This is the method to solve the problem
(1) Create a newuser and see if the Input Method can be selected in International Preference
(2) If the newuser can access the Input Method, then it is preference setting problem
(3) login the newuser and copy the following files from folder ~/Library/Preferences to in a common folder
com.apple.systempreferences.plist
TCIMHaninUserDictionary
com.apple.inputmethod.TCIM.plist
(4) login the olduser and copy the above files back to ~/Library/Preferences
(5) Reboot Mac
.
.
.
Saturday, March 28, 2009
Tuesday, February 10, 2009
How to decrypt iPhone IPA file
Decrypted IPA
Please take note that you don't need this method to decrypt the IPA file, if you already have the decrypted one downloaded from the net. This method applies to the app that you have directly purchased from App Store and want to decrypt it in order to be useful for others.
One of the decrypt methods is to use a jailbreak iPhone and run the script (source from pr0x.org Forum) below in iPhone to create the decrypted ipa.
To use this method you must have installed the app from App Store in jailbreak iPhone plus the following packages from Cydia
com.ericasadun.utilities gdb gawk zip ldid odcctools
Use the following commands in iPhone to install, if you don't like to use Cydia.
To find out the app names that your iPhone have installed, run this command in iPhone
and use this command to generated the decrypted ipa e.g.
If you only want to manually get the decrypted binary for reverse engineering. Suppose the Application Executable is called AppExec and installed in /var/mobile/Applications. This is the script and using the gdb to dump the decrypted binary
Let's use a free app AdHoc Helper (by Erica Sadun) as example
Please take note that you don't need this method to decrypt the IPA file, if you already have the decrypted one downloaded from the net. This method applies to the app that you have directly purchased from App Store and want to decrypt it in order to be useful for others.
One of the decrypt methods is to use a jailbreak iPhone and run the script (source from pr0x.org Forum) below in iPhone to create the decrypted ipa.
To use this method you must have installed the app from App Store in jailbreak iPhone plus the following packages from Cydia
com.ericasadun.utilities gdb gawk zip ldid odcctools
Use the following commands in iPhone to install, if you don't like to use Cydia.
apt-get install com.ericasadun.utilities gdb gawk zip ldid odcctoolsTo find out the app names that your iPhone have installed, run this command in iPhone
find /var/mobile/Applications/ -iname *.appand use this command to generated the decrypted ipa e.g.
./DCrypt.sh "Monkey Ball"- DCrypt.sh Select all
#!/bin/sh
#
# DeCrypt - v1.1 (2008-10-21)
# - v1.1 (2008-10-21)
# FloydianSlip
#
# Heavily based on xcrack
#
# Many thanks to:
# puy0, SaladFork, Flox, Flawless
#
echo "DeCrypt 1.1 (2008-10-21)"
echo "FloydianSlip"
echo
if [ ! -e /usr/bin/plutil ]; then
echo "Cannot find plutil (apt-get install com.ericasadun.utilities)"
exit 1
fi
if [ ! -e /usr/bin/gdb ]; then
echo "Cannot find gdb (apt-get install gdb)"
exit 1
fi
if [ ! -e /usr/bin/otool ]; then
echo "Cannot find otool (apt-get install odcctools)"
exit 1
fi
if [ ! -e /usr/bin/ldid ]; then
echo "Cannot find otool (apt-get install ldid)"
exit 1
fi
if [ ! -e /usr/bin/awk ]; then
echo "Cannot find awk (apt-get install gawk)"
exit 1
fi
if [ ! -e /usr/bin/zip ]; then
echo "Cannot find zip (apt-get install zip)"
exit 1
fi
if [ $# -ne 1 ]; then
echo "Usage: $(basename $0) <ApplicationName>"
echo
exit 1
fi
AppInput=$1
if [ -d "$AppInput" ]; then
tempLoc=$AppInput
else
echo "Locating $AppInput"
tempLoc=$(find /var/mobile/Applications -iname "$AppInput.app")
if [ -z "$tempLoc" ]; then
echo "Unable to locate $AppInput"
exit 1
fi
AppCount=$(find /var/mobile/Applications -iname "$AppInput.app" | wc -l)
if [ $AppCount -gt 1 ]; then
echo "Found two installation directories:"
find /var/mobile/Applications -iname "$AppInput.app"
exit 1
fi
fi
AppPath=$(dirname "$tempLoc")
AppName=$(basename "$tempLoc")
AppExec=$(plutil -v CFBundleExecutable "$tempLoc/Info.plist" 2>&1 | awk -F "] " '{ print $2 }')
AppVer=$(plutil -v CFBundleVersion "$tempLoc/Info.plist" 2>&1 | awk -F "] " '{ print $2 }')
AppDisplayName=$(plutil -v CFBundleDisplayName "$tempLoc/Info.plist" 2>&1 | awk -F "] " '{ print $2 }')
if [ ! -d "$AppPath" ]; then
echo "Unable to locate original installation directory"
exit 1
fi
if [ ! -d "$AppPath/$AppName" ]; then
echo "Unable to locate .app directory"
exit 1
fi
if [ ! -e "$AppPath/$AppName/$AppExec" ]; then
echo "Unable to locate executable"
exit 1
fi
echo "Found $AppName"
echo "Creating directories"
WorkDir="/tmp/DecryptApp-$(date +%Y%m%d-%H%M%S)"
NewAppDir="$HOME/Documents/Decrypted"
if [ -e "$WorkDir" ]; then
rm -rf "$WorkDir"
fi
mkdir -p "$WorkDir"
if [ ! -e "$NewAppDir" ]; then
mkdir -p "$NewAppDir"
fi
if [ ! -d "$WorkDir" -o ! -d "$NewAppDir" ]; then
echo "Unable to create Directories"
exit 1
fi
echo "Copying application files"
cp -a "$AppPath/$AppName/" "$WorkDir/"
if [ ! -e "$WorkDir/$AppName/$AppExec" ]; then
echo "Unable to copy application files"
rm -fr "$WorkDir"
exit 1
fi
echo "Analyzing application"
CryptID=$(otool -l "$WorkDir/$AppName/$AppExec" | grep cryptid | awk '{print $2}')
if [ $CryptID -ne "1" ]; then
echo "Application is not encrypted"
rm -fr "$WorkDir"
exit 1
fi
CryptSize=$(otool -l "$WorkDir/$AppName/$AppExec" | grep cryptsize | awk '{print $2}')
if [ ! $CryptSize ]; then
echo "Unable to find CryptSize"
rm -fr "$WorkDir"
exit 1
fi
CryptOff=$(otool -l "$WorkDir/$AppName/$AppExec" | grep cryptoff | awk '{print $2}')
if [ ! $CryptOff ]; then
echo "Unable to find CryptOff"
rm -fr "$WorkDir"
exit 1
fi
echo "Locating and patching CryptID"
# "/System/Library/Frameworks" in hex
PathAsHex="2f53797374656d2f4c6962726172792f4672616d65776f726b73"
# - Convert to hex on 1 long line, only take stuff before the path string,
# - Convert to 1 byte set per line, find 0x01 (line number is offset in the real file),
# - Strip newlines, reverse the order
oneLocations=($(od -A n -t x1 -v "$WorkDir/$AppName/$AppExec" | \
tr -d ' ','\n' | \
sed "s/$PathAsHex.*\$//" | \
sed "s/../&\n/g" | \
grep -n -s 01 | \
cut -d : -f 1 | \
sort -nr | \
tr "\n" " "))
for TryOffset in "${oneLocations[@]}"; do
cp -a "$WorkDir/$AppName/$AppExec" "$WorkDir/$AppName/$AppExec.trying"
foo=$(echo -ne "\x00" | dd bs=1 seek=$((TryOffset - 1)) conv=notrunc status=noxfer of="$WorkDir/$AppName/$AppExec.trying" 2>&1> /dev/null)
cid=$(otool -l "$WorkDir/$AppName/$AppExec.trying" | grep cryptid | awk '{print $2}')
if [ $cid -eq 0 ]; then
break
fi
rm "$WorkDir/$AppName/$AppExec.trying"
done
if [ ! -e "$WorkDir/$AppName/$AppExec.trying" ]; then
echo "Unable to find CryptID"
rm -fr "$WorkDir"
exit 1
fi
mv "$WorkDir/$AppName/$AppExec.trying" "$WorkDir/$AppName/$AppExec"
echo "Dumping unencrypted data from application"
echo -e "set sharedlibrary load-rules \".*\" \".*\" none\r\n\
set inferior-auto-start-dyld off\r\n\
set sharedlibrary preload-libraries off\r\n\
set sharedlibrary load-dyld-symbols off\r\n\
handle all nostop\r\n\
break *0x2000\r\n
commands 1\r\n\
dump memory $WorkDir/dump.bin 0x2000 $(($CryptSize + 0x2000))\r\n\
kill\r\n\
quit\r\n\
end\r\n\
start" > $WorkDir/batch.gdb
foo=$(gdb -q -e "$AppPath/$AppName/$AppExec" -x $WorkDir/batch.gdb -batch 2>&1> /dev/null)
rm $WorkDir/batch.gdb
echo "Verifiying data dump"
DumpSize=$(stat -c%s "$WorkDir/dump.bin")
if [ "$DumpSize" != "$CryptSize" ]; then
echo "Memory dump is not the right size or does not exist"
rm -fr "$WorkDir"
exit 1
fi
echo "Replacing encrypted data with data dump"
foo=$(dd seek=4096 bs=1 conv=notrunc if="$WorkDir/dump.bin" of="$WorkDir/$AppName/$AppExec" 2>&1> /dev/null)
rm "$WorkDir/dump.bin"
echo "Signing the application"
foo=$(ldid -s "$WorkDir/$AppName/$AppExec" 2>&1> /dev/null)
plutil -s 'SignerIdentity' -v 'Apple iPhone OS Application Signing' "$WorkDir/$AppName/Info.plist" 2>&1> /dev/null
if [ -e "$WorkDir/$AppName/SC_Info" ]; then
echo "Removing SC_Info"
rm -fr "$WorkDir/$AppName/SC_Info"
fi
if [ -e "$WorkDir/$AppName/_CodeSignature" ]; then
echo "Removing _CodeSignature"
rm -fr "$WorkDir/$AppName/_CodeSignature"
fi
if [ -h "$WorkDir/$AppName/CodeResources" ]; then
echo "Removing CodeResources"
rm -fr "$WorkDir/$AppName/CodeResources"
fi
if [ -e "$WorkDir/$AppName/ResourceRules.plist" ]; then
echo "Removing ResourceRules.plist"
rm -fr "$WorkDir/$AppName/ResourceRules.plist"
fi
echo "Building .ipa"
mkdir -p "$WorkDir/Payload"
if [ ! -e "$WorkDir/Payload" ]; then
echo "Failed to create Payload directory"
rm -fr "$WorkDir"
exit 1
fi
mv "$WorkDir/$AppName" "$WorkDir/Payload/"
echo "Copying iTunesArtwork"
if [ -e "$AppPath/iTunesArtwork" ]; then
cp -a "$AppPath/iTunesArtwork" "$WorkDir/"
else
echo "Unable to find iTunesArtwork"
fi
echo "Compressing the .ipa"
IPAName=$NewAppDir/$(echo $AppDisplayName | sed -e "s: :_:g")-v$AppVer.ipa
cd "$WorkDir"
zip -m -r "$IPAName" * 2>&1> /dev/null
cd - 2>&1> /dev/null
if [ ! -e "$IPAName" ]; then
echo "Failed to compress the .ipa"
rm -fr "$WorkDir"
exit 1
fi
echo "Removing temporary files"
rm -rf "$WorkDir"
echo "Done"
echo "Created decrypted .ipa at $IPAName"
If you only want to manually get the decrypted binary for reverse engineering. Suppose the Application Executable is called AppExec and installed in /var/mobile/Applications. This is the script and using the gdb to dump the decrypted binary
Let's use a free app AdHoc Helper (by Erica Sadun) as example
otool -l `find /var/mobile/Applications -iname AdHoc` | grep cryptsize
output-> cryptsize 8192
# get the cryptsize say 8192
gdb `find /var/mobile/Applications -iname AdHoc`
(gdb) b *0x2000
Breakpoint 1 at 0x2000
(gdb) r
(gdb) x/20i 0x2000
(gdb) dump binary memory /var/root/dump.bin 0x2000 (0x2000+8192)
(gdb) kill
Kill the program being debugged? (y or n) y
(gdb) quit
cd /var/root/
cp `find /var/mobile/Applications -iname AdHoc` .
dd seek=4096 bs=1 conv=notrunc if=dump.bin of=AdHoc
Monday, February 2, 2009
How to install iLife 09 on Mac OS X 10.5.5
iLife 09 requires Mac OS X 10.5.6
If you want to install it in 10.5.5, you need to change the SystemVersion.plist
and change this
to
You cannot change the SystemVersion.plist back after installation, as iPhoto 09 and iMovie 09 will check this when launch.
If you want iPhoto 09 to skip the check*, you need to use a hex editor
open and change this file
/Applications/iPhoto.app/Contents/MacOS/iPhoto
then find (do multiple finds) and replace 10.5.6 to 10.5.5 and save it
*this trick does not work on iMovie 09
If you want to install it in 10.5.5, you need to change the SystemVersion.plist
sudo vi /System/Library/CoreServices/SystemVersion.plistand change this
<key>ProductVersion</key>
<string>10.5.5</string>
to
<key>ProductVersion</key>
<string>10.5.6</string>
You cannot change the SystemVersion.plist back after installation, as iPhoto 09 and iMovie 09 will check this when launch.
If you want iPhoto 09 to skip the check*, you need to use a hex editor
open and change this file
/Applications/iPhoto.app/Contents/MacOS/iPhoto
then find (do multiple finds) and replace 10.5.6 to 10.5.5 and save it
*this trick does not work on iMovie 09
Thursday, January 29, 2009
How to install iWork 09 on Mac OS X 10.5.5
iWork 09 requires Mac OS X 10.5.6, but I want to install it in my 10.5.5 machine and don't want to upgrade Mac OS
Here are the steps
(1) download iWork 09 Trial from Apple

(2) Use Disk Utility to convert the iWork09Trial.dmg into a read-write image file say iWork09.dmg
(3) Mount the newly created read-write image iWork09.dmg
(4) Use Terminal to enter the command
and change this
to
(5) Start the Installation from the mounted image
(6) After Installation completed
(7) Use Terminal to enter the command
(8) Then start any iWork 09 application, it will ask you to register, click register later
(9) It will ask you three times after you close and then open any iWork 09 app, then the option of "never register" will appear. Proceed to click never register.
(10) In case you did not do step (7), it will ask you for the serial number, enter this
Enjoy.
.
.
.
.
.
Here are the steps
(1) download iWork 09 Trial from Apple
(2) Use Disk Utility to convert the iWork09Trial.dmg into a read-write image file say iWork09.dmg
(3) Mount the newly created read-write image iWork09.dmg
(4) Use Terminal to enter the command
- shell script: Select all
cd /Volumes/iWork\ \'09\ Trial\ Install\ DVD/Packages/iWork09Trial.mpkg/Contents/
vi iWorkTrial.dist
and change this
if (-1 == system.compareVersions(system.version.ProductVersion, '10.5.6'))
to
if (-1 == system.compareVersions(system.version.ProductVersion, '10.5.5'))
(5) Start the Installation from the mounted image
(6) After Installation completed
(7) Use Terminal to enter the command
- shell script: Select all
sudo defaults write /Library/Preferences/com.apple.iWork09.Installer InstallMode -string 'Retail'
(8) Then start any iWork 09 application, it will ask you to register, click register later
(9) It will ask you three times after you close and then open any iWork 09 app, then the option of "never register" will appear. Proceed to click never register.
(10) In case you did not do step (7), it will ask you for the serial number, enter this
Y93U-HMME-3YRG-MOFO-MOFO-5S2Enjoy.
.
.
.
.
.
Friday, January 16, 2009
redsn0w is coming
- shell script: Select all
wget http://appldnld.apple.com.edgesuite.net/content.info.apple.com/iPod/SBML/osx/061-5358.20081120.Gtghy/iPod2,1_2.2_5G77a_Restore.ipsw
unzip -o iPod2,1_2.2_5G77a_Restore.ipsw 018-4056-128.dmg
vfdecrypt -k 148025cde5c51d51d7733e74c6857dfca70d7240287d6eb039a1ed835413120b0af1e296 -i 018-4056-128.dmg -o ipt2g_mainfs.dmg
Wednesday, January 14, 2009
Tuesday, December 30, 2008
PCI MZK-NAS01SG / MZK-NAS02SG modding
This NAS comes with Linux OS and BT download / iTunes / UPnP DLNA AV Server and can be modified using the Dlink - DNS323 funplug packages
Objective of modding
(a) Add ssh server
(b) Add lighttpd (port 80), php & mysql
(c) change the web admin http page to port 81
Steps
(1) Upgrade NAS firmware 1.1.2
(2) Setup the BT Downloader and FTP / Samba server via the web admin of the NAS
(3) Use telnet to gain access
telnet 192.168.1.100 1192
ID: root
PASSWORD: password
(4) install funplug
cd /DataFolder
mkdir ffp
cd ffp
wget http://www.inreto.de/dns323/fun-plug/0.5/fun_plug.tgz
tar zxvf funplug.tgz
ln -sf /DataFolder/ffp /
export PATH=/ffp/bin:/ffp/sbin/:$PATH
(5) download funplug packages
cd /DataFolder/ffp
rsync -av inreto.de::dns323/fun-plug/0.5/packages .
(6) start ssh server
chmod 111 /ffp/var/lib/sshd
sh /ffp/start/sshd.sh start
(7) Install lighttpd, php and mysql
cd /DataFolder/ffp
mkdir -p packages
wget http://81.216.140.39/dns-323/mysql_and_php/mysql-5.1.28-rc-1.tgz
wget http://81.216.140.39/dns-323/mysql_and_php/php-5.2.6-mysql51-1.tgz
funpkg -i mysql-5.1.28-rc-1.tgz
funpkg -i php-5.2.6-mysql51-1.tgz
chmod u+x /ffp/start/mysqld.sh
/ffp/start/mysqld.sh restart
/ffp/bin/mysqladmin -u root password 'new-password'
ln -s /ffp/var/mysql.sock /tmp/mysql.sock
cp /DataFolder/ffp/etc/examples/lighttpd.conf-with-php /DataFolder/ffp/etc/lighttpd.conf
cp /DataFolder/ffp/etc/examples/my.cnf /DataFolder/ffp/etc/my.cnf
vi /DataFolder/ffp/etc/lighttpd.conf
mkdir -p /DataFolder/ffp/etc/www/logs
mkdir -p /DataFolder/www/tmp
echo '<?php phpinfo(); ?>' > /DataFolder/www/index.php
when editing lighttpd.conf change these
server.document-root = "/DataFolder/www/"
server.upload-dirs = ( "/DataFolder/www/tmp" )
server.errorlog = "/DataFolder/ffp/etc/www/logs/error.log"
accesslog.filename = "/DataFolder/ffp/etc/www/logs/access.log"
server.port = 80
(8) Modify btdog (so that the modding will be effective even after NAS reboot)
mv /DataFolder/.bittorrent/bin/btdog /DataFolder/.bittorrent/bin/btdog_bak
vi /etc/protocols
and add this line to /etc/profile
export PATH=/ffp/bin:/ffp/sbin/:$PATH
cp /etc/profile /DataFolder/.bittorrent/bin/profile.bak
vi /DataFolder/.bittorrent/bin/btdog
the content of btdog is
- btdog: Select all
-
#ledset 4=USB1 6=USB2 7=Power 17=HDD1 18=HDD2, 0=on 1=off #/bin/ledset 4 1 #/bin/ledset 6 1 #/bin/ledset 7 1 #/bin/ledset 17 1 #/bin/ledset 18 1 ln -s /DataFolder/ffp/ /ffp export PATH=/ffp/bin:/ffp/sbin/:/usr/bin:/bin:/usr/sbin:/sbin killall webs nashttpd cp /DataFolder/.bittorrent/bin/profile.bak /etc/profile /DataFolder/ffp/sbin/lighttpd -f /DataFolder/ffp/etc/lighttpd.conf& chmod 600 /DataFolder/ffp/etc/ssh/ssh_host_rsa_key /DataFolder/ffp/etc/ssh/ssh_host_dsa_key /DataFolder/ffp/etc/ssh/ssh_host_key chmod 600 -R /DataFolder/ffp/var/lib/sshd chmod 111 /DataFolder/ffp/var/lib/sshd sh /DataFolder/ffp/start/sshd.sh start cp /DataFolder/ffp/etc/my.cnf /etc/my.cnf chmod 0644 /etc/my.cnf chmod +x /DataFolder/ffp/start/mysqld.sh sh /DataFolder/ffp/start/mysqld.sh start& webs& ln -sf /DataFolder/ffp/var/mysql.sock /tmp/mysql.sock /DataFolder/.bittorrent/bin/btdog_bak /DataFolder/.bittorrent/bin/bt -daemon-loop --default-settings-file /DataFolder/.bittorrent/bin/btsettings.txt
chmod +x /DataFolder/.bittorrent/bin/btdog
(9) reboot NAS and test lighttpd, php, mysql, ssh and other servers
and enjoy installing some more packages from fun-plug see here
Subscribe to:
Posts (Atom)
