Merge legacy and latest

.github/workflows/build.yml

@@ -28,6 +28,14 @@ jobs:
         with:
           ref: ${{ inputs.branch || github.ref }}
 
+      - name: Cache Homebrew packages
+        uses: actions/cache@v4
+        with:
+          path: ~/Library/Caches/Homebrew
+          key: brew-${{ runner.os }}-make-ldid
+          restore-keys: |
+            brew-${{ runner.os }}-
+
       - name: Install dependencies
         run: brew install make ldid
 
@@ -36,8 +44,7 @@ jobs:
           echo "$(brew --prefix make)/libexec/gnubin" >> $GITHUB_PATH
           echo "THEOS=${{ github.workspace }}/theos" >> $GITHUB_ENV
 
-      # Original from YTweaks
+      - name: Get Theos and dependencies commit
-      - name: Get Theos commit
         run: |
           get_commit_hash() {
             local repo_url=$1
@@ -51,13 +58,18 @@ jobs:
           fi
           echo "THEOS_REPO=$THEOS_URL" >> $GITHUB_ENV
           echo "THEOS_COMMIT=$(get_commit_hash "$THEOS_URL")" >> $GITHUB_ENV
+          echo "PSHEADER_COMMIT=$(get_commit_hash "https://github.com/PoomSmart/PSHeader.git")" >> $GITHUB_ENV
+          echo "SDK_COMMIT=$(get_commit_hash "https://github.com/Tonwalter888/iOS-SDKs.git")" >> $GITHUB_ENV
 
       - name: Cache Theos
         id: cache-theos
-        uses: actions/cache@v5
+        uses: actions/cache@v4
         with:
           path: theos
-          key: Tweak-18.6-SDK-${{ env.THEOS_COMMIT }}
+          key: Theos-${{ env.THEOS_COMMIT }}-SDK-${{ env.SDK_COMMIT }}-PSHeader-${{ env.PSHEADER_COMMIT }}
+          restore-keys: |
+            Theos-${{ env.THEOS_COMMIT }}-SDK-${{ env.SDK_COMMIT }}-
+            Theos-${{ env.THEOS_COMMIT }}-
 
       - name: Setup Theos
         if: ${{ steps.cache-theos.outputs.cache-hit != 'true' }}
@@ -68,16 +80,8 @@ jobs:
             git sparse-checkout set --no-cone iPhoneOS18.6.sdk
             git checkout --quiet
             mv *.sdk "$THEOS/sdks"
-            
-      - name: Clone headers
-        run: |
-          if [ ! -d "$THEOS/include/PSHeader" ]; then
-            git clone --quiet --depth=1 https://github.com/PoomSmart/PSHeader.git "$THEOS/include/PSHeader"
-          else
-            cd $THEOS/include/PSHeader
-            git pull --quiet --force
             cd ${{ github.workspace }}
-          fi
+            git clone --quiet --depth=1 https://github.com/PoomSmart/PSHeader.git "$THEOS/include/PSHeader"
 
       - name: Build Tweak
         run: |

.gitignore

@@ -1,2 +1,6 @@
 .DS_Store
 Build.md
+/RedditPatch
+/PineHeartsUnlock
+/App
+/GoodnotesPro

GPXViewer2/GPXViewer2.plist

@@ -1,7 +1,7 @@
 {
 	Filter = {
 		Bundles = (
-			"tech.baye.servercat",
+			"family.gander.gpxviewer2",
 		);
 	};
 }

GPXViewer2/Makefile

@@ -0,0 +1,13 @@
+TARGET = iphone:latest:14.0
+INSTALL_TARGET_PROCESSES = gpxviewer2
+ARCHS = arm64
+
+include $(THEOS)/makefiles/common.mk
+
+TWEAK_NAME = GPXViewer2
+
+GPXViewer2_FILES = Tweak.x
+GPXViewer2_CFLAGS = -fobjc-arc
+GPXViewer2_FRAMEWORKS = Foundation UIKit
+
+include $(THEOS_MAKE_PATH)/tweak.mk

GPXViewer2/Tweak.x

@@ -0,0 +1,53 @@
+#import <Foundation/Foundation.h>
+#import <UIKit/UIKit.h>
+#import <CommonCrypto/CommonCrypto.h>
+#import <CloudKit/CloudKit.h>
+#import <mach-o/dyld.h>
+#import <string.h>
+
+%hook CKContainer
++ (id)defaultContainer { return nil; }
++ (id)containerWithIdentifier:(id)arg1 { return nil; }
+%end
+
+%ctor {
+    @autoreleasepool {
+        // Device UUID
+        NSString *deviceUUID = [[[UIDevice currentDevice] identifierForVendor] UUIDString];
+        if (!deviceUUID) deviceUUID = @"<no-device-uuid>";
+
+        // Compute SHA256 hashes for all product keys
+        NSString *salt = @"-gpxviewerbyjg-";
+        NSArray *productKeys = @[
+            // @"family.gander.gpxviewer2.iap.nc.coffee",
+            // @"family.gander.gpxviewer2.iap.nc.hikingsnack",
+            @"family.gander.gpxviewer2.iap.nc.hikingmeal",
+            // @"family.gander.gpxviewer2.easteregg.secret.access",
+            // @"family.gander.gpxviewer2.iap.nc.level1",
+            // @"family.gander.gpxviewer2.iap.nc.level2",
+            // @"family.gander.gpxviewer2.iap.nc.level3",
+        ];
+
+        NSMutableArray *hashes = [NSMutableArray array];
+        for (NSString *key in productKeys) {
+            NSString *input = [NSString stringWithFormat:@"%@%@%@", deviceUUID, salt, key];
+            const char *cstr = [input UTF8String];
+            unsigned char digest[CC_SHA256_DIGEST_LENGTH];
+            CC_SHA256(cstr, (CC_LONG)strlen(cstr), digest);
+            NSMutableString *hex = [NSMutableString stringWithCapacity:CC_SHA256_DIGEST_LENGTH * 2];
+            for (NSUInteger i = 0; i < CC_SHA256_DIGEST_LENGTH; i++) {
+                [hex appendFormat:@"%02x", digest[i]];
+            }
+            [hashes addObject:hex];
+        }
+
+        // // empty hashes array
+        // NSMutableArray *hashes = [NSMutableArray array];
+
+        [[NSUserDefaults standardUserDefaults] setObject:hashes
+                                                  forKey:@"proversionmanager.storage.purchasedproducts"];
+        [[NSUserDefaults standardUserDefaults] synchronize];
+
+        NSLog(@"[GPXViewer2] Injected %lu product hashes", (unsigned long)[hashes count]);
+    }
+}

GPXViewer2/control

@@ -0,0 +1,9 @@
+Package: com.rev.gpxviewer2unlock
+Name: GPXViewer2 Unlock
+Version: 1.0
+Architecture: iphoneos-arm
+Description: Unlock all IAP products and easter egg in GPXViewer 2
+Maintainer: rev
+Author: rev
+Section: Tweaks
+Depends: firmware (>= 14.0)

Infuse/Infuse-iOS/Tweak.x

@@ -79,3 +79,45 @@
     return nil;
 }
 %end
+
+%hook NSFileManager
+- (NSURL *)containerURLForSecurityApplicationGroupIdentifier:(NSString *)groupIdentifier {
+    NSString *homeDirectory = NSHomeDirectory();
+    NSString *containerBasePath = [homeDirectory stringByAppendingPathComponent:@"Documents/ApplicationGroupContainers"];
+    NSURL *baseURL = [NSURL fileURLWithPath:containerBasePath isDirectory:YES];
+    NSURL *containerURL = [baseURL URLByAppendingPathComponent:groupIdentifier];
+    
+    NSFileManager *fileManager = [NSFileManager defaultManager];
+    NSString *containerPath = [containerURL path];
+    BOOL containerExists = [fileManager fileExistsAtPath:containerPath];
+    
+    if (!containerExists) {
+        NSError *error = nil;
+        
+        [fileManager createDirectoryAtURL:containerURL
+               withIntermediateDirectories:YES
+                                attributes:nil
+                                     error:&error];
+
+        NSURL *appSupportURL = [containerURL URLByAppendingPathComponent:@"Library/Application Support"];
+        [fileManager createDirectoryAtURL:appSupportURL
+               withIntermediateDirectories:YES
+                                attributes:nil
+                                     error:&error];
+
+        NSURL *cachesURL = [containerURL URLByAppendingPathComponent:@"Library/Caches"];
+        [fileManager createDirectoryAtURL:cachesURL
+               withIntermediateDirectories:YES
+                                attributes:nil
+                                     error:&error];
+
+        NSURL *preferencesURL = [containerURL URLByAppendingPathComponent:@"Library/Preferences"];
+        [fileManager createDirectoryAtURL:preferencesURL
+               withIntermediateDirectories:YES
+                                attributes:nil
+                                     error:&error];
+    }
+
+    return containerURL;
+}
+%end

Infuse/Infuse-tvOS/Infuse.plist

@@ -1,7 +1,7 @@
 {
 	Filter = {
-		Bundles = (
+		Executables = (
-			"com.firecore.infuse",
+			infuse,
 		);
 	};
 }

Infuse/Infuse-tvOS/Makefile

@@ -1,7 +1,6 @@
 TARGET = appletv:latest:18.3
-ARCHS = arm64
+ARCHS = arm64 arm64e
 INSTALL_TARGET_PROCESSES = infuse
-THEOS_PACKAGE_SCHEME = rootless
 
 include $(THEOS)/makefiles/common.mk
 
@@ -10,8 +9,6 @@ TWEAK_NAME = Infuse
 Infuse_FILES = Tweak.x
 Infuse_CFLAGS = -fobjc-arc
 Infuse_FRAMEWORKS = Foundation UIKit
+Infuse_LDFLAGS += $(THEOS)/vendor/lib/appletv/CydiaSubstrate.framework/CydiaSubstrate.tbd
 
 include $(THEOS_MAKE_PATH)/tweak.mk
-test-print:
-	@echo "ARCH is $(THEOS_PACKAGE_ARCH)"
-	@echo "CONTROL is $(_THEOS_DEB_PACKAGE_CONTROL_PATH)"

Infuse/Infuse-tvOS/Tweak.x

@@ -95,3 +95,41 @@
     return nil;
 }
 %end
+
+%hook NSPersistentCloudKitContainerOptions
+- (id)initWithContainerIdentifier:(id)arg1 {
+    return nil;
+}
+%end
+
+%hook CKRecordID
+- (id)initWithRecordName:(id)arg1 {
+    return nil;
+}
+- (id)initWithRecordName:(id)arg1 zoneID:(id)arg2 {
+    return nil;
+}
+%end
+
+%hook CKSystemSharingUIObserver
+- (id)initWithContainer:(id)arg1 {
+    return nil;
+}
+%end
+
+%hook NSFileManager
+- (id)ubiquityIdentityToken {
+    return nil;
+}
+- (NSURL *)containerURLForSecurityApplicationGroupIdentifier:(NSString *)groupIdentifier {
+    NSString *docPath = [NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES) firstObject];
+    NSString *path = [docPath stringByAppendingPathComponent:groupIdentifier];
+    NSURL *url = [NSURL fileURLWithPath:path];
+
+    if (![[NSFileManager defaultManager] fileExistsAtPath:[url path]]) {
+        [[NSFileManager defaultManager] createDirectoryAtURL:url withIntermediateDirectories:YES attributes:nil error:nil];
+    }
+
+    return url;
+}
+%end

Infuse/Infuse-tvOS/control

@@ -1,6 +1,6 @@
 Package: io.infuseteam.infuserootless
 Name: Infuse (Rootless)
-Version: 2.1
+Version: 2.3
 Architecture: appletvos-arm64
 Description: Unlock the full potential of Infuse
 Maintainer: Infuse Team

OqeePlus/OqeePlus-tvOS/Makefile

@@ -1,7 +1,6 @@
 TARGET = appletv:latest:18.3
 ARCHS = arm64
 INSTALL_TARGET_PROCESSES = Oqee
-THEOS_PACKAGE_SCHEME = rootless
 
 include $(THEOS)/makefiles/common.mk
 
@@ -9,5 +8,6 @@ TWEAK_NAME = OqeePlus
 
 OqeePlus_FILES = Tweak.x
 OqeePlus_CFLAGS = -fobjc-arc
+OqeePlus_LDFLAGS += $(THEOS)/vendor/lib/appletv/CydiaSubstrate.framework/CydiaSubstrate.tbd
 
 include $(THEOS_MAKE_PATH)/tweak.mk

OqeePlus/OqeePlus-tvOS/control

@@ -1,6 +1,6 @@
 Package: xyz.nohamr.oqeeplus
 Name: Oqee+ (tvOS)
-Version: 1.0
+Version: 1.1
 Architecture: appletvos-arm64
 Description: Oqee+ Ads blocker hook for tvOS
 Maintainer: NohamR

README.md

@@ -6,8 +6,7 @@ iOS tweaks built with [Theos](https://theos.dev), injected into IPAs via [cyan](
 
 | Tweak                                                   | App              | Target     |
 | ------------------------------------------------------- | ---------------- | ---------- |
-| [ServerCatPremium](ServerCatPremium/index.md)           | ServerCat 1.30.0 | iOS 17+    |
+| [ServerCatPremium](ServerCatPremium/index.md)           | ServerCat 1.30.0 / 1.6.4 | iOS 15+    |
-| [ServerCatPremium (legacy)](ServerCatPremium_/index.md) | ServerCat 1.6.4  | iOS 15     |
 | [TextasticPro](TextasticPro/index.md)                   | Textastic 10.9.2 | iOS 18+    |
 | [BusinessJB](BusinessJB/index.md)                       | Business 2.3.000 | iOS 15     |
 | [CreditAgricoleJB](CreditAgricoleJB/index.md)           | Ma Banque 47.0.0 | iOS 15.8.6 |

ServerCatPremium/Tweak.x

@@ -5,7 +5,16 @@
 
 #define TARGET_MODULE       "ServerCat"
 #define IDA_BASE            0x100000000
-#define ADDR_IS_PREMIUM     0x10009CD24  // Address of "isPremiumActive" in IDA (adjust if needed)
+
+/*
+ * EDIT THE HOOK ADDRESS OFFSET ACCORDING TO THE APP VERSION USED:
+ *
+ * ServerCat 1.30.0 (latest)  -> 0x10009CD24
+ * ServerCat 1.6.4  (legacy)  -> 0x100454D70
+ *
+ * Find the address of `isPremiumActive` in IDA and set it below.
+ */
+#define ADDR_IS_PREMIUM     0x10009CD24
 
 static int (*orig_isPremiumActive)(void);
 
@@ -26,7 +35,7 @@ static int hook_isPremiumActive(void) {
     }
 }
 
-// iOS 16 Crash Fix
+// iOS 16+ Crash Fix
 %hook CKContainer
 + (id)defaultContainer {
     return nil;

ServerCatPremium/index.md

@@ -1,9 +1,13 @@
 # ServerCatPremium
 
-Unlocks premium features in ServerCat by forcing `isPremiumActive` (`sub_10009CD24`) to always return `1`.
+Unlocks premium features in ServerCat by forcing `isPremiumActive` to always return `1`.
 
 - **App**: [ServerCat – SSH Terminal](https://apps.apple.com/us/app/servercat-ssh-terminal/id1501532023)
-- **Tested on**: ServerCat 1.30.0 (600), iOS 18.3
+- **Tested on**: ServerCat 1.30.0 (iOS 18.3) and ServerCat 1.6.4 (iOS 15.8.6)
+
+Hook address offsets (edit in `Tweak.x`):
+- `0x10009CD24` — ServerCat 1.30.0
+- `0x100454D70` — ServerCat 1.6.4
 
 ## Build
 
@@ -14,10 +18,7 @@ make clean && make package THEOS_PACKAGE_SCHEME=rootless DEBUG=0
 ## Inject
 
 ```sh
-cyan -i tech.baye.servercat-1.30.0.ipa \
+cyan -i <input.ipa> -o <output_patched.ipa> -f xyz.nohamr_1.0.0-1_iphoneos-arm64.deb -u
-     -o tech.baye.servercat-1.30.0_patched.ipa \
-     -f xyz.nohamr_1.0.0-1_iphoneos-arm64.deb \
-     -u
 ```
 
 ## Screenshots

ServerCatPremium_/Makefile

@@ -1,13 +0,0 @@
-TARGET = iphone:latest:14.0
-INSTALL_TARGET_PROCESSES = ServerCat
-ARCHS = arm64 arm64e
-
-include $(THEOS)/makefiles/common.mk
-
-TWEAK_NAME = ServerCatPremium
-
-ServerCatPremium_FILES = Tweak.x
-ServerCatPremium_CFLAGS = -fobjc-arc
-ServerCatPremium_FRAMEWORKS = Foundation
-
-include $(THEOS_MAKE_PATH)/tweak.mk

ServerCatPremium_/Tweak.x

@@ -1,27 +0,0 @@
-#import <substrate.h>
-#import <mach-o/dyld.h>
-#import <string.h>
-#import <Foundation/Foundation.h>
-
-#define TARGET_MODULE       "ServerCat"
-#define IDA_BASE            0x100000000
-#define ADDR_IS_PREMIUM     0x100454D70  // Address of "isPremiumActive" in IDA (adjust if needed)
-
-static int (*orig_isPremiumActive)(void);
-
-static int hook_isPremiumActive(void) {
-    return 1;
-}
-
-%ctor {
-    for (uint32_t i = 0; i < _dyld_image_count(); i++) {
-        const char *name = _dyld_get_image_name(i);
-        if (name && strstr(name, TARGET_MODULE)) {
-            uintptr_t base = (uintptr_t)_dyld_get_image_header(i);
-            uintptr_t addr = base + (ADDR_IS_PREMIUM - IDA_BASE);
-            MSHookFunction((void *)addr, (void *)hook_isPremiumActive, (void **)&orig_isPremiumActive);
-            NSLog(@"[ServerCatPremium] Hooked isPremiumActive at 0x%lx", addr);
-            return;
-        }
-    }
-}

ServerCatPremium_/index.md

@@ -1,26 +0,0 @@
-# ServerCatPremium (legacy — iOS 15)
-
-Unlocks premium features in ServerCat by forcing `isPremiumActive` (`sub_100454D70`) to always return `1`.
-
-- **App**: [ServerCat – SSH Terminal](https://apps.apple.com/us/app/servercat-ssh-terminal/id1501532023)
-- **Tested on**: ServerCat 1.6.4, iOS 15.8.6
-- **Note**: ServerCat 1.6.4 is the last version supporting iOS 15. Latest requires iOS 17+.
-
-## Build
-
-```sh
-make clean && make package THEOS_PACKAGE_SCHEME=rootless DEBUG=0
-```
-
-## Inject
-
-```sh
-cyan -i tech.baye.servercat-1.6.4.ipa \
-     -o tech.baye.servercat-1.6.4_patched.ipa \
-     -f xyz.nohamr_1.0.0-1_iphoneos-arm64.deb \
-     -u
-```
-
-## Screenshots
-![../docs/screens/ServerCatPremium_/menu.png](../docs/screens/ServerCatPremium_/menu.png)
-![../docs/screens/ServerCatPremium_/menu2.png](../docs/screens/ServerCatPremium_/menu2.png)

TF1Plus/TF1Plus-tvOS/Makefile

@@ -1,7 +1,6 @@
 TARGET = appletv:latest:18.3
 ARCHS = arm64
 INSTALL_TARGET_PROCESSES = mytf1
-THEOS_PACKAGE_SCHEME = rootless
 
 include $(THEOS)/makefiles/common.mk
 
@@ -9,5 +8,6 @@ TWEAK_NAME = TF1Plus
 
 TF1Plus_FILES = Tweak.x
 TF1Plus_CFLAGS = -fobjc-arc
+TF1Plus_LDFLAGS += $(THEOS)/vendor/lib/appletv/CydiaSubstrate.framework/CydiaSubstrate.tbd
 
 include $(THEOS_MAKE_PATH)/tweak.mk

TF1Plus/TF1Plus-tvOS/control

@@ -1,6 +1,6 @@
 Package: xyz.nohamr.tf1plus
-Name: TF1+ (Rootless)
+Name: TF1+ (Rootful)
-Version: 1.0
+Version: 1.1
 Architecture: appletvos-arm64
 Description: TF1+ Ads blocker hook
 Maintainer: NohamR

VolkswagenJB/.gitignore

@@ -0,0 +1,3 @@
+.theos/
+packages/
+.DS_Store

VolkswagenJB/Makefile

@@ -0,0 +1,13 @@
+TARGET = iphone:latest:14.0
+INSTALL_TARGET_PROCESSES = Volkswagen
+ARCHS = arm64
+
+include $(THEOS)/makefiles/common.mk
+
+TWEAK_NAME = VolkswagenJB
+
+VolkswagenJB_FILES = Tweak.x
+VolkswagenJB_CFLAGS = -fobjc-arc
+VolkswagenJB_FRAMEWORKS = Foundation
+
+include $(THEOS_MAKE_PATH)/tweak.mk

VolkswagenJB/Tweak.x

@@ -0,0 +1,98 @@
+#import <substrate.h>
+#import <mach-o/dyld.h>
+#import <string.h>
+#import <Foundation/Foundation.h>
+
+#define TARGET_MODULE   "Volkswagen"
+#define IDA_BASE        0x100000000
+
+// sysctl P_TRACED check : always return 0 (no debugger)
+#define ADDR_SYSCTL_DEBUG_CHECK     0x10081D5A4
+
+// ptrace(PT_DENY_ATTACH) + FishHook installer : NOP the whole thing
+#define ADDR_PTRACE_FISHHOOK        0x10081D704
+
+// JailbreakDetection orchestrator (8 checks) : always return 1 (clean)
+#define ADDR_JB_ORCHESTRATOR        0x100824E9C
+
+// Individual JB sub-checks : each returns 1 (no jailbreak found)
+#define ADDR_JB_FILE_EXIST          0x100823E38   // type 1: stat/access
+#define ADDR_JB_FILE_READABLE       0x100824238   // type 2: fopen/isReadable
+#define ADDR_JB_SANDBOX_ESCAPE      0x1008245FC   // type 3: write test + fork
+#define ADDR_JB_SYMLINK             0x100824A14   // type 5: symlink resolve
+#define ADDR_JB_DYLIB_NAMES         0x100824C7C   // type 6: _dyld_get_image_name scan
+
+#define ADDR_SECURITY_CHECK_BFC     0x100828BFC   // sub_100828BFC(v10) & 1
+#define ADDR_SECURITY_CHECK_D20     0x100828D20   // sub_100828D20() & 1
+#define ADDR_SECURITY_CHECK_CD4     0x100828CD4   // sub_100828CD4() : bool
+
+
+static void *(*orig_sysctl_debug)(void);
+static void *hooked_sysctl_debug(void) { NSLog(@"[VWTweak] hooked_sysctl_debug called"); return 0; }
+
+static void (*orig_ptrace_fishhook)(void);
+static void hooked_ptrace_fishhook(void) { NSLog(@"[VWTweak] hooked_ptrace_fishhook called"); return; }
+
+static uint64_t (*orig_jb_orchestrator)(void);
+static uint64_t hooked_jb_orchestrator(void) { NSLog(@"[VWTweak] hooked_jb_orchestrator called"); return 1; }
+
+// static uint64_t (*orig_jb_file_exist)(void);
+// static uint64_t hooked_jb_file_exist(void) { NSLog(@"[VWTweak] hooked_jb_file_exist called"); return 1; }
+
+// static uint64_t (*orig_jb_file_readable)(void);
+// static uint64_t hooked_jb_file_readable(void) { NSLog(@"[VWTweak] hooked_jb_file_readable called"); return 1; }
+
+// static uint64_t (*orig_jb_sandbox_escape)(void);
+// static uint64_t hooked_jb_sandbox_escape(void) { NSLog(@"[VWTweak] hooked_jb_sandbox_escape called"); return 1; }
+
+// static uint64_t (*orig_jb_symlink)(void);
+// static uint64_t hooked_jb_symlink(void) { NSLog(@"[VWTweak] hooked_jb_symlink called"); return 1; }
+
+// static uint64_t (*orig_jb_dylib_names)(void);
+// static uint64_t hooked_jb_dylib_names(void) { NSLog(@"[VWTweak] hooked_jb_dylib_names called"); return 1; }
+
+static uint64_t (*orig_security_check_bfc)(uint64_t);
+static uint64_t hooked_security_check_bfc(uint64_t arg) { NSLog(@"[VWTweak] hooked_security_check_bfc(%llu) called", arg); return 0; }
+
+static uint64_t (*orig_security_check_d20)(void);
+static uint64_t hooked_security_check_d20(void) { NSLog(@"[VWTweak] hooked_security_check_d20 called"); return 0; }
+
+static uint64_t (*orig_security_check_cd4)(void);
+static uint64_t hooked_security_check_cd4(void) { NSLog(@"[VWTweak] hooked_security_check_cd4 called"); return 0; }
+
+
+static void hookAt(uintptr_t base, uintptr_t ida_addr, void *hook, void **orig) {
+    uintptr_t real = base + (ida_addr - IDA_BASE);
+    MSHookFunction((void *)real, hook, orig);
+    NSLog(@"[VWTweak] Hooked 0x%lx (slide base 0x%lx)", real, base);
+}
+
+%ctor {
+    for (uint32_t i = 0; i < _dyld_image_count(); i++) {
+        const char *name = _dyld_get_image_name(i);
+        if (!name || !strstr(name, TARGET_MODULE))
+            continue;
+
+        uintptr_t base = (uintptr_t)_dyld_get_image_header(i);
+        NSLog(@"[VWTweak] Found %s at base 0x%lx", name, base);
+
+        hookAt(base, ADDR_SYSCTL_DEBUG_CHECK,  (void *)hooked_sysctl_debug,    (void **)&orig_sysctl_debug);
+        hookAt(base, ADDR_PTRACE_FISHHOOK,     (void *)hooked_ptrace_fishhook, (void **)&orig_ptrace_fishhook);
+
+        hookAt(base, ADDR_JB_ORCHESTRATOR,     (void *)hooked_jb_orchestrator, (void **)&orig_jb_orchestrator);
+
+        // hookAt(base, ADDR_JB_FILE_EXIST,       (void *)hooked_jb_file_exist,    (void **)&orig_jb_file_exist);
+        // hookAt(base, ADDR_JB_FILE_READABLE,    (void *)hooked_jb_file_readable, (void **)&orig_jb_file_readable);
+        // hookAt(base, ADDR_JB_SANDBOX_ESCAPE,   (void *)hooked_jb_sandbox_escape,(void **)&orig_jb_sandbox_escape);
+        // hookAt(base, ADDR_JB_SYMLINK,          (void *)hooked_jb_symlink,       (void **)&orig_jb_symlink);
+        // hookAt(base, ADDR_JB_DYLIB_NAMES,      (void *)hooked_jb_dylib_names,   (void **)&orig_jb_dylib_names);
+
+        hookAt(base, ADDR_SECURITY_CHECK_BFC,  (void *)hooked_security_check_bfc,(void **)&orig_security_check_bfc);
+        hookAt(base, ADDR_SECURITY_CHECK_D20,  (void *)hooked_security_check_d20,(void **)&orig_security_check_d20);
+        hookAt(base, ADDR_SECURITY_CHECK_CD4,  (void *)hooked_security_check_cd4,(void **)&orig_security_check_cd4);
+
+        return;
+    }
+
+    NSLog(@"[VWTweak] Target module '%s' not found in dyld image list", TARGET_MODULE);
+}

VolkswagenJB/VolkswagenJB.plist

@@ -0,0 +1,7 @@
+{
+	Filter = {
+		Bundles = (
+			"com.volkswagen.WeConnect.production",
+		);
+	};
+}

VolkswagenJB/control

@@ -1,8 +1,8 @@
-Package: xyz.nohamr.servercatpremiumlegacy
+Package: xyz.nohamr.volkswagenjb
-Name: ServerCatPremium (Legacy)
+Name: VolkswagenJB (Rootless)
 Version: 1.0.0
 Architecture: iphoneos-arm
-Description: Unlocks premium features in ServerCat app.
+Description: Bypass jailbreak detection in Volkswagen app
 Maintainer: NohamR
 Author: NohamR
 Section: Tweaks

VolkswagenJB/index.md

@@ -0,0 +1,26 @@
+# VolkswagenJB
+
+Disables jailbreak detection in Volkswagen.
+
+- **App**: [Volkswagen](https://apps.apple.com/fr/app/volkswagen/id1517566572)
+- **Latest version**: 2.72.0
+- **Tested on**: iOS 16.7.15
+
+## Build
+
+```sh
+make clean && make package THEOS_PACKAGE_SCHEME=rootless DEBUG=0
+```
+
+## Inject
+
+```sh
+cyan -i com.volkswagen.WeConnect.production_2.72.0.ipa \
+     -o com.volkswagen.WeConnect.production_2.72.0_patched.ipa \
+     -f xyz.nohamr.volkswagenjb_1.0.0-1_iphoneos-arm64.deb \
+     -u
+```
+
+## Screenshots
+
+![../docs/screens/VolkswagenJB/undetected.png](../docs/screens/VolkswagenJB/undetected.png)

scripts/patch-tvos.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+set -e
+
+if [ "$#" -ne 2 ]; then
+    echo "Usage: $0 <file.ipa> <file.deb>"
+    exit 1
+fi
+
+IPA=""
+DEB=""
+
+for arg in "$@"; do
+    case "$arg" in
+        *.ipa)
+            IPA="$arg"
+            ;;
+        *.deb)
+            DEB="$arg"
+            ;;
+        *)
+            echo "Unknown file type: $arg"
+            exit 1
+            ;;
+    esac
+done
+
+if [ -z "$IPA" ] || [ -z "$DEB" ]; then
+    echo "You must provide one .ipa and one .deb file."
+    exit 1
+fi
+
+# ---- Prepare output folder ----
+OUT_DIR="/tmp/ipa_patched"
+mkdir -p "$OUT_DIR"
+
+IPA_NAME=$(basename "$IPA")
+OUTPUT_IPA="$OUT_DIR/$IPA_NAME"
+
+echo "[+] Patching IPA with cyan..."
+# cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 0
+cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 9 --tv
+echo "[+] Patch complete."
+
+# Copy patched IPA next to the original with _patched suffix
+ORIG_DIR=$(dirname "$IPA")
+ORIG_BASENAME=$(basename "$IPA" .ipa)
+PATCHED_IPA="$ORIG_DIR/${ORIG_BASENAME}_patched.ipa"
+cp "$OUTPUT_IPA" "$PATCHED_IPA"
+echo "[+] Patched IPA saved as: $PATCHED_IPA"

scripts/patch.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+
+set -e
+
+if [ "$#" -ne 2 ]; then
+    echo "Usage: $0 <file.ipa> <file.deb>"
+    exit 1
+fi
+
+IPA=""
+DEB=""
+
+for arg in "$@"; do
+    case "$arg" in
+        *.ipa)
+            IPA="$arg"
+            ;;
+        *.deb)
+            DEB="$arg"
+            ;;
+        *)
+            echo "Unknown file type: $arg"
+            exit 1
+            ;;
+    esac
+done
+
+if [ -z "$IPA" ] || [ -z "$DEB" ]; then
+    echo "You must provide one .ipa and one .deb file."
+    exit 1
+fi
+
+# ---- Prepare output folder ----
+OUT_DIR="/tmp/ipa_patched"
+mkdir -p "$OUT_DIR"
+
+IPA_NAME=$(basename "$IPA")
+OUTPUT_IPA="$OUT_DIR/$IPA_NAME"
+
+echo "[+] Patching IPA with cyan..."
+# cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 0
+cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 9
+echo "[+] Patch complete."
+
+# Copy patched IPA next to the original with _patched suffix
+ORIG_DIR=$(dirname "$IPA")
+ORIG_BASENAME=$(basename "$IPA" .ipa)
+PATCHED_IPA="$ORIG_DIR/${ORIG_BASENAME}_patched.ipa"
+cp "$OUTPUT_IPA" "$PATCHED_IPA"
+echo "[+] Patched IPA saved as: $PATCHED_IPA"

scripts/patch_and_serve.sh

@@ -38,7 +38,8 @@ IPA_NAME=$(basename "$IPA")
 OUTPUT_IPA="$OUT_DIR/$IPA_NAME"
 
 echo "[+] Patching IPA with cyan..."
-cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite
+# cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 0
+cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 9
 echo "[+] Patch complete."
 
 LOCAL_IP=$(ipconfig getifaddr en0 2>/dev/null)