frida VS Lunar

Frida, uff this is just AMAZING, yes with uppercase and in bold letters. They also has bindings on different languages that can be found in their github repository. Spoiler alert...the Go binding it's pure shit...really couldn't run it. Use just the default that it's installed with pip install frida-tools.

A great framework for doing something along those lines is Frida (https://github.com/frida/frida). Works on a bunch of stuff, including Android and iOS. Some global-ish certificate pinning bypasses work through Frida, by patching http libraries to not raise exceptions, accept system certificates, etc and just quietly hum along instead. Certificate unpinning in turn enables network MITM with mitmproxy, which makes it a lot quicker and easier to inspect, block, or modify network traffic.

Funnily enough, I've seen much stronger obfuscation from reverse engineering from my cheap Tuya IoT devices app than from my bank app.

Install Frida from Github :- https://github.com/frida/frida

// see: https://github.com/frida/frida/issues/382

If anyone needs a "monkey" not for web pages but for any process on your computer system, may I recommend Frida:

https://frida.re

https://github.com/frida/frida

With Frida, you write JavaScript programs and inject them into arbitrary processes, to hook and modify and call whatever you please.

It gets a lot of use in the reverse engineering and vulnerability research communities, but has broader scope too. For instance, I used it recently to automate the UI of a video production program on Windows, by injecting a thread that sends window messages to the main message loop and hooks into various system dialog functions.

var android_log_write = new NativeFunction( Module.getExportByName(null, '__android_log_write'), 'int', ['int', 'pointer', 'pointer'] ); var tag = Memory.allocUtf8String("[frida-sript][ax]"); var work = function() { setTimeout(function() { android_log_write(3, tag, Memory.allocUtf8String("ping @ " + Date.now())); work(); }, 1000); } work(); // console.log does not seems to work. see: https://github.com/frida/frida/issues/382 console.log("console.log"); console.error("console.error"); console.warn("WARN"); android_log_write(3, tag, Memory.allocUtf8String(">--(O.o)-<)");

Go to https://github.com/frida/frida/releases and download the latest frida-server--android-arm64.xz. Extract it and run adb push frida-server--android-arm64 /sdcard/frida-server

It sounds like a kind of black magic:

> ...It’s a dynamic code instrumentation toolkit. It lets you inject snippets of JavaScript or your own library into native apps on Windows, macOS, GNU/Linux, iOS, Android, and QNX.

> ...Frida’s core is written in C and injects QuickJS into the target processes, where your JS gets executed with full access to memory, hooking functions and even calling native functions inside the process.

> There’s a bi-directional communication channel that is used to talk between your app and the JS running inside the target process.

Here's a description of the architecture:

https://frida.re/docs/hacking/

And the source:

https://github.com/frida/frida

---

Apparently using "wxWindows Library Licence, Version 3.1":

> This is essentially the LGPL, with an exception stating that derived works in binary form may be distributed on the user's own terms. This is a solution that satisfies those who wish to produce GPL'ed software using Frida, and also those producing proprietary software.

https://github.com/frida/frida/blob/master/COPYING

It’s done in a similar way on macOS: a dylib is added to the bundle and an LC_LOAD command is added to the app binary. The dylib is the first thing that runs because of using the constructor attribute, like this: https://notes.alinpanaitiu.com/Injecting%20a%20DYLIB%20into%...

The nice thing is that a signed app will refuse to load a dylib that does not have the same signature. So crackers will be forced to change the whole app signature which can be easily detected in app code.

I have that kind of protection in Lunar (https://lunar.fyi/) and Clop (https://lowtechguys.com/clop) and it seems to be good enough as they have no recent cracks.

Pretty sure Lunar [0] can do this for you, and you can buy a lifetime license.

[0]: https://lunar.fyi/

I've had good luck with the Lunar app - it manages my Dell and LG monitors on an M2. (No affiliation) https://lunar.fyi

Wild! I am working on exactly the same thing now for Lunar (https://lunar.fyi), and I'm also calling it Night Mode ^_^ what a coincidence

I've been trying to make "white regions in dark backgrounds" less painful for months, but doing that at the system level on macOS is incredibly hard. I see you're doing it with CSS filters, which make sense in the limited scope of an article. But applying something like that on the whole macOS UI would cause confusion.

I already use something similar on the iPhone: I read on the Kindle app which has white text on black background, then I have a full red Color Tint filter on the Triple Back Tap shortcut which I use before reading. Very similar effect to your solution, although I don't have images in my books.

I was comparing anti-piracy measures with DRM, I don't have actual DRM in my app. I can't block users that really bought the app from using it (which is what DRM is notorious for).

But I do have a license verification for the Pro features (https://lunar.fyi/#pro), and that is what people are cracking in the app. I only added more protection around this verification.

Lunar

There's no Reduce White Point on Mac as far as I am aware. However, you can use the fantastic Lunar [0] app to achieve this, as it supports "Sub-Zero Dimming".

To use it, I think you just need to start Lunar, and then press the Reduce Brightness button on your keyboard until it goes below the minimum Mac allows.

[0] https://lunar.fyi

As the dev of a macOS app that breaks all the time because of external hardware, the tone of the article hits close to home. (I’m talking about https://lunar.fyi/ whose brightness control commands can be blocked by USB-C hubs, “smart” monitors, too long cables etc.)

I had to disable public GitHub issues on the app repo [1] because people seemed to fuel each other with spiteful comments and “why can’t you just!!” sentences.

The contact form still attracts many such “entitled” people and it hurts to wake up to such messages, but at least I can choose to ignore those if I can’t bring anything to the discussion. There’s no peer pressure.

These people are expecting too much from a handful of developers who are sharing a lot of free work and time that could have been spent better than hunting new IDs in URLs and updating regular expressions.

[1] https://github.com/alin23/Lunar

Last year I bought a second computer for my music studio. I wanted to use the same set of 2 monitors and wired keyboard + trackpad on both machines.

I wrote simple scripts to switch my monitor inputs with keyboard shortcuts (even simpler with Lunar, amazing new Mac app — https://lunar.fyi), which saved me from having to press annoying input-source buttons.

But I couldn't for the life of me find a simple, suitable software controllable KVM switch. That still requires the hardware button to be controlled, so frustrating.

Some people like the process of writing code, more than the end result. I had a few months of that feeling, but nowadays it’s rarely about writing for me.

Just the other day I used Copilot to explain the disassembly of macOS KeyboardBacklight code, so that I can turn off the keyboard lights when using Lunar’s Blackout (https://lunar.fyi/#blackout)

It even helped me generate the ObjC function signatures from assembly and use the right calling convention in Swift afterwards. It really feels like magic.

I would have no joy in writing that code, it’s mostly bridging and translation anyway. I just need it to do this thing so that people can take advantage of it.