search

NyaMisty / fouldecrypt

A lightweight and simpling iOS binary decryptor
271 stars 41 forks source link

failed patchfinder dimentio's init! Failed to init kerninfra!! #18

Closed Ender890 closed 3 months ago

Ender890 commented 3 months ago

I get this error with one app. fouldecrypt works with other apps though.

i tried installing libkernrw-utils, libkernrw0, and dimentio.

i tried chmod +x on the frameworks in the app folder.

Edit: i tried all three parameters in the makefile (one at a time, 3 different debfiles), for kernrw, krw, tfp0. i have the devel files installed.

libkrw0, libkrw0-tfp0, and libdimentio0 are installed by default. i didnt touch those.

palerain-beta9, iphone7, ios 15.8.1, ellekit hooker. zsh starship shell.

what did i do wrong.

❯ fouldecrypt -v /path/to/example-app-binary ~/Documents/example-binary-decrypted 22:51:01.614955 mapping input file: example-app-binary 22:51:01.615579 mapping output file: /var/mobile/Documents/example-app-binary 22:51:01.616126 copying original data of size 0x68d6a0... 22:51:01.646696  not fat binary, directly decrypting it! 22:51:01.646728  finding encryption_info segment in slide... 22:51:01.646734  found encryption_info segment at offset 1320 22:51:01.646738  decrypting encrypted data... 22:51:01.646741  Going to decrypt crypt page: off 0xb5000 size 0x1000 cryptid 1, cpuType 100000c cpuSubType 0 22:51:01.646748  Not 16k aligned, trying to do the hack :O failed patchfinder dimentio's init! Failed to init kerninfra!!

edit: not sure why, but today on some of my repeated attempts, i see this after the "trying to do the hack" part: (actually, that value keeps changing each time. i tried a bunch, and these values repeat):

host: 0xA03 host: 0xB03 host: 0x1203 host: 0x1303 host: 0x1103 host: 0xC03 host: 0x903

maybe i need this? do i build it into fouldecrypt? i installed fouldecrypt from your repo. maybe i should build from git? https://github.com/NyaMisty/KernInfra

Ender890 commented 3 months ago

i just built it from source , i think it was built correctly with submodules , with kerninfra, using 15.6 sdk, and the krw0 parameter in makefile. i still get the same error. here is some extra info, hope its useful.

❯ file example-app-binary example-app-binary: Mach-O 64-bit arm64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|BINDS_TO_WEAK|PIE> ❯ otool -L example-app-binary example-app-binary:         /usr/lib/libc++.1.dylib (compatibility version 1.0.0, current version 1700.255.0)         /usr/lib/libz.1.dylib (compatibility version 1.0.0, current version 1.2.12)         @rpath/ObjectiveDropboxOfficial.framework/ObjectiveDropboxOfficial (compatibility version 1.0.0, current version 1.0.0)         @rpath/SGUSharedResources.framework/SGUSharedResources (compatibility version 1.0.0, current version 1.0.0)         @rpath/Bugsnag.framework/Bugsnag (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/CloudKit.framework/CloudKit (compatibility version 1.0.0, current version 2150.34.1)         /System/Library/Frameworks/SystemConfiguration.framework/SystemConfiguration (compatibility version 1.0.0, current version 1300.100.9)         /System/Library/Frameworks/NetworkExtension.framework/NetworkExtension (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/Foundation.framework/Foundation (compatibility version 300.0.0, current version 2420.0.0)         /usr/lib/libobjc.A.dylib (compatibility version 1.0.0, current version 228.0.0)         /usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 1345.100.2)         /System/Library/Frameworks/AVFAudio.framework/AVFAudio (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/AVFoundation.framework/AVFoundation (compatibility version 1.0.0, current version 2.0.0)         /System/Library/Frameworks/AVKit.framework/AVKit (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/CFNetwork.framework/CFNetwork (compatibility version 1.0.0, current version 1494.0.7)         /System/Library/Frameworks/Combine.framework/Combine (compatibility version 1.0.0, current version 311.0.0)         /System/Library/Frameworks/CoreData.framework/CoreData (compatibility version 1.0.0, current version 1344.1.0)         /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation (compatibility version 150.0.0, current version 2420.0.0)         /System/Library/Frameworks/CoreGraphics.framework/CoreGraphics (compatibility version 64.0.0, current version 1774.4.3)         /System/Library/Frameworks/CoreImage.framework/CoreImage (compatibility version 1.0.0, current version 6.0.0)         /System/Library/Frameworks/CoreMedia.framework/CoreMedia (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/CoreServices.framework/CoreServices (compatibility version 1.0.0, current version 1226.0.0)         /System/Library/Frameworks/CoreTelephony.framework/CoreTelephony (compatibility version 1.0.0, current version 0.0.0)         /System/Library/Frameworks/CoreText.framework/CoreText (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/CoreVideo.framework/CoreVideo (compatibility version 1.2.0, current version 1.5.0)         /System/Library/Frameworks/DeviceCheck.framework/DeviceCheck (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/ImageIO.framework/ImageIO (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/Intents.framework/Intents (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/IntentsUI.framework/IntentsUI (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/LocalAuthentication.framework/LocalAuthentication (compatibility version 1.0.0, current version 1394.100.151)         /System/Library/Frameworks/Network.framework/Network (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/QuartzCore.framework/QuartzCore (compatibility version 1.2.0, current version 1.11.0)         /System/Library/Frameworks/SafariServices.framework/SafariServices (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/Security.framework/Security (compatibility version 1.0.0, current version 61123.100.169)         /System/Library/Frameworks/StoreKit.framework/StoreKit (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/UIKit.framework/UIKit (compatibility version 1.0.0, current version 7439.1.105)         /System/Library/Frameworks/UserNotifications.framework/UserNotifications (compatibility version 1.0.0, current version 1.0.0)         /System/Library/Frameworks/WebKit.framework/WebKit (compatibility version 1.0.0, current version 618.1.15)         /System/Library/Frameworks/WidgetKit.framework/WidgetKit (compatibility version 1.0.0, current version 402.116.100)         /usr/lib/swift/libswiftCore.dylib (compatibility version 1.0.0, current version 0.0.0)         /usr/lib/swift/libswiftCoreFoundation.dylib (compatibility version 1.0.0, current version 120.100.0, weak)         /usr/lib/swift/libswiftCoreGraphics.dylib (compatibility version 1.0.0, current version 15.0.0)         /usr/lib/swift/libswiftCoreImage.dylib (compatibility version 1.0.0, current version 2.0.0, weak)         /usr/lib/swift/libswiftCoreLocation.dylib (compatibility version 1.0.0, current version 36.0.0, weak)         /usr/lib/swift/libswiftDarwin.dylib (compatibility version 1.0.0, current version 0.0.0, weak)         /usr/lib/swift/libswiftDataDetection.dylib (compatibility version 1.0.0, current version 758.7.0, weak)         /usr/lib/swift/libswiftDispatch.dylib (compatibility version 1.0.0, current version 41.0.0)         /usr/lib/swift/libswiftFileProvider.dylib (compatibility version 1.0.0, current version 1835.102.2, weak)

Ender890 commented 3 months ago

ok so, it turns out that the most recent versions of this app in question: used a framework only available on ios 16.0+ SDKs to build it. the binary file for one plugin in this app required a framework called "AppIntents", which isnt on any ios lower than 16.0. when dumpdecrypted was used, appintents error was shown. didnt know how to inject a 16.0 framework which isnt native to 15.0+, so kept going down one version at a time until the framework in question did not use appintents.

dyld_lib env path for a theos sdk and build-essential didnt work. maybe this is a dyld shared cache thing, unsure.