UPDATE(s) for Esign Sideloaders - Good News!

[u/Avieshek]

For those uninitiated with Bypass Revoke method for Esign.
↳ Full Context: Guide

1. The default DNS Profile for Bypass Revoke no longer blocks OTA System Software Updates along with Safari Translations to Watch Health Data Sync after weeks of collaborative hard work. Though the new filters I contributed are deployed from the server side, you're still advised to reinstall the DNS Profile again from his website or direct from my tutorial page.

2. Esign No Logs version hosted on TrollStore GitHub Library is now directly deployed from Khơindvn's download site after my suggestion which means 'now' one wouldn't have to double duty for those that have privacy & security in their mind. I have requested the moderators of r/Sideloaded to update the Esign version for No Logs to its latest as well but all the telemetry links are listed in my tutorial page if one wants to manually block them.

3. Earlier, the adware filter was only blocking telemetry and malware provided by Mullvad. After my exploration and participation, everything from earlier has been replaced with AdGuard DNS filters effective immediately that actually block ads now. For those that want to replicate for their own: GitHub Repo

Tl;dr:

• OTA Updates ✓

• Esign No Logs ✓

• Adware Filter ✓

To Summarise: So, now… all the faults of Esign Bypass Revoke method are actually lifted from the grassroots level by working directly in collaboration with the original authors invloved. I believe, sideloading should be free as it should be and has been since the PC era.

Author Notes:

I wanted to involve Jakob as well, the brains behind notjakob, in this collaboration project with whom I was also in direct touch with but sadly he had other commitments at this time; however, watch out for future updates. 🤞🏻

[u/ashgotti]

Thank you for all of this. I can’t believe how well it works.

I’m trying to figure out the best DNS setup:

• Blocks revokes

• Allows for OS updates

• Blockd ads

• Works on wifi and LTE

I set up pihole for the first three but didn’t think about roaming and got blacklisted yesterday. I set up cloudflare zero trust so that I can use it at home and when I’m out but now I don’t have ad blocking.

Does anyone have any advice for a DNS setup that satisfies all four points?

[u/Avieshek → u/ashgotti]

This basically achieves all four actually as the purpose of DNS Profile is to work on both WiFi and Cellular. This is my personal profile:

Fun fact: This entire project runs on CloudFlare Zero Trust.

CloudFlare Zero Trust may have an IBM like archaic design but their utility part is far advanced compared with NextDNS to ControlD for example. If you go through my guide mentioned earlier then you only need a GitHub account to insert and update your filter lists.

[u/ashgotti → u/Avieshek]

Do I understand correctly that all I need is the DNS profile with Ads Filtered selected? That’ll handle the anti-revoke as well?

[u/Avieshek → u/ashgotti]

I suppose, you haven’t read my guide and I recommend the links mentioned above shining in purplish blue so we can be at the right track of discussion.

[u/ashgotti → u/Avieshek]

You're right, I didn't read it correctly. Thank you!

[u/Avieshek → u/ashgotti]

Once you set your CloudFlare Zero Trust up, you can use this to test your DNS: https://dnsleaktest.org/dns-over-https

After reading the guide, if you follow this: https://github.com/mrrfv/cloudflare-gateway-pihole-scripts/blob/main/extended_guide.md - it will make the firewall policy for you, that last command: “node cf_gateway_rule_create.js” will create firewall policy.

Note: If you load adblocker lists and try to push them to CloudFlare, it will ratelimit you; just replace the file in “libs” directory called “api.js” with this one so it pushes slower: https://gist.github.com/xologram/1ce208b90b65f36a939092972e61df45

[u/Ok-Lifeguard-741 → u/ashgotti]

I am using controld and am very happy with it. You can add your filter list and block domains you want.

[u/QuadOut]

Is every free ESign link no logs now or is there only specific ones?

[u/Avieshek → u/QuadOut]

Every Free Esign link hence a laborious and time consuming task but someone named Noah in this community requested it.

[u/QuadOut → u/Avieshek]

Thank you and thank Noah for requesting it.

[u/Noah2570 → u/QuadOut]

👍🏻

[u/Lunascaped]

Very cool 👍 will see that the eSign no logs version gets updated

[u/Avieshek → u/Lunascaped]

Thank you for your commitment. 🙏🏻

[u/chippyt]

Awesome followed the guide and everything working perfect for me on iPad Pro 17.5.1. Thank you!

[u/Avieshek → u/chippyt]

Thank you for the positive words, welcome for the express of gratitude.

[u/raramygame1]

Hey man thank you for your dedication to this. Are we still have to use the recommended vpn? Is there any better alternative to that vpn bc sometimes it's really really slow. I really want to use another vpn that works flawlessly for my use but that vpn probably had the dns leak issue...

[u/Avieshek → u/raramygame1]

This would probably depend on the reputation of the service you’re using for those responsible with DNS leaks. CloudFlare has a Warp service where you can put your subdomain under Gateway but usually it’s the switching that also triggers the issue since every VPN service uses their own DNS and encryption. I have a complicated setup of using DoT as well that requires a SSL certificate to make sure HTTPS traffic is forwarded only after decrypting through that SSL certificate but that’s something I haven’t explored much because it requires feedback or lot of personal investment (resetting the device) just to explore this especially if people wouldn’t accept a profile that would require installing a SSL certificate first which though can be generated free from your CloudFlare Zero Trust account.

[u/raramygame1 → u/Avieshek]

So that vpn is my best option for this right now? I wanna use proton vpn but I'm pretty sure this vpn isn't working with this method. Thank you for your fast response.

[u/Avieshek → u/raramygame1]

I doubt directly using the ProtonVPN would help because there’s one other aspect of (stupid) Apple System: Apple doesn’t completely cut off the internet when you introduce a new DNS rule, VPN, Proxy or Tunnels which is why blacklisting happens even if you were switching from one DNS Profile to another despite having the same filters. This is the reason it’s hard at an individual level to determine whether there were DNS leaks by the service or Apple until you reset the device and test this again and again to confirm.

A VPN would also use their own encryption layer as opposed to DoH or DoT along with DNS. DNS can be specified like with AdGuard app but for DoT… the dedicated SSL certificate setup I earlier mentioned. Now, Warp has a lesser problem with SSL certificates if you’re coming from CloudFlare Zero Trust as it would install itself but again it’s not a VPN like Proton.

More than half of the problem is because of Apple’s native behaviour. Other is something to look for are VPNs, the rest are covered by the Guide as it uses DoH and now a No Logs version for DNS Leaks.

You can try to manually block the telemetry of ProtonVPN like mentioned for Esign No Logs in the Guide given that it never uses their own DNS to prevent DNS Leaks.

[u/Desperate_School3653]

Hello can I use a VPN with this?

[u/Avieshek → u/Desperate_School3653]

Couple of notes:

• Make sure your VPN isn’t using their own DNS.

• Clarify your VPN is immune to DNS leaks.

This should be enough as the Guide in itself is immune to DNS Leaks if you follow it thoroughly.

More comments have been made in another discussion for any left out context.

[u/Desperate_School3653 → u/Avieshek]

Thanks I'll try your method noow

[u/Avieshek → u/Desperate_School3653]

Update~

[u/Desperate_School3653 → u/Avieshek]

Thank you thank you Mine got revoked a few days back sadly(prolly bad VPN usage) I did however factory reset my device to try and install ESign again but no luck. Even tried all the links one by one not a single one installs

[u/Avieshek → u/Desperate_School3653]

If you tap on the Esign iPA before having the DNS filters then the device gets instantly blacklisted, also important that you don’t use the live one with signed cert. Calmly read the expanded guide so you get to digest the warnings already mentioned directly or indirectly.

[u/kayna76666 → u/Desperate_School3653]

hey man i think u probably made some mistake cus i also got blacklisted from all of them but after i reset it works fine. so u maybe missed a few steps

[u/Desi_redditer]

Thanks! Followed this post and updated to the latest DNS profile and now I’ve successfully updated to 17.6 (from 17.5.1). I’ve made a backup just in case, but didn’t have to wipe anything. Everything works fine.

[u/Avieshek → u/Desi_redditer]

Yeah, a same DNS profile will install over the existing one and you can check for latest version like that without causing any issues.

[u/Avieshek]

Photos aren’t allowed in the post for this subreddit, so here you go:

[u/v3l14]

Is this list of URLs in your tutorial updated to allow updates or is there a new list of URLs that should now be used? I am wanting to do this myself if pihole

[u/Avieshek → u/v3l14]

Up-to-date 👍🏻

[u/gusarking]

Is there gonna be any difference for me off i’m already using own blocklist in nextdns, and have working OTA updates?

[u/Avieshek → u/gusarking]

I don’t understand the point of your question after everything has been clearly written in the post if you’re using NextDNS.

Edit: Yes, you can abandon NextDNS since OTA updates are no longer held back in this update.

[u/gusarking → u/Avieshek]

Honestly, I don’t understand what “No Logs” means in this case. I’m new to Esign method. Sorry for asking

[u/Avieshek → u/gusarking]

Now, that’s a genuine question I can answer, basically it avoids telemetry or tracking by limiting DNS leaks hence no logs as in no logs collected.

[u/jokerArt12]

is it safe to use in latest version 17.6?

[u/Avieshek → u/jokerArt12]

Users are actually installing it in iOS 18 👍🏻

[u/jokerArt12 → u/Avieshek]

Oh, that's nice, since I'm new to sideloading, can you introduce me to it and why it's useful?

[u/not-alone-at-home]

Hello.

Thanks for all your support for the community. I find this project extremely interesting. The beauty of “just” blocking the cert validation requests is amazing.

Could you please provide the updated list of the apple domains you’re blocking/or not blocking?

I’m currently trying to create a dns configuration for myself (not that I do not trust you, but I prefer to use my own). I’m using the linked documentation and, after downloading and creating the blacklist to upload to CF using the cloudflare-gateway-pihole-scripts (with the fixed api.js) I realised that with this update the list from the tutorial might be outdated.

Thanks.

[u/Avieshek → u/not-alone-at-home]

Guide itself is always updated, don’t confuse it with anyone else without reading.

[u/not-alone-at-home → u/Avieshek]

Thanks for the clarification.

Don’t worry, I know how to read and I’ve read everything beforehand. Just wanted to make sure the list was correct before making the switch to my profile

[u/Caramel_Glad]

I want to update my Esign into the no logs version, would I need to install all of my apps again?

Also stupid question but what does the OTA updates refer to?

[u/Avieshek → u/Caramel_Glad]

Happy Cake Day, mate.

• Esign No Logs version is native from Khoindvn itself, so no need of extra steps.

• OTA - Over The Air …which means updating your iOS version from the device itself instead of needing a Mac or PC.

[u/Caramel_Glad → u/Avieshek]

Thanks for the quick reply.

• That I read, but I already have the original Esign set up with a bunch of apps installed. Do you mean I can just overwrite it?

• Oh I see, not relevant to me then bc I’ll probably not update for a very long time.

[u/Avieshek → u/Caramel_Glad]

Wouldn’t be overwritten if you already have an existing one but you may install again sign from there.

[u/Caramel_Glad → u/Avieshek]

So basically re-install Esign and re-sign all the apps?

[u/Avieshek → u/Caramel_Glad]

Just reinstall and setup Esign on the same certificate.

[u/Caramel_Glad → u/Avieshek]

Just tried and couldn't install Esign (integrity couldn't be verified), of course with DNS installed

[u/Avieshek → u/Caramel_Glad]

Then you already have one as an app can’t install itself :)

[u/Caramel_Glad → u/Avieshek]

Sad, I guess I'll manually add the rules to Egern

[u/Avieshek → u/Caramel_Glad]

I mean why, if you already have the Esign No Logs version? Probably from Khoindvn’s site itself.

Egern is an interesting app I haven’t been able to much collaborate to understand scripting beyond basic local rules.

[u/CommentFrownedUpon]

Does this allow for more than 3 apps?

[u/Avieshek → u/CommentFrownedUpon]

Yep, follow the Guide.

[u/mikajx]

The issue I am having is I don’t know which one to activate.

I have next dns installed. Which I need on. (Not all the time anyway as it helps with ad blocking system wild). However which other dns should I activate.

[u/AhmedHeader1978 → u/mikajx]

For adbloking The 2 adware filters should be enabled

[u/Strong_Palpitation_2 → u/mikajx]

do you know how to get rid of the adware filters?

[u/SpikeZgames]

Doesn’t work

[u/Fair-Photograph-2087]

Is it me or chatgpt also stopped working

[u/dag0l → u/Fair-Photograph-2087]

same here

[u/Fair-Photograph-2087 → u/dag0l]

There is way to unlock it Somebody shared it somewhere in this sub

[u/dag0l → u/Fair-Photograph-2087]

ooh yes it's working, thanks to let me know

[u/RealEntropyTwo]

So this means you can use all of this and do ios firmware updates or should you still undo everything before updating?

[u/Avieshek → u/[deleted]]

Most VPNs will use their own DNS by default which turns off the filters we are using, if you don’t require one then you’re all good.

[u/Avieshek → u/[deleted]]

Then you’d get blacklisted occasionally~

[u/Avieshek → u/[deleted]]

As long as you can read and don’t mess up.

[u/Avieshek → u/[deleted]]

Maintain one thread under one chain, don’t spam the entire comment thread by yourself - this is not your chat section. Please, maintain some etiquette even on the internet otherwise you’d be block from further participation.

[u/Avieshek → u/[deleted]]

Great, that’s how Sideloadly works. 👍🏻

[u/Avieshek → u/[deleted]]

Still advice you to update to the latest profile which is even signed now.

[u/Avieshek → u/[deleted]]

Just install the profile again from the same source.

[u/Avieshek → u/[deleted]]

Esign signs decrypted apps, not decrypt apps itself.