Skip to content

Commit

Permalink
Add more fonts
Browse files Browse the repository at this point in the history
Also fix #1.
  • Loading branch information
zhuowei committed Dec 27, 2022
1 parent df0c9b3 commit 5f46c11
Show file tree
Hide file tree
Showing 15 changed files with 61 additions and 37 deletions.
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
xcuserdata
15 changes: 13 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,20 +2,28 @@ Proof-of-concept app to overwrite fonts on iOS using [CVE-2022-46689](https://su

Works on iOS 16.1.2 and below (tested on iOS 16.1) on unjailbroken devices.

IPA available in the [Releases](https://github.com/zhuowei/WDBFontOverwrite/releases) section.

Fonts included:

- DejaVu Sans Condensed
- DejaVu Serif
- DejaVu Sans Mono
- Go Regular
- Go Mono
- Segoe UI
- Comic Sans MS
- Choco Cooky

![Screenshot](https://user-images.githubusercontent.com/704768/209511898-a1477b66-28e4-471a-87d9-36c1c2eb25ca.png)

![Another screenshot](https://user-images.githubusercontent.com/704768/209606970-a382c273-bdcb-425c-bca1-1b6f9b31862f.png)

## Choice of fonts

I don't know how to port fonts for iOS properly: I did look for guides, but they were too difficult.

The included fonts were the only fonts I found that worked without porting. Other fonts I tested all displayed in a really squished way.
The included fonts were the only fonts I found that worked without porting. [Other fonts I tested](https://docs.google.com/document/d/1pGWevL6IVB8XBUhnAYazgMaWjMOsOfOZSjOoFwj6Jmk/edit?usp=sharing) all displayed in a really squished way.

## Font conversion

Expand All @@ -38,4 +46,7 @@ See `repackfonts/make_woff2src.sh` for details: this script:
- Apple for the [test case](https://github.com/apple-oss-distributions/xnu/blob/xnu-8792.61.2/tests/vm/vm_unaligned_copy_switch_race.c) and [patch](https://github.com/apple-oss-distributions/xnu/blob/xnu-8792.61.2/osfmk/vm/vm_map.c#L10150). (I didn't change anything: I only wrapped the test case in a library.)
- Everyone on Twitter who helped out and experimented with CVE-2022-46689, especially [@dedbeddedbed](https://twitter.com/dedbeddedbed), [@AppleDry05](https://twitter.com/AppleDry05), and [@haxi0sm](https://twitter.com/haxi0sm) for exploring what can be done with this issue..
- The [DejaVu fonts](https://dejavu-fonts.github.io) are distributed according to their [license](https://dejavu-fonts.github.io/License.html).
- Choco Cooky is the property of Samsung: I don't have any rights to redistribute it, but I'm posting it anyways because #yolo.
- The [Go fonts](https://go.dev/blog/go-fonts) are distributed according to their license.
- Segoe UI and Comic Sans MS are the property of Microsoft.
- Choco Cooky is the property of Samsung.
- I don't have any rights to redistribute these, but I'm posting them anyways because #yolo.
4 changes: 2 additions & 2 deletions WDBFontOverwrite.xcodeproj/project.pbxproj
Original file line number Diff line number Diff line change
Expand Up @@ -305,7 +305,7 @@
"$(inherited)",
"@executable_path/Frameworks",
);
MARKETING_VERSION = 1.0;
MARKETING_VERSION = 1.1;
PRODUCT_BUNDLE_IDENTIFIER = com.worthdoingbadly.WDBFontOverwrite;
PRODUCT_NAME = "$(TARGET_NAME)";
SWIFT_EMIT_LOC_STRINGS = YES;
Expand Down Expand Up @@ -339,7 +339,7 @@
"$(inherited)",
"@executable_path/Frameworks",
);
MARKETING_VERSION = 1.0;
MARKETING_VERSION = 1.1;
PRODUCT_BUNDLE_IDENTIFIER = com.worthdoingbadly.WDBFontOverwrite;
PRODUCT_NAME = "$(TARGET_NAME)";
SWIFT_EMIT_LOC_STRINGS = YES;
Expand Down
66 changes: 34 additions & 32 deletions WDBFontOverwrite/ContentView.swift
Original file line number Diff line number Diff line change
Expand Up @@ -7,43 +7,45 @@

import SwiftUI

struct FontToReplace {
var name: String
var postScriptName: String
var repackedPath: String
}

let fonts = [
FontToReplace(
name: "DejaVu Sans Condensed", postScriptName: "DejaVuSansCondensed",
repackedPath: "DejaVuSansCondensed.woff2"),
FontToReplace(
name: "DejaVu Serif", postScriptName: "DejaVuSerif", repackedPath: "DejaVuSerif.woff2"),
FontToReplace(
name: "DejaVu Sans Mono", postScriptName: "DejaVuSansMono", repackedPath: "DejaVuSansMono.woff2"
),
FontToReplace(name: "Go Regular", postScriptName: "GoRegular", repackedPath: "Go-Regular.woff2"),
FontToReplace(name: "Go Mono", postScriptName: "GoMono", repackedPath: "Go-Mono.woff2"),
FontToReplace(name: "Segoe UI", postScriptName: "SegoeUI", repackedPath: "segoeui.woff2"),
FontToReplace(
name: "Comic Sans MS", postScriptName: "ComicSansMS", repackedPath: "Comic Sans MS.woff2"),
FontToReplace(
name: "Choco Cooky", postScriptName: "Chococooky", repackedPath: "Chococooky.woff2"),
]

struct ContentView: View {
@State private var message = "Choose a font."
var body: some View {
VStack {
Text(message).padding(16)
Button(action: {
message = "Running"
overwriteWithFont(name: "DejaVuSansCondensed.woff2") {
message = $0
}
}) {
Text("DejaVu Sans Condensed").font(.custom("DejaVuSansCondensed", size: 18))
}.padding(16)
Button(action: {
message = "Running"
overwriteWithFont(name: "DejaVuSerif.woff2") {
message = $0
}
}) {
Text("DejaVu Serif").font(.custom("DejaVuSerif", size: 18))
}.padding(16)
Button(action: {
message = "Running"
overwriteWithFont(name: "DejaVuSansMono.woff2") {
message = $0
}
}) {
Text("DejaVu Sans Mono").font(.custom("DejaVuSansMono", size: 18))
}.padding(16)
Button(action: {
message = "Running"
overwriteWithFont(name: "Chococooky.woff2") {
message = $0
}
}) {
Text("Choco Cooky").font(.custom("Chococooky", size: 18))
}.padding(16)
ForEach(fonts, id: \.name) { font in
Button(action: {
message = "Running"
overwriteWithFont(name: font.repackedPath) {
message = $0
}
}) {
Text(font.name).font(.custom(font.postScriptName, size: 18))
}.padding(8)
}
}
}
}
Expand Down
4 changes: 4 additions & 0 deletions WDBFontOverwrite/Info.plist
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,13 @@
<key>UIAppFonts</key>
<array>
<string>PreviewFonts/Chococooky.ttf</string>
<string>PreviewFonts/Comic Sans MS.ttf</string>
<string>PreviewFonts/DejaVuSansCondensed.ttf</string>
<string>PreviewFonts/DejaVuSansMono.ttf</string>
<string>PreviewFonts/DejaVuSerif.ttf</string>
<string>PreviewFonts/Go-Mono.ttf</string>
<string>PreviewFonts/Go-Regular.ttf</string>
<string>PreviewFonts/segoeui.ttf</string>
</array>
</dict>
</plist>
Binary file added WDBFontOverwrite/PreviewFonts/Comic Sans MS.ttf
Binary file not shown.
Binary file added WDBFontOverwrite/PreviewFonts/Go-Mono.ttf
Binary file not shown.
Binary file added WDBFontOverwrite/PreviewFonts/Go-Regular.ttf
Binary file not shown.
Binary file added WDBFontOverwrite/PreviewFonts/segoeui.ttf
Binary file not shown.
Binary file not shown.
Binary file modified WDBFontOverwrite/RepackedFonts/DejaVuSansCondensed.woff2
Binary file not shown.
Binary file added WDBFontOverwrite/RepackedFonts/Go-Mono.woff2
Binary file not shown.
Binary file added WDBFontOverwrite/RepackedFonts/Go-Regular.woff2
Binary file not shown.
Binary file added WDBFontOverwrite/RepackedFonts/segoeui.woff2
Binary file not shown.
8 changes: 7 additions & 1 deletion repackfonts/make_woff2src.sh
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,17 @@ set -e
rm -rf PreviewFonts XmlFonts XmlFontsRenamed RecompiledFonts RepackedFonts || true
mkdir -p PreviewFonts XmlFonts XmlFontsRenamed RecompiledFonts RepackedFonts || true

IFS="
"
fonts="
OriginalFonts/dejavu-fonts-ttf-2.37/ttf/DejaVuSansCondensed.ttf:DejaVuSansCondensed
OriginalFonts/dejavu-fonts-ttf-2.37/ttf/DejaVuSansMono.ttf:DejaVuSansMono
OriginalFonts/dejavu-fonts-ttf-2.37/ttf/DejaVuSerif.ttf:DejaVuSerif
OriginalFonts/ChocoCooky/assets/fonts/Chococooky.ttf:Chococooky"
OriginalFonts/ChocoCooky/assets/fonts/Chococooky.ttf:Chococooky
OriginalFonts/image/font/gofont/ttfs/Go-Regular.ttf:GoRegular
OriginalFonts/image/font/gofont/ttfs/Go-Mono.ttf:GoMono
OriginalFonts/Comic Sans MS.ttf:ComicSansMS
OriginalFonts/segoeui.ttf:SegoeUI"
for fontandname in $fonts
do
font="$(echo "$fontandname" | cut -d ":" -f 1)"
Expand Down

0 comments on commit 5f46c11

Please sign in to comment.