Skip to content

Instantly share code, notes, and snippets.

View dlevi309's full-sized avatar

Daniel dlevi309

130 followers · 621 following
View GitHub Profile
@dlevi309
dlevi309 / profile_defaults.md
Last active March 30, 2024 11:30
An extensive list of settings written when installing a debugging profile from developer.apple.com

Digital Car Key:

Has three sections.

defaults: {
    “com.apple.MobileBluetooth.debug” =     {
        ExtraZoningLog =         {
            EnableZoneLogging = 1;
        };
        FWStreamLogging =         {
@dlevi309
dlevi309 / abi.py
Last active March 26, 2024 16:57
script to switch between iOS13 (00000002) and iOS14 (80000002) arm64e ABI
import sys
from pathlib import Path
MH_MAGIC_64 = b'\xcf\xfa\xed\xfe'
CPU_TYPE_ARM64 = b'\x0c\x00\x00\x01'
CPU_SUBTYPE_IOS13 = b'\x02\x00\x00\x00'
CPU_SUBTYPE_IOS14 = b'\x02\x00\x00\x80'
IOS13_HEADER = MH_MAGIC_64 + CPU_TYPE_ARM64 + CPU_SUBTYPE_IOS13
IOS14_HEADER = MH_MAGIC_64 + CPU_TYPE_ARM64 + CPU_SUBTYPE_IOS14
@dlevi309
dlevi309 / reachable_services_get.m
Last active February 7, 2024 17:47 — forked from zhuowei/reachable_services.txt
Reachable Mach services from the app sandbox on iOS 16.1
// cc reachable_services_get.m -o reachable_services_get -framework Foundation
#import <Foundation/Foundation.h>
#import <servers/bootstrap.h>
void enumerateMachServices() {
NSDictionary<NSString*, id>* dict = [NSDictionary dictionaryWithContentsOfFile:@"/System/Library/xpc/launchd.plist"];
NSDictionary<NSString*, id>* launchDaemons = dict[@"LaunchDaemons"];
for (NSString* key in launchDaemons) {
NSDictionary<NSString*, id>* job = launchDaemons[key];
@dlevi309
dlevi309 / crashcatch.c
Last active January 1, 2024 09:30
Interpose-able code to catch crashes, print, and exit cleanly. Check near line 106 https://opensource.apple.com/source/libclosure/libclosure-67/objectTests/test.pl
#include <signal.h>
#include <string.h>
#include <unistd.h>
#include <execinfo.h>
#include <stdio.h>
#include <stdlib.h>
// from dyld-interposing.h
#define DYLD_INTERPOSE(_replacement,_replacee) __attribute__((used)) static struct{ const void* replacement; const void* replacee; } _interpose_##_replacee __attribute__ ((section ("__DATA,__interpose"))) = { (const void*)(unsigned long)&_replacement, (const void*)(unsigned long)&_replacee };
@dlevi309
dlevi309 / DLMobileGestaltSPI.h
Last active November 6, 2023 09:38
/*
* Copyright (C) 2023 Daniel Levi
*
* Originally based on Apple's header for WebKit. The file within this repo
* named LICENSE_APPLE contains the copyright notice provided by Apple
*
* This header is based on my own disassembly of libMobileGestalt and contains
* 760 keys that should support any iOS version up until iOS 17.
*
*/
@dlevi309
dlevi309 / platform_swap.m
Last active October 9, 2023 08:00 — forked from DerekSelander/platform_swap.m
Exchange Mach-O platform types with min version
//
// main.m
// platform_swap @LOLgrep
//
#import <Foundation/Foundation.h>
#import <mach-o/loader.h>
#define PLATFORM_VISIONOS 11
#define PLATFORM_VISIONOSSIMULATOR 12
@dlevi309
dlevi309 / 0strings.md
Last active October 8, 2023 19:23
a version of `strings(1)` that isn’t dependent on a linker

strings

a version of strings(1) that isn’t dependent on a linker. Dumps all strings of any given file.

Based off code provided by toybox

@dlevi309
dlevi309 / realEntitlements.txt
Created June 15, 2021 14:35
A breakdown of all the actual entitlements accessed when granting the com.apple.private.security.no-container entitlement
com.apple.private.security.disk-device-access
com.apple.private.security.no-container
com.apple.private.security.storage.AppBundles
com.apple.private.security.storage.AppDataContainers
com.apple.private.security.storage.AppStoreCache
com.apple.private.security.storage.BulletinDistributor
com.apple.private.security.storage.CallHistory
com.apple.private.security.storage.CloudKit
com.apple.private.security.storage.CoreKnowledge
com.apple.private.security.storage.DCIM
@dlevi309
dlevi309 / sep_a12.txt
Created May 5, 2022 10:08 — forked from matteyeux/sep_a12.txt
================================== iphone11,2 ===================================================
14.4.1-14.2
key : 5a37b94ad2b79cb789ed930f0dff883ed0487a86151844450e0a197070647369e9691f5091c202ab8699939f31bf6c4a
18B92/14.2
key : aa0684897a2a372e7bcb0f26625a70142bdb671267af4d23a2ec851910c7e8641a738ce63c1fccc558b480baa0b086f2
@dlevi309
dlevi309 / ForceNoBuddy.md
Last active August 24, 2023 00:03
Forcibly skip iPhone Setup (PurpleBuddy)

ForceNoBuddy

Skip the iPhone setup screen on checkra1n devices, make sure these files are written to /var/mobile/Library/Preferences

This no longer works as of iOS 15 (or it might, but I'm pretty sure it's gone)

com.apple.purplebuddy.plist

<?xml version="1.0" encoding="UTF-8"?>