maybe fix

Author: jurre111

lara/kexploit/pe/rc.m

@@ -541,6 +541,7 @@ int enable_debug_overlay(RemoteCall *proc) {
     uint64_t clsUIApplication = remote_getClass(proc, "UIApplication");
     uint64_t clsUITapGestureRecognizer = remote_getClass(proc, "UITapGestureRecognizer");
     uint64_t clsUIWindow = remote_getClass(proc, "UIWindow");
+    uint64_t clsUIViewController = remote_getClass(proc, "UIViewController");
 
     if (!clsDebugOverlayWindow) {
         printf("(rc) UIDebuggingInformationOverlay class not found\n");
@@ -550,20 +551,34 @@ int enable_debug_overlay(RemoteCall *proc) {
     uint64_t selInit = remote_sel(proc, "init");
     uint64_t selOverlay = remote_sel(proc, "overlay");
     uint64_t selPrepare = remote_sel(proc, "prepareDebuggingOverlay");
+    uint64_t selOverlayStatus = remote_sel(proc, "overlayStatus");
     uint64_t selPerform = remote_sel(proc, "performSelectorOnMainThread:withObject:waitUntilDone:");
 
-    // 1. Swizzle -[UIDebuggingInformationOverlay init] to -[UIWindow init] to bypass internal check
+    // 1. Get return 1 gadget from UIViewController _canShowWhileLocked
+    if (clsUIViewController) {
+        uint64_t selReturn1 = remote_sel(proc, "_canShowWhileLocked");
+        uint64_t methodReturn1 = RemoteArbCall(proc, class_getInstanceMethod, clsUIViewController, selReturn1);
+        uint64_t return1Imp = RemoteArbCall(proc, method_getImplementation, methodReturn1);
+        
+        // 2. Swizzle +[UIDebuggingInformationOverlay overlayStatus] to return 1 (YES)
+        uint64_t methodOverlayStatus = RemoteArbCall(proc, class_getClassMethod, clsDebugOverlayWindow, selOverlayStatus);
+        if (methodOverlayStatus && return1Imp) {
+            RemoteArbCall(proc, method_setImplementation, methodOverlayStatus, (uint64_t)return1Imp);
+        }
+    }
+    
+    // 3. Swizzle -[UIDebuggingInformationOverlay init] to -[UIWindow init] to bypass internal check
     uint64_t methodWindowInit = RemoteArbCall(proc, class_getInstanceMethod, clsUIWindow, selInit);
     uint64_t methodOverlayInit = RemoteArbCall(proc, class_getInstanceMethod, clsDebugOverlayWindow, selInit);
     uint64_t impWindowInit = RemoteArbCall(proc, method_getImplementation, methodWindowInit);
     if (methodOverlayInit && impWindowInit) {
         RemoteArbCall(proc, method_setImplementation, methodOverlayInit, impWindowInit);
     }
 
-    // 2. Call +[UIDebuggingInformationOverlay prepareDebuggingOverlay] to prevent UIDebuggingInformationOverlayNotPrepared exception
+    // 4. Call +[UIDebuggingInformationOverlay prepareDebuggingOverlay]
     remote_msg(proc, clsDebugOverlayWindow, selPerform, selPrepare, 0, 1, 0);
 
-    // 3. Get or allocate overlay window
+    // 5. Get or allocate overlay window
     remote_msg(proc, clsDebugOverlayWindow, selPerform, selOverlay, 0, 1, 0);
     uint64_t debugOverlay = remote_msg(proc, clsDebugOverlayWindow, selOverlay, 0, 0, 0, 0);
     if (!debugOverlay) {
@@ -572,26 +587,46 @@ int enable_debug_overlay(RemoteCall *proc) {
             debugOverlay = remote_msg(proc, debugOverlay, selInit, 0, 0, 0, 0);
         }
     }
-    
-    // 4. Set windowScene
+
+    if (!debugOverlay) {
+        printf("(rc) Failed to obtain UIDebuggingInformationOverlay instance\n");
+        return -1;
+    }
+
+    // 6. Ensure rootViewController is NEVER nil (prevents app crash when UIWindow is unhidden!)
+    uint64_t selRootVC = remote_sel(proc, "rootViewController");
+    uint64_t selSetRootVC = remote_sel(proc, "setRootViewController:");
+    uint64_t rootVC = remote_msg(proc, debugOverlay, selRootVC, 0, 0, 0, 0);
+    if (!rootVC) {
+        uint64_t clsRootTVC = remote_getClass(proc, "UIDebuggingInformationRootTableViewController");
+        if (!clsRootTVC) clsRootTVC = remote_getClass(proc, "UIDebuggingInformationOverlayViewController");
+        if (!clsRootTVC) clsRootTVC = clsUIViewController;
+        
+        if (clsRootTVC) {
+            uint64_t newRootVC = RemoteArbCall(proc, objc_alloc, clsRootTVC);
+            newRootVC = remote_msg(proc, newRootVC, selInit, 0, 0, 0, 0);
+            if (newRootVC) {
+                remote_msg(proc, debugOverlay, selPerform, selSetRootVC, newRootVC, 1, 0);
+            }
+        }
+    }
+
+    // 7. Set windowScene
     uint64_t mainWindowScene = get_main_window_scene(proc);
     if (debugOverlay && mainWindowScene) {
         uint64_t selSetWindowScene = remote_sel(proc, "setWindowScene:");
         remote_msg(proc, debugOverlay, selPerform, selSetWindowScene, mainWindowScene, 1, 0);
     }
 
-    // 5. Show overlay window immediately
+    // 8. Show overlay window
     if (debugOverlay) {
         uint64_t selSetHidden = remote_sel(proc, "setHidden:");
-        uint64_t selMakeKeyAndVisible = remote_sel(proc, "makeKeyAndVisible");
         uint64_t selToggle = remote_sel(proc, "toggleVisibility");
-        
-        remote_msg(proc, debugOverlay, selPerform, selSetHidden, 0, 1, 0);
-        remote_msg(proc, debugOverlay, selPerform, selMakeKeyAndVisible, 0, 1, 0);
+        remote_msg(proc, debugOverlay, selPerform, selSetHidden, 0, 1, 0); // setHidden:NO
         remote_msg(proc, debugOverlay, selPerform, selToggle, 0, 1, 0);
     }
 
-    // 6. Register gesture recognizer to status bar and main window
+    // 9. Register activation gesture recognizers to status bar and main window
     if (clsDebugOverlayHandler && clsUITapGestureRecognizer) {
         uint64_t selMainHandler = remote_sel(proc, "mainHandler");
         uint64_t selSharedInstance = remote_sel(proc, "sharedInstance");