search

khcrysalis / Feather

Feather is a free on-device iOS application manager/installer, using certificates part of the Apple Developer Program.
GNU General Public License v3.0
1.06k stars 57 forks source link

Esign Certs support for DNS signing method #4

Closed gototheskinny closed 1 month ago

gototheskinny commented 2 months ago

Expired certificate signing Dns method is the only signing option for a lot of us. The only missing feature of this app is that functionality (for now ofc). The ability of using those certificates is crucial. I don't know if there's a way to use them in this app please let us know in the description too.

khcrysalis commented 2 months ago

You can sign apps with expired certificates just fine, but normally won't install them.

I'm not sure what this "Dns" method is, care to explain?

gototheskinny commented 2 months ago

You can sign apps with expired certificates just fine, but normally won't install them.

I'm not sure what this "Dns" method is, care to explain?

https://reddit.com/r/sideloaded/comments/1debdgh/guide_how_to_sideload_on_ios_without_expiry/

The issue is those certificates can't be used by this app and can't replace the esign app with this app.

To understand this situation you have to look into that reddit post.

JDsnyke commented 2 months ago

To clarify, Esign uses a certificate format called .esigncert. This is what we want support for.

gototheskinny commented 2 months ago

To clarify, Esign uses a certificate format called .esigncert. This is what we want support for.

I just don't know if that will be enough. If you read that reddit post, you will understand that this method uses revoked certificates, but thanks to DNS, it functions as if it were a normal certificate. So what I'm trying to say is this: Yes, we need support for .esigncert certificates, but those certificates must be able to install the ipa we want without any problems, in accordance with this DNS method, just like the esign app.

Cristiandis commented 2 months ago

please please add this function to i dont like the esign ui i would switch to this immediately

Cristiandis commented 2 months ago

also because it's Chinese closed source spyware

Cristiandis commented 2 months ago

so is it possible to support such foemat

khcrysalis commented 2 months ago

To clarify, Esign uses a certificate format called .esigncert. This is what we want support for.

Sadly, I'm not sure how to decode this format at all. I've gotten my hands on a few files that has the .esigncert extension and none of the software I have recognize it as an archive. It could be something proprietary, I don't know :(

gototheskinny commented 2 months ago

To clarify, Esign uses a certificate format called .esigncert. This is what we want support for.

Sadly, I'm not sure how to decode this format at all. I've gotten my hands on a few files that has the .esigncert extension and none of the software I have recognize it as an archive. It could be something proprietary, I don't know :(

I hope it's not encrypted or not readable 😔

JDsnyke commented 2 months ago

Lunascaped the mod on reddit said that they have a discord bot that can decrypt the esigncert files. It's a matter of getting in touch with them to test if that's the case.

JDsnyke commented 2 months ago

The AppleP12 telegram group also has some of the unrevoked esign certs if anyone wants to try it. I was able to use one and it worked for me.

current live cert zip

Cristiandis commented 2 months ago

Lunascaped the mod on reddit said that they have a discord bot that can decrypt the esigncert files. It's a matter of getting in touch with them to test if that's the case.

can i have a link

ccavee commented 2 months ago

Someone said the revoked certs from AppleP12 are the same certs as the esign cert just in that format but even after using the AppleP12 revoked certs I get the error of "unable to verify app"

gototheskinny commented 2 months ago

Someone said the revoked certs from AppleP12 are the same certs as the esign cert just in that format but even after using the AppleP12 revoked certs I get the error of "unable to verify app"

If you used those certificates in the past and they were revoked, unfortunately, they won’t work for you unless you back up your device and perform a factory reset (which resets your device UDID and allows the certificates to work again). I did this about 15 days ago and followed the steps correctly. So far, so good.

ccavee commented 2 months ago

My apps still work on eSign just fine i'm still not blacklisted and i've been using it for a 2 months now

schweppes-0x commented 2 months ago

Integrating this functionality into Feather would be the final push for me to make the switch. I already love the app but this is a crucial feature for most of us. Right now when i launch the apps installed by revoked certificates + dns i get "Unable to verify"

HitWithSpader commented 1 month ago

It works if you use the new Online Install Method

Integrating this functionality into Feather would be the final push for me to make the switch. I already love the app but this is a crucial feature for most of us. Right now when i launch the apps installed by revoked certificates + dns i get "Unable to verify"

gototheskinny commented 1 month ago

It works if you use the new Online Install Method

Integrating this functionality into Feather would be the final push for me to make the switch. I already love the app but this is a crucial feature for most of us. Right now when i launch the apps installed by revoked certificates + dns i get "Unable to verify"

Can you use ESign certificates?

khcrysalis commented 1 month ago

The dns method works if you whitelist domains used by feather, I cannot guarentee it will work though you'll need to try it yourself.

Domains: app.localhost.direct & api.palera.in

*.esigncert support is not happening, however wherever you get these they should also provide standard zip files with p12's, provisioning profiles, and passwords.

Cristiandis commented 1 month ago

The dns method works if you whitelist domains used by feather, I cannot guarentee it will work though you'll need to try it yourself.

Domains: app.localhost.direct & api.palera.in

*.esigncert support is not happening, however wherever you get these they should also provide standard zip files with p12's, provisioning profiles, and passwords.

may i add something that might help, someone made a everything sideloading that provides both .esigncert and their respective p12 and mobileprovision. https://www.icloud.com/shortcuts/170ef8326f474ab88b2205c5343adb88