diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..9bce6af --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +xcuserdata diff --git a/README.md b/README.md index 8cda44b..db22ff8 100644 --- a/README.md +++ b/README.md @@ -2,20 +2,28 @@ Proof-of-concept app to overwrite fonts on iOS using [CVE-2022-46689](https://su Works on iOS 16.1.2 and below (tested on iOS 16.1) on unjailbroken devices. +IPA available in the [Releases](https://github.com/zhuowei/WDBFontOverwrite/releases) section. + Fonts included: - DejaVu Sans Condensed - DejaVu Serif - DejaVu Sans Mono +- Go Regular +- Go Mono +- Segoe UI +- Comic Sans MS - Choco Cooky ![Screenshot](https://user-images.githubusercontent.com/704768/209511898-a1477b66-28e4-471a-87d9-36c1c2eb25ca.png) +![Another screenshot](https://user-images.githubusercontent.com/704768/209606970-a382c273-bdcb-425c-bca1-1b6f9b31862f.png) + ## Choice of fonts I don't know how to port fonts for iOS properly: I did look for guides, but they were too difficult. -The included fonts were the only fonts I found that worked without porting. Other fonts I tested all displayed in a really squished way. +The included fonts were the only fonts I found that worked without porting. [Other fonts I tested](https://docs.google.com/document/d/1pGWevL6IVB8XBUhnAYazgMaWjMOsOfOZSjOoFwj6Jmk/edit?usp=sharing) all displayed in a really squished way. ## Font conversion @@ -38,4 +46,7 @@ See `repackfonts/make_woff2src.sh` for details: this script: - Apple for the [test case](https://github.com/apple-oss-distributions/xnu/blob/xnu-8792.61.2/tests/vm/vm_unaligned_copy_switch_race.c) and [patch](https://github.com/apple-oss-distributions/xnu/blob/xnu-8792.61.2/osfmk/vm/vm_map.c#L10150). (I didn't change anything: I only wrapped the test case in a library.) - Everyone on Twitter who helped out and experimented with CVE-2022-46689, especially [@dedbeddedbed](https://twitter.com/dedbeddedbed), [@AppleDry05](https://twitter.com/AppleDry05), and [@haxi0sm](https://twitter.com/haxi0sm) for exploring what can be done with this issue.. - The [DejaVu fonts](https://dejavu-fonts.github.io) are distributed according to their [license](https://dejavu-fonts.github.io/License.html). -- Choco Cooky is the property of Samsung: I don't have any rights to redistribute it, but I'm posting it anyways because #yolo. +- The [Go fonts](https://go.dev/blog/go-fonts) are distributed according to their license. +- Segoe UI and Comic Sans MS are the property of Microsoft. +- Choco Cooky is the property of Samsung. +- I don't have any rights to redistribute these, but I'm posting them anyways because #yolo. diff --git a/WDBFontOverwrite.xcodeproj/project.pbxproj b/WDBFontOverwrite.xcodeproj/project.pbxproj index 76be29c..5c9a4ec 100644 --- a/WDBFontOverwrite.xcodeproj/project.pbxproj +++ b/WDBFontOverwrite.xcodeproj/project.pbxproj @@ -305,7 +305,7 @@ "$(inherited)", "@executable_path/Frameworks", ); - MARKETING_VERSION = 1.0; + MARKETING_VERSION = 1.1; PRODUCT_BUNDLE_IDENTIFIER = com.worthdoingbadly.WDBFontOverwrite; PRODUCT_NAME = "$(TARGET_NAME)"; SWIFT_EMIT_LOC_STRINGS = YES; @@ -339,7 +339,7 @@ "$(inherited)", "@executable_path/Frameworks", ); - MARKETING_VERSION = 1.0; + MARKETING_VERSION = 1.1; PRODUCT_BUNDLE_IDENTIFIER = com.worthdoingbadly.WDBFontOverwrite; PRODUCT_NAME = "$(TARGET_NAME)"; SWIFT_EMIT_LOC_STRINGS = YES; diff --git a/WDBFontOverwrite/ContentView.swift b/WDBFontOverwrite/ContentView.swift index 77d4adb..b18e993 100644 --- a/WDBFontOverwrite/ContentView.swift +++ b/WDBFontOverwrite/ContentView.swift @@ -7,43 +7,45 @@ import SwiftUI +struct FontToReplace { + var name: String + var postScriptName: String + var repackedPath: String +} + +let fonts = [ + FontToReplace( + name: "DejaVu Sans Condensed", postScriptName: "DejaVuSansCondensed", + repackedPath: "DejaVuSansCondensed.woff2"), + FontToReplace( + name: "DejaVu Serif", postScriptName: "DejaVuSerif", repackedPath: "DejaVuSerif.woff2"), + FontToReplace( + name: "DejaVu Sans Mono", postScriptName: "DejaVuSansMono", repackedPath: "DejaVuSansMono.woff2" + ), + FontToReplace(name: "Go Regular", postScriptName: "GoRegular", repackedPath: "Go-Regular.woff2"), + FontToReplace(name: "Go Mono", postScriptName: "GoMono", repackedPath: "Go-Mono.woff2"), + FontToReplace(name: "Segoe UI", postScriptName: "SegoeUI", repackedPath: "segoeui.woff2"), + FontToReplace( + name: "Comic Sans MS", postScriptName: "ComicSansMS", repackedPath: "Comic Sans MS.woff2"), + FontToReplace( + name: "Choco Cooky", postScriptName: "Chococooky", repackedPath: "Chococooky.woff2"), +] + struct ContentView: View { @State private var message = "Choose a font." var body: some View { VStack { Text(message).padding(16) - Button(action: { - message = "Running" - overwriteWithFont(name: "DejaVuSansCondensed.woff2") { - message = $0 - } - }) { - Text("DejaVu Sans Condensed").font(.custom("DejaVuSansCondensed", size: 18)) - }.padding(16) - Button(action: { - message = "Running" - overwriteWithFont(name: "DejaVuSerif.woff2") { - message = $0 - } - }) { - Text("DejaVu Serif").font(.custom("DejaVuSerif", size: 18)) - }.padding(16) - Button(action: { - message = "Running" - overwriteWithFont(name: "DejaVuSansMono.woff2") { - message = $0 - } - }) { - Text("DejaVu Sans Mono").font(.custom("DejaVuSansMono", size: 18)) - }.padding(16) - Button(action: { - message = "Running" - overwriteWithFont(name: "Chococooky.woff2") { - message = $0 - } - }) { - Text("Choco Cooky").font(.custom("Chococooky", size: 18)) - }.padding(16) + ForEach(fonts, id: \.name) { font in + Button(action: { + message = "Running" + overwriteWithFont(name: font.repackedPath) { + message = $0 + } + }) { + Text(font.name).font(.custom(font.postScriptName, size: 18)) + }.padding(8) + } } } } diff --git a/WDBFontOverwrite/Info.plist b/WDBFontOverwrite/Info.plist index 5346c90..e0eb2b6 100644 --- a/WDBFontOverwrite/Info.plist +++ b/WDBFontOverwrite/Info.plist @@ -7,9 +7,13 @@ UIAppFonts PreviewFonts/Chococooky.ttf + PreviewFonts/Comic Sans MS.ttf PreviewFonts/DejaVuSansCondensed.ttf PreviewFonts/DejaVuSansMono.ttf PreviewFonts/DejaVuSerif.ttf + PreviewFonts/Go-Mono.ttf + PreviewFonts/Go-Regular.ttf + PreviewFonts/segoeui.ttf diff --git a/WDBFontOverwrite/PreviewFonts/Comic Sans MS.ttf b/WDBFontOverwrite/PreviewFonts/Comic Sans MS.ttf new file mode 100644 index 0000000..831e3d8 Binary files /dev/null and b/WDBFontOverwrite/PreviewFonts/Comic Sans MS.ttf differ diff --git a/WDBFontOverwrite/PreviewFonts/Go-Mono.ttf b/WDBFontOverwrite/PreviewFonts/Go-Mono.ttf new file mode 100644 index 0000000..853d473 Binary files /dev/null and b/WDBFontOverwrite/PreviewFonts/Go-Mono.ttf differ diff --git a/WDBFontOverwrite/PreviewFonts/Go-Regular.ttf b/WDBFontOverwrite/PreviewFonts/Go-Regular.ttf new file mode 100644 index 0000000..3845655 Binary files /dev/null and b/WDBFontOverwrite/PreviewFonts/Go-Regular.ttf differ diff --git a/WDBFontOverwrite/PreviewFonts/segoeui.ttf b/WDBFontOverwrite/PreviewFonts/segoeui.ttf new file mode 100644 index 0000000..0f52cbd Binary files /dev/null and b/WDBFontOverwrite/PreviewFonts/segoeui.ttf differ diff --git a/WDBFontOverwrite/RepackedFonts/Comic Sans MS.woff2 b/WDBFontOverwrite/RepackedFonts/Comic Sans MS.woff2 new file mode 100644 index 0000000..51e3182 Binary files /dev/null and b/WDBFontOverwrite/RepackedFonts/Comic Sans MS.woff2 differ diff --git a/WDBFontOverwrite/RepackedFonts/DejaVuSansCondensed.woff2 b/WDBFontOverwrite/RepackedFonts/DejaVuSansCondensed.woff2 index fff6b6d..b254854 100644 Binary files a/WDBFontOverwrite/RepackedFonts/DejaVuSansCondensed.woff2 and b/WDBFontOverwrite/RepackedFonts/DejaVuSansCondensed.woff2 differ diff --git a/WDBFontOverwrite/RepackedFonts/Go-Mono.woff2 b/WDBFontOverwrite/RepackedFonts/Go-Mono.woff2 new file mode 100644 index 0000000..784c2fc Binary files /dev/null and b/WDBFontOverwrite/RepackedFonts/Go-Mono.woff2 differ diff --git a/WDBFontOverwrite/RepackedFonts/Go-Regular.woff2 b/WDBFontOverwrite/RepackedFonts/Go-Regular.woff2 new file mode 100644 index 0000000..2897994 Binary files /dev/null and b/WDBFontOverwrite/RepackedFonts/Go-Regular.woff2 differ diff --git a/WDBFontOverwrite/RepackedFonts/segoeui.woff2 b/WDBFontOverwrite/RepackedFonts/segoeui.woff2 new file mode 100644 index 0000000..02294e9 Binary files /dev/null and b/WDBFontOverwrite/RepackedFonts/segoeui.woff2 differ diff --git a/repackfonts/make_woff2src.sh b/repackfonts/make_woff2src.sh index a7e74a3..7c26619 100755 --- a/repackfonts/make_woff2src.sh +++ b/repackfonts/make_woff2src.sh @@ -3,11 +3,17 @@ set -e rm -rf PreviewFonts XmlFonts XmlFontsRenamed RecompiledFonts RepackedFonts || true mkdir -p PreviewFonts XmlFonts XmlFontsRenamed RecompiledFonts RepackedFonts || true +IFS=" +" fonts=" OriginalFonts/dejavu-fonts-ttf-2.37/ttf/DejaVuSansCondensed.ttf:DejaVuSansCondensed OriginalFonts/dejavu-fonts-ttf-2.37/ttf/DejaVuSansMono.ttf:DejaVuSansMono OriginalFonts/dejavu-fonts-ttf-2.37/ttf/DejaVuSerif.ttf:DejaVuSerif -OriginalFonts/ChocoCooky/assets/fonts/Chococooky.ttf:Chococooky" +OriginalFonts/ChocoCooky/assets/fonts/Chococooky.ttf:Chococooky +OriginalFonts/image/font/gofont/ttfs/Go-Regular.ttf:GoRegular +OriginalFonts/image/font/gofont/ttfs/Go-Mono.ttf:GoMono +OriginalFonts/Comic Sans MS.ttf:ComicSansMS +OriginalFonts/segoeui.ttf:SegoeUI" for fontandname in $fonts do font="$(echo "$fontandname" | cut -d ":" -f 1)"