| Welcome, Guest |
You have to register before you can post on our site.
|
| Online Users |
There are currently 60 online users.
» 0 Member(s) | 57 Guest(s)
Facebook, Forum Biopsy Bot [Anti-Spam], Twitter
|
| Latest Threads |
iOS 18.4 - 12.0 - How to ...
by GeoSn0w
05-03-2025, 06:12 PM
|
iOS 17 - 9.0 Turdus Merul...
by GeoSn0w
04-06-2025, 08:04 PM
|
iOS 18.2 - iOS 17 Jailbre...
by GeoSn0w
04-06-2025, 08:04 PM
|
iOS 18.2 - iOS 17.0 (All ...
by GeoSn0w
03-27-2025, 11:14 PM
|
Ian Beer RELEASED HUGE iO...
by GeoSn0w
03-27-2025, 10:21 PM
|
iOS 17.7.5 - 11.3 DOWNGRA...
by GeoSn0w
03-24-2025, 11:18 PM
|
iOS Jailbreak News / New ...
by GeoSn0w
03-24-2025, 10:41 PM
|
iOS 18.4 - iOS 16 (All De...
by GeoSn0w
03-24-2025, 10:10 PM
|
iOS 18.3.2 - iOS 16 Jailb...
by GeoSn0w
03-19-2025, 11:38 PM
|
AMAZING RELEASE: New iOS ...
by GeoSn0w
03-12-2025, 10:07 PM
|
|
|
iOS 12.2 / 12.1.4 / 12.1.3 IMPORTANT Unc0ver Jailbreak Update (Update Now!) + 4K Devi |
|
Posted by: GeoSn0w - 07-21-2019, 04:10 AM - Forum: Jailbreak News
- No Replies
|
 |
In today's video, we're discussing the latest Unc0ver Jailbreak update released by Pwn20wnd just a few hours ago which adds support for the 4K devices (iPhone 5S, iPhone 6, iPhone 6 Plus, iPod Touch 6 etc.) , and includes a completely new tfp0 kernel exploit created by Jake James, the developer behind the RootlessJB Jailbreak. The exploit is created around the vulnerability found by Ned Williamson of Google Project Zero, and it supports A7 through A11 devices. The update makes the exploit much more reliable and the jailbreak much better, even for the 16K devices (iPhone 6S and newer). A12 devices are still not supported for now. The 4K devices can now Jailbreak with #Cydia included.
Ned Williamson also announced on his Twitter account that he's currently updating his Sock Puppet tfp0 kernel exploit to support 4K devices (he has successfully confirmed it working on iPhone 5S on iOS 12.2), and he's also improving the overall speed and reliability of the exploit. Once he releases, Pwn20wnd might update it into #Unc0ver to make the Unc0ver Jailbreak even faster.
As always, do not forget to SUBSCRIBE to stay updated with the latest #iOS and #Jailbreak news, tutorials and updates!
|
|
|
Problem Going to 8.4.1 |
|
Posted by: Comet - 07-19-2019, 09:29 PM - Forum: iOS Downgrade Corner
- No Replies
|
 |
Hi, as you all know, I am Comet!, My downgrade tool is finished but I am running into a error that I only seem to be getting on my iPhone 5 GSM on iOS 10.3.3. When the OTA appears everything goes great until I am stuck on Estimating time remaining. I have already tried restoring via iTunes and reseting on-device. Nothing seems to be working. Can anyone shed any light on this topic? (EDIT) After days of testing, I figured it out myself. For anyone else having this issue, Before you install any sort of downgrade tweak, go to the App Store and install a VPN, after install the tweak, restart and connect to VPN. Go to settings and it should fix any issue that you are having! Have a nice day everyone. Hoped this you, or someone else. This was a really big pain to figure out lol.
|
|
|
|
iOS 12.2 / 12.1.4 / 12.1.3 JAILBREAK For A12 Devices | When To Expect It |
|
Posted by: GeoSn0w - 07-19-2019, 04:40 AM - Forum: Jailbreak News
- No Replies
|
|
In today's video, we're taking a look at the status of the A12 devices Jailbreak for iOS 12.1.3, iOS 12.1.4 and iOS 12.2. As you probably know, the A12 devices (iPhone XS, XR, and XS MAX) were completely left out from both the Unc0ver Jailbreak and from the Chimera / Electra Jailbreak. There is a good reason for that, and we explain it in this video so that people can make educated guesses on what is the appropriate version to stay on and when will we get an #A12 Jailbreak with Cydia or with Sileo.
Unfortunately, the reason no A12 Jailbreak was updated or created for iOS 12.1.3 all the way up to iOS 12.2, is due to PAC (Pointer Authentication Codes) for which we need a bypass. The bypass used by the Chimera Jailbreak in iOS 12.0 up to iOS 12.1.2 for A12 devices is unfortunately no longer functional and we need a different one. Siguza, an iOS Jailbreak developer, has confirmed a few days ago that there are current methods outlined by Brandon Azad of Google Project Zero that still work for iOS 12.2, but those need to be implemented first. Brandon has presented the techniques at MOSEC 2019 conference.
As always, do not forget to SUBSCRIBE to stay updated with the latest #iOS and #Jailbreak news, tutorials and updates!
|
|
|
|
|
iOS 12.3.1 / 12.3 / 12.4 JAILBREAK News / Status: Tfp0 Status, When Should We Expect |
|
Posted by: GeoSn0w - 07-18-2019, 05:37 AM - Forum: Jailbreak News
- No Replies
|
|
In today's video, we're discussing the current status of the iOS 12.3.1, iOS 12.3 and iOS 12.4 Jailbreak for iPhone 5S all the way up to iPhone XS MAX (A12). After the Unc0ver Jailbreak was released for iOS 12.1.3 up to iOS 12.2 a few days ago, people on iOS 12.3 to 12.3.1 started having questions on where they will get a jailbreak as well. The answer is a bit complicated. We do have what it takes to build one, but it was not released yet. In this video we're discussing why, and when should we expect the tfp0 to be released by @derrek6.
In the meantime, it's a great idea to go ahead and save your SHSH2 blobs for iOS 12.3 and iOS 12.3.1 as these versions are currently signed, with iOS 12.3.1 being the latest stable version, and iOS 12.4 is currently in Beta 7. Once iOS 12.4 is released as a stable build, iOS 12.3 will likely stop being signed, so I recommend saving your SHSH2 blobs while it's still doable.
The tfp0 kernel bug is extremely important for the development of not only the jailbreak, but also for applications like GeoFilza, Osiris Jailbreak, NonceSetter, and other tfp0-based apps. Actually, 99% of the times, if there is no tfp0 publicly available for that iOS version, it's not possible to make a jailbreak for it. The tfp0 offers kernel VM read/write, letting us apply the necessary jailbreak patches. As always, do not forget to SUBSCRIBE to stay updated with the latest #iOS and #Jailbreak news, updates and tutorials.
|
|
|
|
| Curious |
|
Posted by: Creoleotter - 07-15-2019, 07:13 PM - Forum: Jailbreak Development
- Replies (2)
|
 |
Simply put. Where does one begin their development in creating a jb. And what “skill” or knowledge is needing in finding exploits necessary to compile one?
|
|
|
|
| Tom's Tool Dump #0 |
|
Posted by: tomnific - 07-15-2019, 12:15 AM - Forum: Useful Tools and Utilities
- No Replies
|
 |
Hey y'all, I've been a lurker in this community for eons, and it's about time I contributed something.
What I've got for y'all today are some betas for various tools I've been working on for the past couple months, and have been holding off on publishing until they were all ready.
iksof (iOS Kernel Symbol Offset Finder)
Just another in the long list of offset finders out there. When I first started writing this, the idea was to finally have a nice platform binary, rather than a shell script for finding symbol offsets in an IPSW file's kernelcache. I recently realized that there's actually a few out there already and that I just wasn't looking hard enough. Regardless, this is a thing I made, and I think it has potential
In essence, it tries to get all symbol offsets you could possibly need, and prints them out as macro definitions for you.
It's open-source and on GitHub here: https://github.com/tomnific/iksof
Logos++
Let's face it, using Logos to interact with Swift is just plain awful. I mean, I suppose it's better than using raw MobileSubstrate calls, but it's still counter to the purpose of Logos, which is to simplify the hooking process.
Logos++ make hooking Swift just as easy as hooking anything else. Hooking a Swift class looks nearly identical to hooking any other class. And hooking a function - well just look at the before and after:
Logos:
Code:
static void (*orig_ViewController_randomFunction)(void) = NULL;
void hook_ViewController_randomFunction() {
orig_ViewController_randomFunction();
NSLog(@"Hooked random function");
}
%ctor {
%init(ViewController = objc_getClass("HookExampleApp.ViewController"));
MSHookFunction(MSFindSymbol(NULL, "__T014HookExampleApp14ViewControllerC14randomFunctionyyF"),
(void*)hook_ViewController_randomFunction,
(void**)&orig_ViewController_randomFunction);
}
Logos++:
Code:
%hookswiftf("HookExampleApp.ViewController", void, "__T014HookExampleApp14ViewControllerC14randomFunctionyyF", void)
{
%orig;
NSLog(@"Hooked random function");
}
Like C++ compiles down to C, Logos++ gets translated down to plain logos using a tool called Logos--.
At its current state, it's mostly a proof of concept, but it is entirely useable. However, I know a lot of tweak developers develop on their iDevices, so, unfortunately, this may be difficult for them to integrate into their process, as Logos-- is a Java program.
As you'll see, the different parts of the language handle Swift's name mangling in different ways. Based on user feedback, the language will be changed to support one consistent method of handling it.
You can find it on GitHub here: https://github.com/tomnific/LogosXX
Xpwnd
Xpwnd is perhaps the tool I'm most excited to share (no relation to the xpwn toolsuite). In short, it's a modded version of Xcode that has custom SDKs geared towards both iOS Security Research and Jailbreak development (with Tweak development hopefully coming down the road)
I noticed that most jailbreaks seem to have a "standard library", if you will, of helper utilities (these utilities are found in almost every jailbreak). In addition, things like QiLin, IOKit and some headers from the macOS SDK are also frequently copied over into their own local includes. Instead of repetitively including these source files and libraries, I wanted to make something that lets you include them like any normal standard C library header. This was the genesis of the idea for a Jailbreak SDK
However, I quickly learned that adding arbitrary SDKs to Xcode is not an easy task and has some unintended side effects. Eventually, I decided it would be much simpler, and safer, if there was simply a second Xcode dedicated to this kind of work. Thus, Xpwnd was born.
There are some kinks that I'm afraid may be inherently unpatchable, but they don't fully inhibit anything and in spite of them, Xpwnd is actually surprisingly stable.
Quick aside: during the making of Xpwnd, I also managed to figure out how Xcode handles the mythical Sparse SDKs - something that was previously thought to be a killed feature (but I'll post more on that elsewhere in the future).
Right now, I've been focusing on the Jailbreak Development side of Xpwnd, so that's probably where you'll see the most changes coming up.
Xpwnd is installable with a simple shell script - all that's needed is a vanilla Xcode, about 30 minutes of time, and 40GB of free storage (Xpwnd is only 20GB after the installation). In the README, there's a full list of bugs and how they can be mitigated until a permanent solution is found.
You can find Xpwnd on GitHub here: https://github.com/tomnific/Xpwnd
TLDR; I'm publishing betas of some stuff I've been working on:- iksof - iOS Kernel Symbol Offset Finder tool
- Logos++ - a superset of Logos that supports Swift
- Xpwnd - a modded version of Xcode designed to aid each level of the jailbreak stack
Stay tuned,
~ tomnific
|
|
|
|
|
