tkgstratorandClaude Sonnet 4.6 07a88cd808 feat(tweak): hook AppleWebCrypto::HKDF at offset 0x11900 to capture appboot sign key derivation ...

Static analysis of NFWebCrypto confirms that offsets 0x11990/0x119b8 are HMAC
call sites within a single C++ method at 0x11900 (netflix::AppleWebCrypto::HKDF).
Replace placeholder offset logging with a working MSHookFunction hook using the
correct struct-return calling convention (x8 sret). The hook logs ikm, info, key,
and okm to correlate HKDF output against the target 38b2030d sign key.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-09 10:11:28 +00:00

..

include

feat(tweak): add NetflixEntityAuth tweak to capture entity_auth_data values

2026-04-09 09:13:26 +00:00

Tweak.m

feat(tweak): hook AppleWebCrypto::HKDF at offset 0x11900 to capture appboot sign key derivation

2026-04-09 10:11:28 +00:00