Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
L
libplist
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
1
Issues
1
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
pwn
libplist
Commits
0f4aeb11
Commit
0f4aeb11
authored
Jul 29, 2008
by
Zach C
Committed by
Matt Colyer
Jul 29, 2008
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Version 0.09, added ability to talk to 2.0 firmware.
parent
e2ff1128
Expand all
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
180 additions
and
37 deletions
+180
-37
AFC.c
AFC.c
+132
-30
AFC.h
AFC.h
+7
-1
lockdown.c
lockdown.c
+18
-4
main.c
main.c
+23
-2
No files found.
AFC.c
View file @
0f4aeb11
This diff is collapsed.
Click to expand it.
AFC.h
View file @
0f4aeb11
...
...
@@ -53,11 +53,14 @@ enum {
AFC_GET_INFO
=
0x0000000a
,
AFC_GET_DEVINFO
=
0x0000000b
,
AFC_LIST_DIR
=
0x00000003
,
AFC_DELETE
=
0x00000008
,
AFC_RENAME
=
0x00000018
,
AFC_SUCCESS_RESPONSE
=
0x00000002
,
AFC_FILE_OPEN
=
0x0000000d
,
AFC_FILE_CLOSE
=
0x00000014
,
AFC_FILE_HANDLE
=
0x0000000e
,
AFC_READ
=
0x0000000f
AFC_READ
=
0x0000000f
,
AFC_WRITE
=
0x00000010
};
AFClient
*
afc_connect
(
iPhone
*
phone
,
int
s_port
,
int
d_port
);
...
...
@@ -72,3 +75,6 @@ AFCFile *afc_get_file_info(AFClient *client, char *path);
AFCFile
*
afc_open_file
(
AFClient
*
client
,
const
char
*
filename
,
uint32
file_mode
);
void
afc_close_file
(
AFClient
*
client
,
AFCFile
*
file
);
int
afc_read_file
(
AFClient
*
client
,
AFCFile
*
file
,
char
*
data
,
int
length
);
int
afc_write_file
(
AFClient
*
client
,
AFCFile
*
file
,
char
*
data
,
int
length
);
int
afc_delete_file
(
AFClient
*
client
,
const
char
*
path
);
int
afc_rename_file
(
AFClient
*
client
,
const
char
*
from
,
const
char
*
to
);
lockdown.c
View file @
0f4aeb11
...
...
@@ -149,15 +149,16 @@ int lockdownd_start_SSL_session(lockdownd_client *control, const char *HostID) {
for
(
i
=
0
;
strcmp
(
dictionary
[
i
],
""
);
i
+=
2
)
{
if
(
!
strcmp
(
dictionary
[
i
],
"Result"
)
&&
!
strcmp
(
dictionary
[
i
+
1
],
"Success"
))
{
// Set up GnuTLS...
//gnutls_anon_client_credentials_t anoncred;
gnutls_certificate_credentials_t
xcred
;
if
(
debug
)
printf
(
"We started the session OK, now trying GnuTLS
\n
"
);
errno
=
0
;
gnutls_global_init
();
//gnutls_anon_allocate_client_credentials(&anoncred);
gnutls_certificate_allocate_credentials
(
&
xcred
);
gnutls_certificate_set_x509_trust_file
(
xcred
,
"hostcert.pem"
,
GNUTLS_X509_FMT_PEM
);
gnutls_init
(
control
->
ssl_session
,
GNUTLS_CLIENT
);
if
((
return_me
=
gnutls_priority_set_direct
(
*
control
->
ssl_session
,
"NO
RMAL:+VERS-SSL3.0
"
,
NULL
))
<
0
)
{
if
((
return_me
=
gnutls_priority_set_direct
(
*
control
->
ssl_session
,
"NO
NE:+VERS-SSL3.0:+ANON-DH:+RSA:+AES-128-CBC:+AES-256-CBC:+SHA1:+SHA256:+SHA512:+MD5:+COMP-NULL
"
,
NULL
))
<
0
)
{
printf
(
"oops? bad options?
\n
"
);
gnutls_perror
(
return_me
);
return
0
;
...
...
@@ -214,6 +215,14 @@ ssize_t lockdownd_secuwrite(gnutls_transport_ptr_t transport, char *buffer, size
if
(
debug
)
printf
(
"pre-send
\n
length = %i
\n
"
,
length
);
bytes
=
mux_send
(
control
->
iphone
,
control
->
connection
,
buffer
,
length
);
if
(
debug
)
printf
(
"post-send
\n
sent %i bytes
\n
"
,
bytes
);
if
(
debug
)
{
FILE
*
my_ssl_packet
=
fopen
(
"sslpacketwrite.out"
,
"w+"
);
fwrite
(
buffer
,
1
,
length
,
my_ssl_packet
);
fflush
(
my_ssl_packet
);
printf
(
"Wrote SSL packet to drive, too.
\n
"
);
fclose
(
my_ssl_packet
);
}
return
bytes
;
}
...
...
@@ -251,11 +260,16 @@ ssize_t lockdownd_securead(gnutls_transport_ptr_t transport, char *buffer, size_
}
}
// End buffering hack!
char
*
recv_buffer
=
(
char
*
)
malloc
(
sizeof
(
char
)
*
(
length
*
4
00
));
// ensuring nothing stupid happens
char
*
recv_buffer
=
(
char
*
)
malloc
(
sizeof
(
char
)
*
(
length
*
10
00
));
// ensuring nothing stupid happens
if
(
debug
)
printf
(
"pre-read
\n
client wants %i bytes
\n
"
,
length
);
bytes
=
mux_recv
(
control
->
iphone
,
control
->
connection
,
recv_buffer
,
(
length
*
4
00
));
bytes
=
mux_recv
(
control
->
iphone
,
control
->
connection
,
recv_buffer
,
(
length
*
10
00
));
if
(
debug
)
printf
(
"post-read
\n
we got %i bytes
\n
"
,
bytes
);
if
(
debug
&&
bytes
<
0
)
{
printf
(
"lockdownd_securead(): uh oh
\n
"
);
printf
(
"I believe what we have here is a failure to communicate... libusb says %s but strerror says %s
\n
"
,
usb_strerror
(),
strerror
(
errno
));
return
bytes
+
28
;
// an errno
}
if
(
bytes
>=
length
)
{
if
(
bytes
>
length
)
{
if
(
debug
)
printf
(
"lockdownd_securead: Client deliberately read less data than was there; resorting to GnuTLS buffering hack.
\n
"
);
...
...
main.c
View file @
0f4aeb11
...
...
@@ -36,12 +36,13 @@ int main(int argc, char *argv[]) {
}
printf
(
"Now starting SSL.
\n
"
);
if
(
!
lockdownd_start_SSL_session
(
control
,
"29942970-207913891623273984"
))
{
// if (!lockdownd_start_SSL_session(control, "29942970-207913891623273984")) {
if
(
!
lockdownd_start_SSL_session
(
control
,
"2994593482385678618538736"
))
{
printf
(
"Error happened in GnuTLS...
\n
"
);
}
else
{
printf
(
"... we're in SSL with the phone... !?
\n
"
);
port
=
lockdownd_start_service
(
control
,
"com.apple.afc"
);
}
port
=
lockdownd_start_service
(
control
,
"com.apple.afc"
);
if
(
port
)
{
printf
(
"Start Service successful -- connect on port %i
\n
"
,
port
);
AFClient
*
afc
=
afc_connect
(
phone
,
3432
,
port
);
...
...
@@ -69,6 +70,26 @@ int main(int argc, char *argv[]) {
free
(
my_file
);
free
(
file_data
);
}
else
printf
(
"couldn't open a file
\n
"
);
my_file
=
afc_open_file
(
afc
,
"/readme.libiphone.fx"
,
AFC_FILE_WRITE
);
if
(
my_file
)
{
char
*
outdatafile
=
strdup
(
"this is a bitchin text file
\n
"
);
bytes
=
afc_write_file
(
afc
,
my_file
,
outdatafile
,
strlen
(
outdatafile
));
free
(
outdatafile
);
if
(
bytes
>
0
)
printf
(
"Wrote a surprise. ;)
\n
"
);
else
printf
(
"I wanted to write a surprise, but... :(
\n
"
);
afc_close_file
(
afc
,
my_file
);
free
(
my_file
);
}
printf
(
"Deleting a file...
\n
"
);
bytes
=
afc_delete_file
(
afc
,
"/delme"
);
if
(
bytes
)
printf
(
"Success.
\n
"
);
else
printf
(
"Failure.
\n
"
);
printf
(
"Renaming a file...
\n
"
);
bytes
=
afc_rename_file
(
afc
,
"/renme"
,
"/renme2"
);
if
(
bytes
>
0
)
printf
(
"Success.
\n
"
);
else
printf
(
"Failure.
\n
"
);
}
afc_disconnect
(
afc
);
}
else
{
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment