import Foundation

final class PaywallManager: ObservableObject {
    @Published var isPro = false

    // FLAW #1: the app trusts a plain JSON response
    // FLAW #2: no cert pinning, so any proxy can answer for your server
    // FLAW #3: "isPro" is just a local bool — whoever controls it wins
    func checkEntitlement() {
        let url = URL(string: "https://api.yourapp.dev/api/entitlement")!
        var req = URLRequest(url: url)
        req.setValue("Bearer \(savedToken())", forHTTPHeaderField: "Authorization")

        URLSession.shared.dataTask(with: req) { data, _, _ in
            guard let data,
                  let json = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
                  let pro = json["pro"] as? Bool else { return }

            DispatchQueue.main.async {
                self.isPro = pro          // whole paywall rides on this
            }
        }.resume()
    }

    private func savedToken() -> String {
        UserDefaults.standard.string(forKey: "auth_token") ?? ""
    }
}

// Your dummy backend — the honest version of this endpoint
app.get("/api/entitlement", async (req, res) => {
    const user = await getUserFromToken(req.headers.authorization);
    if (!user) return res.status(401).json({ error: "unauthorized" });

    // In the vulnerable version, "pro" comes straight from your DB flag
    // with no proof behind it. That's what makes the attack below work.
    res.json({ pro: user.isPro });
});

from mitmproxy import http
import json

TARGET_PATH = "/api/entitlement"

class PaywallCrack:
    def response(self, flow: http.HTTPFlow) -> None:
        if TARGET_PATH in flow.request.path:
            try:
                data = json.loads(flow.response.content)
                data["pro"] = True  # flip the flag the client trusts
                flow.response.content = json.dumps(data).encode()
                print(f"[+] Patched entitlement for {flow.request.pretty_url}")
            except Exception as e:
                print(f"[-] Could not patch: {e}")

addons = [PaywallCrack()]

# Terminal 1: start the proxy with the addon
mitmproxy -s crack_addon.py -p 8080

# Device setup:
# 1. Wi-Fi settings -> HTTP proxy -> your computer's IP, port 8080
# 2. Safari on device -> http://mitm.it -> install the CA cert
# 3. iOS 15+: Settings > General > About > Certificate Trust Settings
#    -> enable full trust for mitmproxy
# 4. Launch your dummy app -> premium unlocks instantly

#import 

// Hook the PaywallManager class from your own dummy app.
// Replace "YourDummyApp" with the actual module/class name
// (use %ctor + objc_getClass to confirm it exists).
%hook PaywallManager

- (BOOL)isPro {
    return YES;   // every read of the flag now returns premium
}

- (void)setIsPro:(BOOL)pro {
    %orig(YES);   // even if the server says false, it stays true
}

%end

%ctor {
    %init;
}

TARGET := iphone:clang:latest:14.0
INSTALL_TARGET_PROCESSES = YourDummyApp

include $(THEOS)/makefiles/common.mk

TWEAK_NAME = PaywallBypass

PaywallBypass_FILES = Tweak.x
PaywallBypass_CFLAGS = -fobjc-arc

include $(THEOS_MAKE_PATH)/tweak.mk

import Foundation
import StoreKit

final class PaywallManager: ObservableObject {
    @Published var isPro = false

    // StoreKit 2: transactions are cryptographically signed by Apple.
    // We send the signed payload to OUR server — the client never
    // decides anything on its own.
    func syncEntitlement() async {
        guard let token = savedToken() else { return }

        // Gather current entitlement transactions from StoreKit 2
        var signedTxns: [String] = []
        for await result in Transaction.currentEntitlements {
            if case .verified(let txn) = result {
                // txn.jsonRepresentation is the JWS the server will verify
                signedTxns.append(String(data: txn.jsonRepresentation(), encoding: .utf8) ?? "")
            }
        }

        var req = URLRequest(url: URL(string: "https://api.yourapp.dev/api/verify")!)
        req.httpMethod = "POST"
        req.setValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
        req.setValue("application/json", forHTTPHeaderField: "Content-Type")
        req.httpBody = try? JSONEncoder().encode(["transactions": signedTxns])

        // Pinned session — see PinnedSession below
        let (data, resp) = try? await PinnedSession.shared.data(for: req)
        guard let data, (resp as? HTTPURLResponse)?.statusCode == 200 else {
            isPro = false
            return
        }

        // Server returns a SIGNED entitlement token, short-lived.
        // Its presence means Apple's receipt checked out server-side.
        if let json = try? JSONDecoder().decode(EntitlementResponse.self, from: data) {
            isPro = json.isValid    // server-verified, not client-decided
            saveEntitlementToken(json.token)
        }
    }
}

// Certificate pinning: mitmproxy's CA is no longer trusted,
// killing Attack A. Note: this alone does NOT stop Attack B —
// which is exactly why the server-side checks above matter most.
final class PinnedSession: NSObject, URLSessionDelegate {
    static let shared = URLSession(configuration: .default, delegate: PinnedSession(), delegateQueue: nil)
    private let pinnedSPKI = "BASE64_SPKI_SHA256_OF_YOUR_CERT"  // ssl-pin-digest of your server cert

    func urlSession(_ session: URLSession, didReceive challenge: URLAuthenticationChallenge,
                    completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {
        guard let serverTrust = challenge.protectionSpace.serverTrust,
              SecTrustEvaluateWithError(serverTrust, nil) else {
            completionHandler(.cancelAuthenticationChallenge, nil); return
        }

        // Compare the server cert's SPKI hash to our pinned value
        var trust: SecTrust?
        SecTrustCopyAnchorCertificates(serverTrust) // (keep default eval)
        if let certs = SecTrustGetCertificateChain(serverTrust),
           let leaf = certs.first,
           let spkiData = spkiHash(of: leaf),
           spkiData == pinnedSPKI {
            completionHandler(.useCredential, URLCredential(trust: serverTrust))
        } else {
            completionHandler(.cancelAuthenticationChallenge, nil)
        }
    }

    private func spkiHash(of cert: SecCertificate) -> String? {
        // Extract SubjectPublicKeyInfo and SHA-256 it
        guard let der = SecCertificateCopyData(cert) as Data?,
              let spki = extractSPKI(from: der) else { return nil }
        return Data(SHA256.hash(data: spki)).base64EncodedString()
    }

    private func extractSPKI(from der: Data) -> Data? {
        // Parse the DER to pull out the public key info block
        // (use a small ASN.1 lib or Heimdall/SwiftSSL for brevity)
        return nil // implement with your ASN.1 parser of choice
    }
}

struct EntitlementResponse: Codable {
    let isValid: Bool
    let token: String
}

private func savedToken() -> String? {
    UserDefaults.standard.string(forKey: "auth_token")
}
private func saveEntitlementToken(_ t: String) {
    UserDefaults.standard.set(t, forKey: "entitlement_token")
}

// This is where the real check happens. The client can lie all it
// wants — this endpoint only trusts Apple's signature.
const { createPublicKey, verify, sign } = require("crypto");
const jwt = require("jsonwebtoken");

// Apple's root CA — fetch once and cache
// https://www.apple.com/certificateauthority/AppleRootCA-G3.cer
const APPLE_ROOT_PUB = loadAppleRootPublicKey();

app.post("/api/verify", async (req, res) => {
    const user = await getUserFromToken(req.headers.authorization);
    if (!user) return res.status(401).json({ error: "unauthorized" });

    const txns = req.body.transactions || [];
    let validPurchase = false;

    for (const jws of txns) {
        // 1. Verify the JWS signature against Apple's root cert chain
        //    (use a JWS lib like jose — it does the x5c chain check)
        const { payload, header } = await jose.compactVerify(jws, APPLE_ROOT_PUB)
            .catch(() => ({ payload: null }));
        if (!payload) continue;   // forged/garbage txn — ignore

        const txn = JSON.parse(payload);
        // 2. Confirm the txn belongs to THIS user's app + is not refunded
        if (txn.appAppleId === YOUR_APPLE_APP_ID && !txn.revocationDate) {
            validPurchase = true;
        }
    }

    // 3. Issue a short-lived SIGNED entitlement token
    const token = sign(
        { sub: user.id, pro: validPurchase, exp: Math.floor(Date.now()/1000) + 3600 },
        process.env.ENTITLEMENT_SECRET,
        { algorithm: "EdDSA" }   // Ed25519 — client can't forge this
    );

    res.json({ isValid: validPurchase, token });
});

// 4. Every premium API endpoint re-checks the token
function requirePro(req, res, next) {
    try {
        const claims = jwt.verify(req.headers["x-entitlement"], process.env.ENTITLEMENT_SECRET);
        if (claims.pro) return next();
    } catch (_) {}
    res.status(403).json({ error: "pro required" });
}

// Example: pro content is gated HERE, not by a hidden button
app.get("/api/pro-content", requirePro, async (req, res) => {
    res.json({ content: await loadProContent() });
});

max_hp = 5;
hp = max_hp;

function scr_take_damage(amount) {
    with (obj_player) {
        hp -= amount;
        if (hp <= 0) {
            hp = 0;
            room_restart();
        }
    }
}

for (var i = 0; i < max_hp; i++) {
    var xx = 20 + (i * 28);
    var yy = 20;
    if (i < hp) {
        draw_sprite(spr_heart_full, 0, xx, yy);
    } else {
        draw_sprite(spr_heart_empty, 0, xx, yy);
    }
}

import SwiftUI

struct CustomTabBar: View {
    @Binding var selected: Int
    let tabs = ["house.fill", "gamecontroller.fill", "person.fill"]
    let labels = ["Home", "Games", "Profile"]

    var body: some View {
        HStack {
            ForEach(0..