4 ms·

Hey all! Author here, happy to answer any questions. Thanks xmprt for sharing!

by brycebostwick 2y ago

smw 2y ago
Do you use a very old phone for jailbreaking, or are there more recent jailbreaks?
- brycebostwick 2y ago
  I mostly use an old phone on 16.6. iOS 17/18 is harder; you can jailbreak that if you have an iPad 7th Gen (technically iPadOS, but whatever). I have a couple but prefer the iPhone since it's less clunky to lug around! I've seen some rumors of that device not supporting iPadOS 19, so I'm not really sure what the plan is if that's true. Maybe everyone starts forking money over to Corellium.
brycebostwick 2y ago
(also, these comments are way too kind. thanks all!)
barco 2y ago
Does iOS have something like PTRACE_SYSCALL to hook up on syscalls entry and maybe change the return value? (Or detect where the SVC is being made)
- sjtgraham 2y ago
  No, but you can use Frida (which replaces an inline syscall with a JMP to a handler) but it quickly becomes complicated if the app verifies its own integrity at unpredictable points during runtime. When this happens hardware breakpoints are your friend, however the developer can still make your life hard by inlining all over the app, and then you quickly run out of hardware breakpoints.
StefanBatory 2y ago
I watched your video on Youtube - it was interesting! But also thanks for providing a written version too, it's very nice ;)
cwillu 2y ago
Autoplaying gif mixed into text, closed the page.
- brycebostwick 2y ago
  I certainly like them by default, but I get that others don't - one thing I could do is have them paused by default if `prefers-reduced-motion` is on. Though I'm curious if you (or any other folks here) have this enabled. (would have added this ages ago if I knew this existed; not a CSS expert, just seeing it now by checking if web has an equivalent of iOS' `UIAccessibility.isReduceMotionEnabled`. neat!)
  - cwillu 2y ago
    Setting doesn't exist on my os, and I certainly would not approve of a setting that gives people license to do (imo) shitty things to the user experience just because there's an obscure setting somewhere. It's your site, you can do what you want; it's my browser, I will close tabs that annoy me with extreme prejudice.
- kmfpl 2y ago
  You also removed the giant pole stuck up your ass?
  - cwillu 2y ago
    You mean the disability that makes motion incredibly distracting while trying to read?
    - ThePowerOfFuet 2y ago
      Then disable autoplay. https://support.mozilla.org/si/questions/1081272 https://support.mozilla.org/si/questions/1081272
bobmcnamara 2y ago
Apple seems to have come so far from the iPhone4's misaligned Thumb 2 page crossing core fault.
xmprt 2y ago
I find your videos fascinating and I'm surprised that more people haven't checked them out or read your articles. I personally use Android so the videos are technically not applicable for me but I still get a lot of value out of learning how some of the low level debugging in iOS works.
gloosx 2y ago
Very interesting article, I always wanted a low-level phone reverse-engineering read like that to understand it better. Few questions for the author: do you think the most popular commercial tool (guardsquare if im not wrong) brings anything new to the table which prevents an easy disassembly like this? Was TopWidgets protected by something similar or was it rather a local effort?

Hey all! Author here, happy to answer any questions. Thanks xmprt for sharing!

smw 2y ago

Do you use a very old phone for jailbreaking, or are there more recent jailbreaks?

brycebostwick 2y ago
I mostly use an old phone on 16.6. iOS 17/18 is harder; you can jailbreak that if you have an iPad 7th Gen (technically iPadOS, but whatever). I have a couple but prefer the iPhone since it's less clunky to lug around! I've seen some rumors of that device not supporting iPadOS 19, so I'm not really sure what the plan is if that's true. Maybe everyone starts forking money over to Corellium.

brycebostwick 2y ago

(also, these comments are way too kind. thanks all!)

barco 2y ago

Does iOS have something like PTRACE_SYSCALL to hook up on syscalls entry and maybe change the return value? (Or detect where the SVC is being made)

sjtgraham 2y ago
No, but you can use Frida (which replaces an inline syscall with a JMP to a handler) but it quickly becomes complicated if the app verifies its own integrity at unpredictable points during runtime. When this happens hardware breakpoints are your friend, however the developer can still make your life hard by inlining all over the app, and then you quickly run out of hardware breakpoints.

StefanBatory 2y ago

I watched your video on Youtube - it was interesting! But also thanks for providing a written version too, it's very nice ;)

cwillu 2y ago

Autoplaying gif mixed into text, closed the page.

brycebostwick 2y ago
I certainly like them by default, but I get that others don't - one thing I could do is have them paused by default if `prefers-reduced-motion` is on. Though I'm curious if you (or any other folks here) have this enabled. (would have added this ages ago if I knew this existed; not a CSS expert, just seeing it now by checking if web has an equivalent of iOS' `UIAccessibility.isReduceMotionEnabled`. neat!)
- cwillu 2y ago
  Setting doesn't exist on my os, and I certainly would not approve of a setting that gives people license to do (imo) shitty things to the user experience just because there's an obscure setting somewhere. It's your site, you can do what you want; it's my browser, I will close tabs that annoy me with extreme prejudice.
kmfpl 2y ago
You also removed the giant pole stuck up your ass?
- cwillu 2y ago
  You mean the disability that makes motion incredibly distracting while trying to read?
  - ThePowerOfFuet 2y ago
    Then disable autoplay. https://support.mozilla.org/si/questions/1081272 https://support.mozilla.org/si/questions/1081272

bobmcnamara 2y ago

Apple seems to have come so far from the iPhone4's misaligned Thumb 2 page crossing core fault.

xmprt 2y ago

I find your videos fascinating and I'm surprised that more people haven't checked them out or read your articles. I personally use Android so the videos are technically not applicable for me but I still get a lot of value out of learning how some of the low level debugging in iOS works.

gloosx 2y ago

Very interesting article, I always wanted a low-level phone reverse-engineering read like that to understand it better. Few questions for the author: do you think the most popular commercial tool (guardsquare if im not wrong) brings anything new to the table which prevents an easy disassembly like this? Was TopWidgets protected by something similar or was it rather a local effort?