PsychoTea

Cracking Powersoft ArmoniaPlus Password Protected Presets

Presets in ArmoniaPlus can be protected with a password. While this feature could be used to stop someone modifying presets in a workspace accidentially, it seems to most commonly be used by speaker manafacturers wanting to "protect" their EQ/DSP settings for their speakers (ie. EAW greybox files).

Fortunately, it's easy enough to bypass the password protection in Armnonia by editing the DLL's using dnSpy. This can also be useful if you forget a preset password you previously set.

1. Ensure Armonia is closed
2. Open PowersoftSDK.Entities.dll in dnSpy(Ex) (must be running as admin)
3. Browse to the PowersoftSDK.Entities.Components.Base namespace and open the LockerComponent<T> class
4. Edit the IsCodeValid function and simply replace the contents with a return true statement

PsychoTea

import idc

def define_func(addr, name):               
        idc.MakeCode(addr)
        idc.MakeFunction(addr)

        idc.MakeNameEx(addr, name, idc.SN_NOWARN)

        print("%s @ %s" % (name, hex(addr)))

PsychoTea

import sys
import json
import re

kslide = 0x0

if len(sys.argv) < 2:
  print("Usage: PanicParser.py [file path]")
  exit()

PsychoTea

struct IOExternalMethodArguments
{
  uint32_t version;
  uint32_t selector;
  uint64_t asyncWakePort;
  uint64_t asyncReference;
  uint32_t asyncReferenceCount;
  const uint64_t *scalarInput;
  uint32_t scalarInputCount;
  const void *structureInput;

PsychoTea

Dump of iOS MACF policy operations 

335 operations total
Only 148 present 
AMFI.kext holds 18, Sandbox.kext holds 130
Data dumped from iPhone9,3 running iOS 12.1.2 

AMFI policy:

operation mpo_cred_check_label_update_execve (6) is present

PsychoTea

signed __int64 __fastcall apfs_snapshot_rename_raw(rename_call_struct *args)
{
  void *v_mount; // x0
  __int64 fs_private; // x19
  snap_info_args_struct *oldsnap_info; // x8
  __int64 oldname_len; // x20
  unsigned __int8 *oldname; // x21
  snap_info_args_struct *newsnap_info; // x8
  unsigned __int64 namelen; // x22
  unsigned __int8 *newname; // x23

PsychoTea

    {
        COPY_RESOURCE("amfid_payload.dylib", "/jb/amfid_payload.dylib");

        inject_trust("/jb/amfid_payload.dylib");

        uint32_t amfid_pid = get_pid_for_name("amfid");

        uint64_t osbool_val = rk64(offs.data.osboolean_true + kernel_slide);
        VAL_CHECK(osbool_val);

PsychoTea

import idaapi
import idautils
import idc

content = ""

with open("/path/to/joker/file", "r") as f:
    content = f.readlines()

for line in content:

PsychoTea

    r = mkdir("/tmp/bash", 0700);
    if(r != 0)
    {
        NSLog(@"Failed to create /tmp/bash: %s", strerror(errno));
        goto out;
    }
    pid_t pid = fork();
    if(pid == -1)
    {
        NSLog(@"fork: %s", strerror(errno));

PsychoTea

#!/bin/bash

lang=text

# See if language arg is given
if [ "$#" -eq "1" ]; then
  lang=$1
fi

echo "Using language: $lang"