#development
1 messages · Page 373 of 1
Failed to spawn: unable to find process with name 'UIKit'
anyone know how i can attach to uikit using frida

so if i wanted to log the methods that are called within a certain class inside the uikit framework
how would i do that.
instead of nslog
yes
u can get notified when ur phone hears shit
Its not a "special" override flag, Security is literally loaded into every process
yea so i have to NSLog everything i am looking for
i need to check all method called within a certain class in the UIKit framework. i can do this with NSLog statements but it takes forever
so i wanted to use frida to do log them for me
or

yea i am just going to use NSLogify
squidward twerk
use Lookin
Lookin?
which has the ability to trace method calls
which is what I assume you want
or lldb
or ghidra
nslogging every function called is rarely the best way to do something
or IDAs debugger which is insane
yep steep learning curve
yea i am going to leave that alone for nwow
i just want to trace the methods in the class so i can know which ones are useful for me
i agree
krit you use lookin alot?
yea i have both of them but no idea how to use them. i only know how to set breakpoints. pause . continue and next line lmfao
apple just autocorrected “though” to “tomboy gf” ok

wallet still has PTSD
so divide the third by 2
and pretend that’s a reasonable fix
i have no idea how tf to use lookin
nvm i have to embed fw
oh wait this is for xcode projects
Xcode pure cringe software
It’s just bad
You would think it would be good after 10 years of updates
But still too bulky
And buggy
facts it is too bulky
macOS is just too bulky as a whole
Every month or so I have to clear about 100gb from ~/Library
Prob
And iOS backup even tho I have iCloud
iCloud surprisingly just works
false
i haven't cleared my hackintosh ever
HOW
wait this might be the annoying one though
Im gonna use yours
I found this
Its in chinese i think
where if you shake phone its gonna keep on showing up lookin shit
alright ill use yours and see
alright
its working but i did safe mode once. ill keep testing it
@misty cradle @half walrus with lookin can you print all methods within a class instead of just one specific
this is lowkey pretty nice

I just wanted to see the UICalloutBarButton method calls
I wasn't, but I'll take it
true

leave those kids alone*
in the basement*

@gaunt mesa 
at least leave someone to watch them
When NSLogify works first try with 100+ methods 
its a song
thanks for volunteering
there are 420 of them but dont' worry
WTF
@grave sparrow please make the drm silent
ok
am just a cat
oh ok carry on
"moo"
carry on my wayward son
thats like their only banger tho
dust in the wind tho

too sl0w
true
Free bird goes hard every time spotify plays it when I forget it exists
fleet wood mac true
free bird so fucking lONG
bro it slaps
lol
literally you listen to exist
and ur gonna tell me it’s too long
i dont really care about length yea tru

most metallica songs
f
disposable heroes too repetitive
it’s still a banger even tho it is a little
its like the song's main feature is just being loud
too bad the production is not great
time to play guitar
wakey wakey time for scoo

I can play thunderstruck on clone hero

you aren't a real guitar hero if you play a real guitar scoob
true
fake guitar hero scoob
yea then i clap ur cheeks when we play online
it’s been forever
f
altho he did beat me on something
bat country maybe
oh
Why not?
it’s a better investment than weed
dude you should it's so much better
fr
fr

on a real plastic guitar
true
many a time
cod mobile dev cursed
trollfr
wtf
lmfaoo wtffff
making hax because the il2cppdumper now makes structs out of every single game class it's fucking crazu op now
structs


wtf
100k structs takes ida over half an hour to get its shit together

what cpu
You should use [redacted] instead
then again it probably doesn’t matter much because it’s single threaded
or if it isnt they shouldn’t do analysis on the main one
Does anyone know where the anisette data one time password is? That question is probably phrased wrong lol

wt shmoo nitro

got a year of it thanks to my friend
this is expensive lol
definitely not paying for nitro again after it expires
it's $50/y for classic
i couldn't get a dev account if i wanted
no mac?
no will to live
no, i'm not 18
for someone who pays for discord i expect better customer support
like your mommmm
giving money to discord L
mfs be paying for discord nitro
Ah, Couldnt you just register a small business under parents name. Then create dev account under that
nice

i gave 1$ to microsoft and got my 3 months
well no one will gift it to me
i just be askin radnomly someone give nitro
or does it stop being personal
and they give
currently in the process of doing that, but i don't need a dev account it's not worth money
especially as i'm slowly losing all my interest in ios crap again
_ _
just get some interest
how
just like
put it in your savings account
do stuff
Yeah fair enough. It is a big commitment when young because its a lot of money
and enjoy 0.1% annually
not even that
i could pay it but why
:literalwhy

It is still a lot of money though. Especially if on min wage at 17
@restive ether the problem is that i don't care enough to make an actual app, and doing anything remotely jailbreak related is just irritating
work on .NET stuff 

i’m sure you’d love that

like i have the money to pay for an apple dev account but i would rather not
thats why flip shoe and sell tweak 
L
hope it was worth it 
definetely was
becoming a certified kubernetes administrator is really good for internships and jobs
collect all the certifications
that's a little expensive
even the stuff i can take an exam for
i would have to fork over like $2800

good for marketability though
man like me would find the exam for free 💯
if you get a job at some places they might even cover it for you
or just finesse it out of them for free
mfers pirating exams wtf
well the one from the linux foundation is the officaially recognized one
@restive ether nobody said anything about pirating
yeah, but it doesn't hurt to have a few prior certifications
cuz that's a good hiring point
but yes its an option 
pirate old copies to get good
i’m certified in the windows office suite 
no
i pirated many of old act tests and then its an easy dub
what the fuck is a kubernetes

container orchestration tool
i'm not even gonna bother explaining cuz i doubt u care anyways
i care 
then read at https://kubernetes.io/ 
that's docker
and it can expand as much as u need it to
this is multiple shits in multiple containers running
false
where did vibeok go
LOL
i like the new mobile feature

it goes fast bro
RIP 
now i have to use the stolen one
very nice
_ _

i will be joining the devteam of one possibly soon
one where i will actually do something bc i like it

idk
prefectly fine if you dont mind updating the offset everytime
sounds abhorrently crusty
but yea that would work
mf really said abhorrently
true
well its my native language so its no surprise id get good vocabulary
no thats tr1's fault

“You’re the first one to point out the meaning of that correctly in my 30 years of teaching this poem”
true
i got this today
“You’re the first one to point out the meaning of that correctly in my 30 years of teaching this poem”
felt good
true
bread brick
brick
iphone
scoop

wtf
+(id)buttonWithTitle:(id)arg1 action:(SEL)arg2 type:(int)arg3 inView:(id)arg4;
@end``` ``` UICalloutBarButton *button = [[%c(UICalloutBarButton) alloc] buttonWithTitle:@"LOL" action:@selector(lol) type:6 inView:self];```
is this correct or not. seems pretty wrong but just asking
okay good
lmfaooo
^
if i dont alloc this would technically be correct
yes
only alloc a class if you're calling an init method
I’ll fucking murder you in your sleep @grave sparrow
finally peace
purging all your data and reinstalling MacOS on a macbook is a pain in the ass
I alway get issues with unmounting disk that is why I wanna slam my head into a wall when I do it
Honestly installing windows and linux are much easier
true
And does the 5 year old method not exist anymore?
What was it called? generally prefixes of things get renamed so you could look for that. Otherwise time to find a new approach.
Yeah pretty much scraping through header sites or sdks for similar terms.
Its got its own framework
Disk utility is fucking dead
Anyone got a download link for the lastest catalina so I can make a bootable USB
How could i add a object to this subviews array. Its hard to explain so ill explain the heirachy. I apologize in advance because i am not sure.
MainView>Subviews(array)>UIView>subviews(array).
Is it even possible to do this? One way i could think of is for loop.
yes
Yea 😂 no idea
I am trying to add a button to the calloutbar
I added it. But without no background

It works the way its supposed. And it enherits UICalloutBarbutton
But i think i added it to the wrong view. (Uicalloutbar).
All the button including copylog are in the....wtf i just found a bug while typing

I think i am hooking into the wrong method
Or actually nvm. I think im good but i just need to add it into that view
@twilit jungle enabling dnd and disabling is hard for some reason lol
I don’t think a beginner would be able to find it out that easily
I had to look into flip switch source to figure it out 

Whats dnd?
True
@tepid olive ok wait
DNDStateService *stateService = (DNDStateService *)[objc_getClass("DNDStateService") serviceForClientIdentifier:@"com.apple.donotdisturb.control-center.module"];
// check if dnd enabled
BOOL doNotDisturbModeEnabled = [[stateService queryCurrentStateWithError:NULL] isActive];
DNDModeAssertionService *assertionService = (DNDModeAssertionService *)[objc_getClass("DNDModeAssertionService") serviceForClientIdentifier:@"com.apple.donotdisturb.control-center.module"];
// disable DND
[assertionService invalidateAllActiveModeAssertionsWithError:NULL];
// Enable DND
DNDModeAssertionDetails *newAssertion = [objc_getClass("DNDModeAssertionDetails") userRequestedAssertionDetailsWithIdentifier:@"com.apple.control-center.manual-toggle" modeIdentifier:@"com.apple.donotdisturb.mode.default" lifetime:nil];
[assertionService takeModeAssertionWithDetails:newAssertion error:NULL];
// then always after enabling/disabling post this notification
[[NSNotificationCenter defaultCenter] postNotificationName:@"SBQuietModeStatusChangedNotification" object:nil];```
@tepid olive so you can save that state service as a property to always check if it’s enabled and everytime with the assertion service disable/enable dnd
Flip switch maybe
That’s where I found it
L
Then it was either here or idk
I’ve sent it before
No
You might wanna change those objc_getClass to %c so it caches
And get the headers
True
Sometimes I just be doing NSClassFromString Bc too lazy to type objc get class blah blah blah 
cryfecta
}``` what is a good if statement i could put here to isolate the view i want
It was literally 10:07 10 mins ago
gm we only speaking facts here
yes
objcGetClass or objc_get_class
@burnt niche well as good practice, you never want to get a view through view.subviews
If u just wanting to print its fine
But if u want to use it, find another way to get it
It may be a pain (sometimes) and take time but it’ll be worth it (or not)
damn there is no way bruh... i been looking since 7 in the morning lmfao
its 2 pm now
there is always a way
Ok I need to finish my pooping now and start run
The last one i click with. Subviews as buttons
Dgh0st will help u
someone new to tweak development can definitely figure that out.

i want the subview of uicalloutbar. So i can add a view in that view
You also don't want that
Unless you are changing how the views look in general
I mean you can do it that way but you are going to get a lot of bugs with edge cases
I just wanna add this button to where it belongs so he has a background cuz rn he lookin very not Fresh
I think there are some methods to add shit to that menu
The way I would go about this is figure out how the UICalloutBarButton is usually created, then modify the model (MVC) to add your new button.



How could i figure out how its created.
Doing 3 things at same time can’t think
Just by tracing methods ?
Lots of way to do that. Tracing methods is one way.

Damn honestly im burnt out for today.. its so easy to hook apps versus springboard/uikit

Apple watches have virus’ that force u to workout 
might throw copylog in ida pro real quick 

10/10 recommend getting 
Bruh
Yes I am running to Taco Bell now
Don't steal other people's research if its not open source and even then ask.

i was just kidding
Were u tho
yea im not going through that
Or are u just trying to protect yourself 
I’ve reversed gh0sts paid tweaks so many times


i wouldve never said it if i was going to 
Yes u would, u just wanted a reaction from us
if it makes you feel better i have it loaded up in ida rn
See bro I was right
This psychology shit too easy
I should become a pushy oslog list
Yes
A pushy oslog list
:frbruh:
I just spammed some buttons which look like pahychoskgist
And wait for auto correct to make it correct
@import UIKit;
@interface UICalloutBarButton : UIButton
+(id)buttonWithTitle:(id)arg1 action:(SEL)arg2 type:(int)arg3 inView:(id)arg4;
@end
@interface UICalloutBar : UIView {
NSMutableArray *m_extraButtons;
}
-(void)lol;
@end
%hook UICalloutBar
- (void)updateForCurrentPage{
UICalloutBarButton *button = [%c(UICalloutBarButton) buttonWithTitle:@"LOL" action:@selector(lol) type:6 inView: self];
button.hidden = NO;
[button setFrame:CGRectMake(240, 0, 92, 36)];
}
%new
-(void)lol{}
%end```
this is my current way of doing it. its horrendous
i tried mshookivar to extra buttons and adding it to them
if it makes you feel better i have it loaded up in ida rn
@burnt niche also nothing makes me feel better other than happiness of family and friends and money
Trollface.png
So what I was saying, try to do your own research, ok workout time gn
RE -[UICalloutBar configureButtons:]
@twilit jungle thank you i ll look into it. i was just about to look at nepetas open source for selector. but ill try to do configure buttons first. is there any way i could put that into ida? that is not possible is it ?
i can start out by logging the argument and see when it gets called and the value of the argument
7.5 pro
may i trouble yall with another one
how would one go about retrieving this binary 
yes sir
idk the path to it
ios 13
i have the latest
uninstall 12?
is ghidra also good
I use it sometimes but i never tried it with mac/iOS binaries
Ghidra just requires more work I guess
A team talented enough could just reverse engineer the ios sdk and make a foss port to linux maybe
obv it would be a lot of work
but still cool if it ever happened
im not saying "from scratch"
im saying "based on reversing existing binaries"
did something happen
you good capt?
whats wrong capt
self.slcTranslateItem = [[UIMenuItem alloc] initWithTitle:@"Translate" action:@selector(slcTranslate:)];
self.slcSearchItem = [[UIMenuItem alloc] initWithTitle:@"Search" action:@selector(slcSearch:)];
return orig;``` vs ```
self.slcTranslateItem = [[UIMenuItem alloc] initWithTitle:@"Translate" action:@selector(slcTranslate:)];
self.slcSearchItem = [[UIMenuItem alloc] initWithTitle:@"Search" action:@selector(slcSearch:)];
return %orig;```
is there any key difference ?
explains alot
Depending on what %orig does, the second approach could also end up changing the value of both of those variables.
Thats probably implementation specific
Right
Even if it did have duplicates, they are just pointers so they should both point to the same thing.
Ok Tr2Fecta is back
3 mile ran true
eh just complain to apple that you’re still getting them right after m2 launches
free m2 
After a few times yes
they upgrade people all the time when shit goes defective
not always
but sometimes
But chances of getting a defective 3 in a row
@grave sparrow nah they upgrade if they have to replace like 2-3-4+ time
U just have to act very nicely with them too
Manipulate them
that reminds me of amds rx 5000 series shit was just broken
Ez
get macos they said. it’s more stable they said

seems more likely it’s just macos bugs interfacing with m1 tho tbh
and not a hardware fault
why not

get a kernel cache and check the offset - kernel slide
then you can see what caused the panic
the function

if they’re symbolicated you could find the guilty function
and report it
idk
then ur boned
and you get a replacement

0xfffffe306734f4e0 - 0xfffffe0019d50000
that offset in the cache should be the address of the guilty function
the most recent backtrace
idk isn’t it in the fs
System/Library/PrelinkedKernels/prelinkedkernel
/System/Library/Caches/com.apple.kext.caches/Startup/kernelcache
one of those
probably the latter
or the easier way
add keepsyms=1 to boot up
and next panic will have symbols
Just add keepsyms=1 to either the Kernel Flags setting in /Library/Preferences/SystemConfiguration/com.apple.Boot.plist, or to the boot-args NVRAM variable. Reboot, and any subsequent panics will be automatically symbolicated.
Just add keepsyms=1 to either the Kernel Flags setting in /Library/Preferences/SystemConfiguration/com.apple.Boot.plist, or to the boot-args NVRAM variable. Reboot, and any subsequent panics will be automatically symbolicated.
Is there an updated version of selector on github?
macos moment
making you jump through hoops to modify your computer
f
windows too but the security is shit so you can just modify registry
registry is garbage
wtf
@grave sparrow that frameworks folder has uikit not uikit core.
you don’t
Okay thanks
if it’s just a local variable then it’s a compiler thing and you just can’t modify it in the language
if it’s a static constant then it’ll be in the const data section
it has to be one of those two
either local or static storage

Gn @everyone

True
Yeah, no that would be bloat.
im brain hurt
@grave sparrow couldnt you distinguish by “type”?
Since one is a constant and one is a normal variable?
@smoky bluff yoshi
types are compile time construct
true
Btw thanks for that method, helped me alot. Just need to re it i put it in ida
Rn
many compile time things are just to make code more readable and maintainable
like const half the time it’s used in c++
what you want probably
assuming the property descriptor even changes between let and var
swift might not bother
how do you think header generators distinguish them
it can’t be a compile time thing only
Its compile time only, except for Obj-c
Obj-c saves everything for runtime
I would hope Swift doesn't do that if it wants to have the speed
Scoop do you like cfa

Buy my sandwiches
@grave sparrow wouldn’t ida docs have something that might help you
@eternal crater i literally just bought one how high are u
Damn I coulda saved you money
dude
I am sober at work for now
i give up
No you didn’t wtf
i try again later with minesweeper
I thought you were from my doordash days
wtf
true
Did you enjoy your sandwich lol
i didnt get it yet
O
i will enjoy it tho

does someone know if i can intercept stdout without redirecting it completely (i need the output in both the console and the file)
cross platform though
are you sure tee doesn't exist on windows
Just make it redirect to your tool which then writes to file and stdout

that's the problem
and if i do it with nodemon --inspect dist/index.js > logfile.txt it only writes it to file
methname
new to WSL - i am trying to compile certain tweak (other tweaks compile fine) but its giving me a shit tone of these errors, what am i missing?
Foundation
which means?
Missing that framework
how is that possible, other tweak compile just fine with the same WSL env and SDKs
dunno what that means but i can go with either option

I am new to WSL, tried to find that question online ofc
but @twilit jungle answer solved my issue, foundation was the problem
wasnt targetting anyone particularly, most of what i say is a meme @peak quartz

f
f
What r word?
whats the best way to check if a tweak is installed other than if /var/lib/dpkg/info/<ID>.list ... exists?
i want to have the option to use my tweak without activator but i want it to listen to activator actions
as in - not force it as dependency
if remove libactivator from control the tweak wont show up
check dylib
Ask the user to tick a box 
/Library/MobileSubstrate/DynamicLibraries
but if the dylib name changes, im screwed?
ah no just activator wont work this is fine tho
it means to regard
its more complicated than i thought, TWEAK_LDFLAGS = -lactivator and no activator installed == tweak is not showing up
its like i need to add logic in makefile
add this to the meme
Did you just make this
amazing explanation, thanks
lol
cant i add activator without the -l?
what does that mean?
got it, i will try this weak import stuff
@grave sparrow what do you think about that NSClassFromString? no need to include -lactivator, if its there it will find it
thank you
Yes sir
Can someone edit this to documentation instead of manual
lol
James May is so iconic it’s fantastic
i've literally been waiting 9 fucking hours and counting for ida to finish processing this cod mobile binary with all the scripts and structs generated by the unity dumper
what a waste of a day
280k structs
literally been not responding for like 4 hours
after synchronizing them
F
idk what yall are talking about but true

😂
no this feb or march lmao, worked out a deal with my homie’s host
getting free xeon e5 vps’ as needed
one of you has to show me how to setup mc though lmao
Its literally just run one command

not even troll thats literally it
no no, setup as in limiting who can join etc
the easy way is just whitelist add DGh0st from the server cmd line
true
i gotchu
i need 
i dm’d Jules and he told Jerry bro. that’s the way to go
true
Yeah don’t
Disassembling the shared cache should become a benchmark for PC’s now
that was quick
Throwing 280k structs into ida should be the benchmark 🤣
I moved my mouse and it stopped responding again
this truly is the saddest timeline
is this on big sur?
I don't believe so
i swear big sur does some weird thing that when the CPU is pressed it'll heavily reduce the UI's framerate and switch the mouse to 5hz
pretty much the only reason i've had to offload a lot of work over to my server
literally all I wanted to do today was hack cod mobile and instead I wait 10+ hours for ida
mood
and it's still not finished
yes
7.5?
i think imma hop on modern warfare for the first time in 3 weeks
Jerry once said if you give up on ida, ida will give up on you
was this with wine?
only because I threw a 100+ mb script at it and 280k structs right after
most of us run IDA 7.0 native
no it's native 7.5
well the people that can afford it have 7.5 
but still feels super bad
honestly running 7.5 with wine runs amazing
performs the same as windows for me as far as ive tested it
i am happily turning away from low level stuff like this
wait what
I really wanna point out that what I am doing is such an extreme use case that I kinda understand
how long it is taking
but still it's a bit ridiculous
you put the cod mobile binary?
yea holy fuck ol
the bin finished analyzing in about 1.15 hrs
the good are C webservers, bless not using trash ass javascript
then I threw the first script at it to symbolize
which took 2.5 hours
then I imported 280k structs
in all fairness the industry standards are stuff like express ¯_(ツ)_/¯
which is what has been taking like 6 hours so far
true but javascript should really die
how did you guys learn to utilize ida. docs/reserach?
facts
that's a bit too much don't you think?
i wish i knew js
just use it every day and you'll get hooked
its really useful
its literally used in everything
especially considering i can combine it with so many things to achieve very nice outcomes
no. the lang makes no sense whatsoever and remains dead until invoked, almost like functional languages but if you invoke it, it has side effects like?? why
if i knew js. frida would be so much more fun to use
afaik there’s no actual program loop or am i mistaken
but it’s not similar to a regular program’s main loop/ thread or is it
i can afford $0

in terms of swift look it up on the swift docs/ apple’s swift wiki
theres a doc on how the symbol names are generated
low level ops + swift = possible increase in depression, anxiety and/or suicidal thoughts
same with decoding x86
why ida why
my sanity wasnt feeling it
waste my entire day why dont you
idk, i'm pretty sure js is more similar to the way python runs
literally sitting here with a depression headache
@tepid olive
probably but js is way faster
I havent given up hope yet
the python interpreter everyone uses is strictly a cached interpreter whereas every half decent js implementation uses dynarec
that’s the spirit bro

lol
that being said the overhead of DOM nullifies all that so thats why electron bad
v8 is a living breathing thing that needs to be coaxed to work properly
I mean if you do python in an OOP fashion that quickly fades but then again thats valid for js too isn’t it?
yeah




















