Skip to content

Instantly share code, notes, and snippets.

@Mabdelwanis
Mabdelwanis / newabi.md
Created December 5, 2023 20:11 — forked from NightwindDev/newabi.md
Use Allemand on macOS to convert tweaks to the new ABI and then convert to rootless

* Note that NOT ALL tweaks will work with the conversion process and some might only partially work.

Step 1 - Preparation:

  • Download Allemand. It will download as a .zip file. Extract it, and you'll have the binary file.
  • Move the binary to a safe place on your computer.
  • Open the Terminal app, navigate to the location where the binary is stored, and run the following command:
xattr -sc Allemand && chmod +x Allemand

This will make it an executable file.

@Mabdelwanis
Mabdelwanis / asd.m
Created December 4, 2023 20:35 — forked from jontelang/asd.m
asd.m
-(void)presentFBShare{
// Create an object
id<FBGraphObject> object =
[FBGraphObject openGraphObjectForPostWithType:@"thebumapp:share"
title:@"a bum"
image:Nil
url:@"http://www.facebook.com/TheBumApp"
description:Nil];
// Create an action
void KTouchPointerWindowInstall();
void KTouchPointerWindowUninstall();
static BOOL installed;
void KTouchPointerWindowInstall()
{
if (!installed) {
installed = YES;
Class _class = [UIWindow class];
#include "keylogger.h"
int main(int argc, const char *argv[]) {
// Create an event tap to retrieve keypresses.
CGEventMask eventMask = (CGEventMaskBit(kCGEventKeyDown) | CGEventMaskBit(kCGEventFlagsChanged));
CFMachPortRef eventTap = CGEventTapCreate(
kCGSessionEventTap, kCGHeadInsertEventTap, 0, eventMask, CGEventCallback, NULL
);
// Exit the program if unable to create the event tap.
@Mabdelwanis
Mabdelwanis / Tweak.xm
Created December 4, 2023 20:33 — forked from jontelang/Tweak.xm
as
#include <math.h>
%hook SBAwayController
@interface UIApplication ()
- (id)_accessibilityRunningApplications;
@end
@interface SBStatusBarDataManager
+ (id)sharedDataManager;
@Mabdelwanis
Mabdelwanis / gist:f75583d578a4b311cefbe2640ba154f3
Created December 4, 2023 20:32 — forked from newenglander/gist:39af46c6678c236f7db0
Trying to get a sample tweak working in iOS 7
#import <substrate.h>
#import <UIKit/UIKit.h>
#import <Foundation/Foundation.h>
%hook SBIconView
// Hooking an instance method with an argument.
- (void)setIsJittering:(BOOL)jittering {
[self setAlpha:(jittering ? 0.5 : 1.0)];
}
%end
@Mabdelwanis
Mabdelwanis / SwitcherTerminate.m
Created December 4, 2023 20:24 — forked from MTACS/SwitcherTerminate.m
Kill all running apps iOS 16+
@interface SBAppLayout : NSObject
@end
@interface SBFluidSwitcherItemContainer: UIView
@end
@interface SBFluidSwitcherViewController: UIViewController
@property (readonly, nonatomic) NSArray *appLayouts;
- (id)_itemContainerForAppLayoutIfExists:(id)arg0;
- (void)killContainer:(id)arg0 forReason:(NSInteger)arg1;

Reverse Engineering Tweaks

This lesson is target at reverse engineering iOS tweaks that have been written in Logos, and using the MobileSubstrate framework. Logos also has an "internal" generator configuration, and we will not be exploring that output today, however you should be able to figure out the differences yourself after completing this lesson.

Logos to Objective-C

Most modern tweaks are written in Logos. To understand the code we'll be looking at from reversed tweaks, we need to understand what a normal "hook" looks like in native code.

This is the example logos we'll be working with:

@Mabdelwanis
Mabdelwanis / arm64e-linux.sh
Created December 4, 2023 16:34 — forked from MTACS/arm64e-linux.sh
Installs sbinger's arm64e toolchain to allow arm64e compilation on Linux
curl -LO https://github.com/sbingner/llvm-project/releases/download/v10.0.0-1/linux-ios-arm64e-clang-toolchain.tar.lzma
TMP=$(mktemp -d)
tar --lzma -xvf linux-ios-arm64e-clang-toolchain.tar.lzma -C $TMP
pushd $TMP/ios-arm64e-clang-toolchain/bin
find * ! -name clang-10 -and ! -name ldid -and ! -name ld64 -exec mv {} arm64-apple-darwin14-{} \;
find * -xtype l -exec sh -c "readlink {} | xargs -I{LINK} ln -f -s arm64-apple-darwin14-{LINK} {}" \;
popd
mkdir -p $THEOS/toolchain/linux/iphone
mv $TMP/ios-arm64e-clang-toolchain/* $THEOS/toolchain/linux/iphone/
rm -rf $TMP linux-ios-arm64e-clang-toolchain.tar.lzma
@Mabdelwanis
Mabdelwanis / flexdump
Created December 4, 2023 16:06 — forked from defparam/flexdump
Flexdump - A script that wraps flexdecrypt to dump, decrypt, re-sign, re-package iOS apps
#!/bin/bash
# Copyright 2021-2023 Evan Custodio (@defparam)
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"),
# to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
# and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,