Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

#import <NanoTimeKit/NanoTimeKit.h> #1

Open
matthijsotterloo opened this issue Aug 18, 2015 · 95 comments
Open

#import <NanoTimeKit/NanoTimeKit.h> #1

matthijsotterloo opened this issue Aug 18, 2015 · 95 comments

Comments

@matthijsotterloo
Copy link

How can I import this file? I don't understand what you mean with import carousel into the dylib

@BlueSpud
Copy link

I also can't find anything that would get a dylib called Carousel, and can't find the framework on my computer. Running El Capitan 6 and Watch OS 2 5

@carbamide
Copy link

It's a from the private framework, NanoTimeKit. We need to find a private header dump from a watch device to even build this. I have no clue how make Carousel pick it up though. I've never done jailbreak dev, just regular.

@BlueSpud
Copy link

@carbamide do you have any idea what Carousel even is? Maybe we can figure it out.

@asmeurer
Copy link

Carousel is the equivalent of SpringBoard for WatchOS.

@Cclleemm
Copy link

Hello @carbamide, do you have a link to download NanoTimeKit header ?

@matthijsotterloo
Copy link
Author

@Cclleemm
Copy link

Thank's @matthijsotterloo, but I allready include this framework in my project but it doesn't compile.

@matthijsotterloo
Copy link
Author

Yes also tried that, it doesn't compile because it's missing NanoTimekit.h which is not included in this framework...

@codyd51
Copy link

codyd51 commented Aug 19, 2015

As stated above, NanoTimeKit is an internal framework running on the Watch. To get headers you can either class dump the binary, or simply write them yourself.

I do not know how he has gotten Carousel to load the dylib, however. That is something I would be very interested in hearing, purely to satiate my curiosity.

@hamzasood
Copy link
Owner

Carousel is the watchOS equivalent of SpringBoard. It's the app that displays the home screen, notification centre, glances, watch faces etc. I haven't open sourced how I got Carousel to load the dylib. This repo only contains the watch face code and what you'd need to hook once you've got code running in Carousel.

@codyd51
Copy link

codyd51 commented Aug 19, 2015

@hamzasood Would you be willing to share what vector/general starting point you're using to get Carousal to load dylibs? Fully understand you don't want to share all your goodies, though this is something that seems very interesting and I'd love to look into it for myself, though I'm not sure where to start.

@biscuitehh
Copy link

+1 @codyd51

@galli-leo
Copy link

@codyd51 I may have found at least a way to load the dylib on the simulator. At the moment I am trying to get the dylib to compile.

The NanoTimeKit.h file is pretty much just a file to import everything from the Framework. This can easily be done yourself.

@VedBoon
Copy link

VedBoon commented Aug 20, 2015

@DJLectr0 I finally decompiled the Carousel headers and compiled the dylib.... would really appreciate your thoughts on loading it.

@codyd51
Copy link

codyd51 commented Aug 20, 2015

@DJLectr0 Hey, that's better than nothing! Mind divulging how you did that? Maybe we could go digging together and see what we can figure out :-)

@galli-leo
Copy link

@VedBoon Sure. Could you also share your xcodeproject with me where you got it to compile? (Best would be private because of the NDA)

I thought of loading in the Simulator like when you load tweaks in the ios sim (http://sharedinstance.net/2013/10/running-tweaks-in-simulator/) so editing the lanchdaemons of the sim sdk to include the Dylib injection like in the article just instead of springboard the carousel plist.

@codyd51
Copy link

codyd51 commented Aug 20, 2015

@DJLectr0 That post is sorely outdated and does not work on recent versions of the iOS sim. I cannot speak for the Watch sim as I have not tried it, but the current method for loading dylibs into the iOS sim is utilizing optool by @alexzielenski

@galli-leo
Copy link

@codyd51 Ok did not know that :( So maybe try optool?

@codyd51
Copy link

codyd51 commented Aug 20, 2015

@DJLectr0 Actually, I have. I totally forgot about this earlier, but @EthanArbuckle and I fooled around with loading some dylibs into the Watch sim's Prefs.app - nothing big, mind you; pushing dumb view controllers and changing color schemes. Neat, but it does not help the final goal of getting dylibs loaded onto an actual device.

@galli-leo
Copy link

@codyd51 Well its a start ;) We could try to load a custom firmware or with the new independent apps look if we can use some methods from some private Frameworks to get it to load the dylib.
Another thought: If we can load dylibs we could theoretically change everything hookable in the system (e.g. Making whatsapp quick reply)

@EthanArbuckle
Copy link

Share your magix hamza

@galli-leo
Copy link

@codyd51 When I get home, I will try to load some simple dylibs in the Simulator and then look at how to get the watch OS 2 Firmware

@codyd51
Copy link

codyd51 commented Aug 20, 2015

(Addressing each sentence in order)

@DJLectr0 Loading a custom firmware isn't in the spirit of what we're trying to achieve IMHO. It's the argument of using Substrate over manually replacing binaries.

We can't use private frameworks while sandboxed.

Yes, that's kind of the whole idea regarding tweak development ;P

@codyd51
Copy link

codyd51 commented Aug 20, 2015

@EthanArbuckle +1

@galli-leo
Copy link

@codyd51 Yes I know, but if we could load a custom Firmware we could inject a dylib, which is what we are trying here. I know its really manual but it would be a nice start.
Hamzasood is also in an internal testing mode. Maybe this allows him to load dylibs?
I will also dig through the carousel headers, maybe there is something there.

@AlexeyBelezeko
Copy link

@DJLectr0 @codyd51 Maybe I didn't unsderstand. But we can try to load dylib to carusel with lldb like this http://www.ifans.com/forums/threads/dylib-injection-with-iphone-simulator.109242/

@galli-leo
Copy link

@AlexeyBlezeko the problem is that we need to find a way to inject the dylib into carousel on an actual watch.

@AlexeyBelezeko
Copy link

@DJLectr0 Can we use gdb on actual watch?

@codyd51
Copy link

codyd51 commented Aug 20, 2015

@AlexeyBelezeko Simple answer: no. The reason is twofold:

  1. That would mean we need native code execution on the watch, which is the end goal in the first place

  2. watchOS is just iOS 8.4 using Carousel as a launcher instead of SpringBoard. There is no working version of gdb on > iOS 8, so even if we had native code exec. we could not use gdb.

@hamzasood
Copy link
Owner

@codyd51 Not quite true. The DeveloperDiskImage for iOS and watchOS both have debugserver. But it can only attach to processes with the get-task-allow entitlement.

@Baddaboo
Copy link

Baddaboo commented May 2, 2016

Since I saw these messages and realized that nobody had still figured this out, I revisited the project and tried a few little hacks here and there but I can't tell if I cleared up all the compiler errors or if there's a bigger problem I'm not seeing. Basically, you have to clean up the header files and create a tbd file for Xcode to recognize them. But now I'm at a point where Xcode attempts to compile the project, stall at linking and then crash
screen shot 2016-05-01 at 6 24 54 pm

@an20olives
Copy link

@Baddaboo Ok just started this back up again got the frameworks that are needed loaded in, I'm still stuck at the NanoTimeKit not found (Got passed before but idk how lol), would we call this progress?

@Baddaboo
Copy link

Baddaboo commented May 2, 2016

@RepoEliteARO I'd say make sure that the NanoTimeKit headers you're using are for whatever version of WatchOS you're trying to compile for. I haven't tried the one that @SObS linked to, because the dump I'm using works just fine, but I think some others are running into issues because their headers are for WatchOS 1.0 and they're compiling for 2.0+. Other than that, make sure that your search path is set, the NanoTimeKit framework is included, and, uh, pray.

I'm at the point where ld keeps crashing and throwing:

clang: error: unable to execute command: Killed: 9

@an20olives
Copy link

an20olives commented May 2, 2016

@Baddaboo Alright thanks ill check out @SObS links and see what I can do, ill get back to you when things work. Ill fix my search paths and see what else I can get done. Any idea what would be causing that?

Update: Just did that fixed the missing "Nano not found" error (starting to remember now :P) now its spewing out a bunch of errors, think most are UIKit errors from what I'm seeing I may have missed something so...
screen shot 2016-05-02 at 5 51 53 pm

@SObS
Copy link

SObS commented May 3, 2016

About UIKit(UIView) and etc: "Missing Headers & Frameworks: … For the most part, you just need to copy the tbd files from the iPhoneOS SDK into the appropriate places in the WatchOS SDK, as well as their headers, then edit the tbd files to include ‘armv7k’. I’m sure somebody will automate this repetitive and thankless job" from here http://blog.steventroughtonsmith.com/post/128957959685/native-uikit-apps-on-apple-watch
Not tried yet.

@angelovAlex
Copy link

angelovAlex commented May 6, 2016

What's the point you all try to compile it when it won't work? The main idea is that this code should be executed by carousel app, without it this code and project are useless. You can just comment out everything and compile an empty dylib to play with, and only after figuring out of how to load that dylib into carousel, it is worth to compile the whole code.

@ph1ps
Copy link

ph1ps commented May 6, 2016

@angelovAlex The bad thing is that we can't inject the compiled dylib into a real Watch without some tricks. Though I think we can inject the code into a simulator which would be pretty cool too :)

@StevenTLBF
Copy link

any progress? :-/ its been almost a year since this was posted :(

@Shugabuga
Copy link

It's been a year since this issue first appeared. Has there been anyone with a solution, or can @hamzasood shed some light on this topic?

@DominikBucher12
Copy link

What is the big deal? You can class-dump files on your own from iOS Simulator. I already did that few minutes ago and I will post the project when it's ready and fully working. 👍

@StevenTLBF
Copy link

@DominikBucher12 YES!!! FINALLY!! Please share once you get it working!!!

@lellis2k
Copy link

lellis2k commented Nov 2, 2016

@DominikBucher12 Excellent, could we see a proof of concept? How far along do you think you are with it?

@Baddaboo
Copy link

Not sure what all the hubbub is with @DominikBucher12 but he is right: it's not that hard to class-dump the sim headers and get the project to compile. If you need any proof, you can grab the dylib I compiled. Since my school's on Thanksgiving break, I decided to pick up the project again to try to figure out how to inject the library into Carousel. All I've been able to do so far is make my watch crash. I pushed a new repo with the patched frameworks and project I'm working on if you want to see what I'm up to: https://github.com/Baddaboo/WatchYourFaceTest

@StevenTLBF
Copy link

Any progress?

@Baddaboo
Copy link

Baddaboo commented Dec 5, 2016

Progress has been very hit-and-miss. I've tried to get Carousel to load the dylib, but debugserver has very little documentation on what it can actually do and there are many points at which I do something that causes my watch to lock up and stop responding to Xcode's debugger until I restart it

@Baddaboo
Copy link

Baddaboo commented Dec 5, 2016

FWIW I even tried swizzling a clockkit function to see if I could get Carousel to execute a dlopen through a complication, but that route seems like a dead-end :/

@oit63
Copy link

oit63 commented Dec 7, 2016

@Baddaboo Thanks, your route now is a kind of good way.

@DominikBucher12
Copy link

Few tips on injecting dylibs, a bit old perhaps http://blog.timac.org/?p=761

a bit of theory:

http://www.programering.com/a/MTN2MzMwATY.html

@StevenTLBF
Copy link

Anything us noobs can do to help?

As a designer, I have great watch faces I could share with everyone if we get this to work!

@Shugabuga
Copy link

Anything us noobs can do to help?

@StevenTLBF Likely no. Plus I doubt that this will be usable on a physical device unless we see a watchOS "jailbreak."

@StevenTLBF
Copy link

@Shugabuga Hamza demoed it on a physical device though.. fingers crossed that we can figure this out!

@Shugabuga
Copy link

Shugabuga commented Dec 14, 2016

@StevenTLBF I think he has an exploit, as his former projects that also required a jailbreak (especially his live wallpaper example) was demoed on actual devices before a JB if I recall.

Plus, how else would we modify Carousel, because if Carousel can be modified without a jailbreak, then that means that SpringBoard could be too.

@StevenTLBF
Copy link

@hamzasood any light you can shed?

@StevenTLBF
Copy link

StevenTLBF commented Feb 15, 2017

@StevenTLBF
Copy link

@Shugabuga
Copy link

I don't think so. We need to include them in Carousel.app, which can't be modified AFAIK.

I know recently a dev was able to get the Hermés watchface running on a normal Apple Watch with only a jailbreak, but we'll see...

@StevenTLBF
Copy link

@Shugabuga Where did you see the Hermés watch face on a normal Apple Watch? I'm intrigued.

@Shugabuga
Copy link

Here.

@justMaku
Copy link

Not sure if anyone is still interested but here's the updated/working repo for use with Simulator.

https://github.com/justMaku/NTKCustomFace

@Shugabuga
Copy link

@justMaku I am interested, so thanks for the link!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests