apple on irq5 test

Cracking iTunes Backup Passwords with Hashcat

Tue, 07 Mar 2017 01:00:00 +0000

Following the recent announcement of LUKS support in hashcat, I noticed that there have been some commits to support iTunes Backup passwords as well.

[tweet https://twitter.com/hashcat/status/824713111118684160]

This is only useful if the backup was encrypted by setting a backup password on the iOS device. If the backup is not encrypted then all the files are in clear and there is nothing to bruteforce.

The keys used to encrypt the backup are stored in the BackupKeyBag, which can be found in the Manifest.plist file. This keybag is a binary blob, the format of which has already been documented by researchers from Sogeti ESEC Lab.

I have written a simplified script which dumps the BackupKeyBag. You will need the Python bindings from libplist for the script to work. If you cannot get it to work, you can try the Perl script from philsmd instead.

Speeding up iOS Backups

iOS device backups usually take a while, depending on how much storage has been used on your device.

The iOS backup process is driven by the device itself, through the BackupAgent process. This process treats the host PC like a dumb disk store, by sending it commands
like DLMessageCreateDirectory, DLMessageUploadFiles, DLMessageRemoveFiles, DLMessageGetFreeDiskSpace, etc. so that it can determine what has been backed up previously and what to send/update for incremental backups.

For password cracking, we don’t need the entire 64 GB (or God forbid, 128 GB) of data on the iOS device. We just need the Manifest.plist, which is typically less than 50 KB. But because the backup process is controlled by the device and not the PC, we can’t simply ask it to send over that single file. Sometimes when we setup a VM with libimobiledevice, we might also not have allocated such a large virtual disk. Of course when I say “we”, I really mean “I”.

The Cost of Fixing an Old iPod

Thu, 03 Jul 2014 01:43:00 +0000

My decade-old 4th generation iPod decided to blue screen on me, literally.

I love old stuff and I’m rather attached to this very first Apple product that I purchased 10 years ago. So I decided to turn to iFixit, the well-known DIY repair store for Apple products, for a replacement LCD screen.

Apple's Lightning Digital AV Adapter

Mon, 11 Mar 2013 22:39:00 +0000

Recently, Panic noticed the odd output resolution and MPEG-like artifacts with the new Lightning digital AV adapter and decided to take a hacksaw to it. They found an ARM processor inside. image credit: Panic blog Shortly after, they received an anonymous comment that explains it all: The reason why this adapter exists is because Lightning is simply not capable of streaming a “raw” HDMI signal across the cable. Lightning is a serial bus.

The Apple 30-pin Dock Connector

Mon, 25 Jun 2012 23:45:00 +0000

The 30-pin dock connector first appeared on the iPod 3G in 2003, and has been on all iPods, iPhones and iPads ever since, with the sole exception of the first generation iPod Shuffle. The first gen Shuffle looks like a thumbdrive (or what some would call a pen drive) and used a USB male connector, whereas the first and second generation iPods had a FireWire port at the top.

iPod Accessory Protocol

Since its introduction, Apple made several minor modifications to the electronics interface of the dock connector, but the physical connector itself remains unchanged. Collectively, this and the communications protocol is called the iPod Accessory Protocol (iAP).

Initially, they introduced different resistor values on the “accessory detect” pin when they allowed third-party companies to make docks and car adapters. At that time, the dock connector mainly had audio in and line out functionality (connected to the back of the docks), as well as a serial interface for remote control via the dock. The serial protocol was largely reverse-engineered by maushammer (website no longer accessible) and this guy here (I think he’s called Christoph but it’s not on that page). This was also used by car manufacturers to allow iPod playback control from buttons on the steering wheel.

When Apple released the iPod Video that was capable of playing videos in 2005, they added video out (composite and S-video), as well as an authentication chip to allow only authorized docks and cables to receive video out (including audio). Soon enough, China caught up with their release of “authorized” accessories, which contain the authentication chip that can be re-purposed for other use.

authentication chip Authentication chip (image from thice.nl)

Presumably, that was also when they added USB support for iAP, which I’m pretty sure also requires an authentication chip. USB support would allow a host to communicate and control the iPod through a USB cable. My car stereo correctly recognizes the iPhone as an iPod over a USB cable.

The iPod Camera Connector was also introduced for the iPod Photo and iPod Video in 2005. This was a small “dongle” that has a dock connector on one end and a USB port on the other. Oddly, according to an Everymac article, later iPods released in 2006 do not support this accessory any more. It is unknown if they somehow switched the USB interface to host mode, or if they used a separate chip to emulate this.

In 2008, charging via FireWire was no longer supported with the introduction of the 2nd generation iPod Touch and 4th generation iPod Nano. The pins dedicated to FireWire in the dock connector are now unused.

Mac Battery Firmware Hacking

Sun, 20 Nov 2011 16:36:00 +0000

[youtube=http://www.youtube.com/watch?v=bc1EU5GTbLE] Charlie Miller reverse engineers the Mac battery firmware updater, sniffs battery communications on the SMBus, writes an IDA processor plugin (in IDAPython) for the CoolRISC 816 processor in the bq20z80, and mucks around with the its firmware. All the source code and presentation materials are provided. [via Dangerous Prototypes]

Enable iOS 5 Multitasking Gestures on iPad 1

Sun, 16 Oct 2011 22:29:00 +0000

Now that iOS 5 has been released, it’s easy to enable multitasking gestures on the iPad 1, using the same trick as before for display mirroring. Edit the /System/Library/CoreServices/Springboard.app/K48AP.plist file and add a boolean key multitasking-gestures in the capabilities dict, and set its value to true. You can add both display mirroring and multitasking gestures to the iPad 1 using this method. That’s it! Alternatively you can use Cydia or redsn0w to do this for you.

Stop iPhone Backup Encryption

Mon, 22 Aug 2011 12:45:00 +0000

Before the days when you could easily opt to use a “complex” passcode from the iPhone Settings, you had to manually use the iPhone Configuration Utility (iPCU). When I created a profile to use a complex passcode, I inadvertently forced my iPhone backups to be encrypted and now that the “Encrypt iPhone backup” checkbox is grayed out, I can’t stop encrypting my backups. But after I jailbroke my phone (because the baseband died), I had the option of mucking around with the system files to see if it could be undone.

5 iOS Features I'd Love

Tue, 07 Jun 2011 23:18:00 +0000

WWDC 2011 kicked off yesterday with Steve Jobs taking the stage as usual. Sadly, there wasn’t a new iPhone announced (because I’m waiting to replace mine). Nevertheless, I’m still looking forward to iOS 5. Here’s some of the features I thought were great: 1. Notification Center I think this has been on everyone’s wishlist for a really long time. If you have no time to respond to the missed calls or SMSes, notifications are now shown on the lock screen so you can see what you’ve missed at a glance.

iPhone 3GS Baseband Issues

Thu, 19 May 2011 01:38:00 +0000

How can you tell when your iPhone baseband dies? Take a look at the top-left corner where the network status is displayed. The SIM card was inserted, the SIM PIN was entered, but it remains unconnected to the network. As you can see from the iTunes icon, this is a newer version of iOS (4.2.1). The older version sported a different iTunes icon and when you clicked the circled i, the IMEI is unknown.

Apple's RAOP is Cracked

Mon, 11 Apr 2011 23:34:00 +0000

For a long time now, apps can stream high-quality audio to an Airport Express or an Apple TV using the RAOP protocol. However, the reverse cannot be done due to the fact that the protocol uses asymmetric encryption, which means the private key is baked into the firmware of the Apple (or Apple-licensed) device. Finally, someone has done something about it. James Laird dumped the ROM of his Airport Express and extracted the private key.

Display Mirroring on the iPad 1

Wed, 06 Apr 2011 15:58:00 +0000

This is interesting, but I don’t have any video out accessories to test it on. You just need to add a boolean that says display-mirroring: YES to the model plist (K48AP.plist for first-gen iPad) under /System/Library/CoreServices/Springboard.app/ and reboot the device. Obviously this requires a jailbroken iPad for you to access the file. It also seems to work with devices that use the A4 chip. I guess this is how Apple did their presentations all along, at all of these iOS device unveiling events.

iOS Profiles & Encrypted Backups

Fri, 14 Jan 2011 11:59:00 +0000

When I got my iPhone, it uses a 4-digit passcode to protect its contents. Unsatisfied with this, I found the iPhone Configuration Utility (iPCU), which was the only way at that time to enable complex passcodes (passwords) on the phone. After creating a profile and uploading it to the phone using the iPCU, my backups were all forced to be encrypted. Encrypted backups are not good for tinkering because you need to decrypt the files before you can edit them, and you need to re-encrypt them for it to be restored to the phone.

"Personal [WiFi] Hotspot" comes to iPhone 4 CDMA

Wed, 12 Jan 2011 02:12:00 +0000

Apple has just announced a new iPhone 4 hardware revision that allows it to be used on CDMA networks. iPhone Personal Hotspot Pref [photo stolen from Ars Technica] Interestingly, the new iPhone comes with a Personal Hotspot preference that allows it to share its 3G connection over WiFi. Ars Technica has photos of the new preference menus. I must stress the photos shown here were not taken by me. Of course the Android people have had this for a while (provided their phones could be updated to Froyo).

mdns-repeater: mDNS across subnets

Sun, 02 Jan 2011 03:51:00 +0000

Update 21-Sep-2011: Added an Installation section and updated the binaries on Bitbucket.

As you may know, I have a couple of Apple devices. Apple is fond of using Multicast DNS (mDNS) for their service discovery. The recent addition to these services being AirPrint (wireless printing service) and AirPlay (wireless audio/video streaming) from your iOS devices.

My home is setup in such a way that the wired and wireless networks are on 2 separate subnets. mDNS uses a multicast address that is “administratively scoped”, meaning the packets will not travel across subnets. I tried fiddling around with iptables rules and looked around for how I can route these packets across the subnets, but to no avail.

There is another solution - a repeater daemon that sits on the router and repeats packets between the 2 subnets. Avahi is used to provide mDNS services and it has a reflector mode that does exactly this. A more lightweight solution was TiVoBridge, which supposedly performs the same task but it’s much smaller. I tried to compile and set up TiVoBridge, but it required a config file and I couldn’t really get it to work the way I wanted it to. There’s an even lighter-weight solution called SAY, but it uses libpcap.

Enter mdns-repeater - a small Linux daemon that does exactly what I want it to do. I have a Linksys WRT54G which runs dd-wrt. This program was intended to be compiled for and installed on the Linksys router. As with all other programs that run on the router, it requires no configuration.

The default dd-wrt configuration has 2 interfaces - vlan1 for the WAN interface and br0 for the wireless interface (and 4-port switch). The program accepts the arguments vlan1 and br0 and begins repeating packets from vlan1 to br0 and vice-versa. I can now get my iOS devices to detect wired servers like a print server for AirPrint.

mdns-repeater is released under GPLv2. Feel free to change it to repeat whatever protocol you want. Patches to add functionality and bug fixes are welcome. You can contact me via bitbucket.org, or if you clone the repository my email is in the commits.

I want a faster iPad

Thu, 18 Nov 2010 23:41:00 +0000

Actually I was aware of this problem some time ago. Even though the iPad has a beefy processor, it still renders Javascript-heavy sites slowly. Yes, probably the Javascript that draws on the canvas can be further optimized, but if other browsers can render faster, why can’t MobileSafari? [youtube=http://youtube.com/watch?v=s72rGDUn2uo]

Change of iPad's Orientation Lock Switch Function

Wed, 27 Oct 2010 21:37:00 +0000

Apple is planning to change the iPad’s orientation lock switch into a mute switch, just like on iPhones, in iOS 4.2. I can’t agree more with this: The iPhone and iPod Touch are, for many people, audio devices. But the iPad is a reading/viewing device for most of us.