Skip to content

Instantly share code, notes, and snippets.

@khanhduytran0
khanhduytran0 / LC research issue 524.md
Last active May 31, 2025 07:15
LiveContainer multitask external keyboard input research

Recap

As you may have known, we recently managed to bring multitask to LiveContainer. This originally came from FrontBoardAppLauncher which was reverse engineered of various Apple apps: ClarityBoard, SpringBoard, Xcode PreviewShell, etc. A quick recap of how we worked on it:

  • I began reverse engineering said apps to study how to use various Private API of FrontBoard, RunningBoardServices and UIKit, resulted in MySystemShell and FrontBoardAppLauncher
  • I found app could spawn multiple processes thanks to the writeup of NSExtension
  • We found we could extend memory limit by setting a hidden NSExtensionPointIdentifier

However, as more and more people get to try it, we were reported that physical keyboard input wouldn't work. (LiveContainer/LiveContainer#524)

If anyone could figure it out, we will forever owe you.

Params being sent to the server are: {
AssetAudience = "02d8e57e-dd1c-4090-aa50-b4ed2aef0062";
AssetType = "com.apple.MobileAsset.iOSSimulatorRuntime";
BaseUrl = "https://mesu.apple.com/assets/macos/";
BuildID = "DCC8573C-1754-11F0-A9CC-CAEE899DAE5C";
BuildVersion = 24E263;
CertIssuanceDay = "2024-12-05";
ClientData = {
AllowXmlFallback = false;
DeviceAccessClient = xcodebuild;
@ChiChou
ChiChou / README.md
Last active April 18, 2025 21:40
macOS cli shortcut to open file in IDA
  1. install swift
  2. install ida.swift to $PATH/ida
@wh1te4ever
wh1te4ever / TrollDetector.m
Last active June 10, 2025 20:48
TrollStore Detector
//
// ViewController.m
// JBDetectTest
//
// Created by seo on 3/27/25.
//
#import "ViewController.h"
#import <dlfcn.h>
@JJTech0130
JJTech0130 / debugger_jit_improved.m
Last active May 24, 2025 02:11
Improved method of using a debugger for JIT on iOS... Uses split rx/rw regions, and works on iOS 18.4b1
#import <Foundation/Foundation.h>
#import <mach/mach.h>
#import <stdio.h>
#import <stdlib.h>
#import <string.h>
#include <libkern/OSCacheControl.h>
const int REGION_SIZE = 0x4000*1;
void write_instructions(void* page)
@khanhduytran0
khanhduytran0 / mount_args.h
Created February 18, 2025 01:51
Boot tvOS on compatible iDevices (WIP)
#ifndef _MOUNT_ARGS_H
#define _MOUNT_ARGS_H
#include <stdint.h>
#include <sys/time.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
enum {
@available(iOS 15.0, *)
public struct RichTextEditor : SwiftUICore.View {
public init(text: SwiftUICore.Binding<Foundation.AttributedString>)
@_Concurrency.MainActor @preconcurrency public var body: some SwiftUICore.View {
get
}
@available(iOS 15.0, *)
public typealias Body = @_opaqueReturnTypeOf("$s7SwiftUI14RichTextEditorV4bodyQrvp", 0) __
}
@available(*, unavailable)
@donato-fiore
donato-fiore / Tweak.x
Last active April 6, 2025 00:39
Allow ControlCenter modules to load when running in a simulator.
#import <Foundation/Foundation.h>
@interface NSObject (Private)
- (id)safeValueForKey:(NSString *)key;
@end
@interface NSArray (BaseBoard)
- (id)bs_mapNoNulls:(id (^)(id))arg1;
- (id)bs_flatten;
- (id)bs_filter:(BOOL (^)(id))arg1;
@justtryingthingsout
justtryingthingsout / accp-h16g-core-sysregs.txt
Created January 8, 2025 12:33
some SysRegs may be missing, but this should be the majority
S3_3_c4_c5_0 at min EL0: DSPSR
S3_3_c4_c5_1 at min EL0: DLR
S3_6_c4_c0_0 at min EL3: SPSR_EL3
S3_6_c4_c0_1 at min EL3: ELR_EL3
S3_1_c0_c0_0 at min EL1: CCSIDR_EL1
S3_6_c1_c0_0 at min EL3: SCTLR_EL3
S3_6_c1_c0_1 at min EL3: ACTLR_EL3
S3_6_c1_c1_2 at min EL3: CPTR_EL3
S3_6_c1_c1_0 at min EL3: SCR_EL3
S3_6_c1_c3_1 at min EL3: MDCR_EL3
@EthanArbuckle
EthanArbuckle / cli-gui.m
Last active May 9, 2025 13:22
drawing a UIWindow from an iOS cli tool
#import <CoreGraphics/CoreGraphics.h>
#import <Foundation/Foundation.h>
#import <objc/runtime.h>
#import <objc/message.h>
#import <dlfcn.h>
__attribute__((constructor)) static void init(void) {
Method bundleIdentifierMethod = class_getInstanceMethod(objc_getClass("NSBundle"), sel_registerName("bundleIdentifier"));
IMP newImp = imp_implementationWithBlock(^(id self) {