development

[zenith hatch]

cum

[trail sandal]

"Thanks capt, this is why we can't have nice things"

unfortunate

[tepid olive]

i want to inject dylib into an ipa i want to use my own cert at sideloadly is that possible?

[trail sandal]

use a tool like azule to inject into the ipa then just sign and install using sideloadly

[tepid olive]

when i sign it with something else sideloadly tries to sign again

[trail sandal]

azule doesnt sign just modifies the ipa

[main apex]

Sideloadly has an option to install without signing again.

[tepid olive]

fr ? ok imma try it

[ocean raptor]

Sideloadly is cringe, the correct way is to buy a paid dev account, get a wildcard mobile provision, sign .app with procursus ldid, zip .app into ipa, then use ideviceinstaller to install the ipa

[main apex]

Under advanced options, select “normal install”

[tepid olive]

my brother in christ

[ocean raptor]

What?

I'm correct

[tepid olive]

kinda

[primal perch]

the correct way is not paying apple 99$ a year

[tepid olive]

the correct way is using codesign

what if procursus servers went down again⁉️

[ocean raptor]

Procursus ldid is hosted on GitHub

https://github.com/ProcursusTeam/ldid

[sacred cradle]

anybody here able to help with an xcode question?

having trouble debugging a generic sounding error

[turbid fjord]

Post the error…

And maybe the code too that’s causing the issue

[high citrus]

https://dontasktoask.com

[sacred cradle]

for context I have basically zero development experience here

[turbid fjord]

Have you set a simulator?

[sacred cradle]

I don't think so

those errors are tied to a few specific frameworks in my project

[restive ether]

dumbest message of the day

[tepid olive]

wdym

[ocean raptor]

Substrate or substitute selection

[tepid olive]

whats different

i have obj c keypanel tweak that work at nonjb

that i want to add

[native dune]

what

[ocean raptor]

Sideloadly should have made the substrate substitute a drop-down menu, not two different check boxes

That's all we're saying

Or at least make it radio selectors smh

[native dune]

what happens if you select both

[tepid olive]

so my one is old?

lmfo

[native dune]

what are you saying

[tepid olive]

i can select

both

lol

[native dune]

lmao

[tepid olive]

bro i sign my ipa with cert at esign .

when i upload it and add dylib with sideloadly app crashs

[chilly plover]

Is there anyway to automate same thing but in iOS?

[weary heath]

Pirated apps and pirated windows

And named after a pirate store

[tepid olive]

?

[weary heath]

Zxtouch

Or Frida maybe

[chilly plover]

It just clicks on x y axis?

[weary heath]

Yeah

Is that Appium?

[chilly plover]

Its uiautomator2

It works by clicking through element resource id

[weary heath]

Does that click a given x y coordinate

Oh

There’s nothing like that that I know of

Idk would Frida work

[chilly plover]

I dont think Frida can click on app front-end

In uiautomator2 we inspect elements the same way we inspect in web through devtools.

[weary heath]

You can add waits until they load

[chilly plover]

In android, its very stable,fast and intelligent.

[gentle grove]

racist

[weary heath]

While not the most efficient way to do things it’s a quick solution rather than reversing an API

[chilly plover]

Both tiktok and Instagram has employed various checks on api calls.

Automating apps seems more easier and more humanly thing to do.

Reversing api is only good for Scraping.

[weary heath]

It’s easier but API is better

[chilly plover]

Of course. Thats the ideal thing to settle for.

How appium works in iOS btw?

[weary heath]

Appium is for Android

[chilly plover]

Works on iOS also I don't know whats the procedure in detail but it sounds like a hassle.

Its not easy as we do on Android

https://appium.io/docs/en/drivers/ios-uiautomation/

It feels me that through appium in iOS, we can only test/automate those app which i developed.

[zenith hatch]

cum

[primal perch]

cock

[tepid olive]

why is this not working

install_name_tool -change /Library/Frameworks/CydiaSubstrate.framework/CydiaSubstrate @executable_path/Frameworks/CydiaSubstrate.framework/CydiaSubstrate BHTwitter.dylib

oh nvm

the other dylib needs changing too

which is ironic because that tweak is specifically made for jailed devices

[tepid olive]

@executable_path worked too, what’s the difference

[faint timber]

you should be using libloader

[tepid olive]

what’s that

[faint timber]

Sys.dylib loads everything in libloader folder

[tepid olive]

oh that sounds epic

and it automatically changes paths too?

[faint timber]

nah

but on iOS 14 or later too many load commands = broken bin

https://github.com/julioverne/libloader-sideloader/

replace /usr/lib/libSystem.B.dylib with @executable_path/Sys.dylib in main app binary

Sys.dylib will load any dylib in @executable_path/libloader/

[ocean raptor]

Yes

@rpath scans a set of directories, /usr/lib /usr/local/lib, any LC_RPATH and any set with env vars
@tepid olive_path is relative to the .app or executable

[restive ether]

[fading aurora]

working on an app, need to launch something in /usr/bin, trying to use NSTask but getting Couldn't posix_spawn: error 1

any tips?

I have com.apple.private.security.no-container set to false and platform-application to true in entitlements

[fading aurora]

@grave sparrow will send code in a minute

How do i ensure its installed in /Application?

Well, how do i tell xcode to install it there?

(Or theos)

[fading aurora]

Its not but im tempted to switch if that will fix my problems

I set one up and it had the same issues

@grave sparrow https://paste.maxleiter.com/post/35bfee22-6f67-48a0-b019-a2f04916fe1b

the theos deb does install it to Applications/

theos should apply them automatically, right? ill check

ah no

i didnt add any entitlements in theos

I did in Xcode but thats not in /Applications

(any ideas on how to have it install there?)

theos does install there

I want to do it with xcode (not a theos project)

yeah but ive set up a codesign script to run after build

ah

well thank you from saving me from further head-bashing

[faint timber]

platform-application is essentially useless as of iOS 11

[fading aurora]

I switched to theos

seems to be working fine

thanks a lot @grave sparrow

calling mmap() seems to send the Death Sentinel after me. is that an entitlements thing?

im getting MAP_FAILED

so yeah, probably my issue

yeah

Everything Is a File 😛

wherever i want, but currently ~/tmp

(where ~ is mobile)

I just get [application<com.maxleiter.app>:44269] Death sentinel fired!

right after the mmap

[fading aurora]

It was improper flags

👌

Thanks 🙏

[tepid olive]

i am using azule for inject dylib to ipa but i want it to inject dylib to another path at ipa

azule source ^^

[faint timber]

mf gave a dylib executable

and cd'ed into an archive

what in the world

[tepid olive]

so tell me what i have to do

[faint timber]

use libloader and do it by hand

don't use that script

[chilly plover]

Do iOS employs any other check to see the device integrity? Soical media apps usually collects lot of device fingerprinting.

[fading aurora]

I'm building a theos swift app with an objective c header, and that all works

but the c header doesnt seem to expose macros in a library

is that expected? or am i doing something wrong?

[wicked summit]

I don't believe you can use C macros in Swift that are more complex than constant definitions like

#define pi 3.141592

[fading aurora]

They are constants

No defines are recognized even if i put them in the bridge

Rn im undeffing, defining as consts, and redefining

[naive kraken]

https://developer.apple.com/documentation/devicecheck?language=objc

really hard if not impossible to bypass, afaik

[primal perch]

int *j = "cum";

[gentle grove]

what will i get if i derefernce this

[primal perch]

0x006d7563 (on little endian architectures)

otherwise 0x63756d00

[gentle grove]

why

what does that number mean

[primal perch]

check an ascii table

[gentle grove]

how'

is it jujst the chjaracters

@primal perch The great software for some game that exploiting anime girls (and boys).

OH FFS

YET ANOTHER HOME ASSISTANT UPDATE

[primal perch]

ya

[gentle grove]

oh

what if i dont dereference it

[primal perch]

then its a pointer to an integer

[hexed knot]

THEN U BE QUIET

[gentle grove]

does the pointer go to the binary itself

[primal perch]

wut

[gentle grove]

like what does it point at

[primal perch]

the characters

[gentle grove]

are the characters its pointing at in the binary in ram

the executable i mean

[primal perch]

somewhere in virtual memory

in this small program yeah its pretty likely the whole binary got loaded in ram

[gentle grove]

what if its go and the binary is huge

like say 130 MB

[primal perch]

intjshrug

[gentle grove]

im loooking at you gitea

[primal perch]

most binaries are probably loaded directly into ram otherwise it would be slow as fuck to wait for a page to get mapped

but idk depends on the OS and its behavior

[gentle grove]

trolled

[primal perch]

thick

[gentle grove]

103 MiB for gitea

let me seew hcih is the biggest

golang moment

[fading aurora]

are there any guides on debugging a theos swift tweak from xcode

@lime pivot i was told you may know

[primal perch]

@gentle grove what the notarization prompt looks like

[gentle grove]

yep

i was under the impression though that all it checked for was whether or not the developer paid apple to have a dev account so they could sign it

[primal perch]

99 a year is expensive af tho ngl

should be like 49 at most

[gentle grove]

it should be $0

[primal perch]

nah

not even the play store is free

[gentle grove]

what

[primal perch]

its 25$ one time

iirc

[gentle grove]

wtf

well at least you dont have to install stuff from play store on android

you can just install stuff with no computer needed

and its even still signed by the developer anyways

[primal perch]

but insecure!

[gentle grove]

the only thing its mising is google having some screening for the play store

apks still have to be signed unless you disable an option

[primal perch]

read: any

[gentle grove]

and if its signed it will verify that signature when you update the app

so it makes sure you install one signed by the same dev

[primal perch]

cool the btd6 cursor on macos is 2x bigger than it should be

thanks for hardcoding DPI ninjakiwi

[gentle grove]

L

its tiny on my monitor but my cursor is normally tiny anyways

[primal perch]

even proton doesnt have this problem

[gentle grove]

so i wasnt sure if it was the fault of:

• wine/proton
• ninja kiwi hardcoding dpi
• it just being the correct size but small because my cursor is small anyways

it looks like it's 144p on proton though

nto sure if thats because hidpi

[primal perch]

ya it has weird red lines

idk why

but at least its the right size

[gentle grove]

it doesnt have red lines for me

it mightve been too small idk

[wicked summit]

wen eta Apple loses a lawsuit and is forced to allow shops other than the app store

[primal perch]

any day now tm

[lime pivot]

yep it’s not as strong as ios signing but it’s still pretty sufficient

[lime pivot]

EU Digital Markets Act is doing that

[lime pivot]

those ARCHS are a little unnecessary, no need to set that, theos sets it appropriately for you

can’t see anything wrong from just eyeballing the code

is the XML valid?

you can try plutil -p Blah.plist (remove -p on iOS)

since you’re getting a blank screen that’s probably successful loading of the bundle, but some failure to load specifiers from there

[primal perch]

no

you forgot ppc

and m68k

[ocean raptor]

you forgot armv7e

and arm65

and arm64[a-z]

[primal perch]

cum

[lime pivot]

arm69 is the new hotness

those extra bits make all the difference

[ocean raptor]

I only use arm69z

or m69k

(the m stands for your mom)

[lime pivot]

oh Motorola you were so innocent back then

little did you know you were 1 digit off from 69

[primal perch]

morello = arm129

[ocean raptor]

is it possible to transfer music to apple music local library using limd?

[lime pivot]

if you wanna talk about terrible model numbering Motorola beat Intel to it with 68k series containing only: 68000, 68008 (nice), 68010, 68020, 68030, 68040, 68060

good thing they reserved all those digits in case they made the 68696

[lime pivot]

ahhh the age old iPod_Control question

[ocean raptor]

no, to my phone, not my ipod

[lime pivot]

yeah it’s a folder in iOS

[ocean raptor]

I haven't bothered to find a 30 pin charger for my ipod, cause I only have airpods and own no music

[lime pivot]

/var/mobile/Media/iPod_Control

[ocean raptor]

oh fr?

I assume it has proprietary metadata?

[lime pivot]

I think the iOS version has been truly figured out by now, but for a long time they kept changing how it works probably because of music label licensing bs

I don’t think they care now considering how easy it is to pirate music with a youtube downloader

[ocean raptor]

literally me

[lime pivot]

lmao

[ocean raptor]

yt-dlp --audio-format mp3 -x --audio-quality 0

I'm not even joking

I'm trying to put songs downloaded from yt into my spotify library

and spotify links local files from AM

[lime pivot]

I mean YouTube Music literally works by Google having uploaded hundreds of thousands of videos containing the music with a 1024x1024 video track containing the album art

[ocean raptor]

I have YT Music because my dad pays for yt premium for the whole family

[lime pivot]

so every song ever produced that Google has a license for, you can get a perfectly clean 192kbps rip for free courtesy of google

[ocean raptor]

but I don't like using multiple apps for music

[primal perch]

i recommend buying a 1$ tidal sub then using tidal-gui to pirate all your shit with good quality rips

source: did it

[lime pivot]

hah

so a looooong long time ago in a galaxy far far away there was a tweak called PwnTunes

[primal perch]

these are rookie numbers too

@old geyser has like 1TB in flac all from tidal

if not more

[ocean raptor]

amazing

[lime pivot]

it let you add music to the on device Music/iPod app on device without using iTunes

the downside is it was, well, bad, lmao

you had to just have id3 tags set in your mp3s or it would just add to your library as the filename

and as your totally legit library grew it would take longer to rebuild the iPod database

I’m talking like you tap the Music icon and it’s a tossup whether PwnTunes or watchdogd would win

[primal perch]

kek

what should i get for consumerism day

[ocean raptor]

we do a little ifuse crashing computer

[lime pivot]

nice

[ocean raptor]

@lime pivot it's called iTunes_Control now

[lime pivot]

I’ve really abused ifuse over the years and it’s never crashed

sounds like a skill issue

also stop using PaidBSD

[ocean raptor]

you've never used it on freebsd though

[ocean raptor]

never

[lime pivot]

lmao

[ocean raptor]

love to see it ls: /tmp/tmp.lV16S0vzkj/: Input/output error

[lime pivot]

yikes

[ocean raptor]

ifuse don't freeze konsole challenge (IMPOSSIBLE)

[lime pivot]

I’ve used ifuse to hack Overcast’s sqlite database directly so many times now

[ocean raptor]

limd is very unstable on fBSD

idevicebackup2 fails backing up at like 99%

[lime pivot]

solid app but where it doesn’t implement something, it’s always an absolute pain in the butt

[ocean raptor]

it's the most annoying thing

I really should switch back to debian, but it's so much work

[lime pivot]

I would have said wine might work better but then sadly wine still doesn’t have USB support

[ocean raptor]

and I hate GNU software

[lime pivot]

I was actually kinda amped that I could sync my iPod with Foobar2000 until I realised it’s impossible because it can’t see it as a USB device

even though I have HDD mode enabled so it exposes the iPod drive with the iPod_Control folder

[lime pivot]

oh right it’s iPod_Control on iPod OS, iTunes_Control on iOS

[ocean raptor]

I like how they change the mp3 names

[lime pivot]

another way they trolled us, they couldn’t just port the iPod database backend as-is, they had to change the folder naming for no obvious reason

yeah it’s based on some weirdo hash algorithm

you end up with like iTunes_Control/AB/CDE.mp3

[ocean raptor]

so that the itunes team has something to work on so they don't all get fired

[lime pivot]

given how fast iPhone OS 1 was slapped together I’m amazed they had time to change things in the iPod code

iPods were Samsung ARM chips so it should have been an almost straight port

just the new UIKit-based iPod app that had to be put together

[ocean raptor]

@lime pivot running ifuse as root fixed like all the instability

[lime pivot]

that's like marginally better than it running in the kernel I guess lmao

[ocean raptor]

fuse is literally part of FreeBSD base, but it's so unstable

ifuse and smbnetfs have both been completely unusable

[lime pivot]

that's a shame

[primal perch]

https://media.discordapp.net/attachments/710745951236522019/986736845729697802/femboy_thinker.gif

[pearl sail]

@vivid dew is this you

[tepid olive]

i love this gif

[primal perch]

fr

[tepid olive]

im a bit high but i agree

i’d fuck a boy

🤤

[primal perch]

[vivid dew]

no, i'm normal

[tepid olive]

trust me it’s not a voluntary desire

telling yourself it doesn’t exist doesn’t work

it’s uncontrollable

[vivid dew]

this you?

[tepid olive]

how do i can ios ssl unpinning with frida . i tired one time but logs i didnt see logs at burp suite

[tepid olive]

too much text

not gonna read all that

[lime pivot]

SWITCH TO LINUX

is that like an affirmation for your switch to boot into linux or something

[pliant fossil]

[ocean raptor]

SWITCH TO FREEBSD

[wicked summit]

SWITCH TO TEMPLEOS

[lime pivot]

switch to windows 2000

[hexed knot]

switch to solaris

[azure sail]

https://tenor.com/view/linux-linux-users-gaming-computer-computers-gif-23121479

[gentle grove]

opinion ignored

[lime pivot]

https://swift.org/blog/vscode-extension/

[turbid fjord]

Could you Orion with this?

[indigo peak]

Try and see

[turbid fjord]

True

[hasty ruin]

can frida interact with ios apps running on m1

whenever i try to attach, it halts for a few seconds until..

Failed to attach: unexpected early end-of-stream

and get hit with EXC_BAD_ACCESS (SIGKILL (Code Signature Invalid))

[main apex]

https://tryitands.ee

[hasty ruin]

• fixed my issue by disabling SIP

[undone nest]

thanks to this i noticed ios 16 got a new player

[fading aurora]

I have a storyboard in my Resources/ and the file exists/bundle is loaded, but I still get NSInvalidArgumentException', reason: 'Could not find a storyboard named 'Main' in bundle NSBundle

any ideas?

I have <key>UIMainStoryboardFile</key> <string>Main</string> in my plist

[main apex]

You just noticed now? Lol

[undone nest]

yea

[faint timber]

Jul 14 13:00:56 securityd[132] <Notice>: trustd[166]/1#12 LF=0 copy_parent_certificates Error Domain=NSOSStatusErrorDomain Code=-34018 "Client has neither application-identifier nor keychain-access-groups entitlements" UserInfo={numberOfErrorsDeep=0, NSDescription=Client has neither application-identifier nor keychain-access-groups entitlements}

tf?

[indigo peak]

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  JUMPOUT(0x100007FB8LL);
}

wtf is JUMPOUT

and that hex thing

[ocean raptor]

It's a long long is hex format

And the JUMPOUT is because the function boundary it detected was incorrect

[indigo peak]

int __cdecl main(int argc, const char **argv, const char **envp)
{
  return 1;
}

thats what it is in armv7s format

[vivid dew]

using a decompiler in 2022

[tepid olive]

using a compiler in 2022

[native dune]

using a

[tepid olive]

using

[ocean raptor]

_ _

[faint timber]

In otherwords jumpout is ida being a lazy shit

[tepid olive]

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ gnisu

[gentle grove]

gnusing

[tepid olive]

mhmmm girl pills

[hexed knot]

gay

[tepid olive]

wish i had the balls to do a physical transition smh

[hexed knot]

Dont u mean you wish you had the ovaries

[gentle grove]

True

Wtf

[primal perch]

if you wanna do it then do it

if you don’t, dont

[tepid olive]

deep

part of it is i simultaneously want both options at once

lol

[gentle grove]

Lmao

[gentle grove]

Then do both

Troll

[ocean raptor]

> ldid -h Taurine | grep "Authority"       
Authority=We Do A Little Trolling iPhone Root CA
Authority=We Do A Little Trolling iPhone Certification Authority
Authority=We Do A Little Trolling iPhone OS Application Signing
Authority=We Do A Little Trolling iPhone Root CA
Authority=We Do A Little Trolling iPhone Certification Authority
Authority=We Do A Little Trolling iPhone OS Application Signing

Hmm... one question about exploited signature: I found this in Taurine execution file when I search Certificate - this words is used in execution file 6 times: We Do A Little Trolling iPhone OS Application Signing - what does this mean. If this is not a trolling, why you give that name?

[tepid olive]

you can have that

[pearl sail]

I always steal more

[tepid olive]

im gonna buy estrogen from brazil off the street

brb

[lime pivot]

pick up some souvenirs for us

[lime pivot]

this is in indeed a trolling universe

[primal perch]

@vivid dew

[gentle grove]

https://twitter.com/0xdade/status/1547647751550226434?s=19

dade (@0xdade)

Isn't that kinda the whole point of Python 😂😂

Likes

1025

Retweets

122

Twitter · Jul 14, 2022, 6:22 PM

python

[opal ridge]

smh

[serene ridge]

probably something different

[gentle grove]

my screenshot was something relating to mailcap so I think its different

[tepid olive]

anyone know what header SBSUIWallpaperSetImage is in

[steady nest]

like any other

💀

[gentle grove]

https://youtube.com/shorts/V-Q8d77t65U?feature=share

Good

https://reddit.com/r/iamverysmart

[tepid olive]

This application is not allowed to access Photo data.
anyone know if theres an entitlement to get around this

[ocean raptor]

TCC stuff

[tepid olive]

What's TCC?

oHH

how do i get around it though?

ios 8.1 btw

what's the entitlement

[ocean raptor]

Man, if only you could use google

[tepid olive]

.

@marble perch what is the entitlement

com.apple.private.tcc.allow-prompting
?

nope

[ocean raptor]

lmgtfy

[tepid olive]

i

am

googling

all

over

bro

please

what

is

it

[ocean raptor]

Just search this repo for TCC

https://github.com/CRKatri/entitlements

[ocean raptor]

Idk, that's why I'm telling you to google it

[tepid olive]

https://github.com/CRKatri/entitlements/blob/main/System/Library/PrivateFrameworks/TCC.framework/tccd.plist

this dont work

https://github.com/CRKatri/entitlements/blob/main/usr/local/bin/tccctl.xml

this dont work

ok now it does this

2022-07-15 15:33:15.028 wallpaper[11700:1971027] CoreData: error: -addPersistentStoreWithType:SQLite configuration:(null) URL:file:///var/root/Media/PhotoData/Photos.sqlite?readonly_shm=1 options:{
    NSPersistentStoreFileProtectionKey = NSFileProtectionCompleteUntilFirstUserAuthentication;
    NSReadOnlyPersistentStoreOption = 1;
    NSSQLitePersistWALOption = 1;
    NSSQLitePragmasOption =     {
        "journal_mode" = WAL;
    };
} ... returned error Error Domain=NSCocoaErrorDomain Code=260 "The operation couldn’t be completed. (Cocoa error 260.)" with userInfo dictionary {
}
2022-07-15 15:33:15.035 wallpaper[11700:1971027] CoreData: error: -addPersistentStoreWithType:SQLite configuration:(null) URL:file:///var/root/Media/PhotoData/Photos.sqlite?readonly_shm=1 options:{
    NSPersistentStoreFileProtectionKey = NSFileProtectionCompleteUntilFirstUserAuthentication;
    NSReadOnlyPersistentStoreOption = 1;
    NSSQLitePersistWALOption = 1;
    NSSQLitePragmasOption =     {
        "journal_mode" = WAL;
    };
} ... returned error Error Domain=NSCocoaErrorDomain Code=260 "The operation couldn’t be completed. (Cocoa error 260.)" with userInfo dictionary {
}

nvm

[tepid olive]

i ran as mobile

and of course it still doesn't work

#import <stdio.h>
#import <string.h>
#import <dlfcn.h>
#import <objc/runtime.h>
#include "PLWallpaperImageViewController.h"
#include "PLStaticWallpaperImageViewController.h"

int main() {
    UIImage *image = [UIImage imageWithContentsOfFile:@"/var/mobile/IOS_6_Logo_2012_Original.png"];
    PLStaticWallpaperImageViewController *wallpaperViewController = [[PLStaticWallpaperImageViewController alloc] initWithUIImage:image];
    wallpaperViewController.saveWallpaperData = YES;
    [wallpaperViewController setValue:@(PLWallpaperModeLockScreen) forKey:@"_wallpaperMode"];
    [wallpaperViewController _savePhoto];
}

im trying to set a wallpaper from cli

Nathans-Alarm:~ mobile$ 

it runs now but wallpaper not set

[ocean raptor]

Yeah, that

[tepid olive]

@grave sparrow it does this
but wallpaper not set

Nathans-Alarm:~ mobile$ 

[ocean raptor]

@tepid olive watch syslog to see the actual error smh

[ocean raptor]

Cydia

[indigo peak]

Speaking facts

[silver rampart]

works fine over here, perhaps try removing the repo and re-adding it

[tepid olive]

no help

i was busy but just checked

nothing

i changed to this, this time
UIImage *image = [UIImage imageNamed: @"/var/mobile/IOS_6_Logo_2012_Original.png"];

oh thats probably why

wallpaperViewController isn't in shared cache
cant find

[ocean raptor]

That's not have imageNamed works

I highly encourage you to read developer.apple.com

[weary heath]

JB. Father, Amazon founder

[silver rampart]

what version of ios are you trying this on

there's multiple things that are wrong with that but one of them is that PhotosLibrary hasn't had that class since iOS 14

[restive ether]

☠️☠️

[silver rampart]

oh lmAo

who knows then the dev wiki might have actually relevant info for once

[ocean raptor]

[silver rampart]

nope its all for ios 6

[ocean raptor]

@silver rampart did you rewrite the front page of the wiki?

[silver rampart]

yes

[ocean raptor]

It threw me off

[silver rampart]

[ocean raptor]

http://iphonedev.wiki/index.php/Dark_Mode

[silver rampart]

trying to improve our discoverability because it's currently not that great

[ocean raptor]

Bro said "copy these 1 million lines"

Smh

Just add it into the website

Ever heard of prefers-color-scheme smh

[silver rampart]

you're underestimating how much mediawiki makes it difficult to do anything

[vivid dew]

trolling

[silver rampart]

you're underestimating how much mediawiki makes it difficult to do anything
like the new top-of-the-page-header on there looks kinda off because it's a css hack since mediawiki doesn't allow you to actually remove a page header

[ocean raptor]

It has relevant info here http://iphonedev.wiki/index.php/Updating_extensions_for_iOS_15/16

(Only because I added it )

[silver rampart]

🙄

should tell people to switch to dragon since theos doesn't officially support ios 15.1 yet

[vivid dew]

is there an admin online

i'd like to report someone for spamming friend requests

[thin valley]

How can I be of service

Oh, that’s not really a offense we can handle. Just block them

[vivid dew]

ok

goodbye @grave sparrow

[thin valley]

#BlockCaptAll2022

[vivid dew]

[silver rampart]

no i just dont work on it at all now

only two development modes

faster/easier and less stable theos alternative

https://dragon.krit.me/

[restive ether]

ninja, L

i find a lot of irony in this

[silver rampart]

absidue cutting off the part of that note that is trashing my project and cameren believing it immediately

[restive ether]

your benefits are subjective, absolute L

[silver rampart]

that wasn't a benifit

[restive ether]

they aren’t based in fact

learn how to format your writing then? i don’t know what to tell you

[silver rampart]

???

read the page?

why do u do this every time i talk

[restive ether]

because you’re a massive hypocrite constantly

[silver rampart]

????

[restive ether]

irony could strike you in the face and you still wouldn’t get it

who needs stability anyways

[silver rampart]

i'm saying that note that you clipped out was me trashing my project and saying to not depend on it, to keep using theos/having it installed

lol

and cam is assuming that i was calling my project stable and maintained, and trashing me for it

[restive ether]

that’s not why i called it ironic

[silver rampart]

i mean i dont disagree with the fact that i'm dense and a hypocrite

just trying to understand what prompts you to say that every time i join

[restive ether]

if i’m here then i’m here? i don’t know what to tell you

[silver rampart]

definitely an issue with it, trying to bring over some of the improvements it had to theos instead of dumping more time into it

got the device manager fully functional in the theos context

(and made the device manager a lot cooler)

if you want to

python3 device.py theos adapter_install

[tepid olive]

8.1

[silver rampart]

it should be fine with an existing ~/.theosrc in place but might back it up anyways to be safe

make commands it adds are:
install_all / iall - install to all devices you've added
respring / rs - respring active device
unins - uninstall the current package
device - add/remove/swap devices

[tepid olive]

ok, is there any fixes i can make to this to get it working on ios 8

#import <stdio.h>
#import <string.h>
#import <dlfcn.h>
#import <objc/runtime.h>
#include "PLWallpaperImageViewController.h"
#include "PLStaticWallpaperImageViewController.h"

int main() {
    UIImage *image = [UIImage imageWithContentsOfFile:@"/var/mobile/IOS_6_Logo_2012_Original.png"];
    PLStaticWallpaperImageViewController *wallpaperImageViewController = [[PLStaticWallpaperImageViewController alloc] initWithUIImage:image];
    wallpaperImageViewController.saveWallpaperData = YES;
    [wallpaperImageViewController setValue:@(PLWallpaperModeLockScreen) forKey:@"_wallpaperMode"];
    [wallpaperImageViewController _savePhoto];
}

[silver rampart]

helps to know what errors you're getting

[tepid olive]

it literally gives no errors

lmfao

[silver rampart]

in os_log as well?

[tepid olive]

nope

checked

[silver rampart]

are you sure running that code in the photos app actually does what you expect it to?

[tepid olive]

im trying to set wallpaper from cli

[silver rampart]

yes

how did you come up with that code to do that

[tepid olive]

it's mainly @lime pivot's code

here

https://www.reddit.com/r/jailbreakdevelopers/comments/24uyr6/which_private_framework_and_methods_set/chbsk11/?utm_source=share&utm_medium=ios_app&utm_name=iossmf&context=3

@silver rampart any idea here

[silver rampart]

nop not really

wish i had an ios 8 device around to test on

[tepid olive]

also

dyld shared cache

[primal perch]

[tepid olive]

i'm assuming that means it's not supposed to be in there and i am completely wrong

[silver rampart]

nah your capitalization was just wrong

[tepid olive]

oh shit

#import <stdio.h>
#import <string.h>
#import <dlfcn.h>
#import <objc/runtime.h>
#include "PLWallpaperImageViewController.h"
#include "PLStaticWallpaperImageViewController.h"

int main() {
    UIImage *image = [UIImage imageWithContentsOfFile:@"/var/mobile/IOS_6_Logo_2012_Original.png"];
    PLStaticWallpaperImageViewController *WallpaperViewController = [[PLStaticWallpaperImageViewController alloc] initWithUIImage:image];
    WallpaperViewController.saveWallpaperData = YES;
    [WallpaperViewController setValue:@(PLWallpaperModeLockScreen) forKey:@"_wallpaperMode"];
    [WallpaperViewController _savePhoto];
}

i changed the spelling and still nothing

Nathans-Alarm:~ mobile$ ```

it does that and the wallpaper doesn't change

[silver rampart]

no it had nothing to do with your variable spelling lol

just the reason your search result came up with nothing

[tepid olive]

there

is nothing

in the syslog

[silver rampart]

if only correllium supported armv7 phones

[tepid olive]

nothing in the syslog when i run that command

[tepid olive]

does it have a iphone 6/5s

on ios 8

[silver rampart]

they only go back to ios 10

[tepid olive]

ah

[tepid olive]

is there anything wrong here

?

[silver rampart]

not at first glance which is why people are begging you to check syslog (yes i know there's nothing there)

[tepid olive]

nothing helpful there

[tepid olive]

@marble perch what now

[silver rampart]

why dont you try doing this in a springboard tweak and see if it works there

if it works from a springboard tweak but not your cli program it is likely an entitlements issue

[silver rampart]

also can you send the binary itself i'm curious

[tepid olive]

ok

btw, this is what happens on ios 7

i have a lot of 4ses

2022-07-15 19:20:06.709 wallpaper[762:507] Warning: bundleIdentifer is nil!
Segmentation fault: 11
iPhone:~ mobile$ 

heres the deb itself

yes this was capts i was too lazy to relabel the package

@silver rampart

[native dune]

frcoal

[silver rampart]

did you try adding the entitlements

[tepid olive]

yeah thats what im doing

[silver rampart]

there are none on the package you sent though

[tepid olive]

i know

i sign it with this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.private.tcc.allow</key>
    <array>
    <string>kTCCServicePhotos</string>
    </array>
    <key>com.apple.security.personal-information.photos-library</key>
    <true/>
</dict>
</plist>```

[silver rampart]

can you sign it with that and then send over the package

[tepid olive]

okay

@silver rampart

hopefully should be signed

it was signed with the wrong entitlements

lol

[silver rampart]

it is not signed with those entitlements

yeah

lol

[silver rampart]

tried running it with these entitlements yet?

[tepid olive]

i have

thats what ive been using

or it would give error

[silver rampart]

oh TIL iphone 4s supported up to ios 9

give me 30 minutes i have 4

[tepid olive]

@silver rampart what framework do i need to fix this

[silver rampart]

where are you seeing that error

[tepid olive]

compiler

[silver rampart]

can you paste the full output it spits out

[tepid olive]

> Making all for tool wallpaper…
==> Compiling main.x (armv7)…
In file included from main.x:1:
/home/nathan/building/WallpaperChanger/SBSUIWallpaperPreviewViewController.h:12:68: error: no type or protocol named 'SBFWallpaperViewLegibilityObserver'
@interface SBSUIWallpaperPreviewViewController : UIViewController <SBFWallpaperViewLegibilityObserver, SBFLegibilitySettingsProvider> {
                                                                   ^
1 error generated.
make[3]: *** [/home/nathan/theos/makefiles/instance/rules.mk:262: /home/nathan/building/WallpaperChanger/.theos/obj/debug/armv7/main.x.da155d8a.o] Error 1
make[2]: *** [/home/nathan/theos/makefiles/instance/tool.mk:20: /home/nathan/building/WallpaperChanger/.theos/obj/debug/armv7/wallpaper] Error 2
make[1]: *** [/home/nathan/theos/makefiles/instance/tool.mk:11: internal-tool-all_] Error 2
make: *** [/home/nathan/theos/makefiles/master/rules.mk:117: wallpaper.all.tool.variables] Error 2
nathan@Nathan-PC:~/building/WallpaperChanger$ 

[silver rampart]

where'd you pull the headers from?

[tepid olive]

https://developer.limneos.net/index.php?ios=8.0&framework=SpringBoardUIServices.framework&header=SBSUIWallpaperPreviewViewController.h

https://raw.githubusercontent.com/nst/iOS-Runtime-Headers/master/PrivateFrameworks/SpringBoardUIServices.framework/SBSUIWallpaperPreviewViewController.h
this one shits errors

i remove the imports because it cant find

[silver rampart]

just create a custom interface in your .m file that only declares the things you specifically need

[tepid olive]

#import <SpringBoardUIServices/SpringBoardUIServices-Structs.h>
        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/home/nathan/building/WallpaperChanger/SBSUIWallpaperPreviewViewController.h:9:9: note: did not find header 'SpringBoardUIServices-Structs.h' in framework 'SpringBoardUIServices' (loaded from '/home/nathan/theos/sdks/iPhoneOS9.3.sdk/System/Library/PrivateFrameworks')
1 error generated.
make[3]: *** [/home/nathan/theos/makefiles/instance/rules.mk:262: /home/nathan/building/WallpaperChanger/.theos/obj/debug/armv7/main.x.da155d8a.o] Error 1
make[2]: *** [/home/nathan/theos/makefiles/instance/tool.mk:20: /home/nathan/building/WallpaperChanger/.theos/obj/debug/armv7/wallpaper] Error 2
make[1]: *** [/home/nathan/theos/makefiles/instance/tool.mk:11: internal-tool-all_] Error 2
make: *** [/home/nathan/theos/makefiles/master/rules.mk:117: wallpaper.all.tool.variables] Error 2
nathan@Nathan-PC:~/building/WallpaperChanger$ ```

[silver rampart]

limneos' site doesn't allow you to download the whole sdk and my site only goes back to ios 13

[tepid olive]

i need SBSUIWallpaperPreviewViewController and controller

[silver rampart]

however like, i think? from memory that this framework is used by Preferences.app for rendering the preview in prefs

[tepid olive]

#import <dlfcn.h>

int main() {
// open the private framework dynamically
void *handle = dlopen("/System/Library/PrivateFrameworks/SpringBoardUIServices.framework/SpringBoardUIServices", RTLD_NOW);

UIImage *wallpaper = [UIImage imageNamed: @"background.jpg"];

Class sbClass = NSClassFromString(@"SBSUIWallpaperPreviewViewController");
// we create a view controller, but don't display it. 
//  just use it to load image and set wallpaper
SBSUIWallpaperPreviewViewController *controller = (SBSUIWallpaperPreviewViewController*)[[sbClass alloc] initWithImage: wallpaper];
[controller setWallpaperForLocations: 3];  // 3 -> set both for lock screen and home screen

dlclose(handle);
}```

[silver rampart]

#include <UIKit/UIKit.h>
@interface SBSUIWallpaperPreviewViewController
-(instancetype)initWithImage:(UIImage *)image;
-(void)setWallpaperForLocations:(NSInteger)locations;
@end

at the top of your file

[tepid olive]

it compiled

[silver rampart]

still waiting for one of the 4ses to charge

cursed old phones

[tepid olive]

Jul 15 20:13:54 Nathans-Alarm wallpaper[986] <Error>: CGContextTranslateCTM: invalid context 0x0. This is a serious error. This application, or a library it uses, is using an invalid context  and is thereby contributing to an overall degradation of system stability and reliability. This notice is a courtesy: please fix this problem. It will become a fatal error in an upcoming update.
Jul 15 20:13:54 Nathans-Alarm wallpaper[986] <Error>: CGContextScaleCTM: invalid context 0x0. This is a serious error. This application, or a library it uses, is using an invalid context  and is thereby contributing to an overall degradation of system stability and reliability. This notice is a courtesy: please fix this problem. It will become a fatal error in an upcoming update.
Jul 15 20:13:54 Nathans-Alarm wallpaper[986] <Error>: CGContextGetCTM: invalid context 0x0. This is a serious error. This application, or a library it uses, is using an invalid context  and is thereby contributing to an overall degradation of system stability and reliability. This notice is a courtesy: please fix this problem. It will become a fatal error in an upcoming update.
Jul 15 20:13:54 Nathans-Alarm wallpaper[986] <Error>: CGContextSetBaseCTM: invalid context 0x0. This is a serious error. This application, or a library it uses, is using an invalid context  and is thereby contributing to an overall degradation of system stability and reliability. This notice is a courtesy: please fix this problem. It will become a fatal error in an upcoming update.
Nathans-Alarm:~ mobile$```

[silver rampart]

does it work tho

[tepid olive]

no

[silver rampart]

F

[tepid olive]

@silver rampart go to 8.4.1 on your 4s

or see if you can get this working on 9

and see if it works on 8.1

LETS

GO

IT WORKS

@silver rampart

[silver rampart]

nice!

[tepid olive]

i had to change the UIImage part

imageWithContentsOfFile

to that

@grave sparrow finally got it

[silver rampart]

if you have any suggestions for it they're v welcome

[ocean raptor]

Yes, imageNamed is for getting the image from the current NSBundle

Like I told you earlier

[tepid olive]

yeah, my bad

[restive ether]

☠️

[tepid olive]

i got arguments working

now time to add to my website

similar to audio player
but wallpaper this time

final product

[hasty ruin]

This isn’t fair I’m on mobile

Can’t do it easily

[tepid olive]

its completely different code wise

#import <dlfcn.h>
#include <UIKit/UIKit.h>
@interface SBSUIWallpaperPreviewViewController
-(instancetype)initWithImage:(UIImage *)image;
-(void)setWallpaperForLocations:(NSInteger)locations;
@end

int main(int argc, char *argv[], char *envp[]) {
// open the private framework dynamically
void *handle = dlopen("/System/Library/PrivateFrameworks/SpringBoardUIServices.framework/SpringBoardUIServices", RTLD_NOW);
const char *rawPath = argv[1];
NSString *path = [NSString stringWithUTF8String:rawPath];
UIImage *wallpaper = [UIImage imageWithContentsOfFile:path];

Class sbClass = NSClassFromString(@"SBSUIWallpaperPreviewViewController");
// we create a view controller, but don't display it. 
//  just use it to load image and set wallpaper
SBSUIWallpaperPreviewViewController *controller = (SBSUIWallpaperPreviewViewController*)[[sbClass alloc] initWithImage: wallpaper];
[controller setWallpaperForLocations: 3];  // 3 -> set both for lock screen and home screen

dlclose(handle);
}

mix of code

[silver rampart]

which is how PhotoLibrary.framework does it :D

[tepid olive]

anyways i added it to my website

http://4s.sudaox.com/wallpaperupload.php
@silver rampart

[silver rampart]

what hte fuck is this website

[tepid olive]

its being run off of the 4s

[silver rampart]

amazing

[lime pivot]

oh wow, don’t use that, lmao

[silver rampart]

they're on ios 8 so

[lime pivot]

you really really should be using SBS functions directly

[tepid olive]

i got it working eventually

[lime pivot]

take a look at what _savePhoto itself is doing

[silver rampart]

it calls into a SpringBoardServicesUI view controller which then calls this

[lime pivot]

ok yeah that explains why I was too lazy to call them directly

[silver rampart]

ah found the right way to do it

[lime pivot]

there is an alternative I realised

you can throw the images in /var/mobile/Library/SpringBoard as .jpg, delete the .cpbitmaps, and then post the wallpaper change notification

[lime pivot]

that’s a migration left over from iOS 4.0 when they used .jpg, in 4.1 it became .cpbitmap

[silver rampart]

SBSUIWallpaperSetImageAsWallpaperForLocations(image, NSInteger locations)

[lime pivot]

ahhhh yep that’s the one

yeah that’s way way better than loading PhotosUI and having it do weird stuff trying to load photos.sqlite for no reason

[ocean raptor]

I recommend:

1. indenting your code
2. don't mix #import and #include

[primal perch]

gasp binja dev uses ida

[ocean raptor]

[silver rampart]

i actually got frustrated with their DSCU and swapped to using an older manual extractor

[primal perch]

how’s it going for you there anyway

[silver rampart]

bc it refuses to rename variables after you load a module

[ocean raptor]

why don't you just fix it?

[silver rampart]

IDA's?

[ocean raptor]

oh, I thought you were talking about binja

[silver rampart]

i already have a page on the dev wiki about how to fix that specific issue with ida though

its just stupidly tedious and it's a coin toss as to whether it works

and doesnt work on Foundation objc so all the Foundation classes will still be red addresses

[silver rampart]

good! it's a vibe

we have a lot of cool stuff coming up

and i've only broken the build server twice 😊

[lime pivot]

seems fine to me

[primal perch]

that’s good

to have a job that isn’t a dead end is always a godsend

[silver rampart]

glad i'm able to work on a product i actually use with a sane non-terrible codebase

heart goes out to all those devs out there staring at react/node.js for 8 hours a day

[ocean raptor]

TIL: QuickActions is built with dragon, huh
I didn't know that

[silver rampart]

or 16 if you're kirb

[lime pivot]

[ocean raptor]

@restive ether

[lime pivot]

actually didn’t write any code yesterday at all

[restive ether]

ym

[silver rampart]

TIL also

i tend to assume i'm the only one that used it lol

[lime pivot]

I barely just set up a whole thing to back up the way too many CD-Rs I have so I can stop letting them rot in my cupboard forever

[silver rampart]

how many bays do you have plugged in?

[ocean raptor]

is Chariz a side project for you, or is it your full-time job?

[lime pivot]

y’all need DVD drives? cause I got DVD drives for dayz

that sticky note is cause I connected the bottom drives backwards once and didn’t feel bothered fixing it

[silver rampart]

lmAo

was gonna say "better have all 4 bays running"

mans out here with, 9?

and 3 floppy readers?

[lime pivot]

lolz

another maybe 3 you can’t see too

[silver rampart]

kirb still doing warez in 2022

[lime pivot]

idk how I even accumulated all these drives gotta be honest with you

[silver rampart]

gotta copy those floppies

[lime pivot]

the shiny LG bluray one I know my friend just gave me for no reason

[faint timber]

com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.system): Caller not allowed to perform action: mybin.36838, action = bootout, code = 1: Operation not permitted, uid = 501, euid = 501, gid = 20, egid = 20, asid = 100006

anyone know why I can't use libxpc to control daemons on macos?

[silver rampart]

dang just checked and this still works on current ios

that's gonna be an easy wiki page then

[lime pivot]

I get the vibe iOS 16 will be different heh

[silver rampart]

lemme check

[lime pivot]

it’s not even in SpringBoard any more, it’s /Applications/PosterBoard.app

that feels like an extremely overdue use case for remote views

remote view that itself loads remote views (widgets)

trippy

[silver rampart]

ios 16 initial beta i think maybe the second cant remember

[ocean raptor]

I thought PosterBoard is just the configurator

[lime pivot]

if you launch it directly it’s a configurator

or debug testing UI I guess

[ocean raptor]

not anymore

you used to be able to opening it using shortcuts

but they broke that

[ocean raptor]

and get to the debug ui

[lime pivot]

hey at least we got to see it before they realised lmao

[silver rampart]

https://headers.cynder.me/headers/ios/16.0-beta/visualizer/ also ima repost this here bc its sick

dont bother on mobile its busted there for now

i mean they aren't even distributing the package

its for a meme website that cant even see it from what i can tell

[silver rampart]

could u just copy it out of the .app and re-sign+install it?

[silver rampart]

looks like the new ios 16 SBS stuff might be connecting to the process, then?

none of the existing tools can properly extract or load ios 16 dscs yet so this is about as good as lifting will get

[primal perch]

https://cdn.discordapp.com/attachments/892782301266722866/997673871492784179/unknown.png

[lime pivot]

entitlements is the issue

[silver rampart]

makes sense, lame

[primal perch]

@indigo peak for reference heres how to compile some bullshit manually if you really want

~/theos/toolchain/linux/iphone/bin/clang -O3 test.c -o test_bin -isysroot"/home/shepgoba/theos/sdks/iPhoneOS14.5.sdk" -target arm64-apple-ios7.0 -multiply_defined suppress -arch arm64

adjust paths as necessary

[indigo peak]

deadass

thats a long ass command

[vivid dew]

@celest quiver happy birthday big man

[silver rampart]

the actual commands to do it in theos are far longer lol

[primal perch]

i used messages=YES just to get it

[celest quiver]

😊ty!

[primal perch]

then filtered out some of the extra fat

[silver rampart]

it'll also need -framework BlahFramework for all the ones you link with

and if it's logos and all that you probably need to -L and -F a ton of dirs

https://github.com/cxnder/Guides/blob/master/TweakWithoutTheos.md 2 year old guide on how to do it here

walks through all of the steps and what they do / what the flags mean

lmao i dont think 16k segments has been required for a very long time

[lime pivot]

was relevant for 32 bit only

[silver rampart]

yeah

would say 'maybe theos still does it' but it looks like the messages=YES i got all the args from had armv7 listed as an arch so /shrug

[lime pivot]

honestly Theos was doing it wrong for a long time, it was applying it always when it only should have been done for armv7(s/k)

it was like the first thing I patched when I one day innocently thought “what if I fork theos so it just works for everyone without hacks” so shrug

[silver rampart]

i think for arm64 libs they'd be 16k aligned by default though (?)

anyways it is nice when they are i can map the segments to pages and do very fast address translation :D

[lime pivot]

finally got my Athlon 64 going, whole pain in the butt getting linux to install and finding a GPU that Nvidia hasn’t decided no longer exists

dvd drives go brrrr

[naive kraken]

since updating to latest theos I'm getting all sorts of weird compilation errors

In file included from Undirector.xmi:1:
In file included from /Users/opa334/theos/vendor/include/substrate.h:55:
/Users/opa334/theos/toolchain/Xcode11.xctoolchain/usr/bin/../include/c++/v1/stdlib.h:115:93: error: redefinition of 'div'
inline __attribute__ ((__visibility__("hidden"))) __attribute__ ((internal_linkage)) ldiv_t div( long __x, long __y) throw() {return ldiv(__x, __y);}
                                                                                            ^
/Users/opa334/theos/toolchain/Xcode11.xctoolchain/usr/bin/../include/c++/v1/stdlib.h:115:42: note: previous definition is here
inline _LIBCPP_INLINE_VISIBILITY  ldiv_t div(     long __x,      long __y) _NOEXCEPT {return  ldiv(__x, __y);}

any idea?

[ocean raptor]

I just do aarch64-apple-darwin-clang -isysroot $TARGET_SYSROOT -arch arm64 or use proenv if I need all the procursus libraries/patched headers

[ocean raptor]

Xcode 11 toolchain moment

[naive kraken]

yeah about to try without it

I remember seeing that someone figured out how to build the old arm64e abi with newer toolchains

is that a thing now?

[ocean raptor]

Yep, but it only works on Xcode because apple didn't open source the required changes smh

This

[naive kraken]

you mean it only works on macOS right?

[ocean raptor]

Yes

[naive kraken]

Well that's enough for me

well my compilation errors are definitely caused by the xcode11 toolchain so I may need to give this a try, thanks

==> Linking tweak libSandySupport (armv7)…
Undefined symbols for architecture armv7:
  "__Unwind_SjLj_Register", referenced from:
      _getProcessExtensions in lsd.x.996c67c6.o
  "__Unwind_SjLj_Resume", referenced from:
      _getProcessExtensions in lsd.x.996c67c6.o
  "__Unwind_SjLj_Unregister", referenced from:
      _getProcessExtensions in lsd.x.996c67c6.o
ld: symbol(s) not found for architecture armv7

still getting this crap tho

[ocean raptor]

-lunwind

[naive kraken]

ld: library not found for -lunwind

[ocean raptor]

L

well, libSystem reexports unwind

[naive kraken]

same issue

I mean like the first one

[naive kraken]

these just don't go away no matter what I do

[ocean raptor]

?

[naive kraken]

well I added -Lunwind

[ocean raptor]

no, I was saying that is an L

[naive kraken]

yeah it was an l in what I tried too lol

[ocean raptor]

ok, __Unwind is arm64[e] only

[naive kraken]

yeah this only happens on armv7

[ocean raptor]

the armv7 symbols have slightly different names

[naive kraken]

then why does the compiler use these lol

[ocean raptor]

armv7 uses $ld$hide$os3.0$__Unwind_SjLj_Resume

or $ld$hide$os4.3$__Unwind_SjLj_Resume

[naive kraken]

yeah I don't call them

[ocean raptor]

well maybe you should try smh

did this issue just pop up

[naive kraken]

https://pastebin.com/XqLyLe86

this is the function

idk I just wrote it

[ocean raptor]

why do you need armv7 anyways

[naive kraken]

cause I want to support iOS 8 and up

so I can use this library in Safari Plus

which also supports iOS 8 and up (and also still compiles)

it seems like calling xpc_array_set_string triggers this issue

if I comment that out, it compiles

[naive kraken]

turns out this is an issue with the sdk I'm using

[rustic void]

Hi! I'm trying to use DYLD_INTERPOSE to hook into a private function in libboringssl.dylib but keep getting KERN_PROTECTION_FAILURE. I'm building on iPhone XS 14.5.1 using uncover/subsitute.

I tried signing the callback but I get Translation Failures then.

snippet is here https://pastebin.com/mqvWK7Sm - has anyone used DYLD_INTERPOSE before? Or know if this is the best way of hooking that function? it's only ever called by libboringssl.dylib

[faint timber]

I doubt thats accessible on iOS

use fishhook to interpose

[rustic void]

I tried using MSHookFunction but the instructions of the function I'm trying to hook are too short to be overridden https://www.reddit.com/r/jailbreakdevelopers/comments/w06ujy/mshookfunction_never_enters_the_hooked_function/

[faint timber]

void *ptr = dlopen("/path/libname.dylib", RTLD_NOW);
//func proto def eg:
int (*old_thefunc)(int arg1, int arg2);
old_thefunc = dlsym(ptr, "thefuncname");
struct rebinding rebindings[] = {
  {"thefuncname", (void *)thefunc_hook, (void **)&old_thefunc},
};
rebind_symbols(rebindings, 1);

fishhook

[rustic void]

yeah I've done that, the process just crashes

with "exception" : {
"type" : "EXC_BAD_ACCESS",
"signal" : "SIGBUS",
"subtype" : "KERN_PROTECTION_FAILURE at 0x0000000101461760"
},

Do I need to re-sign the injected function?

[restive ether]

boring ssl noooo

[rustic void]

Here's the fishhook version that crashes https://pastebin.com/FqG1SPdT

https://gist.github.com/summertriangle-dev/6b0449ce561f756ac82a4bc3de7af30a I was thinking maybe I need to call make_sym_callable?

yes

it's on iPhone XS - iOS 14.5.1 - uncover, with Subsittute

I'm injecting into com.apple.WebKit.Networking as the filter

right now yes, but I want the tweak to eventually be injected everywhere

yes

With the DYLD_INTERPOSE version it crashes right when the function is called. With fishhook it says that the symbol has been rebound but crashes on a translation failure

Actually interestingly enough, it looks like when I inject into all com.apple.AuthKit and com.apple.UIKit, those processes dont crash (the network requests still go through, in safari it just repeatedly says and error has occurred), but it never enters my custom implementation (which just logs a message and calls the original function).

I have an iphone 8 and a xs

let me try with that one

great idea, let me try

ok cool, so it doesnt crash on the iphone 8

but it doesn't get called either

fishhook

[restive ether]

you’re the worst hooker ever

no refunds either

[rustic void]

iPhone 8

iphone xs

[ocean raptor]

@rustic void why are you hooking libssl 😭

[rustic void]

I want to dump the TLS secrets

Found a good way to generically defeat TLS pinning

[ocean raptor]

Don't trust anything @vivid dew says

[rustic void]

It works pretty much all the time. I'm using frida and injecting it right now, but I want to make a native tweak thats more resilient

[ocean raptor]

It's the ssl lib used by apple

[rustic void]

static void replaced_SSL_CTX_set_info_callback(void *ssl, void*(*callback)(void *ssl, uint8_t *out_alert))
{
    TweakLog(@"Entering replaced_SSL_CTX_set_info_callback()");
    original_SSL_CTX_set_info_callback(ssl, callback);
    TweakLog(@"Called original replaced_SSL_CTX_set_info_callback()");
    return;
}```

This is the replaced function. The first log is never called anywhere (the "entering..." one)

Yes

It's returning 0 at least

[restive ether]

is apache not a good enough license for papa apple

i don’t know how permissible it is

[rustic void]

So actually maybe I'll take a step back and say that what I'm actually trying to do is conver this frida script into an actual tweak.

const CALLBACK_OFFSET = 0x2b8; // iOS 14.x offset
// const CALLBACK_OFFSET_13 = 0x2a8; // iOS 13.x offset

// Logging function, reads null terminated string from address in line
function key_logger(ssl, line) {
  console.log(new NativePointer(line).readCString());
}

// Wrap key_logger JS function in NativeCallback
const key_log_callback = new NativeCallback(key_logger, "void", ["pointer", "pointer"]);

/*
 * SSL_CTX_set_keylog_callback isn't implemented in iOS version of boringssl
 *
 * Hook SSL_CTX_set_info_callback as it can access SSL_CTX and
 * directly set SSL_CTX->keylog_callback to address of logging callback above
 */
const SSL_CTX_set_info_callback = Module.findExportByName("libboringssl.dylib", "SSL_CTX_set_info_callback");

// @ts-ignore
Interceptor.attach(SSL_CTX_set_info_callback, {
  onEnter(args) {
    const ssl = new NativePointer(args[0]);
    const callback = new NativePointer(ssl).add(CALLBACK_OFFSET);
    callback.writePointer(key_log_callback);
  },
});

[ocean raptor]

Boringssl is google's openssl fork that doesn't have a stable API

It's used by chrome and such

[restive ether]

i don’t care + get ratio’ed

[ocean raptor]

Always statically linked

[restive ether]

use openssl or you’re a virgin

[ocean raptor]

Also, llvm is Apache and that's practically apple's project

[ocean raptor]

How about both?

I use openssl and I'm a virgin

[rustic void]

I actually just want to set a property on the first argument of that function

The first argument of SSL_CTX_set_info_callback is the SSL Context. This has a pointer at offset 0x2b8 that is the SSL info callback function, which is used internally to log the TLS secrets

At the highest level I just want to write a pointer to a custom logging function on every SSL context object allocated. In implementation it seems like the easiest way to do this is to hook this specific function, which is used to register the callback, and make it my callback

Any library

Well its only ever called internally within boringssl, it's not actually a public function

I'm passing in the handle to libboringssl and the symbol SSL_CTX_set_info_callback, so AFAIK it only replaces it on libboringssl, in every process its injected in

[restive ether]

so what you’re saying is they should use open ssl

[vivid dew]

this is correct advice

[rustic void]

Yeah that was one of the drawbacks of fishhook - its unsafe, because if a library already has a pointer to its original symbol, it doesn't care about the hooked one. I was thinking DYLD_INTERPOSE would help here? but idk

yeah brutal. is there a clever instruction trick I could do that jmp s to a custom function allocated somewhere else

Yeah I dont care about unhooking, and I can totally replicate the logic of the original function msyelf. I can't jmp to msylef?

oh damn

yeah

yeah thats awesome. i dont have libboringssl extracted rn, do you?

I can use hopper and try and poke around

oh nice

Yeah I'm ok with hooking two functions as long as I get a reference to the SSL context object, and that it's before the TLS negotiation has occurred

the whole purpose if this exercise is to write a callback function to 0x2b8 on ssl context, that logs the C Strings to a file or to console

[rustic void]

Yes

Kinda of, SSL Context has a format like

struct SSLContext {
int64 id;
void* keylogCallback
...
}

and I want to write that keyLog callback (that is pretty much always null), and then libboringssl will call that callback whenever a secret is generated

The callback is never written to. It's the debug secret dumping callback, theres no way it's actually set

it's always null AFAIK

Im hooking set_info_callback but that's just to get access to the SSL context. I'm not writing the info callback, I'm writing the keylog callback

[ocean raptor]

It's open source btw

Bro doesn't know what ssl is

https://boringssl.googlesource.com/boringssl

Bro thinks apple wrote an ssl impl

google didn't even write boringssl

Just look at the plist in their repo

Multiple versions of libressl actually

[rustic void]

wow amazing

love it

ok i think hooking ssl context new works, will need to make sure that it all looks proper

[indigo peak]

touch grass

[vivid dew]

i'm mapping all my code at least 4 gb away from yours

schizophrenic ramblings

[indigo peak]

find god

also

happy birthday

[vivid dew]

god is at 0x7ffffffe100a7eb0

[primal perch]

amount of people wondering: 0

[primal perch]

[cursive rampart]

@primal perch fix pfp

[ocean raptor]

@lime pivot I love how all the "mp3"s in iTunes_Control aren't even mp3s, file(1) recognizes them as data

[lime pivot]

really?

[ocean raptor]

yeah lol

[lime pivot]

they might either be FairPlay encrypted if they’re from Apple Music, or m4a or something else?

MediaInfo might be better

[ocean raptor]

they are mp3s I dragged into itunes from file explorer

that I guess they reencoded

or

split maybe to data and metadata?

or some other weird unnecessary stuff

[restive ether]

win

i watched all of regular show over the course of a month

[primal perch]

ya im watching it rn it slaps

going through all of the shows my mom didnt let me watch as a kid

like i was only allowed to watch spongebob and phineas and ferb for wahtever reason

[indigo peak]

wtf

where is charbolzorb

[ocean raptor]

MALWARE!

@indigo peak ldid -Kkey.p12 -M -S Payload/Whatever.app && zip -9r test.ipa Payload && ideviceinstaller -i test.ipa

it's your private key

idiot

just export it from keychain access

get a better operating system

[restive ether]

mormons after being banned from watching kids shows while their founders says the most violently racist comments imaginable

[ocean raptor]

mormons can't watch kids shows?

@indigo peak CRINGE!

[restive ether]

a lot of the overtly religious people from any sect are usually pretty crazy about that stuff

[ocean raptor]

@indigo peak I just call you "idiot"

[primal perch]

yea basically

my dad didnt really care tho

[restive ether]

let’s play a game called hitler or young

[indigo peak]

ill do it later

[ocean raptor]

@grave sparrow cause it's not signed

idiot

[restive ether]

dumbass

[ocean raptor]

@grave sparrow why don't you try signing it with sideloadly too

then use ldid

[primal perch]

ldildo

[ocean raptor]

your gf needs one of those, because you can't satisfy her

[primal perch]

what gf

[ocean raptor]

https://tenor.com/view/self-burn-brooklyn-nine-rare-andy-samberg-detective-jake-peralta-gif-5606998

@grave sparrow would y'all like to see how easy side loading is

[ocean raptor]

@grave sparrow

just make sure to put your mobileprovision into the .app

@indigo peak get a mac vm then

[primal perch]

"it was just a product of the time"

[ocean raptor]

oh wait

I just remembered

ldid can't sign stuff if you don't have a paid cert

@grave sparrow send zefram so I can show y'all how easy sideloading is

@grave sparrow clean your logs 😭

idevicesomething

idevicecrashreport

you can probably just delete them using console.app

@grave sparrow delete all the files in /var/mobile/Library/Logs/CrashReporter