Git Product home page Git Product logo

wdbfontoverwrite's Introduction

Proof-of-concept app to overwrite fonts on iOS using CVE-2022-46689.

Works on iOS 16.1.2 and below (tested on iOS 16.1) on unjailbroken devices.

IPA available in the Releases section.

Fonts included:

  • DejaVu Sans Condensed
  • DejaVu Serif
  • DejaVu Sans Mono
  • Go Regular
  • Go Mono
  • Fira Sans
  • Segoe UI
  • Comic Sans MS
  • Choco Cooky

You can also import custom fonts that were ported for iOS.

Screenshots

DejaVu Sans Condensed | DejaVu Serif | DejaVu Sans Mono | Choco Cooky

Screenshot

Go Regular | Go Mono | Segoe UI | Comic Sans MS

Another screenshot

Hanna Soft + JoyPixels | Bronkoh | Noto Serif SC | Fira Sans

Another screenshot

Screenshot credit: @ev_ynw for the ported Hanna Soft and Bronkoh fonts, JoyPixels for the emoji font

Where to find ported fonts

Known issues

  • The built-in fonts are not properly ported (I don't know how to port fonts). For best results, use a custom font.
    • with the built-in fonts:
    • Only regular text uses the changed font: thin/medium/bold text falls back to Helvetica instead.
    • If the font doesn't show up at all, disable "Bold Text" in accessibility settings.
  • File pickers in apps will fail to open with the error "Something went wrong while displaying documents."
    • This happens if you replace the emoji font, or install fonts with multiple weights
    • Try the experimental .ttc fix by using "Import custom with fix for .ttc"
  • iOS 14.x devices which are jailbroken / were jailbroken before will not be able to revert to the original font.
    • Workaround: do not use this app if you're on iOS 14.x and have previously jailbroken. Instead, just jailbreak and replace fonts normally.

Font conversion

The CVE-2022-46689 issue - as far as I know - only lets you overwrite 16383 bytes out of every 16384 bytes: the last byte of the page can't be written.

(I could be wrong)

To work around this, I package the font using the WOFF2 webfont format, which is supported on iOS. WOFF2 uses Brotli for compression, which lets me insert padding to skip over the last byte.

See repackfonts/make_woff2src.sh for details: this script:

  • renames the font to .SFUI-Regular with TTX following this answer
  • rebuilds the font to .woff2
  • runs repackfonts/BrotliPadding.swift to decompress the WOFF2 file and insert padding to skip past the 16384th byte

Credits

  • Ian Beer of Project Zero for finding CVE-2022-46689.
  • Apple for the test case and patch. (I didn't change anything: I only wrapped the test case in a library.)
  • Everyone on Twitter who helped out and experimented with CVE-2022-46689, especially @dedbeddedbed, @AppleDry05, and @haxi0sm for exploring what can be done with this issue..
  • WOFF2 compressor by Google
  • ttcpad by LIJI32
  • Fontforge stripttc
  • The DejaVu fonts are distributed according to their license.
  • The Go fonts are distributed according to their license.
  • The Fira Sans font is converted by @jonpalmisc - thanks!
  • Segoe UI and Comic Sans MS are the property of Microsoft.
  • Choco Cooky is the property of Samsung.
  • I don't have any rights to redistribute these, but I'm posting them anyways because #yolo.

wdbfontoverwrite's People

Contributors

basti564 avatar ginsudev avatar poomsmart avatar zhuowei avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

wdbfontoverwrite's Issues

Failure to install

There’s an extremely long delay with trying to add the ipa to AltStore. I’ve tried this method several times & it still nothing. I’m on iOS 16.1.1 - iPhone 13 Pro Max. I even reinstalled AltStore & it’s still lagging.

Can't reset to stock font

So yes I tried reboot multiple times and the custom fonts still remain on my whole UI. Installed by TrollStore.

Device: iPhone 11 Pro Max
iOS: 14.8
Jailbreak: unc0ver 8.0.2
TrollStore: 1.4.5
WDBFontOverwrite: 1.2

Emoji Not Lasting

So once successful it will change the emojis but after a period of time they revert back to the stock ones - without a reboot or respring happening.

Add iOS 12.5.6 Support please

Can you add iOS 12.5.6 and iOS 13 support please, i’m using iPhone 6 and I really want to change my system fonts without Jailbreaks. Thanks for listening !

Keyboard font

Version 1.10.4 & 1.10.5 can't change keyboard font, but v1.10.3 work

doesn’t work

i’m on ios 16.0.2 with iphone 13 pro but nomatter what i do the font won’t change

iPad Cannot import font

iPad Pro 14.4 Click to import the custom font and there is no response, and you can't jump to the file app.
Version: 1.10.7

An issue about the custom font couldn't d normal show

I installed this app through Trollstore. My device is an ipad8th iOS 15.2. When I used custom emoji fonts, TTF fonts and TTC fonts, there all had the wrong text. Is the issue that the IPadOs were not supported?

Full Conversion of Choco Cooky font

Hello,
Could you please full port the font Choco Cooky? So when we click in stock font present in the app she have this font in Phone, Lock Screen etc.

thanks a lot
Stefano

Emojis are not apply on iOS 14.7

I tried using AppleColorEmoji.ttc from PoomSmart's source as well as AppleColorEmoji from MacOS Monterey(which I ported for iOS using PoomSmart’s method), but neither worked. First picture is from my iPhone 6s iOS 15.5 and the second and the third are from my iPad Air 3 iOS 14.7
A2A6A722-94B3-44DF-B98E-AE91DA045DDC
98DB7BAE-055C-412C-9FD5-0AA43B1768EF
6DF9DB05-9DB7-495C-B5B0-9C7667EC9FD7

Fonts not changing iOS 16.1.2

The fonts are not changing. It only changed to one font no matter what font I select.
iPhone 11 iOS 16.1.2

IMG_9677.MOV

Helvetica.ttc File cannot be loaded

The Helvetica.ttc file can be used normally in version 03, but cannot be used in versions later than version 03, indicating that the file is too large. What's the matter, please? Pass a file

about custom font imports

I installed v1.3 with a certificate on ios15.6rc, iPhone xr, but it didn't respond when importing .ttf and .ttc.

But I saw in other forums that it can be used with altstore or Bullforg Assistant. Is this a bug or only me or some devices have bugs?

Can’t use custom fonts

How am I supposed to use a custom font exactly? To me at least, it isn’t described very clearly/at all. I’ve tried using the system font manager, using a certificate, and simply importing the font file(s) on it’s own with nothing else (in multiple file extensions) but nothing has seemed to work. I’ve tried using multiple extensions on an IPA installed with Sideloadly, and everything else I’ve tried has been on an IPA installed using a distribution certificate from UDID registrations. My iOS version is 16.2 Beta (Released before 16.1.2 so the exploit works) and I am on a 13 Pro Max.

Home Screen Font

Home screen font changes back to normal if you respring it and you can't redo unless you reboot, 15.6RC A15

Cannot change emoji font on my 1 out of 2 devices (Failed to install custom emojis)

Is this iOS specific problem? I have an iPhone 6s Plus on 15.7.1 and I couldn't change the emoji font, though I can change the display font and successfully imported one from PoomSmart. ipa installed via Sideloadly.

I have an iPad mini 6 on 15.4.1 and could change both the display font and the emoji font. Sideloaded via TrollStore.

Memory usage issues

正如标题所示,替换较大的中文字体将导致严重的内存使用,导致小部件无法加载,第三方键盘无法运行,运行缓慢并反复注销。
更改字体后通过修改系统首选语言注销基板可以使替换的字体覆盖更多界面,但这会导致更多的内存问题。

As the title shows, replacing larger Chinese fonts will lead to severe memory usage, causing widgets to not to load, third-party keyboards cannot run, slow to run and repeatedly log out.
After changing the font, the replacement font can overwrite more interfaces by modifying the system's preferred language logout substrate, but this will lead to more memory problems.

Ios 16.2

iOS 16.2 don’t work
Can you solve the problem ?

thank you

font create script small fix

If font postscript name contains spaces the script interprets it as a second font due to default behavior of for loop is split on spaces, tab and newline , so you should only split on new lines.

IFS=$'\n' should fix that

add more fonts?

I want to replace my Chinese font, otherwise only the English alphabet will be replaced, which will look uncomfortable.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.