Saturday, March 28, 2009

Mac OS X : suddenly disappear Chinese Input Methods

This is the method to solve the problem

(1) Create a newuser and see if the Input Method can be selected in International Preference

(2) If the newuser can access the Input Method, then it is preference setting problem

(3) login the newuser and copy the following files from folder ~/Library/Preferences to in a common folder
com.apple.systempreferences.plist
TCIMHaninUserDictionary
com.apple.inputmethod.TCIM.plist

(4) login the olduser and copy the above files back to ~/Library/Preferences

(5) Reboot Mac
.
.
.

Tuesday, February 10, 2009

How to decrypt iPhone IPA file

Decrypted IPA
Please take note that you don't need this method to decrypt the IPA file, if you already have the decrypted one downloaded from the net. This method applies to the app that you have directly purchased from App Store and want to decrypt it in order to be useful for others.

One of the decrypt methods is to use a jailbreak iPhone and run the script (source from pr0x.org Forum) below in iPhone to create the decrypted ipa.

To use this method you must have installed the app from App Store in jailbreak iPhone plus the following packages from Cydia
com.ericasadun.utilities gdb gawk zip ldid odcctools

Use the following commands in iPhone to install, if you don't like to use Cydia.
apt-get install com.ericasadun.utilities gdb gawk zip ldid odcctools

To find out the app names that your iPhone have installed, run this command in iPhone
find /var/mobile/Applications/ -iname *.app

and use this command to generated the decrypted ipa e.g.
./DCrypt.sh "Monkey Ball"


DCrypt.sh Select all

#!/bin/sh
#
# DeCrypt - v1.1 (2008-10-21)
# - v1.1 (2008-10-21)
# FloydianSlip
#
# Heavily based on xcrack
#
# Many thanks to:
# puy0, SaladFork, Flox, Flawless
#

echo "DeCrypt 1.1 (2008-10-21)"
echo "FloydianSlip"
echo

if [ ! -e /usr/bin/plutil ]; then
echo "Cannot find plutil (apt-get install com.ericasadun.utilities)"
exit 1
fi

if [ ! -e /usr/bin/gdb ]; then
echo "Cannot find gdb (apt-get install gdb)"
exit 1
fi

if [ ! -e /usr/bin/otool ]; then
echo "Cannot find otool (apt-get install odcctools)"
exit 1
fi

if [ ! -e /usr/bin/ldid ]; then
echo "Cannot find otool (apt-get install ldid)"
exit 1
fi


if [ ! -e /usr/bin/awk ]; then
echo "Cannot find awk (apt-get install gawk)"
exit 1
fi

if [ ! -e /usr/bin/zip ]; then
echo "Cannot find zip (apt-get install zip)"
exit 1
fi

if [ $# -ne 1 ]; then
echo "Usage: $(basename $0) <ApplicationName>"
echo
exit 1
fi

AppInput=$1

if [ -d "$AppInput" ]; then
tempLoc=$AppInput
else
echo "Locating $AppInput"
tempLoc=$(find /var/mobile/Applications -iname "$AppInput.app")
if [ -z "$tempLoc" ]; then
echo "Unable to locate $AppInput"
exit 1
fi
AppCount=$(find /var/mobile/Applications -iname "$AppInput.app" | wc -l)
if [ $AppCount -gt 1 ]; then
echo "Found two installation directories:"
find /var/mobile/Applications -iname "$AppInput.app"
exit 1
fi
fi

AppPath=$(dirname "$tempLoc")
AppName=$(basename "$tempLoc")
AppExec=$(plutil -v CFBundleExecutable "$tempLoc/Info.plist" 2>&1 | awk -F "] " '{ print $2 }')
AppVer=$(plutil -v CFBundleVersion "$tempLoc/Info.plist" 2>&1 | awk -F "] " '{ print $2 }')
AppDisplayName=$(plutil -v CFBundleDisplayName "$tempLoc/Info.plist" 2>&1 | awk -F "] " '{ print $2 }')

if [ ! -d "$AppPath" ]; then
echo "Unable to locate original installation directory"
exit 1
fi

if [ ! -d "$AppPath/$AppName" ]; then
echo "Unable to locate .app directory"
exit 1
fi

if [ ! -e "$AppPath/$AppName/$AppExec" ]; then
echo "Unable to locate executable"
exit 1
fi

echo "Found $AppName"

echo "Creating directories"
WorkDir="/tmp/DecryptApp-$(date +%Y%m%d-%H%M%S)"
NewAppDir="$HOME/Documents/Decrypted"

if [ -e "$WorkDir" ]; then
rm -rf "$WorkDir"
fi

mkdir -p "$WorkDir"

if [ ! -e "$NewAppDir" ]; then
mkdir -p "$NewAppDir"
fi

if [ ! -d "$WorkDir" -o ! -d "$NewAppDir" ]; then
echo "Unable to create Directories"
exit 1
fi

echo "Copying application files"

cp -a "$AppPath/$AppName/" "$WorkDir/"

if [ ! -e "$WorkDir/$AppName/$AppExec" ]; then
echo "Unable to copy application files"
rm -fr "$WorkDir"
exit 1
fi

echo "Analyzing application"

CryptID=$(otool -l "$WorkDir/$AppName/$AppExec" | grep cryptid | awk '{print $2}')
if [ $CryptID -ne "1" ]; then
echo "Application is not encrypted"
rm -fr "$WorkDir"
exit 1
fi

CryptSize=$(otool -l "$WorkDir/$AppName/$AppExec" | grep cryptsize | awk '{print $2}')
if [ ! $CryptSize ]; then
echo "Unable to find CryptSize"
rm -fr "$WorkDir"
exit 1
fi

CryptOff=$(otool -l "$WorkDir/$AppName/$AppExec" | grep cryptoff | awk '{print $2}')
if [ ! $CryptOff ]; then
echo "Unable to find CryptOff"
rm -fr "$WorkDir"
exit 1
fi

echo "Locating and patching CryptID"

# "/System/Library/Frameworks" in hex
PathAsHex="2f53797374656d2f4c6962726172792f4672616d65776f726b73"

# - Convert to hex on 1 long line, only take stuff before the path string,
# - Convert to 1 byte set per line, find 0x01 (line number is offset in the real file),
# - Strip newlines, reverse the order
oneLocations=($(od -A n -t x1 -v "$WorkDir/$AppName/$AppExec" | \
tr -d ' ','\n' | \
sed "s/$PathAsHex.*\$//" | \
sed "s/../&\n/g" | \
grep -n -s 01 | \
cut -d : -f 1 | \
sort -nr | \
tr "\n" " "))

for TryOffset in "${oneLocations[@]}"; do
cp -a "$WorkDir/$AppName/$AppExec" "$WorkDir/$AppName/$AppExec.trying"
foo=$(echo -ne "\x00" | dd bs=1 seek=$((TryOffset - 1)) conv=notrunc status=noxfer of="$WorkDir/$AppName/$AppExec.trying" 2>&1> /dev/null)
cid=$(otool -l "$WorkDir/$AppName/$AppExec.trying" | grep cryptid | awk '{print $2}')
if [ $cid -eq 0 ]; then
break
fi
rm "$WorkDir/$AppName/$AppExec.trying"
done

if [ ! -e "$WorkDir/$AppName/$AppExec.trying" ]; then
echo "Unable to find CryptID"
rm -fr "$WorkDir"
exit 1
fi

mv "$WorkDir/$AppName/$AppExec.trying" "$WorkDir/$AppName/$AppExec"

echo "Dumping unencrypted data from application"

echo -e "set sharedlibrary load-rules \".*\" \".*\" none\r\n\
set inferior-auto-start-dyld off\r\n\
set sharedlibrary preload-libraries off\r\n\
set sharedlibrary load-dyld-symbols off\r\n\
handle all nostop\r\n\
break *0x2000\r\n
commands 1\r\n\
dump memory $WorkDir/dump.bin 0x2000 $(($CryptSize + 0x2000))\r\n\
kill\r\n\
quit\r\n\
end\r\n\
start" > $WorkDir/batch.gdb

foo=$(gdb -q -e "$AppPath/$AppName/$AppExec" -x $WorkDir/batch.gdb -batch 2>&1> /dev/null)

rm $WorkDir/batch.gdb

echo "Verifiying data dump"

DumpSize=$(stat -c%s "$WorkDir/dump.bin")
if [ "$DumpSize" != "$CryptSize" ]; then
echo "Memory dump is not the right size or does not exist"
rm -fr "$WorkDir"
exit 1
fi

echo "Replacing encrypted data with data dump"
foo=$(dd seek=4096 bs=1 conv=notrunc if="$WorkDir/dump.bin" of="$WorkDir/$AppName/$AppExec" 2>&1> /dev/null)
rm "$WorkDir/dump.bin"

echo "Signing the application"
foo=$(ldid -s "$WorkDir/$AppName/$AppExec" 2>&1> /dev/null)
plutil -s 'SignerIdentity' -v 'Apple iPhone OS Application Signing' "$WorkDir/$AppName/Info.plist" 2>&1> /dev/null

if [ -e "$WorkDir/$AppName/SC_Info" ]; then
echo "Removing SC_Info"
rm -fr "$WorkDir/$AppName/SC_Info"
fi

if [ -e "$WorkDir/$AppName/_CodeSignature" ]; then
echo "Removing _CodeSignature"
rm -fr "$WorkDir/$AppName/_CodeSignature"
fi

if [ -h "$WorkDir/$AppName/CodeResources" ]; then
echo "Removing CodeResources"
rm -fr "$WorkDir/$AppName/CodeResources"
fi

if [ -e "$WorkDir/$AppName/ResourceRules.plist" ]; then
echo "Removing ResourceRules.plist"
rm -fr "$WorkDir/$AppName/ResourceRules.plist"
fi

echo "Building .ipa"

mkdir -p "$WorkDir/Payload"
if [ ! -e "$WorkDir/Payload" ]; then
echo "Failed to create Payload directory"
rm -fr "$WorkDir"
exit 1
fi
mv "$WorkDir/$AppName" "$WorkDir/Payload/"

echo "Copying iTunesArtwork"

if [ -e "$AppPath/iTunesArtwork" ]; then
cp -a "$AppPath/iTunesArtwork" "$WorkDir/"
else
echo "Unable to find iTunesArtwork"
fi

echo "Compressing the .ipa"
IPAName=$NewAppDir/$(echo $AppDisplayName | sed -e "s: :_:g")-v$AppVer.ipa
cd "$WorkDir"
zip -m -r "$IPAName" * 2>&1> /dev/null
cd - 2>&1> /dev/null
if [ ! -e "$IPAName" ]; then
echo "Failed to compress the .ipa"
rm -fr "$WorkDir"
exit 1
fi

echo "Removing temporary files"
rm -rf "$WorkDir"

echo "Done"
echo "Created decrypted .ipa at $IPAName"








If you only want to manually get the decrypted binary for reverse engineering. Suppose the Application Executable is called AppExec and installed in /var/mobile/Applications. This is the script and using the gdb to dump the decrypted binary

Let's use a free app AdHoc Helper (by Erica Sadun) as example


otool -l `find /var/mobile/Applications -iname AdHoc` | grep cryptsize

output-> cryptsize 8192

# get the cryptsize say 8192

gdb `find /var/mobile/Applications -iname AdHoc`

(gdb) b *0x2000
Breakpoint 1 at 0x2000
(gdb) r
(gdb) x/20i 0x2000
(gdb) dump binary memory /var/root/dump.bin 0x2000 (0x2000+8192)
(gdb) kill
Kill the program being debugged? (y or n) y
(gdb) quit

cd /var/root/
cp `find /var/mobile/Applications -iname AdHoc` .
dd seek=4096 bs=1 conv=notrunc if=dump.bin of=AdHoc

Monday, February 2, 2009

How to install iLife 09 on Mac OS X 10.5.5

iLife 09 requires Mac OS X 10.5.6

If you want to install it in 10.5.5, you need to change the SystemVersion.plist

sudo vi /System/Library/CoreServices/SystemVersion.plist

and change this

<key>ProductVersion</key>
<string>10.5.5</string>


to

<key>ProductVersion</key>
<string>10.5.6</string>


You cannot change the SystemVersion.plist back after installation, as iPhoto 09 and iMovie 09 will check this when launch.

If you want iPhoto 09 to skip the check*, you need to use a hex editor
open and change this file
/Applications/iPhoto.app/Contents/MacOS/iPhoto
then find (do multiple finds) and replace 10.5.6 to 10.5.5 and save it

*this trick does not work on iMovie 09

Thursday, January 29, 2009

How to install iWork 09 on Mac OS X 10.5.5

iWork 09 requires Mac OS X 10.5.6, but I want to install it in my 10.5.5 machine and don't want to upgrade Mac OS

Here are the steps

(1) download iWork 09 Trial from Apple


(2) Use Disk Utility to convert the iWork09Trial.dmg into a read-write image file say iWork09.dmg

(3) Mount the newly created read-write image iWork09.dmg

(4) Use Terminal to enter the command

shell script: Select all


cd /Volumes/iWork\ \'09\ Trial\ Install\ DVD/Packages/iWork09Trial.mpkg/Contents/

vi iWorkTrial.dist



and change this

if (-1 == system.compareVersions(system.version.ProductVersion, '10.5.6'))


to

if (-1 == system.compareVersions(system.version.ProductVersion, '10.5.5'))


(5) Start the Installation from the mounted image

(6) After Installation completed

(7) Use Terminal to enter the command
shell script: Select all


sudo defaults write /Library/Preferences/com.apple.iWork09.Installer InstallMode -string 'Retail'



(8) Then start any iWork 09 application, it will ask you to register, click register later

(9) It will ask you three times after you close and then open any iWork 09 app, then the option of "never register" will appear. Proceed to click never register.

(10) In case you did not do step (7), it will ask you for the serial number, enter this
Y93U-HMME-3YRG-MOFO-MOFO-5S2

Enjoy.
.
.
.
.
.

Friday, January 16, 2009

redsn0w is coming

shell script: Select all


wget http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw

unzip -o iPod2,1_2.2_5G77a_Restore.ipsw 018-4056-128.dmg

vfdecrypt -k 148025cde5c51d51d7733e74c6857dfca70d7240287d6eb039a1ed835413120b0af1e296 -i 018-4056-128.dmg -o ipt2g_mainfs.dmg

Wednesday, January 14, 2009

Bushism



Don't misunderestimated me

Tuesday, December 30, 2008

PCI MZK-NAS01SG / MZK-NAS02SG modding

This NAS comes with Linux OS and BT download / iTunes / UPnP DLNA AV Server and can be modified using the Dlink - DNS323 funplug packages Objective of modding (a) Add ssh server (b) Add lighttpd (port 80), php & mysql (c) change the web admin http page to port 81 Steps (1) Upgrade NAS firmware 1.1.2 (2) Setup the BT Downloader and FTP / Samba server via the web admin of the NAS (3) Use telnet to gain access telnet 192.168.1.100 1192 ID: root PASSWORD: password (4) install funplug cd /DataFolder mkdir ffp cd ffp wget http://www.inreto.de/dns323/fun-plug/0.5/fun_plug.tgz tar zxvf funplug.tgz ln -sf /DataFolder/ffp / export PATH=/ffp/bin:/ffp/sbin/:$PATH (5) download funplug packages cd /DataFolder/ffp rsync -av inreto.de::dns323/fun-plug/0.5/packages . (6) start ssh server chmod 111 /ffp/var/lib/sshd sh /ffp/start/sshd.sh start (7) Install lighttpd, php and mysql cd /DataFolder/ffp mkdir -p packages wget http://81.216.140.39/dns-323/mysql_and_php/mysql-5.1.28-rc-1.tgz wget http://81.216.140.39/dns-323/mysql_and_php/php-5.2.6-mysql51-1.tgz funpkg -i mysql-5.1.28-rc-1.tgz funpkg -i php-5.2.6-mysql51-1.tgz chmod u+x /ffp/start/mysqld.sh /ffp/start/mysqld.sh restart /ffp/bin/mysqladmin -u root password 'new-password' ln -s /ffp/var/mysql.sock /tmp/mysql.sock cp /DataFolder/ffp/etc/examples/lighttpd.conf-with-php /DataFolder/ffp/etc/lighttpd.conf cp /DataFolder/ffp/etc/examples/my.cnf /DataFolder/ffp/etc/my.cnf vi /DataFolder/ffp/etc/lighttpd.conf mkdir -p /DataFolder/ffp/etc/www/logs mkdir -p /DataFolder/www/tmp echo '<?php phpinfo(); ?>' > /DataFolder/www/index.php when editing lighttpd.conf change these server.document-root = "/DataFolder/www/" server.upload-dirs = ( "/DataFolder/www/tmp" ) server.errorlog = "/DataFolder/ffp/etc/www/logs/error.log" accesslog.filename = "/DataFolder/ffp/etc/www/logs/access.log" server.port = 80 (8) Modify btdog (so that the modding will be effective even after NAS reboot) mv /DataFolder/.bittorrent/bin/btdog /DataFolder/.bittorrent/bin/btdog_bak vi /etc/protocols and add this line to /etc/profile export PATH=/ffp/bin:/ffp/sbin/:$PATH cp /etc/profile /DataFolder/.bittorrent/bin/profile.bak vi /DataFolder/.bittorrent/bin/btdog the content of btdog is
btdog: Select all
#ledset 4=USB1 6=USB2 7=Power 17=HDD1 18=HDD2, 0=on 1=off #/bin/ledset 4 1 #/bin/ledset 6 1 #/bin/ledset 7 1 #/bin/ledset 17 1 #/bin/ledset 18 1 ln -s /DataFolder/ffp/ /ffp export PATH=/ffp/bin:/ffp/sbin/:/usr/bin:/bin:/usr/sbin:/sbin killall webs nashttpd cp /DataFolder/.bittorrent/bin/profile.bak /etc/profile /DataFolder/ffp/sbin/lighttpd -f /DataFolder/ffp/etc/lighttpd.conf& chmod 600 /DataFolder/ffp/etc/ssh/ssh_host_rsa_key /DataFolder/ffp/etc/ssh/ssh_host_dsa_key /DataFolder/ffp/etc/ssh/ssh_host_key chmod 600 -R /DataFolder/ffp/var/lib/sshd chmod 111 /DataFolder/ffp/var/lib/sshd sh /DataFolder/ffp/start/sshd.sh start cp /DataFolder/ffp/etc/my.cnf /etc/my.cnf chmod 0644 /etc/my.cnf chmod +x /DataFolder/ffp/start/mysqld.sh sh /DataFolder/ffp/start/mysqld.sh start& webs& ln -sf /DataFolder/ffp/var/mysql.sock /tmp/mysql.sock /DataFolder/.bittorrent/bin/btdog_bak /DataFolder/.bittorrent/bin/bt -daemon-loop --default-settings-file /DataFolder/.bittorrent/bin/btsettings.txt
change btdog to be executable chmod +x /DataFolder/.bittorrent/bin/btdog (9) reboot NAS and test lighttpd, php, mysql, ssh and other servers and enjoy installing some more packages from fun-plug see here