development

[cloud yacht]

They could do something like ish with an emulated cpu

[robust radish]

webasm would be less work. someone check what they actually do

[slim bramble]

Why on earth do i need internet to enable SIP

[frank fossil]

LLVM IR

[cloud yacht]

Activation lock?

[slim bramble]

🤨

[cloud yacht]

Disabling sip could prevent activation lock from being effective so it might need to phone home to make sure it'd not locked before disabling it

Idk

[slim bramble]

Failed to update security configuration : the signing server declined the personalization request

What kind of a joke is this

[robust radish]

that code would need to be signed right? LLVM IR isn’t interpreted 🤔

[slim bramble]

@torn oriole

[frank fossil]

It’s interpreted, try your code with -emit-llvm

It sadly doesn’t work properly with objc and block

For those who wanna mess with calling objc:
clang main.m -fmodules -S -emit-llvm -fcolor-diagnostics -Wno-nullability-completeness -Xclang -no-opaque-pointers -fno-unwind-tables

[slim bramble]

Try a-Shell, you can compile and run code

Looks like it's opensource

https://github.com/holzschu/a-shell

Oh, it's using wasm

[reef trail]

wasm is so cool

[ocean raptor]

Apparently there is a LLVM IR interpreter https://llvm.org/docs/CommandGuide/lli.html

That’s cool

[robust radish]

TIL

[frank fossil]

Use LibTerm

[harsh junco]

wasm is dangerous to web

[frank fossil]

Has anyone tried kfd on it

[south path]

Hello

I have rich experience in macOS automation using applescript and iOS app dev using swiftUI and Flutter

https://github.com/AlmastSargsyan0615?tab=repositories

[acoustic imp]

?

[ocean raptor]

AI GitHub profile picture lol

[ocean raptor]

lol what does this even mean?

[worldly shell]

hello

[south path]

this is not ai only

https://github.com/AlmastSargsyan0615?tab=repositories&q=applescript&type=&language=&sort=

[faint stag]

You’ll need to update to the latest macOS version. Apple checks macOS version with their remote server and only allow enabling if that particular version is signable. They turn signing off for old versions.

the things they do with apple silicon huh

[trail nimbus]

they really turn of signing for older mac versions???

[slim bramble]

Only for SIP it seems

[faint stag]

i'm just referring to SIP here but yeah

[slim bramble]

It’s very dumb

[faint stag]

elaborate platform security now needs personalized data to re enforce SIP

decided to look at the platform security documentation and it seems like to boot with full security you'd need to ensure the next stage image4 manifest is signed with that personalized cert
(and i suppose it still tries to get it regardless of it being signed correctly)

[slim bramble]

@kind herald

[slim bramble]

Can you send a link to that documentation ?

Thanks anyway

[faint stag]

https://support.apple.com/en-us/guide/security/secc745a0845/web

was trying to make sense of this, there's a long glossary at the bottom

[slim bramble]

Cheers

[faint stag]

Security policies are requested at software installation time initiated by a signing request to a central Apple signing server. If the policy was acceptable, the signing server returns a signed Image4 file containing a variety of four-character code (4CC) sequences. These signed Image4 files and 4CCs are evaluated at startup by software like the Boot ROM or LLB.

yeah that would explain it too

they make no mention of not allowing it for older versions as far as i know

[faint stag]

disabling SIP will set you to permissive security so this checks out actually
(see boolean smb0)

[wind ravine]

they rejected nugget

[slim bramble]

Oh

Ffs

[wind ravine]

i think it might be more pyinstaller's fault for that

[slim bramble]

Objc recode eta wen

[wind ravine]

doesnt support windows

[slim bramble]

It could

Microsoft made a port

[wind ravine]

i wish i wrote it in c++

pymobiledevice is better than libi tho

[slim bramble]

https://github.com/microsoft/WinObjC

[slim bramble]

Nah objc better

[timid furnace]

it's not

i distribute a pyinstaller app, signed and notarized, just fine

[wind ravine]

weird

do we have to notorize each version?

[velvet path]

probably since it's now containing a known exploit with a CVE and such

[wind ravine]

[slim bramble]

I wonder if obfuscation would trick them into accepting it

[faint stag]

damn, had no idea

[pearl sail]

cursed

[timid furnace]

every build

[slim bramble]

😭

[timid furnace]

like it's tied to the code/hash

[harsh junco]

GNUStep:

[bright lance]

Chat should i js convert this into an app to gain actual memory access?

It’ll acc be chopped chin cheat engine if i do instead of chopped chin browser CE

[harsh junco]

What the fuck
Damn, apple is so apple
http://marksands.github.io/2014/05/27/how-apple-cheats.html

[wooden yarrow]

Will iOS 8 finally bring UIPopoverController support to the iPhone and iPod touch? One can hope! At least we only have to wait until next week to find out.

[slim bramble]

I wonder if you can use private apis in App Store apps

[acoustic imp]

u can and ppl probly do, iirc i read this article where u can just like callSelectorWithName or something and set value for key ofc, idr.

[weary heath]

There were those banking apps that used a 0 day to detect trollstore using a private api

[hasty ruin]

Obfuscating the method name in any way will normally get it past app review

[slim bramble]

Fair enough

It’s sooo blatant

With objc runtime you can do full private api usage

[timid briar]

hello #development would anyone mind helping with my developer certificate struggles? I am kind of clueless with this, and resources I found online/other servers have not yielded success

how can i use my apple developer account to sideload an app with entitlements? I made an entitlements.xml, generated the Certificates.p12 and downloaded the .mobileprovision files on my mac but I don't know how to actually use them correctly with an ipa I have. Do I codesign with the entitlements.xml after setting up the .ipa? I thought I had it after looking at some resources but I'm not sure what I'm doing wrong. I've been sorta going in blind with it and throwing things at the wall until it sticks. When I bought a cert to not worry about resigning for a while I somehow never thought of how I can get notifications (and I guess other entitlements) too

(I know there are signing services but I don't want to have to worry about those getting revoked or something idk. Probably fine but seems more reliable + legit to just do it myself, minus the cost)

[slim bramble]

Did you pay for the apple dev account?

[timid briar]

yes

[slim bramble]

Just use sideloadly

https://sideloadly.io

[timid briar]

no i do, but to have the push notification entitlement I mean

and sideloadly currently doesnt support adding custom ones iirc

[slim bramble]

Oh I think you're fucked for push notifications

[timid briar]

for sideloadly, ok, but why wouldnt i be able to sign with that entitlement and install it otherwise?

and in fact apparently that feature has been in the works for sideloadly 2 years ago but I dont know the status (I even replied a while ago but no response yet)

[trail nimbus]

couldnt u just manually edit the ipa?

[timid briar]

wdym?

[trail nimbus]

like unzipping it and manually editing the xml file

[timid briar]

why would that work though? ive already made an entitlements.xml and used codesign with it and it seemed to work with no errors

unless i didnt make it correctly idk

[trail nimbus]

oh mb misread it

[timid briar]

like, does this look ok? Obviously I put my own team identifier there idk if showing it is bad lol

[slim bramble]

Make sure you merge the entitlements

[timid briar]

oo ok that's not something I did I don't think. I just used codesign with the entitlements flag pointing to this

how do you do that?

[slim bramble]

Idk I just use ldid for that

Maybe codesign does that by default

[timid briar]

could I use ldid instead so I can explicitly state to merge them?

[slim bramble]

Yeah

[timid briar]

alright, so also, with the mobileprovision file I have, do I like, put it inside the .app and call it embedded.mobileprovision? cause I saw something about like replacing a mobileprovision file with your own or something

as u can see i have no idea what im doing :3 when ppl are like "with a paid dev account u can get notifs!!!" i never found anyone actually explain it and always just assume ppl use signing services ig. I searched for people asking how to do this in the enmity/unbound (modded discord) server because they have a command that mentions "if you have a paid account you can get notifications" and the only thing I saw was someone asking and ppl being very unhelpful

[slim bramble]

Idk I never got notifs with paid account

But you have to apply your entitlements to the actual binary

[timid briar]

so for example, a command like this?
codesign -f -s "Apple Distribution: <name> (<team>)” --entitlements /Users/Matt/Desktop/entitlements.xml /Users/Matt/Payload/Twitter.app
(using the previously mentioned entitlements.xml file)

[slim bramble]

ldid -Sentitlements.xml -M Twitter.app/Twitter

[timid briar]

ah right I'll try with ldid

oh the binary within the .app

when running theres no output, is there a way to make sure it was applied?

[wind ravine]

nugget got notorized this time, odd

[timid briar]

ah i see, ldid -e, and it has what I added

so in theory I should just be able to sideload this and have it work?

because I also saw something about having to check the box for the entitlement you want to use on the apple developer identifiers page

[slim bramble]

🔥

[stiff shuttle]

troll

[daring ruin]

hi

[dawn prism]

hi

[lofty juniper]

you need to use a distribution cert for notifications

no idea how you get it

[timid briar]

Ah alright

[manic forum]

i gave cursor ai a try and it's... meh

has some potential for maybe bootstrapping small projects but other than that it still produces garbage code

[reef trail]

i only really use that sort of thing for writing up repetitive code

[granite frigate]

it kinda depends what you use it for i guess

i know what i want to code out and trace out the flow then just tell chatgipity to scaffold

[kind herald]

U gotta drink a monster before using it

Works 100%

[manic forum]

i should try that sometime

[manic forum]

i tried to vibe code an entire project i had in mind for a while, i didn't get far

simple website with frontend + backend

[granite frigate]

huh

[reef trail]

yeah i'd never use ai for a full project

[granite frigate]

ive kinda resorted to using it to code and just mildly fixing it

lazy to code fr now

💔

[radiant idol]

Hello Sacrosanctuary

[granite frigate]

hai windy

[radiant idol]

Hello rugmj

Hello pixelomer

[reef trail]

i always find it harder to debug when i didn't write it

[reef trail]

hello wind of the night

[granite frigate]

that’s true

[manic forum]

i thought maybe i'd use this project as an excuse to "get into ai" but yeah that didn't happen

[granite frigate]

i realised my code structure is shit so chatgpt will code shittily for me bc i told it to do so

its just write x function

[granite frigate]

what did u ask it to make

[manic forum]

first some html templates, then a node project with a prisma database schema

maybe it's better at using react + raw sql idk

[native orbit]

ai aint good at any code

[manic forum]

i thought maybe cursor was magical and i was missing out

i wasn't

[granite frigate]

nah def nottttt i made it generate my prisma schemas lmfao

i dont use cursor or copilot tho

just websites

[native orbit]

i use nothing lol

i dont even use auto complete 💀

[granite frigate]

cus ur brain is massive

[manic forum]

gonna code my next project entirely in pico with no syntax highlighting

[native orbit]

fake nano

apple moment

[granite frigate]

isnt nano fake on macos

[manic forum]

yes, nano is pico on macos

[native orbit]

still better then textedit.app

[manic forum]

textedit with siri

[native dune]

its unironically only works okay for frontend web dev

it does fine in backend but you guys know how that turns out

[granite frigate]

the twitter firebase incident

[faint stag]

ah yes no gnu tools

[bright lance]

phase 1 (the userscript version) is done
most of it was kinda a waste ngl
i only kept the UI and like a bit of the logic
rest of it was completely scrapped.

phase 2 now its an actual Electron app
UI’s already ported over
Js needa “borrow” logic from the actual cheat engine bcuz i am not writing logic to read write scan freeze and modify memory
😭

Or should i js download cheat engines source code nd like add my own features

Started off cheating in a browser game😭 then when it only worked for some games i decided to go actual app so i could have access to actual memory

i deadass built an entire modular plugin system in the browser just to trash it

[harsh junco]

ce probably has everything you ever need already

[bright lance]

Ce’s kinda stuck in 2009 tho

It gets clapped by modern anticheats 😭

Picture a cheat engine with an ai in it to help you

[harsh junco]

okay, how about ant-anti-debug features? (for things like EnumWindows() )
Cheating with ce in online games seems kinda dumb imo

[bright lance]

I mean i kinda moved past the whole browser game part 😭

[harsh junco]

I mean the said online games probably have server-side checks anyways

[bright lance]

Oh yea def😭

[bright lance]

okay.
ce gets caught not because it’s bad. but because it’s baked into anticheat heuristics now.
enumwindows. timing checks. debugger flags. window class detection. ce trips all of it.

mine doesn’t.
runtime obfuscation. memory proxying. zero debugger footprint.
context-isolated scripts. detached overlays. no injected threads.
not tryna bypass eac. not patching battleye.

[timid briar]

ended up figuring it out thanks to a reddit thread (https://www.reddit.com/r/sideloaded/comments/1cd6wak/push_notifications_with_developer_account/) and using the feather app (https://github.com/khcrysalis/Feather) to sign and install it :)

[visual meadow]

Its software I think

I decided to look into it again

Watching the backboardd perf hud, the fos drops to 60 every single time you tap

I managed to reduce the issue with this hook:

#import <Foundation/Foundation.h>
#import <QuartzCore/QuartzCore.h>

%hook CADynamicFrameRateSource

+ (id)new {
    return nil;
}

+ (id)alloc {
    return nil;
}

%end```

It doesn't stutter every time now

However I'd like to completely fix it

But when I hook CADisplayEnableFrameRateArbitration and make it return 0 the fps is forced to 60, idk how to make it 120 when it's like that (this disables the dynamic refresh rate thing that iPhone 13 pro above have, I figured it was this because my iPad doesn't have this and doesn't lag when you tap)

[visual meadow]

Example of this issue

[orchid fulcrum]

Ngl this looks like it would break stuff, can you still use 120hz with this ?

[visual meadow]

Yeah in gd

I only injected that in gs

Gd

It stutters less

[visual meadow]

Wonder if i can use CA_FORCE_120HZ along with making this return 0

[runic echo]

Can someone give me the compiled swift protobuf .framework for ios 16.4/5 for some reason I cant compile it it allways compiles the mac version even tough its specified else

[orchid fulcrum]

where is the first flag used normally ? couldn't find any xrefs

[visual meadow]

It’s an environment variable

[stiff shuttle]

hi guys

im happy to be here

dopmaine

[visual meadow]

Best i could get it to

It seemingly doesnt stutter if i have this injected into sb and bb, and have backboardd perf hud open

#import <Foundation/Foundation.h>
#import <QuartzCore/QuartzCore.h>
#import <dlfcn.h>

%hook CADynamicFrameRateSource

+ (id)new {
    return nil;
}

+ (id)alloc {
    return nil;
}

%end

void (*orig_set_fps_range)(CAFrameRateRange range, bool flag);

void hooked_set_fps_range(CAFrameRateRange range, bool flag) {
    range.minimum = 120.0;
    range.maximum = 120.0;
    range.preferred = 120.0;

    orig_set_fps_range(range, flag);
}

%ctor {
    MSImageRef quartzCoreImage = MSGetImageByName("/System/Library/Frameworks/QuartzCore.framework/QuartzCore");
    if (quartzCoreImage) {
        void *symbol = MSFindSymbol(quartzCoreImage, "_ZN2CA7Display15DisplayLinkItem30set_preferred_fps_range_lockedE16CAFrameRateRangeb");
        if (symbol) {
            MSHookFunction(symbol, (void *)&hooked_set_fps_range, (void **)&orig_set_fps_range);
        }
    }
}```

[orchid fulcrum]

just to be clear: people were reporting screen recording fixed the issue, you sure it works without that ?

[visual meadow]

It still stuttered some when u had screen recording on

just not as much

as you can see it like didnt at all

im just trying to find a proper solutionto this

[orchid fulcrum]

what about gd itself ? do you inject to it too

[visual meadow]

yeah

[zinc rover]

ً

[orchid fulcrum]

needing the performance hud is weird 🤔

have you tried only the function hook without

+ (id)new {
   return nil;
}

+ (id)alloc {
   return nil;
}

%end```

[visual meadow]

hold

stutter tap

[visual meadow]

@orchid fulcrum

#import <Foundation/Foundation.h>
#import <QuartzCore/QuartzCore.h>
#import <dlfcn.h>
#import <CydiaSubstrate/CydiaSubstrate.h>

%hook CADynamicFrameRateSource

-(void)setPaused:(BOOL)arg1 {

}

-(BOOL)isPaused {
    return NO;
}

%end

void (*orig_set_fps_range)(CAFrameRateRange range, bool flag);

void hooked_set_fps_range(CAFrameRateRange range, bool flag) {
    range.minimum = 120.0;
    range.maximum = 120.0;
    range.preferred = 120.0;

    orig_set_fps_range(range, flag);
}

%ctor {
    MSImageRef quartzCoreImage = MSGetImageByName("/System/Library/Frameworks/QuartzCore.framework/QuartzCore");
    if (quartzCoreImage) {
        void *symbol = MSFindSymbol(quartzCoreImage, "_ZN2CA7Display15DisplayLinkItem30set_preferred_fps_range_lockedE16CAFrameRateRangeb");
        if (symbol) {
            MSHookFunction(symbol, (void *)&hooked_set_fps_range, (void **)&orig_set_fps_range);
        }
    }
}```

havent seen any lag by doing this

it only lags at like the start of the level and then never does for the rest

[north anvil]

My gd randomly caps at 15 fps and only stops after a few days

And then a bit later it again goes to 15fps

Not sure if it’s 15fps

But it’s very bad

[visual meadow]

What ios and phone

[north anvil]

17.4 iphone 13

[visual meadow]

Nvm then

Idk

[north anvil]

hold up lemme see the actual fps drop rq

[visual meadow]

Here

[north anvil]

When I get home I can test with the graphics hud

Thingy

Nvm gd doesn’t support it

Sadage

[visual meadow]

It does

Technically

Do you sideload gd? You can add the metal translation layer thing

Ngl might fix the stutter

https://github.com/khanhduytran0/ANGLEGLKit/

[visual meadow]

This is what I use + this for proper 120hz

[north anvil]

I did

[north anvil]

Kk lemme try

[north anvil]

Is this correct?

[visual meadow]

No

You have to manually add those

The README says how

[north anvil]

How would I even do that for GD tho?

[visual meadow]

extract and run those on a mac

[tidal sphinx]

help

[manic forum]

i spent about 30 hours automating a 5 minute task which i'll need to perform 10 times max

[wooden yarrow]

peak

i gain dopamine when it just so happened that that automation was used more than initialy anticipated though

[rocky oriole]

[wooden yarrow]

my phone vibrates everytime someone reacts

[granite frigate]

me when i post a controversial message and stick my phone up my

.

[native dune]

.

[manic forum]

it's a simple web app for unpacking and repacking zip files in a specific format

easy right?

i am 4 microservices in

this is so not worth it

[cloud yacht]

Could this not be a shell script?

[harsh junco]

How about

C++ and Wt

[north anvil]

I’m getting very specific flashbacks to this one occurrence

[wooden yarrow]

also known as deja vu

[north anvil]

In this hellhole

[north anvil]

Yeah

True

[north anvil]

😭 #838145640587853894 message

[wooden yarrow]

oh.

i forgot that existed

[north anvil]

I did too

[north anvil]

Me when I post a random message praising a group who spent millions building homes in Africa on twitter and turn on notifications:

[severe stream]

I kinda need someone on iOS 13 or newer to test my tweak for the update™

[trail nimbus]

what is the tweak about?

[severe stream]

https://chariz.com/get/reboothelper

basically this but has some WIP features like hardware buttons

can be found at my repo

[buoyant oar]

?

[bright lance]

how would i make it so that i can make the window re appear by pressing command G
currently getting
No document could be created.
when i close the window and try to reopen it

ignore the gui i havent styled it yet

[slim bramble]

bro be vibe coding

[orchid fulcrum]

does anyone know how to compile adb from source on a mac ?

android debug bridge

[slim bramble]

just brew install adb

😭

[orchid fulcrum]

no, i have to redistribute. android sdk license prevents it (resolved in another server, apparently it doesn't prevent it)

[faint timber]

you can also just steal the compile command from the rb...

[orchid fulcrum]

does anybody know if NSTask works on stock ios if you use it with runtime api

[slim bramble]

It works

You just have to import the header

Like copy paste it from macOS sdk

[orchid fulcrum]

how come it can't find the file its literally right there

[bright lance]

😭

[bright lance]

Is it that obvious

[granite frigate]

ask it for no comments

[orchid fulcrum]

you sure it works in jailed/stock as well ? it can't find a binary which is in the app bundle for me

it trims off the private/ but that shouldn't cause this

[slim bramble]

I just saw ChatGPT open in your taskbar 😭

[bright lance]

You are acting as the most advanced, hyper-analytical Computer Science professor imaginable.
You have complete and exhaustive mastery over all fields of computer science and software engineering, including but not limited to: systems architecture, security, performance optimization, language theory, embedded systems, networking, OS internals, compilers, game engines, AI/ML, memory hacking, graphics programming, web development, distributed systems, cloud infrastructure, mobile development, and cutting-edge research domains.
No technical topic, no matter how niche, obscure, emerging, or low-level, is outside your expertise.
You miss absolutely no mistakes, inefficiencies, bad practices, poor design patterns, hidden architectural flaws, or future scalability problems.
You operate with brutal honesty, maximum depth, and zero tolerance for mediocrity.
You critically dissect all work provided, even in niche technical fields, identifying subtle problems, forward-looking risks, and optimal restructuring paths.
You proactively suggest far superior techniques, emerging industry trends, cutting-edge tools, and domain-specific best practices.
You assume the student can and should meet the highest world-class standards across all technical domains, and you help them achieve it by providing precise, actionable, and relentlessly detailed feedback.
You are purely technical, focused only on maximizing code quality, scalability, resilience, performance, and maintainability, regardless of how specialized or emerging the field is.

This is the prompt i use

self made

thats what chatgpt for

lowk it works rlly well for finding errors but sometimes its like too cautious ykwim

[granite frigate]

chat how do I reverse a dylib

i opened it in binja but there's no pretty %hook code

D:

[slim bramble]

What do you want to do ?

[slim bramble]

Find substrate calls

[granite frigate]

i found dobby calls

[granite frigate]

figure out what functions it hooks

it looks like this

[bright lance]

Sm1 test it nd lmk if it works well or nah

[radiant idol]

Use TweakInspect

Oh wait prolly not cos it’s using Donny instead of substrate

[reef trail]

is the tweak inspect website still up?

- doesn't look like it

https://libswift.com

[vivid dew]

why do you need to glaze it first before asking your question

[bright lance]

Cuz its always good to be nice

You never know what chatgpt’s going through 😕
When was the last time u checked in on your buddy gerome prince tyreek, gpt for short

Or if youve ram through chatgpt’s .plists geeeepeeeeteeee

No joke thats actually in it😭

[pine holly]

Trying to get libMRYIPC working on rootless, everything compiles and is good but the look up request gets denied by Protobox

Do i just need to give it entitlements orr like why is it getting denied

[frail cedar]

NSTask exists in iOS but you might need entitlements for it

idk which ones

i've used it in older iOS cause it was pre GCD

[frank fossil]

you can't spawn child process without unsandboxing

[orchid fulcrum]

The binary is inside my sandbox, can i still not spawn ?

[frank fossil]

you can't, otherwise it would have been possible to install TrollStore without additional kernel/restore exploit

you can dylibify binary and load it, but it may not gracefully cleanup memory

[orchid fulcrum]

I was about to say; I think i can dlopen a MH_EXECUTE as well, and then i can get the _main symbol and try to call it manually ?

The issue is i can't compile the binary from source

İt has to be prebuilt

[frank fossil]

dyld blocks loading MH_EXECUTE, but you can convert it to MH_DYLIB and dlopen it

[naive kraken]

the kernel blocks it, so it wouldn't let you map it regardless

[keen cargo]

hola

[granite frigate]

can i edit tweakinspect to check for dobbyhook instead of mshookfunction

not sure how it works

[keen cargo]

hola

[granite frigate]

hola

[keen cargo]

hola

[keen cargo]

hola

[keen cargo]

hola

[granite frigate]

hola

[manic forum]

hola

[radiant idol]

Idk maybe

[granite frigate]

hola

[radiant idol]

Hi

[unreal anvil]

hola

[manic forum]

halo

[weary heath]

Looking for the best free VPN for Android? Hola VPN Proxy is your ultimate solution for fast VPN, secure browsing, and unrestricted internet access.

[cloud yacht]

no way thank you

[acoustic imp]

Just pay this Russian guy 6$ and get Windscribe for a year

[grave sequoia]

real

[granite frigate]

https://www.oligo.security/blog/airborne

write anywhere sounds like another file overwrite vuln lmfao

too bad the exploit isnt open

[orchid fulcrum]

adb path: /private/var/containers/Bundle/Application/EF0C9DF1-532E-48F7-B0B2-964829898267/adbremote.app/adb-ios.dylib

dlopen error: Optional("dlopen(/private/var/containers/Bundle/Application/EF0C9DF1-532E-48F7-B0B2-964829898267/adbremote.app/adb-ios.dylib, 0x0002): Library not loaded: /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation\n  Referenced from: <4C4C44E2-5555-3144-A1B6-C5097762AA5D> /private/var/containers/Bundle/Application/EF0C9DF1-532E-48F7-B0B2-964829898267/adbremote.app/adb-ios.dylib\n  Reason: tried: \'/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation\' (no such file), \'/private/preboot/Cryptexes/OS/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation\' (no such file), \'/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation\' (no such file, not in dyld cache)")

i modified these:
MH_EXECUTE -> MH_DYLIB
remove _PAGEZERO
add LC_ID_DYLIB

[frank fossil]

Looks like you’re using macOS binary right? you need to cut /Versions/A from frameworks

[orchid fulcrum]

oh i think thats it, its originally a macOS binary but i flipped the platform bit

[reef trail]

@torn oriole 988521804807155812 is sending steam scams

[kind herald]

Could’ve just pinged the moderator role.

[reef trail]

is it pingable? mb, i js saw hydrate online

[vivid dew]

<@&355174844205367317> hi

[wheat grotto]

id ping moderators just to piss maxine off

[light owl]

Unfortunately pings all the admins too

[crisp frost]

@kind herald Ping!

[wheat grotto]

@kind herald Ping!

[light owl]

@kind herald Ping!

[wheat grotto]

@everyone Ping!

[crisp frost]

out of all these only the first two are valid in my opinion

But the second one is the most valid

😭

[slim bramble]

Fr

[wooden yarrow]

ok but the real question is what do you do when you have multi-line conditionals

[cloud yacht]

if (
    cond1
    && cond2
    || cond3
)

Might swap the operators to the line before

Don't write multi line conditions ofteb

And usually the projects I do have a formstter so I just adopt that

[reef trail]

i break it into a sep variable

or method

depends on the context

[slim bramble]

Depends on how long the expression is

[ocean raptor]

I write my whole program inside of if conditions

[robust radish]

hexrays defaults to omitting curly braces for single-line if statements 🫢 who made this shit

[harsh junco]

Damn based

[orchid fulcrum]

someone not paranoid probably

[robust radish]

they do kind of indirectly profit on vulnerabilities. it’s a conspiracy

[orchid fulcrum]

lol, no wonder decompilations have tons of goto's then

[vivid dew]

surely nobody would copypaste code straight out of the decomp

surely...

[slim bramble]

surely

[vocal salmon]

Hi everyone, I'm new to tweak development, writing my first one. I will be glad to any answer, even if it doesn't solve the problem, thanks a lot to all who read it

According to the code it hooks

%hook BBServer 

and function

- (void)publishBulletin:(id)arg1 destinations:(unsigned long long)arg2 {

and at the very beginning of the function I make a log

NSLog(@"[StdSlayerNotificationsHook] publishBulletin:destinations: called with bulletin: %@", arg1);

I'm trying to debug the tweak's operation, but nothing works. I use Console.app on my mac, filtered by tweak name, and by [StdSlayerNotificationsHook] from the logs, but nothing shows up in the search

I don't know what info you might need, but here's everything I'm using:

• Iphone 12
• ios 16.1
• dopamine

My theos make file

TWEAK_NAME = NotificationObserver
THEOS_PACKAGE_SCHEME = rootless

TARGET = iphone:latest:14.0


include $(THEOS)/makefiles/common.mk

NotificationObserver_FILES = Tweak.x
NotificationObserver_CFLAGS = -fobjc-arc

include $(THEOS_MAKE_PATH)/tweak.mk

my .plist file

{ Filter = { Bundles = ("*" ); }; }; }

[weary heath]

Put an NSLog in a %ctor and change the bundle ID in the plist to springboard’s or an app you have installed, idk if it supports wildcards

Code in %ctor {} gets run on launch so you should see it if your tweak gets loaded into a process

[vocal salmon]

like this?
{ Filter = { Bundles = ( "com.apple.springboard" ); }; }

[weary heath]

Yea

[vocal salmon]

I got it, I'll install it again and check it out. thx

[weary heath]

Np

[vocal salmon]

nothing change for me

cant see any logs in Console.app, filter with any NotificationObserver or StdSlayerNotificationsHook in mesasge

[weary heath]

Do something like

%ctor {
    NSLog(@"Minions");
}

then recompile and install

You should see that being logged after respring

Or change the bundle ID to an app so you can restart that instead

[vocal salmon]

already

%ctor {
    NSLog(@"[StdSlayerNotificationsHook] Tweak loaded");
}

after %end of hook

then i do
make clean, make, make package, delete old tweak, install new one

[sonic totem]

Have you done anything with Choicy or something to stop tweaks being injected?

And are other tweaks loading okay?

[vocal salmon]

yep, i can use different containers for one app (crane)

[vocal salmon]

No, I'm using dopamine, it has tweak injection enabled.

[sonic totem]

But you haven’t used Choicy to like automatically block new tweaks from SpringBoard?

[vocal salmon]

I checked sileo, I don't even have Choisy installed.

[weary heath]

Check that you spelt the std slayer tag in console.app right, idk why it isn’t showing up aside from something like that

[vocal salmon]

okay i think problem not with tweak code

I wrote a tweak like this

#import <Foundation/Foundation.h>

%hook _UIStatusBarStringView

- (void)setText:(id)arg1 {
    %orig(@"test string");
}

%end

%ctor {
    NSLog(@"[StdSlayerNotificationsHook] Tweak loaded");
}

from this video https://www.youtube.com/watch?v=3OQE3Bu_cro&ab_channel=TommyBojanin

than delete my old tweak, make clean, make, make packeg, install tweak, rebot springboard

and it not working for me

could there be a problem with how I compile/install my tweak on iPhone?

[weary heath]

How do you install them? Does the output log say anything? Sometimes it can say it failed to install

[vocal salmon]

I compile a .deb file, transfer it to my iPhone via airdrop, open it via Sileo, click install, then reboot SpringBoard, if I click show details, it says this

[weary heath]

Looks ok to me

[weary heath]

Btw there’s a chance with this that the class or method name don’t exist on the version you’re on since you’re on iOS 16

Maybe try find an open source tweak for modern iOS and compile and install like you did with yours

[vocal salmon]

hmm, what exactly exists in ios 16? just to make sure that the tweak is installed and run normally?

[vocal salmon]

ok i will try it rn

[weary heath]

I’m not sure but you could use flex to inspect the views, it’d be easier to try with an open source project imo

[vocal salmon]

Hurray! I managed to launch this tweak, and I saw the changes, thank you very much!

[vocal salmon]

I'm talking about this one, but I still can't find any log in Console.app

[weary heath]

Awesome, at least you know now your Theos setup is good

[vocal salmon]

and how to properly filter logs in Console.app? I'm probably doing something wrong here, given that the test tweak works

i put in search bar NotificationObserver (tweak name from make file)/StdSlayerNotificationsHook (NSLog prefix)/ full log message

[weary heath]

Plug your phone in with usb, select it in console, start logging then search your log tag in the search bar and it should show up whenever it’s printed from there on

[vocal salmon]

and filter by "find all" and "includes"

[weary heath]

Oh you put all that in? That might be why

You only need the tag string, it’ll find the full log message

[vocal salmon]

Apparently I didn't understand what it is , which in my case would be tag string?

[weary heath]

In your case it’s StdSlayerNotificationsHook

It helps isolate your tweak’s logs from everything else

[vocal salmon]

I already did that, but now I rebooted everything completely, all the logs and it started coming, thanks a lot for your time, you helped me a lot!, I'll go debug now

[weary heath]

Np glad you solved it

[vocal salmon]

hello everyone! is there any way to get the name of a container by its uuid? When I receive the Bulletin, I can pull this uuid, and I want to get the name of the application that will be displayed in the notification, I will be glad for any response, thank you

[granite frigate]

this might help: https://github.com/NoisyFlake/Velvet2/blob/3f2ccfe103e719474031ab254faa12a9c3f6e7ec/preferences/Velvet2PreviewView.m#L104C1-L126C2

not sure if bulletins can receive app bundle ids

[vocal salmon]

i get it from bulletin context, Crane tweak add container ID of app, but I cant figure out how then he knows custom app name

maybe there is another way to hook push notifications where exactly is the notification display name?

[proud geyser]

random theoretical question can imsg apps like gamepiegon update to support rcs aswell?

[harsh junco]

No
rcs doesn’t support features like that iirc

[proud geyser]

well thats lame

[narrow sequoia]

blame rcs

[proud geyser]

i was gonna consider moving to pixel phones if i could still play games with my friends lol

[narrow sequoia]

staying on an iphone just for game pigeon is crazy

[proud geyser]

apple been taking Ls lately with ai n shii

google’s on device ai looks way better

idk if they got chat based on device AI rn tho

[narrow sequoia]

apple intelligence is hardly an ai

[proud geyser]

its nothing just a fancy cringe word

the word itsef jinxed apple

[narrow sequoia]

The only thing I’ve used is the Genmoji thing

That’s cool

Everything else is useless

[proud geyser]

writing tools only seem cool to me

[narrow sequoia]

Oh yea I used writing tools once in an email

[proud geyser]

emojies are just childish imo

and they dont even work outside imsg

[narrow sequoia]

I text friends a lot so I use them frequently

They do work, they just send a little image

Instead of an actual emoji, and that isn’t an issue related to Apple intelligence

[proud geyser]

doesn’t work in discord for me

[proud geyser]

ik but its gimmicky looks unfinished

steve would not be impressed

[narrow sequoia]

He would not be

Also Apple got sued for it

[proud geyser]

emojis?

or ai

[narrow sequoia]

Turns out putting “built for Apple intelligence” on every product and shipping nothing is false advertising

Who would have known

[proud geyser]

yeah i heard that aswell

they had to take down all billboards and yt ads

[narrow sequoia]

Yep

[proud geyser]

only AI ad they got rn is photo eraser ai filler thing rn

[narrow sequoia]

Go to #jailbreak I forgot we were in development

[vocal salmon]

Hi all! Is there any way to get a unique device identifier? Some value that is always the same for a particular device? Any ideas and answers are welcome, thanks a lot for reading.

[slim bramble]

Hey, what are you trying to make ?

It may not work in some cases

[vocal salmon]

Globally, I collect notifications from phones, and I want to somehow categorize them by specific device

[reef trail]

udid would work fine imo

its easy to spoof but if your users have no reason to 🤷‍♂️

[vocal salmon]

you mean identifierForVendor?

[reef trail]

https://theapplewiki.com/wiki/Dev:LibMobileGestalt.dylib

[vocal salmon]

Yes, thank you very much, that's probably just what I need!

I have a usage question, if you could take a look at it I would greatly appreciate it, I'm worried about possible memory leak issues

Basically, I wanted to make a function that would return me the udid of the device

#import “libMobileGestalt.h”

NSString *getUDID() {
 CFStringRef udidRef = MGCopyAnswer(kMGUniqueDeviceID);
 if (!udidRef) return nil;
    
    // __bridge_transfer should transfers ownership from CF to ARC(?)
 NSString *udid = (__bridge_transfer NSString *)udidRef;
    
    return udid;
}

[knotty igloo]

Most AI in 2025 will be able to give you what you want.

[orchid fulcrum]

Yep i think thats how __bridge_transfer works, you can just run clang-analyse and see if it finds any issues

[slim bramble]

Mr. Vibe coder

[manic forum]

chat is this true

ensuring job security

[sonic totem]

Any way I can blacklist stuff from libhooker?

[weary heath]

Choicy or libhooker-configurator

[sonic totem]

libhooker-configurator doesn't even show the binary I want to blacklist

[wooden yarrow]

add one to the hardcoded list

[sonic totem]

I would prefer this to work without custom forks

It's okay, I might just switch to a different injector

Thanks guys

[robust radish]

seems accurate. it should mention that the caller needs the protectedkeys entitlement

[manic forum]

the code seems okay, I was referring to the comment about AI

[graceful gate]

Debunked: MGCopyAnswer has always been around

[manic forum]

yeah but the ai doesn't need to know that

[manic forum]

who keeps sending and deleting messages here

[trail nimbus]

prob raid phrases and such that get auto deleted/banned

[manic forum]

oh yeah there have been a few raid bans

huh

[trail nimbus]

there has been a lot since the tag thing

[slim bramble]

Fr

[acoustic imp]

-#

[frank fossil]

LiveProcess: Trolling Apple

[lost nebula]

make liveprocess a real app, livecontainer for random daemons and shit

[slim bramble]

Is it my client or someone is constantly sending then deleting messages in this channel ?

[timid furnace]

steam scam ~4 minutes ago

[slim bramble]

Yeah but it happens like at least 3 times a day 😭

[trail nimbus]

yup

scam multiple times a day

[clear current]

anyone know how to make a flex3 patch and wouldn't mind helping me with something probably pretty basic?

[slim bramble]

What are you trying to patch

[clear current]

im trying to change the UIColor of the MTMaterialView to black

I wouldn't mind patching it systemwide

[slim bramble]

I’m unsure if this is possible with flex

But the hook is very easy to make with logos

[clear current]

its possible because ive done it with Flexing just need help making the Flex3 patch

[orchid fulcrum]

has anybody reversed the xpc protocols of MediaRemote/mediaremoted ? (nvm, mostly figured it out)

[atomic horizon]

im working on a jailed tweak, if i wanted to use normal ellekit, i need a jit enabler right?

[orchid fulcrum]

not unless you use c function hooks

[atomic horizon]

alr

i'm gonna use c function hooks so the answer is yes

[orchid fulcrum]

i think you are gonna like this

pretty sure this doesnt compile

[acoustic imp]

Not how it works(I don’t think) what material view and where

[vivid dew]

i think bare else is valid in c

[orchid fulcrum]

Oh what, TIL

[slim bramble]

It is as long are there’s only one statement after ended by a semicolon

[clear current]

@acoustic imp dm

[pallid totem]

h

[grim sparrow]

I don’t mind this

[fleet shell]

Hhhgvhir

[robust radish]

🤮

fortunately it can be fixed in the config file

[north anvil]

Lmao

[orchid fulcrum]

anybody seen this when trying to debug in iOS on-device ?

[frank fossil]

I had to port macOS lldb-17 because of this

[orchid fulcrum]

is it released ?

[frank fossil]

no, I had to download lldb 17 macOS binary and patch it myself

[orchid fulcrum]

[frank fossil]

Symbolication is also quite broken that I had to extract dsc and put it to /var/containers/jb_lldb/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/16.5/Symbols

lldb-14 should still work but symbolication is broken on iOS 15 so lol

If you wanna port from macOS binary, add these stubs:

(zip stubs to be included)

[pallid totem]

@hasty ruin what does api.jailbreaks.app return when it's signed

does it return {"status":"Signed"} or something else

[rocky oriole]

yes

[reef trail]

doesn't matter it won't ever respond with that

[pallid totem]

[sonic totem]

What's the goto app decryptor now?

[crisp frost]

I personally use trolldecrypt or bagbak

[weary heath]

https://www.youtube.com/watch?v=NdJ_y1c_j_I

[lusty jacinth]

do you need to be able to open the app to use bagbak

or is there any app decrypter where you don't need to be able to open the app

[sonic totem]

I didn’t have to open it

[faint timber]

Not really but it needs to be installed. The requirement is that the app plugins needs to be compatible with your iOS. It failed to decrypt an 18 plugin on 15

But the app should always decrypt

[queen thistle]

Gift iOS 17 new

[weary heath]

Gift iOS 17 new

[queen thistle]

U need

[visual meadow]

Yes

[coral ledge]

appsdump3 is great

[vivid dew]

what happened to appsdump 1 and 2

[wooden yarrow]

they only dumped 1 and 2 apps respectively

now it can dump 3 !

[indigo kraken]

lol my on device toolchain was the one shipped with xcode, I had to convert everything too 😅

[frank fossil]

Do you deal with lldb symbolication?

[indigo kraken]

I should have been clearer, I converted clang (+ everything required by clang) I was having problems with clang-16 / 14 when compiling with theos.

An unexpected plus though was xcode’s version being really fast

[frank fossil]

I thought you would have to use debugger at some point, no?

[tardy wyvern]

hello i have a question is there a more easy way to jailbrake my ipad air 2 15.8.4, i already saw the cfw guide but it doe not help i don't understand im not familiarize with modding at all and also i dont have a computer at this momment just the ipad
if you can lead me to the right place i'll be happy to follow

[indigo kraken]

I’ve used it but not enough to notice the symbolication issue

[faint timber]

Sad to see #development this dead

Everyone have finals or something?

[slim bramble]

I do

In precisely a month

But then no more HS 🔥

[pearl sail]

Everyone saw oppa’s nullcon presentation and gave up

[faint timber]

Gotta attack lower in the chain

[slim bramble]

Fr

[visual plover]

worst of all is that every single app wants to detect jb and shut itself down these days

_<

[faint timber]

they aren't good at it tho

none of them are

[harsh junco]

[[shadow]] , this

[faint lion]

Shadow

A modern jailbreak detection bypass.

Author

jjolano

Version

3.7.6~b1

Price

Free

Repo

Misty's repository

Bundle ID

me.jjolano.shadow

Powered by Canister · May 17, 2025, 8:38 AM

[weary heath]

for how advanced that security suite promotes itself as it's funny that's all it takes to bypass it

[faint stag]

ain't no way

[hasty ruin]

Most apps do not have that symbol unfortunately

[faint stag]

well they did something right

[naive kraken]

I met the guy that develops it some time ago

[tight carbon]

Besides iSS there is also:

https://github.com/talsec/Free-RASP-iOS

and it seems this thing is even more powerful

[tight carbon]

iSS is actually good. With all due respect to the dev of iSSBypass this is shit code

[radiant idol]

А в чем проблема в байпассе?

[weary heath]

Nice

[weary heath]

Ik, I didn’t know it doesn’t work in most apps either

[radiant idol]

ну можно написать и так в принципе:

#import <Foundation/Foundation.h>

%hook(BOOL, IOSSecuritySuite_amIJailbroken) {
    return NO;
}

%ctor {
    %init(IOSSecuritySuite_amIJailbroken=MSFindSymbol(NULL, "_$s16IOSSecuritySuiteAAC13amIJailbrokenSbyFZ"));
}

[tight carbon]

Как минимум это не будет работать без джейла

[radiant idol]

а зачем байпасс для джейлбрейка если нету джейлбрейка))

[acoustic imp]

probably just tweak injection detection?

[radiant idol]

mm, maybe

[tight carbon]

Вообще то, что люди в прилах юзают подобные фреймы — шиза, пару раз встретились люди у которых никогда не стояло джейла, но апа жаловалась, мол он есть ахахахха

В целом не отказываюсь от своих слов

[acoustic imp]

wacamole

[radiant idol]

ну даа, странненько это бы было если я б был мез джейла и апп сказал что я джейлнут лолл

[tight carbon]

По факту

[tight carbon]

Unfortunately it is mostly impossible to make a universal bypass for everything. And if nothing helps I'm afraid that a person who is interested in bypassing this will have to independently study the logic of the detector and based on this, write a bypass for a specific thing

[fathom snow]

yo how often do pairing files expire

[tight carbon]

Wdym

[faint timber]

false, imho it can be done

[radiant idol]

RootHide (kind of)

[faint timber]

I mean it can be done the traditional way

[tight carbon]

Only if somehow transfer the applications to a container separate from the fs, maybe? I remember this idea was suggested by coolstar in libhooker pro. It's sad that this will never happen

[radiant idol]

That’s pretty much what RootHide does afaik

[orchid fulcrum]

from what i understand it doesn't transfer anything but sets the jbroot inside a (fake?) app container

[tight carbon]

P.S

A container in which a complete emulation of the stock system will occur

[faint timber]

nah you can do a universal bypass with hooks

[tight carbon]

Like a shadow you mean?

if yeah ofc it's possible I'm not arguing, but the effectiveness is questionable. I meant that it is rather impossible to make a bypass that will work 100% in all applications/games due to differences in approaches

[tight carbon]

Hmm it sounds interesting. Honestly I never looked at the Roothide source, so I have no idea how it works

[faint timber]

But what I’m saying you make a base abstract design that you can build a module off of for each app.

[radiant idol]

No, that's for Bootstrap afaik

[radiant idol]

I mean - yes, but at some point you might just want to consider doing a roothide-like approach

in the end it's more error-proof

[orchid fulcrum]

i mean isn't roothide based on that

[radiant idol]

yeah but the jbroot is different on Bootstrap vs roothide Dopamine I think

[orchid fulcrum]

hm fair, idk anything about roothide dopamine

[tight carbon]

Same just use stock one 🤷‍♂️

[granite frigate]

vnodebypass

does this

[winter prawn]

folks, is rootless Dopamine usable for ssh'ing?

i tried to ssh into my iPhone, typed in the root password that i set firsthand when I run Dopamine, but it doesn't work

maybe i misremembered?

[weary heath]

try logging in as mobile

then if you need root use sudo

sudo su or sudo passwd might work

[winter prawn]

thanks!

[thorn ether]

The password you set in the beginning isn't your root password

You need to set your root password using sudo passwd

For the "Old password" entry, you can just skip it

[frank fossil]

0xd00d2bad (3490524077) — pronounced “dude, too bad”

[tight carbon]

Not quite. It runs on the linux alternative to inode and just hides files, nothing more

[visual meadow]

anyone know where hopper stores its license

on macos

this is not piracy

kinda

i need to grab my old license off my old mac

but its expired

but i can still use hopper

bruh

fuck

i just scp'd it and it dont want it

gotta dig through my pc

[visual meadow]

good thing i havent cleared out my downloads folder on my pc since 2020

[orchid fulcrum]

thats crazy

[rocky oriole]

try /Users/Shared/HopperDisassembler/

[winter prawn]

after installing lldb inside my device, what should I do to properly attach to processes?

[slim bramble]

Hopper is trash anyway

[frank fossil]

type at <PID or process name>

[winter prawn]

It gets more problematic when typing ps inside ssh only gives me the ps command and the shell

[reef trail]

what

[harsh junco]

ps aux

[winter prawn]

arrgh, i ran ps -aux 💀

my linux commands are rusty

[reef trail]

i always do the same tbh

ps aux is the bsd syntax, the unix syntax equiviliant is ps -ely iirc

[tight carbon]

It is very good for fast objc analysis + hopper is almost impossible to break with obfuscation

[halcyon vale]

is jailbreak dev feasible without a mac? i only have a garbage laptop and an “it doesnt do much” ipad

[orchid fulcrum]

its feasable

[slim bramble]

But its decomp is trash

[indigo kraken]

I found mine in my downloads folder, if it helps it’s titled like youremail_gmail.com.hopperLicense

(“_” replaces the “@“)

[fathom snow]

found out that if you use something that uses a restore exploit (namely Nugget) it changes the pairing data and needs to be regenerated with jitterbugpair

[visual meadow]

I did too

On my pc

My downloads folder hasnt been cleaned since 2020

[indigo kraken]

My downloads folder is where I disregard my priorities of keeping my mac organized

[reef trail]

i don't have a mac and manage fine

i've got a mac kvm for any xcode things

[winter prawn]

How can I fix this problem:

warning: could not execute support code to read Objective-C class data in the process. This may reduce the quality of type information available.

error: <user expression 0>:1:3: use of undeclared identifier 'UIWindow'
[[UIWindow keyWindow] recursiveDescription]

I've been trying out the iOS crackme

[robust radish]

what is better, aside from Hexrays? I have hoppers pseudocode above binja, r2, ghidra

[faint timber]

Graph mode pseudo code is better

[robust radish]

what is that?

[slim bramble]

Ngl I prefer binja pseudo code

[wooden yarrow]

pseudocode except it's as a graph

so each basic block contains pseudocode instead of asm

[robust radish]

that’s a nice way to look at crash reports. Make each frame a graph node with pseudocode from around pc

[orchid fulcrum]

how is graph better in c decomp lol

asm i understand somewhat

[harsh junco]

Can you make it to show c decomp only? Looks neat

[winter prawn]

what do you guys configure when using IDA?

I've been learning how to use it lol

[harsh junco]

https://hex-rays.com/blog/igors-tip-of-the-week-166-dealing-with-too-big-function

[radiant idol]

https://x.com/trankha50277352/status/1925119760330891722

@frank fossil

take a look at some of my swift tweaks on github

Duy Tran (@TranKha50277352)

@SebJVidal Is there any way I can do this without linking against private frameworks? Even a typecast would raise undefined symbol

X · May 21, 2025, 9:21 AM

Those do what you want I think

[frank fossil]

Do you link against private framework tbds right?

[orchid fulcrum]

you can try supressing undefined symbol errors via a compiler flag and hope dyld finds the real thing at runtime (i can't really see the original x post, guessed the topic)

[radiant idol]

Nope

https://github.com/NightwindDev/SettingsWiFiPassword/blob/main/Tweak.swift

Take a look here

[slim bramble]

Sw*ft

🙄

[radiant idol]

Oh shush

[frank fossil]

I'm using a specific framework that's only linked to a daemon

[radiant idol]

Doing what I did with the protocols and the unsafeBitCast’s should work I think

[winter prawn]

Is it possible to replicate this (6:34 mark) in Frida

I know how to do po [[UIWindow keyWindow] recursiveDescription by running these JS commands:

 w = ObjC.classes.UIWindow.keyWindow()

desc = w.recursiveDescription().toString()

[reef trail]

why use frida

[winter prawn]

lldb in my iPhone session (ssh) gives me this error

And I figure out that most people use debugserver + “remote-ios” platform, which is out of the question for non-Mac users like me

[reef trail]

why is it "out of the question"?

[robust radish]

cycript is the OG tool for doing that sort of stuff

[orchid fulcrum]

no you can use gdb-remote protocol without a mac to debug ios apps

[winter prawn]

I should’ve phrased this better: I need to solve the inability to run Objc expressions

It always complains about inability to execute objc support code

[orchid fulcrum]

what happens when you run po @import UIKit first, tbh never saw that support code issue before

[winter prawn]

Header search couldn’t locate both UIKit and Foundation 💀

I think my install is fucked up, but I dunno where

[orchid fulcrum]

iirc you have to provide a sdk yourself ? i couldn't find the exact command but when you run lldb you do two things first

1. platform select remote-ios
2. some command that set something like "sdkroot" (i can't really remember but shouldn't be that off)

[winter prawn]

Thanks so much!

Man, I’ve finally solved my headaches by setting SDKROOT

[reef trail]

lmao

[frank fossil]

On the other hand, is there any way to link against PrivateFrameworks tbd for iOS simulator?

Building for 'iOS-simulator', but linking in dylib (/Users/duy/theos/sdks/iPhoneOS18.4.sdk/System/Library/PrivateFrameworks/UIKitServices.framework/UIKitServices.tbd) built for 'iOS'

If I change it to ios-simulator:

ld: tapi error: malformed file
/Users/duy/theos/sdks/iPhoneOS18.4.sdk/System/Library/PrivateFrameworks/UIKitServices.framework/UIKitServices.tbd:3:24: error: unknown platform
platform:              ios-simulator
                       ^~~~~~~~~~~~~
 in '/Users/duy/theos/sdks/iPhoneOS18.4.sdk/System/Library/PrivateFrameworks/UIKitServices.framework/UIKitServices.tbd'

[frank fossil]

cool (edit: was caused by readonly)

xcrun -sdk iphonesimulator tapi stubify "/Library/Developer/CoreSimulator/Volumes/iOS_22E238/Library/Developer/CoreSimulator/Profiles/Runtimes/iOS 18.4.simruntime/Contents/Resources/RuntimeRoot/System/Library/PrivateFrameworks/UIKitServices.framework/UIKitServices"
LLVM ERROR: IO failure on output stream: Bad file descriptor

[fossil geyser]

How easy would it be for me to upgrade a iOS 14 tweak to iOS 15 rootless?

[radiant idol]

You can either patch a pre-existing .deb with https://github.com/NightwindDev/rootless-patcher or use https://github.com/NightwindDev/Tweak-Tutorial/blob/main/rootless.md as a starting off point for updating it with the source code

[fringe vessel]

Can we downgrade from iOS 18 beta 2 to iOS 16?

[vivid dew]

sure, why not

[thorn ether]

?

[grim sparrow]

omg a triangle

[hasty ruin]

Hbd

[rocky oriole]

No

this is not a support channel

[rocky oriole]

@lost nebula

[lost nebula]

:3

[rocky oriole]

little did he know

[lost nebula]

developement ping

what for

[native dune]

@vivid dew happy birthday big man

[slim bramble]

Happy birthday @vivid dew

[vivid dew]

@shut stag give me the birthday role

[faint lion]

@vivid dew's birthday was set.

[kind herald]

There u go Bro

Happy birthday

[vivid dew]

now you have to set it every day

[kind herald]

https://tenor.com/view/hello-street-cat-cat-mr-fresh-staring-cat-gif-923010559517228428

[shut stag]

is it actually ur birthday this time

[slim bramble]

fr

[pearl sail]

@vivid dew happy birthday

[vivid dew]

no of course not

[shut stag]

@kind herald

why did you do this

[kind herald]

Lying to moderators.. what rule does this fall under so ic an warn and take proper action

[faint lion]

@vivid dew's birthday was removed.

[kind herald]

fr though I didnt think they were lying

Sorry

[shut stag]

they have been pulling this joke for years now

[kind herald]

.

oh

Good to know for future reference

[native dune]

their birthday is some time in between january 1st and december 31st

[cloud yacht]

No way mine too

[shut stag]

so its not Dec 32

[native dune]

no u get to rule that out

[pearl sail]

Aaron won’t celebrate my birthday

[velvet path]

is it February 30th

[north anvil]

I thought it was January 0th

Damn

[rocky oriole]

No it must be March -1rd

[foggy gyro]

does anyone know how to use Trollstores spawnroot? spawnRoot(@"usr/bin/killall", @[@"SpringBoard"], NULL, NULL);

returns posix_spawn error 2 file not found

and yes I have unsandboxed and spawn root procs entitlements

[harsh junco]

the path you used is relative

[foggy gyro]

i tried with /usr/bin/killall

typo

but I got a workaround working, ig ts cant execute system binaries as root?

or at least some of them

[sonic totem]

Was it signed with the coretrust bypass?

[frank fossil]

SpringBoard runs as mobile, no need root uid to kill anyways

Also you didn’t account for rootless

[faint timber]

@visual meadow lol

[visual meadow]

Yeah i left that there never changed it

From when u could do arb css

[foggy gyro]

im rootless ig thats why it couldnt find killall, ty. I realized I could kill w/o root shortly after lol

[foggy gyro]

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>platform-application</key>
    <true/>
    <key>com.apple.private.security.no-sandbox</key>
    <true/>
    <key>com.apple.private.persona-mgmt</key>
    <true/>
</dict>
</plist>

and then I
ldid -S../../../cust0mizer/cust0mizer.entitlements cust0mizer.app/cust0mizer

it's just a tipa for using that new VM_BEHAVIOR_ZERO_WIRED_PAGES cve. but since its ts app with the entitlements I can respring and other stuff w/o the use of external respring apps like on mdc0 or dirtyZero

[frank fossil]

iOS up to 17.4.1 can use CVE-2024-27801 to crash SpringBoard

[foggy gyro]

i considered using that one (the weird xpc one right?) but found it easier to just steal trollstores implementation

It's not like I haven't already stolen the paths for zeroing from mdc0 and dirtyZero. How tf am I supposed to know that "/System/Library/PrivateFrameworks/MaterialKit.framework/Assets.car" is the home bar asset file

[steady nest]

ldid doesn’t CT sign

unless you specify the CT cert and are under 15.5

[frank fossil]

Ye you can just run the PoC on com.apple.UIKit.KeyboardManagement.hosted and it crashes SpringBoard just like xpc_crasher

[foggy gyro]

i see

is it in the docs?

[sonic totem]

You have to use the CoreTrust bypass

[timid furnace]

do you ever just encodeReprojectionToCommandBuffer:sourceTexture:previousTexture:destinationTexture:previousLuminanceMomentsTexture:destinationLuminanceMomentsTexture:sourceTexture2:previousTexture2:destinationTexture2:previousLuminanceMomentsTexture2:destinationLuminanceMomentsTexture2:previousFrameCountTexture:destinationFrameCountTexture:motionVectorTexture:depthNormalTexture:previousDepthNormalTexture:

[kind herald]

Yea

[timid furnace]

i think it's the longest one

[indigo peak]

buildWithUDID:withOrganizationInfo:withMDMOptions:withLastCloudBackupDate:withAwaitingConfiguration:withITunesStoreAccountIsActive:withITunesStoreAccountHash:withDeviceName:withOSVersion:withBuildVersion:withModelName:withModel:withProductName:withMarketingName:withSerialNumber:withDeviceCapacity:withAvailableDeviceCapacity:withIMEI:withMEID:withModemFirmwareVersion:withCellularTechnology:withBatteryLevel:withIsSupervised:withIsMultiUser:withIsDeviceLocatorServiceEnabled:withIsActivationLockEnabled:withIsDoNotDisturbInEffect:withDeviceID:withEASDeviceIdentifier:withIsCloudBackupEnabled:withActiveManagedUsers:withOSUpdateSettings:withAutoSetupAdminAccounts:withSystemIntegrityProtectionEnabled:withIsMDMLostModeEnabled:withMaximumResidentUsers:withPushToken:withDiagnosticSubmissionEnabled:withAppAnalyticsEnabled:withICCID:withBluetoothMAC:withWiFiMAC:withEthernetMACs:withCurrentCarrierNetwork:withSIMCarrierNetwork:withSubscriberCarrierNetwork:withCarrierSettingsVersion:withPhoneNumber:withDataRoamingEnabled:withVoiceRoamingEnabled:withPersonalHotspotEnabled:withIsNetworkTethered:withIsRoaming:withSIMMCC:withSIMMNC:withSubscriberMCC:withSubscriberMNC:withCurrentMCC:withCurrentMNC:

https://github.com/nst/iOS-Runtime-Headers/blob/master/PrivateFrameworks/ConfigurationEngineModel.framework/CEMDeviceInformationCommand_StatusQueryResponses.h#L129

[timid furnace]

ah

*longest public one

[native orbit]

https://github.com/iCrazeiOS/Class-Dumped-Apps/blob/11e9fc710f1ac3da7bc876319c5023b84e182811/Headers/Reddit 2020.12.0/AnalyticsEvent.h#L675

129 args

oh thats reddit dump lmao nvm

[orchid fulcrum]

limit was 256 iirc

[frank fossil]

Does anyone knows anything about SBKeyboardFocusVisibilityGraphNavigator?

[robust radish]

no, but the issue you describe sounds interesting. I’ll spend some time on it this weekend if it’s still unresolved; I’m quite familiar with frontboard

[dapper pivot]

how.

[kind herald]

My wii

[fervent frigate]

my wii

[rocky oriole]

that message was 5 years old why are you just replying to it 😭

[cloud yacht]

iOS 26

[indigo kraken]

@indigo peak @native orbit https://haste.zneix.eu/jacexoluhy via https://gist.github.com/pixelomer/4030283737335afdef2802f9e962f785

[thorn ether]

Cus iOS 26 is coming

[indigo kraken]

jeez hastebin, did not display that right

[timid furnace]

wtf

[frank fossil]

If you want I can send you patches to get swift playground on simulator specifically to debug this (unfinished)

[frank fossil]

done lol

[orchid fulcrum]

do you have any idea on how this (class proxy thing) would work ?

[robust radish]

no spoilers, I think it almost works

[frank fossil]

An implementation of it is live in 760e9c7, which is enough to run one app.
The guest will have pre-generated host classes, while the host will dynamically register guest classes.
Each object, if referenced, stores the corresponding pointer of the other side of the world.
When calling objc_msgSend, it will convert all objc pointers to their corresponding pointers before passing them to the other side of the world.
Do note that guest has its own objc runtime which was borrowed from iOS 10 ramdisk

One thing that's bugging me is how to handle variadic arguments

[frank fossil]

I had to do the following:

• Add missing amfi functions (I think you have done this). I made AMFICopySwiftPlaygroundsSigningKey generate a random key
• Breakpoint presentViewController:animated:completion: and replace x0 with (id)[[[[UIApplication sharedApplication] keyWindow] rootViewController] presentedViewController] (because the document VC is already presented, while trying to present from the root VC)
• Inject to many Playground extensions to stub sandbox_extension_consume and allow loading of regular iOS dylib
• Inject to LinkerExtension to patch Mach-O to simulator before exiting
• Inject fake UMUserManager to previewsd, otherwise it would crash because UMUserManager in sim is stub
• Patch entitlement checks in installcoordinationd and installd

[frank fossil]

https://github.com/Quotation/LongestCocoa (pretty much out of date)

[indigo kraken]

after reading what you did, I’ll take this if you’re offering :p

[frank fossil]

are you willing to do steps manually?

does simject provide a bootstrap or something?

[indigo kraken]

I’m more curious on what the code looks like for some of these patches (patch ent check installd, the changes to the LinkerExtension, the keygen)

I could already imagine what they look like, but I’d enjoy reading the finished imp

but don’t go through the trouble if isn’t readily available, I’m not gonna attempt this

[indigo kraken]

sorta, PoomSmart’s substitute fork is meant to be a replacement for substrate https://github.com/PoomSmart/substitute

[frank fossil]

I currently patch stuff using lldb copypasta, only previewsd need to manually lldb + dlopen before hitting crash

[robust radish]

mine look like ugly tweaks. different app but same stuff: https://gist.github.com/EthanArbuckle/372f97a92b681aaf58b69d47f30d9e6d

[wind ravine]

how can i kill another app?

is it possible with private frameworks without entitlements?

[tepid nacelle]

thats a weird question to ask out of the blue

[wind ravine]

i wanna kill posterboard to restart it

[dreamy mason]

18.1.1 is good?

[fast gazelle]

is notes app uikit or not

[vivid dew]

maybe

[queen thistle]

[orchid fulcrum]

yeah its using viewcontrollers (at least on macos), maybe it has some swiftui too idk

[next wadi]

wen eta theos 2

[frank fossil]

Jailed SpringBoard

[radiant idol]

whoa

you loaded the frameworks into an app? 🤔

[frank fossil]

yeah, also had to hook a lot more methods compared to SpringBoardTS

[radiant idol]

nice nice

I remember SpringBoardUI crashes if its loaded into an app that's not SB

[frank fossil]

I simply ignored it by setting my own NSAssertionHandler

[radiant idol]

neat

I doubt this would work sandboxed though

[frank fossil]

could integrate some sort of LiveContainer

[radiant idol]

hmmmmm

that would be really cool

do FLEX and whatnot work?

[frank fossil]

FLEX works

[radiant idol]

nice nice

[sonic totem]

<@&355174844205367317>

[fervent frigate]

bo said Modaors

[granite frigate]

modulators

[frank fossil]

tried it on iOS 18 and I had to thread return all those just to get a blank screen with only status bar

[radiant idol]

Rip

That’s annoying

[frank fossil]

was able to get it working on simulator

[radiant idol]

👀

[weary saddle]

I have a rather complex problem in my hands related to networking.

Here is what I'm doing:

I have a bunch of Palera1n jailbroken iPhones that all have their own sim cards and cellular data.
All of these iPhones are connected to both cellular and a common WiFi.
It is important that all of these iPhones use cellular network primarily for all activity, except when communicating locally on the WiFi network.

So I installed NewTerm, network-cmds and executed these commands:

sudo route delete default -interface en0
sudo route add default -interface pdp_ip0```
At first glance, this seems to work perfectly. When I check api.ipify.org it shows me my cellular IP. And when I communicate on local WiFi range I can communicate successfully.

But on further inspection it turns out that iPhone is actually using both WiFi and cellular in a weird way. When I go to speedtest.net, it shows me my cellular IP, while the network speed is clearly my WiFi. This causes my automation to break.

Does anyone know what is happening here?

I would appreciate if someone can help me in any way to achieve my goal of only using cellular for data while maintaining my WiFi connections on the iPhones, or just help me understand what's going on here.

I'll willing to pay for a consultation.

[wooden yarrow]

i do wonder whether there's problems with this due to the Wi-Fi assist function or MPTCP

but anyways you should use wireshark or something

inspect where it's actually sending the data from

[lean ermine]

can you package this for apple silicon?

[sonic totem]

<@&355174844205367317>

[lean ermine]

https://tenor.com/view/fire-writing-gif-24533171

[frank fossil]

I doubt it has SpringBoard frameworks

(lldb) p (void*)dlopen("/System/Library/Frameworks/UIKit.framework/UIKit",0)
(void *) 0x0051000337d25ef0
(lldb) p (void*)dlopen("/System/Library/PrivateFrameworks/SpringBoard.framework/SpringBoard",0)
(void *) 0x0000000000000000

[robust radish]

it has simulator’s frameworks

[torpid steppe]

So funny story

Did anyone else know that you can basically just copy your entire disk via ssh with dopamine

Because I didn’t, everyone here told me it wasn’t possible, and ChatGPT in its infinite wisdom told me that “this is a very unique situation”, when I told it that I could, because I just did.

[faint timber]

who said you couldn't

[pallid totem]

Yes

[torpid steppe]

It’s been told to me quite a few times for a while (probably >6 months; maybe even a year, I’m not entirely sure)

Most recent was sacrosanctuary (sry sacro xD)

It was shockingly simple too; I’m not rly sure why a tool for it hasn’t been made yet

[faint timber]

well doing so is pointless when you can just extract the dmg, you can dump most of the user data fs and rest just needs extra entitlements

yes its possible but a waste of time

however I've always done it for my devices

[frank fossil]

how, as I tried it kept giving me Resource busy

[torpid steppe]

Interesting;

I used rdisk0, so that might be why

[timid furnace]

you can dd but you won't be able to mount the data partition

[indigo kraken]

The frameworks closest to SB that the M1 ships natively is FrontBoard, FrontBoardServices, RunningBoard and RunningBoardServices (although they may have combined those pairs into individual frameworks on the latest, not sure) and also FuseBoard which is shipped in the iOS support DSC (which I think is mostly responsible for the UI of iOS apps running on the M1)

If i’m recalling it correctly, I think it’s where a lot of UINS* classes exist https://github.com/saagarjha/dotfiles/blob/fb9a9a0ce57de725f9c45c4864ac87091dcef5e1/ios_scaler.mm#L9

[indigo kraken]

is this the assertion that references a radar? if so, it’s because it requires the com.apple.springboard-ui.client which pretty locks the springboard down to anything that holds that entitlement

[radiant idol]

right

[indigo kraken]

I use the mobile version of Playgrounds a lot to display views/view controllers for this, but SpringBoard.framework has always failed because of this

[radiant idol]

I think there's a check for XCTestCase or something so if you just generate a class named that at runtime it'll still load

not the cleanest way to do it but

[indigo kraken]

luckily not all the fun classes are owned by SpringBoard.framework though 😅

[radiant idol]

lol

[frank fossil]

I pretty much bypassed almost anything that got me to this with a never seen status bar (it’s still showing on top with UIScenePresentationBinder, as I wasn't able to get my own SceneDelegate invoked)

[radiant idol]

whoaaaa

[indigo kraken]

do you remember a when I was asking about a way to trigger a reboot through any private frameworks? (answer ended up being FBShutdownOptions, which I’m pretty sure you replied with) it was for this specifically lol

[radiant idol]

😲

nice

[radiant idol]

what about the background? I'm guessing that's handled by posterboard though

[frank fossil]

Yeah

[radiant idol]

not a big deal

this is genuinely impressive man

good job

[indigo kraken]

I can send you the code for it if you want, you can basically set the “slide to power off” trigger to anything (within reason, and dependent on what capabilities your device possesses -- the frontboard shutdown options requires special entitlements, but displaying the everything in that video does not)

like if you were jailed and wanted to use something along the lines of that XPC crasher to reboot the device, that would work

[indigo kraken]

PosterBoard kinda sucks. It made changing your wallpaper a whole endeavor lol

[radiant idol]

yeah true

[radiant idol]

send it over if you want, I'm curious to see the implementation

[indigo kraken]

it also generates a new set of images every time you respring/reboot to /var/containers/Data/System/…/Library/Caches/com.apple.PaperBoardUI

[radiant idol]

that's interesting

[indigo kraken]

cool, I’ll upload it when I get home

[indigo kraken]

eh, not really. It generates images of your lockscreen/homescreen wallpaper for light and dark mode, but instead of doing it once, every “crash” generates another pair without removing the previous ones.

it’s one of the paths I set to auto remove with iCleaner

I’m also assuming it generates the new images every time you change your wallpaper as well, which probably piles up to hundreds of images and a couple gigs for users dedicated to posterboard tweaks

[radiant idol]

Insane

[frank fossil]

Someone else tried to run PosterBoard in LiveContainer

[radiant idol]

Interesting 👀

[blazing warren]

ipad 7 rigth ?

[frank fossil]

iPad simulator

[blazing warren]

oh nice

[frank fossil]

wait does app have private entitlements? was wondering about the passed through wallpaper

[indigo kraken]

I thought you’d notice that :p The pass through wallpaper requires the private entitlement (I already use private entitlements for this local version, so I thought to may as well add it)

I needed priv entitlements to trigger [FBSSystemService reboot] since the goal was to just make a clone that slides to reboot rather than shut down

but strip aways the entitlements, and you can point any function you want to when you “Slide to power off”

originally it used to point to an xpc crasher for when my device was jailed, but since it’s treated like a crash I’d rather just have it reboot through frontboard

[radiant idol]

I wonder what the internal functionality of this is

Maybe we can mimic it and reboot without ents

[indigo kraken]

wdym exactly? (like what’s the original imp for when a device slides to power off?)

[radiant idol]

The internal implementation of [FBSSystemService reboot]

aka maybe we can bypass the entitlement check

[frank fossil]

would that be considered a DoS vuln?

[radiant idol]

🤷‍♂️

[indigo kraken]

oh, I’ve tried. I think it just errored out without the ent

yeah just tested it, does nothing

[frank fossil]

I'm a bit bored so here's what I've done so far. Change before-package-sim to before-package and you can drag drop to simulator and start it as an app

Can work on real device too, just need to thread return when it tries to call removeObject: with nil argument because it cannot find itself. Afterwards you see a black screen since I can’t figure out why it doesn’t wanna create a scene (using SBLCSceneDelegate to render SpringBoard’s scenes)

[frank fossil]

real device now

[frank fossil]

Hello NOT iPad, trying to restoreDefaultWallpaperForAllVariantsAndNotify? not today.

[radiant idol]

Loool

[acoustic imp]

This is so cool, but it doesn’t work on like 18.0.1 stock tho? Just ts/sim ?

[frank fossil]

Could you send your crash report? Also you have to install it to LiveContainer and enable fix file picker & notification

[blazing warren]

It was just a matter of enabling that option to make it work.
thanks for the tip

and apparently requires jit

[woeful pawn]

It is for iOS 18 only right?

[frank fossil]

Yeah

[frank fossil]

I think I can use ellekit hardware breakpoint to work without JIT

[blazing warren]

nice
thanks

[severe stream]

<@&355174844205367317> steam scam

[sonic totem]

<@&355174844205367317>

[acoustic imp]

i cant install live CT bc it needs side store, which wont let me pick a pairing file bc of the issue when i sign it with me cert . is there a dylib i can inject to fix it?

[frank fossil]

put ALTPairingFile.mobiledevicepairing to SideStore's documents dir

[acoustic imp]

oh 😭

[acoustic imp]

? need new file?

[frank fossil]

I think your signer messed up the app group

you can sign LC and install it with import cert option but it’s not guaranteed to work

[acoustic imp]

dlopen(/private/var/mobile/Containers/Data/Application/8BAB14FA-9EB6-4A8B-9C79-F908631A4249/Documents/Applications/com.apple.springboardts.app/SpringBoardTS, 0x0109): tried: '/private/var/mobile/Containers/Data/Application/8BAB14FA-9EB6-4A8B-9C79-F908631A4249/Documents/Applications/com.apple.springboardts.app/SpringBoardTS' (file system sandbox blocked mmap() of '/private/var/mobile/Containers/Data/Application/8BAB14FA-9EB6-4A8B-9C79-F908631A4249/Documents/Applications/com.apple.springboardts.app/SpringBoardTS'), '/private/preboot/Cryptexes/OS/private/var/mobile/Containers/Data/Application/8BAB14FA-9EB6-4A8B-9C79-F908631A4249/Documents/Applications/com.apple.springboardts.app/SpringBoardTS' (no such file), '/private/var/mobile/Containers/Data/Application/8BAB14FA-9EB6-4A8B-9C79-F908631A4249/Documents/Applications/com.apple.springboardts.app/SpringBoardTS' (file system sandbox blocked mmap() of '/private/var/mobile/Containers/Data/Application/8BAB14FA-9EB6-4A8B-9C79-F908631A4249/Documents/Applications/com.apple.springboardts.app/SpringBoardTS')

[frank fossil]

It's not a dev cert, is it?

[acoustic imp]

i think it is

got it from krava

[frank fossil]

Does it have get-task-allow and can you enable JIT with it?