From b47c00f0047599454e542385872a3157dd3ed7a5 Mon Sep 17 00:00:00 2001
From: Zhuowei Zhang <zhuoweizhang@yahoo.com>
Date: Tue, 27 Dec 2022 19:52:26 -0500
Subject: [PATCH] overwrite emoji font

---
 WDBFontOverwrite/BrotliPadding.swift     | 34 ++++++++++++++++++++++++
 WDBFontOverwrite/ContentView.swift       | 19 +++++++++++++
 WDBFontOverwrite/OverwriteFontImpl.swift | 14 ++++++----
 3 files changed, 62 insertions(+), 5 deletions(-)

diff --git a/WDBFontOverwrite/BrotliPadding.swift b/WDBFontOverwrite/BrotliPadding.swift
index c4095bc..1947214 100644
--- a/WDBFontOverwrite/BrotliPadding.swift
+++ b/WDBFontOverwrite/BrotliPadding.swift
@@ -133,6 +133,40 @@ func repackWoff2Font(input: Data) throws -> Data {
       tableEnd += 1
     }
   }
+  // if this is a collection, we need more
+  if header.flavor.bigEndian == 0x7474_6366 {
+    func read255UShort() -> UInt16 {
+      let oneMoreByteCode1 = 255
+      let oneMoreByteCode2 = 254
+      let wordCode = 253
+      let lowestUCode = 253
+      let first = input[tableEnd]
+      var outNum: UInt16 = 0
+      if first == wordCode {
+        outNum = UInt16(input[tableEnd]) << 8 | UInt16(input[tableEnd])
+        tableEnd += 2
+      } else if first == oneMoreByteCode1 || first == oneMoreByteCode2 {
+        outNum =
+          UInt16(input[tableEnd])
+          + UInt16(first == oneMoreByteCode1 ? lowestUCode : lowestUCode * 2)
+        tableEnd += 1
+      } else {
+        outNum = UInt16(first)
+      }
+      tableEnd += 1
+      return outNum
+    }
+    // version - skip
+    tableEnd += 4
+    let numCollectionFonts = read255UShort()
+    for _ in 0..<numCollectionFonts {
+      let numTables = read255UShort()  // numTables
+      tableEnd += 4  // version
+      for _ in 0..<numTables {
+        _ = read255UShort()  // table index
+      }
+    }
+  }
 
   // hack: we made a fake Brotli that just returns the uncompresssed input directly
   // so instead of compressed data we get the uncompressed data directly
diff --git a/WDBFontOverwrite/ContentView.swift b/WDBFontOverwrite/ContentView.swift
index 74dc1cd..0969942 100644
--- a/WDBFontOverwrite/ContentView.swift
+++ b/WDBFontOverwrite/ContentView.swift
@@ -66,6 +66,25 @@ struct ContentView: View {
         }) {
           Text("Import custom SFUI.ttf")
         }.padding(8)
+        Button(action: {
+          message = "Running"
+          overwriteWithCustomFont(
+            name: "CustomAppleColorEmoji.woff2",
+            targetName: "/System/Library/Fonts/CoreAddition/AppleColorEmoji-160px.ttc"
+          ) {
+            message = $0
+          }
+        }) {
+          Text("Custom emoji")
+        }.padding(8)
+        Button(action: {
+          message = "Importing"
+          importCustomFont(name: "CustomAppleColorEmoji.woff2") {
+            message = $0
+          }
+        }) {
+          Text("Import custom emoji")
+        }.padding(8)
       }
     }
   }
diff --git a/WDBFontOverwrite/OverwriteFontImpl.swift b/WDBFontOverwrite/OverwriteFontImpl.swift
index c52fef9..bb11837 100644
--- a/WDBFontOverwrite/OverwriteFontImpl.swift
+++ b/WDBFontOverwrite/OverwriteFontImpl.swift
@@ -22,9 +22,10 @@ func overwriteWithFont(name: String, completion: @escaping (String) -> Void) {
 /// Overwrite the system font with the given font using CVE-2022-46689.
 /// The font must be specially prepared so that it skips past the last byte in every 16KB page.
 /// See BrotliPadding.swift for an implementation that adds this padding to WOFF2 fonts.
-func overwriteWithFontImpl(fontURL: URL) -> Bool {
+func overwriteWithFontImpl(
+  fontURL: URL, pathToTargetFont: String = "/System/Library/Fonts/CoreUI/SFUI.ttf"
+) -> Bool {
   var fontData = try! Data(contentsOf: fontURL)
-  let pathToTargetFont = "/System/Library/Fonts/CoreUI/SFUI.ttf"
   #if false
     let documentDirectory = FileManager.default.urls(for: .documentDirectory, in: .userDomainMask)[
       0
@@ -113,7 +114,10 @@ func dumpCurrentFont() {
   try! origData.write(to: URL(fileURLWithPath: pathToTargetFont))
 }
 
-func overwriteWithCustomFont(name: String, completion: @escaping (String) -> Void) {
+func overwriteWithCustomFont(
+  name: String, targetName: String = "/System/Library/Fonts/CoreUI/SFUI.ttf",
+  completion: @escaping (String) -> Void
+) {
   let documentDirectory = FileManager.default.urls(for: .documentDirectory, in: .userDomainMask)[
     0
   ]
@@ -123,7 +127,7 @@ func overwriteWithCustomFont(name: String, completion: @escaping (String) -> Voi
     return
   }
   DispatchQueue.global(qos: .userInteractive).async {
-    let succeeded = overwriteWithFontImpl(fontURL: fontURL)
+    let succeeded = overwriteWithFontImpl(fontURL: fontURL, pathToTargetFont: targetName)
     DispatchQueue.main.async {
       completion(succeeded ? "Success: force close an app to see results" : "Failed")
     }
@@ -149,7 +153,7 @@ var globalDelegate: WDBImportCustomFontPickerViewControllerDelegate?
 func importCustomFont(name: String, completion: @escaping (String) -> Void) {
   // yes I should use a real SwiftUI way to this, but #yolo
   let pickerViewController = UIDocumentPickerViewController(forOpeningContentTypes: [
-    UTType("public.truetype-ttf-font")!, UTType(filenameExtension: "woff2", conformingTo: .font)!,
+    UTType.font, UTType(filenameExtension: "woff2", conformingTo: .font)!,
   ])
   let delegate = WDBImportCustomFontPickerViewControllerDelegate { urls in
     globalDelegate = nil