Proteas

void inject_trusts(int pathc, const char *paths[])
{
    printf("[+] injecting into trust cache...\n");
    
    extern uint64_t g_kern_base;
    
    static uint64_t tc = 0;
    if (tc == 0) {
        /* loaded_trust_caches
         iPhone11,2-4-6: 0xFFFFFFF008F702C8

nmoinvaz

Apple MachO Code Signature with Ticket file format structure

• Super blob (embedded signature = 0xfade0cc0)
  • Blob (code directory = 0xfade0c02)
    • Code signature (DER encoded)
  • Blob wrapper (fade0b01)
    • Length [4]
    • Offset [4]
    • Type? [4] = 256? (signature?)
• Unknown [4] 239?

huishannetaporter

# Create the .itmsp folder
mkdir <path to your .itmsp folder>/<name of your .itmsp folder>.itmsp

# Move your .ipa file into the .itmsp folder
cp <path to where your .ipa file is stored> <path to your .itmsp folder>/<name of your .itmsp folder >.itmsp

# Generate the metadata.xml file
fileSize=` stat -f %z <Your .ipa file>`
md5Checksum=`md5 <Your .ipa file>  | cut -d "=" -f 2 | awk '{print $1}'`

andripwn

#!/bin/bash

# colors
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[0;33m'
RESET='\033[0m'

# install homebrew
echo -e "[-] ${GREEN}install homebrew...${RESET}"

eybisi

Java.perform(function(){
    let ThreadDef = Java.use('java.lang.Thread');
    let ThreadObj = ThreadDef.$new();
    function stackTrace() {
                console.log('------------START STACK---------------')
                let stack = ThreadObj.currentThread().getStackTrace();
                for (let i = 0; i < stack.length; i++) {
                                console.log(i + ' => ' + stack[i].toString());
                            }
                console.log('------------END STACK---------------');