary is formatted

ocean raptor
cloud yacht
#

whatever being my string?

ocean raptor
#

Whatever being the arguments that memmem() needs to find your string

cloud yacht
#

okay

ocean raptor
cloud yacht
#

hmmm I must missunderstand somethng

#import <UIKit/UIKit.h>
#import <mach-o/dyld.h>
#include <CydiaSubstrate/CydiaSubstrate.h>

%ctor {
    NSLog(@"[Lovely] Hi Mom");
    int image_index = -1;
    for(int i = 0; i < _dyld_image_count(); i++) {
        NSLog(@"[Lovely] %s", _dyld_get_image_name(i));
        if (strstr(_dyld_get_image_name(i), ".app/")) {
            image_index = i;
            break;
        }
    }
    if(image_index < 0) {
        NSLog(@"[Lovely] Failed to find image: (Balatro.app/balatro)!");
        return;
    }
    const struct mach_header* header = _dyld_get_image_header(image_index);
    MSImageRef image = MSGetImageByName(_dyld_get_image_name(image_index));
    void* symbol_substrate = MSFindSymbol(image, "_luaL_loadbuffer");
    NSLog(@"[Lovely] Symbol: %p", symbol_substrate);
    NSLog(@"[Lovely] Header: %p, Image: %p", header, image);
    NSLog(@"[Lovely] size of cmds: %i", header->sizeofcmds);
    char needle[] = "=[love \"arg.lua\"]";
    int straddr = 0x100000000 + ((char *)memmem((const void *)header, 70000, needle, strlen(needle)) - (char *)header);
    NSLog(@"[Lovely] straddr: %i", straddr);
}
``` this is resulting in a negative value (which woudl be not found, right)
ocean raptor
#

Why aren’t you using the file size from the header for the memmem() lol

cloud yacht
#

good point

#

Still doesn't seem to work

#import <UIKit/UIKit.h>
#import <mach-o/dyld.h>
#include <CydiaSubstrate/CydiaSubstrate.h>

%ctor {
    NSLog(@"[Lovely] Hi Mom");
    int image_index = -1;
    for(int i = 0; i < _dyld_image_count(); i++) {
        NSLog(@"[Lovely] %s", _dyld_get_image_name(i));
        if (strstr(_dyld_get_image_name(i), ".app/")) {
            image_index = i;
            break;
        }
    }
    if(image_index < 0) {
        NSLog(@"[Lovely] Failed to find image: (Balatro.app/balatro)!");
        return;
    }
    const struct mach_header* header = _dyld_get_image_header(image_index);
    MSImageRef image = MSGetImageByName(_dyld_get_image_name(image_index));
    void* symbol_substrate = MSFindSymbol(image, "_luaL_loadbuffer");
    NSLog(@"[Lovely] Symbol: %p", symbol_substrate);
    NSLog(@"[Lovely] Header: %p, Image: %p", header, image);
    NSLog(@"[Lovely] size of cmds: %i", header->sizeofcmds);
    char needle[] = "=[love \"arg.lua\"]";
    char * ptr = (char *)memmem((const void *)header, header->sizeofcmds, needle, strlen(needle));
    int straddr = 0x100000000 + (ptr - (char *)header);
    NSLog(@"[Lovely] pointer: %p, straddr: %i", ptr, straddr);
}
<Notice> 15:31:28 love[1454]: [Lovely] /usr/lib/systemhook.dylib
<Notice> 15:31:28 love[1454]: [Lovely] /private/var/containers/Bundle/Application/3EBCAC08-0F59-42EB-8474-A6C19E6176F0/love.app/love
<Notice> 15:31:28 love[1454]: [Lovely] Symbol: 0x1006ba968
<Notice> 15:31:28 love[1454]: [Lovely] Header: 0x1003d0000, Image: 0x1003d0000
<Notice> 15:31:28 love[1454]: [Lovely] size of cmds: 4496
<Notice> 15:31:28 love[1454]: [Lovely] pointer: 0x0, straddr: -3997696
ocean raptor
#

Idk, is memmem returning anything?

#

Ditch the pointer to vmaddr math thing and only log the memmem pointer

cloud yacht
#

yeah it's the ptr value whcih is returnign 0x0

ocean raptor
#

Oh there’s your issue

#

Fix your memmem()

cloud yacht
#

yeah but what am I doing wrong?

ocean raptor
#

First of all sizeofcmds is not the right field lol

#

I’m not at my computer right now

#

When I get home in like 30 min I’m gonna be adapting my symbolfinder to run on device and I’ll send it to you

cloud yacht
#

idk which value I would use

robust radish
#

I can make an example that’s more directly applicable

ocean raptor
robust radish
ocean raptor
placid kraken
placid kraken
#

look at main.igo 😭

#

imagine the horrors

#

imagine needing to write the characters seisuu on your keyboard for an int

wooden yarrow
#

oh it uses the full width characters

#

might as well make use of the english full width ones too

placid kraken
#

yeah easier to type with an ime

wooden yarrow
#

@placid kraken how

ellec /usr/local/include/elle/std/runtime/index.le -o libelle.o -c -nogc -nosm -nofmt -nostd
thread 'main' panicked at src/misc/build.rs:25:10:
Failed to execute QBE.: Os { code: 2, kind: NotFound, message: "No such file or directory" }
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
make: *** [install-runtime] Error 101
placid kraken
#

you need to get qbe probably

ocean raptor
wooden yarrow
#

thanks

wooden yarrow
placid kraken
#

😭😭😭😭😭

robust radish
placid kraken
#

soon it’ll be able to actually compile things

wooden yarrow
#

you know what ill make this even funnier by making all the debug prints jp too

#

@placid kraken this may be your first external bug report but uh

placid kraken
#

unicode is something i definitely did not have in mind when i wrote that function lmao i’ll need to rewrite it completely at some point

#

although that throwing an error is strange

wooden yarrow
#

wait actually is it エリー or エレ

#

probably more like エレ actually

placid kraken
kind herald
#

:3

#

:3

wooden yarrow
pallid totem
#

what the fuck did i click upon on

wooden yarrow
placid kraken
#

これは学校のプロジェクトで、先生は日本語を知らないんだ 🎀🎀

placid kraken
#

これ、大好きになるよ

#

hehe

placid kraken
wooden yarrow
pallid totem
placid kraken
wooden yarrow
placid kraken
wooden yarrow
placid kraken
#

まあ、わかってるけど、Google 翻訳はわかってないね

#

:3

placid kraken
#

と思う

wooden yarrow
wooden yarrow
placid kraken
wooden yarrow
#

英語から日本語に翻訳するときも問題やねん

placid kraken
#

うん

wooden yarrow
#

最初っから英語はこんなに喋り方とか癖とかないからかもしれんけど

#

まあバイリンガルの人やったらトーンでわかるやろう

pallid totem
#

help

wooden yarrow
pallid totem
wooden yarrow
# pallid totem wat

that is indeed a plausable translation of the message you're replying to, yes

placid kraken
wooden yarrow
#

誰が勉強中って

pallid totem
#

"なんや" is a dialectal expression from the Kansai region of Japan, particularly associated with the Osaka area. It's an informal way of saying "what" or "what's this?" It can convey curiosity or surprise. In standard Japanese, you might see it as "何ですか" (nandesuka).

placid kraken
wooden yarrow
placid kraken
#

pallid totem
# wooden yarrow こっちはグッグル翻訳の話しとったんやけど、まあ

The phrase "こっちはグッグル翻訳の話しとったんやけど、まあ" translates roughly to "I was talking about Google Translate, but oh well."

  • "こっちは" (kocchi wa) means "about this" or "we."
  • "グッグル翻訳" (Guguru hon'yaku) means "Google Translate."
  • "の話しとった" (no hanashitotta) means "was talking about."
  • "んやけど" (n'yakedo) is a dialectal way of saying "but."
  • "まあ" (maa) is often used to express resignation or indifference, similar to "well."

Overall, it reflects a casual, conversational tone, likely indicating a shift in focus or acceptance of the conversation's direction.

#

i love ai slop

placid kraken
#

i mean it’s right

pallid totem
ocean raptor
#

lol

wooden yarrow
pallid totem
# wooden yarrow 確かにチャットジーピーティみたいなん使っとったら日本語の方言の癖と喋り方を掴みやすいかもな

The sentence "確かにチャットジーピーティみたいなん使っとったら日本語の方言の癖と喋り方を掴みやすいかもな" translates to:

"Indeed, if you use something like ChatGPT, it might be easier to grasp the quirks and speaking style of Japanese dialects."

  • "確かに" (tashika ni) means "indeed" or "certainly."
  • "チャットジーピーティ" (ChatGPT) refers to ChatGPT.
  • "みたいなん" (mitai nan) means "like" or "something like."
  • "使っとったら" (tsukattottara) means "if you were using."
  • "日本語の方言の癖" (Nihongo no hōgen no kuse) means "quirks of Japanese dialects."
  • "と喋り方" (to shaberikata) means "and speaking style."
  • "を掴みやすいかもな" (o tsukami yasui kamo na) means "might be easier to grasp."

Overall, it's expressing the idea that using a language model like ChatGPT can help users better understand Japanese dialects.

wooden yarrow
placid kraken
#

うん

wooden yarrow
#

まあそりゃLLMやからな

placid kraken
#

驚いたです

pallid totem
placid kraken
wooden yarrow
#

w

pallid totem
rocky oriole
#

no

placid kraken
#

ああ、もう1時だね。おやすみ🎀

placid kraken
wooden yarrow
pallid totem
#

nice

#

im gonna go sleep

#

gn

placid kraken
wooden yarrow
placid kraken
#

じゃね (⌒▽⌒)

wooden yarrow
#

@tacit spade i am curious to know if you can understand the backlog of this convo

placid kraken
#

i’m curious would it be better to use 少し or ちょっと in this context

#

for a little bit

wooden yarrow
#

in where

placid kraken
wooden yarrow
wooden yarrow
wooden yarrow
placid kraken
wooden yarrow
#

trold

placid kraken
wooden yarrow
#

what is it suppoed to say in english

#

actually

placid kraken
#

(strawberry aka this) is a school project and my teacher doesnt understand japanese

#

although i put sore

#

silly

wooden yarrow
#

ohh so prob more like 「これは学校のプロジェクトなんだけど先生は日本語を知らないんだ 🎀🎀」

#

(sorry i cant speak in hyoujungo v well so i just kansai ben)

placid kraken
#

yeah that would work too

wooden yarrow
#

god i literally cant think of what "なんやけど" would be in hyoujungo

#

i can raise it to the formal 「なんですけど」but wtf is the casual form in hyoujungo

#

ohhh right chatgpt told me it would be「なんだけど」

elder scaffold
placid kraken
#

なんだけど is what i was thinking but i wasn’t completely sure

wooden yarrow
placid kraken
#

because iirc there’s a pattern where you replace da or desu with ya in kansai ben

#

right

placid kraken
wooden yarrow
#

anyways gn

elder scaffold
#

I am convinced that the most incomprehensible dialect in Japan is Tsugaru dialect (I don't even think it's Japanese anymore)

#

gn

wooden yarrow
#

true

ocean raptor
#

@cloud yacht @robust radish here's your symbol finder wilson it grabs all the symbols that lovely-injector is actually using

#

have fun hooking that up (or better yet, converting it to rust lol)

cloud yacht
#

Thank you I will look into it

ocean raptor
#

mister objc giving me that xref() saved me a ton of time

#

I didn't have to fixup siguza's to work on mapped binaries

ocean raptor
cloud yacht
#

will do

#

my mac has procursus on it so will jsut installing libcapstone-dev on it be enough or do I need to pull in the ios builds?

cloud yacht
#

the linked deb doesn't work

#

like it's a 404

ocean raptor
#

And yes, that static library will work fine on both rootful and rootless

#

Just put the libcapstone.a into your theos lib and the capstone folder into theos include

#

This deb has it at include/include/capstone for some reason though lol

cloud yacht
#

yeah I noticed that on the mac one

ocean raptor
#

Don’t do the extra include, that’s a bug

cloud yacht
#

not sure how I should build this for iOS

#

tried clang -I./lib/include -L./lib/lib -lcapstone patchfinder.c -target arm64-apple but it couldn't find mach-o/dyld.h

ocean raptor
#

If it’s not in your SDK, it should be in your theos headers

#

This code should be compiled into a dylib and injected into Balatro btw

#

You can just do it with theos even

#

I have an idea, to get this to work in lovely injector you should make a version of the libloading crate that is specifically for grabbing these symbols that is api compatible and just gets swapped in when you compile for iOS

cloud yacht
#

I got it to compile and hooked up to rust but it can't find the symbols (also it is warning me about ios version differences)

ocean raptor
#

Hm good luck

#

I hope you figure it out

cloud yacht
#

me too

cloud yacht
#

since i need to recompile this from scratch I got time, is there a way to pass args to an iOS app (argv, enviroment variables, etc)

harsh junco
#

its arm64-apple-ios(ver)

#

arm64-apple-ios13.0

cloud yacht
#

I ended up just giving it to the rust cc crate which I belive is handling the target correctly (probably)

cloud yacht
#

idk

#

I'm assuming something weird with cargo

harsh junco
#

Isn’t apple arcade 13+

cloud yacht
#

I'm not sure how it's even choosing it's target ios version

harsh junco
#

That’s minimum ios ver rust supports

cloud yacht
#

I was experimenting with stuff and was wondering if rust wasn't liking that it was a pointer to a function so I tried making a function to just return the value and calling that and now I'm getting

harsh junco
#

Try setting IPHONEOS_DEPLOYMENT_TARGET=13.0

#

Also

#

x64_86-darwin

#

????

#

????

cloud yacht
cloud yacht
cloud yacht
cloud yacht
#

setting it to 16.4 doesn't complain

#

idk why it wants that verision in particualr

cloud yacht
#

it compiled for arm64 but arm64e isn't working now

#

looks like capstone doesn't have an arm64e slice

cloud yacht
#

it seems to crash when running on non-balatro love apps

naive kraken
trail nimbus
#

i have a phone with trollstore 17.0. Would i be to directly plant a file into an apps data from my computer with like a py script or something? Or would i need to elevate some stuff with trollstore before i could do that? If it helps i already have filza installed not sure tough if that has some kind of api or something

ocean raptor
placid kraken
#

are my sentences coherent

#

i talk with people in jp pretty often but i usually do a lot more reading and don’t say very much

wooden yarrow
#

by coherent do you mean understandable or

placid kraken
#

like grammatically correct (for the most part)

wooden yarrow
#

yes

placid kraken
#

good

placid kraken
#

@wooden yarrow i was having this conversation a few days ago

#

what is the most common usage for “everything”

- 全て
- すべて
- 全部

wooden yarrow
#

全て is the same thing as すべて

placid kraken
#

from what i know 全て is more formal than すべて

#

and 全部 is the least formal

wooden yarrow
#

maybe in text

#

equivalent in speech

placid kraken
#

well yeah obviously it’s the same pronunciation lol

wooden yarrow
#

although in recent writing i think 全て is equivalent in formality to すべて

placid kraken
#

ah

#

and 全部 is less formal?

wooden yarrow
#

i think you use 全て/すべて and 全部 in different contexts actually

placid kraken
#

ah

wooden yarrow
#

or well you're more likely to use one over the other

placid kraken
#

well yeah surely because formality right

#

zenbu is casual and subete is more formal

wooden yarrow
#

全て消す instead of like 全部消す for example although the latter does still work

placid kraken
#

or is there another context when you would use one over the other

wooden yarrow
#

in literal terms 全て is "all" while 全部 is from "all parts"

placid kraken
#

i see

lusty jacinth
ocean raptor
robust radish
ocean raptor
#

That looks like some mod is loading nativefs.lua which needs to be fixed to support macOS/ios

#

Orrrr

#

I guess we need to get the symbolfinder to find PHYSFS_getMountPoint

#

Idea: get the symbolfinder to locate PHYSFS_getMountPoint then MSHookFunction dlsym to return it if it’s searching for the symbol

cloud yacht
cloud yacht
cloud yacht
#

I tried adding logging, thought it doesn't seem that it worked. However I can see the print I had in the assembly view so hopefully this should help

#

For some reason its not making a log but I can get one from last night

ocean raptor
#

The solution is to update my symbolfinder to support finding whatever symbols the nativefs lua module is trying to ffi

#

Then hook dlsym to return that function when passed the name of it

cloud yacht
#

I might also be able to patch the mod to not need that native function

ocean raptor
#

My solution seems better but whatever 🤷‍♂️

cloud yacht
#

it probably is

#

I can provide the lua of the crasig function if it would help

ocean raptor
#

No, I found it

cloud yacht
#

though I get a real crash wne opening a non-balatro love

ocean raptor
#

It’s the nativefs module’s ffi

cloud yacht
ocean raptor
cloud yacht
#

for these there are symbols so I can probably do some heuristics on them to switch to MSFindSymbol

#

but idk if some other love app will come to popularity and not have symbols

ocean raptor
cloud yacht
#

yeah

#

hold on I can send the ipa for the one

ocean raptor
#

I already have it

cloud yacht
#

oh okay good

ocean raptor
cloud yacht
#

fair enough

ocean raptor
#

Also, please update my code to close the capstone handle lol

cloud yacht
#

oh yeah did I mention my cursed fix for the issue earlier of it not finding symbols

ocean raptor
#

I saw that yeah

#

Please make it just bail out if symbol finding doesn’t work instead of crashing btw

cloud yacht
#

I suspsect it might be memmem going to far and getting killed

cloud yacht
ocean raptor
#

App Store apps are never arm64e

ocean raptor
#

Cause the memmem only scans the __TEXT.__text section

cloud yacht
#

so where is it crashing?

ocean raptor
#

Attach lldb to it

cloud yacht
#

I do but theres no symbols

ocean raptor
#

2025-01-22 04:32:12.6370 -0700 default 0x428f0 0x0 Balatro[3044] (LovelyPatchfinderPOC.dylib): [Lovely] pointer: 0x0, straddr: -1900544

#

This is probably part of it

#

lol

cloud yacht
#

wait where is this from?

ocean raptor
ocean raptor
cloud yacht
#

oh that was another thing I was working on (but failing)

#

I should remove that

#

More context

#

I thought the printf was supposed to go to xcode but I don't see where it would be

ocean raptor
#

Does whatever binary you’re trying to hook have the code point string?

cloud yacht
#

Yeah seems like it

ocean raptor
#

Wait it’s crashing Balatro?

cloud yacht
#

fake balatro

ocean raptor
#

Idk

cloud yacht
#

is there a quick way to see if a binary still has symbols?

ocean raptor
#

I sent my symbol finder but that runs on macho files yesterday

#

Find that and get it to compile and you can run it on your Mac

cloud yacht
#

whar?

ocean raptor
#

Compile that a run ./a.out Balatro and it’ll try to find all the symbols

cloud yacht
#

real or fake balatro

#

do you have the macho.h

ocean raptor
ocean raptor
cloud yacht
#

first is fake second is real

ocean raptor
#

Wtf

#

Decrypt your real one lol

cloud yacht
#

I thought I did

ocean raptor
#

That doesnt look like it got decrypted

cloud yacht
#

oh wait I might've only put the decrypted one on my pc not the mac

#

wait I might've mixed up my binarys

#

okay here is the non-balatro for sure one

ocean raptor
#

Ok cool

#

Seems to work fine

cloud yacht
#

So why is it crashing on the in memory version?

ocean raptor
#

Idk

#

lol

cloud yacht
#

true

ocean raptor
#

attach lldb to the app and step through

cloud yacht
#

I'm not sure how to get it to have the proper debugging info to let me do that

#

probably I just don't have the nessicary debugger knowledge to do this

ocean raptor
#

Don’t strip your binary

cloud yacht
#

I tried doing debug build and it didn't work but I just realized that puts my deb in a different place so I installed the wrong deb

#

oh I also just broke my deb script for debug builds

#

There we go

#

thats for the codepointstr_xref

#

Oh yeah this may be useful

#

seems odd that has bad access

#

hmm on love it crashes on the lua_noenv_xref

cloud yacht
#

yeah frankly idk whats going wrong and for some reason I can't debug normal balatro to see whats different

icy escarp
#

uhhh does anyone know how to prevent injected dylibs from appearing in the list of NSBundles, and/or how to use dopamine's .fakelib to disguise the origin of these

ocean raptor
#

Ugh this is so stupid

#

Look at the very top of the constructor

#

Where it finds the image index

cloud yacht
#

It's not that

#

the fake balatro app has the same name and I modifed it to find the love one

#

although it seems like if it fails to find it will keep running which it shouldn't

#

also I verifed in the debugger it had the right image name

ocean raptor
#

Ok well I’m going to update that xref function to only scan __TEXT.__text and we’ll see if that fixes it

#

Or actually you can do that

cloud yacht
#

isn't that already what it does?

#

also doesn't the mh's cancel out here?

ocean raptor
#

No

#

But I am questioning that math

ocean raptor
cloud yacht
#

so would i just want to change end to seg->vmsize?

ocean raptor
#

No

cloud yacht
#

I don't get how this end pointer works

ocean raptor
#

We’re gonna rework this entire logic for getting it

cloud yacht
#

right

#

seg has vmaddr

#

so can current not be vmaddr and then end be vmaddr + vmsize?

#

that didn't fix it but it also didn't break it

ocean raptor
cloud yacht
#

oh is the slide it's spot in memory rn?

ocean raptor
#

uint64_t xref(const void *text_sec, size_t text_sec_sz, uint64_t string_addr) {
    uint32_t *current = (uint32_t *)text_sec;

    uint32_t *end = (uint32_t *)((uintptr_t)text_sec + text_sec_sz);
#

Try with that

#

You’ll have to update the forward declaration and all the calls to xref() to pass in the text_sec and text_sec_sz vars instead of mh and text_segment

cloud yacht
#

new crash

#

looks like this is caused by codepointstring_xref being 0

#

but now xref isn't erroring

ocean raptor
#

Ugh, what is the value of codepointstring_xref?

cloud yacht
#

0

ocean raptor
#

Ugh

#

What is codepointstr addr?

#

The address that is getting xref’d

cloud yacht
#

Also potential new issue

ocean raptor
#

Hahaha

#

OK yeah these memmem() for bytes ain’t working

cloud yacht
ocean raptor
#

In hex pls lol

cloud yacht
#

104E4D9A7

cloud yacht
ocean raptor
cloud yacht
#

it seems ot be functioning proper on real balatro so I'll assumue it correctly found the function

cloud yacht
ocean raptor
cloud yacht
#

I checked if any of the xrefs were null and if so returned early and set a flag there was an error. Then in rust code if there was an error fallback to using MSFindSymbol

#

since the other two have symbols this works

ocean raptor
#

Hmm

#

That works

cloud yacht
#

yeah

acoustic imp
cloud yacht
#

so if I'm only building for aarch64 do I need to worry about old and new abi?

native orbit
#

no

faint timber
#

nah they only changed the auth/got abi

cloud yacht
#

also can I use the same build for rootless and rootful if I just set my rpath to include the rootful paths?

cloud yacht
#

Oh nice that would simplify my build process

orchid fulcrum
#

hooking a specific instance

hasty ruin
#

object_setClass?

#

Oh

#

The code is there fr

#

Okay yeah

#

Had to do that in Rune to fix a tweak conflict

kind herald
#

What about a keyboard conflict

hasty ruin
#

nope

pallid totem
#

did i just notice that objc uses YES and NO as booleans

#

and not true or false

hasty ruin
#

Both

pallid totem
pallid totem
#

bro

#

NULL YOURSELF

#

Sorry

acoustic imp
#

(night bullied me into not using them smh)

pallid totem
#

do not

#

thank you

hasty ruin
#

good job @radiant idol

pallid totem
#

😭

radiant idol
#

icraze's original statement was right

hasty ruin
pallid totem
acoustic imp
kind herald
#

1984

#

MOds

pallid totem
#

llease keep deleting maxines message

#

thank you

radiant idol
#

@modulators

acoustic imp
#

self report

pallid totem
#

what if instead of icraze we just had craze

kind herald
#

Proton Mail Bridge

pallid totem
#

what the fuck am i saying

acoustic imp
hasty ruin
#

Hard to even imagine.

pallid totem
#

🤔

#

16player may just be the definition of “if it works it works”

kind herald
#

@shut stag Can you check audit logs and see who's deleting my messages and shit 👍

acoustic imp
#

i plead the 5th

hasty ruin
pallid totem
#

16player

fiery dragon
#

that's horrifying

pallid totem
#

?

#

mods

#

snipe

#

now

#

@lofty juniper

fiery dragon
#

I saw that

faint lionBOT
#
MuffinStore.app deleted a message

?

acoustic imp
#

?

fiery dragon
#

farther back

radiant idol
pallid totem
#

Fuck.

lofty juniper
pallid totem
pallid totem
acoustic imp
#

twas a silly joke

pallid totem
#

ok

#

nvm

lofty juniper
acoustic imp
lofty juniper
#

you’re not to delete messages in development.

acoustic imp
#

:/

kind herald
#

Based Nooka.

pallid totem
#

@hasty ruin

#

question

#

is it possible to make a react ios app

#

i know discord is one

lofty juniper
#

yes…?

acoustic imp
pallid totem
#

but how hard is it actually

#

to make one

lofty juniper
#

it’s just react native

hasty ruin
#

Making RN apps should get you banned from this channel

pallid totem
lofty juniper
#

no

pallid totem
#

stupid shits

kind herald
#

Making 16player should get you banned from this channel

lofty juniper
#

because they do cross platform development?

radiant idol
#

cross compat between ios and android

#

react native makes that easier

pallid totem
#

True

#

but

pallid totem
hasty ruin
#

I think neither of them have delete perms lmao

pallid totem
#

more work for them

#

react is so much more buggy than just using swift or uikit

radiant idol
#

swift and uikit dont work on android

pallid totem
radiant idol
#

makes it harder to sync development

#

theres no purpose for them really

#

react native does the work just fine, its just us jailbreakers who dont like it

pallid totem
radiant idol
#

that's not due to the language

#

they're just lazy

pallid totem
hasty ruin
radiant idol
pallid totem
#

and also isnt react incredibly slow

lofty juniper
acoustic imp
#

dc is RN...

pallid totem
acoustic imp
#

on all platforms ?

radiant idol
#

but it doesnt

pallid totem
#

like theyre not

radiant idol
#

it takes 2 seconds maybe

pallid totem
#

identical

pallid totem
#

and see how long it takes to get to this channel (which discord should automatically do)

acoustic imp
pallid totem
#

7 seconds

lofty juniper
#

broke ass phone

acoustic imp
pallid totem
lofty juniper
#

ok a17 pro launches under a second

pallid totem
#

or under

cloud yacht
#

I mean when you need to make network requests its not bad.

lofty juniper
#

buddy.. have you used a meta app

pallid totem
#

meta uses react and react native too

radiant idol
#

thats because they made react

pallid totem
#

what

radiant idol
pallid totem
#

oh

radiant idol
pallid totem
#

well that probably explains why they actually have good usage and speeds of it

hasty ruin
#

Instagram is a good app because it’s actually still native

pallid totem
#

@hasty ruin

#

do i fix some issues at my code and stay awake all day or get 55 minutes of sleep and do not fix my code

acoustic imp
pallid totem
#

quick

pallid totem
#

noo

#

i go sleep

#

gn

cloud yacht
#

gn

hasty ruin
rain dune
#

Dead chat

cloud yacht
placid kraken
ocean raptor
#

@cloud yacht so is all that’s left is to update the symbolfinder to find the PHYSFS_ symbols?

manic forum
#

TIL C files must end with a newline

harsh junco
wooden yarrow
#

it's in the POSIX standard

#

all text files must end in a newline because otherwise the last line wont be counted as a line

manic forum
#

what

wooden yarrow
hollow laurel
wooden yarrow
placid kraken
#

what is an empty string in C

#

wait wouldn’t that be just a ptr to NULL

timid furnace
#

no

native orbit
#

ptr to null terminator \0

timid furnace
#

^

#

pointer to a valid region of memory containing a null terminator

placid kraken
#

that is what i said

cedar stag
#

predictive code completion is ass

#

why are we checking for iOS 11 in 2025 bruh 😭

native orbit
orchid fulcrum
placid kraken
#

NULL is usually a macro to 0 in most C compilers

#

so usually it is identical

#

just semantic differences maybe

timid furnace
#

a pointer to null is not the same as a pointer to memory that contains null

placid kraken
#

can you show an example

#

doing

char x[1];
*x = 0;
``` is an empty string surely
#

0 == ‘\0’ anyway

timid furnace
#
// The absence of string
char* a = NULL;
// Empty string
char* b = "";

// idk if your printf has null checks or not
printf("a: %p (%s)\n", a, a);
printf("b: %p (%s)\n", b, b);

printf("b[0]: %d\n", b[0], b[0]);
#

remember, a string is a pointer to contiguous characters in memory, so a pointer = NULL is not the same as a pointer to memory where the one and only character is 0

#

absence of string vs empty string

#

you probably understand by now but

native orbit
#

swift be like: "contiguous" nah fuck that

timid furnace
cedar stag
#

rude

placid kraken
#

i said the ptr points to NULL

placid kraken
#

read what i said earlier closely

placid kraken
#

or am i going insane

manic forum
#

an empty string in C is a pointer that points to a zero char

placid kraken
#

that is equivalent to what i said i think

manic forum
#

the size of a char is at least 8 bits and platform-defined

placid kraken
#

well not going by the C abi because NULL can be anything it doesn’t need to be 0 but it tends to be 0

timid furnace
#

pointer to NULL is interpreted as ptr = NULL, at least to me

#

the pointer points to address 0

native orbit
manic forum
timid furnace
#

idk its language nuance

placid kraken
manic forum
#

Also wchar is a stupid type it doesn't even work

placid kraken
#

i see

manic forum
#

who decided to make wchar 2 bytes come on

native orbit
#

any MS type is just dumb lol

cedar stag
#

Microware

placid kraken
#

usually i think of the ptr itself as the address

native orbit
placid kraken
#

so when i think of a ptr to NULL i think like “ptr, aka some number, that when derefed gives 0”

manic forum
#

i think the size of that is also platform defined intjsad

native orbit
placid kraken
#

what’s the point

native orbit
#

supports non latin chars

manic forum
timid furnace
#

me when A APIs vs W APIs (Win32 API users will understand)

manic forum
#

but at that point just do utf32 go all in with 4 bytes

native orbit
#

wait until they come out with llchar_t

cedar stag
placid kraken
#

i love utf8

manic forum
placid kraken
timid furnace
manic forum
placid kraken
#

such a smart way to do that i would’ve literally just had a full i32 for each char

timid furnace
manic forum
#

the windows api is either w or a right

#

wide char or ascii

#

neither fully works for unicode

native orbit
manic forum
#

awesome

#

WHAT

#

A stands for ANSI not ASCII??

#

insane

timid furnace
#

i mean

#

you have 8 bits

#

might as well use them

manic forum
#

i hate text encoding, they should make an operating system that communicates solely through hand gestures

native orbit
#

ascii just said fuck the 8th bit fr

manic forum
#

not sign language just gestures

#

are they the same thing

#

idk

placid kraken
manic forum
#

when is that useful

placid kraken
#

char + tag

manic forum
#

what would the tag be

native orbit
#

0 or 1 troll

manic forum
placid kraken
#

whatever i need it to be? depends what i’m doing

one time i made the tag whether the char is representing a valid b64 char (which you can turn into a small function but instead of needing to do a big switch case you just mask and shift)

ocean raptor
#

Insanity

cloud yacht
robust radish
ocean raptor
#

Replace those stupid searches for the first couple instructions with more reliable methods

#

That don’t find the wrong function like they do currently

robust radish
#

I’m working on a patchfinder too and it’s a pain the ass. trying to find offsets for a bunch of struct members

indigo peak
#

@rocky oriole why tf did you react to this almost a year later 💀

rocky oriole
#

idk

visual meadow
#

I strongly disagree with the statement you have replied to

#

Now this one, I agree with

torn oriole
fiery dragon
#

Is this for tweak/apple related development or just general programming?

visual meadow
#

but i was banned from here in 2018

#

so i was not here

timid furnace
#

@indigo peak can you link @graceful gate the ellekit sim build

#

No access to computers atm

graceful gate
#

Yes I do have that build, it’s on Discord

#

I’m looking for the fork on GitHub or sth

#

So that my script can automate installation of injection library

indigo peak
#

@graceful gate

graceful gate
indigo peak
#

whoops

graceful gate
#

👌

indigo peak
orchid fulcrum
#

how do i include objc_debug_isa_mask

#

#import <objc/objc-private.h>
#import <objc/objc-runtime.h>
#import <objc/runtime.h>

these didn't work

edit: just declare it extern

thorn ether
#

do u know why im getting this error:

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 36.2M  100 36.2M    0     0  50.3M      0 --:--:-- --:--:-- --:--:-- 50.3M
[INFO] Installing iPhoneSimulator17.2.sdk...
tar: could not chdir to '/sdks'

[ERROR] Failed to install SDK.
korboy@korboys-Mac-Pro ~ %```
indigo peak
#

echo $THEOS

#

run that

#

and send what it says

thorn ether
indigo peak
#

sucks

#

just do it manually

#

all the script does is download a tar and extract it

thorn ether
orchid fulcrum
#

are there docs for malloc_zone_t somewhere ?
it seems like apple itself don't provide it and i couldn't find any 3rd party ones either
specifically i am looking for thezone->introspect->enumerator()function pointer

robust radish
#

radar: private apis lacking documentation

marsh ocean
#

hello chat

#

of development

cedar stag
#

Hello purple name

slim bramble
cedar stag
slim bramble
marsh ocean
#

it'd be great if i had orang name

unique galleon
#

I would enjoy an orange name ❤️

orchid fulcrum
#

same frfr

slim bramble
slim bramble
slim bramble
lean ember
#

Any help building an opensource project for ios