development

[tepid nacelle]

thx alpha

[ocean raptor]

I charge $60/hr to fix procursus things, but for Java it’ll be $120/hr

[silver rampart]

did dev lose manage messages perm

who did what

[wooden yarrow]

well we can still pin

just no deleting

[silver rampart]

its like an old western town but the streets are paved over and theres a walmart now

[gentle grove]

Welcome to r/jb

2026

[ocean raptor]

This is basically 1984

[silver rampart]

woeis

[timid furnace]

nothing

it's just a bunch of files from Fugu15

[pearl sail]

White name moment

[lime pivot]

who’s our walmart greeter

[silver rampart]

plx for sure every time i get pinged in announcements theyre here

[wooden yarrow]

this does not spell great things for my internet entrenchment

[silver rampart]

join furry communities theyre less mentally damaging and amazingly have just as many people in industry hope this helps

[wooden yarrow]

incredible advice that certainly many in this server will hate on

[vivid dew]

there is folf fur stuck in the ethernet port

[hasty ruin]

Deservedly so

[silver rampart]

this server is a bastion of good takes always keep this in your heart

[orchid fulcrum]

@naive kraken @sonic totem @robust radish

does any of you know what exactly i should call to ask SPTM to change protections of a page ? there is sptm_map_pagebut i couldn't make sure if it can be used for this.

goal is changing RW memory to RX memory in the kernel when ctrr is disabled. (which im still not sure if its possible or not)

[sonic totem]

Ermmmm

Can you patch SPTM

or not

Because lowkey the easiest way is just to modify kernel PTEs directly

That’s what I did under no KTRR

[orchid fulcrum]

the setup is basically "SIP/amfi off + ctrr disabled + kextRW" so probably no ?

[sonic totem]

Hm

Does vm_protect work?

kcall’ing it

[orchid fulcrum]

nope, that panics with Taking non-sleepable RW lock with preemption enabled when ctrr is on and Unexpected fault in kernel physical aperture when ctrr is off.

edit: okay now i am trying it again and it stopped panicking for whatever reason, although i am still trying to find out if it worked.

edit2: i don't think it worked, the target address panics with Kernel instruction fetch abort at pc. Which makes me think its still RW

[sonic totem]

That is such a cursed panic reason

[severe stream]

<@&355174844205367317>

[torn oriole]

No way thanks mr beast

[torn oriole]

Ok but can it actually successfully “recover” data in that state if the passcode is right

I mean

To get into this state you’ve sacrificed the data anyway

If it doesn’t then apple doesn’t care

Although

Interesting since you can unlock a device with activation lock if you bestow upon it the previous passcode

[torn oriole]

Sometimes

I forgot how this actually works

[wooden yarrow]

backup nand !

very surprising to me to see the keybags haven't even been wiped

[wooden yarrow]

backing up the keybag

[wooden yarrow]

@fringe cove possibly got an answer

[wooden yarrow]

during data recovery it can't store the state of the failed passcode attempts onto the actual stashbag

who's to say the second update is the one that bricks it

its likely the first

[crisp frost]

I could've sworn everythingapplebro made a video about this like 7 years ago

everythingapplepro

[crisp frost]

@fringe cove https://www.youtube.com/watch?v=IXglwbyMydM

I found it

[wooden yarrow]

yo why is that technique so old

what the hell

surely you would think they'd have figured it out by now

[wooden yarrow]

well it is big, just... not the first time it's been discovered i guess

[orchid fulcrum]

apparently vm_protect is returning KERN_INVALID_ARGUMENT (4). don't really know why

[gentle grove]

<@&355174844205367317> spam

[timid furnace]

<@&355174844205367317>

[torn oriole]

Thank you Elon musk

[timid furnace]

I can't believe my withdrawal was successfully!

[torn oriole]

Gir for the love of god

Gir ffs

[timid furnace]

top 10 gir moments

[torn oriole]

Thank you you heap of shit

[faint lion]

Pong!

Message Latency

234ms

API Latency

18ms

[torn oriole]

No excuse

Just a shit bot

[quaint rain]

Yesterday gir had downtime

😛

[kind herald]

unsurprising

[timid furnace]

tfw my bot, which has been running on pycord and hasn't had any real updates in over 2 years, has better uptime and reliability than gir

[native dune]

gir needs an async db

pycord in 2026 is insane

[crisp frost]

yes

just do the usual seprmvr64 dualboot way but just dont seprmvr64

make sure to copy sep fw and stuff

should work ™

[crisp frost]

yes

[faint timber]

they are called anchors

well the sub number is an anchor idk about various disks

[sand scarab]

what are the chances we get coruna based jailbreak?

[sonic totem]

2.5%

It’s the same NAND but I don’t really know how to explain it any further

[wooden yarrow]

isnt this apfs container stuff

or atleast disk2 would be, i imagine the kernel just exposes the "NOR" as another disk(s) for convenience (?)

then those are views of the NOR

quote unquote because they're actually stored in the nand

they've had both iirc, partition pointing to the apfs container and also containers as logical disks themselves

boot components, i.e. the ones loaded by LLB

[sonic totem]

They have to have disk0 pointing to NOR

For ROM I think

[wooden yarrow]

huhh doesnt ROM not even have those abstractions

doesnt it just read straight off of disk with offsets and lengths

[sonic totem]

Actually yeah

Bare bare minimum just to read the raw blockdev

[wooden yarrow]

yes

[sonic totem]

Yes

Ah wait what’s on disk0 then

[wooden yarrow]

normal partitions

[sonic totem]

O

[wooden yarrow]

yes

[faint timber]

nvme namespaces

[wooden yarrow]

0s1s1 should be root and 0s1s2 should be data which on sep devices you need giga locker for

then on apfs and later you get like 1s3 as preboot and etc

yes, the one in xART partition

is 0s1s5 in apfs usually

[faint timber]

bool AppleEmbeddedNVMeController::IdentifyNamespaces()::2071:Found 7 namespaces in current NAND
bool AppleEmbeddedNVMeController::DetermineNamespaces()::2520:Identified nsid[1] as nstype[1]
bool AppleEmbeddedNVMeController::DetermineNamespaces()::2520:Identified nsid[2] as nstype[2]
bool AppleEmbeddedNVMeController::DetermineNamespaces()::2520:Identified nsid[3] as nstype[3]
bool AppleEmbeddedNVMeController::DetermineNamespaces()::2520:Identified nsid[4] as nstype[4]
bool AppleEmbeddedNVMeController::DetermineNamespaces()::2520:Identified nsid[5] as nstype[5]
bool AppleEmbeddedNVMeController::DetermineNamespaces()::2520:Identified nsid[6] as nstype[6]
bool AppleEmbeddedNVMeController::DetermineNamespaces()::2520:Identified nsid[7] as nstype[8]

no

those aren't the disks

theres probably a namespace for various things
SYSCFG, NVRAM, and I guess disk0 and disk1 get their own namespace

disk0 just being raw blockdev format

apple only designs stuff they deem needed

idk

better off hijacking ANS2 firmware imo

the literally nvme driver

its own chip

its an interfacer like I2C

read raw address write raw address, controls functionality

you really should do some I2C/LCD breadboard stuff

you can try to get the BSDRoot code in kernel to init the syscfg/nvram as disks

may need decent amount of reversing

doubt its hidden, the code to show it just doesn't exist because it was never needed

I think its simpler than we all think

[wooden yarrow]

they're physically inaccessible from the AP afaik

you'd have to send the data from the coprocs to the ap and make that a virtual disk for that to work

not well versed in the driver but i would say so

but it should have been stored in such a way that it's easily accessible by iBoot since it needs the info

well no the kernel should also need it for like the nvram userspace cli and probably also uses syscfg for something else

but not sure it depends on the ans2 driver for those things

[trail nimbus]

How exactly would I hook into SwiftUI classes/functions to for example change text in theos? From what I saw I think it’s pretty different from UIKit so it would work differently

[slim bramble]

https://gist.github.com/leptos-null/1f7fc9de9f7ae018f149f13446f9c8ae

[light owl]

Thank you

[trail nimbus]

Ty

[harsh junco]

ty

[timid furnace]

Iirc it's like nvme namespaces or something

[zealous wasp]

can someone help me

game persivation

[faint timber]

don't be this annoying

[tepid olive]

You asked this a million times before and refused to even give the game name

[thorn ether]

at this point no one should give you help now

[zealous wasp]

I did man 🙁 its Respawnables

I Said it in #jailbreak

[sonic totem]

<@&355174844205367317>

[sonic totem]

Performance

[wooden yarrow]

it's in the name, it's a fast path

[sonic totem]

Before iOS 14, everything not in trustcache went through amfid, which involved the kernel communicating with userspace, and this is SLOW compared to keeping everything in the kernel

Now, if a binary is from the App Store, it's signature validation is done entirely inside kernel code and it saves AMFI having to call out to userspace

and on a regular user's device, the only apps they will be running are either system apps or App Store apps, so in theory, AMFI will never have to call out to userspace

Only when a user starts sideloading or using TestFlight does amfid actually get used

[wooden yarrow]

recently opened apps are probably cached anyways

[sonic totem]

Yes

Or just any Apple binary too

daemons and stuff

And binary on the rootfs

Also while it may seem like a security risk to have the App Store fast path, you have to remember that CMS parsing bugs are not easy to find

Not impossible, but very difficult

I mean ASFP has been around for 6 majors now and only two public bugs have been disclosed

[lime pivot]

at this point why hasn't amfid been eliminated entirely? (aka, why can't they make the entire CoreTrust out of fast path)

like I always assumed this was just them slowly porting things over to CoreTrust, while also getting a performance win

[sonic totem]

I would presume because validating provisioning profiles can require an Internet connection and they don’t have the functionality for that in the kernel maybe?

[lime pivot]

ah, provisioning profiles

[sonic totem]

And with how provisioning profiles are installed/stored on the FS as well for example, seems like something for userspace to handle

[lime pivot]

I could maybe see amfid being stripped down to just things like that, but at that point the perf benefit is basically zero

[sonic totem]

I mean, it basically is

Stripped down to just that I mean

Enterprise, developer and TestFlight certs

All of which can expire/revoke/whatever

[sonic totem]

Doubt it

It’s quicker than that

[lime pivot]

it could be CRL checks

cert revocation list

[fading shell]

Ich würde dir ja gerne antworten, aber leider verstehe ich dich nicht

[wheat grotto]

vienkārši uztaisi pats savu profilu, nav jau tik grūti

[fluid lintel]

Hi are you interested in possible collaborations with my company in vulnerability research on mobile and desktop?

[quaint rain]

Most jailbreak developers are already hired at companies like cellebrite/coreillium

[faint timber]

Don’t reply to bots

[fluid lintel]

I am not a bot

[fluid lintel]

Thanks

[faint timber]

For a second we thought you were when you send the same message across multiple servers at the same time, our apologies

[fluid lintel]

Ok sorry 👍

[thorn ether]

i love how hes talking like he's talking to one person only

[frail geyser]

@quaint rain gm

[quaint rain]

?

[frail geyser]

gm

[quaint rain]

Gm

[thick saddle]

GM

[elder scaffold]

<@&355174844205367317>

[indigo peak]

@torn oriole

[torn oriole]

Amazing

They’ve changed the currency value again

Awesome

[harsh junco]

<@&355174844205367317>

[torn oriole]

Maxine do your job

[ashen birch]

any rust nerds see this https://github.com/Batchhh/Alloy-ios

[patent eagle]

i was banned from jailbreak i dont know why and i need to get unbanned bc im favorite game is jailbreak and jailbreak is my motovation so im really sad that i get banned so can yall teachn me how to get unbanned please help me

can yall help me?

[velvet path]

!t roblox you got told in #jailbreak

[faint lion]

Hey @patent eagle, have a look at this!

roblox

This Discord server is for iOS jailbreaking, not Roblox. Please keep your discussions on-topic, thank you!

Added by SlimShadyIAm#9999 | Used 3,796 times · Dec 21, 2020, 9:17 PM

[thorn ether]

No

[wooden yarrow]

how does this compare to ellekit

[fading shell]

<@&355174844205367317> (especially @kind herald) do your job

[frail geyser]

bro

[wheat grotto]

@slim bramble @light owl @native dune @shrewd smelt yooooo, theyre handing out bitcoin

[shrewd smelt]

Ok

[slim bramble]

imagine getting muted

what a skill issue

[frail geyser]

LMAO

[fading shell]

yeah, imagine...

[slim bramble]

lies

[wheat grotto]

what the fuck, since when is it 4 pings

wasnt it 5 ?

thx rick (i assume it was rick)

[light owl]

reply counts as one

[wheat grotto]

b r u h

[hasty ruin]

<@&355174844205367317> gm

[torn oriole]

Oh my Christ what is with them all today

[hasty ruin]

<@&355174844205367317> gm

[thin valley]

Gm!

[hasty ruin]

gm

hyd

[thin valley]

Chilling like a villain. New place, finally unpacking. You?

[hasty ruin]

oh fire how's the new place

doing the best i have in a while

[thin valley]

So much more storage and space for jr to move. He’s not fully crawling but doing the army crawl.

[thin valley]

Honestly this made my day, glad to hear bro

[hasty ruin]

oh no watch out

gonna be causing trouble in no time

apparently when i was a baby i knocked something heavy over and it nearly landed on my head

[thin valley]

Time to invest in protective gear lol

[timid furnace]

<@&355174844205367317>

[fading shell]

<@&355174844205367317>

[visual meadow]

Modulators

[azure sail]

rick

[hasty ruin]

gir needs opencv to spot those attachments

[azure sail]

True

[visual meadow]

mr beast in attachment = ban

[fading shell]

https://tenor.com/view/small-mrbeast-funny-meme-hahahaha-gif-14300745468208619201

[pearl sail]

@hasty ruin yoo they release a irl video of you

[visual meadow]

Is it possible to strip a process of CS_PLATFORM_BINARY on macOS?

With amfi off basically all procs have it and it can cause this:

[hasty ruin]

i dont know
but that seems to be the same thing breaking dotnet runtime

[native dune]

java is also broken with amfi off

[hasty ruin]

oh what

i dont remember having any issues with it on monterey at least

and i had amfi off for years on there

[native dune]

https://bugs.openjdk.org/browse/JDK-8326663?attachmentViewMode=list#:~:text=Description,not a common use-case.

[hasty ruin]

oh jdk22+

[native dune]

https://github.com/corretto/corretto-11/issues/385#issuecomment-2817199764

[visual meadow]

well right now i have so many workarounds for no amfi_allow_any_signature

i hooked amfid to platformize dylibs in /Library/TweakInject

If I make it platformize all that issue comes back

I wonder if i need amfi off

entirely

Idk how much shit would break though since i have this

[light owl]

Yeah how do you know this

[native dune]

yup

[lime pivot]

yeah this comes from the .NET runtime

I debugged this a yearish ago and it is something to do with the JIT engine getting an error back from the system in whatever way, I forget the details

I wanna say this shouldn't be fixed because we shouldn't normalise running with amfi nuked, but, it does actually get in my way on my isolated test Mac 🙃

[visual meadow]

why does this only happen when the process is platformized is my question

that's so weird

[sonic totem]

It’s not uncommon for them to disallow certain mechanisms for platform binaries

[visual meadow]

is it possible to strip platform from a running proc?

[sonic totem]

With krw?

[visual meadow]

I just looked into the xnu src no its not possible without krw

[hasty ruin]

can you use a kext

[visual meadow]

not in the way i want probably not

its fine i worked around

[orchid fulcrum]

with krw, where was that flag located ? (like whats it called)

in the proc struct ?

[frank fossil]

CS_OPS_CLEARPLATFORM in dev kernel

[atomic horizon]

yo

is there any hooking library using stikdebug with the txm thing for patching the instructions?

[timid furnace]

i uh

what

[atomic horizon]

so like

on txm

can't write to executable memory

so u have to use a debugger to write to it with privileged access

is there a hooking library that uses that workaround for hooking

[atomic horizon]

eh

I just made my own

[sonic totem]

proc->proc_ro->csflags

[ashen birch]

didn’t see this but absolutely 0 idea i just stumbled across it

[harsh junco]

<@&355174844205367317>

[slim bramble]

<@&355174844205367317>

[thorn ether]

there has to be a way to auto block this shit

[faint timber]

Discord will implement any feature except protect their users

Lmao finally after a decade they made load times faster

Can’t make this shit up

[hasty ruin]

Coruna

[indigo kraken]

is your iPad arm64 or arm64e

boutta just send you an iOS version nettop

[quaint rain]

How the fuck do you do that 😭

Windows 11 ahh bug

[echo heron]

https://github.com/userlandkernel/ios-deamon-clients can anyone tell me if i need entitlements for this backboardd xpc logic

i was working on a tool to launch, terminate apps and respring

using backboardd xpc

if i run the app on non-jailbroken phone it just says xpc connection invalidated

but i can't see why in my syslog

I reverse engineered the xpc logic from backboardd the logic should be correct

[hasty ruin]

https://cdn.discordapp.com/attachments/1266535437967691826/1484270855818182906/caption.gif

https://cdn.discordapp.com/attachments/1266535437967691826/1484271228016529498/caption.gif

https://fixupx.com/dankuntz/status/2034324593536877047

Daniel Kuntz (@dankuntz)

7 years in to SwiftUI

Quoting Jacob Bartlett (@jacobtechtavern)
︀
CPU and thermal performance in a SwiftUI list explains why we had so many hitches. Even at rest, no scrolling, the CPU screamed at 100% capacity to render every gif, and well past 100% (distributing work across CPU cores) when I scrolled.
︀︀
︀︀The “Very High” energy impact rapidly heated my device. The measured thermal trace crept up towards Serious. When I wasn’t paying attention, the app was even killed by the OS, presumably hitting a critical thermal spike.
︀︀
︀︀After giving a serious beating to my shiny new A19 chip, the same feed in UIKit produced comparatively nearly trivial CPU and energy usage.
︀︀* At rest, UIKit dropped as low as 11% CPU utilisation, vs a consistent 100% for the SwiftUI version
︀︀* Energy usage correspondingly held at High for UIKit, vs Very High for SwiftUI.
︀︀
︀︀I gave up waiting for the thermal profile to hit Fair after 3 minutes.
…

FixupX · Mar 18, 2026, 5:42 PM

[sonic totem]

You do

[echo heron]

So this would work on jailbroken iOS with entitlements

Are all daemons locked down with entitlements or are there also daemons i can talk to without em

I’m researching xpc

I also found that if you set TaskSpecial port in a launchd plist to -1 it will bypass the checks and launchd will accept it as a huge integer

But that wont likely cause issues

Launchd is pretty secure xpc wise

Its pretty nice you can build iOS apps on linux with theos jailed and sideload with Legacy-iOS-kit

I’m now reversing xpc of locationd and writing clients for it

[wispy wind]

Hey! I did some sandbox research on Delta Beta (iOS 26) with a custom injected dylib. My goal was to find a possible vector for something like TrollStore on iOS 26, but I only found typical sandbox denials. The report is in .md format because I use Linux. I'm not very experienced, so any tips on where to go from here would be appreciated!

[tribal path]

None of this makes any sense if you put any amount of thought into it

In what way

[wispy wind]

Fair enough! I'm still learning. Could you point me in the right direction?

[unborn owl]

I mean I asked claude about a solution to my problem and asked it to research... but it still feels unlikely that it would work.

[wispy wind]

I understand, I'm still learning. I was just tired of dealing with certificates expiring all the time and had the idea of looking at some logs on my iPhone to see if I could find anything useful, maybe something that could lead to a TrollStore equivalent on iOS 26. I know it's a long shot, just trying to learn.

[tribal path]

Outside of my range of knowledge sadly so I can't really say

[tribal path]

The way TrollStore works is with a flaw in how the CoreTrust kernel extension validates binaries

You'd need to find a CoreTrust bypass in order to have something similar, and that's insanely unlikely as Apple hasn't reported patching one recently and it's not a common class of bug really

[wispy wind]

That makes a lot of sense, thank you! So there's basically no realistic path to something like TrollStore on iOS 26 right now?

[tribal path]

Not at the moment no
Your best bet is just dealing with sideloading normally or getting an Apple Developer Program membership

[wispy wind]

Understood, thank you so much for taking the time to explain! Really appreciate it.

[sonic totem]

Best tip I can offer is don’t ask AI to find bugs based on syslog

[wispy wind]

oh, ok thanks

I don't know much about it. I was trying to learn something new, so I ended up asking some AI tools for help to see if I was on the right track, but thanks for the tip and for your attention.

[echo heron]

You need to extract and analyze the sandbox profiles

But it wont be good for trolletore

[vivid dew]

can i have your claude api key

[unborn owl]

Found my old iphone x running ios 13.7 and it works

[light owl]

sk-ant-api03-YxrH-ZL0G

Sorry youll have to pay me for the rest

[thorn ether]

nice claude research

[frank fossil]

the only realistic way outside of exploits is if you can find prime factors of an old 1024-bit public key before Apple realizes and bans it

[hasty ruin]

@slim bramble hey bro we need to utilise the 16player botnet

get them cracking

[unborn owl]

With checkra1n & blackbird do you guys think its possible to bypass biometrics?

Or does the touch id have something we need?

[rocky oriole]

we can't discuss that here

[unborn owl]

its not what u think it is but ok np

is it possible to automate entering a passcode instead?

[rocky oriole]

yeah

always been

[blazing warren]

@modulators

[dusk cove]

they arent gonna do anything

[magic karma]

based stance on vibecoding

[sonic totem]

Rubber ducking goated

It’s so helpful

[gentle grove]

Just don't have a skill issue

[sonic totem]

Hey duck how do I pwn iOS 26

[rocky oriole]

use checkm8 with dmaFail

[unborn owl]

i used to give models the shit but they are good as long as you don’t hit the ethics barrier

it got me to where i wanted and much faster than i thought but i still had to think

[unborn owl]

if you want to build an app and install it with custom entitlements but don’t want to deal with a persistence helper i assume its ok to just use the exploit chain of trollinstaller and then have my app be the system app?

[lyric heron]

how are you going to install it as a system app

just give your ipa the entitlements and it's a done deal

if you're on a trollstore-able version just install your ipa through that...

[unborn owl]

build my own minimal installer using trollinstallerx

[lyric heron]

what for

just use trollstore

[unborn owl]

i mean sure but there’s a reason i want to avoid it. the code looks fine i guess

[lyric heron]

yeah like im just wondering what the reason could be

trollstore is not detectable...

[wind iris]

💔

Trollstore is literally goated

[frank fossil]

CVE-2025-31207… unless someone backported the patch to a tweak

[lyric heron]

yeah but you can bypass that by changing the identifier no?

[wind iris]

are there really apps that check if trollstore is installed

thats crazy

[lyric heron]

there were like 1-3 apps

[unborn owl]

this wasnt my concern either to be honest

[wind iris]

what then

i dont see a reason why not to use trollstore

[unborn owl]

i was writing something that does operations with the secure element by having access to the pin. i was thinking although it is risky i can reduce some of the risk by not using trollstore and just using the way it installs itself to become a trusted app

risky being what the app does kinda breaks the trust model

[lyric heron]

but how does that differ

like it still has the same permissions and entitlements

[unborn owl]

i mean its probably unlikely anyway i’d probably setup mdm to disable certain things on this device and have a firewall in place

without LLMs i would totally agree with you but it would probably take it 30 minutes to have working installer without input from the human

[lyric heron]

i dont think a mdm profile can stop an app with the highest entitlements

[unborn owl]

im saying i would use it to lockdown the phone after i install it

like for example no safari or no messaging (idk if this is possible) and no installing of apps

and one to prevent updates

at the end of the day this is all over the top

its v unlikely i would be a target of anything

[unborn owl]

have most jb’s been found by state actors exploits being patched or indepedent researchers debugging?

[main nexus]

any way to use xcode on windows? or get a free macos cloud vm? since virtualising using own hardware is far too laggy. just trying to modify vlc for ios so it mixes audio when a second audio source plays on top of vlc, which lowers vlc audio volume while the second audio source plays then restores the vlc audio volume once the second audio source is paused or finished

[light owl]

no

[unborn owl]

gg hacked account

[main nexus]

<@&355174844205367317>

[thorn ether]

use WSL for development, then github or bitrise macos ci to build final release

[unborn owl]

kernel_base: 0xfffffff04b848000
kernel_slide: 0x44844000
Mach-O magic: 0x100000cfeedfacf ✓
uid before: 501
seems like u can get llms to vibe rebuild exploits

[crisp frost]

yeah but whats the point

if this is the darksword chain there are 2 already public objc implementations anyway

[unborn owl]

ye i mean it doesnt mean much to me but it gets rejected by chat but works thru claude code

seems odd to me

[crisp frost]

the thing is once u have krw thats cool and all but then what

without a base for the llm to build upon its gonna start hallucinating

and if u dont know what the previous steps do the latter steps will become 100x harder

sorry if this comes over as mean btw its cool its just a bit silly imo

[unborn owl]

ur right

im bored

lol

[main nexus]

is there like a guide i can follow for more info on this? a youtube video, blog or some documentation?

[thorn ether]

for WSL?

[main nexus]

well i’ve never used WSL and i’m not really familiar with bitrise macos ci

[thorn ether]

https://theos.dev/docs/installation-linux

[main nexus]

what about github or bitrise macos ci to build the ipa?

let’s say i use github, what would i do?

[thorn ether]

i dont have time to explain, chatgpt it 👍

[unborn owl]

ye u were right lol stuck and im not an ios re person

[tidal solar]

osxcross my beloved

While my MacBook can certainly compile various things and run them, both osxcross and darling (the latter for CLI binaries only) work fine on my beefy Linux desktop. I exported my XCode SDK under the right license terms and ofc can’t and won’t re-share, but the binaries the clang installation produces run just fine on real macOS and iOS if you really get into the bare metal and toolchain stuff. And you can just sign the binaries and be off

[thorn ether]

@lime pivot@main nexus care to explain why u are thumbs downing?

[velvet path]

ai is known to hallucinate and give wrong/incorrect information

[thorn ether]

thats why you tell it source online sources

also github ci is not complex

if u dont know how to use chatgpt to prevent hallucination on simple topics then u might as well give up

[wooden yarrow]

there's a better source it's called google

[thorn ether]

where do u think chatgpt sources online information?

[timid furnace]

you think ChatGPT sources info from Google?

[thorn ether]

no it searches the web, which google does too

[rocky oriole]

!t ai

[faint lion]

ai

AI is considered a unreliable source of information and should not be used to obtain any jailbreaking advice. This is because some AI models are trained on data that is either outdated and no longer relevant, or is not explicitly trained on iOS jailbreaking. As a result, AI can often "hallucinate" or state something that isn't true. If you would like to jailbreak or get support with one, you may use the buttons below or ask in https://discord.com/channels/349243932447604736/688122301975363591

Added by bradleytechman | Used 62 times · Sep 6, 2025, 11:51 PM

[rocky oriole]

.

[thorn ether]

did you miss the part where ai can search the web?

[wooden yarrow]

why would you rely on second hand information that you then need to verify for yourself regardless

useless

use brain

[thorn ether]

ok then ill tell the guy to google it instead of chatgpt, happy?

[wooden yarrow]

yes stop telling people to use chatgpt to offload their brain power

it's already weak from being in rjb

[thorn ether]

guy didnt have any brain power in the first place so thats why i told him to chatgpt it

[wooden yarrow]

and you didn't think to help them improve that?

smh

[thorn ether]

no

guy was asking questions he could simply google easily so clearly he doesnt know how to use google anyways

[main nexus]

i did google, and most results ended up saying you need a mac to build an ipa, hence why i came here. there's no need to be so rude

[thorn ether]

then you werent googling correctly, so telling u to use chatgpt was the best choice

[quaint rain]

It will only search the web when it believes it needs to or you tell it to

At least for GPT and Claude

[quaint rain]

you didn’t tell OP that before hand

[quaint rain]

Plus not all ai tools can source the web, basically only the office instance of the main ones can, at least effectively

[tribal path]

Tbf I don't think any decent LLM would need to search online to get the original question correct

[tribal path]

Decent LLM being ChatGPT or Claude specifically

[unborn owl]

do u guys not like LLMs?

[tribal path]

I do

[quaint rain]

LLMs are fine

I use them

[thorn ether]

thats what i said but everyone here thinks llms are too dumb to explain github ci

[quaint rain]

Telling other people to depend on it for a basic question is not

[unborn owl]

i completely agree they have issues but i think they are better than searching the web

theres a reason why google shows gemini in the response

[tribal path]

I don't think they're better than searching the web for everything
There's things they're good at and things that they aren't

Development and programming stuff though. Is something that they're good at

[unborn owl]

for example jailbreaking they are probably good enough

[tribal path]

Hit or miss

I wouldn't take jailbreak advice from ChatGPT

Too niche of a topic

[thorn ether]

^ agreed. i said chatgpt cus i know github ci is an extremely simple topic so llms are more than capable enough to tell u about it

[quaint rain]

From me and from what I’ve seen from others, nah

I’ve seen it recommended make tools

And/or just make a up a jailbreak/support for it

[unborn owl]

but the jailbreaking guide thats so often linked in here, would that not be its primary source of truth lol?

[tribal path]

That is absolutely a legitimate area where it will hallucinate constantly and I've experienced this myself before asking rather simple stuff

[tribal path]

It's not really, no

[unborn owl]

https://claude.ai/share/60b56489-3e7b-4546-9b2b-e4a910831bad

this isnt too bad

[quaint rain]

They don’t get trained off days here

They get trained on sketchy websites that allow ai to scrape off of in the case of a few more clicks

[unborn owl]

its not that

they get fed a shit ton of data

you cant and probably dont know exactly what goes in to an llm

[quaint rain]

Data not from here; or if it is it’s so little

[unborn owl]

but u can prolly guess

[tribal path]

The sources it was checking online was not really the most legit things
It is somewhat impressive though that it was able to filter that out and come up with a pretty much accurate result, but it is way more 50/50 than something properly officially documented in detail

Anyways this is probably getting a little bit off topic now

[unborn owl]

sure

[quaint rain]

On this specific paragraph they forgot dopamine exists

Would like to add that Claude would be better on this then ChatGPT which will suck your dick as it’s spitting misinformation

[unborn owl]

yea and on the first one the llm assumed ios 18 exists for the 17pm

i know its not completely accurate

[tribal path]

Claude did impress me again here
Acknowledged it needed to do a web search at least

ChatGPT is pretty horrendous if it doesn't know what it's talking about
When it does know what it's talking about though, it does pretty okay. It just won't tell you or try to search online if it doesn't know what it's talking about really

[unborn owl]

claude helped me write an ios app & reverse engineer some system binaries

and it eventually worked

[quaint rain]

Well that is a older one and doesn’t have as much fakes/misinfo as palera1n, checkra1n, and unc0ver

[tribal path]

Aquila came out like last year lol

That's why it impresses me

[unborn owl]

and the way I wanted it to, but i had to know how the RE & i had to think too

[main nexus]

i heard claude found zero-day exploits on ms edge or something like that

[unborn owl]

it has definitely found exploits

it did in firefox

[quaint rain]

I’m not saying LLMs themselves are bad, it’s bad if your telling other people to use it for a topic it can hallucinate on and which the person can’t really be held much accountable

[unborn owl]

they are getting much better

though

[thorn ether]

github ci?

[unborn owl]

https://www.anthropic.com/news/mozilla-firefox-security

@main nexus

[quaint rain]

Especially for ChatGPT in particular

[unborn owl]

wdym by held accountable, are you saying if you want to offer help you better offer the best help possible not just "use claude"

[tribal path]

I do think that is kinda true
Offering help isn't super useful if you're just going to directly cite AI or tell someone to just use AI
Pointing someone in the right direction / knowing roughly what to do is good

[main nexus]

that's actually wild

free bug bounties

[unborn owl]

you are right however current frontier models are better generic knowledge stores than any human

if you are going to offer help and use ai in the answer you should have some familiarity with the topic

[tribal path]

I agree with that as well yes

[unborn owl]

i personally have never helped someone by using ai to help them

[rocky oriole]

#779145909886910474 message confused on "An app may be able to enumerate a user's installed apps", can apps not already do that, like shortcuts and others

js wondering

[sonic totem]

A sideloaded app can’t

It counts as accessing sensitive data

[rocky oriole]

oh i see

do appstore apps just automatically get the permission for that then

or, how do developers test that functionality then on a real device

[frank fossil]

neither can appstore apps

[faint timber]

https://medium.com/@pplcallmesrkor/reversing-anogs-how-delta-force-mobiles-anti-cheat-enumerates-your-installed-apps-on-ios-9b7d6a3ec157

[rocky oriole]

i downloaded an app yesterday that did

it controls screentime though so probably something using that

[frank fossil]

you see why there is no public API to detect TrollStore

[rocky oriole]

yea

[rocky oriole]

interesting

[rocky oriole]

i assume it just did it using screentime or something then, since that's the purpose of the app

[frank fossil]

oh yeah there's an API for that

but like not all apps can use it since it's behind an entitlement

[rocky oriole]

makes sense

thanks guys

[frank fossil]

and requires user approval

[rocky oriole]

yeah i do remember approving that

thanks for the explanation

[lime pivot]

you are very misinformed if you think this fixes hallucination

[thorn ether]

brother the topic was about github ci, not how to create exploits for ios 26

[lime pivot]

not the reason though, your original message was condescending and could have been worded better

[lime pivot]

so is this one

[thorn ether]

which original message exactly?

[lime pivot]

#development message

[thorn ether]

HOW IS THAT CONDESCENDING 😭

[lime pivot]

idk, chatgpt it

[thorn ether]

holy shit if u think thats condescending ur either being disingenuous or soft af lmao all i said was i didnt have time cus i really didnt, and said chatgpt it

i tried to be extra nice with the 👍 too

[rocky oriole]

keyword public

opa334 (@[e-mail])

Some banking apps on the App Store started shipping a sandbox escape to detect TrollStore being installed, I'm not kidding unfortunately.

Infosec Exchange · Mar 25, 2025, 7:37 PM

https://www.rxddit.com/r/Trollstore/comments/1s2jl44/deliveroo_yet_another_popular_app_that_ships/ thought I would leave this here

tl;dr another appstore app uses a sandbox escape to detect trollstore

[lime pivot]

actual insanity that's allowed

[frank fossil]

pretty sure no that's just due to static analysis could not catch them

https://blog.verichains.io/p/technical-analysis-improper-use-of

[lime pivot]

by analysis it can be easily hidden, by the policy enforced by humans it shouldn't be allowed

[fading shell]

apple should install trollstore on all app store testing devices to make sure this never happens again

[gentle grove]

No, it genuinely is just a stupid response to give

[thorn ether]

ok cool

[quaint rain]

“You wanna play at your own game” ahh app

[unborn owl]

is this not against apples terms?

why would they approve this

[thorn ether]

cus apple

[plucky drum]

heck even for a sake of trollstore

its just a trollstore

bank apps even trolled us🙃

[lime pivot]

because app review barely reviews anything, these days they're mostly just there to enforce that you're using in app purchases correctly. they only enforce other rules when someone reports someone breaking them

I feel like someone might know what Xcode version this error started happening with error: The armv7 architecture is deprecated. You should update your ARCHS build setting to remove the armv7 architecture.the toolchain supports armv7 just fine I'm pretty sure but Xcode refuses to compile if that's found in ARCHS

[grim sparrow]

@mossy bobcat

@magic hazel

mfer has an alt with the same namae

[magic hazel]

lmao

[magic hazel]

14

Iirc

Actually

Well it depends

Yeah 14

[lime pivot]

thanks, yeah that matches what I found

had to set up a macOS 12 VM for Xcode 13

[orchid fulcrum]

can this new krw exploit also be used to kcall stuff ? or does that require a pac bypass or another stuff like that

[obtuse hornet]

We have a pac bypass btw

Also, I’m patching this ucred struct:
0x00: 00 93 20 f5 df ff ff ff 40 9a 20 f5 df ff ff ff |.. .....@. .....|
0x10: b6 02 00 00 00 00 00 00 2a 07 00 00 05 23 00 22 |............#."|
0x20: c0 bd 07 f8 dc ff ff ff 60 0d f7 45 dd ff ff ff |........`..E....|
0x30: 02 00 00 00 00 00 12 00 00 00 1a 00 00 00 00 00 |................|
0x40: f5 01 00 00 f5 01 00 00 ff ff ff ff f5 01 00 00 |................|
0x50: f5 01 00 00 f5 01 00 00 f5 01 00 00 b6 02 00 00 |................|
0x60: 00 00 00 00 2a 07 00 00 00 00 00 00 00 00 00 00 |...............|
0x70: 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 |................|

I’ve verified all the offsets I’m patching but the changes don’t seem to persist

write: kwrite32(ucred + 0x40, 0)
read: kread32(ucred + 0x40) returns 501 (unchanged)

Does anyone know why the changes don’t stay? Are these structs in some special zone or could it be a pac issue

[naive kraken]

ucreds are PPL protected

[sonic totem]

We don’t

[sonic totem]

Shouldn’t it trigger a data abort?

[obtuse hornet]

Damn. So elevation to root is not possible without a bypass

[obtuse hornet]

Well, user mode at least

[sonic totem]

Yeah for kcall it needs to be a kernel mode bypass

[obtuse hornet]

Makes sense

[obtuse hornet]

and we can’t patch the proc structure's cached credentials either? Or will that just not do anything

[sonic totem]

Won’t do anything

[obtuse hornet]

Damn

[unborn owl]

nice seems like all of these iphones i bought are unused ios 16.3

[main nexus]

now i'm wondering whether it's even possible for an ios app (vlc) to duck its own audio when a second audio source plays, so both audio sources play but vlc is quieter until the second audio source stops. there's mixWithOthers and duckOthers, but it seems like there's no duckOwn or anything like that?

[echo heron]

nice read on the private apis

I'm working on xpc clients for common daemons

somewhat the lower end of private apis

So far I have a coreduetd client out there already

Ah shit that ucreds are ppl protected

that explains my panic

So how does darksw0rd get privileges to access passwords then

if u cant patch ucred

i'm currently using diaphora to load kernel symbols

Dont ask where i got the symbols from

I'll store the sqlite3 database with the functions that have symbols from iOS 18.4.1 online

so anyone can do this

for development

[unborn owl]

Finally, the exploit loaded one last module, pe_main.js. This uses CVE-2025-43520, a kernel-mode race condition in XNU's virtual filesystem (VFS) implementation, which can be exploited to build physical and virtual memory read/write primitives. This vulnerability was patched by Apple in iOS 18.7.2 and 26.1.

according to the google write up

[frank fossil]

darksword uses exception ports to create an arb call window on any processes, similar to TaskPortHaxx, which is based on a technique used in psychicpaper post-exploitation

[echo heron]

That was my initial idea

Nice to see it implemented

Like I had that idea about half a year ago

that explains the xpc service they drop

I mean use

[frank fossil]

Ref: src/libs/TaskRop/RemoteCall.js#L347-L348

[unborn owl]

what can you do with darksword besides steal data

can you inject frida into a process?

[echo heron]

no as everything is rop

[frank fossil]

arb call sandbox_extension_issue_file -> /var r/w

[echo heron]

Ah that explains the file r/w

You cant load unsigned code so frida injection won't work

[frank fossil]

inject to installd and you get 3 app limit bypass

[unborn owl]

hmm

[echo heron]

Maybe u can use safari to load unsigned code

with jit

but u cant load code into running processes other than safari

only rop/jop

[frank fossil]

Coruna allows unsigned code on victim processes and injects dylib to them

[echo heron]

what iOS version is that

I'm on 18.3

[unborn owl]

i think its 17.x not 18

[echo heron]

yeah thats what I think too

how does jit work

does only safari use jscore with unsigned code

or can u just use jscore anywhere

for unsigned code

only safari has that entilement right

[unborn owl]

for these safari js exploits are they just abusing processes connected to the sandbox?

with their own code obviously

[echo heron]

also don't the exceptions create crashlogs

in the exploit

would be nice for some yara rules

[unborn owl]

i think darksword specifically deleted those

[echo heron]

what about global kernel r/w through maliciously crafted iosurface

or is that a bad idea

as in all apps can access iosurface buffer

so u can use it for global kernel r/w

[sonic totem]

Can’t work

PAC

Giving all apps access to kernel r/w primitives is relatively unsafe too

[elder scaffold]

<@&355174844205367317>

[tribal path]

Probably not

What even is the tweak?

[quaint rain]

Nebula

[tribal path]

Interesting

I may dabble idk

[quaint rain]

The dot is probably rendered as a shape and not a image, you would probably need to overlay it in some way
Tho I am talking out of my ass

[tribal path]

Yeah I do doubt it’s an image

[unborn owl]

claude tried telling me an identifier applicationId was not related to the application and it was internal from some daemon lmao

but it is quite good IF you know what you are doing

its made many mistakes which if I didn't know I wasn't doing I would surely be kicking my pc rn

[unborn owl]

hmm ig i would be hesitant

i don't write tweaks but if apple changed their graphics api from 16 to 26 its gonna be annoying

my guess if you find the way it creates the system creates the cursor shape and replace it with the shape you want it shouldnt be too difficult

but idk if theres multiple states and transitions it does on it

do that the wrong person

and u face jail buddy

😭

if you do it now, you will be pinned for conspiracy too

[obtuse hornet]

How do I locate vm_map_entry for a specific vm_map

[sonic totem]

vm_map->hdr->links?

[junior cypress]

I'm going crazy I'm trying to learn how to make gadgets works on ios jailed but the documentation is kind of shit the .js file I have to put in path that I use the config with script where the fuck do I have to put that file inside the ipa?
Because I tried with listen and everything works if I manually inject the .js file via frida with pc to it, but with script without pc it doesn't work...

{
"interaction": {
"type": "script",
"path": "agent.js",
"on_change": "ignore"
},
"runtime": "qjs",
"teardown": "minimal",
"code_signing": "required"
}
I have the .config inside the ipa so inside the framework I have all 3 file agent.js MgRt.dylib MgRt.config
But when i start the app it open fine but my agent.js doesn't automatically load...
On jailed device.

[worldly pasture]

is there anything i can do to contribute to development? i don't have a mac and in the past i've tried but theos was a pain to setup

[stray viper]

Development of what?

[worldly pasture]

jailbreaks

[stray viper]

You don’t have to contribute, jailbreak development requires lots of knowledge about iOS security

[worldly pasture]

it seems really interesting and i want to

[thorn hound]

!t becomejbdev

[faint lion]

becomejbdev

#1090168975251492996 message

Added by dhinak | Used 169 times · Feb 6, 2024, 5:30 AM

[thorn hound]

wtf i thought this was general

[thorn ether]

theos is extremely easy to set up with WSL

https://theos.dev/docs/installation-linux

[vivid dew]

you can develop whatever you want honestly

like just start developing

find an empty field and just develop all over the place

develop all over your school's bathroom wall

etc. etc.

[lime pivot]

hmm

[gentle grove]

upvote

https://tenor.com/view/developers-ballmer-gif-5359434

[errant tinsel]

Can someone help me create my jailbreak? More specifically, I am creating a jailbreak/tweak for iOS 26.0 and below, with the darksword exploit, and I am trying to get kernel r/w. Currently I have gotten kernel r/w on iOS 15.7 with this exploit BUT on iOS 26.0 no one had done it yet and I need the so_count hex value for Darwin kernel 25.0 to properly get kernel r/w access.. not sure if anyone here has any knowledge on this but it would be a great help, my question is, does anyone know how to get the so_count hex value for Darwin 25?

[faint timber]

26 nerfed exploitation offsets aren’t the issue

[errant tinsel]

wdym?

[errant tinsel]

how do you know

[magic karma]

he's smart

[faint timber]

from real testing

[sonic totem]

You can get kernel r/w easily on non-MTE lol

[faint timber]

Yes

[sonic totem]

So 26 didn’t really nerf anything, MTE did

[faint timber]

Just need to change the exploit

[obtuse hornet]

Use lara

It has the right offsets

[faint timber]

No just need different spray device

[sonic totem]

It worked OOTB for me apart from socket offsets I think

[obtuse hornet]

For iOS 26.0

But you won’t be able to make a jailbreak with this

The closest we can get to a jailbreak using this is springboard injection

[sonic totem]

Or just find a PPL bypass 🗣️

[errant tinsel]

well not really

[obtuse hornet]

But nobody has ported remotecall.js to c yet

Im working on it currently but it’s painful and slow

[obtuse hornet]

Well absolutely really actually

[sonic totem]

I know someone else is

[errant tinsel]

With kernel r/w there’s much more you can do than just springboard stuff

[sonic totem]

But idk if it’s public

[obtuse hornet]

Lisa?

[sonic totem]

But still, full tweak injection isn’t possible with this

Because you can’t hook C functions

[sonic totem]

No

[obtuse hornet]

True

[errant tinsel]

with r/w you can basically control the whole kernel

if you know what your doing

[sonic totem]

Not teally

PPL/SPTM

PAC

Will all get in your way

[errant tinsel]

For arm64 devices at least

[sonic totem]

Sure, you can have a lot of control, but not a jailbreak

Well that’s different

[magic karma]

(no arm64 devices on 26)

[faint timber]

I’m confused IOSurface works out of the box for a18 on 26?

[sonic totem]

Worked for me just fine

26.0.1

[faint timber]

Hmm

[errant tinsel]

I guess you can still do some stuff without ppl/pac bypasses

[grim sparrow]

this is crazy to think about tbh

rip iPad 7

[faint timber]

Rip armv8.1

[sonic totem]

tvOS:

[obtuse hornet]

Well you clearly don’t

[elder scaffold]

tvOS 26.0 jelbrek wen

[sonic totem]

s0n

[elder scaffold]

well arm64 jb is easy trol

[grim sparrow]

ok but like

be honest, whats the point of a tvos jailbreak

trollstore is argubaly useful, but a jailbreak just doesn't seem needed

because all you're doing is sideloading apps for piracy

[steady nest]

what if i want to open Youtube if right left right left on the d pad

[faint timber]

Still no watch jb

[grim sparrow]

I would much rather a watch jb

[grim sparrow]

what are you watching on your TV that requires you to rapidly switch like that

A watch JB would just be useful overall tbh

• Constant HR monitoring
• Custom watch faces that aren't just apps
• Aemulo

my top 3

[elder scaffold]

well no idea
it might be useful if could extend the airplay funtion? trol

[steady nest]

I don't like pressing multiple buttons when I can press just 1

so I remapped youtube and netflix buttons on my TV remote to smarttube and stremio

[obtuse hornet]

are kcall primitives eve still possible?

[sonic totem]

On arm64e?

You need a kernel PAC bypass

And that is not easy nowadays

Kexploits

Well we have one for 26 and 0 PAC bypasses so

[echo heron]

how about using physmem hardware registers

I know some hardware registers are mapped in physmem

Maybe that's a lead

[sonic totem]

Almost none of them are useful for PAC

Or have anything to do with it

Also, mapped registers are at random physical addresses and we often have no idea how they work, so

[pearl sail]

Well I hear the market for a PAC bypass is pretty nice so makes sense we won’t get one for awhile

[sonic totem]

I can imagine so

I don't even know when the last one was patched

Most recent I know of is 17.4 iirc?

[obtuse hornet]

has anyone made a poc for the darksword pac bypass yet

cant figure out the pacia shit

[sonic totem]

Don't think so

I know it uses WebGL

@frank fossil

[frank fossil]

I believe it just hijacks WebGPU process since it shares PAC keys with the rest of the system

[obtuse hornet]

Yeah, logs say something about webgpu too

[slim bramble]

@kind herald

do your job

useless

[orchid fulcrum]

so is the idea overwriting a function pointer that can be called at will ? and pac is preventing that ?

even if it didn't how would you pass custom arguments to registers

[sonic totem]

Well historically you’d get a limited calling primitive, maybe where you can only control one or two registers, and find some gadget to build it into a better calling primitive

Then you’d want to setup a stable bypass by calling ml_sign_thread_state to sign a completely arbitrary thread state that you can invoke from userspace

But not only have they removed a bunch of kernel PAC attack surface in recent years, but also removed the gadgets iirc

[obtuse hornet]

Weneta full arm64e kcall primitive for darksword

[crisp frost]

already done

[sonic totem]

I mean, if you’re on arm64 it’s easy

[obtuse hornet]

me when i lie

[crisp frost]

no i didnt lie

im just on ipad 7 lol

you edited your message it used to not say arm64e

[obtuse hornet]

Lies

All lies

[elder scaffold]

i have full userland jailbreak for ipad 7 🗣️

[steady nest]

18.7.8:

[elder scaffold]

[silver rampart]

noo who deleted it i was about to type mr beast into the text box to confirm payout

wthh

[proper harness]

how to install ios 9.3 xcode simulator on xcode 13

[mellow tiger]

https://old.reddit.com/r/jailbreak/comments/1oyk47y/is_there_any_working_safari_user_agent_changer/

this tweak spoofs safari ua to ios 18.6.2, which is vulnerable to DarkSword

I wonder if spoofing it to >=18.7.3 would prevent some DarkSword payloads from delivering

(screenshot taken from here https://www.lookout.com/threat-intelligence/article/darksword)

[obtuse hornet]

No, it would default to rce_worker_18.4.js

[sonic totem]

The exploit offsets are hardcoded for those versions so if you’re spoofing from an earlier version they shouldn’t work anyway

[mellow tiger]

So if I'm on 15.8.6 (Dopamine) and the exploit runs rce_worker_18.6.js because it detects my Safari UA as 18.6.2, it should fail

Sounds good

[sonic totem]

Yes

Also it only targeting arm64e

[mellow tiger]

Coruna has hardcoded targets for iOS 13-17.4 only. Assuming it uses the browser UA to detect the version, it shouldn't run RCE on spoofed 18.6.2. I don't know if it uses other browser fingerprinting techniques, I'm guessing not because 99% of users don't jb and have no way of changing it
https://cloud.google.com/blog/topics/threat-intelligence/coruna-powerful-ios-exploit-kit

[sonic totem]

Well the exploits don’t work on iOS 18 anyway

[mellow tiger]

But I'm on iOS 15 (not 15.8.7) so if it sees through the spoof it's still vulnerable to Coruna. And DarkSword is still unpatched in 15.8.7 hence the Dopamine beta jb using it

[mellow tiger]

I'm just theorizing since some people will probably say it's still technically unsafe and a simple UA tweak can't possibly be a foolproof solution

[sonic totem]

If there was a tweak to patch the WebKit bugs that’s the only foolproof way

[hybrid horizon]

I saw someone hacked together an updated WebKit on twitter dot com for the purpose of backporting the security patches :P

https://github.com/Lessica/WebKitPlayground

spiritually similar

[ocean raptor]

What if I start working on Procursus again as an April fools joke

[cloud yacht]

if you do you should update neovim

[lost nebula]

for april fools bring back Elucubratus instead

thanks

[reef fiber]

settings > safari > request desktop website, done you're a mac catalina 🙂

[visual meadow]

anyone know where splashboard denylist is

Snapshot generation request for bundleID: com.atebits.Tweetie2 rejected due to the app being denylisted.

i dont wanna delete and reinstall

[visual meadow]

I figured it out theres api that removes the flag

[lime pivot]

that would be a good joke

it would be even funnier if you continued on april 2, 3, 4, 5, 6

actually it would be an absolute laugh fest if you kept doing it every day for years

[ocean raptor]

Definitely not going to do that

I’m not even going to do it for one day

[lime pivot]

do it for 23 hours, 59 minutes, and 59 seconds

[indigo kraken]

is this a system denylist? sounds new

[visual meadow]

Its been there for a while i think

Ive had it happen on 16

Probably happens earlier

[indigo kraken]

@visual meadow I’d explore lsaw / xbappmanifestctl for anything related to that (xbappmanifestctl is a tool for everything related to splashboard)

oh I see you figured it out, didn’t notice your second message

[visual meadow]

Ok

[acoustic imp]

Is the new os18 update for os26 devices ota only ?

[timid furnace]

probably

we'll find out in 13 hours

[kindred portal]

Does anyone know if DarkSword is compatible with iOS 18.1? The PoC on GitHub isn’t but not sure if that’s lack of offsets or not all the vulnerabilities existed on that version
I’ve looked at the CVEs and none of them say they started after 18.1, but most of them just don’t have a starting version so idk

[velvet path]

yes

[severe stream]

<@&355174844205367317>

[kindred portal]

Nice
Is finding offsets for iOS something that’s at least doable if you have some reverse engineering experience or is it just a massive pain for iOS? I saw a really old blog post which afaik was saying you mostly need the ipsw file + some custom tooling, is that still the case?

[sonic totem]

Are you trying to use the WebKit exploit?

[kindred portal]

I want to yeah
Probably will not be successful but just want to at least try the PoC on my 18.1 phone if it’s possible, it’s just missing offsets

[sonic totem]

I guess you can I theory port it by just looking at what they point to on a compatible version and then finding the same sequence in an older version

[keen lintel]

Hey i have a question, could i possibly develop a tweak to get liquid glass using https://github.com/DnV1eX/LiquidGlassKit ?
im already halfway and a sucessful build is there, but i enter safemode as soon as i install the tweak

[keen lintel]

(update i gave up and made smth else - https://github.com/portonvpn/Dockremover)

on accident

unoptimized as hell btw

[crisp frost]

its not even public

[orchid fulcrum]

has anyone did the offset finding for 14pm on 26.0 ? (planning to do it sometime if not)

im assuming these are kernel offsetts
are these offsetts required for the actual exploitation that gives you krw or are they just for PoC purposes ?

[sonic totem]

They're for either krw or finding kernel base

Because it goes through some structures to find a __TEXT pointer

[keen lintel]

wdym

sources

[grim sparrow]

the link to ur repo

its either the wrong link or a private repo

[keen lintel]

oh yeah mb it’s private (was testing)

dont use it

unoptimized as hell

just removes dock

[grim sparrow]

i dont think he was planning on using it

[keen lintel]

lmao

[grim sparrow]

more just wanted to look because you posted a link here

[keen lintel]

oh okay

i js wanted to ask if it was possible to implement that liquid glass kit in older ios

[grim sparrow]

you could in theory, but it would be a lot of manual work

[keen lintel]

oh okay👍

[hasty ruin]

<@&355174844205367317> gm

[kind herald]

https://cdn.discordapp.com/attachments/688121419980341282/1264427817366454323/discord-scam.gif

[hasty ruin]

[hasty ruin]

[slim bramble]

@kind herald

[slim bramble]

@rotund magnet

<@&355174844205367317>

[torn oriole]

Lmao you got got

[slim bramble]

No, I ping hdml on purpose

[torn oriole]

Suuuure

[slim bramble]

🙄

[hasty ruin]

Hey you can ban him for useless ping now

[rotund magnet]

on it

pinging staff is fine but pinging me is a bannable offense

[kind herald]

@rotund magnet

[rotund magnet]

die bitch

[kind herald]

ok sorry

[elder scaffold]

<@&355174844205367317>

[finite frost]

hey guys, I just began developing for ios and I wonder whats a good method for getting the current media's title and artist, I am right now hooking into MRUNowPlayingLabelView but its really inconsistent, sometimes giving me the song name and sometimes the song name and artist name, I tried MRMediaRemoteGetNowPlayingInfo but it just crashes, gpt is telling me it's a PAC error since it is actually calling MRMediaRemoteGetNowPlayingInfoForOrigin and I haven't been able to figure that out, also somehow parsing the song title with artist name might be a challenge due to certain songs having their own '-' in the title

[hasty ruin]

MRMediaRemoteGetNowPlayingInfo is correct

what crash are you getting

[finite frost]

should be in here, didn't look at it myself just sent it to gemini, it told me it's actually calling MRMediaRemoteGetNowPlayingInfoForOrigin, which takes some additional parameter for the origin, I am using theos with the 16.5 sdk and compiling on my iphone

[grim sparrow]

can you show the code for this

[finite frost]

#import <os/log.h>
#import <MediaRemote/MediaRemote.h>

%hook SBMediaController
- (void)setNowPlayingInfo:(id)arg1 {
  %orig;
  os_log(OS_LOG_DEFAULT, "[geniuslockscreen] Caught setNowPlayingInfo call");
  MRMediaRemoteGetNowPlayingInfo(dispatch_get_main_queue(), ^(CFDictionaryRef result) {
    if (result == 0) {
      NSDictionary *resultDict = (__bridge NSDictionary *)result;
      os_log(OS_LOG_DEFAULT, "[geniuslockscreen] %{public}@", resultDict);
    } else {
      os_log(OS_LOG_DEFAULT, "[geniuslockscreen] MRMediaRemoteGetNowPlayingInfo returned nothing");
    }
  });
}
%end

mediaremote is included in the private frameworks in the makefile

[grim sparrow]

is arg1 one not what you need

[finite frost]

uhh dont think so, when checking with FLEXing it just shows some 2 values like is first track and is last track, I am on ios 17 though

atleast for the actual value that is under sbmediacontroller didnt look at what it actually gives when I hook it

[grim sparrow]

just print arg1

It's underlying type is NSDictionary

[finite frost]

okay imma try I gotta go so I will try to do it on my iphone 😭

[grim sparrow]

I would not be surprised if its an NSDictionary of the MRNowPlayingInfo

[finite frost]

btw how do I get the os logs on iphone, I cannot run the oslog command it just gives errors I gotta check it via cable

on pc

[grim sparrow]

windows?

[finite frost]

nono I can get logs on linux with the idevice stuff, just on iphone I cannot get them cuz with the terminal oslog just gives me something about corrupt errors prob because I am running nathanlr which is rootless

[grim sparrow]

oh

lol

[grim sparrow]

fwiw this isnt the code thats crashing, you know that right?

[finite frost]

ik that, I can os log just fine, it crashes once it hits the mrmediaremote method

[grim sparrow]

just checking

[finite frost]

yeah sorry I am gonna tell you if it worked once I get back, I already need to go

[finite frost]

yup arg1 is empty, still haven't figured it out unfortunately

[orchid fulcrum]

can we use darkswords remotecall on springboard with dlopen to achieve springboard tweaks ? or library validation etc disallows that

[visual meadow]

Anyone know how to grab a file from the FDR server?

Or rather what is the url to it

[naive kraken]

of course you can't

anything involving mapping executable code is behind PPL

JavaScript interpreter is all the "code execution" you will get

[wooden yarrow]

<@&355174844205367317> good evening

[visual meadow]

bro

[elder scaffold]

meow

[visual meadow]

vro

https://tenor.com/view/federal-gif-21422736

[harsh junco]

meow

[orchid fulcrum]

can someone explain this more in depth in their free time.

my thoughts (on calling dlopen from springboard on an unsigned/locally signed dylib):

since springboard is unsandboxed the "file-map-executable" sandbox rule is irrevelant.

"library validation" feature could be an issue (dylib needs to be apple signed)

other than that simply "remapping rw memory as rx memory" itself might need jit entitlements or bypassing ppl/sptm. although i think mmap has exceptions for that for files (mentioned in the middle of this video https://youtu.be/SuQGQ1vh9k0?si=0fc8w4-L6P_kHN58)

[sonic totem]

If you want to inject a library, it needs to be the same trust level as springboard, so in this case the library must be in trustcache

If you want to remap memory from RW -> RX and execute it, at least on 18.x, you need the wx_allowed bit set on your pmap, which requires a PPL/SPTM bypass in this case

[hasty ruin]

@kind herald

[slim coyote]

@kind herald

[kind herald]

Maxine

[wooden yarrow]

<@&355174844205367317> gm

[exotic spire]

gm

[obtuse hornet]

Alfie wen eta libgrabkernel2w with .aea ota update support

[sonic totem]

Does it not work with AEA?

Why wouldn’t it? The kernels are unencrypted

[visual meadow]

how are you supposed to partial zip a .aea lol

the kernel is within

[sonic totem]

Oh right OTAs are entirely AEA’d

@timid furnace thankfully we have your aea lib too

[faint timber]

piece of cake
ipsw ota extract --key-db ota_fcs_keys.json 801e486d28bb9952372d751114662165d7990d9fa20df048c7dac4f386ee3ad0.aea --pattern "AssetData/boot/BuildManifest.plist"

[timid furnace]

Not really possible

At best it'd take a while

[grim sparrow]

@gentle crescent

[gentle crescent]

:(

[grim sparrow]

:)

[obtuse hornet]

uh oh, why not?

gotta make libgrabkernel3 now or what

[timid furnace]

AEAs have no file list

You have to scan through until you find the kernel[cache]

Which basically means fetching from the start

[worn bramble]

i made a bluetooth LE advertisement tweak that hooks into bluetoothD

[sonic totem]

@obtuse hornet you can just get krw and “sandbox escape” to /private/preboot, no?

[obtuse hornet]

Well you know how to know recursion you must first know recursion? It’s the same here. We grab offsets from the kernelcache that we need for the sandbox escape

[faint timber]

exploits needing offsets... now thats a blast from the past

[sonic totem]

Which offsets?

You should be able to hardcode them based on XNU version unless there’s actual kernel addresses

[crisp frost]

wait, why do you need aea's for the kernelcache again

aren't those just in the ipsw root

or is it for ota only versions

I'm not up to date on latest devices and latest softwares lol

my knowledge cut off point is like iOS 17

[wooden yarrow]

that or ota only devices (watch, homepod etc)

[frank fossil]

So you’re saying these need to patchfind:

    uint64_t kernproc = xpf_item_resolve("kernelSymbol.kernproc");
    if (!kernproc) kernproc = xpf_item_resolve("kernproc");

    uint64_t rootvnode = xpf_item_resolve("kernelSymbol.rootvnode");
    uint64_t procsize  = xpf_item_resolve("kernelStruct.proc.struct_size");

• kernproc can be found dynamically by traversing back from proc_self
• rootvnode can be found by other means (see wh1te4ever’s implementation)
• taskbyproc can be implemented using a different way proc->proc_ro->task (see wh1te4ever’s implementation

[orchid fulcrum]

so im kinda out of the loop, i want to use kread, kwrite (and ideally remotecall) primitives on my 26.0 iphone 14pm. what exactly do i need to find offsetts for (and where to put them, https://github.com/opa334/darksword-kexploit/blob/main/src/main.m here ?) in order to do that ?

[elder scaffold]

look at the dopamine implementation.

[frank fossil]

all offsets and RemoteCall are already implemented in wh1te4ever’s fork

Also we should look into stack-based pwning lol. Some of their bypasses look wild, especially what exception ports injector and MIG bypass do is hold a kernel mutex then modify something in kernel stack. That made me wonder if a PPL/codesign bypass can be done in a similar fashion?

[slim bramble]

What's MIG?

[tribal path]

I was looking at it a few days ago
Does it still depend on XPF? I was having trouble trying to get it working on tvOS even after I compiled libxpf for tvOS

[frank fossil]

Mach Interface stuff, though in DarkSword context it also includes sandbox bypass and such

[frank fossil]

it includes XPF but unused

[obtuse hornet]

i know, white4evers version does it too, im just too lazy to implement it 😭

[obtuse hornet]

a codesign bypass would be sick

wouldnt that just instantly enable "real" springboard .dylib injection via remotecall?

[tribal path]

ah alright
I’ll mess with it again later today then

[slim bramble]

Depends on the trust level you get with the bypass, I’m guessing SpringBoard is in TC, so the bypass would have to be at that level, and I don’t think that’s the case

Dont take my word for it tho, I may be wrong

[granite frigate]

hi chat

so i picked up

a mac from ewaste

it boots

to a random person’s password

im assuming the dude doesnt want it anymore cus

it was in the ewaste.

so wat do

[tribal path]

this is development
but anyways which model / year

[granite frigate]

2015 pro i think?