Skip to content

Instantly share code, notes, and snippets.

View zhuowei's full-sized avatar

zhuowei

View GitHub Profile
@zhuowei
zhuowei / reachable_services.txt
Created February 21, 2023 06:26
Reachable Mach services from the app sandbox on iOS 16.1
PurpleSystemAppPort
PurpleSystemEventPort
UIASTNotificationCenter
com.apple.ABDatabaseDoctor
com.apple.AppSSO.service-xpc
com.apple.AuthenticationServicesCore.AuthenticationServicesAgent
com.apple.CARenderServer
com.apple.ClipServices.clipserviced
com.apple.CoreAuthentication.daemon
com.apple.DeviceAccess.xpc
POST https://ar-genai.graph.meta.com/graphql HTTP/2.0
accept-language: en-CA, en-US
authorization: OAuth <removed>
content-length: 743
content-type: application/x-www-form-urlencoded
user-agent: Dalvik/2.1.0 (Linux; U; Android 11; Pixel 3 XL Build/RQ1A.201205.003.A1) [FBAN/StellaForAndroid;FBAV/241.0.0.52.168;FBPN/com.facebook.stella;FBLC/en_CA;FBBV/803648009;FBCR/;FBMF/Google;FBBD/google;FBDV/Pixel 3 XL;FBSV/11;FBCA/armeabi-v7a:armeabi;FBDM/{density=3.5,width=1440,height=2621};]
x-fb-client-ip: True
x-fb-friendly-name: FetchConstellationUpdates
x-fb-request-analytics-tags: {"network_tags":{"product":"830547164036012","request_category":"graphql","purpose":"none","retry_attempt":"0"}}
x-fb-server-cluster: True
@zhuowei
zhuowei / _header.txt
Last active October 26, 2025 18:28
Counting number of top iPad apps marked as available on visionOS
Business, Free: 71/100
Business, Paid: 84/100
Weather, Free: 92/100
Weather, Paid: 89/100
Utilities, Free: 75/100
Utilities, Paid: 77/100
Travel, Free: 89/100
Travel, Paid: 86/100
Sports, Free: 78/100
Sports, Paid: 77/100
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>UnifiedBar</key>
<dict>
<key>DisclosureRequired</key>
<string>ace440ac-b4f6-4b43-aade-02bba1589aef</string>
<key>Enabled</key>
<false/>
/ # ./gunyah_vmm -i gunyah_vmm -d sample_vm.dtb -S 0x800000 -D 0x780000 -R 0x770
000
[ 62.874010] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=92 'gunyah_vmm'
survived set user mem region
survived GH_VM_SET_DTB_CONFIG
[RM]allocated vmid=128
[RM]VM_ALLOCATE: 3 vmid=128, ret=0
[RM]MEM_APPEND VM 3 H 0 ret 0
[RM]VM_CONFIG_IMAGE: from:3 vmid:128 auth:0 mp:0 img: 0/0 dt: 0x780000/0x1000
[RM]NOTIFY_VM_STATUS: to: 3 [128: 1/0/0]
diff --git a/DT.txt b/../../../../../watch7ota/AssetData/boot/Firmware/all_flash/DTn187sap.txt
index 4cc7323..08f26d9 100755
--- a/DT.txt
+++ b/../../../../../watch7ota/AssetData/boot/Firmware/all_flash/DTn187sap.txt
@@ -4,19 +4,19 @@ device-tree:
AAPL,phandle (4): 0x1
config-number (29): "syscfg/CFG#/0x40,zeroes/0x40"
serial-number (29): "syscfg/SrNm/0x20,zeroes/0x20"
- target-type (6): "N157s"
+ target-type (6): "N187s"
Params being sent to the server are: {
AssetAudience = "02d8e57e-dd1c-4090-aa50-b4ed2aef0062";
AssetType = "com.apple.MobileAsset.iOSSimulatorRuntime";
BaseUrl = "https://mesu.apple.com/assets/macos/";
BuildID = "DCC8573C-1754-11F0-A9CC-CAEE899DAE5C";
BuildVersion = 24E263;
CertIssuanceDay = "2024-12-05";
ClientData = {
AllowXmlFallback = false;
DeviceAccessClient = xcodebuild;
@zhuowei
zhuowei / diff_gen70900_675_676.patch
Created June 11, 2025 03:33
Galaxy S24 firmware: gen70900_sqe.fw: April update (S921USQU4BYD9): v675, diffed with May update (S921USQS4BYE4), v676
diff --git a/gen70900_675_v.txt b/gen70900_676_v.txt
index 57f81588973..b7a82309bc8 100644
--- a/gen70900_675_v.txt
+++ b/gen70900_676_v.txt
@@ -1,12 +1,12 @@
; a7xx microcode
-; Disassembling microcode: /home/zhuowei/gen70900_sqe.fw.v675
-; Version: 01520675
+; Disassembling microcode: /home/zhuowei/gen70900_sqe.fw.v676
+; Version: 01520676
@zhuowei
zhuowei / WDBSetWebSecurityEnabled.m
Created September 1, 2020 04:47
Disable same-origin policy on iOS WKWebView with private API.
// Allows disabling Same-Origin Policy on iOS WKWebView.
// Tested on iOS 12.4.
// Uses private API; obviously can't be used on app store.
@import WebKit;
@import ObjectiveC;
void WKPreferencesSetWebSecurityEnabled(id, bool);
@interface WDBFakeWebKitPointer: NSObject
@import Darwin;
@import ObjectiveC;
@import CloudKit;
extern bool GEOConfigGetBOOL(int feature, void* something);
// Hooks feature flags in a resigned Maps.app to return true.
// Usage:
// clang -shared -fmodules -o libmaps_inject.dylib maps_inject.m \
// "$(xcrun