I just had to turn on my VPN to download a Windows ISO because my residential IP incorrectly gets flagged as a VPN IP by Microsoft while my VPN IP does not.
Remote
opa334
@opa334@infosec.exchange
mastodon 4.8.0-alpha.3+glitchDeveloper of Dopamine Jailbreak, TrollStore and some jailbreak tweaks.
Employed at Cellebrite Labs, opinions are my own.
1542 Followers
89 Following
46 Posts
Joined December 18, 2022
So basically Apple is bullying me by revoking my dev cert every time I sideload something with com.opa334.Dopamine, so this makes testing more complicated now cause every time I need to debug something with Xcode, I now change it to com.opa334.FuckYou. Well, it looks like I fucked up and released Dopamine 3.0.5 with com.opa334.FuckYou last night. Woops.
Replying to
Heck, give me $10k and I will give you personal knowledge transfer session on top where you can actually learn how Dopamine works instead of just making an LLM (or me) do all the work.
After reflecting a bit, I want to share a bit more about how I feel about AI and Relaxin.
As much as I gave Relaxin shit, I want to clarify that this was only about the way they approached it, not about AI assisted development / research in general.
I think the fact they managed to make an LLM implement Rocket is generally impressive, but everything related to how it was integrated into Dopamine is not. I also think that at this point it's hard to deny the fact that AI definitely does find bugs and some of them may even lead to exploits.
I guess I should finally explain what went on in my head when I accused them of larping Dopamine SPTM support... Basically I was already mostly finished with implementing SPTM support on Corellium myself at the point of their announcement, but I was already targeting higher versions, since iOS 18 was already out when I started with these efforts. iOS 18+ in particular requires non trivial new logic to make forkfix work again because starting that version, it is required to modify the TXM address space. Other than that, SPTM support was actually not that difficult to figure out, the main problem was just finding the equivalent offsets and making a patchfinder for those. There of course was the page table allocator, but the LLM managed to sidestep properly fixing that by going purely though the VM layer, as I already explained earlier. So when they initially announced SPTM support, I thought that there was absolutely no chance an LLM figured the forkfix logic out, simply because I didn't yet realize it wasn't needed on iOS 17. This should hopefully explain my initial reaction of asking them for a screen recording of a binary being spawned in NewTerm.
Me: Geez, I wonder why there's so users confused on how the "Hide Jailbreak" feature of Dopamine works
Also me: *accidentally removed the explanation of the feature from the UI while refactoring something unrelated in the app*
5 in the morning and I finally figured out wtf is wrong with Dopamine jbupdate. Turns out there has been an OOB write on a kernel pointer for the past 3 years but until now the allocation was always large enough to tank it. In Dopamine 3 I switched the allocator to one that only allocates as much bytes as needed, leading to this OOB write now smashing the next element on the heap, which can lead to all sorts of panics. Also notably the "Failed to update BaseBin" corruption issue is caused by this, since the specific file that's usually corrupted is written to right before the broken code is called. So if the broken code panics immediately, this is what causes the filesystem corruption...
How a 3 year old bug can bite you in the ass...
Replying to
3.0.1 is out to fix all regressions that we have been able to reproduce so far.
https://github.com/opa334/Dopamine/releases/tag/3.0.1
I just pushed a Choicy update to my repo and submitted it to BigBoss to add basic support for iOS 17 - 26 (arm64e)
So I made the mistake of logging into X again and someone tried to gift me a verified checkmark. I was gonna be mad that they gave money to Elon but it turns out there is some sort of exploit that allows people to give checkmarks to other users for free so... thanks I guess? I'm gonna take a guess and presume I'm not going to get this checkmark since my username is a Mastodon handle anyways though, since it has been pending verification for several days now :D
Going to be interesting to see what they will do, the way the platform is ran I don't think they will even realize anything is wrong but if they do it would be funny if they decide to ban all accounts that got a non legit verified checkmark lol, let's burn the place down 🔥
I find it disrespectful Dopamine is not even credited on their website despite it being 95% of their project
Crane 1.3.18 is out
Changelog:
- Fix notification support not working on iOS 17.0 - 17.3.1
- Add support for iOS 26.0 - 26.0.1
I took some time to write about my thoughts on the recent AI jailbreak developments:
https://www.reddit.com/r/jailbreak/comments/1v9ongc/comment/p0fmj50
https://github.com/opa334/darksword-kexploit
Unlike other repos, this one was not written by generative AI.
WIP
LET US COOK JUST A LITTLE BIT MORE
Replying to
Update: pattern-f's A12/A13 PPL bypass is not going to be publicly released in the foreseeable future, which means anything higher than 17.3.1 is off the table for now.
Dopamine 2.5 Beta 3: Adds support for iOS 16.7.16, 17.0 - 18.7.1 (arm64)
Huge revelations in the jailbreaking scene today. I have reimplemented the DarkSword iOS <=26.0.1* kernel exploit that was somehow randomly posted on GitHub yesterday. Dopamine 15.8.7 support eta s0n 🤣 And maybe iOS 16 EOL support too!
*untested on anything above iOS 17 at the moment
So I'm at a point where Dopamine works on iOS 17/18 (arm64) but DarkSword device support is kinda abysmal still and e.g. it doesn't work at all on 2GB RAM devices like the iPad 6 currently.
So two known issues with Dopamine 3 that are still unresolved:
- OTA Jailbreak Updates are kinda borked on iOS 17+ and sometimes panic and cause some weird file system corruption. I suggest not using it and just manually rebooting and rejailbreaking when updating to a new version for the time being. I have posted an ipa that at least resolves the corruption to the point where you can jailbreak with normal Dopamine again afterwards here https://discord.com/channels/349243932447604736/688126462066163756/1535996700546703360
- The TXM panic issue that was supposed to be fixed in 3.0.2 is actually not fixed and requires more work. For now avoid anything that mounts a DDI / loads a trustcache while jailbroken.
Replying to
Support for higher arm64e versions (potentially up to 17.3.1) is still pending the PPL/SPTM bypasses being reverse engineered.
Apparently some journalists and youtubers are falsely citing me as the source of DarkSword, I hope this README update should clear it up
I have pushed a Dopamine Beta to add support for more versions on arm64 using the #DarkSword exploit https://github.com/opa334/Dopamine/releases/tag/2.5b1
Dopamine 2.5b2 is out with some experimental improvements to DarkSword that have been contributed by Clarity.
TrollStore 2.1.1 is out to fix a typo in an entitlement name...
Instead of warning about exploit source code that does nothing harmful whatsoever, how about doing something about all the countless fake jailbreaks hosted on your platform that all link to the similar sites (e.g. pangu8(.)com) that sell fake software for real money?
@github@infosec.exchange @GitHub@mstdn.social @github@hachyderm.io @githubprojects@threads.net
https://youtu.be/KxlIr-oHJCc In other news I have published a german video of me explaining how to use the unc0ver 13.5 jailbreak that I made in 2020 but never uploaded until now, as an april fools joke :D
iOS 13.5 Jailbreak erschienen?!? Tutorial! Plus Safari Plus Tweak Review (Rare)
Crane 1.3.17-2 is out.
Changelog:
- Fix container name not being displayed on notifications from recent WhatsApp versions
👨🍳 🥔 🥕🥘
Replying to
@etas0n@ioc.exchange DarkSword is missing a PPL/SPTM bypass. We still need a reverse engineered version of the bypasses in Coruna to jailbreak (maybe) up to 17.3.1 on arm64e devices. arm64 updates will come sooner.
Replying to
@zhuowei@notnow.dev I assume this would be extremely complicated since you can't replace executable code and even doing something like interposes I would assume is very limited since I don't think it's easy to make native code call into javascript by replacing a pointer.
I assume all they really do is call from JS into native code and of course there might be some stuff you can do with it, but I don't think it's much outside of well… what a malware would want to do 😛
IOS Hacking in 2024 - An Overview | Lars Fröder https://youtu.be/prj6g0QsBGI
IOS Hacking in 2024 - An Overview | Lars Fröder
Replying to
@kumpel @github @GitHub@mstdn.social @github@hachyderm.io yeah same, never even got a response in any of my tickets...
Replying to
Replying to
Like Relaxin supposedly took $200k worth of (unsubsidised) tokens to develop.
I, of course, don't know how much was spent on reimplementing Rocket and how much was spent on integrating it into Dopamine, but for the sake of the argument, let's assume it's even ($100k each).
If you instead instead just made a $20k bounty with $10k going to Alfie and $10k going to me, Dopamine 3 would have probably been done before work on Relaxin even started, all for 1/10th of the price and it would have been a much cleaner implementation than anything the LLM could ever produce...
Replying to on infosec.exchange
@sftmzl@infosec.exchange none of the changes of 3.0.2 should have any effect on iOS 15 :/
Replying to
Okay... verdict: High functioning AI slop
Many redundant functions that just wrap around already existing functions, no SPTM page table allocator (it somehow does everything through the VM layer, I'm impressed that doesn't panic on process exit but it still reintroduces all the issues that I solved in Dopamine 1.1.3 almost 3 years ago, funnily they call my proper allocator "legacy" in a printf, while they're the ones bringing out legacy solutions from 3+ years ago), dead code paths that never get taken, weird acronyms in function names that I can't figure out what they stand for, etc.
I also found at least one typo in a printf, which indicates to me that the claim "0 lines written by humans" is wrong.