test

.github/workflows/build-deb.yml

@@ -2,14 +2,10 @@ name: C/C++ CI
 
 on:
   push:
-    #tags:
-    #  - 'v*'
-
-    #branches: [ master ]
 
 jobs:
   build:
-    runs-on: macos-latest
+    runs-on: macos-13
     strategy:
       matrix:
         provider: [TFP0, LIBKRW, LIBKERNRW]
@@ -20,23 +16,29 @@ jobs:
           submodules: recursive
 
       - name: Prepare Theos
-        uses: Randomblock1/theos-action@v1
+        uses: und3fined/theos-action@main
 
       - name: Build package
         run: |
+          cp -rf include/* $THEOS/vendor/include/
           rm -f packages/*
-          cp control.template control
+
           if [[ ${{matrix.provider}} == TFP0 ]]; then
+            cp control.tfp0 control
             USE_TFP0=1 make package FINALPACKAGE=1
           elif [[ ${{matrix.provider}} == LIBKRW ]]; then
-            sed -i '' 's/{{.depends}}/libkrw/g' control
+            cp control.krw control
             USE_LIBKRW=1 make package FINALPACKAGE=1
           elif [[ ${{matrix.provider}} == LIBKERNRW ]]; then
-            sed -i '' 's/{{.depends}}/libkernrw0/g' control
+            cp control.kernrw control
             USE_LIBKERNRW=1 make package FINALPACKAGE=1
           fi
+        env:
+          DEVELOPER_DIR: /Applications/Xcode_14.2.app/Contents/Developer
+          # LDFLAGS: "-L/usr/local/opt/llvm/lib"
+          # CPPFLAGS: "-I/usr/local/opt/llvm/include"
       - name: Publish artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v4
         with:
-          name: fouldecrypt-${{matrix.provider}}
+          name: foulfolder-${{matrix.provider}}
           path: ${{ github.workspace }}/packages/*.deb

.gitignore

@@ -2,3 +2,37 @@
 packages
 other's proj
 priv_include
+CMakeLists.txt
+.idea/
+cmake-build-*/
+
+### macOS ###
+# General
+.DS_Store
+.AppleDouble
+.LSOverride
+
+# Icon must end with two \r
+Icon
+
+
+# Thumbnails
+._*
+
+# Files that might appear in the root of a volume
+.DocumentRevisions-V100
+.fseventsd
+.Spotlight-V100
+.TemporaryItems
+.Trashes
+.VolumeIcon.icns
+.com.apple.timemachine.donotpresent
+
+# Directories potentially created on remote AFP share
+.AppleDB
+.AppleDesktop
+Network Trash Folder
+Temporary Items
+.apdisk
+
+control

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "kerninfra"]
 	path = kerninfra
-	url = https://github.com/NyaMisty/KernInfra
+	url = git@github.com:und3fined/KernInfra.git

Makefile

@@ -1,16 +1,13 @@
-TARGET := iphone:clang:latest:7.0
+TARGET := iphone:clang:12.4:7.0
 ARCHS = arm64 arm64e
+export ADDITIONAL_CFLAGS = -DTHEOS_LEAN_AND_MEAN -fobjc-arc
 
 include $(THEOS)/makefiles/common.mk
 
-TOOL_NAME = fouldecrypt flexdecrypt2
-
-# USE_TFP0 = 1
-# USE_LIBKRW = 1
-# USE_LIBKERNRW = 1
+TOOL_NAME = fouldecrypt flexdecrypt2 foulwrapper foulfolder fouldlopen
 
 fouldecrypt_FILES = main.cpp foulmain.cpp
-fouldecrypt_CFLAGS = -fobjc-arc -Wno-unused-variable # -Ipriv_include
+fouldecrypt_CFLAGS = -fobjc-arc -Wno-unused-variable -Ipriv_include
 fouldecrypt_CCFLAGS = $(fouldecrypt_CFLAGS)
 fouldecrypt_CODESIGN_FLAGS = -Sentitlements.plist
 fouldecrypt_INSTALL_PATH = /usr/local/bin
@@ -19,12 +16,31 @@ fouldecrypt_LDFLAGS += -Lkerninfra/libs
 fouldecrypt_CCFLAGS += -std=c++2a
 
 flexdecrypt2_FILES = main.cpp flexwrapper.cpp
-flexdecrypt2_CFLAGS = -fobjc-arc -Wno-unused-variable # -Ipriv_include
+flexdecrypt2_CFLAGS = -fobjc-arc -Wno-unused-variable -Ipriv_include
 flexdecrypt2_CCFLAGS = $(flexdecrypt2_CFLAGS)
 flexdecrypt2_CODESIGN_FLAGS = -Sentitlements.plist
 flexdecrypt2_INSTALL_PATH = /usr/local/bin
 flexdecrypt2_SUBPROJECTS = kerninfra
 flexdecrypt2_LDFLAGS += -Lkerninfra/libs
 flexdecrypt2_CCFLAGS += -std=c++2a
 
+foulwrapper_FILES = foulwrapper.m
+foulwrapper_CFLAGS = -fobjc-arc -Wno-unused-variable -Ix_include
+foulwrapper_CCFLAGS = $(foulwrapper_CFLAGS)
+foulwrapper_CODESIGN_FLAGS = -Sentitlements.plist
+foulwrapper_INSTALL_PATH = /usr/local/bin
+foulwrapper_FRAMEWORKS = Foundation MobileCoreServices
+foulwrapper_PRIVATE_FRAMEWORKS = MobileContainerManager
+foulwrapper_LIBRARIES = applist
+
+foulfolder_FILES = foulfolder.m
+foulfolder_CFLAGS = -fobjc-arc -Wno-unused-variable -Ix_include
+foulfolder_CCFLAGS = $(foulfolder_CFLAGS)
+foulfolder_CODESIGN_FLAGS = -Sentitlements.plist
+foulfolder_INSTALL_PATH = /usr/local/bin
+foulfolder_FRAMEWORKS = Foundation MobileCoreServices
+
+fouldlopen_FILES = fouldlopen.c
+fouldlopen_INSTALL_PATH = /usr/local/bin
+
 include $(THEOS_MAKE_PATH)/tool.mk

README.md

@@ -31,6 +31,12 @@ Install the correct version:
 
 Run `fouldecrypt` on an encrypted binary.
 
+## About `foulwrapper`
+
+`foulwrapper` will find all Mach-Os in a specific application and decrypt them using `fouldecrypt`:
+
+`usage: foulwrapper (application name or bundle identifier)`
+
 ## Credits
 @meme: foulplay
 @JohnCoates: flexdecrypt

control.kernrw

@@ -0,0 +1,10 @@
+Package: dev.und3fy.foulfolder.tauri
+Name: foulfolder (Tauri)
+Version: 0.2.0
+Architecture: iphoneos-arm
+Depends: applist,zip,libkernrw0
+Description: Directly decrypt binaries like fouldecrypt, but also supports iOS 14
+Maintainer: und3fined
+Author: misty
+Section: System
+Tag: role::hacker

control.krw

@@ -0,0 +1,10 @@
+Package: dev.und3fy.foulfolder.unc0ver
+Name: foulfolder (unc0ver)
+Version: 0.2.0
+Architecture: iphoneos-arm
+Depends: applist,zip,libkrw
+Description: Directly decrypt binaries like fouldecrypt, but also supports iOS 14
+Maintainer: und3fined
+Author: misty
+Section: System
+Tag: role::hacker

control.tfp0

@@ -0,0 +1,10 @@
+Package: dev.und3fy.foulfolder
+Name: foulfolder
+Version: 0.2.0
+Architecture: iphoneos-arm
+Depends: applist,zip
+Description: Directly decrypt binaries like fouldecrypt, but also supports iOS 14
+Maintainer: und3fined
+Author: misty
+Section: System
+Tag: role::hacker

entitlements.plist

@@ -2,31 +2,37 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 <dict>
-	<key>application-identifier</key>
-	<string>-</string>
-	<key>com.apple.developer.team-identifier</key>
-	<string>-</string>
-	<key>com.apple.diagnosticd.diagnostic</key>
-	<true/>
-	<key>com.apple.frontboard.debugapplications</key>
-	<true/>
-	<key>com.apple.multitasking.termination</key>
-	<true/>
-	<key>com.apple.private.cs.debugger</key>
-	<true/>
-	<key>com.apple.private.security.no-sandbox</key>
-	<true/>
-	<key>com.apple.private.skip-library-validation</key>
-	<true/>
-	<key>com.apple.springboard.launchapplications</key>
-	<true/>
-	<key>dynamic-codesigning</key>
-	<true/>
-	<key>get-task-allow</key>
-	<true/>
-	<key>platform-application</key>
-	<true/>
-	<key>task_for_pid-allow</key>
-	<true/>
+    <key>application-identifier</key>
+    <string>-</string>
+    <key>com.apple.developer.team-identifier</key>
+    <string>-</string>
+    <key>com.apple.diagnosticd.diagnostic</key>
+    <true/>
+    <key>com.apple.frontboard.debugapplications</key>
+    <true/>
+    <key>com.apple.multitasking.termination</key>
+    <true/>
+    <key>com.apple.private.cs.debugger</key>
+    <true/>
+    <key>com.apple.private.security.no-sandbox</key>
+    <true/>
+    <key>com.apple.private.skip-library-validation</key>
+    <true/>
+    <key>com.apple.private.MobileContainerManager.allowed</key>
+    <true/>
+    <key>com.apple.private.MobileContainerManager.lookup</key>
+    <true/>
+    <key>com.apple.private.MobileContainerManager.otherIdLookup</key>
+    <true/>
+    <key>com.apple.springboard.launchapplications</key>
+    <true/>
+    <key>dynamic-codesigning</key>
+    <true/>
+    <key>get-task-allow</key>
+    <true/>
+    <key>platform-application</key>
+    <true/>
+    <key>task_for_pid-allow</key>
+    <true/>
 </dict>
 </plist>

fouldlopen.c

@@ -0,0 +1,11 @@
+#include <dlfcn.h>
+#include <stdio.h>
+
+int main(int argc, char **argv) {
+  void *(*sym_dlopen)(const char *, int) = dlsym(RTLD_DEFAULT, "dlopen");
+  for (int i = 1; i < argc; i++) {
+    void *handle = sym_dlopen(argv[i], RTLD_NOW);
+    dlclose(handle);
+  }
+  return 0;
+}