Up

.gitignore

@@ -4,3 +4,7 @@ Build.md
 /PineHeartsUnlock
 /App
 /GoodnotesPro
+/StravaPremium
+scripts/build_install_loop.sh
+CanardDumper/Tweak.x.bak
+CanardDumper/Tweak_POC.x

CanardDumper/.gitignore

@@ -0,0 +1,3 @@
+.theos/
+packages/
+.DS_Store

CanardDumper/CanardDumper.plist

@@ -0,0 +1,7 @@
+{
+	Filter = {
+		Bundles = (
+			"fr.lecanardenchaine.app",
+		);
+	};
+}

CanardDumper/Makefile

@@ -0,0 +1,14 @@
+TARGET = iphone:latest:15.0
+ARCHS = arm64 arm64e
+INSTALL_TARGET_PROCESSES = fr.lecanardenchaine.app
+
+include $(THEOS)/makefiles/common.mk
+
+TWEAK_NAME = CanardDumper
+CanardDumper_FILES = Tweak.x
+CanardDumper_CFLAGS = -fobjc-arc -Wno-deprecated-declarations -std=c++11 -x objective-c++
+CanardDumper_CXXFLAGS = -std=c++11
+CanardDumper_FRAMEWORKS = Foundation UIKit
+CanardDumper_LDFLAGS = -lstdc++
+
+include $(THEOS_MAKE_PATH)/tweak.mk

CanardDumper/Tweak.x

@@ -0,0 +1,153 @@
+#import <substrate.h>
+#import <Foundation/Foundation.h>
+#import <UIKit/UIKit.h>
+
+#pragma mark - Constants
+
+static NSString *const kCanardLogTag = @"[CanardDumper]";
+static NSString *const kCanardDumpDirectoryName = @"CanardDumps";
+
+#pragma mark - State
+
+static NSString *CanardArchivePassword;
+static int CanardLastSavedReadSize = -1;
+
+#pragma mark - UI Helpers
+
+static UIViewController *CanardTopViewController(UIViewController *viewController) {
+    if (!viewController) return nil;
+    
+    if (viewController.presentedViewController) {
+        return CanardTopViewController(viewController.presentedViewController);
+    }
+    if ([viewController isKindOfClass:[UINavigationController class]]) {
+        return CanardTopViewController([(UINavigationController *)viewController visibleViewController]);
+    }
+    if ([viewController isKindOfClass:[UITabBarController class]]) {
+        return CanardTopViewController([(UITabBarController *)viewController selectedViewController]);
+    }
+    return viewController;
+}
+
+static void CanardPresentShareSheet(NSString *filePath) {
+    dispatch_async(dispatch_get_main_queue(), ^{
+        UIWindow *keyWindow = nil;
+        for (UIWindow *window in [UIApplication sharedApplication].windows) {
+            if (window.isKeyWindow) {
+                keyWindow = window;
+                break;
+            }
+        }
+
+        UIViewController *topVC = CanardTopViewController(keyWindow.rootViewController);
+        if (!topVC) {
+            NSLog(@"%@ Unable to present share sheet", kCanardLogTag);
+            return;
+        }
+
+        NSURL *fileURL = [NSURL fileURLWithPath:filePath];
+        UIActivityViewController *shareController = [[UIActivityViewController alloc] initWithActivityItems:@[fileURL] applicationActivities:nil];
+        shareController.popoverPresentationController.sourceView = topVC.view;
+        shareController.popoverPresentationController.sourceRect = CGRectMake(
+            CGRectGetMidX(topVC.view.bounds),
+            CGRectGetMidY(topVC.view.bounds),
+            0, 0
+        );
+        [topVC presentViewController:shareController animated:YES completion:nil];
+    });
+}
+
+#pragma mark - File Helpers
+
+static NSString *CanardSanitizedFilename(NSString *password) {
+    if (password.length == 0) return @"unknown";
+
+    NSCharacterSet *invalidChars = [NSCharacterSet characterSetWithCharactersInString:@"/:\\?%*|\"<>\n\r\t"];
+    NSString *sanitized = [[password componentsSeparatedByCharactersInSet:invalidChars] componentsJoinedByString:@"_"];
+    return sanitized.length > 0 ? sanitized : @"unknown";
+}
+
+static NSString *CanardDumpDirectory() {
+    NSString *docsPath = [NSSearchPathForDirectoriesInDomains(NSDocumentDirectory, NSUserDomainMask, YES) firstObject];
+    return [docsPath stringByAppendingPathComponent:kCanardDumpDirectoryName];
+}
+
+static bool CanardSaveData(NSData *data, NSString *password) {
+    NSFileManager *fm = [NSFileManager defaultManager];
+    NSString *dumpDir = CanardDumpDirectory();
+
+    if (![fm fileExistsAtPath:dumpDir]) {
+        [fm createDirectoryAtPath:dumpDir withIntermediateDirectories:YES attributes:nil error:nil];
+    }
+
+    NSString *fileName = [NSString stringWithFormat:@"file_%@.pdf", CanardSanitizedFilename(password)];
+    NSString *filePath = [dumpDir stringByAppendingPathComponent:fileName];
+
+    if ([data writeToFile:filePath atomically:YES]) {
+        NSLog(@"%@ Saved to %@ (%lu bytes)", kCanardLogTag, filePath, (unsigned long)data.length);
+        CanardPresentShareSheet(filePath);
+        return YES;
+    }
+
+    NSLog(@"%@ Failed to save to %@", kCanardLogTag, filePath);
+    return NO;
+}
+
+#pragma mark - DlyArchiveReader Hooks
+
+%hook DlyArchiveReader
+
+- (bool)setUpArchiveError:(id *)error {
+    NSLog(@"%@ setUpArchiveError: %p", kCanardLogTag, error);
+    return %orig;
+}
+
+- (NSString *)password {
+    NSString *pwd = %orig;
+    CanardArchivePassword = [pwd copy];
+    NSLog(@"%@ password: %@", kCanardLogTag, pwd);
+    return pwd;
+}
+
+- (int)getDocumentSize {
+    int size = %orig;
+    NSLog(@"%@ getDocumentSize: %d", kCanardLogTag, size);
+    return size;
+}
+
+- (NSData *)readDataAt:(int)offset withSize:(int)size {
+    NSLog(@"%@ readDataAt: offset=%d size=%d", kCanardLogTag, offset, size);
+    NSLog(@"%@ %@", kCanardLogTag, [[NSThread callStackSymbols] componentsJoinedByString:@"\n"]);
+
+    NSData *data = %orig;
+
+    if (data.length > 0 && size != CanardLastSavedReadSize) {
+        CanardLastSavedReadSize = size;
+        CanardSaveData(data, CanardArchivePassword);
+    }
+
+    return data;
+}
+
+%end
+
+#pragma mark - DlyCoreArchive Hooks
+
+%hook DlyCoreArchive
+
+- (instancetype)initWithArchivePath:(NSString *)path error:(NSError **)error {
+    NSLog(@"%@ initWithArchivePath: %@ error:%p", kCanardLogTag, path, error);
+    return %orig;
+}
+
++ (instancetype)newWithArchivePath:(NSString *)path error:(NSError **)error {
+    NSLog(@"%@ newWithArchivePath: %@ error:%p", kCanardLogTag, path, error);
+    return %orig;
+}
+
+- (bool)openArchiveWithType:(NSUInteger)type error:(id *)error {
+    NSLog(@"%@ openArchiveWithType: %lu error:%p", kCanardLogTag, (unsigned long)type, error);
+    return %orig;
+}
+
+%end

CanardDumper/control

@@ -0,0 +1,9 @@
+Package: xyz.nohamr.canarddumper
+Name: CanardDumper
+Version: 1.0.0
+Architecture: iphoneos-arm
+Description: Dumps extracted files from DlyCore DlyArchiveFile::GetFile to Documents/CanardDumps for Le Canard Enchaîné app analysis
+Maintainer: NohamR
+Author: NohamR
+Section: Tweaks
+Depends: mobilesubstrate (>= 0.9.5000)

CloudQuit/.gitignore

@@ -0,0 +1,3 @@
+.theos/
+packages/
+.DS_Store

CloudQuit/CloudQuit.plist

@@ -0,0 +1,7 @@
+{
+	Filter = {
+		Bundles = (
+			"com.example.cloudquit",
+		);
+	};
+}

CloudQuit/Makefile

@@ -0,0 +1,13 @@
+TARGET = iphone:latest:14.0
+INSTALL_TARGET_PROCESSES = com.example.cloudquit
+ARCHS = arm64
+
+include $(THEOS)/makefiles/common.mk
+
+TWEAK_NAME = CloudQuit
+
+CloudQuit_FILES = Tweak.x
+CloudQuit_CFLAGS = -fobjc-arc
+CloudQuit_FRAMEWORKS = Foundation
+
+include $(THEOS_MAKE_PATH)/tweak.mk

CloudQuit/Tweak.x

@@ -0,0 +1,12 @@
+#import <substrate.h>
+#import <Foundation/Foundation.h>
+
+// iOS 16+ Crash Fix
+%hook CKContainer
++ (id)defaultContainer {
+    return nil;
+}
++ (id)containerWithIdentifier:(id) arg1 {
+    return nil;
+}
+%end

CloudQuit/control

@@ -0,0 +1,9 @@
+Package: xyz.nohamr.cloudquit
+Name: CloudQuit
+Version: 1.0.0
+Architecture: iphoneos-arm
+Description: Fixes iOS 16+ CloudKit crashes by returning nil from CKContainer methods.
+Maintainer: NohamR
+Author: NohamR
+Section: Tweaks
+Depends: mobilesubstrate (>= 0.9.5000)

HatchDragons/.gitignore

@@ -0,0 +1,3 @@
+.theos/
+packages/
+.DS_Store

HatchDragons/HatchDragons.plist

@@ -0,0 +1,7 @@
+{
+	Filter = {
+		Bundles = (
+			"com.runawayplay.dragons",
+		);
+	};
+}

HatchDragons/Makefile

@@ -0,0 +1,13 @@
+TARGET = iphone:latest:14.0
+INSTALL_TARGET_PROCESSES = com.runawayplay.dragons
+ARCHS = arm64 arm64e
+
+include $(THEOS)/makefiles/common.mk
+
+TWEAK_NAME = HatchDragons
+
+HatchDragons_FILES = Tweak.x
+HatchDragons_CFLAGS = -fobjc-arc
+HatchDragons_FRAMEWORKS = Foundation
+
+include $(THEOS_MAKE_PATH)/tweak.mk

HatchDragons/Tweak.x

@@ -0,0 +1,156 @@
+// log stream --predicate 'process == "HatchDragons" AND eventMessage contains "HGH" ' --level default --style compact
+
+#import <substrate.h>
+#import <Foundation/Foundation.h>
+#import <mach-o/dyld.h>
+
+#define LOG(fmt, ...) NSLog(@"[HGH] " fmt, ##__VA_ARGS__)
+
+#pragma mark - IL2CPP String Layout
+
+#define IL2CPP_STRING_LENGTH_OFFSET  0x10
+#define IL2CPP_STRING_CHARS_OFFSET   0x14
+#define IL2CPP_DICT_ENTRIES_OFFSET   0x18
+#define IL2CPP_DICT_COUNT_OFFSET     0x20
+#define IL2CPP_ARRAY_CAPACITY_OFFSET 0x18
+#define IL2CPP_ARRAY_DATA_OFFSET     0x20
+#define IL2CPP_DICT_ENTRY_SIZE       24
+#define IL2CPP_STRING_MAX_LENGTH     (1 << 16)
+
+#pragma mark - Helpers
+
+static uintptr_t getImageBase(void) {
+    uint32_t count = _dyld_image_count();
+    for (uint32_t i = 0; i < count; i++) {
+        const char *name = _dyld_get_image_name(i);
+        if (name && strstr(name, "UnityFramework")) {
+            return (uintptr_t)_dyld_get_image_header(i);
+        }
+    }
+    return 0;
+}
+
+static int requestCount = 0;
+
+static NSString *timestampString(void) {
+    static NSDateFormatter *fmt;
+    static dispatch_once_t onceToken;
+    dispatch_once(&onceToken, ^{
+        fmt = [[NSDateFormatter alloc] init];
+        fmt.dateFormat = @"HH:mm:ss.SSS";
+    });
+    return [fmt stringFromDate:[NSDate date]];
+}
+
+static NSString *il2cppString(void *str) {
+    if (!str) return nil;
+    uint32_t len = *(uint32_t *)((char *)str + IL2CPP_STRING_LENGTH_OFFSET);
+    if (len == 0 || len > IL2CPP_STRING_MAX_LENGTH) return @"(empty?)";
+    NSString *s = [[NSString alloc] initWithBytes:((char *)str + IL2CPP_STRING_CHARS_OFFSET)
+                                           length:len * 2
+                                         encoding:NSUTF16LittleEndianStringEncoding];
+    return s ?: @"(unparseable)";
+}
+
+static NSString *il2cppHeaders(void *dict) {
+    if (!dict) return @"(nil)";
+
+    void *entriesArr = *(void **)((char *)dict + IL2CPP_DICT_ENTRIES_OFFSET);
+    if (!entriesArr) return @"(empty)";
+
+    uint64_t cap = *(uint64_t *)((char *)entriesArr + IL2CPP_ARRAY_CAPACITY_OFFSET);
+    if (cap == 0) return @"(empty)";
+
+    NSMutableString *out = [NSMutableString string];
+    uint32_t used = 0;
+    char *data = (char *)entriesArr + IL2CPP_ARRAY_DATA_OFFSET;
+
+    for (uint64_t i = 0; i < cap; i++) {
+        char *e = data + i * IL2CPP_DICT_ENTRY_SIZE;
+        int32_t hashCode = *(int32_t *)e;
+        void *key = *(void **)(e + 8);
+        void *value = *(void **)(e + 16);
+
+        if (hashCode < 0 || !key) continue;
+        [out appendFormat:@"\n        %@: %@", il2cppString(key),
+         value ? il2cppString(value) : @"(null)"];
+        used++;
+    }
+
+    return used ? out : @"(empty)";
+}
+
+static void logRequest(NSString *method, void *self, NSString *body) {
+    requestCount++;
+    NSString *uri = il2cppString(*(void **)((char *)self + 0x10));
+    NSString *platform = il2cppString(*(void **)((char *)self + 0x20));
+    void *hdrs = *(void **)((char *)self + 0x18);
+
+    NSMutableString *msg = [NSMutableString stringWithFormat:
+        @"[%@] ▶ %@ #%d self=%p\n    URI: %@\n    Headers:%@\n    Platform: %@",
+        timestampString(), method, requestCount, self, uri, il2cppHeaders(hdrs), platform];
+
+    if (body) {
+        [msg appendFormat:@"\n    Body: %@", body];
+    }
+
+    LOG(@"%@", msg);
+}
+
+#pragma mark - CI.HttpClient.RequestHandler Hooks
+
+static void (*orig_performGet)(void *, void *);
+static void (*orig_postJson)(void *, void *, void *);
+
+static void hooked_performGet(void *self, void *handler) {
+    logRequest(@"CI.GET", self, nil);
+    orig_performGet(self, handler);
+}
+
+static void hooked_postJson(void *self, void *payload, void *handler) {
+    logRequest(@"CI.POST", self, payload ? il2cppString(payload) : nil);
+    orig_postJson(self, payload, handler);
+}
+
+#pragma mark - PlayerInventory Currency Hooks
+
+static void (*orig_modifyHC)(void *, long, void *, int);
+static void (*orig_modifySC)(void *, long, void *);
+
+static void hooked_modifyHC(void *self, long amount, void *info, int quantity) {
+    if (amount < 0) {
+        LOG(@"ModifyHC %ld → %ld (negated)", amount, -amount);
+        amount = -amount;
+    }
+    orig_modifyHC(self, amount, info, quantity);
+}
+
+static void hooked_modifySC(void *self, long amount, void *info) {
+    if (amount < 0) {
+        LOG(@"ModifySC %ld → %ld (negated)", amount, -amount);
+        amount = -amount;
+    }
+    orig_modifySC(self, amount, info);
+}
+
+#pragma mark - Hook Installation
+
+#define HOOK(base, rva, hook, orig) \
+    MSHookFunction((void *)((base) + (rva)), (void *)(hook), (void **)&(orig))
+
+%ctor {
+    uintptr_t base = getImageBase();
+    if (!base) {
+        LOG(@"UnityFramework not found, aborting");
+        return;
+    }
+
+    LOG(@"UnityFramework base = 0x%lx", (unsigned long)base);
+
+    HOOK(base, 0x58FE798, hooked_performGet, orig_performGet);
+    HOOK(base, 0x58FED8C, hooked_postJson,  orig_postJson);
+    HOOK(base, 0x57DC6EC, hooked_modifyHC,  orig_modifyHC);
+    HOOK(base, 0x57E4978, hooked_modifySC,  orig_modifySC);
+
+    LOG(@"All hooks installed");
+}

HatchDragons/control

@@ -0,0 +1,9 @@
+Package: xyz.nohamr.hatchdragons
+Name: HatchDragons
+Version: 1.0.0
+Architecture: iphoneos-arm
+Description: Logs CI.HttpClient requests (PerformGet/PostJson) from the HatchDragons Unity (il2cpp) game to the console.
+Maintainer: NohamR
+Author: NohamR
+Section: Tweaks
+Depends: mobilesubstrate (>= 0.9.5000)

HatchDragons/index.md

@@ -0,0 +1,22 @@
+# HatchDragons
+
+Logs HTTP requests and negates currency deductions in HatchDragons so spending hard/soft currency instead adds it to the player's balance.
+
+- **App**: [HatchDragons](https://apps.apple.com/us/app/hatch-dragons/id6746389113)
+- **Latest version**: 1.2.1
+- **Tested on**: iOS 18.3
+
+## Build
+
+```sh
+make clean && make package THEOS_PACKAGE_SCHEME=rootless DEBUG=0
+```
+
+## Inject
+
+```sh
+cyan -i com.runawayplay.dragons_1.2.1.ipa \
+     -o com.runawayplay.dragons_1.2.1_patched.ipa \
+     -f xyz.nohamr.hatchdragons_1.0.0_iphoneos-arm.deb \
+     -u
+```

NetworkLogger/.gitignore

@@ -0,0 +1,3 @@
+.theos/
+packages/
+.DS_Store

NetworkLogger/Makefile

@@ -0,0 +1,13 @@
+TARGET = iphone:latest:14.0
+INSTALL_TARGET_PROCESSES = *
+ARCHS = arm64 arm64e
+
+include $(THEOS)/makefiles/common.mk
+
+TWEAK_NAME = NetworkLogger
+
+NetworkLogger_FILES = Tweak.x
+NetworkLogger_CFLAGS = -fobjc-arc
+NetworkLogger_FRAMEWORKS = Foundation
+
+include $(THEOS_MAKE_PATH)/tweak.mk

NetworkLogger/NetworkLogger.plist

@@ -0,0 +1,2 @@
+{
+}

NetworkLogger/Tweak.x

@@ -0,0 +1,156 @@
+#import <substrate.h>
+#import <Foundation/Foundation.h>
+
+#define LOG(fmt, ...) NSLog(@"[NetworkLogger] " fmt, ##__VA_ARGS__)
+#define MAX_BODY_LOG 2048
+
+#pragma mark - Helpers
+
+static int requestCount = 0;
+
+static NSString *timestamp(void) {
+    static NSDateFormatter *fmt;
+    static dispatch_once_t once;
+    dispatch_once(&once, ^{
+        fmt = [NSDateFormatter new];
+        fmt.dateFormat = @"HH:mm:ss.SSS";
+    });
+    return [fmt stringFromDate:[NSDate date]];
+}
+
+static NSString *method(NSURLRequest *req) {
+    return req.HTTPMethod.length ? req.HTTPMethod : @"GET";
+}
+
+static NSString *url(NSURLRequest *req) {
+    return req.URL.absoluteString;
+}
+
+static NSString *formatHeaders(NSDictionary *hdrs) {
+    if (!hdrs.count) return @"(none)";
+    NSMutableString *s = [NSMutableString string];
+    [hdrs enumerateKeysAndObjectsUsingBlock:^(NSString *k, NSString *v, BOOL *_) {
+        [s appendFormat:@"\n    %@: %@", k, v];
+    }];
+    return s.copy;
+}
+
+static NSString *formatBody(NSData *data) {
+    if (!data.length) return @"(empty)";
+    NSString *str = [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
+    if (str) return str.length > MAX_BODY_LOG ? [str substringToIndex:MAX_BODY_LOG] : str;
+    return [NSString stringWithFormat:@"<binary %lu bytes>", (unsigned long)data.length];
+}
+
+static NSString *formatResponse(NSHTTPURLResponse *resp, NSData *body) {
+    NSMutableString *s = [NSMutableString stringWithFormat:@"HTTP %ld", (long)resp.statusCode];
+    [resp.allHeaderFields enumerateKeysAndObjectsUsingBlock:^(NSString *k, NSString *v, BOOL *_) {
+        [s appendFormat:@"\n    %@: %@", k, v];
+    }];
+    if (body) [s appendFormat:@"\n    Body: %@", formatBody(body)];
+    return s.copy;
+}
+
+static void logDataResponse(int num, NSURLRequest *req, NSData *data, NSURLResponse *resp, NSError *err) {
+    if (err) {
+        LOG(@"[%@] ◀ #%d %@ %@\n    Error: %@", timestamp(), num, method(req), url(req), err.localizedDescription);
+    } else if ([resp isKindOfClass:[NSHTTPURLResponse class]]) {
+        LOG(@"[%@] ◀ #%d %@ %@\n%@", timestamp(), num, method(req), url(req), formatResponse((NSHTTPURLResponse *)resp, data));
+    } else {
+        LOG(@"[%@] ◀ #%d %@ %@\n    (non-HTTP)", timestamp(), num, method(req), url(req));
+    }
+}
+
+#define LOG_REQUEST(req, extra) \
+    LOG(@"[%@] ▶ #%d %@ %@\n    Headers:%@%@", timestamp(), ++requestCount, method(req), url(req), formatHeaders(req.allHTTPHeaderFields), extra)
+
+#define WRAP_DATA_HANDLER(orig, self, _cmd, req, handler, ...) \
+    void (^wrapped)(NSData *, NSURLResponse *, NSError *) = ^(NSData *d, NSURLResponse *r, NSError *e) { \
+        logDataResponse(requestCount, req, d, r, e); \
+        if (handler) handler(d, r, e); \
+    }; \
+    return orig(self, _cmd, req, ##__VA_ARGS__, wrapped)
+
+#pragma mark - NSURLSession Hooks
+
+static NSURLSessionDataTask *(*orig_dataTaskReq)(NSURLSession *, SEL, NSURLRequest *, void (^)(NSData *, NSURLResponse *, NSError *));
+
+static NSURLSessionDataTask *hooked_dataTaskReq(NSURLSession *self, SEL _cmd, NSURLRequest *req, void (^handler)(NSData *, NSURLResponse *, NSError *)) {
+    NSString *bodyLog = req.HTTPBody ? [NSString stringWithFormat:@"\n    Body: %@", formatBody(req.HTTPBody)] : @"";
+    LOG_REQUEST(req, bodyLog);
+    WRAP_DATA_HANDLER(orig_dataTaskReq, self, _cmd, req, handler);
+}
+
+static NSURLSessionDataTask *(*orig_dataTaskURL)(NSURLSession *, SEL, NSURL *, void (^)(NSData *, NSURLResponse *, NSError *));
+
+static NSURLSessionDataTask *hooked_dataTaskURL(NSURLSession *self, SEL _cmd, NSURL *u, void (^handler)(NSData *, NSURLResponse *, NSError *)) {
+    return hooked_dataTaskReq(self, _cmd, [NSURLRequest requestWithURL:u], handler);
+}
+
+static NSURLSessionUploadTask *(*orig_uploadTask)(NSURLSession *, SEL, NSURLRequest *, NSData *, void (^)(NSData *, NSURLResponse *, NSError *));
+
+static NSURLSessionUploadTask *hooked_uploadTask(NSURLSession *self, SEL _cmd, NSURLRequest *req, NSData *body, void (^handler)(NSData *, NSURLResponse *, NSError *)) {
+    LOG_REQUEST(req, [NSString stringWithFormat:@"\n    Body: %@", formatBody(body)]);
+    WRAP_DATA_HANDLER(orig_uploadTask, self, _cmd, req, handler, body);
+}
+
+static NSURLSessionDownloadTask *(*orig_downloadTask)(NSURLSession *, SEL, NSURLRequest *, void (^)(NSURL *, NSURLResponse *, NSError *));
+
+static NSURLSessionDownloadTask *hooked_downloadTask(NSURLSession *self, SEL _cmd, NSURLRequest *req, void (^handler)(NSURL *, NSURLResponse *, NSError *)) {
+    LOG_REQUEST(req, @"");
+    int num = requestCount;
+    void (^wrapped)(NSURL *, NSURLResponse *, NSError *) = ^(NSURL *loc, NSURLResponse *resp, NSError *err) {
+        if (err) {
+            LOG(@"[%@] ◀ #%d %@ %@\n    Error: %@", timestamp(), num, method(req), url(req), err.localizedDescription);
+        } else if ([resp isKindOfClass:[NSHTTPURLResponse class]]) {
+            LOG(@"[%@] ◀ #%d %@ %@\n    (saved to %@)\n%@", timestamp(), num, method(req), url(req), loc.path, formatResponse((NSHTTPURLResponse *)resp, nil));
+        }
+        if (handler) handler(loc, resp, err);
+    };
+    return orig_downloadTask(self, _cmd, req, wrapped);
+}
+
+static void (*orig_resume)(NSURLSessionTask *, SEL);
+
+static void hooked_resume(NSURLSessionTask *self, SEL _cmd) {
+    LOG(@"[%@] ▶ RESUME %@ %@", timestamp(), method(self.currentRequest), url(self.currentRequest));
+    orig_resume(self, _cmd);
+}
+
+#pragma mark - NSURLConnection (Legacy)
+
+static void (*orig_asyncSend)(NSURLConnection *, SEL, NSURLRequest *, NSOperationQueue *, void (^)(NSURLResponse *, NSData *, NSError *));
+
+static void hooked_asyncSend(NSURLConnection *self, SEL _cmd, NSURLRequest *req, NSOperationQueue *queue, void (^handler)(NSURLResponse *, NSData *, NSError *)) {
+    LOG_REQUEST(req, @" (legacy)");
+    void (^wrapped)(NSURLResponse *, NSData *, NSError *) = ^(NSURLResponse *r, NSData *d, NSError *e) {
+        logDataResponse(requestCount, req, d, r, e);
+        if (handler) handler(r, d, e);
+    };
+    orig_asyncSend(self, _cmd, req, queue, wrapped);
+}
+
+#pragma mark - Constructor
+
+#define HOOK_MSG(cls, sel, hook, orig) \
+    MSHookMessageEx(cls, @selector(sel), (IMP)hook, (IMP *)&orig)
+
+%ctor {
+    LOG(@"=== tweak loaded ===");
+
+    Class session = NSClassFromString(@"NSURLSession");
+    if (session) {
+        HOOK_MSG(session, dataTaskWithRequest:completionHandler:, hooked_dataTaskReq, orig_dataTaskReq);
+        HOOK_MSG(session, dataTaskWithURL:completionHandler:, hooked_dataTaskURL, orig_dataTaskURL);
+        HOOK_MSG(session, uploadTaskWithRequest:fromData:completionHandler:, hooked_uploadTask, orig_uploadTask);
+        HOOK_MSG(session, downloadTaskWithRequest:completionHandler:, hooked_downloadTask, orig_downloadTask);
+    }
+
+    Class task = NSClassFromString(@"__NSCFLocalDataTask") ?: NSClassFromString(@"NSURLSessionDataTask");
+    if (task) HOOK_MSG(task, resume, hooked_resume, orig_resume);
+
+    Class conn = NSClassFromString(@"NSURLConnection");
+    if (conn) HOOK_MSG(conn, sendAsynchronousRequest:queue:completionHandler:, hooked_asyncSend, orig_asyncSend);
+
+    LOG(@"=== all hooks installed ===");
+}

NetworkLogger/control

@@ -0,0 +1,9 @@
+Package: xyz.noham.networklogger
+Name: NetworkLogger
+Version: 1.0.0
+Architecture: iphoneos-arm
+Description: Logs every network request and response to the console via os_log.
+Maintainer: NohamR
+Author: NohamR
+Section: Tweaks
+Depends: mobilesubstrate (>= 0.9.5000)

NetworkLogger/index.md

@@ -0,0 +1,44 @@
+# NetworkLogger
+
+Logs every network request and response to the console via `os_log`. Useful for debugging API calls, reverse-engineering endpoints, and understanding how an app communicates with its backend.
+
+## What it hooks
+
+- `NSURLSession` task creation (`dataTaskWithRequest:`, `dataTaskWithURL:`, `uploadTaskWithRequest:fromData:`, `downloadTaskWithRequest:`)
+- `NSURLSessionTask resume`
+- `NSURLConnection sendAsynchronousRequest:queue:completionHandler:` (legacy)
+
+## Output format
+
+```
+[NetworkLogger] ▶ REQUEST GET https://platform.runawayplay.com/dragons/api/mailbox
+    Headers:
+        Authorization: Bearer <token>
+        X-Client-Platform: ios
+    Body: (none)
+[NetworkLogger] ◀ RESPONSE GET https://platform.runawayplay.com/dragons/api/mailbox
+    HTTP 200
+    Content-Type: application/json
+    ...
+    Body: {"mailItems": [...]}
+```
+
+## Build
+
+```sh
+make clean && make package THEOS_PACKAGE_SCHEME=rootless
+```
+
+## Inject
+
+```sh
+cyan -i <input.ipa> -o <output_patched.ipa> -f <tweak.deb> -u
+```
+
+## Viewing logs
+
+```sh
+log stream --predicate 'eventMessage contains "NetworkLogger"' --level debug
+```
+
+Or view in Console.app filtering for `NetworkLogger`.

README.md

@@ -5,7 +5,7 @@ iOS tweaks built with [Theos](https://theos.dev), injected into IPAs via [cyan](
 ## Tweaks
 
 | Tweak                                              | App                      | Target      |
-| ------------------------------------------------------- | ---------------- | ---------- |
+| -------------------------------------------------- | ------------------------ | ----------- |
 | [ServerCatPremium](ServerCatPremium/index.md)      | ServerCat 1.30.0 / 1.6.4 | iOS 15+     |
 | [TextasticPro](TextasticPro/index.md)              | Textastic 10.9.2         | iOS 18+     |
 | [BusinessJB](BusinessJB/index.md)                  | Business 2.3.000         | iOS 15      |
@@ -16,6 +16,10 @@ iOS tweaks built with [Theos](https://theos.dev), injected into IPAs via [cyan](
 | [TF1+ (iOS)](TF1Plus/TF1Plus-iOS/index.md)         | TF1+ 11.36.0             | iOS 14+     |
 | [OqeePlus (tvOS)](OqeePlus/OqeePlus-tvOS/index.md) | Oqee 2.40                | tvOS 18.3   |
 | [OqeePlus (iOS)](OqeePlus/OqeePlus-iOS/index.md)   | Oqee 2.40                | iOS 18+     |
+| [VolkswagenJB](VolkswagenJB/index.md)              | Volkswagen 2.72.0        | iOS 16.7.15 |
+| [GPXViewer2](GPXViewer2)                           | GPXViewer 2              | iOS 14+     |
+| [RMHook](RMHook/index.md)                          | reMarkable               | iOS         |
+| [HatchDragons](HatchDragons/index.md)              | HatchDragons 1.2.1       | iOS 18+     |
 
 ## Build
 

scripts/patch-tvos.sh

@@ -2,49 +2,5 @@
 
 set -e
 
-if [ "$#" -ne 2 ]; then
-    echo "Usage: $0 <file.ipa> <file.deb>"
-    exit 1
-fi
-
-IPA=""
-DEB=""
-
-for arg in "$@"; do
-    case "$arg" in
-        *.ipa)
-            IPA="$arg"
-            ;;
-        *.deb)
-            DEB="$arg"
-            ;;
-        *)
-            echo "Unknown file type: $arg"
-            exit 1
-            ;;
-    esac
-done
-
-if [ -z "$IPA" ] || [ -z "$DEB" ]; then
-    echo "You must provide one .ipa and one .deb file."
-    exit 1
-fi
-
-# ---- Prepare output folder ----
-OUT_DIR="/tmp/ipa_patched"
-mkdir -p "$OUT_DIR"
-
-IPA_NAME=$(basename "$IPA")
-OUTPUT_IPA="$OUT_DIR/$IPA_NAME"
-
-echo "[+] Patching IPA with cyan..."
-# cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 0
-cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 9 --tv
-echo "[+] Patch complete."
-
-# Copy patched IPA next to the original with _patched suffix
-ORIG_DIR=$(dirname "$IPA")
-ORIG_BASENAME=$(basename "$IPA" .ipa)
-PATCHED_IPA="$ORIG_DIR/${ORIG_BASENAME}_patched.ipa"
-cp "$OUTPUT_IPA" "$PATCHED_IPA"
-echo "[+] Patched IPA saved as: $PATCHED_IPA"
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+"$SCRIPT_DIR/patch.sh" --tv "$@"

scripts/patch.sh

@@ -2,25 +2,48 @@
 
 set -e
 
-if [ "$#" -ne 2 ]; then
-    echo "Usage: $0 <file.ipa> <file.deb>"
+usage() {
+    echo "Usage: $0 [--tv] [-o <output.ipa> | --output <output.ipa>] <file.ipa> <file.deb>"
     exit 1
-fi
+}
 
+TV=0
 IPA=""
 DEB=""
+OUTPUT_IPA=""
+OUTPUT_SPECIFIED=0
 
-for arg in "$@"; do
-    case "$arg" in
+while [ "$#" -gt 0 ]; do
+    case "$1" in
+        -o|--output)
+            if [ -z "$2" ]; then
+                echo "Error: $1 requires an argument."
+                exit 1
+            fi
+            OUTPUT_IPA="$2"
+            OUTPUT_SPECIFIED=1
+            shift 2
+            ;;
+        -o=*|--output=*)
+            OUTPUT_IPA="${1#*=}"
+            OUTPUT_SPECIFIED=1
+            shift
+            ;;
+        --tv)
+            TV=1
+            shift
+            ;;
         *.ipa)
-            IPA="$arg"
+            IPA="$1"
+            shift
             ;;
         *.deb)
-            DEB="$arg"
+            DEB="$1"
+            shift
             ;;
         *)
-            echo "Unknown file type: $arg"
-            exit 1
+            echo "Unknown argument: $1"
+            usage
             ;;
     esac
 done
@@ -30,21 +53,22 @@ if [ -z "$IPA" ] || [ -z "$DEB" ]; then
     exit 1
 fi
 
-# ---- Prepare output folder ----
-OUT_DIR="/tmp/ipa_patched"
-mkdir -p "$OUT_DIR"
+if [ -z "$OUTPUT_IPA" ]; then
+    OUTPUT_IPA="/tmp/ipa_patched/$(basename "$IPA")"
+    mkdir -p "$(dirname "$OUTPUT_IPA")"
+fi
 
-IPA_NAME=$(basename "$IPA")
-OUTPUT_IPA="$OUT_DIR/$IPA_NAME"
+CYAN_ARGS=(-i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 9)
+if [ "$TV" -eq 1 ]; then
+    CYAN_ARGS+=(--tv)
+fi
 
 echo "[+] Patching IPA with cyan..."
-# cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 0
-cyan -i "$IPA" -o "$OUTPUT_IPA" -f "$DEB" -u --overwrite -c 9
+cyan "${CYAN_ARGS[@]}"
 echo "[+] Patch complete."
 
-# Copy patched IPA next to the original with _patched suffix
-ORIG_DIR=$(dirname "$IPA")
-ORIG_BASENAME=$(basename "$IPA" .ipa)
-PATCHED_IPA="$ORIG_DIR/${ORIG_BASENAME}_patched.ipa"
-cp "$OUTPUT_IPA" "$PATCHED_IPA"
-echo "[+] Patched IPA saved as: $PATCHED_IPA"
+if [ "$OUTPUT_SPECIFIED" -eq 0 ]; then
+    PATCHED_IPA="$(dirname "$IPA")/$(basename "$IPA" .ipa)_patched.ipa"
+    cp "$OUTPUT_IPA" "$PATCHED_IPA"
+    echo "[+] Patched IPA saved as: $PATCHED_IPA"
+fi