What is this?
BadNotes is a jailbreak tweak for iOS that unlocks GoodNotes Pro by spoofing the app's subscription check.
BadNotes is a jailbreak tweak for iOS that unlocks GoodNotes Pro by spoofing the app's subscription check.How do I get this running on my device?You build the tweak (the repo ships a GitHub Actions workflow, buildIPA.yml, that produces an IPA) and install it on a jailbroken device via the usual tweak installer, since it patches GoodNotes' behavior at runtime rather than being a standalone app.
You build the tweak (the repo ships a GitHub Actions workflow, buildIPA.yml, that produces an IPA) and install it on a jailbroken device via the usual tweak installer, since it patches GoodNotes' behavior at runtime rather than being a standalone app.Do I need a jailbroken iPhone for this?Yes - BadNotes hooks NSURLSession inside the live GoodNotes app at runtime, which only works on a jailbroken iOS device capable of loading tweaks.
Yes - BadNotes hooks NSURLSession inside the live GoodNotes app at runtime, which only works on a jailbroken iOS device capable of loading tweaks.Does it unlock every GoodNotes Pro feature, including AI tools?No. It only fakes the local subscription check, so anything that actually depends on GoodNotes' servers, like AI features and collaboration, still won't work.
No. It only fakes the local subscription check, so anything that actually depends on GoodNotes' servers, like AI features and collaboration, still won't work.How does BadNotes actually fool GoodNotes into thinking I'm Pro?GoodNotes checks subscription status by calling a GoodNotes-proxied RevenueCat API ('/v1/subscribers/') on every launch. BadNotes intercepts that specific network response and swaps in a crafted JSON payload claiming you have an active Pro subscription.
GoodNotes checks subscription status by calling a GoodNotes-proxied RevenueCat API ('/v1/subscribers/') on every launch. BadNotes intercepts that specific network response and swaps in a crafted JSON payload claiming you have an active Pro subscription.Why doesn't it just patch the app's code directly?Because the Pro check is decided by a server response, not local code, so intercepting and rewriting that one API response at the networking layer is enough to flip the app's Pro status, without needing to touch GoodNotes' actual logic.
Because the Pro check is decided by a server response, not local code, so intercepting and rewriting that one API response at the networking layer is enough to flip the app's Pro status, without needing to touch GoodNotes' actual logic.What are similar projects?FilzaSlop, AirCard-iOS, Erosion, TrollStore, AirCard, bad_query, GenP, OhMyKeymint
FilzaSlop, AirCard-iOS, Erosion, TrollStore, AirCard, bad_query, GenP, OhMyKeymintWhich topics is it in?hook, crack, cracking, mobile-security, tweaks, mitm, patcher, piracy, jailbreak, security-research, exploit, objective-c
hook, crack, cracking, mobile-security, tweaks, mitm, patcher, piracy, jailbreak, security-research, exploit, objective-c