samy kamkar samyk

What's nonce entanglement?

Beginning with devices using an A12 SoC or higher, Apple introduced nonce entangling.

This meant that, when saving SHSH blobs, a nonce generator would generate a different ApNonce for each device.
When saving SHSH blobs for an A12+ device, you now must find a generator-ApNonce pair for your device, then use that generator-ApNonce pair when saving SHSH blobs.
After you have found a generator-ApNonce pair for your device, you can save it and re-use it whenever you save SHSH blobs again.

Getting a generator-ApNonce pair (jailbroken)

(iOS 14+ only) Install an iOS kernel r/w library.
- On Taurine, install libkernrw.

On unc0ver, install libkrw.

Native Permission scrapers

These two scripts scrapes Android's permissions and iOS usage description lists. It extracts key information and stores it in JSON to use within other documentation.

Android uses the Manifest Permissions documentation.
iOS uses the Information Property List, together with each individual pages.

How to use

Set up the files locally

Comparison chips (SoCs) table for ESP8266/ESP32/ESP32-S2/ESP32-S3/ESP32-C3/ESP32-C6

A minimal table to compare the Espressif's MCU families.

	ESP8266	ESP32	ESP32-S2	ESP32-S3	ESP32-C3	ESP32-C6
Announcement Date	2014, August	2016, September	2019, September	2020, December

Quickstart

Step 0: Pre-requisites

Get a tool that can unpack Rar files (A good option is WinRar but many others exist as well)
Install a clean copy (ideally no modifications to start) of GTAV & note the location where GTA5.exe is installed

Note: At time of writing, the mod is compatible with the latest game update released by Rockstar on Aug 11, 2020 v1.0.2060.0 & should be work previous versions down to 1.0.1180.2)

	import Foundation
	import NearbyInteraction
	import MultipeerConnectivity
	import Combine

	var numberFormatter: NumberFormatter {
	let numberFormatter = NumberFormatter()
	numberFormatter.roundingMode = .halfEven
	numberFormatter.maximumFractionDigits = 3
	numberFormatter.minimumFractionDigits = 3

	#include <M5Core2.h>
	#include <Preferences.h>
	#include <Fonts/EVA_20px.h>

	#include <stdio.h>
	#include <Kalman.h> // https://github.com/TKJElectronics/KalmanFilter


	#define ENCx_A 35
	#define ENCx_B 36

	{
	"final_space": true,
	"console_title": true,
	"console_title_style": "folder",
	"blocks": [
	{
	"type": "prompt",
	"alignment": "left",
	"horizontal_offset": 0,
	"vertical_offset": 0,

	SetDirectory[NotebookDirectory[]];

	\[Theta]0 = -.1 \[Pi]; \[Phi]0 = .35*\[Pi];
	\[Psi]0 = {Cos[\[Theta]0] Cos[\[Phi]0], Sin[\[Theta]0] Cos[\[Phi]0],
	Sin[\[Phi]0]};

	Clear[BlochSphereVector];
	BlochSphereVector[\[Psi]_, imSize_ : 1000, color_ : Gray,
	opacity_ : 1, \[Phi]view_ : \[Pi]/4, viewdist_ : 100] := Module[{
	tubeball, pointline,

	#if 0
	IOAccelContext2::finish_fence_event() race condition OOB read/write

	This is a method exposed to user space, it takes a kernel read-only shared memory
	(type 2 via clientMemoryForType()) address and treats it as an IOAccelEvents Array.

	The user supplied index is checked against the IOAccelEvents array bounds,since there are no
	locks held in this method,it is possible to change the array bounds by calling
	IOAccelContext2::clientMemoryForType() again in a separate thread, this will expand the size by
	multiplying the older size by 2, but we still have a reference to the old shared memory address