That's what comes to mind first. It's how I've done it in another uaf's and stuff
#development
tepid olive
lapis vessel
if I just allocate a port array of size x, free it, then leak a buffer of size x, 99% of the time it's the right one
and if I allocate 100 port arrays of size x, free them, then leak a buffer of size x, that's never yet failed on me
so long as the kalloc zone you choose isn't super busy
lapis vessel
@icy cloud it can indeed
tepid olive
He's wise to hate the face
icy cloud
so spam ool ports, free them, then use the bug which reads back a buffer which is too big?
lapis vessel
oh btw shmoo 0x4000 is larger than the max structureOutputSize so you can't use that, but yes sorry your method is correct
icy cloud
and as mentioned it can be in any kalloc zone. Is 16384 the optimal one? Shmoo mentioned that
tepid olive
I like 16384 because you can send pages that are completely controlled back to all_free
primal perch
true power of two
tepid olive
and it's pretty quiet
tepid olive
so after garbage collection happens, the zone allocator marks all_free pages available for use by all kalloc zones
lapis vessel
max size is 0x1000 shmoo
tepid olive
So that's a page of completely controlled memory that's up for grabs by another zone
and it is also very easy to trigger gc by spamming kalloc.16384
Oh ok
icy cloud
garbage collection happens after the ool ports are received right?
lapis vessel
and as mentioned it can be in any kalloc zone. Is 16384 the optimal one? Shmoo mentioned that
@icy cloud I totally arbitrarily chose 0x300 and it works for me
icy cloud
so set them up with send right once and send a message to them and then they’ll die?
primal perch
once theyre received
icy cloud
then declare an IOBiffer and read back?
lapis vessel
and I (again totally arbitrarily) chose to send 0x80 messages
tepid olive
@icy cloud triggering gc isnt relevant to exploiting his bug because you can allocate the iobuffer from the same zone you sprayed earlier
it would only be relevant if for example he could only make iobuffer of 500 bytes (kalloc.512 allocation), but he wanted to leak a structure that lives in kalloc.1024. You would spray kalloc.1024, free all your allocations to try and trigger gc, then spray kalloc.512 to try and get a freed kalloc.1024 page in use again for that allocation
lapis vessel
psycho my exploit looks like this:
- Create a port to receive the messages
- Create a mach message with an ool port array of 0x300/8 of the port you want to find the address of
- Send this message to the receive port 0x80 times, triggering the allocations
- Receive 0x80 messages from the receive port to free the allocations
- Use my bug to leak 0x300 bytes
tepid olive
Dont expect to understand it conceptually until you've spent like 4 days just reading and reading stuff
icy cloud
0x300 divided by 8 in number 2?
tepid olive
that's what it was like for me when I started
primal perch
yea even that whole guide i barely understand and ive done a bit for while
havent really gone invested in it though
icy cloud
Yeah I figured it’ll take me a while. I’ve only worked with C and iOS for a few months now
lapis vessel
ok so I want the port array buffer to be 0x300 bytes in size right?
and each port pointer is 8 bytes in size
so I need 0x300/8 ports
but yeah this stuff is not easy to get into when you're starting out
icy cloud
I read it over a couple of times and the logic seems to make sense
I’m sure I’ll run into issues but that’s expected
tepid olive
this is what an OOL port array looks like in the kernel, it's literally a kalloc'ed array of kernel port pointers
if it helps you understand it better
lapis vessel
shmoo that's not ios 14 I'm disappointed /s
icy cloud
so once they’re freed I read back those addresses?
tepid olive
Lol that's from the winter/spring. I have so many screenshots inside my notes from doing exploit dev
icy cloud
freed by receiving
lapis vessel
once they're freed then the the freelist for that kalloc zone will be topped with those buffers, so when the ioBuffer is allocated, it should overlap with one of them
tepid olive
Yea a mach message is freed when you receive it or destroy the reply port with mach_port_destroy
icy cloud
and it’ll overlap so then I just read back with a buffer the size 0x300
tepid olive
Yeah
misty cradle
is that the one thats patched in 14.2
@grave sparrow no idea
tepid olive
nice 😳 Maybe I can try to exploit 14 now that tfp0 is pretty much dead
misty cradle
just saw it on the TL
tepid olive
14.1 music player feels weird after months of 14.2 testing
but its a lot better than that monstrosity
gaunt mesa
hey @twilit jungle
twilit jungle
gaunt mesa
i know ur always talking about not using @available checks and i had a question for a specific class
so essentially with one of my hooks its set so that if its ios 12.2 or later it hooks MRPlatterViewController, else MediaControlsPanelViewController
instead of an @available check what would u recommend i do?
twilit jungle
Do both of those classes exist and are used?
gaunt mesa
lemme check if it exists
but its not used in 12.2 and up
im checking for existence rn
it does exist in both tho
twilit jungle
Okay well that check doesn't matter if its unused
twilit jungle
gaunt mesa
and im getting it using MSHookIvar
if MSHookIvar doesn't get anything it'll safemode me right?
tepid olive
valueForKey is nice
gaunt mesa
the code looks like this rn btw
tepid olive
send
gaunt mesa
if (@available(iOS 12.2, *)) {
// Shit With MRPlatterViewController MSHookIvar here
} else {
// Shit With MediaControlsPanelViewController MSHookIvar here
}
sad! apple changed code moment
gaunt mesa
the availability guard seems horrible
twilit jungle
is it the same MSHookIvar for both?
twilit jungle
And there is no getter for it?
gaunt mesa
doesn't appear to be
twilit jungle
Well you can either try/catch valueForKey: or use safeValueForKey: (to handle 3 cases, 2 for the different classes and nil case).
gaunt mesa
i don't understand the context of the valueForKey
twilit jungle
valueForKey: is the same as MSHookIvar if the object conforms to NSKeyValueCoding which all NSObject do.
gaunt mesa
so for the "key" part i would supply the ivar name if im understanding this correctly
twilit jungle
Yea
tepid olive
imagine not conforming to NSKeyValueCoding
twilit jungle
valueForKey: throws an exception when the key doesn't exist
tepid olive
twilit jungle
safeValueForKey: doesn't throw an exception, it returns nil instead.
No you don't need MSHookIvar
tepid olive
ex:
tepid olive
NSInteger cockSize = [renai safeValueForKey:@"_cockSize"]; //cock size ivar
if(!cockSize) NSLog(@"Renai doesn't appear to have a cock at the moment!");
that's supplied in my %init like this
Class classInstance = NSClassFromString(className);
%init(MediaHooks, MediaController = classInstance);
so wouldn't the hook just think its id
tepid olive
yes
gaunt mesa
and i wouldn't be able to get any of the ivars or anything anyways?
twilit jungle
what?
tepid olive
you would have to cast, if thats what you mean
it will think its just generic nsobject
probably
gaunt mesa
tepid olive
i know what you mean, where you do %init(class = runtimeclass);
twilit jungle
You don't need to cast to call valueForKey:
gaunt mesa
yeah
tepid olive
it will think its just generic nsobject
@tepid olive
twilit jungle
Nor do you need to cast to get MSHookIvar
tepid olive
well yeah...
gaunt mesa
ill try it but i think ill have the issue
since im doing the class = runtimeclass thing
gaunt mesa
tepid olive
.xm
@primal perch true
primal perch
/s
twilit jungle
true
tepid olive
i swear, that laughing thing is the only thing worse than that yellow face
twilit jungle
primal perch
lul
gaunt mesa
twilit jungle
true
twilit jungle
gaunt mesa
why is ur pfp still
tepid olive
cause it reflects how i am feeling
today
i change it every day
to show how i feel
tepid olive
a method
primal perch
valueForKey but safe
tepid olive
^
gaunt mesa
tepid olive
is it actually? lmao
gaunt mesa
damn
tepid olive
ive just used valueForKey never safe value
twilit jungle
do you think we just make shit up here?
primal perch
@interface NSObject (deeznuts)
-(id)safeValueForKey:(NSString *)cum;
@end``` truesafevalue for key is just
[object valueForKey:foo] ?: nil;
twilit jungle
No that doesn't work
tepid olive
well try and catch
tepid olive
primal perch
exceptions 🤢
primal perch
true
twilit jungle
valueForKey: throws exception if key doesn't exist, otherwise it gets the value for that key regardless of the value is nil or something else
tepid olive
==== RAGE OVER ====
primal perch
==== RAGE OVER ====
gaunt mesa
bro i swear i always spell translatesAutoResizingMaskIntoConstraints wrong
tepid olive
real geo snow?
gaunt mesa
or i make it Masks
twilit jungle
safeValueForKey: returns nil if key doesn't eixst, otherwise it gets the value for that key regardless of the value is nil or something else
So your [object valueForKey:foo] ?: nil; is pointless
primal perch
you can do ghostpp
gaunt mesa
primal perch
that didnt get banned technically
aHR0cHM6Ly9jZG4uZGlzY29yZGFwcC5jb20vZW1vamlzLzcyODgxMjQ5OTkxNDE5NDk4Ni5wbmc/dj0x
tepid olive
@misty cradle
gaunt mesa
oh yeah @twilit jungle u were right it did get the correct runtimeclass btw
thanks for the help
twilit jungle
gaunt mesa
rare moment
primal perch
'actually coding' moment
primal perch
you certainly can
true
anime girl
idk
its just unregistering your hooked method with the objc runtime and associating the old one back with the runtime
you can, idk a good implementation for it
yea that basically
MSHookMessageEx([cum class], @selector(deezNuts), (void *)orig_deezNuts, NULL);
maybe
i think it overwrites the old one
might not
for that particular hook yea
substrate does it for you
MSHookMessageEx([cum class], @selector(deezNuts), (void *)hooked, (void **)&orig);
MSHookMessageEx([cum class], @selector(deezNuts), (void *)orig, NULL);``` try itthe 2nd line later on
orig being a function pointer and hooked being the new implementation
actually wait i dont think you want the casts
well how you gonna run the code to st art it
normally you use a constructor
unhooking it would take more resources than a simple if check
if its about that, dont bother
layoutCumviews
adrl x69, someshit
br x69
yea
its like 3 instructions to check if its enabled
basically doesnt matter
performance hits come when people do weird shit
it takes more instructions to call layoutSubviews than those
any perceivable performance hit is from like iterating over subviews' subviews or doing uiimage shit
4 instructions isnt going to do shit
lol unless its like in sys_write then yea its not worth it
you burned more instructions rn debating over it than will ever be consumed by the additional ones
twilit jungle
In theory unhook makes sense, practically not so much
primal perch
you could check 1000 times and thered still be no difference in performance
cpus are fast
well thats a whole memory allocation
if it were called enough yea
like a lot
still basically no performance difference tho
unless you didnt use ARC none was hogged
itd get released before you return
that gets one pointer in each process its loaded in
twilit jungle
twilit jungle
8 bytes for the pointer, doesn't include the actual dictionary once assigned
primal perch
and skoop
lethal ice
wtf
primal perch
8 bytes for the pointer, doesn't include the actual dictionary once assigned
@twilit jungle ah yea true
its owned by cfprefsd i believe
and it just xpcs it or some shit or maybe it copies
idk
if you get preferences then it comes from there
twilit jungle
He reads from file
primal perch
twilit jungle
primal perch
its one line bro
twilit jungle
primal perch
NSUserDefaults initWithSuiteName:@"deeznuts.com.cum"
twilit jungle
primal perch
yes it only gets access to its own shit
which includes some pointers to library functions that you link against
printf, objc_msgSend etc
any ipc implementation worth a damn (eg all used operating systems) is handled by the kernel and you just invoke some functions
well your value lives in the dylib which gets mapped into the process
so changing one will not change the other
so each process gets its own copy
yes
ye
and you cant access the other without some form of ipc
nor should you in most cases since that sounds like bad programming style
yes doing anything to one variable in one process will not affect the other unless you write the ipc code for it
so like you could post a notification that one changed and then write it to a plist then load that in the other process
dont do that
but you could
and because the two pointers are independent (eg static NSDictionary *prefs;) keep in mind that these will point to two different things belonging to the process it's in
freeing one wont free the other bc it should own it
filesystem ipc is complete dook
it involves a write to non volatile storage which is much slower than ram
its necessary for like storing prefs but if you want to communicate state changes or something its probably the worst thing you could do
things that need to be persistent stuff like that
but camera for example doesnt use that shit
or remote views
thats a better example
pretty sure
mediaserverd
memory gets shared behind the scene for remote views and the OS manages it so its secure as both processes were explicit about what they wanted
and they get nothing more than that
any of the ways that apple recommends is fine
if you need to be hacky about it then youre doing it wrong
something like that yeah
trump
the OS
memory manager
process can request more somehow i dont know the specifics
yea so just dont leak
save it for after
yep theres prioritized processes which you can probably guess
which will kill user apps to not let le system die
well cocoatop does it so
probably
unless that polls 
primal perch
earthbound true
gaunt mesa
seems like the unhooking stuff could be great for prefs
but it would most likely require some respring for visual things right
twilit jungle
It being visual has nothing to do with it requiring a respring.
primal perch
twilit jungle
Also don't really see the special case where it would be helpful for prefs but if you have proper hooks then that should already be happening as bundles are dynamically loaded and unloaded.
primal perch
tepid olive
@tepid olive POG
it's
happening
lmao
i just realized i was in #development
true
is #assembly a thing
yet
ah
ok
true
#julesisoverparty
but no sex
@vivid dew woe
primal perch
i assassinated jules a few hours ago
@vivid dew
surreal mountain
primal perch
tru
tepid olive
primal perch
its the leviathan site
surreal mountain
bruh\
next dust
Guys basically I’ve been trying to make a function return a string
But that function has an http request in it
And i need to wait for it to end before returning the value
But whenever i set a semaphore wait/ while loop after task.resume() the task will never start
next dust
Swift
surreal mountain
oh
i can give guidance then
not
code
so what i do is i have a dynamic library with a method to build and send my http request and said method has a completion handler (NSString *response) and completionHandler(response);
thats objc
next dust
Uhm
surreal mountain
and in my main thing i use that lib and call that method and it just returns what i want
so
have a method with a completion handler
next dust
The thing is that it’s not starting when i use semaphore
surreal mountain
why semaphore
next dust
And let it async
twilit jungle
Bruh
next dust
Even a while
surreal mountain
dispatch_async 
next dust
Ima send code
surreal mountain
this is my objc code
does ur swift stuff do the same thing
this works flawlessly
twilit jungle
Please stop
twilit jungle
Blindly giving him code to copy won't help but okay I'll shut up
next dust
func getConfirmationUrl() -> String {
var mail : String = ""
var headers = [
"User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36",
"Authorization": "Bearer \(self.authToken)"
]
var request = URLRequest(url: URL(string: "")!)
//request.httpMethod = "GET"
//request.allHTTPHeaderFields = headers
var (data, response, error) = URLSession.shared.synchronousDataTask(with: request)
if (error != nil) {
print("kfok262362")
print(error!)
} else {
print("ok262362")
var httpResponse = response as? HTTPURLResponse
var utf8Data = String(decoding: data!, as: UTF8.self)
var json = try? JSONSerialization.jsonObject(with: data!, options: []) as? [String:AnyObject]
if(httpResponse?.statusCode == 200)
{
do {
var mails = json??["member"] as! [Any]
print(mails.count)
return "sex"
} catch {
}
} else {
print(utf8Data)
}
}
return "ded"
}
dont look at the print things
it's just to see whenever it gets there or not
it was almost 1 am
xD
extension URLSession {
func synchronousDataTask(with request: URLRequest) -> (Data?, URLResponse?, Error?) {
var data: Data?
var response: URLResponse?
var error: Error?
let semaphore = DispatchSemaphore(value: 0)
let dataTask = self.dataTask(with: request) {
data = $0
response = $1
error = $2
semaphore.signal()
}
dataTask.resume()
_ = semaphore.wait(timeout: .distantFuture)
return (data, response, error)
}
}
the extension
to make it sync
primal perch
i strongly recommend doing http requests asynchronously
primal perch
primal perch
you dont if you setup a callback
twilit jungle
Why does it have to return stuff?
primal perch
just run the update code in a block
surreal mountain
just use a completionhandler
next dust
uhm
also i gotta loop for a while
till the value changes
so make a req every 1 sec
let's say
and if it changes
surreal mountain
void method, completion handler NSString so it "returns" that NSString
idek how that works in swift
but
next dust
how do i return the completionhandler result from the main func?
surreal mountain
not a clue
you call the method
and specify a string u want to be set with whatever it "returns"
idk how in swift
next dust
But why doesnt the semaphore way work
surreal mountain
no idea
next dust
Also I’m running that func on an async thread
surreal mountain
i run my stuff async too
primal perch
surreal mountain
i dont get it
next dust
Is there a way to do like JavaScript promise?
next dust
Like i get a callback out of the function
Ye
That’s good as well
I just need the end value at the end
primal perch
next dust
I can just put the code inside the callback
twilit jungle
Thats what that async response is
next dust
Ok i can do that
primal perch
guess what you win
next dust
Also how can i loop trough reqs?
next dust
For that i gotta need sync?
twilit jungle
No you don't
twilit jungle
You loop through the requests the same way you look through anything else. The response would asynchronously be called multiple times, you just need to differentiate between those responses.
next dust
Uhm?
primal perch
next dust
Wait does task.resume wait till the req is done?
Meeeh guysss
I rly need help and i guess you’re my only chance
primal perch
just be aware all of these are public api and therefore have documentation
true
very serious channel 
twilit jungle
task.resume starts/resumes the task
primal perch
not true, but also very false
next dust
No shit
twilit jungle
Okay then why are you asking if start means "done"?
next dust
Just nvm
primal perch
twilit jungle
Just write async code, you shouldn't be making HTTP requests sync
twilit jungle
There is no but
next dust
I need to loop till i get a different response
twilit jungle
That doesn't mean you can't make it async
next dust
There’s no way to do it asynchronously
primal perch
then start the task again after it completes
twilit jungle
Yes there is
primal perch
in the complete block
primal perch
you might to reset some shit but its very possible
twilit jungle
Multiple requests same time, async callback that does another request until you get what you want (i.e. recursion), list goes on.
primal perch
re assign idk the specifics
twilit jungle
There is no reason to force this to be sync
You are literally asking for trouble by doing that
next dust
Multiple requests same time, async callback that does another request until you get what you want (i.e. recursion), list goes on.
@twilit jungle an example?
lethal ice
twilit jungle
Uhh I am not about to look for examples
lethal ice
true
twilit jungle
But those are pretty straight forward concepts, you should be able to figure it out on your own
twilit jungle
Instead of going straight to google first, think about it
next dust
Ikr
twilit jungle
Forget about swift
Just think about how you would do it
And then try to incorporate into swift
next dust
Id resume the task again inside the res code
primal perch
true
next dust
Do they???
twilit jungle
But you are thinking in terms of swift at that point
next dust
yes
twilit jungle
Well iOS API
primal perch
createTask() {
task = async_request some shit completion block {
// its done, handle response and update UI idk
createTask()
}
}
viewDidShit() {
createTask()
}```Oh lol
twilit jungle
You can always cancel and resume the task to restart it. Which may or may not work depending on if the requests to the server expects something unique per request.
next dust
How
twilit jungle
This is where quip's code comes in, you pass in block that does the UI updating as one of the arguments.
next dust
Im inside a task res body
twilit jungle
Thats a block, so you can capture any variable inside of that
next dust
But it’s still not main thread
twilit jungle
Right you'd have to make sure you do the UI changes on main thread
next dust
What if i call a main thread func that updates the ui from a task
twilit jungle
Yes that works, just keep track of retain cycles when you capture variables in blocks
twilit jungle
Welp I don't want to explain memory management, so google for iOS retain cycles with blocks. Hopefully that yields something helpful.
next dust
Uhm i found that
DispatchQueue.main.async {
self.labelTest.text = eventsArray[0].description
}
twilit jungle
Thats not what I was talking about
Thats more of performing things on main thread
Which yes you need, but you are going to have to make sure to avoid retain cycle when you capture self there in the response where you call it.
next dust
primal perch
true
next dust
Also how am i going to deploy my app to my iphone?
I’m on xcode 10 and ios 14
(Hackintosh, high sierra)
lethal ice
@everyone red vines are better but twizzlers are almost as good
lethal ice
tepid olive
Why no one uses idevicediagnostics to save blobs on A12+? You just need to get "BootNonce" and "ApNonce" variables from mobilegestalt. That way you can set the nonce later.
11
steady nest
Because that still gives you no way to know the generator that generates that nonce
tepid olive
tepid olive
steady nest
but, is the BootNonce 16 bytes of size?
well, can make sense if the BootNonce is the correct size
I'd suggest trying that on a device that doesn't have nonce entanglement, it's the only way you can be sure it worked
well, generators are 16 bytes 😐
0x1(x16)
opal ridge
8 bytes would be 256 combinations
steady nest
yes, but generators are 16 bytes though
not sure honestly
I'd still suggest you to check that nonce on an A11 or below phone
that way you'll know if it's the real generator or not, for sure
I'm checking
response
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>MobileGestalt</key>
<dict>
<key>BootNonce</key>
<data>
/Eivo1XcZlI=
</data>
<key>Status</key>
<string>Success</string>
</dict>
</dict>
</plist>
just a sec
fc48afa355dc6652
not correct :/
I didn't set the nonce
no idea, just broke
I'm on checkra1n, I don't think it sets a nonce by default
nice call on gestalt, though
still, same nonce
might be because I saved blobs yesterday
it is
let me check another device
yes, I know
my iPad doesn't have a nonce set
I'll check
doesn't match :/
QcZnAul9MEI= -> 41c66702e97d3042
Generator is 0x85bc71a70a7fa1ab
the upcoming kernel poc will shed some light on whether it worked or not
yes
you managed to restore?
well, from what I can see, it's very likely that it works
I'm testing it with more gestalt keys and looking at the gestalt cache and the results are the same
the cache is probably updated upon reboots, but since you can get both the bootnonce and the apnonce, there should be no issues.
oh
bingo
the key is ApNonceRetrieve
that'll give you the actual current boot-nonce
aba17f0aa771bc85
0x85bc71a70a7fa1ab
in little endian, of course
it works for every device
even a12 and above, you found a solution
who
oh
thought you were the same, same green pic
opal ridge
that's a breakthrough
opal ridge
lol someone pls post this on reddit
steady nest
w8
let me just get the right keys for the ap
I don't rly care about the karma
the keys he suggested aren't fully correct
I'm building a test script
still didn't check
might be incorrect
steady nest
it's not ApNonce
not mobilegestalt ApNonce, that's what I mean
it's giving me an incorrect value
no
my nonce isn't set on this device
it's a random one
ApNonceRetrieve gives me the correct boot-nonce, in little endian
I sha1'd that and now I'm looking for the key that gives me the same value
yes
an incorrect value
it's not the sha-1
that allows for blob saving already
I'm looking for a way to get the current ApNonce from userland, though
cc @faint timber
gestalt
that way, it works fine on Windows
it should return 17f3a106114aa393724c038717f59a8be4e5cc46 but it's returning 9b094615cfef2e2ef7c01c08dc58875c1a212764c66953bd6c946eeebbb73049
wait what.
it's sha1 on pre a12
uh
yes
oh fuck
yes
no, I know you're right
I also thought it was sha384, but I only skimmed through 1conan's code
and only looked at the sha1 part lol
well
sha384 should be 92941690027b63b4aacb444cae95153460c967d9bd2a431f6b68446d9c8d49b000676fd60d9444234f1f92d0c9306206
apnonce returns 9b094615cfef2e2ef7c01c08dc58875c1a212764c66953bd6c946eeebbb73049
looking at tihmstar's code, he also uses "ApNonce"
device?
you jailbroken?
We'd need someone with A12 and jailbroken for further testing
I can't check irecovery atm :/
jailbroken?
great
you got libimobiledevice?
on macOS
great
can you check your boot-nonce using system info and then run idevicediagnostics mobilegestalt ApNonceRetrieve
yeah, don't set
uh
:/
1111...
951202fb7eaebb6e0f66c802575c5f776a3ac80a3902d1a02b0af9c779efef44
weird
can you check the nonce on irecovery?
should be irecovery -q | grep NONC
on recovery mode
also, can you check idevicediagnostics mobilegestalt ApNonceRetrieve
looks like it's just ApNonce for a12+ ?
wait what.
ApNonceRetrieve gives me nothing on 13 and gives me output on 14
wrong generator, but it's set with ody
tepid olive
steady nest
found a shortcut that allows reading gestalt cache, unjailbroken
misty cradle
F
steady nest
like you did with aidsisaprankbro
misty cradle
like you did with aidsisaprankbro
@steady nest you mean like u did
steady nest
can be
rebooting userspace to check if something changes
nope
bootnonce changed
no longer set
gestalt still answers with the same values, though
looks to be answering for gestalt cache
Imma delete it and check again
yup
it's from the cache
deleted it and value changed
uh
bootnonce changed but, it's still incorrect
twilit jungle
You can load FrontBoardServices in settings app
steady nest
I've deleted the cache and the values changed, so I can only assume it's correct
@grave sparrow can you set the nonce, delete the cache and try checking gestalt again please
/var/containers/Shared/SystemGroup/whatendsinmobilegestaltcache/Library/Caches/the plist file
west grove
Hmm
west grove
So then
steady nest
irecovery -q | grep NONC
great
means we found a way to get the generator associated with a nonce on a12+ unjailbroken
yes, please
just to check if we can do it without going back to recovery
set nonce, then delete
idevicediagnostics gestalt BootNonce
idevicediagnostics gestalt ApNonce
idevicediagnostics gestalt ApNonceRetrieve
@tepid olive I believe setting the nonce with dimentio, then deleting the cache then checking stuff would be enough
delete that file using filza or ssh
it changes to the current one once cache is deleted @tepid olive
yes, that one
Set nonce to 0x1111111111111111```
should match thisoh yes, my bad
d9636c45d3dea89649525195cbbd55ebe8bf2bba1fffd1e96acbb903a9fe02bd
nothing
can you check BootNonce?
1111
good
bad part, apnonce
boot-nonce, maybe?
FirmwareNonce?
tepid olive
Please update to Xcode 12.1 (or delete it).
Xcode can be updated from:
https://developer.apple.com/download/more/
Error: Your Xcode does not support macOS 11.0.
It is either outdated or was modified.
Please update your Xcode or delete it if no updates are available.
```  homebrewnothing
nothing
sleeping
trying to figure out why it doesn't work on a11 and below (doesn't matter)
trying to figure out apnonce
idk
sure, thank you!
half walrus
what's the question
undone nest
one sec i gotta find the snippet again
oke so basically i have the html on the right
and i somehow need to target the text field with *****@icloud.com in it
already tried some stuff but couldn’t figure it out
half walrus
the actual text field?
half walrus
which specific element
undone nest
wait i actually don’t have everything expanded in that one
i need to select the one i have my cursor on ideally
no idea if thats possible
half walrus
it is
gaunt mesa
wait ur trying to get that specific element
yeah but discord obfuscates their shit so taht id will change like a lot
half walrus
give me a sec
i'm working on it
div[class^="profile"] + div > div[class^="field-"]::nth-of-type(2) > div > h5 + div > span
@undone nest
try this
note that you'll need to find a way to remove the button field from that so you can get only the text inside span
grim sparrow
Scraping mad man
half walrus
having to do reddit css does things to ur mind
since you cant modify the html itself
div.class.startsWith("profile") (element directly after of type) div (direct child of type) div.class.startsWith("field-")::(only select 2nd one that qualifies for this) (direct child of type) div (direct child of type) h5 (directly next to this) div (direct child of type) span
is the breakdown on that selector
grim sparrow
I-
half walrus
yeah but discord obfuscates their shit so taht id will change like a lot
@gaunt mesa it's not obfuscation
gaunt mesa
oop
half walrus
IDS are just randomly generated by their, system or whatever you want to call it
gaunt mesa
its part of their minification right?
half walrus
nah it's just how it's built
gaunt mesa
hm
half walrus
imagine you style a specific NSString in objc
well in css land, every NSString is an NSString object kinda thing
so how do you specify which one? a pointer to it in memory, which'll be random
gaunt mesa
ahh
half walrus
done like that so IDs or classes dont ever conflict due to human error
gaunt mesa
okay that makes more sense
lethal ice
orange uhh
twilit jungle
gaunt mesa
hello
half walrus
does USB Passthrough in a mac VM provide enough control for checkra1n to work
half walrus
not exactly hyped to write a usb driver rn
gaunt mesa
does USB Passthrough in a mac VM provide enough control for checkra1n to work
@half walrus why a mac vm?
half walrus
guess i could use linux
gaunt mesa
yeah
half walrus
mm fun windows drivers
misty cradle
@rapid lion hello men can you please hurry up with the UI
- krit
gaunt mesa
is it possible to stop coalescing or whtever the fuck its called
like when using gcd
i don't want it to combine my timers or delay them and its annoying
tardy narwhal
writing the win driver is no fun, you can passthrough from windows host to mac/ linux vm but it’s very atrocious if not done properly
@half walrus just a heads up, either wait for checkrain team or scout git for the (probably only) alternative solution
rare plinth
Does anyone know where the bundle executables are for Control Center modules?
shoot my developer role
twilit jungle
Inside the module bundles?
rare plinth
I checked the module bundles but theres no executable
for example, /System/Library/ControlCenter/Bundles/ConnectivityModule.bundle has an Info.plist that specifies CFBundleExecutable as ConnectivityModule but there is no executable to be found
twilit jungle
Probably inside dsc then
misty cradle
frcoal
primal perch
Probably inside dsc then
@twilit jungle
lapis vessel
Has anyone tried this btw? https://www.reddit.com/r/jailbreakdevelopers/comments/jn8sqs/a_modern_dyld_decacher/
half walrus
i have
see my issues on the project
My local copy has several fixes
I was able to get classrefs/superrefs working
lapis vessel
So definitely a promising project then?
half walrus
very
it's all in python and I had plans in the past to build this kind of tool, so I'll be contributing heavily
lapis vessel
Fantastic! We've been sorely missing a good dsc extractor pretty much since the imaon2 days
tepid olive
Oh that’s cool
half walrus
but yes as it stands this project is a godsend, and it's mostly functional
tepid olive
jtool really isn’t doing it 
half walrus
currently working better than IDA
there's a few things that've been bugging out in parts of the project where I can't understand what's going on in the code, but even rn with my fixes it's better than IDA's extractor
half walrus
neat
lapis vessel
@glacial matrix do you perhaps want to update the list at http://iphonedevwiki.net/index.php/Dyld_shared_cache?
half walrus
i intended to update it when the tool was usable for non-python devs
as it stands you need to python3 then from Runner import * and manually call everything yourself
lapis vessel
From my first quick scan through I saw there were multiple "modules", were you just running it with them all enabled?
glacial matrix
everyone is welcome to make constructive edits to the wiki
gaunt mesa
oh
half walrus
From my first quick scan through I saw there were multiple "modules", were you just running it with them all enabled?
@lapis vessel the modules are just the stages of extraction
"fixing" certain things
so yeah
lapis vessel
Oh anyone with an account can make edits to existing pages?
glacial matrix
yes, that's how a wiki works :P
tepid olive
Woe I don’t like python
lapis vessel
join the club
tepid olive
Mostly because I gave up on learning it when I was 10 and won’t touch it since
primal perch
its great for supplementary projects
you dont need to jump through 80 hoops to get it to run on your machine™️
tepid olive
True
lapis vessel
How can a language that has readability as an important part of its philosophy be so unreadable
primal perch
for a beginner, getting a C project compilable with dependencies is probably harder than using C itself
tepid olive
Why it dark
How can a language that has readability as an important part of its philosophy be so unreadable
@lapis vessel this
lapis vessel
Like half the design team wanted it to be readable and the other half wanted to do crazy one-liners
glacial matrix
trying to write C-like code in python is also a mistake that might deter people from using it as it should and make it less readable than it could be
primal perch
its not halloween though
primal perch
C like python is best python
glacial matrix
nope
glacial matrix
bad:
array = [1, 2, 3, 4]
sum = 0
for i in range(len(array)):
sum += array[i]
better:
array = [1, 2, 3, 4]
sum = 0
for e in array:
sum += e
best:
array = [1, 2, 3, 4]
sum = reduce((lambda x, y: x + y), array)
Perfect example of what I dislike about python
half walrus
i disagree completely
lapis vessel
The 2nd one is so easy to read
half walrus
i have no idea what that last one does at all
lapis vessel
The third is impossible
half walrus
and when people insist on me writing my python code that way it leads to unmaintainable projects
lapis vessel
The design favours one-liners over readability
glacial matrix
there's a time and place for everything tho, so "best" is only for making the sum of a list of numbers
primal perch
there's really no wrong answer if its readable and isnt implemented like poop
glacial matrix
"better" is a solid choice for most loops
lapis vessel
The "better" you can look at and immediately see what it does, maybe just because my python knowledge is a bit sketchy but it takes a fair amount of work to decipher what the "best" one does
glacial matrix
there's probably a "sum" function
twilit jungle
1 + 2 + 3 + 4
primal perch
how to write game
glacial matrix
import gravity
I don't know everything about python, but a year and half of using it everyday does help and I find it much faster to iterate than C or objC
sometimes a map is good, sometimes comprehensions are better
readability is subjective tho
half walrus
lol
do i get a cookie for the laziest arg parsing ever done in python
@twilit jungle if you want more proof that python sometimes encourages writing barely readable code ^
don't feel like importing another module for fairly simple args
glacial matrix
should be using argparse
twilit jungle
definitely readable
glacial matrix
except c doesn't have exceptions :P
half walrus
so i might've gotten the "unreadable code" bit backwards
as with argparse it'd be a lot longer and messier
except c doesn't have exceptions :P
C style but being lazy about the fact I can catch the two crashes because they both mean args weren't entered properly
glacial matrix
from argparse import ArgumentParser
if __name__ == '__main__':
arg_parser = ArgumentParser("Extractor")
arg_parser.add_argument("-c", metavar="DYLD_PATH", help="dyld cache path")
arg_parser.add_argument("-e", required=True, metavar="FW", help="framework name")
arg_parser.add_argument("-o", required=True, metavar="OUT", help="output file")
parsed = arg_parser.parse_args()
DYLD_PATH, FW, OUT = parsed.DYLD_PATH, parsed.FW, parsed.OUT
extract(FW, OUT)
but not in the stdlib
primal perch
:RubyCry:
primal perch
@half walrus
primal perch
u tryna get your uid or something
tepid olive
@tepid olive https://cdn.discordapp.com/attachments/688121419980341282/774447093821603840/unknown.png
true
false
primal perch
tepid olive
@lethal ice that's my server
lethal ice
primal perch
updates submodules
tepid olive
give ip
@vivid dew mc.stkc.me
steady nest
it makes 5 changes to futurerestore itself, and then also changes tsschecker/idevicerestore?
@grave sparrow updates submodules
