[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-83329":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":9,"language":10,"languages":9,"totalLinesOfCode":9,"stars":11,"forks":12,"watchers":13,"openIssues":14,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":16,"stars7d":17,"stars30d":17,"stars90d":15,"forks30d":15,"starsTrendScore":18,"compositeScore":19,"rankGlobal":9,"rankLanguage":9,"license":20,"archived":21,"fork":21,"defaultBranch":22,"hasWiki":23,"hasPages":21,"topics":24,"createdAt":9,"pushedAt":9,"updatedAt":25,"readmeContent":26,"aiSummary":9,"trendingCount":15,"starSnapshotCount":15,"syncStatus":27,"lastSyncTime":28,"discoverSource":29},83329,"cyanide","zeroxjf\u002Fcyanide","zeroxjf","Cyanide — iOS tweak runner built on top of the DarkSword kernel r\u002Fw exploit",null,"Objective-C",148,15,1,34,0,6,46,31,3.61,"GNU Affero General Public License v3.0",false,"main",true,[],"2026-06-12 02:04:33","\u003Cp align=\"center\">\n  \u003Cimg src=\"https:\u002F\u002Fraw.githubusercontent.com\u002Fzeroxjf\u002Fcyanide\u002Fmain\u002FCyanide\u002FAssets.xcassets\u002FAppIcon.appiconset\u002Ficon-ios-1024x1024.png\" alt=\"Cyanide\" width=\"160\">\n\u003C\u002Fp>\n\n\u003Ch1 align=\"center\">Cyanide\u003C\u002Fh1>\n\n**By [@zeroxjf](https:\u002F\u002Fgithub.com\u002Fzeroxjf) and [d1y](https:\u002F\u002Fx.com\u002Fchenhonzhou)** — an iOS tweak runner built on top of the DarkSword kernel r\u002Fw primitive.\n\nCyanide is a fork of [`wh1te4ever\u002Fdarksword-kexploit-fun`](https:\u002F\u002Fgithub.com\u002Fwh1te4ever\u002Fdarksword-kexploit-fun)\nfor iOS kernel research. It wraps the native DarkSword kernel stages in an\nObjective-C iOS app, restructures the UI as an Installer\u002FSettings split, and\nadds a few reliability fixes for repeated local testing. It does not ship\nthe browser-delivered WebKit\u002Fdyld parts of the original DarkSword chain.\n\n## Install\n\nOpen this page on your iPhone\u002FiPad and tap one of the buttons below.\n\n\u003Cp align=\"center\">\n  \u003Ca href=\"https:\u002F\u002Fcelloserenity.github.io\u002Faltdirect\u002F?url=https:\u002F\u002Fraw.githubusercontent.com\u002Fzeroxjf\u002Fcyanide\u002Fmain\u002Fsource.json\" target=\"_blank\">\n    \u003Cimg src=\"https:\u002F\u002Fgithub.com\u002FCelloSerenity\u002Faltdirect\u002Fblob\u002Fmain\u002Fassets\u002Fpng\u002FAltSource_Blue.png?raw=true\" alt=\"Add AltSource\" width=\"200\">\n  \u003C\u002Fa>\n  \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fzeroxjf\u002Fcyanide\u002Freleases\u002Flatest\" target=\"_blank\">\n    \u003Cimg src=\"https:\u002F\u002Fgithub.com\u002FCelloSerenity\u002Faltdirect\u002Fblob\u002Fmain\u002Fassets\u002Fpng\u002FDownload_Blue.png?raw=true\" alt=\"Download .ipa\" width=\"200\">\n  \u003C\u002Fa>\n\u003C\u002Fp>\n\n## Feedback\n\n- [Report a bug](https:\u002F\u002Fgithub.com\u002Fzeroxjf\u002Fcyanide\u002Fissues\u002Fnew?template=bug_report.yml)\n- [Request a feature](https:\u002F\u002Fgithub.com\u002Fzeroxjf\u002Fcyanide\u002Fissues\u002Fnew?template=feature_request.yml)\n- [Join the Signal group](https:\u002F\u002Fsignal.group\u002F#CjQKIP0pxjc9V52ddCNk--04DosuoQl-vVOsznJfQ4GwlrlxEhCveFhBS8YdNcILpUFt7IqC) for setup help, support,\n  test notes, and rough ideas before they become issues.\n\n## Patreon\n\nEarly access to experimental tweaks (Dynamic Stage Lite, Signal Readouts,\nTypeBanner, Location Simulator, Call Recording Sound, and future work) is\navailable to [Patreon supporters](https:\u002F\u002Fwww.patreon.com\u002Fzeroxjf) at the\nMember tier and above.\n\n## Tweaks\n\nThese tweaks have been tested on iOS 18.x and 26.x. Expect version drift in\nSpringBoard and related daemons to break things on other releases.\n\n### Status Bar\n\n- **StatBar**: battery temperature and free-RAM overlay anchored to the\n  SpringBoard status bar, with optional C\u002FF and network-speed display.\n- **NSBar**: compact live download\u002Fupload speed overlay for the status bar,\n  with selectable corner\u002Fcenter positions. Ported from\n  [`d1y\u002Fcyanide-ios`](https:\u002F\u002Fgithub.com\u002Fd1y\u002Fcyanide-ios).\n- **NiceBar Lite**: configurable status-bar-adjacent labels for custom text,\n  date\u002Ftime formats, battery, memory, traffic, uptime, IP address, disk,\n  thermal state, and other live readouts. Ported from\n  [`d1y\u002Fcyanide-ios`](https:\u002F\u002Fgithub.com\u002Fd1y\u002Fcyanide-ios).\n\n### Home Screen Layout\n\n- **SBCustomizer**: dock icon count, home-screen columns\u002Frows, and hidden icon\n  labels. Native port of the lightsaber sbcustomizer payload.\n- **Home Layout Extras**: extra padding around the home grid and dock, plus\n  per-icon scale for home and dock icons. Stacks on top of SBCustomizer.\n\n### Performance\n\n- **Powercuff**: CPU\u002FGPU underclocking through simulated `thermalmonitord`\n  pressure levels (off, nominal, light, moderate, heavy). Lasts until reboot.\n  Port of [`rpetrich\u002FPowercuff`](https:\u002F\u002Fgithub.com\u002Frpetrich\u002FPowercuff).\n\n### SpringBoard Tweaks\n\nPorted from [`kolbicz\u002FDarkSword-Tweaks`](https:\u002F\u002Fgithub.com\u002Fkolbicz\u002FDarkSword-Tweaks):\n\n- **Disable App Library**: removes the App Library page past the last home screen.\n- **Disable Icon Fly-In**: skips the spring-in animation when icons appear.\n- **Zero Wake Animation**: snaps the display on instantly when waking.\n- **Zero Backlight Fade**: instant lock\u002Funlock backlight.\n- **Double-Tap to Lock**: lock the device with a wallpaper double-tap.\n\n### System Updates\n\n- **Disable OTA Updates**: toggles the launchd OTA `disabled.plist` to block or\n  unblock update prompts. Persists across reboots.\n\n### Beta\n\n> ⚠︎ Work in progress — these work but may change or need re-applying between builds.\n\n- **Gravity Lite**: core port of Julio Verne's classic Gravity tweak. Applies\n  UIDynamicAnimator physics to home-screen and dock icons — gravity, collisions,\n  bounce, friction, accelerometer steering, shake pulses, and an explosion\n  button. Use Restore Icon Layout if icons stay displaced after deactivating.\n- **Axon Lite**: groups Notification Center requests by app with a SpringBoard\n  overlay and dedups duplicates while the RemoteCall session is alive.\n- **Cyanide Themer**: per-bundle icon theme engine. Walks SpringBoard's\n  SBIconView hierarchy and swaps each icon's image with a PNG matched on bundle\n  ID. Ships with iOS 6 Theme; also accepts a custom folder of `\u003CbundleID>.png`\n  files or a binary plist. Pick a theme in Settings before running.\n- **SnowBoard Lite**: imports SnowBoard\u002FIconBundles-style theme folders or\n  archives into Cyanide's local theme library, then applies the selected theme\n  through the existing icon replacement pipeline. Ported from\n  [`d1y\u002Fcyanide-ios`](https:\u002F\u002Fgithub.com\u002Fd1y\u002Fcyanide-ios).\n- **LiveWP**: copies a selected MP4\u002FMOV\u002FM4V into Cyanide's app container and\n  plays it behind SpringBoard's home and lock screen windows while the live\n  RemoteCall session is active. Ported from\n  [`d1y\u002Fcyanide-ios`](https:\u002F\u002Fgithub.com\u002Fd1y\u002Fcyanide-ios).\n- **Watch Pairing Override**: edits the watchOS pairing range stored on the\n  iPhone so you can pair a newer Apple Watch or revive an older one. Persists\n  across reboots; respring before pairing.\n\n### Experimental\n\n> ⚠︎ Unstable or in-development — require Experimental Tweaks to be enabled in Settings.\n>\n> Experimental tweaks ship early to [Patreon supporters](https:\u002F\u002Fwww.patreon.com\u002Fzeroxjf) before public release.\n\n- **Dynamic Stage Lite**: brings Stage Manager-style split-view to iPhone over\n  RemoteCall — no jailbreak required. Hosts a second app's scene alongside\n  SpringBoard using the same scene-hosting design as [`tomt000`'s Dynamic Stage](https:\u002F\u002Fhavoc.app\u002Fpackage\u002Fdynamicstage).\n- **Signal Readouts**: replaces the signal-strength glyphs with live numeric\n  readouts — RSRP dBm on cellular, bar count on WiFi.\n- **TypeBanner**: shows a pill banner below the Dynamic Island when the active\n  Messages conversation shows a typing indicator. Detection fires only while\n  Messages.app is running.\n- **Location Simulator**: drives Apple's CoreLocation simulation path from a\n  RemoteCall host process and sets a static target coordinate. Simulated\n  locations may violate app terms, platform rules, game rules, ride-share or\n  delivery policies, or local law depending on how they are used. Use only where\n  you have permission; you are responsible for your use and apply or restore it\n  at your own risk. It may also affect location-tied system behavior such as\n  time zone\u002Fdate\u002Ftime handling and can have unintended consequences; only use it\n  if you know what you're doing. Credits: `kolbicz` provided the\n  RemoteCall\u002FCLSimulationManager GPS spoofer prototype, and `ezzuldinSt`'s\n  LSpoof provided the app-side spoofing, picker, bookmarks, and route-simulation\n  reference.\n- **Call Recording Sound**: replaces the CallServices\n  `StartDisclosureWithTone` and `StopDisclosure` audio files with Cyanide's\n  bundled silent payloads, with separate Silence and Restore actions. Cyanide\n  backs up the first originals into its app container before replacement, but\n  this is still a persistent system-file edit under\n  `\u002Fvar\u002Fmobile\u002FLibrary\u002FCallServices\u002FGreetings\u002Fdefault`. Disclosure sounds may be\n  legally required where you live; you are responsible for your use and should\n  restore the originals before removing Cyanide if you want Cyanide's backups\n  written back. Credits: `YangJiiii` (`@duongduong0908`) for the EnsWilde and\n  Disable Call Recording BookRestore reference tools, and `@Little_34306` as\n  credited by the original projects for the Disable Call Recording concept.\n\n## Supported Targets\n\nTested target range:\n\n- iOS\u002FiPadOS 17.0 through 18.7.1\n- iOS\u002FiPadOS 26.0 through 26.0.1\n- A19\u002FM5 devices are not supported\n\nThe kernel bugs used here, `CVE-2025-43510` and `CVE-2025-43520`, were fixed in\niOS\u002FiPadOS 18.7.2 and 26.1. Later builds are outside this kernel exploit window.\n\n## What This Fork Changes\n\n- Cleans shared exploit state before each attempt.\n- Matches the target process with an explicit marker.\n- Validates sockets before using the spray path.\n- Treats missed races as retryable failures instead of hard failures.\n- Tightens the A18\u002FM4 `pe_v2` path with initialized target-file contents,\n  stable local remap addresses, bounded page freeing, socket-spray preflight\n  checks, and controlled zone-trim retries.\n\n## Kernel Research Features\n\n- Escape the app sandbox.\n- Control or crash userspace processes from the app.\n- Change UID, GID, and sticky bits on target files.\n- Disable ASLR by setting `P_DISABLE_ASLR` in `launchd`'s `proc->p_flag`.\n\n## Credits\n\n- [`opa334`](https:\u002F\u002Fgithub.com\u002Fopa334): original [`darksword-kexploit`](https:\u002F\u002Fgithub.com\u002Fopa334\u002Fdarksword-kexploit), ChOma, and XPF — the kernel r\u002Fw primitive Cyanide is built on.\n- [`wh1te4ever`](https:\u002F\u002Fgithub.com\u002Fwh1te4ever): [`kfun` \u002F `darksword-kexploit-fun`](https:\u002F\u002Fgithub.com\u002Fwh1te4ever\u002Fdarksword-kexploit-fun) — the RemoteCall implementation that lets a sideloaded app apply tweaks inside SpringBoard. Cyanide is a fork of this project.\n- [`rooootdev`](https:\u002F\u002Fgithub.com\u002Frooootdev): working kexploit behavior used to stabilize this fork.\n- [`neonmodder123`](https:\u002F\u002Fgithub.com\u002Fneonmodder123): Web Respring method.\n- [`kolbicz`](https:\u002F\u002Fgithub.com\u002Fkolbicz): OTA Disabler, SpringBoard tweaks, and\n  the RemoteCall\u002FCLSimulationManager GPS spoofer prototype used as the starting\n  point for Location Simulator.\n- `ezzuldinSt`: LSpoof app-side `CLLocationManager` spoofing, picker,\n  bookmarks, and route-simulation reference used while shaping Location\n  Simulator.\n- `YangJiiii` (`@duongduong0908`): EnsWilde and Disable Call Recording\n  BookRestore reference tools used while shaping Call Recording Sound.\n- `@Little_34306`: credited by the original call-recording projects for the\n  Disable Call Recording concept.\n- [`rpetrich`](https:\u002F\u002Fgithub.com\u002Frpetrich): Powercuff.\n- [Julio Verne](https:\u002F\u002Fgithub.com\u002Fjulioverne): the original [Gravity](https:\u002F\u002Fgithub.com\u002Fjulioverne\u002FGravity) tweak that Gravity Lite is a core port of.\n- [`d1y`](https:\u002F\u002Fx.com\u002Fchenhonzhou): [`cyanide-ios`](https:\u002F\u002Fgithub.com\u002Fd1y\u002Fcyanide-ios)\n  AGPL-3.0 sources used for the NSBar, NiceBar Lite, SnowBoard Lite, and\n  LiveWP ports.\n- [`tomt000`](https:\u002F\u002Fgithub.com\u002Ftomt000): [Dynamic Stage](https:\u002F\u002Fhavoc.app\u002Fpackage\u002Fdynamicstage) — the original Stage Manager-for-iPhone tweak whose split-view + scene-hosting design Dynamic Stage Lite re-implements over RemoteCall.\n\n### UI inspiration\n\n- The classic [Installer.app](https:\u002F\u002Fgithub.com\u002FAppTapp\u002FInstaller-3) (Ripdev & Nullriver Software, now maintained by AppTapp and the Legacy Jailbreak community) — the iPhoneOS 1 package-manager look that the Cyanide Installer tab is modeled after.\n- The [Sileo Project](https:\u002F\u002Fgithub.com\u002FSileo\u002FSileo) (the Sileo Team) — the queue → review → confirm install flow and the bottom queue-popup pattern.\n\n## Build\n\n```sh\n.\u002Fscripts\u002Fbuild.sh\n```\n\nThe build script uses the `Cyanide` scheme, disables code signing, and writes\nan unsigned IPA to:\n\n```text\nbuild\u002FCyanide.ipa\n```\n\nEquivalent manual build:\n\n```sh\nxcodebuild \\\n  -project Cyanide.xcodeproj \\\n  -scheme Cyanide \\\n  -sdk iphoneos \\\n  -configuration Debug \\\n  CODE_SIGNING_ALLOWED=NO \\\n  build\n```\n\n## License\n\nThe open-source portion of this repository — everything outside the\n`Cyanide\u002Ftweaks\u002Fprivate\u002F` submodule — is licensed under **AGPL-3.0**.\nSee `LICENSE`.\n\nThe NSBar, NiceBar Lite, SnowBoard Lite, and LiveWP ports adapt AGPL-3.0 code\nfrom [`d1y\u002Fcyanide-ios`](https:\u002F\u002Fgithub.com\u002Fd1y\u002Fcyanide-ios) and remain in the\nAGPL-covered public tree.\n\nThe `Cyanide\u002Ftweaks\u002Fprivate\u002F` submodule points at a separate private\nrepository containing the closed-source experimental tweak\nimplementations. Those files are\n**All Rights Reserved**, distributed in compiled form only inside\nofficial Cyanide releases, and gated to active Patreon supporters at the\nMember tier or above. Public clones won't be able to fetch the\nsubmodule, and the experimental tweaks will be absent from local builds\nunless you re-implement them. The public app target still builds without\nthat submodule.\n",2,"2026-06-11 04:10:57","CREATED_QUERY"]