development

[granite frigate]

no appropiater channel

[tribal path]

can boot to (internet) recovery / a bootable macOS USB, erase disk, and reinstall macOS without any issue

[granite frigate]

sweet

oke

[tribal path]

T2 and later added activation

[granite frigate]

i can also do arch right

[tribal path]

yeah

[granite frigate]

might just nuke it

[tribal path]

have fun

[sonic totem]

If you could get a stable CS bypass you could get a “jailbreak” to an extent

More like a semi-jailbreak

[obtuse hornet]

That’s what I was thinking

[orchid fulcrum]

so these are what he found the offsets for and mine is the last one right ? so another ios/phone combo still needs manual offset research ? very lucky for me lmao

[tribal path]

That's what it's been tested on, offsets are present for other devices. iPhone14,6 isn't your phone anyways (that's the SE 3rd gen, yours is iPhone15,3)

[orchid fulcrum]

😭

[tribal path]

AI overview is trash sadly

[manic forum]

it's genuinely baffling how bad the ai overview is sometimes

[visual meadow]

what method does springboard call to open another app when you hit a link inside of an app

[frank fossil]

I think I reversed something close, see how LiveContainer passes url scheme to LiveProcess

[tribal path]

It works!
will be doing some more experiments with this soon, hypothetically should be able to make a jailbreak since it's arm64 but I doubt I'm smart enough to do that

[unkempt magnet]

All devices iOS 17.0-26.0.x should work,
Not only these device, I reversed almost all of device's kernelcache

rootvnode can be also obtainable from launchd's vnode; by walking down vnode->v_parent.

[sonic totem]

Or vnode_for_path("/")

[unkempt magnet]

To make working proc_self,
I added intentionally
pthread_set_qos_class_self_np(QOS_CLASS_BACKGROUND, 0); and
pthread_set_qos_class_self_np(QOS_CLASS_USER_INITIATED, 0); to between socket func,

Then you can get current thread kaddr.

[frank fossil]

Interesting

[orchid fulcrum]

so can a krw be used to achieve arbitary task_for_pid trivially so that we have a way to manipulate other processes via userspace mach apis ? like i know we can implement task_by_proc but that just gives you the kaddr of the actual task rather than a send right to its task port that you can use from userspace.

if not; what about:
using remote call on a process that has task_for_pid-allow entitlement, and then using mach apis from that process.

/*
i was thinking this so maybe we could use tfp on & set a custom exception port for amfid and bypass codesigning but im not sure if this part makes any sense
*/

[crisp frost]

me when dtsecurity

[unkempt magnet]

Amfid codesigning bypass has been dead on iOS 15.2+ (IIRC)

[sonic totem]

IIRC amfid hooks aren’t enough anymore because the kext double checks signatures if amfid approves them

[orchid fulcrum]

ok i see, what abt the send right part tho

[obtuse hornet]

well i mean isnt remotecall already just getting task ports?

[orchid fulcrum]

hm, i think it does the exception port method as well yea

[obtuse hornet]

do exception ports not equal task ports?

i mean i know that theyre not the same thing but dont they both amount to the same thing?

[orchid fulcrum]

i meant the way it "calls" stuff on the remote process is by using exception ports, but im not familiar with the codebase yet so maybe im making it up. and to set a custom exception port on a process you need to have access to its task port (or maybe krw can bypass that)

[obtuse hornet]

oh im totally tripping

my bad i was thinking of the wrong thing

[sonic totem]

In theory yes because you can use krw to get code exec in a process that has system task ports access probably

[tribal path]

Is the only way of bypassing codesigning injecting to the trustcache?

[obtuse hornet]

tc injection is close to infeasable nowadays iirc

[sonic totem]

CoreTrust bypass

[obtuse hornet]

didnt ctv3 exist once?

[sonic totem]

If you have PPL/SPTM bypass it’s over

[native orbit]

@sonic totem does fake blob method still work?

[obtuse hornet]

good luck finding that 😭

[sonic totem]

Fcntl?

[native orbit]

yes and no

the blob attached to vnode

[sonic totem]

Oh no

Csblobs are RO

[native orbit]

sad

[sonic totem]

PAC or PPL/SPTM bypass required

CS is basically unbypassable with krw alone

[native orbit]

laughs in arm64

[sonic totem]

We have one for 17.3.1 and below

[obtuse hornet]

well i dont have a device on that version

ergo its useless

[sonic totem]

Your turn to find a bypass

PPL lowkey easier than KRW

#cope

[native orbit]

[sonic totem]

Get to work jb devs

[native orbit]

ok apex dev

[sonic totem]

Shoutout Sileo for adding Amethyst and Apex support in 2024

[native orbit]

2026 release 100%

[sonic totem]

🗣️ 🗣️

[tribal path]

Well yeah that but I’m talking with only a kernel exploit (with a PPL bypass if applicable)

[sonic totem]

Then yes trustcache only

[obtuse hornet]

ctv4 etas0n™

[sonic totem]

Need v3

[obtuse hornet]

ctv3 exists apparently

i was told by someone who was told that someone has it

[sonic totem]

Is this person a reliable source though

[obtuse hornet]

well the person who told me, yes, the person who told the person who told me, i dont know

[frank fossil]

then manipulate kernel stack memory before amfid returns to AMFI

[obtuse hornet]

key word

tinfoil hat

[sonic totem]

It also means codesigning validation never leaves the kernel

Unless you’re using enterprise/dev signed apps

[obtuse hornet]

so what does this mean for the average user

[orchid fulcrum]

jelbrek

[manic forum]

jelbrek

i have not slept in 3 days

[left phoenix]

Seks

[light owl]

@kind herald This bot sucks

[kind herald]

Not my problem

@shut stag
Hi

[shut stag]

wtf

[kind herald]

So what were you saying about your shit code

[shut stag]

well you banned him

[light owl]

Your bots suck

[shut stag]

so it shoulda deleted

[light owl]

Gir and your chatgpt ai slop bot

[shut stag]

so its a discord bug

[light owl]

Yup ... blame it on discord ... Not the bot ...

[manic forum]

should've kept janet fr

[orchid fulcrum]

im trying launching the whitevers darksword/kfun app, the xpf library is causing issues, i am copying it to the app bundle and signing it (via xcodes codesign on copy feature)

[tribal path]

You can remove XPF, it isn't required, I was having trouble with it too

[orchid fulcrum]

thanks

[kind herald]

cloude ai

@shrewd smelt @native dune @light owl

[hasty ruin]

rootfs is the biggest of all

[shrewd smelt]

cloid

[obtuse hornet]

cloud ai

[lime pivot]

you should never trust a random person sending you code to run

[hasty ruin]

no bro you just gotta search for terminal.app, open it, paste in this long ass command full of b64 data, then run it with sudo to verify you're not a robot

[pearl sail]

It makes sense in theory

[faint timber]

remember to always press yes for UAC when the yellow window pops up

[light owl]

What if its red

[faint timber]

just means extra trusted compared to yellow

[manic forum]

uacs are annoying

i just login as Administrator at all times

there are at least 2 people i know who actually do this, one for weird explorer extensions and the other for performance i think

[harsh junco]

performance?

[manic forum]

the same person also uses windows 10, doesn't install windows updates, has removed windows defender and has disabled microcode patches that mitigate spectre/meltdown/etc to improve performance

idk

[harsh junco]

💀❓

[faint timber]

the plot went entirely over your head tbh

[manic forum]

?

[faint timber]

its nowhere near important enough to explain just move on with your life cut your losses

[tough pendant]

Just turn UAC off lmao

It’s literally in the control panel

Holy genius

[tepid olive]

not sure if anyone had noticed/find this helpful at all but theres a retype function in SPTM (14 pm 26.1) which handles retyping memory frames validates new frame type (new_type < 0x40 (must be under 64)) but it never validates the current frame type loaded from metadata (fte->type) before using it to index a function pointer table

so theoretically if we found a way to corrupt fte->type it might be smth

or im just yapping nonsense

[tepid nacelle]

@slim bramble not sure if anyone had noticed/find this helpful at all but theres a retype function in SPTM (14 pm 26.1) which handles retyping memory frames validates new frame type (new_type < 0x40 (must be under 64)) but it never validates the current frame type loaded from metadata (fte->type) before using it to index a function pointer table

[sonic totem]

Stop using AI to try and find SPTM bugs

[void harbor]

How did blud know it was AI

💔

[steady nest]

he's using a part of his body you're incapable of

[void harbor]

Hi.

Long time no see buddy.

[sonic totem]

Because you can tell when someone tries to play off an AI answer as their own but clearly doesn’t understand what they’re talking about

Not the first time…

[void harbor]

Gulp

[void harbor]

Right

Bro @sonic totem Test my escalate code pls

[sonic totem]

Oops

[void harbor]

I still don't have any iOS 14 devices

[sonic totem]

Forgot

I can test today

[void harbor]

All good

Ok wait

I made some changes

Will send in dms

[sonic totem]

I was deep in Coruna for like 3 days

[void harbor]

Nice

[void harbor]

Check your direct messages Blud. 👀

[lime pivot]

bro caught coruna-19

[void harbor]

I see what you did there

[sonic totem]

I would rather catch COVID than keep reversing this atp

[lime pivot]

have you considered using claude 4.7 opus (1m context)

[sonic totem]

I would rather not go broke

But in all honesty it’s fine, I can reverse it without issue, it’s just a LOT to reverse

And I’m worried Claude will mess stuff up

[elder scaffold]

oh no

[unkempt magnet]

When I asked how PurpleGfxMem/vram located in and if there's any way to see where located,
Then Claude stopped to answer about it. 😩

[void harbor]

Idk why AI does this

You would've thought it's pretty obvious if you wanted that information for malicious purposes

[thorn ether]

you should use Claude CLI

[unkempt magnet]

Okay, I submitted application and now got accepted! 🙂

[unkempt magnet]

Now I can continue to send prompts.

[native valve]

Hello, anyone got a guide for how to create tweaks for apps such as YouTube? I want to try developing a tweak

[tribal path]

I like this
General guide for tweaks in general

https://github.com/NightwindDev/Tweak-Tutorial/tree/main

you can look at YouTubeX’s source and maybe find headers to look at making tweaks for YouTube specifically

https://github.com/PoomSmart/YouTube-X

[orchid fulcrum]

what happens when you write custom data to ssv protected files with krw ? it restores on the next boot ? it doesn't boot at all ?

[obtuse hornet]

it restores on next boot

[sonic totem]

“Write”?

[obtuse hornet]

yeah

[orchid fulcrum]

idk the correct term tbh, change vnode ?

[obtuse hornet]

with krw we can directly modify the virtual fs i.e. write to r/o or SSV protected files

[sonic totem]

Is it vnode swapping or what?

[obtuse hornet]

nope

we mmap the file and patch its memory protections from r-- to rw-

and then write directly

memcpy

[sonic totem]

Damn

I've not seen that done before

[obtuse hornet]

desperate times call for desperate measures

[sonic totem]

It's nice I didn't know it was that easy lol

vnode redirects ftw

[obtuse hornet]

the great part is that were not even redirecting anything, just editing the files memory directly

though, vnode redirection is of course also a possibility

might even be the better approach tbh

[sonic totem]

That's what I used to use

Idk why

Ah because I had a writable rootfs but didn't want to write to the file directly

[orchid fulcrum]

yikes i also managed to get myself flagged in chatgpt, and the question wasn't even any good it was some script kiddie level bs 😭

[obtuse hornet]

well i mean we can ptrace arbitrary processes i.e. enable jit, no? couldnt we just write like position independent code into jit mem and jump to it via the remotecall you described?

correct me if im wrong

though, we still cant like map a macho binary

well we could

but code signing breaks that i think

[sonic totem]

Doesn’t the ptrace trick require the target process to have get-task-allow?

[obtuse hornet]

true

i forgot about that

uhhh

[orchid fulcrum]

yep thats no good then (i was typing a super cool plan tho rip..)

[rocky isle]

Hey anyone use appium? Im having a weird issue where i can't reliably startup the WDA runner on my phone by using uiopen via ssh. Sometimes it works, sometimes it wont start. My WDA runner app is installed via trollstore so doesn't have the normal restrictions. But if i run the app via pressing the icon on the phone physically, works fine. Is there a tweak or something that lets me mimic the way laucnhing apps works via pressing vs uiopen

[orchid fulcrum]

#jailbreak message

init_remote_call causes a panic for me consistently on 14pm 26.0, i tried both with and without using the mig bypass option, and with and without being debugged/monitored by xcode. panics everytime

[sonic totem]

Wrong offsets

You've got some NULL deref

[native valve]

Anyone has an idea why the google login in YouTube is not working when I inject my own .dylib into the decrypted ipa?

It works fine if I use some known tweak such as YouTube Plus (former YTLite)

[tribal path]

https://github.com/dayanch96/YTLite/blob/main/Sideloading.x

Not sure how up to date this still is

[native valve]

Oh I see, thank you

[tribal path]

No problem

This might be more up to date:

https://github.com/PoomSmart/IAmYouTube/

[native valve]

I guess I can use classdumpios or something if this doesn’t work anymore to analyze it myself. Will test this first though, ty

[tribal path]

no problem

Reason why something like that is needed is because sideloading apps inherently changes their bundle identifier (appends your team ID to the end iirc), unless signed with an enterprise certificate
On a jailbroken device just tweaking the app directly that shouldn't be an issue, and with TrollStore that shouldn't be an issue either, only with normal sideloading

[light owl]

signing an app with the same bundle id of an app store app will get your developer account banned

[tribal path]

yeah assuming you're on like
an actual paid Apple Developer Program membership

[light owl]

so people use ppq check in feather or whatever and add 4 characters to the end so it doesnt match anymore

[tribal path]

Truthful

[shut cedar]

@wooden yarrow are you still reversing sep these days

i have an interest for reversing the chip on my macbook

for asahi

cc @crisp frost

[shut cedar]

(what i'm asking is if anyone has somewhere to point me towards to start before i bug the asahi people)

[wooden yarrow]

you can certainly see what's still missing then RE the corresponding SEP modules

[crisp frost]

idk anything about mac sep internals ngl

welcome back tho

bro is prob gonna despawn in 3 days to return on another alt later

[orchid fulcrum]

uint64_t firstPortAddr = task_get_ipc_port_kobject(task_self(), firstExceptionPort);
panics on this line fwiw

[sonic totem]

Well it’s something inside that function

[slim bramble]

yeah

a new alt in 67 days

[orchid fulcrum]

following more, crashes in kreadptr part of task_get_ipc_port_object. arg looks like a valid kaddr, so i assume task_get_ipc_port_table_entry works fine. and the ie_object offset is 0, so idk whats causing the issue here

[sonic totem]

Hm no that’s correct

ie_object being at offset 0

[orchid fulcrum]

yep.

[orchid fulcrum]

kread64(arg) also panics tho, so maybe task_get_ipc_port_table_entry doesn't work after all

[sonic totem]

What’s arg

Like its value

8?

[orchid fulcrum]

nah, its a 0xfffffffaa... , i.e an address in kernel

[sonic totem]

0xfffffffaa doesn’t seem like an address in the kernel lol

This makes no sense unless you’re getting a different panic

Because the panic said you tried to kread address 0x8

[orchid fulcrum]

lemme check latest panic log

[sonic totem]

Ah no

I misread it

0xfffffffa… seems like a bad address

But that is the address in the panic log

[shut cedar]

i haven't rejoined this server in nearly a year

occasionally i check hd

[orchid fulcrum]

could it be that t1sz_boot is 0x11 on a16 in whitevers fork, but it should actually be 0x19

lara's remotecall seems to work

[sonic totem]

Yes actually that’s probably the issue

[orchid fulcrum]

ok cool, now it doesn't panic and init remotecall actually tries to do stuff.

however while lara's 5 icon dock tweak works, mine (exact same code, one uses @frank fossil 's objc wrapper class implementation the other uses whitevers impl directly) seems to crash springboard

@obtuse hornet cc ^

[obtuse hornet]

whats this tool you used to parse the panic?

[orchid fulcrum]

console.app on mac

[obtuse hornet]

oh

as in you dragged the panic into it or you were watching the syslogs

[orchid fulcrum]

former

[sonic totem]

I would do some basic remote call to confirm it actually works

Set X0 to 0x41414141 and jump to a LDR X1, [X0] or something

[obtuse hornet]

this is a known issue. on a15+ and m1-4, t1sz_boot is 0x11 though it should be 0x19 or vice versa.

[sonic totem]

XPF update required

[obtuse hornet]

not even an xpf situation, the value is hardcoded 💀

[sonic totem]

Yeah I know lol I just mean XPF has a metric to patchfind it

[obtuse hornet]

oh

[sonic totem]

But it doesn’t support iOS 26

[orchid fulcrum]

nah i fixed that, with 0x11 it straight up kernel panics. i changed it to 0x19 and it doesn't panic anymore. but it doesn't actually work either, lara's 5 dock tweak works but i can't reproduce it in my own code, i wonder if theres anything special that lara does

[obtuse hornet]

so does lara work or not?

[orchid fulcrum]

i tried to simply call malloc and it still crashes. not sure how to do ldr x1 thing

[orchid fulcrum]

it does

[obtuse hornet]

is your app built for arm64e?

cause it needs to be

[orchid fulcrum]

oh..

that was it lol

[orchid fulcrum]

i have some ideas myself but can someone explain whats the reason behind this

[obtuse hornet]

might be a pac thing?

no clue honestly

[orchid fulcrum]

yeah pretty sure it is, but like what specifically i wonder

[obtuse hornet]

xpaci

[orchid fulcrum]

So apparently protobox disallows springboard to call task_for_pid,.

Warning idk what im talking about below:
can i use krw to add my apps ipc_entry/port (whatever), to springboards ipc_space->is_table and generate a mach_port_name (send right) manually so that i can call vm_remap or other mach api from springboard with my apps task port name as the target ?

[obtuse hornet]

no clue, but i can tell you that just "adding" it isnt possible. we dont have kalloc. you could overwrite (?)

[orchid fulcrum]

oh right

[sonic totem]

You can use the DarkSword method to bypass Protobox

That’s what the MIG bypass is

[sonic totem]

You can do a local kalloc very easily (local meaning it is freed when your process exits or you free it)

[orchid fulcrum]

how come ?

[orchid fulcrum]

oh i see

[orchid fulcrum]

i guess you can call malloc in ur process and remap the corresponding phys address into kernelspace

[sonic totem]

That is one way I think yes

Or another easy way that comes to mind is create a pipe and steal its pipebuf pointer

When you close the pipe, it’ll free the buffer

[shut cedar]

do u have free time

[shut cedar]

what are tz0 and 1

exception levels? tbh i don't even know what exception levels fully are

[sonic totem]

TrustZone

Isolated memory regions

SEP uses TZ0

[shut cedar]

and TZ1 is on the AP?

[steady nest]

tz1 is for KPP

[sonic totem]

It’s unused

There are also references to TZ2/TZ3 which afaik are also unused

[steady nest]

A8 tvOS 26:

[sonic totem]

[elder scaffold]

KPP bypass for tvOS 26 confirmed

[shut cedar]

Has it always been unused

[elder scaffold]

A10 and later, yes

(Idk about recent devices)

[sonic totem]

KPP used it on A7-A9

[obtuse hornet]

does anyone know if dns profiles are stored as files on the fs somewhere and if yes, where? or are they somewhere in profiled memory

[tribal path]

I’m 80% sure they’re done on the filesystem just from my experience with other profiles (elite tvOS update blocking experiments)

I can look into it later for DNS profiles specifically but yeah. Just monitor the filesystem while adding a DNS profile or search for a specific string you’re using as a DNS server on the filesystem

[obtuse hornet]

i tried /var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfiles/ (to no success)

[narrow sequoia]

like a nextdns profile or?

[tribal path]

Yeah no it’s not there, that just stores the actual profile and its metadata and such
I’ll investigate it soon
I wouldn’t be surprised if it’s maybe stored via UserDefaults?

[obtuse hornet]

a normal dns profile, i dont care which provider

[obtuse hornet]

that would be bad

but ive heard multiple people tell me its somewhere in var

[narrow sequoia]

i mean those are just like any other profile you install right

[tribal path]

why?

would just be a normal plist lol

[narrow sequoia]

wouldnt it be a .mobileprofile

[obtuse hornet]

for real? i dont know how userdefaults/appstorage is stored

[tribal path]

That would be for the profile itself but not for the actual settings the profile applies

[narrow sequoia]

oh

i mean maybe grep for it

[obtuse hornet]

i dont exactly have a terminal lol

i just have arbitrary / read thats it

[narrow sequoia]

rip

[tribal path]

UserDefaults and SwiftUI’s AppStorage wrapper just pretty much store a (usually binary) plist file containing the keys you’re saving in a folder depending on the domain

[obtuse hornet]

bplist my beloved ❤️

[tribal path]

Hate bplist so much
XML supremacy

[obtuse hornet]

just convert 😎

[tribal path]

[tribal path]

you don’t have any other jailbroken device?

[harsh junco]

openstep plist format.
until we meet again.

[obtuse hornet]

i do, but they take like 3 days to charge 😭

[tribal path]

rip

[timid furnace]

it's probably in sc framework

[obtuse hornet]

SystemConfiguration?

[timid furnace]

yes

[obtuse hornet]

so in /System?

[timid furnace]

no

but exactly where i can't confirm

i would have to dig a device out for that

[tribal path]

@obtuse hornet try /private/var/preferences/com.apple.networkextension.plist

It's a binary plist (NSKeyedArchiver specifically) which is not super fun to work with manually

[obtuse hornet]

just convert and convert back no?

thanks by the way

[tribal path]

NSKeyedArchiver is the relatively painful part
you'll see when you get there, it's just really annoying to work with

[tribal path]

no problem

[tribal path]

I'm pretty sure you can work with it easily within an app but I haven't had to really deal with it much before

[obtuse hornet]

What the hell am I looking at 😭

[tribal path]

Yeah it's annoying.

https://stackoverflow.com/questions/56215273/round-trip-encoding-and-decoding-with-nskeyedarchiver-and-nskeyedunarchiver

Probably a helpful stackoverflow thread just briefly looking into decoding NSKeyedArchiver stuff. It seems somewhat easy to work with if you intend to integrate this into an app or something

[wooden yarrow]

https://github.com/michaelwright235/nskeyedarchiver_converter etc

[orchid fulcrum]

to clear up some confusion

second argument to init_remote_call is bool useMigFilterBypass, were you talking about that ?

or was it the other functions in MigFilterBypassThread.m ?

i tried to pass true to the first case but it didn't help, i still get Protobox: SpringBoard(35) deny(1) syscall-mach 45

[hasty ruin]

hey i did the opposite of that ages ago

[wooden yarrow]

xkcd 927

[hasty ruin]

[sonic totem]

That is the bypass I’m talking about yes

Idk how remote call uses it

But it’s a per-call usage

[visual meadow]

does anyone know of an entitlement that would allow jit on 26

com.apple.private.cs.allow-jit is not working

[sonic totem]

dynamic-codesigning

[visual meadow]

didnt work either

wait

i'm so unintelligent

disregard this entire conversation

[sonic totem]

Debugger entitlement required

[visual meadow]

i forgot to include substrate

oops

[orchid fulcrum]

isn't it developer instead of private

[visual meadow]

theres both

[sonic totem]

Fake JIT isn’t even possible anymore no?

Unless you have debugger entitlement

[visual meadow]

let me just add that then

com.apple.private.cs.debugger?

[sonic totem]

I guess

[visual meadow]

ok let me see if it works

still not working but probably for another reason

[lime pivot]

can't imagine how you can make NSKeyedArchiver even less readable

[obtuse hornet]

It’s a simple true/false flag

Just call rc_stable(x, y, z, hasMigBypassThread: true)

[sonic totem]

I more meant I don’t know what it uses the MIG filter bypass for

[orchid fulcrum]

is the way remotecall sets an exception port in a remote thread as such:

1. create a pthread on our own process.

1.5 set its state to:
pc: thread_set_exception_ports
x0: self_machThread (obtained through pthread_mach_thread_np)

2. use krw to write target/remote threads TRO into somewhere near our threads thread->kstack->sp (which i assume is where our threads original tro was)

tbh now i am confused, a better question -> how does remotecall set an exception port on a remote thread

[frank fossil]

it replaces thread_ro pointer in kernel stack while having krw hold a lock of dummyThread

Let's say you have 3 threads: main thread, setter thread, dummy thread
Main thread has krw hold lock of dummy thread, then spawn the setter thread calling thread_set_exception_ports(dummyThread) and wait a bit till setter thread hangs because of the lock. Then main thread gets the setter thread->kobject->kstack->sp and locate dummy thread's tro pointer in it, then replace it with victim thread's tro pointer.

to be clear, check out thread_set_exception_ports_internal src:

    tro = get_thread_ro(thread);
    thread_mtx_lock(thread);

[orchid fulcrum]

oh i see, makes sense

[frosty shore]

Ok

[orchid fulcrum]

im kinda conused if darksword can do physical read/write ?

the fork i have doesn't have dedicated functions for them, but CVE-2025-43520 analysis says it does physical rw as well

https://gist.github.com/Muirey03/8c8370258e32bafaf99e72ec90258c8d#:~:text=7. This is a TOCTOU. An attacker can remap the virtual address range so that the region is no longer physically contiguous after the first call to vm_map_get_upl%2C causing an OOBR/OOBW to physmem

[steady nest]

with darksword you're reading/writing to a physically contiguous page that may or may not belong to your process
the stable primitive is a virtual rw primitive with sockets

[sonic totem]

It’s relative physical r/w because it’s only out-of-bounds from the start of your mapping and you don’t know the base address of the mapping

But the actual OOB access is in the physical address memcpy

[steady nest]

it's at the offset you're at in the mapping, not only at the start :p

each mapping is like 128mb iirc

[sonic totem]

Oops yea

Good point

[tough pendant]

alfie

i have a suggestion

release apex

[lime slate]

I have a suggestion, let him finish reversing the stuff regarding to arm64e 17.3.1 and lower

[tough pendant]

i have a suggestion aswell

i want to use ape

x

[sonic totem]

Are you offering to finish it for me? Thank you so much 🙏

[lime slate]

I wish, they’d probably make it even more unstable

Honestly I’d love to see it done but I know it’ll be a while, you have higher priorities but I hope it doesn’t get tucked away and forgotten.

[tough pendant]

you dont know me son

im a professional jailbreak creator that knows every end of the kernel of the iOS

i literally have 30 ppl and pac exploits in my hand right now

i am the exploit god

do not challenge me

i will end you

[lime slate]

Yeah… sure keep talking your dad is also the ceo of discord right?

[void harbor]

I think he's joking bro

[lime slate]

I know

[tough pendant]

yes

john discord is my dad

you got a problem with that pal?

[vivid dew]

i hope someone dies and goes to hell today

[light owl]

@kind herald Bye bye 😁

[kind herald]

What?

[rocky oriole]

Might be a little fast sorry

Reminder to check your vibecoded apps you put on the appstore

[kind herald]

What ?

[rocky oriole]

Message sent before video

[kind herald]

Piracy

Mods

[rocky oriole]

No I didn't even tweak it

It's just like that

App is supposed to be limited to one domain for free, yet you can just search for the other domains and click on them fine

[kind herald]

MaxineRole icon, Administrators — 7:59 PM
Piracy
Mods

[rocky oriole]

Also discovered a capcut jailbreak "bypass" in the mean time while editing it

You can literally just use flex to move the pop up out of the way, but it breaks some things like anything that interacts with wifi directly (afaik)

[visual meadow]

its so fucking annoying to get rid of that

you have to clear the keychain for the app

and reinstall it

and make SURE nothing injects into it

[rocky oriole]

That would explain why hide jailbreak does nothing then

lol

[timid furnace]

1. there is no such thing, it's on provisioning profiles, not certificates
2. one of the following:
   a. Be grandfathered in
   b. Choose the 7 day validity option

have ancient dev account

2021

New Apple Developer Program memberships created after June 6, 2021, require development- and ad-hoc-signed apps for iOS, iPadOS, and tvOS to check in with the PPQ service when the app is first launched.

[elder scaffold]

rip

[quaint rain]

I’ve never had problems with CapCut

I’ve just been hiding Choicy

Last used the app literally yesterday

[visual meadow]

If you've been having choicy not load the tweaks then you wont notice anything lol

[rocky oriole]

Oh lmao

[primal wing]

Is there a way to check my account to see which side it's classified as? Something to check in the profiles, the keys, the online portal, etc? I don't remember the exact date so

[timid furnace]

create a profile

https://cdn.discordapp.com/attachments/779134930265309198/1333290680683859968/image.png?ex=69ece9f5&is=69eb9875&hm=ea99a64ce73ff9a3f3ebbb7f7b6901fdac1448cbd02706e43795e7cbbc3b5bcb&

afaik, the bottom should only show on accounts with PPQ enforced

[primal wing]

Ah. I don't see the bottom section on my portal. I guess that means I'm locked to paying apple essentially for life then. unfortunate

[timid furnace]

old screenshot so UI may have changed

[timid furnace]

rip

[primal wing]

indeed. What exactly does enforcing PPQ actually do, that actually matters? Ability to sideload decrypted app-store apps?

[elder scaffold]

I don't know what the situation is now, but I registered in 2019, didn't pay in 2023, and paid again in 2024, and PPQ check is still not enforced.

[lament mica]

Random question, does anyone know where these certificate icons are located on macOS? the ones that look like this:

[quaint rain]

Coreservices is my bet

[lime pivot]

/System/Library/CoreServices/CoreTypes.bundle

[quaint rain]

@lime pivot do you know where MacOS checks for the city name on About This Mac?

[grim sparrow]

it displays a city name?

[rocky oriole]

I think he means like "Tahoe 26.1"

yes

[quaint rain]

as in the marketing term

Big Sur, Ventura, Somona, Sequioa, Tahoe, etc

[grim sparrow]

ooooohhhhhhhhh

[quaint rain]

i was a bit unclear

i cant find it anywhere 😭

[grim sparrow]

i swear ive seen it somewhere

[quaint rain]

the closest i found was like the about urls

and ofc the version number in coreservices or whatever

[grim sparrow]

not sure why I ran this as 2 commands, but im genuinely intrigued now

[quaint rain]

i thought about changing it to macos weed for funny hahas but now im way too invested in where that damn string is at

SystemVersion.plist for example has the version numbers and copyright year, however no marketing version name

[grim sparrow]

tried looking in how About this Mac works

it literally just makes an xpc client to "com.apple.systemprofiler" with the message "showAboutThisMac"

[quaint rain]

I noticed it was basically just system profiler under the hood too, you can tell on activity monitor

this is the open files and ports on it according to activity monitor

/System/Library/CoreServices/SystemVersion.bundle/English.lproj/SystemVersion.strings just reads bplist00”

WVersionUBuild_FullVersionString_Version %@ (Build %@)1������

����������������������I

The sibling plist to the systemversion bundle once again only has version number and build number

As far as i can see AppleSystemInfo.framework only has shit for processors and model names

@grim sparrow anything new or nah?

[grim sparrow]

No

😭

[quaint rain]

Where the fuck can this single word be 😭

[timid furnace]

@grim sparrow @quaint rain

NSString* +[SystemDesktopAppearance OSName](id a1, SEL a2)
{
  NSString* v2 = _OSVersion();
  if ([v2 hasPrefix:@"26."]) {
    return @"macOS Tahoe";
  } else {
    return [@"macOS" stringByAppendingFormat:@" %@", [v2 substringWithRange:NSMakeRange(0, 2)]];
  }
}

higher level code strips out the macOS prefix

enjoy this absolutely useless information

[quaint rain]

Where is this located? I already checked the SystemDesktopAppearance framework in /System/Library/PrivateFrameworks before and didnt fine anything

[timid furnace]

it's in the framework

[indigo peak]

the binary is in the dsc

[timid furnace]

well yea

i hope they knew that

not going to get far in *OS RE otherwise

dsc worst invention in human history

[quaint rain]

which means would have to decompile it and shit even at the thought of changing it

[quaint rain]

Fuck it, going to see if i can extract edit, and resign it

its 1 (one) word

[lime pivot]

maybe it's not a thing any more or maybe it's #if'd out to only early beta builds, but the name can also be determined by an http request

at least a few times on the initial WWDC beta 1 build, for a few hours the about screen only displayed a version number. later on, the name appears

I remember disassembling this code a long time ago

[timid furnace]

[grim sparrow]

Bless

[hasty ruin]

imagine they did this for visionOS and it switched from xrOS to visionOS during the keynote

[lime pivot]

seems like that was so last minute they didn't even have time to throw in something like this

how did it even get so close with such a terrible name

[hasty ruin]

guess they were too busy failing with apple intelligence

[timid furnace]

26.0? or older macOS?

i'm really curious about this now

[lime pivot]

older is when I saw it. I don't know if it still happens

when I say older, I looked at it around macOS 10.12

but I'm pretty sure I've seen it fetch the brand name for years since then. just don't know about recently

[timid furnace]

ohhhhhhhhhhhhhhh

[lime pivot]

it shows the name as just "macOS", and then after a few seconds it finally shows "macOS" + brand name

[timid furnace]

yea that's not relevant anymore

i looked into this a while back when trying to figure out all of the system profiler apis

[floral notch]

https://iphonedevwiki.net turned into moltbook lol

https://community.iphonedevwiki.net/

looks like dhowett lost control sometime between may 2020 and march 2022

[hasty ruin]

@lime pivot probably knows a more precise time

[lime pivot]

cynder took it over from him a few years ago, losing the domain was a lot more recent. sometime last year I think

but even then, I recall he nuked the server before cyn had a chance to properly pull everything

I'm considering it very lucky we grabbed everything from devwiki and put it on applewiki, but we trampled on what cyn was trying to do in taking over devwiki and I regret that

[lean ermine]

anyone know kernel offsets for hypervisor

[tepid nacelle]

stop making fortnite cheats

noob

[lean ermine]

true...

[pearl sail]

Anti-cheats hate it when you hook hyper-v

[shut cedar]

good night jailbreak nation

[crisp frost]

gm

[shut cedar]

what are your thoughts regarding Nix

[harsh junco]

I want to try it, looks good on paper

[shut cedar]

exactly, on paper

are you a tinkerer? do you value your time?

[harsh junco]

I don’t think im autistic enough nor do i have enough free time to write nix cfgs

[shut cedar]

do you have an idea about how it works? aware of devshells? flakes? home-mananger? nix-darwin?

[harsh junco]

Brother. What.

[shut cedar]

fr

correct opinion

well if you try it out some day don't try using the useless abstractions like home-manager stick to flakes

maybe the occasional devshell or nixpkgs override in your system flake for a package that's out of date like limd suite or utm's qemu fork

so much easier and less complex to just copy over your dotfiles and only use nix the way I do

[harsh junco]

ostree on the other hand….

[shut cedar]

I should try guix next in a vm

[cloud yacht]

I think nix would be real neat if I commonly used multiple machines so I could keep my setup in sync for all of them

[gentle grove]

Damn shulkk did not like nixos

[gentle grove]

In the future I might use nixos for my server PCs to make them kubernetes nodes but time will see

[shut cedar]

Too complex

And the 3rd-party abstractions like using Neovim as a Nix module can be buggy

[rocky oriole]

Anyone know about any free network request loggers for ios

FLEX isn't working for me for some reason

[cloud yacht]

Mitm proxy

[native dune]

webproxytool

[thorn hound]

yea

not telling

[shut cedar]

so then don't mention it

[shut cedar]

https://github.com/nix-community/nixvim

[quaint rain]

Why are you trying to get free McDonald’s points

[rocky oriole]

It is not that

I'll explain later kinda busy rn

[shut cedar]

@harsh junco i would only realistically suggest someone to use nix if
a) macports and homebrew on macOS aren't cutting it
b) you have a desktop/server that has some computational power (if tight on resources try Alpine Linux)
c) you have adhd (don't value your time), autism, or ocd (you value excessive containerization and abstractions)

remember to run nix-collect-garbage when you remember it exists

[magic karma]

real

i dont get the point

tbh

[primal wing]

so now that it is expired, there is literally no other known way to block these ota updates? i'd be fine supervising my own device but i remember that only delayed them by like 90 days, and i have not updated in a year, so pretty sure i am far past that. would do almost anything by this point tbh. ye old dns proxy isn't so great for me because i kind of want to actually use a real dns proxy - and ios does not allow you to use both at the same time, it can be pretty annoying sometimes

[indigo kraken]

https://x.com/MasterMike88/status/2050221978313744810

Michael (@MasterMike88)

Some quick things of note:
- You may need to toggle WiFi/Cellular off, reboot, then toggle them back on before the profile starts to work (I will add this to guide later, but I work shortly so not now)
- It appears I forgot that people use the app of this platform instead of the

X · May 1, 2026, 2:33 PM

[velvet path]

iOS allows you to have more than one DNS profile enabled at once

[visual meadow]

you can replicate the effect the old ota profile had by doing:

defaults write com.apple.MobileAsset MobileAssetAssetAudience 0fded8f8-415e-4dd2-8924-02fd0fcd4f74
killall softwareupdated -9```

[tribal path]

There's many, many ways of blocking updates in 2026 and you're not lacking options
If you're on a jailbroken device OTADisabler is the easiest way possible. It does the exact equivalent of just writing to com.apple.MobileAsset's preferences.
Besides that, you can do it with backup modification (Either disabling softwareupdated entirely, or writing to com.apple.MobileAsset's preferences as seen above)

The tvOS profile has really never been the actual best way of blocking updates and I never liked using it

[shut cedar]

did anyone ever figure out what happened to JTV

[primal wing]

iphone, not mac

[tribal path]

that will work on an iPhone if it's jailbroken

[tribal path]

Disappeared from the face of the Earth

[primal wing]

ain't no jailbreak on ios 18 my g

[tribal path]

humble iPad 7

[tribal path]

just use nugget then

[primal wing]

true, but sadly the MDM dns profiles only support DNS-over-tls or dns-over-https - without any ability to use ye old standard DNS over port 53, so sadly a dns profile cannot help for this dns server. only a dns proxy, through a custom app with code, can achieve standard DNS:53

(the opposite side of the problem is, the majority of network routing (including safari browsing and the OTA updater), route through public DNS first, and only fallback to a dns proxy app if the system doesn't find it. which sadly means that this app proxy cannot accomplish blocking DNS to the OTA update server)

pretty frustrating double-sided problem from apple

[primal wing]

1. not seeing any documentation on blocking OTA updates
2. either way, it says its gestalt spoofer only works to 18.1, that's not me

[tribal path]

It can block OTA updates and supports blocking OTA updates up to 26.5 still

I believe it has two ways of actually doing it
One completely disables softwareupdated, the other will just write the plist like the profile did and like OTADisabler does

[primal wing]

sounds like the better option is backup modifier

[tribal path]

that's what nugget does yes

[primal wing]

i don't suppose there's some writeup on how to modify the backup myself? if not then i guess i can just comb through its src

if i overwrite that plist key, does that also hide the red 1 badge? or just stop softwareupdated from doing stuff?

[tribal path]

Modifying backups isn't an impossible task
You'd have to take an unencrypted backup of your device first, and there's a writeup going into more detail about how the backup system and domains and such work

https://gist.github.com/leminlimez/c602c067349140fe979410ef69d39c28

[tribal path]

Nothing does anything about that to my knowledge

[primal wing]

badge whatever, as long as i'm safe from apple, then i can live

if i bootloop doing this, can i blame somebody? tim perhaps?

[frank fossil]

why not just use some darksword sandbox escape? if can

[shell wigeon]

In older versions of iOS, this badge and the table cell in Settings come from the corefollowupd/CoreFollowup.framework. I was able to permanently hide the these on my jailbroken iOS 14 device by killing that daemon permanently. The same is probably true on iOS 18 using nugget to disable the daemon. I need to investigate this at some point.

[tribal path]

That's a different way of doing it than I was originally going to look into

There's a file at /var/mobile/Library/CoreFollowUp/items.db and deleting it makes everything go away

I need to actually test this though first

[shell wigeon]

That works too, at least on older iOS. I'm not sure the easiest way to do this on un-jailbroken iOS 18. CoreFollowUp is such an evil framework, it does all the marketing "try Apple Music for 3 months" spam too.

[shell wigeon]

I was able to remove the badge on an un-jailbroken iOS 18 device by setting the date to April 2026, re-installing the old AppleSeed profile, disabling the DNS profile, checking for updates to clear CoreFollowUp, re-enabling the DNS profile and removing the AppleSeed profile, then restarting again. Phew.

[surreal tusk]

yo anyone was able to fix this issue? https://github.com/ProcursusTeam/Procursus/issues/1427

it's been 3years 🤣

[indigo kraken]

this is what I’ve been doing

1. install TrustEvaluator https://github.com/dlevi309/TrustEvaluator
2. remove the signature from an old OTA profile (and the removal date, etc) https://haste.zneix.eu/busimygogi
3. install the profile (and remove TrustEvaluator if you want) then you can checking for update will remove the badge, the profile doesn’t have a removal date

[primal wing]

interesting, is this closer to installing a tvos profile, or to install an profile that can edit preferences to write the usual MobileAsset prefs key?

and the more important question......do installed profiles survive restoring itunes backups?

[tribal path]

why do this if you can just jailbreak and use OTADisabler?

[primal wing]

and @tribal path i have nugget up now, just the Disable OTA toggle under daemons?

[tribal path]

yeah

[primal wing]

any other useful/cool keys i should try too?

what does Enable Lock Screen Clock Animation do exactly anyway

i suppose hiding the annoying VPN icon in the status bar would be nice too

[tribal path]

It does this effect for the Lock Screen clock when the time changes iirc https://sarunw.com/images/animating-number-changes-in-swiftui-new.gif

[primal wing]

lol

[native dune]

isnt that default

[primal wing]

no

[tribal path]

I don't think so no

[primal wing]

damn a minecraft chest wallpaper too

[native dune]

oh its a weird animation

like fades but not

[primal wing]

@tribal path do i have to touch mobilegestalt at all, and/or provide a gestalt file, even if i'm not using anything in that section?

[tribal path]

you dont have to, no

for both

[primal wing]

what's Enable Internal Storage anyway

[tribal path]

I have no clue

[primal wing]

ah yes, i can force my device to be an apple-store demo model. lovely

[primal wing]

ok, i turned off find my....gonna have nugget restore it now.....i ain't gonna bootloop right? ios 18.6.2 iphone 14 series

[tribal path]

You shouldn't bootloop whatsoever especially since you aren't touching MobileGestalt

[light owl]

shows more details about the storage used on your phone

[primal wing]

ok, rebooted

yay software update is sent to hell

now i just have to either figure out a way to remove the icon badge, or just suffer and live with it

[tribal path]

When I stop procrastinating it'll be figured out

[primal wing]

amazing, really thank you for looking into it. just make aaron put something in announcements or just ping me anywhere or whatever if you ever figure it out?

@tribal path oh no ios 15 support on nugget?

[tribal path]

I don't think 15 is really supported no

[primal wing]

sad, i suppose my alt device can just use a dns profile since i dont ever use real dns connections on those anyway

[rocky oriole]

Ignore the fact that I have -132mb of system data (I have no idea how but it's accurate iirc, also the apps counter next to the storage is from
a separate tweak)

This is just for ios 16 though idk how else it applies on newer versions

[primal wing]

interesting. though you should be in jail for a font like that

[rocky oriole]

Hey I used to have comic sans as my font

In the misaka days of jailbreaking

[primal wing]

change it to LastResort and you can stay

[rocky oriole]

nvm

[primal wing]

lastresort is the super old font used by apple when the standard english fonts are missing. it's basically unreadable egyptian hieroglyphics

[rocky oriole]

oh

:/

What if last resort is missing

[primal wing]

https://boingboing.net/2020/08/17/lastresort-the-macs-weirdes.html

[tribal path]

It just shows question marks

[primal wing]

excellent question

[tribal path]

It also spams tf out of the syslog

[rocky oriole]

I had assumed that was part of last resort

What if that is also missing

[tribal path]

It's somehow not

[primal wing]

is that OTADisabler tweak on a repo?

[tribal path]

[[OTADisabler]] yes

[faint lion]

OTADisabler

Disable OTA and remove badges on home screen, etc.

Author

ichitaso

Version

0.6

Price

Free

Repo

ichitaso repository

Bundle ID

com.ichitaso.otadisabler

Powered by Canister · May 3, 2026, 12:43 AM

[primal wing]

is it literally just defaults write

[tribal path]

I mean technically no but the effect is identical

[primal wing]

i'll just defaults write for my jailbroken device then

what is that uuid? does that correspond to something, like to the old tvos profile? or can i just use any random UUID?

[tribal path]

It probably corresponds to a tvOS beta

[primal wing]

ugh, i had the old OTA DNS profile installed before i ran nugget, and now afterwards, it won't let me remove that profile. any way to force remove it?

it shows up in the list in Settings > Device Management > DNS, but the typical menu to remove it is entirely missing. if i connect to apple configurator 2, also doesn't show up in the list. if i reinstall the same profile, it just adds it as a duplicate profile, hm

[fringe cove]

erase all content

[tribal path]

I had
And by had I mean still have. This issue, on my main phone at that. It could almost definitely be fixed with more backup modification, but I just don't really know WHERE and my phone isn't vulnerable to DarkSword so it isn't really easy to go and search to look around for it.

[primal wing]

so i'll have to erase all content to get rid of it?

or maybe erase all settings

at the least it'd be easy to put a note in the app directions or whatever saying remove your profiles before running, would save some headaches

[tribal path]

No
If it's a DNS profile you can just change DNS to Automatic and it'll be the same as disabling it

A way of completely removing it is almost definitely doable but just hasn't been done yet. I'd imagine it truthfully could be at /private/var/preferences/com.apple.networkextension.plist but that file being completely removed would probably be problematic.

[frank fossil]

maybe something to do with skip setup wiping Library/ConfigurationProfiles/CloudConfigurationDetails.plist

[primal wing]

i mean i guess i can just take itunes backup, erase, restore backup, maybe then i can figure out if profiles survive backups

[primal wing]

yeah that seems likely

[tribal path]

Profiles do survive backups

[tribal path]

That checks out yeah

[primal wing]

should i have unchecked skip setup?

[tribal path]

I've had the same DNS profile just sit on my phone for legitimately maybe 3 years across multiple iPhones at this point

I just haven't cared enough to remove it

[primal wing]

i don't have that much junk on my phone, it's just annoying having to re-setup everythiing, takes a few hours

i mean do profiles survive icloud backups?

seems less likely?

[tribal path]

Yes

[primal wing]

man

stupid apple

[frank fossil]

my guess is it's saved to some db

im gonna grep the entire /var to see

[primal wing]

i had hoped installing the exact same profile, uuid and all, would just make it overwrite the db entry wherever it is

[tribal path]

I assume it's here as I stated since that's where DNS profiles end up installing their preferences to

[primal wing]

unfortunately it doesn't work

[tribal path]

I don't know if deleting that file is safe or not, nor do I know how it would be stored in terms of backup domains

[frank fossil]

/var/preferences/com.apple.networkextension.plist

[primal wing]

ah yes network extensions

what

[indigo kraken]

OTADisabler hooks the Preferences app, the method I just mentioned works while unjailbroken and the profile never expires or removed (unless you do it manually)

[indigo kraken]

53 gigabytes of TikTok? do you not have iCleaner installed? all that used storage is probably a buildup of app caches

okay yeah I just noticed the 3rd pic with 2 gigs of CrashReporter storage. Use iCleaner, it’ll probably free up a 100 gigs lol

[light owl]

its 5.3 gb

theres a decimal there but the font is ass so you cant really see it at a quick glance

[pearl sail]

fr

[rocky oriole]

I do but

it crashes for some reason and I have no idea why because there is no log generated

Probably something to do with my environment being fucked considering I have now -150mb of system data and opa also told me to reinstall my whole jailbreak environment on a seperate issue

[indigo kraken]

@rocky oriole run these commands in a shell and see if it fixes it

rm /var/mobile/Library/Preferences/com.ivanobilenchi.icleaner.plist
ln -s /var/jb/var/root/Library/Preferences/com.ivanobilenchi.icleaner.plist /var/mobile/Library/Preferences/com.ivanobilenchi.icleaner.plist

as root

[obtuse hornet]

Do y’all think I can modify /var/preferences/com.apple.networkextension.plist to block/unblock a site without having to go through the manual profile install process?

Or at least install a profile that blocks the site once and then enabling/disabling that profile using the plist

[frank fossil]

that’s what the DNS-based OTA blocker profile can do.

[frank fossil]

(ignore duplicated entries, I’m having the same issue as this)

[obtuse hornet]

i know, but can i enable/disable these profiles without having to go into settings simply by modifying com.apple.networkextension.plist on runtime?

[rocky oriole]

thanks, but it didn't work

[indigo kraken]

what’s the actual problem? specifically that separate issue you mentioned

[tribal path]

I'd suspect you could
I might have to look into if the file gets modified when toggling profiles or not

[rocky oriole]

icleaner crashes on launch with no crashlog generated, that seperate issue is that newterm doesn't work at all but ssh and mterm do

#dopamine message

[obtuse hornet]

i dont have a single jailbroken phone 😭

cant monitor this kind of shit that easily without jb unfortunately

[worldly pasture]

does anyone know where sideload related data is stored by the ios system >17.0? i've been digging around and even jailed, darksword's read/write can be used to modify files to loosen sideloading restrictions...

/var/db/MobileIdentityData seems to be blacklists from apple and can be cleared, is there any place that tracks the expiry date of certificates?

i dont have a mac but it'd be cool if i could write an app that uses darksword's r/w abilities to help people modify system files, beyond just a file explorer like filzajailedds

(pls ping if replying)

[obtuse hornet]

thats embedded into the cert

cryptographically secure

[worldly pasture]

ah i see

[frank fossil]

mis.db in profiles table

If you're familiar enough with sql, you know what you can do to prevent the record from being deleted

[crisp frost]

[visual meadow]

anyone know why when i hit an ios notification on my mac it just opens quick look simulator

like the ios app running on my mac not iphone mirroring

[visual meadow]

ended up making a tweak to rewrite the path to the main app bundle from whatever appex it tries to open

[floral notch]

i see. better than it getting deleted. thank you for your service

[lime pivot]

even if most of this is incredibly out of date, it's still far better to have it easily accessible than not

honestly wish I could get paid to do nothing but update the wiki

[shell wigeon]

Following up on this. I modified Nugget to disable followupd. That gets rid of the banners/nags inside of the Settings app (the ones that show up a few seconds after you launch settings, as Settings will query CoreFollowup after launch). However, it's not getting rid of the Settings icon badge, as that seems to come from elsewhere in the Settings code.

It's a partial win, as that will also get rid of the "non-genuine battery" messages and other Apple BS.

[floral notch]

are there any gotchas when trying to hook SpringBoard w/ opainject? im able to hook mediaserverd and appstore apps. but when i try to inject SpringBoard, it restarts

iPhone X, iOS 16.7.10, palera1n 2.2.1

heres the opainject output, ill pull up the syslog later

mediaserverd: https://gist.githubusercontent.com/rweichler/246dd00621c5ac11f219f48f5932afef/raw/da00f36dfeab7f05f17cff8c664707ffe7556875/gistfile1.txt
SpringBoard: https://gist.githubusercontent.com/rweichler/7663828b51a25370aca40df595ccde93/raw/55277534cf3fc54b9d8b9bcc75654899c33a3f10/gistfile1.txt
Spotify: https://gist.githubusercontent.com/rweichler/2ab1527ac0b0f29da1d76bac699d848c/raw/ebf022d29a463be4d565b28b2fd03bcd7baa596a/gistfile1.txt

[wooden yarrow]

tried https://github.com/opa334/opainject/issues/2#issuecomment-1601572642 ?

[floral notch]

ty. added that entitlement and didnt seem to make a difference: https://gist.githubusercontent.com/rweichler/348dbb3781c38ed399addccbbbc9c4e2/raw/db583c314668c8ea08a25849ffb475c0de71a518/gistfile1.txt

worst-case scenario, i can just special-case SpringBoard and hook it with ellekit

[naive kraken]

SpringBoard crash log?

[naive kraken]

that entitlement is already a thing?

[floral notch]

crash stopped to repro after i installed ws.hbang.common and com.muirey03.cr4shed

from /var/mobile/Library/Logs/CrashReporter:

ah ok its reproing again, 10 times in a row

at least it sometimes works

[naive kraken]

That looks like your dylib is causing a deadlock

[floral notch]

you are 100% correct

1000%

ty

i was wondering why it was taking forever to hook

blocked for like 10 seconds

i stubbed it and now its instant

[floral notch]

alright i stubbed pretty much everything and it still crashes

it sometimes works randomly but i cant find a pattern

at least now it doesn't block for 10 seconds

[naive kraken]

I would recommend creating a new detached pthread in the constructor and doing anything in that thread

[floral notch]

EXC_CRASH SIGILL

"mach_msg2_internal"
"mach_msg_overwrite"
"mach_msg"
"__CFRunLoopServiceMachPort"
"__CFRunLoopRun"
"CFRunLoopRunSpecific"
"GSEventRunModal"
"-[UIApplication _run]"
"UIApplicationMain"
"SBSystemAppMain"
"start"

constructor is empty

__attribute__((__constructor__)) static void _MSInitialize()
{
#if 0
    char serviceName[4096];
    sprintf(serviceName, "pidproxy%d", getpid());
    ttStartProxy(serviceName, runLuaCode);
#endif
}

ok im able to consistently repro now. lemme narrow it down

[floral notch]

ill come back to this later

[shell wigeon]

Anybody know if there are any unintended side-effects of deleting Library/FrontBoard/applicationState.db? I'm working with a Nugget fork to try to disable the Software Update badging after you apply the blockota mobileprofile on a non-jailbroken device. I got followupd disabled, but that kept the badge on Settings. If I nuke applicationState.db, it resets the badge and everything Just Works™. But I'm not sure if there's actually anything important kept in that file.

[verbal pebble]

how do i get libkwr on ios12 with checkra1n?

does procursus just not support ios 12 anymore

[tribal path]

checkra1n doesn't use Procursus

[velvet path]

is that even needed as a package on checkm8 environment or below iOS 14 anyways

[verbal pebble]

theres a bunch of broken repos and im like in a mix apt state between iphoneos-arm64 and arm

i might try fix shit with Odysseyra1n

[velvet path]

did you strap over a Chimera setup

or whatever

[tribal path]

On checkra1n not really since it has a tfp0 patch of course

Other than trying to maybe use something that depends on libkrw or trying to develop something for not-checkra1n jailbreaks

[verbal pebble]

noh i just used checkra1n

[tribal path]

You shouldn't be? You're on iOS 12 which is very much so rootful, there should be nothing iphoneos-arm64 at all on the system

[verbal pebble]

fah

[velvet path]

personal opinion here: any reason you’re not using Chimera(/TNSv2) instead of - just seems like you’re putting extra effort on yourself

[verbal pebble]

im tryna load my kernel patches

[tribal path]

What kernel patches do you even need that checkra1n doesn't already have?

[verbal pebble]

im just changing two functions inside AppleBCMWLANBusInterfacePCIe before the patch the broadcom driver checks if the firmware hash verification returned a good result in X19. If X19 0 it fails and rejects my firmware patch if its is nonzero it has success

im tryna load my kernel patch to let my broadcom driver patch load

i got it installed my apt was just fukt

i just realised im gona have to compile on the phone against the library

[verbal pebble]

Does checkra1ns tfp0 usually allow mach_vm_write to __TEXT_EXEC or is AMCC blocking it
the panic ESR was 0x9600004f (unexpected fault in kernel static region) when i was writing via libkrw and 0x96000006 (permission fault) when i used mach_vm_protect + mach_vm_write directly
im on iPhone 6, T7000/A8, checkra1n iOS 12.5.7 idek if pongoOS bypasses kernelcache signature verification on T7000 to let me replace the kernelcache on disk with a patched one

theres like nowhere with this information 😔

gota make an ios wiki

lmao sigmah

[verbal pebble]

forgor to compress kernelcache befor reboot

[shut cedar]

💔 🫡

Thank you for being a Binary Ninja customer. Unfortunately, your Binary Ninja support will expire in 5 days. If you wish to continue to receive support and updates, you will need to renew via the following renewal link:

https://binary.ninja/renew/?serial=69420694206942069420

You will only be able to renew your license for up to 30 days after your support ends. If you miss this renewal period, you will need to purchase a new license and will not be eligible for the renewal pricing.

Please note that you will only receive three of these notifications: 60 days, 30 days, and 5 days before your support expires. If you do not renew your support, you may continue to use the last version of Binary Ninja and you can download old stable installers from the Binary Ninja Portal (https://portal.binary.ninja). However, you will lose access to the following:

 - Development Channel Updates
 - Support requests
 - Installers for versions released after your support ended

If you purchased your license through a reseller, forward this email to them. They can use the included renewal link and you will receive the updated license and download links while they will receive the purchase receipt (if they use their email address during checkout).

If you have multiple licenses, note that this renewal link will only renew the support associated with this serial number (your license file has information about which serial is associated with which product). If you wish to combine licenses or make any other changes, contact support at https://binary.ninja/support

If you purchased your license on a student discount, you will need to re-apply for the student discount on the renewal to receive discount pricing. Please see the student discount FAQ entry on our site for more details: https://binary.ninja/faq/#student-discount

--
Vector 35
https://binary.ninja/

[sonic totem]

No checkra1n does not disable KTRR

Oh wait this is T7000

Well the kernel is all mapped as R-X for starters, hence your panic, and the KPP will stop you patching it anyway

Do you patches inside PongoOS, that will work

[steady nest]

yea you need to flip pte to rw

and disable KPP if you want to do it from booted OS

xnu spy has code for this

[sonic totem]

Yeah

But probs easier to just do it from Pongo

[floral notch]

aight so i can repro the crash like this:

#include <netdb.h>

void lolwut()
{
    struct addrinfo hints = {0};
}

or this:

#include <netdb.h>
#include <string.h>

void lolwut()
{
    struct addrinfo hints;
    memset(&hints, 0, sizeof(hints));
}

this does not crash:

#include <netdb.h>

void lolwut()
{
    struct addrinfo hints;
}

im not even calling this function, the mere existence of that function causes the crash
also that entitlement from the github issue made no difference

[floral notch]

very strange... im just gonna special-case SpringBoard and use ellekit

[obtuse hornet]

oh wierd

Termination Reason: SIGNAL 4 Illegal instruction: 4

are you on arm64?

[floral notch]

iPhone X, iOS 16.7.10, palera1n 2.2.1

[sonic totem]

Honestly just check the assembly

Match it up with the crashlog

[floral notch]

im prolly just gonna give up tbh sry, i already burned too much time on this

special casing with ellekit isnt too bad

[sonic totem]

If you wanna drop a dylib I’m happy to have a look, but nws if not

[floral notch]

depends on a launchdaemon

ill upload that l8r

if needed

sorry that one is no repro

i think that repros but i cant test rn

[umbral vessel]

i asked this in #general earlier, but i got no response

i'm trying to add my cydia repo to my iphone 7. it's jailbroken using odysseyra1n and it runs ios 13.1.3
on sileo, when i add it/refresh sources it gives me this, a dpkgarchitecture error. i've heard this is relating to rootless/rootful jailbreaks
it doesn't have any rootless tweaks
on zebra it doesn't show anything but adds the repo with no errors
on cydia it seems to work just fine

how can i fix this?

[tribal path]

Is your repo's Release file specifying Architectures: iphoneos-arm?

It very probably is relating to rootless/rootful jailbreaks

[hasty ruin]

The issue is that this line contains a comma ^

they’re supposed to be space separated, not comma separated

[umbral vessel]

this might be it

because i think they're seperated by commas

[tribal path]

I didn't even think to actually go and check the repo

[hasty ruin]

yeah you have iphoneos-arm, iphoneos-arm64

[umbral vessel]

i do

[rocky oriole]

Yeah that's it I also just checked

[umbral vessel]

just delete the comma and then commit

?

[hasty ruin]

Yes

[umbral vessel]

okay thanks

[hasty ruin]

Np

[tribal path]

(if you don't have any rootless tweaks you don't need to include iphoneos-arm64)

[umbral vessel]

i probably will make a rootless version

[tribal path]

ok then yeah keep it

[umbral vessel]

okay yeah ipad 7 isn’t showing any tweaks but iphone 7 is

[rocky oriole]

cuz you don't have any rootless tweaks

[umbral vessel]

that’s what i was about to say

[rocky oriole]

also you have two debs but only one in /packages

[umbral vessel]

need to edit that too

so everything shows up properly

[umbral vessel]

packages.bz2?

[rocky oriole]

no

https://github.com/penn76/penn76.github.io/blob/main/cydia/packages

[umbral vessel]

what does packages.bz2 do anyways

are they just the same thing

[rocky oriole]

pretty sure that is just an archvie of all of your deb files?

[umbral vessel]

because i added the other packages file myself

[rocky oriole]

idk i haven't touched my repo in like 20 years

[umbral vessel]

wait do i only need to include the filename in the releases file?

[floral notch]

im speculating here, so dont quote me on this, but i think debian made their package manager before it was common for http servers to support the header Accept-Encoding: gzip

i dont see any other reason why

apt was released in 1999, apache added gzip in 2002

[verbal pebble]

bro fah

[verbal pebble]

thx

im just tryna unbrick my phone rn bc my dumahh tried to load kernel patch from the disk that was twice the size of what it shuld have been

???

crayz lol

I'm tryna find a way to restore/update with 12.5.7 ispw even though its unsigned

imazing is giving me problems bc im on sonoma

[velvet path]

if you have blobs just use Legacy iOS Kit

[velvet path]

!t bluetool

[faint lion]

Hey @verbal pebble, have a look at this!

bluetool

The Windows version of 3uTools exhibits spyware like behavior and thus we do not recommend it and have it filtered. Sandbox analysis and third-party reports show excessive system and browser data collection, firewall and registry modification, sandbox detection, server communication that you can't block, and the use of modified or pirated jailbreaks/tweaks. For an iOS device management tool, this is should not be needed whatsoever. For evidence and technical details, see the attached document.

Added by bradleytechman | Used 51 times · Dec 21, 2025, 6:22 AM

[verbal pebble]

i forgot to get the blobs 💀

[verbal pebble]

ah

[velvet path]

you can dump onboard with ssh ramdisk

[verbal pebble]

W

[verbal pebble]

everytime i reboot its stuck in recovery i think bc i forgot to LZSS compress kernel before loading it

it might be over 😔

[velvet path]

ssh ramdisk doesn't need the device to normally boot

[verbal pebble]

ohh

shiett W

thx gng

[velvet path]

https://github.com/LukeZGD/Legacy-iOS-Kit/wiki/How-to-Use for reference

[verbal pebble]

lol ya i downloading

u guys r crayz

big brain community

[sonic totem]

No the issue is you replaced the on-disk kernelcache

You can’t do that

[tough pendant]

would legacy kit work on arm? im installing ubuntu on windows phone and i wonder if it would work

[hasty ruin]

[light owl]

Answer the question i craze

[hasty ruin]

do i look like Mineek

I don’t do legacy

[light owl]

@crisp frost Will legacy ios kit work on arm

On windows phone

[crisp frost]

it works on arm but idk about windows phone

there's likely a ton of others reasons why it wouldnt work

usb limitations come to mind

[hasty ruin]

yeah that’s what I was thinking

you could prob get another iOS device to run it tho

[rocky oriole]

yes on arm but like mineek said there's gonna be a bunch of things that are not working

[tough pendant]

what

[rocky oriole]

typo

[tough pendant]

ohhhh

ok

usb apparently works when you use LumiaWOA to flash linu

x

[rocky oriole]

[floral notch]

(deleted a bunch of messages that i was wrong about)

ok im able to consistently repro / no-repro with these two debs:

https://eqe.fm/static/bf0ee5a665-repro.deb
https://eqe.fm/static/0afb27b16c-norepro.deb

sending deb instead of just the dylib because the dylib relies on a LaunchDaemon

this is what i used to repro:

eqe_opainject "$(ps aux | grep Spring | grep Board | awk '{print $2}')" /var/jb/Library/MobileSubstrate/DynamicLibraries/com.r333d.eqe.lucy.dylib

eqe_opainject is the exact same as upstream 849bb296

@sonic totem

[floral notch]

just incase ur curious i dont need it fixed

[floral notch]

i love tailscale

wish this shit existed 10 years ago man would have changed the whole game

[lime pivot]

with all the networking crap I run tailscale is such a blessing

[cloud yacht]

Tailscale is how my proxmox doesn't make me lose my sanity, especially when I was running it at the uni

[ocean raptor]

Tailscale is great

[faint timber]

^

[grim sparrow]

Cameron in chat

[manic forum]

nah man i expose all of my services directly to the internet for everyone to connect

it makes things more interesting and exciting

(my server is a part of at least 7 botnets, probably)

[gentle grove]

write your own wireguard config

[native dune]

mid

[brazen timber]

fr

[ocean raptor]

si

[shut cedar]

how is httpd like to config

i want to switch over from caddy for SlowCGI

[ocean raptor]

Idk, I fumbled along to set it up once and promptly forgot

Im a sysadmin for work, so I don’t really enjoy doing it at home anymore

[gentle grove]

Couldn't you just use it with caddy if you don't want to switch? It sounds like it just speaks fastcgi

[radiant crater]

Do u guys use bindiff

[harsh junco]

there is also diaphora for ida

[verbal pebble]

lol ya it looks good

[shut cedar]

'ts the only one i got working

highly recommend it

[kind herald]

man

@shut stag @shut stag @shut stag @shut stag

@shut stag @shut stag @shut stag @shut stag

fix it

fix your bot

@shut stag

claude go

https://media.discordapp.net/attachments/1279378646347415615/1501768038611947600/Untitled.jpg?ex=69fd45f9&is=69fbf479&hm=efffa6eab0a18176d5faff44ca6a05efda8a0302917cc9cafb99853e9bb89d41&=&format=webp&width=520&height=694 https://media.discordapp.net/attachments/1279378646347415615/1501768038935167026/Untitled.jpg?ex=69fd45f9&is=69fbf479&hm=8250b89bc45d900c32931a36c486f02145395eaa6649a9dc782b506ec3b13ee2&=&format=webp&width=520&height=694 https://media.discordapp.net/attachments/1279378646347415615/1501768039237160960/Untitled.jpg?ex=69fd45fa&is=69fbf47a&hm=9e40db5cf4e9f3693f5402545b17d1da14768c332732bea687667839294e1549&=&format=webp&width=520&height=694 https://media.discordapp.net/attachments/1279378646347415615/1501768039467585626/Untitled.jpg?ex=69fd45fa&is=69fbf47a&hm=4cd7ac00aaa213a21bad735c54f4824cd619ce7cd30b2b0c3545f57752860ac8&=&format=webp&width=643&height=481 WOuNWdtV

[gentle grove]

@kind herald https://media.discordapp.net/attachments/1279378646347415615/1501768038611947600/Untitled.jpg?ex=69fd45f9&is=69fbf479&hm=efffa6eab0a18176d5faff44ca6a05efda8a0302917cc9cafb99853e9bb89d41&=&format=webp&width=520&height=694 https://media.discordapp.net/attachments/1279378646347415615/1501768038935167026/Untitled.jpg?ex=69fd45f9&is=69fbf479&hm=8250b89bc45d900c32931a36c486f02145395eaa6649a9dc782b506ec3b13ee2&=&format=webp&width=520&height=694 https://media.discordapp.net/attachments/1279378646347415615/1501768039237160960/Untitled.jpg?ex=69fd45fa&is=69fbf47a&hm=9e40db5cf4e9f3693f5402545b17d1da14768c332732bea687667839294e1549&=&format=webp&width=520&height=694 https://media.discordapp.net/attachments/1279378646347415615/1501768039467585626/Untitled.jpg?ex=69fd45fa&is=69fbf47a&hm=4cd7ac00aaa213a21bad735c54f4824cd619ce7cd30b2b0c3545f57752860ac8&=&format=webp&width=643&height=481 WOuNWdtV

[kind herald]

dude

[gentle grove]

You sent it

[kind herald]

https://cdn.discordapp.com/attachments/1266535437967691826/1501697224214577183/togif.gif

[gentle grove]

https://cdn.discordapp.com/attachments/1266535437967691826/1501697224214577183/togif.gif

I. Love this gif

Image

Wharever

[shut cedar]

i wanted to run an IRC bouncer and web IRC client

in order to get it working, i needed to install caddy-l4

caddy-l4 requires caddyx or whatever its called

the VPS has 1GB memory 10GB disk storage

[gentle grove]

The irc bouncer supports fastcgi?

[proper harness]

that vps is weaker then my will to live

[gentle grove]

Or slowcgi

[shut cedar]

https://soju.im/

[gentle grove]

because what are you proxying through an http server for

Why not just have the bouncer listen directly on the port

It's not like tcp can do virtual hosting

[shut cedar]

because its more config

i dont have a reason

tbh

this is for learning

[gentle grove]

Well then that works

Idk if apache can do it either though

without some sort of extension

[shut cedar]

the ISP is so 🐐 ed though

I have nothing bad to speak about them

Support is phenomenal, the UI is great

just expensive AF

http://mythic-beasts.com/

i'm switching to OVH for other services

[brazen timber]

thats enough memory fr

170.91user 27.66system 1:10.95elapsed 279%CPU (0avgtext+0avgdata 699448maxresident)

bascially 680mb

[shut cedar]

OS?

[brazen timber]

NAME="Fedora Linux"
VERSION="44 (Server Edition)"

[shut cedar]

whaaa

with systemd and all that

"with systemd and all that" neckbeard ahh response

yea this is using Alpine

[harsh junco]

Lunduke core

[shut cedar]

systemd is woke gay goyslop

[jovial vortex]

Mental Outlaw core

[shut cedar]

i used to watch his videos long ago

same w lunduke occasionally but lunduke was always ragebait

[jovial vortex]

So is the Linux kernel. Git gud snowflake.

[jovial vortex]

Yeah he really started down that path in 2018

[shut cedar]

the linux schizotuber i respect the most is luke smith

[jovial vortex]

I love SystemD because it’s dumb and easy for me to understand.

[shut cedar]

yeah tbh

for me not really

[hasty ruin]

Andrea Borman better

[shut cedar]

very complex in what you can do w it

i always forget the command to reboot into uefi

[hasty ruin]

https://youtu.be/YVI6SCtVu4c