khanhduytran0

This is WIP, may contain incomplete info.

Dualboot 13.2 InternalUI

You need to find 13.2_17B45a_InternalUI_D331pAP_DVT, sha256sum ffdc84e560e14cad79916aaa9f143b225348ebca47e8fdd096a7cd47bdd0983d on the internet. I can't include the link here.

Copy all IMG4 files from the dump /usr/standalone/firmware/* (and inside FUD too) to your working dir.

Setup

Make 2 volumes from ramdisk, I have my System and Data as disk0s1s11 and disk0s1s12, mounted to /mnt1 and /mnt2 respectively.

mineek

This will permanently block revokes and some ppq stuff.
Use this together with the profile to block some domains "without" a DNS.
Even if you don't have the profile, after applying this your device just cannot register revokes anymore. So you'll just not be able to install the app, but you will not get permanently blacklisted.

note this may lead to side effects. I am not sure. However, it does work.

AS ALWAYS, USE AT YOUR OWN RISK.

Basically all u need to do is run these commands one by one in a terminal on a jailbroken device:

WHW0x455

Bypass PAC in JIT

The code snippets and conceptual analysis presented in this document are based on iOS 16.2.

The bug was disclosed and patched after Pwn2Own 2024 and was assigned CVE-2024-27834. Details of the patch can be found in the WebKit repository.

• https://support.apple.com/en-us/120905
• https://github.com/WebKit/WebKit/commit/3e3d0883c84955472ece1b2f2e63f31522c5440d

DerekSelander

From 01129d60439367d27d4dd55669465be4e66315f2 Mon Sep 17 00:00:00 2001
From: LOLgrep <meow>
Date: Fri, 21 Nov 2025 21:15:11 -0700
Subject: [PATCH] merp

blerb
---
 common/FileManager.cpp             | 1 +
 configs/base.xcconfig              | 7 ++++++-
 configs/dsc_extractor.xcconfig     | 1 +

Siguza

#include <spawn.h>
#include <stdint.h>
#include <stdio.h>

extern char **environ;

typedef struct
{
    uint32_t version;
    uint32_t size;

EthanArbuckle

/*
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.appstored.jobmanager</key>
    <true/>
    <key>com.apple.accounts.appleaccount.fullaccess</key>
    <true/>
    <key>com.apple.appstored.private</key>
    <true/>

khanhduytran0

Recap

As you may have known, we recently managed to bring multitask to LiveContainer. This originally came from FrontBoardAppLauncher which was reverse engineered of various Apple apps: ClarityBoard, SpringBoard, Xcode PreviewShell, etc. A quick recap of how we worked on it:

• I began reverse engineering said apps to study how to use various Private API of FrontBoard, RunningBoardServices and UIKit, resulted in MySystemShell and FrontBoardAppLauncher
• I found app could spawn multiple processes thanks to the writeup of NSExtension
• We found we could extend memory limit by setting a hidden NSExtensionPointIdentifier

However, as more and more people get to try it, we were reported that physical keyboard input wouldn't work. (LiveContainer/LiveContainer#524)

If anyone could figure it out, we will forever owe you.

zhuowei

Params being sent to the server are: {
    AssetAudience = "02d8e57e-dd1c-4090-aa50-b4ed2aef0062";
    AssetType = "com.apple.MobileAsset.iOSSimulatorRuntime";
    BaseUrl = "https://mesu.apple.com/assets/macos/";
    BuildID = "DCC8573C-1754-11F0-A9CC-CAEE899DAE5C";
    BuildVersion = 24E263;
    CertIssuanceDay = "2024-12-05";
    ClientData =     {
        AllowXmlFallback = false;
        DeviceAccessClient = xcodebuild;

ChiChou

#!/usr/bin/env swift

import AppKit
import Foundation

guard CommandLine.arguments.count > 1 else {
  fputs("Usage: \(CommandLine.arguments[0]) <file1> <file2> ...\n", stderr)
  exit(1)
}

wh1te4ever

//
//  ViewController.m
//  JBDetectTest
//
//  Created by seo on 3/27/25.
//

#import "ViewController.h"
#import <dlfcn.h>