Lizynz

QEMU on Apple Silicon with Vulkan support

The following is taken from https://gist.github.com/akihikodaki/87df4149e7ca87f18dc56807ec5a1bc5 with modifications to introduce Vulkan support. Since we need custom patches to QEMU, virglrenderer, MoltenVK, and libepoxy, the provided script will pull the right refs and build everything with the right params. Feel free to inspect the script to find the source for all the modifications. We are actively working to upstream everything so please do not build anything long-term with these patches.

Testing

Prerequisites

Xcode (relatively recent version)
Vulkan SDK for macOS (Make sure to select "System Global Installation" during Select Components.)

the sneakyf1shy apple intelligence tutorial v2.0

Warning

This is patched as of iOS/iPadOS 18.1 DevBeta 5. If you want to follow this, stay on Beta 4.

This actually downloads the models, and is NOT just new SiriUI. Hence, this process is complex and probably not worth it.

⚠️ Prepare to be disappointed and annoyed, and have your time wasted! ⚠️

What does not work: Writing Tools, Memories, Reduce Interruptions, Image Eraser and other tools that are within official Apple Intelligence on supported devices.

This article aims to describe how to hook Swift functions.

Thanks to help from @NightwindDev for discussion and testing.

Overall, the idea is simple: Write our own Swift code that will have the same calling convention as the target code, then get a pointer to our own code and the target code, and call MSHookFunction with these values.

Code

Introduction

Apple restricted the access to Xcode LLM (Predictive code completion) feature on China models of Mac. This guide provides a way to bypass that restriction. It's verified on macOS 15.0 Beta (24A5264n), but there is no guarentee that it will always work on later macOS versions.

Prerequisites

Xcode is installed and run at least once.
SIP debugging restrictions are disabled (via csrutil enable --without debug command in recovery mode).

Disclaimer

HOLY SHIT is this original guide outdated and broken as fuck

Credits to OrangeRa1n for the original guide

YOLOOOOOOOOO?

This is a guide on how to activate ur idevice on ios 15 (maybe ios 14 idk) when its futurerestored on 16 sep.

DISCLAIMER: I am very aware people might use this to bypass icloud, but I am NOT encouraging you to bypass icloud.

ALSO: THIS IS RECOMMENDED FOR ADVANCED USERS ONLY, i am not responsable for ur device being broken (tho idk how it becomes broken via this)

whatisthisthisthisthisthisthis?

This is a guide on how to activate ur idevice on ios 15 (maybe ios 14 idk) when its futurerestored on 16 sep.

DISCLAIMER: I am very aware people might use this to bypass icloud, but I am NOT encouraging you to bypass icloud.

ALSO: THIS IS RECOMMENDED FOR ADVANCED USERS ONLY, i am not responsable for ur device being broken (tho idk how it becomes broken via this)

also, i've only tested this on macOS, might work on linux tho if u replace darwin with linux and shit.

How to Defang macOS System Protections

If you want to change things on the root drive of a Mac you will need to take some steps to disable the built in security of the system. Most of these steps are the same regardless if you are on Intel or Apple Silicon. If there is a difference it is noted.

Note that all of these things put a Mac into an unsupported and less secure state.

Make sure you either perform these steps in a VM or that you reset the protections after you are done poking around

Protections and Terms

(This list is not exahustive on the details of each. Check the links at the end for more info.)

	#!/bin/zsh

	# Save content as extract-ipa.sh file name
	# chmod +x extract-ipa.sh
	# Open terminal and run ./extract-ipa.sh <app id>
	# App ID is Id in appstore url. Like https://apps.apple.com/cn/app/ai-app/id6447539504?l=en&uo=4
	# App ID -> id6447539504
	# Full command like: ./extract-ipa.sh id6447539504

	WATCHED_DIR="$HOME/Library/Group Containers/K36BKF7T3D.group.com.apple.configurator/Library/Caches/Assets/TemporaryItems/MobileApps"

	#!/usr/bin/env bash
	#
	# Build Frida DEB.

	# register the cleanup function to be called on the EXIT signal
	trap cleanup INT

	#######################################
	# Deletes the temp directory.
	# Globals:

	I faced this issue with the following environment:
	iPhoneX iOS 16.5.1, palera1n rootless jb, ellekit 1.0