#development

1 messages Ā· Page 357 of 1

gaunt mesa
#

lol

#

that bothers me so much

#

i just write nicely formatted code to start with

lime pivot
#

I think that was something I said needs fixing a while back šŸ˜›

half walrus
#

is that new

#

that sounds problematic yeah

lime pivot
#

new cause I stalk dragon issues

half walrus
lime pivot
#

but I think that was always a thing

half walrus
gaunt mesa
#

one eye is gone

jade vault
#

I found a bug in the messages app, but I'm not quite sure if it could be used for anything

half walrus
#

it's so much cleaner than

lime pivot
#

when building on the default admin user on macOS, uid 501, that would make the files be owned by mobile, also uid 501

half walrus
#

several nearly identical methods with the arguments changed

lime pivot
#

which is kiiiiiinda very dangerous

gaunt mesa
#

i need to properly learn python

half walrus
#

yes u do

lime pivot
#

tried to stop this with theos by trying to enforce fakeroot first… then fakeroot kept breaking with macOS updates so I made dm.pl just set uid/gid 0 always

glacial matrix
gaunt mesa
#

i'll add it to my list of shit to learn in 2021

half walrus
#

but i will fix this rn

gaunt mesa
#

@lime pivot dm

lime pivot
#

oh yeah everything is… horrible honestly

half walrus
#

is there a reason that wouldn't work (as theos doesn't use it, i'm assuming you're saying)

gaunt mesa
#

theos uses some pl file for debs right

lime pivot
#

if you think for more than a few seconds about how very popular packages (ab)use setuid(0)… uh yeah you can definitely come up with a few attack scenarios

half walrus
#

my macos has Debian 'dpkg' package management program version 1.20.0 (darwin-amd64).

lime pivot
#

well

half walrus
#

but if mojave or others ship with pre 1.19, i'm not using that

lime pivot
#

they don't ship with anything

glacial matrix
#

@half walrus like, you can do

COLOR_FORMAT = "\033[{bold};{color}m{text}\033[m"
text = COLOR_FORMAT.format(bold=0, color=33, text="...")
gaunt mesa
#

mojave

jade vault
#

So you guys know about about iOS code yeah?

lime pivot
#

no, sorry

gaunt mesa
#

no

half walrus
jade vault
#

Would there be anything you can achieve with a blank text being sent?

half walrus
#

the origin of all of that code

glacial matrix
#

(or COLOR_FORMAT = "\033[{bold};{fg_color};{bg_color}m{text}\033[m")

jade vault
#

Here's a bug I found if you would like to recreate

jade vault
#

On iOS 14 it won't send a message and the last sent message in the contact list will be blank

#

Step one: compose a new email
Step two: write message
Step three: cancel message and save as draft
Step four: open saved draft
Step five: select all text and copy
Step six: move to messages app
Step seven: paste copied text
Step eight: press send

gaunt mesa
#

that's probably some encoding thing lol

half walrus
#

this may be

#

many time

gaunt mesa
#

i know apple adds a random question mark to my discord messages

half walrus
#

nvm its apparently completely lost

glacial matrix
#

rip

gaunt mesa
#

tip

half walrus
#

probably not a bad thing

#

was a waste of time

lime pivot
#

the only reason for dm.pl was 2 things

  1. saurik was pretty hard on not supporting xz compression despite dpkg moving on to xz as default, and later on completely removing support for compressing to anything except gzip (just for compatibility) and xz, coolstar didn't care and now everyone is using xz so it prob doesn't matter any more
  2. fakeroot being terrible, too many bugs so I couldn't make it a mandatory dependency, and the issue of way too many packages being released with dangerously insecure permissions
gaunt mesa
#

well

half walrus
gaunt mesa
#

jailbreaks in general aren't secure

half walrus
#

which might help it make more sense

lime pivot
#

ļæ½

half walrus
glacial matrix
lime pivot
#

it's fun to drop that in group chats

#

watch people go wait I head my phone beep but there's no message???

gaunt mesa
half walrus
peak quartz
#

Wasn’t me but ill know for next time

half walrus
#

idk what 'it' is but

#

at least one of them usually listens

#

jb rn has some massive security issues we can hopefully gradually work on

jade vault
#

Well thanks for anyone that tried I'll look into it and see what it's doing

half walrus
#

and inefficiencies in general

wicked summit
half walrus
#

does it ship with python stdlib

gaunt mesa
#

guys

wicked summit
#

ah nvm

gaunt mesa
#

did u know adam demasi cant receive payments at this time

half walrus
#

if the answer is no then so is mine

gaunt mesa
lime pivot
wicked summit
#

understandable

half walrus
#

yaml is the only exception to that and i've actively been trying to get rid of it

wicked summit
#

this for DragonBuild?

half walrus
#

python on ios doesn't ship with pip and its balls to set up

#

yeah

lime pivot
# gaunt mesa

because financial shit is always deployed so spottily

half walrus
#

and the whole goal of the thing is to work OTB with 0 setup

lime pivot
#

Apple Card is US only

#

Apple Pay Cash is US only

wicked summit
#
python -m ensurepip

goes brrr

half walrus
#

doesn't work on ios

wicked summit
#

does for me

half walrus
#

what bootstrap

glacial matrix
lime pivot
#

Theos does have a few Perl dependencies it bundles in because you would hate me even more if I forced you to use cpan šŸ˜‚

half walrus
#

i write for elu and use it myself

peak quartz
#

can anyobdy tells me what im doing wrong here? im trying to translate the swift version over to obj-c but it looks like its giving me the regular UIVisualEffectView class.. I am trying to achieve true blur-effect other than the crappy one

half walrus
#

I'd bundle yaml if i knew how

wicked summit
lime pivot
#

homecursus

half walrus
#

in the same sense i don't expect the user to have macports installed if they're on macos

glacial matrix
#

wen 2.6 release?

lime pivot
half walrus
#

someone needs to make a pytheos git though

glacial matrix
lime pivot
#

certain previous jailbreaks (I think even as recent as 11.3) would just give everyone the task_for_pid-allow entitlement 😬

#

which is cool as shit, then you can debug any process via Xcode

half walrus
glacial matrix
#

I should make public a pair of repos

lime pivot
#

but also unbelievably disgusting in how "fuck security anyway lol" it is

half walrus
#

i'd love to see the logos rewrite public as well

#

despite it being a non-functional WIP

#

i'd love to expand on the language server rn

lime pivot
#

10.3 jb just entirely killed all sandbox rules, which is dumb for security sure but also because it makes the jb so easy to detect

glacial matrix
#

I just got stuck on figuring out a good way to do statement stacks

half walrus
#

or like the guy open sourcing the dyld extractor despite it very much not being done

#

now i got/get to finish it :)

wicked summit
#

for terminal GUI shenanigans

lime pivot
half walrus
#

o

lime pivot
#

not sure how recent

gaunt mesa
#

does theos have a version number

half walrus
#

why am i not following uro

half walrus
glacial matrix
gaunt mesa
#

true

tepid olive
#

task-for-pid_allow getting neutered on 11.x and 9.x jbs was such a godsend lol

glacial matrix
#

so there's technically a logos.c and logos.py

lime pivot
gaunt mesa
#

is there a logos.js tho

glacial matrix
wicked summit
half walrus
#

refactored the entire project, i think almost 4 million changes if you count the sdks

lime pivot
#

TIL about that flag honestly

half walrus
#

so i bumped from 1.1 to 1.2

#

lol

lime pivot
#

thank god they finally came up with a less dumb workaround than this wacky program that depends on code injection into arbitrary processes

gaunt mesa
#

theos has a website

#

tf

lime pivot
#

theos dot developer!

half walrus
#

what license is it under

wicked summit
#

MIT

gaunt mesa
#

will it be accepted

half walrus
#

i would submodule more shit if i didn't also have to worry about licenses

surreal mountain
#

pro has a pyyaml package

#

id like to see elu get one

gaunt mesa
#

ok

half walrus
#

does it

lime pivot
half walrus
#

like a package that specifically installs pyyaml @surreal mountain?

surreal mountain
#

you can just take that deb

half walrus
#

fuckin bless u @tepid olive

gaunt mesa
lime pivot
#

pls do come up with something less "I came up with it in half an hour and it at least looks better than it probably is meant to" lmao

surreal mountain
#

[[python3-yaml]]

tepid olive
#
python3-yaml

YAML parser and emitter for Python3

Author

Hayden Seay

Version

5.3.1

Repo
Bundle ID

python3-yaml

More Info
surreal mountain
#

there

#

pyyaml

half walrus
#

[[dragon]]

tepid olive
#
Docks - Dragon (iPhX)

Docks - Drawer Blue (iPhX) on the dock of your homescreen

Author

BuufJuiced

Version

2019-04-20

Repo
Bundle ID

com.yourepo.buufjuiced.docks-dragoniphx

More Info
half walrus
surreal mountain
#

lol 19 pages

#

šŸ’€

#

wtf

gaunt mesa
glacial matrix
#

if I had a nickel for every time I made a parser, I'd have 15 cents :/

lime pivot
#

we actually do want to make the homepage more suitable to also show other projects

#

ping @nimble parcel about what he proposed to me for it

surreal mountain
#

@half walrus suggestion: build and put the deb on your repo

glacial matrix
surreal mountain
#

not in dragon deb itself

#

then depend on it

surreal mountain
#

so if a more updated version is on pro

#

they get the more updated version

half walrus
#

i just bundled literally everything

#

i should

#

really really fix that

surreal mountain
#

yes but

half walrus
#

that package is so illegal

wicked summit
#

dude, watch out for the typos there

#

red squiggly lines mean typos

surreal mountain
#

why dont you just

wicked summit
#

please fix

surreal mountain
#

depend on each deb

half walrus
#

so many DMCAs

surreal mountain
#

and then put python3-yaml on your repo as well

#

so elu users also get it

half walrus
#

@surreal mountain to avoid bootstrap related issues

surreal mountain
#

how could that cause an issue?

half walrus
#

i don't want my repo conflicting with others

surreal mountain
#

procursus is pinned, no?

half walrus
#

i dont want to have my package only work on certain bootstraps

surreal mountain
#

oh dynamic linking i forgot about that

#

i thin

#

k

half walrus
#

i want the user to click one button and get the tool and have it run

surreal mountain
#

true

half walrus
#

given

#

certain people would kill me if they knew how i accomplished getting that to work

#

lol

surreal mountain
#

lol

half walrus
#

need to swap it to procursus binaries

half walrus
glacial matrix
half walrus
#

didn't break anyone in the communities' licenses on stuff in it

#

how far along is that

glacial matrix
#

not much

surreal mountain
#

Why

half walrus
#

because they can

lime pivot
#

yep!

half walrus
#

because someone told them "you're an idiot if you try that" or "that's impossible"

#

origin of like 20% of my projects

grim sparrow
#

lol

half walrus
#

someone got arm64 .ipas to run in the simulator

#

nothing is impossible anymore

#

and then they monetized it too

glacial matrix
grim sparrow
#

Bruh

lime pivot
glacial matrix
#

I'm not sure if using lambdas is quite the same as macros

surreal mountain
#

cock

half walrus
#

yeah doesn't really look like the same thing now

#

how is this running scanf in printf

glacial matrix
half walrus
#

this is abuse of something low-level lol

#

even in the unformatted file i have no idea what's going on

#

given, the macro names are, lacking

glacial matrix
#

scanf is in arg macro

glacial matrix
half walrus
#

honestly this is really cool though

#

be cooler if they wrote it without variables

#

but they just used char dat[18*2+2+500] = {1, 0, 10, 0, 10}; to make things needlessly confusing

#
// Okay so here's our array.
// dat[0] stores whether or not we should continue looping.
// dat[2] stores the current turn counter, decremented by one every turn.
// dat[4] gets filled by scanf() to be the user's entered integer.
glacial matrix
#

Simple enough

half walrus
#

why not use variables for those then

#

i mean why write this in the first place sure but hmph

glacial matrix
#

Because it’s easier to deref a single variable with a changing index than multiple variables

glacial matrix
#

I thought I read that

#

Literally the first line of the readme (bar the title)

half walrus
#

you know the rule

glacial matrix
#

Why require that tho? Code golf probably

half walrus
#

if they wanted people to read readme's they'd indicate it in the filename or something

#

i'm no longer allowed to complain about people not reading mine now rip

#

i've become my worst enemy

glacial matrix
#

Haha

half walrus
glacial matrix
#

Welcome to the club

half walrus
#

question then is where do i document my stuff

lime pivot
#

see also self-modifying code in the DOS/classic Mac OS days

half walrus
#

cuz i get ppl aren't gonna read it, can't change humans

lime pivot
#

back when literally overwriting your own program in memory was the best compression/obfuscation

half walrus
#

@rapid lion may know more

cloud sundial
#

The file is literally called "readme" how hard can it be

#

Unless I'm missing a lot of the context

lime pivot
#

readme? you can’t tell me what to do

half walrus
#

as that particular method of obfuscation entirely defeats VAC's one "attack"

half walrus
cloud sundial
glacial matrix
half walrus
#

and i bitch about it but literally just did the same shit

#

"why was this written" first line of readme

#

oo i learned about quines the other day

lime pivot
#

I try to read readmes but some people are honestly bad at them

#

(one of those people is me)

half walrus
#

constantly changing mine

lime pivot
#

there’s also the people who write their entire documentation in the readme

half walrus
#

because you have to make a lot of info very easy to digest

lime pivot
#

like pages and pages and pages

half walrus
#

not all of us can afford websites lol

lime pivot
#

useful for cmd-f-ing blindly I guess

half walrus
#

and gh wiki layout is shit

lime pivot
#

yeahhhhhh but you can literally just make more .md files

#

and link to them

glacial matrix
half walrus
#

not really

lime pivot
#

I might actually move Theos wiki into the repo…

half walrus
#

it's hard to process or find information on gh wikis

lime pivot
#

it’s dumb that the wiki is backed by a separate git repo, yet the only options are Let Everyone Edit (and don’t email me about it, like no seriously, it’s fine /s) and Only Let Me Edit (so now nobody knows how to propose changes)

half walrus
#

and of all places for "hard to process or find information" to be an issue, code wikis has to be the worst

lime pivot
#

the halfway is for me to make a docs/ dir with the .md files, and have github actions sync that with the wiki git repo

#

ok that’s actually a good idea

half walrus
#

fuck ur streamlined table of contents, we're gonna shove a massive, bigger, bolder, +4px font size larger, alphabetical list of pages in ur face

#

and then truncate it anyways

lime pivot
#

ugh my godddd

#

so dumbbbb

#

the wiki is like the only thing that hasn’t changed one bit since Microsoft took over

half walrus
#

i need to stfu and write an extension to fix it

lime pivot
#

you can make custom sidebars

#

the downside is you can’t style them nicely to match the alphabetical sidebar, and it doesn’t hide the alphabetical sidebar only collapses it by default

half walrus
#

yeah

lime pivot
#

which, like

half walrus
#

no way to search either

lime pivot
#

has absolutely not changed since like 2012

half walrus
#

if you go to the main repo

#

search a term

#

then select "Wikis"

lime pivot
#

it was like what’s the easiest way to make these people shut up about the wiki feature being bad

#

why don’t we just make a special page filename that if exists, will display above the file list, and collapse the file list by default

#

easy done

#

yeah gh search is uh slightly unintuitive at first

#

you’d probably expect a search bar inside the tab not on the top nav bar

half walrus
#

its almost unbeatable and yet still painful

#

i'm implementing what you wanted in the headers site via grep btw

lime pivot
#

oh I dunno, I did show you OpenGrok

half walrus
#

heavily debating whether it's worth setting up a database for any of this

lime pivot
#

it requires the thing to know how to parse the symbols in all the languages you use obv, but it’s still extremely cool

half walrus
lime pivot
#

there is also an official Google code search tool for AOSP now, but it only had the latest Android release IIRC, no indexes for old releases

half walrus
#

currently the biggest overhead is highlight.js, but disabling that on pages w/o code fixes that

lime pivot
#

there was always a Chromium one

#

Mozilla has their codesearch too, just used it yesterday

half walrus
#

ima throw this online now

lime pivot
#

Google used to have a thing called Code Search, which yeah, did what it sounds like, code search

#

people on hacker news still bring up how much they miss it whenever there’s a post about github

half walrus
#

wish google would just sell me a tool to search my own site lol

#

given that's sorta their shit

lime pivot
#

they have one, it’s just, amazingly bad

half walrus
#

yeah not that thing

#

something more integrated

tardy narwhal
lime pivot
#

Google CSE (custom search engine)

#

it’s not like the ā€œrealā€ google at all

half walrus
lime pivot
half walrus
#

speaking of

#

would you reccomend i steal your headers repo

glacial matrix
tardy narwhal
#

huh, thats why i left out a search bar on my own header service lmao. people can ctrl + f to find shit quick

half walrus
#

one i have rn uses whatever dump tool isn't RuntimeBrowser

half walrus
tardy narwhal
half walrus
#

gotcha

tardy narwhal
lime pivot
#

one of my favorite features of firefox is that you can just start typing anywhere and it’ll initiate a find in page

#

can also just tap / as I learned the other day

half walrus
#

i wrote some (bad?) logic that lets mine work based on class name without needing specific framework

#

which allowed some really cool stuff combined with highlight.js

lime pivot
#

however can I recommend something slightly overkill but definitely worth the trouble

#

for rendering code, use monaco-editor

tardy narwhal
#

I’m leaving it out though because I see no point in it

lime pivot
#

the editor component from vscode

tardy narwhal
#

while researching you have multiple tabs open anyway + a multitude of headers

lime pivot
#

then you get free regex search, case sensitive, etc etc

half walrus
lime pivot
#

and syntax highlighting

half walrus
#

if i can use that on a site

lime pivot
#

for header search hell yeah you totally want to

half walrus
#

because highlight.js highlights ok but it doesn't give me anything parsable

#

this is what i can do now

tardy narwhal
#

just use pygments lul

#

even has a logos lexer

half walrus
#

anything UIKit in the header browser you can click

#

and view the header for

#

and anything SB

#

also supports protocol headers

lime pivot
#

we gotta teach you about document.querySelectorAll() šŸ˜›

tardy narwhal
#

protocols are a bitch when dumped

half walrus
lime pivot
half walrus
#
  • speed
lime pivot
#

yeah, fair

half walrus
#

feel like a class based search is going to be faster than css rule based search

surreal mountain
#

gm

tardy narwhal
#

then again i think the editor would be useless for me or at least my case, headers are prerendered and just served as static files

lime pivot
#

querySelector is fast anyway, I mean you probably don’t need to care unless you plan for this to run on an iPhone 3G

half walrus
#

but using css rules can be nice esp. since i wrote nothing but reddit css and java for a couple years

#

and if u ever wanna learn css very, intimately

#

write a reddit theme

lime pivot
#

ah the good ole days where you’d scroll slightly too fast and just get met with CHECKERBOARD while it caught up with you

half walrus
#

the only way you can get custom html elements is abusing the sidebar and convoluted css rules

#

you have to use custom spritesheets

#

for monstercat we even had to build a program to generate them

lime pivot
half walrus
lime pivot
#

Reddit and CSS is such a fun thing

half walrus
#

^ i wrote that

#

i think i win

#

compared to the r/w98 sub

lime pivot
#

old reddit looks bad because it would break all the countless super custom css edits subs have made

half walrus
#

given it's hideous but

lime pivot
#

while new reddit has had CSS ā€œcoming soon!ā€ for the past 5 years

#

and is janky and unusable and I still can’t imagine humans actually use the new reddit

half walrus
lime pivot
#

god

#

why

half walrus
#

which

#

anything where you can say "if you spend 5 minutes setting it up it's usable" is poorly designed

#

like vim

#

new.reddit is vim

#

probably better but fuck that

lime pivot
#

like, if I’m logged out (which seems to happen more often lately idk why) it goes into fuck you mode where you see like 1.5 comments before it has a ā€œload moreā€ button (which actually is instant so it’s not loading anything, just toggling a css class)

half walrus
#

lol

lime pivot
#

then you only see like 3 comments into a thread before you have to keep clicking ā€œsee more commentsā€ to read the whole thing

half walrus
#

like twitter

#

which'd be way less annoying if

#

yknow, clicking a twitter link and having it open in a non-twitter app didn't mean i was logged out

lime pivot
#

yeah but I mean at least Twitter has an excuse because it’s a flat conversation view and tweets take up a lot of scrolling space

#

reddit posts are just a tiny header and footer, no profile pic and shit

half walrus
#

nsexcept actually made a tweak bounty for fixing cookies in in-app webviews

#

should look at whoever fulfilled it

lime pivot
#

hah I did want to make a tweak for that

#

cookie thing is dumb

half walrus
#

given how i handled H+ drm

#

not super trusting of that though

lime pivot
#

making the web on iOS hard to use and showing confusing ā€œSettings wants to log in using google.comā€ prompts my mum gets confused by but hey at least we solved like 3 companies using it to steal your Safari cookies!

half walrus
lime pivot
#

it’s like when Twitter was caught tracking the apps you have installed, querying thousands of URL schemes in the background, and now you need to declare each url scheme you want to open, and can only query up to 20 or some shit

#

incidentally, I think that also means the classic Cephei twitter cell code has been broken for some time, hasn’t been opening 3rd party twitter clients because it gets blocked from querying them

#

the new code ā€œworksā€ in that it only tries to open the official app via universal link, falling back to safari vc

#

which actually is probably a bad idea cause then you have to log into this dumbass web view with the separate cookies

half walrus
#

i should open source my DRM

lime pivot
#

lollll oh dear

half walrus
#

as a lesson in "what is the bare fuckin minimum effort someone can put into drm to make it work"

lime pivot
#

you know you can register a custom url scheme right šŸ˜‚

#

NSURLProtocol

half walrus
#

bare fuckin minimum effort

#

i should be clear

lime pivot
#

lmao I mean I can feel that vibe

glacial matrix
lime pivot
#

still hahahaha ow it makes me cry

half walrus
#

the paypal integration itself was extremely secure

#

i made sure of that

lime pivot
#

I’m actually surprised PayPal still lets you host checkout in a web view

half walrus
#

everything on my end that i can justifiably make poop was poop

lime pivot
#

Google banned web views for OAuth ages ago as well as a bunch of others

half walrus
#

it was hosted "on my website"

#

(which used the web view)

lime pivot
#

Cydia Store login was broken for weeks because you’d just get an error on tapping the Google login button

#

lucky saurik thought ahead and added target=ā€œ_openā€ to open safari

glacial matrix
#

(oh, lol, I just got an ad in japanese (instead of the usual en/es/fr) on youtube)

half walrus
#

man i'd love to throw this on gh but i don't want to get crucified because people see it and accuse me of being careless with genuinely sensitive data

lime pivot
#

eh

#

if you’re just using eg the paypal API as intended then it’s fine

#

it’s just a security measure for people who want to steal your login

half walrus
#

at least it used SSL

#

?

lime pivot
#

please log in with your google account in my web view! trust me, it’s fine!! frfr

#

I’m not gonna use it to drain your bank account via google play

half walrus
#

yeah the, stuff i could've done with my drm implementation had i been malicous

lime pivot
#

oh there’s sooooo much bad shit any of us could do at any moment

glacial matrix
half walrus
#

i was looking into hacks to make things work and, hm

tepid olive
lime pivot
#

it’s a miracle it’s so rare anything bad actually does happen

surreal mountain
#

good old times

half walrus
#

may or may not have exactly guessed why i named it that

lime pivot
#

worst I can think of is Unflod stealing Apple ID creds when it sends the API request to auth you for an App Store download

half walrus
#

"must be secure!"

#

lol

#

and it was fwiw

lime pivot
#

I’d hope so

half walrus
#

that was the most painfully locked down server i've ever built, solely because it stored udids

glacial matrix
#

have http://insecure.kritanta.me redirect to it

lime pivot
#

http://secure. is definitely something I’ve seen before

half walrus
#

disabled ssh from public ips

#

could only get in from another machine on my network

#

my network at digitalocean*

lime pivot
#

I hate that it’s even something someone built and signed off on, it’s not like a subdomain registers itself

half walrus
#

which all have password auth disabled

#

i could've stored them better ig

#

but now the only reason I can offer past customers the ios 14 version is bc i have plaintext udids

lime pivot
#

thing is, why store udids?

#

hash them like passwords

half walrus
#

(guess who's not giving me customer emails :))

#

i should've

#

but since i didn't, a few thousand people are gonna hate me a bit less

lime pivot
half walrus
#

oh wait you're right

#

i could still hash yeah

tepid olive
#

yeah if you have the hashing algorithm and salt (if any) you can just have the license check verify the hash

lime pivot
#

like you only need to test the current device’s hashed udid against your db when you’re in a request where you have the unhashed data anyway

half walrus
#

(lol)

#

we're discussing hashing a hash

undone nest
#

saves processing power fr

half walrus
tepid olive
#

Hash the hash with som big salt

#

SHA512 takes nearly no processing power

lime pivot
#

yeah I mean I was always hashing udids because I just really don’t want to be pwned and have all tweak DRM in the community be totally screwed

half walrus
#

you don't even need 512

#

extremely simple hash will do

tepid olive
#

Less about need and more about why not

half walrus
#

well yeah

#

but nobody is brute forcing a hashed udid

#

coming from someone who had a 2 week long project dedicated to udid-related brute forcing

undone nest
#

wouldnt that literally be like cracking a 40 character long password

half walrus
#

yes

#

20

undone nest
#

20?

half walrus
#

ur making me question now

undone nest
#

i just googled and it says its 40

#

ĀÆ_(惄)_/ĀÆ

half walrus
#

NSString *udid = [NSString stringWithFormat:
@"%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x",
result[0], result[1], result[2], result[3], result[4],
result[5], result[6], result[7],
result[8], result[9], result[10], result[11], result[12],
result[13], result[14], result[15],
result[16], result[17], result[18], result[19]

#

20

tepid olive
#

:fruhh:

half walrus
#

20 255 bit values

#

so uh

lime pivot
#

I’d say udids are easier to crack now than before though, with the new style that’s just chipmodel-ecid zero padded out

half walrus
#

wish they used that on watches sadCat

lime pivot
#

you have a fixed amount of possibilities for the first few characters, and zero padding means most of them will have plenty of zeros after the dash

half walrus
#

given thats why we were trying to brute force ecid in the first place

lime pivot
#

TSS backup sites could easily hoard ECID + device models for later bruteforcing repos with

#

of course Chariz will just auto ban you when it figures out what’s up but still

half walrus
lime pivot
#

I 100% don’t expect Packix to have any protection

half walrus
#

it's not rng

lime pivot
#

it’s not?

#

well I guess nobody really looked into it except you

half walrus
#

not fully

#

i wasn't the first actually

lime pivot
#

all they know is idk sometimes it’s long sometimes it’s short so it must be a truly random number

half walrus
#

like so many things i've gotten into, siguza seems to have all my ideas long before i do lol

#

i'm just idiotic enough to follow through on some of them

tepid olive
half walrus
#

is there a new style of ecid

#

and yes

tepid olive
#

no I meant UDID

half walrus
#

i can't speak for post A11 watches

#

don't have one

lime pivot
#

lol, who wrote a wikipedia page that basically just verbatim copied the iPhone Wiki page https://en.m.wikipedia.org/wiki/UDID

UDID is an acronym for Unique Device Identifier. The UDID is a feature of Apple's iOS devices. It is a unique identifier for a single device that is fetched from Apple servers when a user tries to activate the device using iCloud or the Setup app. This ID is also used by iTunes to detect the phone or to communicate with it while restoring the iP...

#

Not to be confused with IMEI
I mean I guess

half walrus
#

but checkm8 watches have the exact same format as checkm8 phones

#

thanks apple for changing identifiers at a very convenient time

#

wonder if there's anything related to the format change and the bugfix

lime pivot
#

yeah there are still heaps and heaps of pre-A12 in my db

#

but also plenty of A12/A13

half walrus
#

guess which retard did all of them in the old style

#

i did not anticipate needing to move to not handling my own payments

lime pivot
#

chariz welcomes you when you’re ready šŸ˜›

half walrus
#

and as such didn't write the logic to use new format where appropriate

tepid olive
half walrus
#

so is there any way you can have chariz hit my own server to check activation status

tepid olive
#

not like I have an Apple Watch in the first place

lime pivot
#

I go by emailing out token links rather than by udid anyway

half walrus
#

uhh forgot to tell you earlier than now but

lime pivot
#

oh poop

lime pivot
#

you didn’t get your paypal export?

half walrus
#

nope

lime pivot
#

aw fuck

half walrus
#

i can generate them and see they've been created, cant click, and i dont get the email

lime pivot
#

hah ok that’ll be a fun one to work with but it’s doable

half walrus
#

so

#

1 sec

#

hop on my server and please dont hurt me

#

@lime pivot no point in validating that when the pool of people who're going to try and bypass that on my server is very small

#

and said people will just see this in a disassembler and defeat it there first without needing to fuck with my server

lime pivot
#

could do but it makes me a tad bit uneasy lmao

half walrus
#

yeah i wouldn't do that for chariz

#

trying to think of how to handle that

lime pivot
#

man I look at my error logs and there’s still people finding their email for purchase transfers we did from 2017

#

they 404 now because moved to Packix and all that

half walrus
#

it took them several weeks to crack this tweak

lime pivot
#

not that any of those tweaks would even work on iOS 13 or 14 I bet, it’s been that long

half walrus
#

:/

#

i'd write good drm but the cracking scene is dead

lime pivot
#

hah

half walrus
#

why try

peak quartz
#

is there any tweak that never got cracked?

half walrus
#

yes

#

anything by spark

#

iirc

#

now again

#

the cracking scene is dead

lime pivot
#

I think it’s more that nobody even started working on cracking your tweak for a few weeks, rather than that cracking is hard

half walrus
#

lol that too

peak quartz
#

why cracking scene is dead?

#

every single tweak is cracked

half walrus
#

bc tweaks have shit drm

peak quartz
#

all of them?

half walrus
#

a majority yeah

peak quartz
#

so how does spark does that?

half walrus
#

bc spark is incredibly smart and incredibly good at writing complex code, and he's been doing it for quite a while

peak quartz
#

i meant his method

lime pivot
#

OSExperience was never cracked

half walrus
#

many weren't

lime pivot
#

he did accidentally open source his DRM when he open sourced the tweak, which was hilarious

half walrus
#

has harbor ever been cracked

#

swick walked me through how his drm works

lime pivot
#

I shouldn't say hilarious, it was amusing but a shame for him

#

unless that was the plan all along

half walrus
#

lol

inner quail
#

Piracy

half walrus
#

we're discussing drm

lime pivot
#

you said the bad word!!!!!

eternal crater
#

10/10 filter bypass

gentle crescent
#

please sop

half walrus
#

sigh

restive ether
#

loss

half walrus
#

why warn

#

cmon

peak quartz
#

im discussing ways to protect tweaks

half walrus
#

cant talk about drm in tweak dev channel

#

ffs

peak quartz
#

im not supporting any tool or cracking whatsoever

#

its just amazes me now that i know how this tool work

half walrus
#

can't protect against it if you aren't allowed to say what 'it' is lol

peak quartz
#

@half walrus you ever got the chance to look on how it works?

half walrus
#

ah

restive ether
#

that was instinctual

#

will fix

lime pivot
#

I amusingly broke the "it" tweak by complete accident and I think it was only recently fixed

half walrus
lime pivot
#

I see you are a person of culture

#

pronouncing Cydia the way grate god saurik pronounces it

peak quartz
#

i saw that once legit client downloads the package it gets uploaded to his server and then every other client just uses the tool to donwload it from there automatically

half walrus
lime pivot
#

sid-ee-ah

gentle crescent
#

yeah sorry I didn't see it was development chat

lime pivot
#

not siddy-ah like everyone does

gentle crescent
#

I'll lift your warns

half walrus
undone nest
#

slim uhh

half walrus
#

wonder where i picked that up

#

wait what's the difference

peak quartz
#

thats ok @gentle crescent @rotund oracle

#

thanks

lime pivot
#

like you're saying city in a cool way and then adding ah on the end

half walrus
#

like two syllables instead of 3?

lime pivot
#

yeah

half walrus
#

both of those have 3 syllables

peak quartz
#

is it ok to publish cdown website will all the debs?

lime pivot
#

refer to terrible talkboard episode recorded from my shitty macbook mic lmao

peak quartz
#

it has above 300gb of tweaks

#

ok i will not

half walrus
#

don't paste that here

peak quartz
#

k

half walrus
#

which, if u can get a tweak for free using said tool

#

that's not even cracking

#

that's just downloading

lime pivot
#

but your honour I didn't crack the movie I just downloaded it

peak quartz
#

@half walrus cant dm you

half walrus
#

same thing that annoys me about the app that extracts ipas from memory

#

now u can

half walrus
lime pivot
#

there's tons of those

#

one breaks and never gets fixed, a new one pops up

half walrus
#

i use the one all the pirates use

#

because dragon decrypt is broken

lime pivot
#

haven't needed it for ages but yes probably the same

#

I find it amusing Flex effectively has a crack tool built in and everyone just, pretends it doesn't exist

half walrus
#

flex or flEx

lime pivot
#

weird flex but ok

half walrus
#

one of them needs to rebrand i stg

lime pivot
#

the build your own return false one

half walrus
#

like i'm sorry coates, i know u were first, but its probably one of the more annoying things here

half walrus
lime pivot
#

hah too bad considering The Other Flex started outside of our community

half walrus
#
  • flex.ipa hopefully gets a rebrand and redesign
#

given supercharge is poised to entirely replace it at this point

#

it was useful as a header browser for a bit but now supercharge does that better

#

speaking of

#

runtimebrowser is broken on my phone on iOS 14

lime pivot
#

wen eta supercharge

#

aw really

half walrus
#

cant open the headers to view them

#

so not a bad bug, probably just a uikit one

lime pivot
#

I would rewrite that whole app if I had time

#

it's so slapped together and not changed since like iOS 4

half walrus
#

if you rewrite it, just use my website

#

i was thinking about this yesterday

lime pivot
#

RuntimeBrowser 2.0 but it's actually just a web view to krit's website

half walrus
#

.

#

.

#

have normal UI but pop a webview every time you open a header

#

when you click a link in a header, use the hack i used in my DRM to hijack the link

#

- (void)webView:(WKWebView *)webView runJavaScriptAlertPanelWithMessage:(NSString *)message initiatedByFrame:(WKFrameInfo *)frame completionHandler:(void (^)())completionHandler when a website in an alertview calls alert() in the JS, this code triggers

half walrus
#

lol

lime pivot
#

keep that thing away from me

#

😰

half walrus
#

have a better way to transfer data from js to objc?

lime pivot
#

NSURLProtocol

#

and there's a JS message events API something something don't remember exactly

#

for two-way message passing

half walrus
#

ykw fair

lime pivot
#

hahah I can respect the hack works though

half walrus
#

pretty sure that hack is a krit original, i'm proud of it

lime pivot
#

that's insane and amazing at the same time

half walrus
#

let me see what message was

#

TXID

lime pivot
#

alert("if you see this what the fuck are you doing")

half walrus
#

this is where i didn't validate it

#

so i sent the TXID via alert()

#

to the tweak, who then messaged my activation server (not on the same machine as the one hosting the paypal view just for minimal security purposes)

lime pivot
#

I mean that separation is slightly more effort than I put in

half walrus
lime pivot
#

I'm not confident it's actually worth the trouble

half walrus
#

you could've sent it literally anything in the payment field and it'd accept it

lime pivot
#

especially when PayPal is the one doing all the sensitive stuff and I don't need to be compliant with payment industry regulations in an 800 page pdf

half walrus
#

i wasn't wondering "if" it'd get cracked, far more interested in which route they'd go

#

in retrospect the tweak cracking itself to activate kind of sealed that deal

lime pivot
#

I think that kinda does hurt the DRM scheme

half walrus
lime pivot
#

like, if you can just grab the dylib, you just package that up on your pirate repo, right

half walrus
#

sigh

#

yep

lime pivot
#

but yes, agreed, sigh

half walrus
#

running redeb after you pay is all you need to do

#

removed all of the activation checks once i realized that

#

'cept for the visual one

#

wish it were possible to ship a paid tweak without any drm, but then how do you make it paid

lime pivot
#

repo is your DRM

half walrus
#

we've come full circle

lime pivot
#

well… that's not exactly great

#

just needs one person to buy it for it to be "cracked" aka silently uploaded by the "it" tweak

half walrus
#

funny how i hate drm given how much drm shit i've written

#

i do want to use some of my new stuff when h+ is on chariz

#

@gaunt mesa has seen a small piece of it

#

unshimmable udid code

restive ether
half walrus
#

i was wrong, luca's libsandwich cant bypass my code

lime pivot
half walrus
#

you'd need tfp1 to bypass it

#

well, you'd just want kernel r/w

restive ether
#

yeah im sure just about everything in that database is wrong

lime pivot
#

yeah I mean it seems kinda obvious that a visualiser tweak will be rendering graphics and rendering graphics consumes energy and energy consumes battery

half walrus
#

doing it through dyld would make you repeatedly cry

#

if you even could

#

i should take it further and remote the IOKit.framework dependency lol

#

make it literally require kernel r/w to bypass

#

unless, @ muirey, I'm assuming IOKit talks to the kernel using mach ports(???), would there be a way to intercept that and change data now

#

nvm billy's youtube video walks you through writing a fuzzer that does that

#

cc @peak quartz

#

the Yes button is broken

peak quartz
half walrus
#

you have to click no

#

and then it lets you in

peak quartz
#

also good

half walrus
#

polish website

peak quartz
#

yep

#

178gb of tweaks

half walrus
#

none of mine

peak quartz
#

no way

half walrus
#

see this is why people add pirate repos though

#

everything is in one spot

restive ether
#

also we’re working on exempting most / maybe all piracy words from development, will probably finish tomorrow

half walrus
#

pirate repos are just Netflix for jailbreak

half walrus
#

tryin not to get pixelomered

restive ether
#

well...he was just stupid

half walrus
#

so am i

restive ether
#

i tried vouching for his unban then he makes me look fucking stupid by doing the same shit nfr

peak quartz
#

what was the story?

#

im not updated

half walrus
#

he bypassed the filter

#

not to say something bad just to do it

tepid olive
#

@tepid olive, Couldn't find anything matching that search query!

restive ether
#

he exploited tf outta the bot, got banned for it, unbanned again under the condition he doesn’t do that then did basically the same thing again

peak quartz
#

did he opened a CVE?

half walrus
#

which is in character for anything jailbreak dev

#

i wouldn't expect anything less

restive ether
#

yeah

half walrus
#

thought he was bakc

#

ah lol

#

that's dumb

#

let him break it

#

its what we do here

restive ether
#

he got banned for fucking with paracility

peak quartz
#

i agree

restive ether
#

because it’s not our bot so he could fuck with it anywhere else

half walrus
#

still dumb

#

its free QA

grim sparrow
#

Aarons not hosting a bug bounty mate

restive ether
#

lol

#

isn’t our bot to even make a bug bounty off

half walrus
#

not paid

#

but not banned lol

grim sparrow
#

Damn I should be paid for telling Slim his filter was broken

restive ether
#

it would’ve been fine if the exploitation wasn’t so spammy tbh

rotund oracle
half walrus
#

and for fucking with a bot that isn't even ur guys'?

restive ether
#

well

half walrus
#

that's their concern then

restive ether
#
  1. he could’ve added it anywhere and it’s what aaron said to do
#
  1. he broke their backend doing it
half walrus
#

still their concern tho

restive ether
#

and it would’ve been fine but people kept spamming it and making it worse nfr

half walrus
#

contact them if pixel wont if it's such a concern

nocturne yacht
restive ether
#

we didn’t know what he was doing

half walrus
#

ppl write shit code

grim sparrow
half walrus
#

unsurprising

restive ether
#

blame renai

nocturne yacht
half walrus
#

probably didn't wrap main inside a while True: try except

tepid olive
#

I'm gonna make my depiction '); DROP table packages; --

restive ether
#

actually idk who wrote the backend could’ve been sonic, shuga or renai

tepid olive
#

or $(rm -rf /)

half walrus
restive ether
#

just removed two pages worth of redundancy from the filter

#

true

half walrus
#

bonus points if you have it email you when it crashes and you get your inbox destroyed

grim sparrow
#

True!

tepid olive
#

speaking of input sanitization, when I released an update for my Icon Themer shortcut that generates profiles on my server rather than locally - which allows me to sign the profiles and collect anonymous usage stats - it seems like somehow it was not downscaling the icons properly

grim sparrow
#

lol

tepid olive
#

since it is very popular, it generated about 30000 .mobileconfig profiles daily (I have a cronjob auto-delete anything older than 24h)

#

and they took up like 50 GB

grim sparrow
#

L

half walrus
#

mm image scaling in objc

restive ether
#

apple must love that

tepid olive
#

I added in an imagemagick resize in the server code, now 30000 profiles only take up 1 GB

half walrus
#

steal H+ code for it

#

i suffered so others can live

tepid olive
grim sparrow
tepid olive
#

they fucked with it so much in 14.3 that they introduced a bug that can bootloop devices by just installing a webclip

#

still waiting for Apple Product Security to reply to my email

half walrus
grim sparrow
#

Senua from Hellblade

half walrus
#

always wondered

grim sparrow
#

Haha

half walrus
grim sparrow
#

Hellblade is one of my favourite games to exist, and my pfp is from the trailer for Hellblade 2

tepid olive
#

true

half walrus
half walrus
#

imagine a black bg there

tepid olive
#

imagine if the piracy/scam sites figured out how to make a bootloop profile

#

slide to jailbreak bootloop

grim sparrow
#

lol

half walrus
#

the stuff they did to velox to crack it

#

holy shit

tepid olive
restive ether
#

i bet it nukes your battery to accomplish the job

half walrus
#

like honestly thank god h+ cracked itself

#

so they couldn't fuck it up like they did with velox

restive ether
#

i’m pretty sure they only cracked velox out of spite

half walrus
#

90% of our crash reports were pirates

restive ether
#

so it’s just bad

grim sparrow
#

They should of just rewrote the tweak then

#

Ezpz

half walrus
#

was daniel taunting them

restive ether
#

no

#

i think tr1 was lol

grim sparrow
#

I thought it was burrit0z

restive ether
#

it was one of them

#

might’ve been both

half walrus
#

iirc both

grim sparrow
#

because they sent death threats to him when it was cracked

primal perch
half walrus
#

not their fault though

#

well

#

it was their fault but who fucking cares

restive ether
#

i think burritoz was making fun of how bad their multipla crack was

half walrus
#

daniel got pissy

#

like do you not get how it'll end up helping sales in the end

grim sparrow
#

I still don’t get why pirate repos mirror free tweaks on default repos, other than to inject malware

half walrus
#

i didn't have h+ numbers to show him at that point but /shrug

restive ether
#

i refuse to believe they mirror shit for fun

restive ether
#

i’ve never compared the files though

grim sparrow
#

They admitted to modifying the system

restive ether
#

i like how they try to block competing piracy repos

grim sparrow
#

Yeah that’s one thing they do

half walrus
#

they mirror shit because it makes them incredibly convenient for users

grim sparrow
#

Mr Landres modified the host file to block other pirate repos

half walrus
#

my repo list is saved in my icloud backups or honest to god i'd probably use one

grim sparrow
#

Which is just funny imo

restive ether
#

it doesn’t even work

half walrus
#

because it's so much easier to go to one repo and get everything you need

#

have to add two github.io repos to install Flexall

restive ether
#

i think it’s funny because they mirror but a lot of tweaks these days check if the ID was changed

half walrus
#

@twilit jungle pls fix

restive ether
twilit jungle
half walrus
#

who's the reason for that

twilit jungle
#

The fix is to use FLEXing fr

grim sparrow
#

Pirate repos don’t even have my 2 free tweaks smug

restive ether
#

should be standard practice just to troll them

half walrus
#

just be 2 molecules nicer if i didn't have to add that guy's repo

#

not his biggest fan anyways

twilit jungle
#

await FLEXing doesn't use libFLEX?

grim sparrow
#

Kinda sad how I’ve been working on an nfc tweak for ages, and my main phone doesn’t even have working nfc

half walrus
#

i wrote without a jailbreak for a while there

#

when 13 dropped iirc

twilit jungle
#

You can always install the 0.0.11 version (its an old version of FLEX but doesn't have the dependency).

half walrus
#

pre-checkm8

grim sparrow
#

My whole motivation was putting my school card in wallet, now I’d have to carry a 2nd phone for that

half walrus
#

so when i updated i kissed jb goodbye for a few months

grim sparrow
#

I just want the flex of using the Apple Pay interface to beep into school

half walrus
#

or even just bundle and provides: it

#

shit that reminds me

peak quartz
#

@half walrus do you have any way to blur the background in general and not an image?

half walrus
#

that one weird dude is maintaining mitsuha now

#

need to update statusviz

half walrus
#

for the 3 weeks it has an active maintainer

half walrus
grim sparrow
#

I’ve done it a million times before but I’ve forgotten the exact way lol

peak quartz
half walrus
#

how did you get the bottom screenshot

peak quartz
#

Instalauncher2

grim sparrow
half walrus
#

.swift

grim sparrow
#

Shush

#

Just translate it ezpz

peak quartz
#

Not

restive ether
half walrus
#

.

#

why do i remember everything i say

#

but i can't even find my damn shoes most days

#

we have reddit too

peak quartz
#

I will pay a lot for this kind of extension

grim sparrow
#

One exists for ObjC to Swift, but they said they couldn’t do it for inverted because of the issues it could present

half walrus
#

not a real converter

grim sparrow
#

I personally just learnt both languages fr

half walrus
#

just a basic syntax converter

twilit jungle
half walrus
#

the only color they ship in is white

#

or that

#

it comes with all the social media apps installed

#

but

#

all you can do is delete the app

#

censorship

#

we only censor liberals

lime pivot
#

just hide Made in China on the SIM tray ez

half walrus
#

so they're banned from our platform

#

how do

lime pivot
#

it's just the SIM tray we outsource to the chinese government-run slave labour! obviously!

half walrus
#

i dont get the thought process

#

forced the mods on r/trumpcriticizestrump to not ban trump supporters

#

just to make a point

#

didn't even devolve into chaos

lime pivot
#

ever just taxed truck imports so high that the only example of one any american can think of is F150

half walrus
#

we shut it down yesterday

lime pivot
#

we should tax iPhones so everyone buys those US-made smartphones instead

half walrus
#

taxes are authortarian

#

unless it's taxes on womens products

#

in which case removing that tax would be socialism