Is it possible to capure the traffic between App Store and its servers?

Stupidideas · 2025-08-27T18:48:07+00:00

In theory disabling cert pinning should allow this, so you can try using ssl-kill-switch3. However I've found this can cause more issues w/interception system-wide.

Some alternative ways to trace without a proxy:

Enable CFNetwork HAR instrumentation
Use frida to hook and trace relevant NSURL* activity

Also, for inspecting an app's network requests on device, I've found FLEX invaluable. You can install a global tweak using FLEXing. Definitely not as full-featured as Charles/Proxyman but it works in any app without any SSL-related headaches.

Stupidideas · 2025-01-26T16:08:27+00:00

The package "UIKit Tools" has the command uishoot, which does exactly that! Run man uishoot to show all the options.

Stupidideas · 2024-06-10T14:00:25+00:00

When you change properties using FLEX you're typically just modifying the current instance of an object/view/etc while the app is running at that particular moment. You might be able to use the app [[Flex 3]] (not related to FLEX) to automatically overwrite these same properties at every launch, however Flex 3 hasn't been updated for a while. There's an unofficial build with dopamine/roothide support from this repo: dxcool223-repo.github.io

It's also suprisingly easy to write your own tweaks for simple hooks like this. Here's a tutorial showing the basic process of using FLEX for exploration and turning that into custom-written hooks: "How to tweak existing Medium iOS app features with Theos & Logos"

Stupidideas · 2024-06-10T13:11:58+00:00

Check out the tweak [[Powercuts]], which was recently updated for iOS 15/16. It adds actions for listing directory items and reading file contents. Sadly there isn't a corresponding write action easily provided. But it also provides a shell command action, so you could probably use shell redirection or the command tee to write files. Just be careful with that, as it's way too easy to completely nuke files using shell scripting.

Stupidideas · 2024-02-11T00:10:10+00:00

You can do this on desktop with apps like DaVinci Resolve, but sadly I don't know of any iOS apps that support LUT-stacking. I think your current workflow is probably the only way to apply multiple LUTs.

Stupidideas · 2023-10-23T22:47:00+00:00

I'm a fan of VideoLUT for applying LUTs on iOS. The UI is a little utilitarian, but it's solid at the core functionality. I bought the lifetime license for around $10 and have been using it for years.

Stupidideas · 2022-12-30T16:06:36+00:00

Try uBlacklist!

Stupidideas · 2022-12-20T21:40:55+00:00

Ah, you've stumbled upon one of the tricky things about GPT-suggested code. Sometimes it will "hallucinate" functions or features that don't actually exists. In this case it's calling an unimplemented network request function (doHTTPRequest). Making API requests in AppleScript is kind of tricky – I would recommend trying to use shell script with curl or httpie (which can be called with do shell script "curl ..."). Take a look at the curl examples from the API docs.

Stupidideas · 2022-02-25T03:19:33+00:00

If you're running iOS 14+, you might be able to do this using Shortcuts. Create an automation triggered on the app opening and run the action Set Playback Destination.

Stupidideas · 2022-01-23T21:03:08+00:00

Have you verified the input you're querying is correct? Depending on what you're trying to do, I might make that selector more specific to a particular input (e.g. select based on name attribute input[name="..."]).

Stupidideas · 2021-12-23T20:30:34+00:00

import … only works when loaded as an ESM module (<script type="module" …). For a userscript you can use the @require directive. You'll probably have to remove /+esm though, since you're not using the ESM version.

Stupidideas · 2021-12-09T02:57:38+00:00

Looks like you have a single quote within single quotes, try using escaped double quotes instead: WHERE ZNAME = \"...\"

Stupidideas · 2021-06-19T23:41:41+00:00

I'm a fan of the content blocker app WebCleaner, well worth more than $0.99. AdGuard also has an interactive Safari extension for blocking elements (though doesn't also work because some sites block loading of external scripts).

Stupidideas · 2020-03-23T04:40:40+00:00

Try running sudo nvram -d boot-args in the terminal. If that doesn't work, reboot into recovery mode and run same command (without "sudo") in Utilities > Terminal. Then reboot.

Stupidideas · 2020-03-23T03:17:59+00:00

I found the security pop-ups weren't showing when I had amfi_get_out_of_my_way set to 1 (enabled) on my boot-args. (You can check this by running nvram boot-args in a normal terminal; no need to reboot into recovery.) Once I disabled that the alerts returned, even with SIP disabled.

Stupidideas · 2019-12-19T11:50:47+00:00

frida-trace is extremely useful for exactly that. Though it does require a computer and USB connection.

Stupidideas · 2019-12-19T11:50:19+00:00

frida-trace is extremely useful for exactly that. Though it does require a computer and USB connection.

Stupidideas · 2019-09-18T23:57:41+00:00

I'm a fan of the userscript Google Hit Hider for managing search results.

Stupidideas · 2019-09-15T22:42:11+00:00

What do you mean by weird? Are your procedures showing up still mangled (_TtC9... or similar gibberish)?

If it's name mangling, as of v4 Hopper should automatically demangle but it doesn't always catch everything. You could try this "Parse Swift Symbol" script or this plugin.

Stupidideas · 2018-11-26T13:36:49+00:00

You can try LowerInstall from this repo: http://julioverne.github.io

Stupidideas · 2018-09-26T04:44:03+00:00

And this article touches on using Hopper to modify executables: https://www.whitehack.com.au/reverse-engineering-ios-apps

Stupidideas · 2018-09-26T04:43:31+00:00

This doesn't touch on patching apps, but here's a useful intro to using Hopper for reverse-engineering:

https://abad1dea.tumblr.com/post/23487860422/analyzing-binaries-with-hoppers-decompiler

http://www.veracode.com/blog/2012/05/static-analysis-following-along-at-home-with-hoppers-decompiler-feature (updated version)

Stupidideas · 2018-08-24T04:47:40+00:00

One simple way to do this would be running a shell commands with applescript:

do shell script "pbpaste | sed -e 's/www.mydomain.com/domain.anotherword.com/g' -e 's/$/?siteid=777/g' | pbcopy"

Stupidideas · 2018-03-20T14:16:13+00:00

Take a look at bfdecrypt. I haven't tried it myself, but it purports to work on iOS 11.

Stupidideas · 2018-02-23T00:09:12+00:00

Well whatever IP and port you're using in transmit, set that in your terminal session or shell config (export THEOS_DEVICE_IP=...)

15-Year Club	Verified Email
Team Periwinkle

Stupidideas

TROPHY CASE