How does SimulateTouch click on my app when injecting into Springboard

[lengfeng222]

#import "TouchSimulator.h"
#import <UIKit/UIApplication.h>
#import <dlfcn.h>

static void postEvent(IOHIDEventRef event);
static void execute();
static IOHIDEventRef parent = NULL;

void simulateTouch(int type, float x, float y) {
if (parent == NULL) {
parent = IOHIDEventCreateDigitizerEvent(kCFAllocatorDefault,
mach_absolute_time(),
kIOHIDDigitizerTransducerTypeHand,
0,
0,
kIOHIDDigitizerEventTouch,
0,
0.0,
0.0,
0.0,
0.0,
0.0,
0,
true,
0
);
IOHIDEventSetIntegerValue(parent, kIOHIDEventFieldDigitizerIsDisplayIntegrated, 1);
}

uint32_t isTouch = type == TOUCH_UP ? 0 : 1;
IOHIDDigitizerEventMask eventMask = 0;
if (type != TOUCH_UP && type != TOUCH_DOWN)
    eventMask |= kIOHIDDigitizerEventPosition;
if (type == TOUCH_UP || type == TOUCH_DOWN)
    eventMask |= (kIOHIDDigitizerEventTouch | kIOHIDDigitizerEventRange);

IOHIDEventRef child = IOHIDEventCreateDigitizerFingerEvent(kCFAllocatorDefault, mach_absolute_time(), 1, 3, eventMask, x, y, 0.0f, 0.0f, 0.0f, isTouch, isTouch, 0);
IOHIDEventSetFloatValue(child, kIOHIDEventFieldDigitizerMajorRadius, 0.04f);
IOHIDEventSetFloatValue(child, kIOHIDEventFieldDigitizerMinorRadius, 0.04f);
IOHIDEventAppendEvent(parent, child);

execute();

}

static UIWindow* getKeyWindow() {
for (UIWindow *window in [UIApplication sharedApplication].windows) {
if (window.isKeyWindow) {
return window;
}
}
return NULL;
}

static void postEvent(IOHIDEventRef event) {
static IOHIDEventSystemClientRef ioSystemClient = nil;
UIWindow* keyWindow = getKeyWindow();
NSLog(@"���� ��%@",keyWindow);
if (ioSystemClient == NULL) {
ioSystemClient = IOHIDEventSystemClientCreate(kCFAllocatorDefault);
}
if (event != NULL && keyWindow != NULL) {
uint32_t contextID = keyWindow._contextId;
void handle = dlopen("/System/Library/PrivateFrameworks/BackBoardServices.framework/BackBoardServices", RTLD_NOW);
if (handle) {
typedef void ( BKSHIDEventSetDigitizerInfoType)(IOHIDEventRef,uint32_t,uint8_t,uint8_t,CFStringRef,CFTimeInterval,float);

        BKSHIDEventSetDigitizerInfoType digitizer = (BKSHIDEventSetDigitizerInfoType)dlsym(handle, "BKSHIDEventSetDigitizerInfo");
        digitizer(event, contextID, false, false, NULL, 0, 0);
        [[UIApplication sharedApplication] _enqueueHIDEvent:event];
    }
}
IOHIDEventSetSenderID(event, kIOHIDEventDigitizerSenderID);
IOHIDEventSystemClientDispatchEvent(ioSystemClient, event);

}

static void execute() {
IOHIDEventSetIntegerValue(parent, kIOHIDEventFieldDigitizerTiltX, kIOHIDDigitizerTransducerTypeHand);
IOHIDEventSetIntegerValue(parent, kIOHIDEventFieldDigitizerTiltY, 1);
IOHIDEventSetIntegerValue(parent, kIOHIDEventFieldDigitizerAltitude, 1);
postEvent(parent);
CFRelease(parent);
parent = NULL;
}

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[lengfeng222]

I have set a senderlD for touch events, but the system considers it invalid. When I obtain a system senderlD, it conflicts with my code. Can I hook this validation to make the senderlD valid, or make it non-conflicting? This is for touch events. Solution is paid.

…

------------------ Original ------------------ From: Argentium ***@***.***&gt; Date: Sun,Aug 11,2024 11:39 AM To: community/community ***@***.***&gt; Cc: lengfeng222 ***@***.***&gt;, Author ***@***.***&gt; Subject: Re: [community/community] How does SimulateTouch click on my app wheninjecting into Springboard (Discussion #127485) Touch Event Creation The simulateTouch function creates an IOHIDEventRef event that simulates a digitizer (touch screen) interaction. It uses IOHIDEventCreateDigitizerEvent to create a parent event representing a hand transducer (a generic touch event). It then creates a child event using IOHIDEventCreateDigitizerFingerEvent, representing a finger interacting with the screen. The coordinates (x, y) specify where the touch is happening. Touch Type and Event Mask The simulateTouch function checks the type of touch event (e.g., TOUCH_UP, TOUCH_DOWN, etc.) and sets the appropriate flags (eventMask) and parameters. TOUCH_UP means lifting the finger, and TOUCH_DOWN means pressing on the screen. Window Context Identification The getKeyWindow function retrieves the current key window, which is the window that is currently receiving touch events. This is important because the touch event needs to be targeted at the correct window. Posting the Event The postEvent function sends the generated touch event to the iOS event system. It first gets the context ID of the key window, which is necessary to route the touch event correctly. The code dynamically loads the BackBoardServices framework to use the private BKSHIDEventSetDigitizerInfo function, which is used to configure the touch event with the context ID of the target window. The event is then dispatched using the _enqueueHIDEvent: method from the UIApplication class. Final Execution The execute function finalizes the event by setting additional properties like tilt and altitude before sending it through the postEvent function. — Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***&gt;

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬