Manually decrypting iOS & tvOS apps with LLDB and debugserver
When automated tools like TrollDecrypt fail on newer jailbreaks, it’s time to dust off the old-school manual decryption method using LLDB to dump memory directly.
Ios
Nuking Ads in Oqee app via Google IMA SDK
How I reversed the Google IMA SDK implementation in the Oqee app to completely block pre-roll and mid-roll ads on iOS and tvOS using a custom VMAP payload.
Unlocking Oqee's hidden developer mode and Konami code
Reversing Free’s Oqee app to find hidden developer settings, NSUserDefaults bypasses, and a literal Konami code gesture sequence.
Anatomy of an iOS crack
Breaking down obfuscated dylibs, CloudKit crashes, and certificate pinning.
Blocking ads on the TF1+ iPhone app
Reverse engineering the myTF1 iPhone app to block video ads using a Theos tweak.
Blocking ads on the TF1+ Apple TV app
Reverse engineering the myTF1 Apple TV app to block video ads using Frida and a Theos tweak.
Bypassing Crédit Agricole's jailbreak detection
Reversing the Crédit Agricole app: Analyzing its Swift-based jailbreak checks, debugging with LLDB to identify the specific file triggering the block, and implementing a Frida bypass.
Bypassing Banque Postale's jailbreak detection - Part 2
Reversing the main Banque Postale app: Dealing with Hermes bytecode, analyzing the JailMonkey library, and discovering why the detection logic fails on modern rootless jailbreaks.
Bypassing Banque Postale's jailbreak detection - Part 1
A deep dive into the Banque Postale iOS app’s jailbreak detection.