init

Author: Fl0rk

.gitignore

@@ -0,0 +1,3 @@
+.theos/
+packages/
+.DS_Store

Makefile

@@ -0,0 +1,11 @@
+TARGET := iphone:clang:latest:latest
+DEBUG = 0
+
+include $(THEOS)/makefiles/common.mk
+
+TWEAK_NAME = ScreenProtectorKit-Spoof
+
+ScreenProtectorKit-Spoof_FILES = Tweak.x
+ScreenProtectorKit-Spoof_CFLAGS = -fobjc-arc
+
+include $(THEOS_MAKE_PATH)/tweak.mk

README.md

@@ -0,0 +1,95 @@
+# ScreenProtectorKit Spoof
+
+A Logos tweak to spoof screenshot and screen recording protections in [ScreenProtectorKit](https://github.com/prongbang/ScreenProtectorKit).
+
+## Analysis
+
+To understand how the library blocks screen capture, inspect the compiled Mach-O binary with a disassembler. Then search for the `ScreenProtectorKit` namespace to identify its core API.
+
+![image0](img/img0.png)
+
+By looking at related iOS system APIs, we can identify three defense layers used by the library:
+
+1. **The Visual Layer (`UITextField`):** The library uses the common `setSecureTextEntry:` trick to hide the app UI during screenshots or screen recording.
+
+![image1](img/img1.png)
+
+2. **The Active Check Layer (`UIScreen`):** The `screenIsRecording()` function checks `[UIScreen mainScreen].isCaptured` directly to detect whether the screen is being recorded.
+
+![image2](img/img2.png)
+
+3. **The Event Detection Layer (`NSNotificationCenter`):** The `screenshotObserver(using:)` and `screenRecordObserver(using:)` functions show that the library listens for screenshot and screen recording notifications through `NSNotificationCenter` and forwards them to the Flutter layer.
+
+![image3](img/img3.png)
+
+## The Spoof
+
+To disable these protections, all three layers need to be handled separately. Hooking the usual `addObserver:selector:` is not enough here, because the library uses block-based observers instead.
+
+Below is a breakdown of the Logos tweak (`Tweak.x`) and how it targets each layer.
+
+### 1. Visual Layer (`UITextField`)
+
+The library hides the app UI behind a secure text field so iOS will black out the screen. We spoof this by forcing `setSecureTextEntry:` to always use `NO`. We also spoof the getter in case the app checks the UI state.
+
+```objective-c
+%hook UITextField
+
+- (void)setSecureTextEntry:(BOOL)secure {
+    %orig(NO);
+}
+
+- (BOOL)isSecureTextEntry {
+    return NO;
+}
+
+%end
+```
+
+### 2. Active Check Layer (`UIScreen`)
+
+The app also checks whether screen recording is active. We spoof `isCaptured` to always return `NO`, so the app always thinks screen recording is inactive.
+
+```objective-c
+%hook UIScreen
+
+- (BOOL)isCaptured {
+    return NO;
+}
+
+%end
+```
+
+### 3. Event Detection Layer (`NSNotificationCenter`)
+
+The library reports screenshot and screen recording events to the Flutter layer. We spoof this by returning `nil` during observer registration, so the event handler cannot run.
+
+```objective-c
+%hook NSNotificationCenter
+
+- (id)addObserverForName:(NSNotificationName)name object:(id)obj queue:(NSOperationQueue *)queue usingBlock:(void (^)(NSNotification *note))block {
+    
+    if ([name isEqualToString:UIApplicationUserDidTakeScreenshotNotification] ||
+        [name isEqualToString:UIScreenCapturedDidChangeNotification]) {
+        return nil; 
+    }
+    
+    return %orig;
+}
+
+%end
+```
+
+## Example with `CLICK-Ed`
+
+Spoof successful, with screenshots and screen recording working normally and no black screen.
+
+![image4](img/img4.png)
+
+## Usage
+
+Use [Sideloadly](https://sideloadly.io/) to inject the dylib into the `.ipa`.
+
+## Disclaimer
+
+This project is for educational and research purposes only.

ScreenProtectorKit-Spoof.plist

@@ -0,0 +1 @@
+{ Filter = { Bundles = ( "realjobscomltd.clickqa" ); }; }

Tweak.x

@@ -0,0 +1,43 @@
+#import <UIKit/UIKit.h>
+
+%hook UITextField
+
+// 1. Bypass the Visual Layer: Prevent iOS from applying the black/blur privacy screen
+- (void)setSecureTextEntry:(BOOL)secure {
+    %orig(NO);
+}
+
+// Spoof the getter just in case the app validates the UI state
+- (BOOL)isSecureTextEntry {
+    return NO;
+}
+
+%end
+
+%hook UIScreen
+
+// 2. Bypass the Active Polling Layer: Force the system to report that no recording is active
+- (BOOL)isCaptured {
+    return NO;
+}
+
+%end
+
+%hook NSNotificationCenter
+
+// 3. Bypass the Event Layer: Intercept block-based observer registrations
+- (id)addObserverForName:(NSNotificationName)name object:(id)obj queue:(NSOperationQueue *)queue usingBlock:(void (^)(NSNotification *note))block {
+    
+    // If the app tries to listen for screenshot or screen recording events, drop it
+    if ([name isEqualToString:UIApplicationUserDidTakeScreenshotNotification] ||
+        [name isEqualToString:UIScreenCapturedDidChangeNotification]) {
+        
+        // Return nil to provide an invalid observer token. The closure will never execute.
+        return nil; 
+    }
+    
+    return %orig;
+}
+
+%end
+

control

@@ -0,0 +1,9 @@
+Package: com.fl0rk.screenprotectorkit-spoof
+Name: ScreenProtectorKit-Spoof
+Version: 0.0.1
+Architecture: iphoneos-arm
+Description: Spoof screen recording detection!
+Maintainer: Fl0rk
+Author: Fl0rk
+Section: Tweaks
+Depends: mobilesubstrate (>= 0.9.5000)