ninjaprawn

Keybase proof

I hereby claim:

• I am ninjaprawn on github.
• I am ninjaprawn (https://keybase.io/ninjaprawn) on keybase.
• I have a public key whose fingerprint is CF49 8FBE 0A08 CD6B CD78 E984 B80D B856 F2F3 EA71

To claim this, I am signing this object:

ninjaprawn

#Introduction I recently got a Pebble Time for my cake day, and wanted to see what I could do with it outside watchfaces and apps.

#Before everything else I was able to accomplish all of below by using Pebble Firmware Utils by MarSoft (https://github.com/MarSoft/pebble-firmware-utils). Python 2.7 is required to get the firmware files. Run the following:

cd pebble-firmware-utils
python downloadFirmware.py
python unpackFirmware.py [file_name].pbz
cd pebble_firmware

ninjaprawn

INTRO

Yeah, just want to mess around. Mainly trying to use bugs/vulns revealed by apple in ios patches (e.g. CVE-2012-3726 from https://support.apple.com/en-au/HT202615) Using my iPod 4, downgraded to ios 4.

BUT FIRST

Need to know how the exploit stuff works, and how to find them w/o using existing, patched vulns. Main type: buffer overflow. Data usually has a fixed memory size in which it is allocated (only that variable can currently use that space). Buffer overflow is when there are more bytes than the allocated space, causing memory to overflow into other memory.

ninjaprawn

var app = [SBApplicationController sharedInstance];
var ap = [app applicationWithBundleIdentifier:@"com.apple.camera"];
var appicon = [[SBApplicationIcon alloc] initWithApplication:ap];
var iconView = [[SBIconViewMap homescreenMap] mappedIconViewForIcon:appicon];
[[SBIconController sharedInstance] _revealMenuForIconView:iconView presentImmediately:true];

ninjaprawn

@interface SBApplicationController
+(id)sharedInstance;
-(id)applicationWithBundleIdentifier:(id)arg1 ;
@end

@interface SBApplication
@end

@interface SBApplicationIcon : NSObject
-(id)initWithApplication:(id)arg1 ;

ninjaprawn

    @interface SBApplicationController
    +(id)sharedInstance;
    -(id)applicationWithBundleIdentifier:(id)arg1 ;
    @end

    @interface SBApplication
    @end

    @interface SBApplicationIcon : NSObject
    -(id)initWithApplication:(id)arg1 ;

ninjaprawn

%hook BSPlatform

- (BOOL)isInternalInstall {
    return YES;
}

%end

ninjaprawn

SBUIController - NO (Protected by FrontBoard)
SBIconController - NO (Protected by FrontBoard)
SBPowerDownController - YES (assertion failure in -[SBPowerDownController _screen])
SBWallpaperController - NO (Protected by FrontBoard)
SpringBoard (actual app) - YES (Not sure how to fetch, Only one UIApp can be active at one time)

ninjaprawn

...
@property (strong, nonatomic) NSString *currentPhoneNumber;
...

-(NSMutableArray*)getHiddenNumbers {
    NSArray *hiddenNumbers = [[NSUserDefaults standardUserDefaults] objectForKey:@"hiddenNumbers"];
    if (hiddenNumbers == nil) {
        return [[NSMutableArray alloc] init];
    }
    return [NSMutableArray arrayWithArray:hiddenNumbers];

ninjaprawn

Showing All Messages

Build target Limitless of project Limitless with configuration Debug

PhaseScriptExecution Symlinks\ Setup /Users/ninja/Library/Developer/Xcode/DerivedData/Limitless-ffaafdspyfyrqgberifhaiobmnbg/Build/Intermediates/Limitless.build/Debug-iphoneos/Limitless.build/Script-FA25322E1DE0FB2800D4FA86.sh
    cd /Volumes/Files/Developer/Limitless
    export ACTION=build
    export AD_HOC_CODE_SIGNING_ALLOWED=NO
    export ALTERNATE_GROUP=staff