Conversation

Zhuowei Zhang

@zhuowei

·

Jun 5, 2018

The entitlement to launch Marzipan is "http://com.apple.private.iosmac", it seems. Time to, like, disable AMFID and fakesign an app with the entitlement?

Quote Tweet

Steve Troughton-Smith (Archived)

@stroughtonsmith

·

Jun 5, 2018

I'm not sure how Apple can make such a big deal about announcing Marzipan, including showing it off in the developer SOTU, and then entitlement-gate it so nobody can play with it even for fun What a buzzkill. Guess we wait till next year

Show this thread

1

1

8

Steve Troughton-Smith (Archived)

@stroughtonsmith

·

Jun 5, 2018

I tried but got nowhere ☹️ Not sure where in amfid to patch, all scripts were byte pattern based

3

2

Khaos Tian

@KhaosT

·

Jun 5, 2018

Can you just disable SIP and borrow an app with entitlement?

1

Steve Troughton-Smith (Archived)

@stroughtonsmith

·

Jun 5, 2018

It wouldn’t load my plugins, but I can try harder tomorrow

1

Khaos Tian

@KhaosT

Loading dynamic library won’t work because sandbox and signature check… Those apps are marked as platform binary which the developer signed framework will not load. I guess you have to patch amfid 😛

6:35 AM · Jun 5, 2018

1

Like

Zhuowei Zhang

@zhuowei

·

Jun 5, 2018

lldb attaches to VoiceMemos and Stocks just fine after disabling SIP; I wonder if putting a breakpoint on csops in lldb would get around the environmental variable restriction.