Mabdelwanis

@interface SBAppLayout : NSObject
@end

@interface SBFluidSwitcherItemContainer: UIView
@end

@interface SBFluidSwitcherViewController: UIViewController
@property (readonly, nonatomic) NSArray *appLayouts;
- (id)_itemContainerForAppLayoutIfExists:(id)arg0;
- (void)killContainer:(id)arg0 forReason:(NSInteger)arg1;

Mabdelwanis

Reverse Engineering Tweaks

This lesson is target at reverse engineering iOS tweaks that have been written in Logos, and using the MobileSubstrate framework. Logos also has an "internal" generator configuration, and we will not be exploring that output today, however you should be able to figure out the differences yourself after completing this lesson.

Logos to Objective-C

Most modern tweaks are written in Logos. To understand the code we'll be looking at from reversed tweaks, we need to understand what a normal "hook" looks like in native code.

This is the example logos we'll be working with:

Mabdelwanis

curl -LO https://github.com/sbingner/llvm-project/releases/download/v10.0.0-1/linux-ios-arm64e-clang-toolchain.tar.lzma
TMP=$(mktemp -d)
tar --lzma -xvf linux-ios-arm64e-clang-toolchain.tar.lzma -C $TMP
pushd $TMP/ios-arm64e-clang-toolchain/bin
find * ! -name clang-10 -and ! -name ldid -and ! -name ld64 -exec mv {} arm64-apple-darwin14-{} \;
find * -xtype l -exec sh -c "readlink {} | xargs -I{LINK} ln -f -s arm64-apple-darwin14-{LINK} {}" \;
popd
mkdir -p $THEOS/toolchain/linux/iphone
mv $TMP/ios-arm64e-clang-toolchain/* $THEOS/toolchain/linux/iphone/
rm -rf $TMP linux-ios-arm64e-clang-toolchain.tar.lzma

Mabdelwanis

#!/bin/bash
# Copyright 2021-2023 Evan Custodio (@defparam)
#
# Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), 
# to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, 
# and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,

Mabdelwanis

#import <UIKit/UIKit.h>

@interface _TtC4Toss11AppDelegate
- (BOOL)application:(UIApplication *)app openURL:(NSURL *)url options:(NSDictionary<UIApplicationOpenURLOptionsKey, id> *)options;
@end

@interface _TtC9KakaoTalk17TalkSceneDelegate
- (void)scene:(UIScene *)scene openURLContexts:(NSSet<UIOpenURLContext *> *)URLContexts;
@end

Mabdelwanis

#import <Foundation/Foundation.h>
#import <Security/Security.h>

typedef NS_ENUM(NSInteger, TSKTrustDecision) {
    TSKTrustDecisionShouldAllowConnection,
    TSKTrustDecisionShouldBlockConnection,
    TSKTrustDecisionDomainNotPinned,
};

%hook TSKPinningValidator

Mabdelwanis

// Inject into appstored and itunesstored

#import <MobileGestalt/MobileGestalt.h>

NSString *deviceClass;

%hook XDCDevice
- (NSString *)productType {
  return deviceClass;
}

Mabdelwanis

Hosted Preference Bundles

Create a "hosted" view of a preference bundle outside of Preferences.app, and in a dedicated application.

For application

• Create new tweak using "iphone/application_modern" template
• In the app's delegate file add the following to the -(void)applicationDidFinishLaunching:(UIApplication *)application; method:

Mabdelwanis

static NSString *accessGroupID() {
    NSDictionary *query = [NSDictionary dictionaryWithObjectsAndKeys:
                           (__bridge NSString *)kSecClassGenericPassword, (__bridge NSString *)kSecClass,
                           @"bundleSeedID", kSecAttrAccount,
                           @"", kSecAttrService,
                           (id)kCFBooleanTrue, kSecReturnAttributes,
                           nil];
    CFDictionaryRef result = nil;
    OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, (CFTypeRef *)&result);
    if (status == errSecItemNotFound)

Mabdelwanis

#import <substrate.h>

%hook SBAppSliderController

- (BOOL)sliderScroller:(id)scrollingViewController isIndexRemovable:(unsigned int)index
{	
	return YES;
}

- (void)sliderScroller:(id)scrollingViewController itemWantsToBeRemoved:(unsigned int)index