๋‚˜๋„ ์ž์„ธํžˆ๋Š” ๋ชจ๋ฅด๊ฒ ๊ณ  ๋””์Šค์ฝ”๋“œ ์„œ๋ฒ„์— ๊ณต์ง€์˜ฌ๋ผ์™”๋Š”๋ฐ ์ค‘์š”ํ•œ๋“ฏ..?

์ผ๋‹จ 26.4 ์˜ฌ๋ฆฌ์ง€ ๋ง์•„์•ผํ• ๋“ฏ ใ…‡ใ…‡..


์ „๋ฌธ
@everyone so after doing some decomp work, I've found what Apple's doing. This feels very intentional to break SideStore/StikDebug.ย 

tl;dr - there's a few ways to get around this, new code just needs to be written.

For the tech savvy, this is this gist of what's going on. Apple has updated the lockdown connection check to determine if the incoming socket exists on the local subnet.ย 

```c
ย  ย  ย  ย  ย  ย  ย  ย  ย  psVar15 = piVar14->ifa_netmask;
ย  ย  ย  ย  ย  ย  ย  ย  ย  if (psVar15 == (sockaddr *)0x0) {
ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  if (sVar3 == '\x1e') {
ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  if (CONCAT44(uStack_f0,uStack_f4) == CONCAT44(uStack_108,uStack_10c) &&
ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  CONCAT44(uStack_e8,uStack_ec) == CONCAT44(uStack_100,uStack_104)) {
LAB_100024548:
ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  iVar6 = _strncmp(piVar14->ifa_name,"utun",4);
ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  bVar4 = iVar6 == 0; // if it's a VPN and not local, reject
ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  goto LAB_1000242fc;
ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  }
ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  }
ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  else if (uStack_f4 == uStack_10c) goto LAB_100024548;
ย  ย  ย  ย  ย  ย  ย  ย  ย  }
ย  ย  ย  ย  ย  ย  ย  ย  ย  else if (sVar3 == '\x1e') {
ย  ย  ย  ย  ย  ย  ย  ย  ย  ย  // IPv6 code, snipped out
ย  ย  ย  ย  ย  ย  ย  ย  ย  }
ย  ย  ย  ย  ย  ย  ย  ย  ย  // basically check if this IP falls in the subnet
ย  ย  ย  ย  ย  ย  ย  ย  ย  else if (((uStack_10c ^ uStack_f4) & *(uint *)(psVar15->sa_data + 2)) == 0)
ย  ย  ย  ย  ย  ย  ย  ย  ย  goto LAB_100024548; // see the comment above, we're rejcting
```

So yeah, looks very intentional. It's a half baked attempt at blocking us, but an attempt nonetheless. So now what?

1. If the VPN IP falls within a physical subnet, the connection will go through and we're good.

2. I've been putting a lot of effort into reverse engineering ``[redacted]`` the last few months, and it can serve as a viable replacement for all of this altogether. There's more work to do, but it at least exists.

So until we've written the code to either dynamically change VPN IPs or finish [redacted], don't update to 26.4.ย 

Thanks friends.

- dc official App