Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
L
libplist
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
1
Issues
1
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
pwn
libplist
Commits
b39a0c05
Commit
b39a0c05
authored
Aug 14, 2008
by
Matt Colyer
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
Minor cleanups, refactored and commented iphone.c.
parent
f281e24c
Show whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
79 additions
and
59 deletions
+79
-59
AFC.h
src/AFC.h
+0
-2
ifuse.c
src/ifuse.c
+0
-4
initconf.c
src/initconf.c
+2
-2
iphone.c
src/iphone.c
+77
-51
No files found.
src/AFC.h
View file @
b39a0c05
...
...
@@ -28,9 +28,7 @@
#include <sys/stat.h>
typedef
struct
{
//const uint32 header1 = 0x36414643; // '6AFC' or 'CFA6' when sent ;)
uint32
header1
,
header2
;
//const uint32 header2 = 0x4141504C; // 'AAPL' or 'LPAA' when sent ;)
uint32
entire_length
,
unknown1
,
this_length
,
unknown2
,
packet_num
,
unknown3
,
operation
,
unknown4
;
}
AFCPacket
;
...
...
src/ifuse.c
View file @
b39a0c05
...
...
@@ -53,10 +53,8 @@ static int ifuse_getattr(const char *path, struct stat *stbuf) {
if
(
!
file
){
res
=
-
ENOENT
;
}
else
{
//stbuf->st_mode = file->type | 0444; // testing write access too now
stbuf
->
st_mode
=
file
->
type
|
0644
;
// but we don't want anything on the iPhone executable, like, ever
stbuf
->
st_size
=
file
->
size
;
//stbuf->st_nlink = 2;
}
return
res
;
...
...
@@ -98,8 +96,6 @@ static int ifuse_open(const char *path, struct fuse_file_info *fi) {
AFCFile
*
file
;
AFClient
*
afc
=
fuse_get_context
()
->
private_data
;
uint32
mode
=
0
;
/*if((fi->flags & 3) != O_RDONLY)
return -EACCES;*/
// trying to test write access here
if
((
fi
->
flags
&
3
)
==
O_RDWR
||
(
fi
->
flags
&
3
)
==
O_WRONLY
)
{
mode
=
AFC_FILE_READ
;
...
...
src/initconf.c
View file @
b39a0c05
...
...
@@ -56,7 +56,7 @@ int main(int argc, char *argv[]) {
gnutls_global_init
();
size_t
size
;
char
*
host_id
=
NULL
;
//"29942970-207913891623273984"
char
*
host_id
=
NULL
;
gnutls_x509_privkey_t
root_privkey
;
gnutls_x509_privkey_t
host_privkey
;
...
...
@@ -73,6 +73,7 @@ int main(int argc, char *argv[]) {
//TODO
host_id
=
lockdownd_generate_hostid
();
if
(
debug
)
printf
(
"HostID: %s
\n
"
,
host_id
);
/* generate keys */
gnutls_x509_privkey_generate
(
root_privkey
,
GNUTLS_PK_RSA
,
2048
,
0
);
gnutls_x509_privkey_generate
(
host_privkey
,
GNUTLS_PK_RSA
,
2048
,
0
);
...
...
@@ -132,7 +133,6 @@ int main(int argc, char *argv[]) {
/* store values in config file */
init_config_file
(
host_id
,
&
root_key_pem
,
&
host_key_pem
,
&
root_cert_pem
,
&
host_cert_pem
);
gnutls_free
(
root_key_pem
.
data
);
...
...
src/iphone.c
View file @
b39a0c05
...
...
@@ -29,7 +29,7 @@
extern
int
debug
;
/**
/**
Gets a handle to an iPhone
*
* @return A structure with data on the first iPhone it finds. (Or NULL, on
* error)
...
...
@@ -37,22 +37,28 @@ extern int debug;
iPhone
*
get_iPhone
()
{
iPhone
*
phone
=
(
iPhone
*
)
malloc
(
sizeof
(
iPhone
));
usbmux_version_header
*
version
=
version_header
();
struct
usb_bus
*
bus
,
*
busses
;
struct
usb_device
*
dev
;
//
i
nitialize the struct
//
I
nitialize the struct
phone
->
device
=
NULL
;
phone
->
__device
=
NULL
;
phone
->
buffer
=
NULL
;
// Initialize libusb
.
// Initialize libusb
usb_init
();
usb_find_busses
();
usb_find_devices
();
struct
usb_bus
*
busses
=
usb_get_busses
(),
*
bus
;
struct
usb_device
*
dev
;
busses
=
usb_get_busses
();
for
(
bus
=
busses
;
bus
;
bus
=
bus
->
next
)
{
for
(
dev
=
bus
->
devices
;
dev
;
dev
=
dev
->
next
)
{
if
(
dev
->
descriptor
.
idVendor
==
0x05ac
&&
(
dev
->
descriptor
.
idProduct
==
0x1290
||
dev
->
descriptor
.
idProduct
==
0x1291
||
dev
->
descriptor
.
idProduct
==
0x1292
))
{
if
(
dev
->
descriptor
.
idVendor
==
0x05ac
&&
(
dev
->
descriptor
.
idProduct
==
0x1290
||
dev
->
descriptor
.
idProduct
==
0x1291
||
dev
->
descriptor
.
idProduct
==
0x1292
)
)
{
phone
->
__device
=
dev
;
phone
->
device
=
usb_open
(
phone
->
__device
);
usb_reset
(
phone
->
device
);
...
...
@@ -60,12 +66,18 @@ iPhone *get_iPhone() {
}
}
phone
->
device
=
NULL
;
// :( sorry Daniel
phone
->
__device
=
NULL
;
// :( sorry Daniel
phone
->
device
=
NULL
;
phone
->
__device
=
NULL
;
for
(
bus
=
busses
;
bus
;
bus
=
bus
->
next
)
{
// do it again as per libusb documentation
// Set the device configuration
for
(
bus
=
busses
;
bus
;
bus
=
bus
->
next
)
{
for
(
dev
=
bus
->
devices
;
dev
;
dev
=
dev
->
next
)
{
if
(
dev
->
descriptor
.
idVendor
==
0x05ac
&&
(
dev
->
descriptor
.
idProduct
==
0x1290
||
dev
->
descriptor
.
idProduct
==
0x1291
||
dev
->
descriptor
.
idProduct
==
0x1292
))
{
if
(
dev
->
descriptor
.
idVendor
==
0x05ac
&&
(
dev
->
descriptor
.
idProduct
==
0x1290
||
dev
->
descriptor
.
idProduct
==
0x1291
||
dev
->
descriptor
.
idProduct
==
0x1292
)
)
{
phone
->
__device
=
dev
;
phone
->
device
=
usb_open
(
phone
->
__device
);
usb_set_configuration
(
phone
->
device
,
3
);
...
...
@@ -76,58 +88,73 @@ iPhone *get_iPhone() {
if
(
phone
->
__device
&&
phone
->
device
)
break
;
}
if
(
!
phone
->
device
||
!
phone
->
__device
)
{
// nothing connected
// Check to see if we are connected
if
(
!
phone
->
device
||
!
phone
->
__device
)
{
free_iPhone
(
phone
);
if
(
debug
)
printf
(
"get_iPhone(): iPhone not found
\n
"
);
if
(
debug
)
fprintf
(
stderr
,
"get_iPhone(): iPhone not found
\n
"
);
return
NULL
;
}
//
Okay, initialize the phone now.
//
Send the version command to the phone
int
bytes
=
0
;
bytes
=
usb_bulk_write
(
phone
->
device
,
BULKOUT
,
(
char
*
)
version
,
sizeof
(
*
version
),
800
);
if
(
bytes
<
20
&&
debug
)
{
printf
(
"get_iPhone(): libusb did NOT send enough!
\n
"
);
fprintf
(
stderr
,
"get_iPhone(): libusb did NOT send enough!
\n
"
);
if
(
bytes
<
0
)
{
printf
(
"get_iPhone(): libusb gave me the error %d: %s (%s)
\n
"
,
fprintf
(
stderr
,
"get_iPhone(): libusb gave me the error %d: %s (%s)
\n
"
,
bytes
,
usb_strerror
(),
strerror
(
-
bytes
));
}
}
// Read the phone's response
bytes
=
usb_bulk_read
(
phone
->
device
,
BULKIN
,
(
char
*
)
version
,
sizeof
(
*
version
),
800
);
// Check for bad response
if
(
bytes
<
20
)
{
free_iPhone
(
phone
);
if
(
debug
)
printf
(
"get_iPhone(): Invalid version message -- header too short.
\n
"
);
if
(
debug
&&
bytes
<
0
)
printf
(
"get_iPhone(): libusb error message %d: %s (%s)
\n
"
,
bytes
,
usb_strerror
(),
strerror
(
-
bytes
));
free
(
version
);
if
(
debug
)
fprintf
(
stderr
,
"get_iPhone(): Invalid version message -- header too short.
\n
"
);
if
(
debug
&&
bytes
<
0
)
fprintf
(
stderr
,
"get_iPhone(): libusb error message %d: %s (%s)
\n
"
,
bytes
,
usb_strerror
(),
strerror
(
-
bytes
));
return
NULL
;
}
else
{
}
// Check for correct version
if
(
ntohl
(
version
->
major
)
==
1
&&
ntohl
(
version
->
minor
)
==
0
)
{
// We're all ready to roll.
printf
(
"get_iPhone() success
\n
"
);
fprintf
(
stderr
,
"get_iPhone() success
\n
"
);
free
(
version
);
return
phone
;
}
else
{
// BAD HEADER
}
else
{
// Bad header
free_iPhone
(
phone
);
if
(
debug
)
printf
(
"get_iPhone(): Received a bad header/invalid version number."
);
free
(
version
);
if
(
debug
)
fprintf
(
stderr
,
"get_iPhone(): Received a bad header/invalid version number."
);
return
NULL
;
}
}
if
(
debug
)
printf
(
"get_iPhone(): Unknown error.
\n
"
);
return
NULL
;
// if it got to this point it's gotta be bad
// If it got to this point it's gotta be bad
if
(
debug
)
fprintf
(
stderr
,
"get_iPhone(): Unknown error.
\n
"
);
free_iPhone
(
phone
);
free
(
version
);
return
NULL
;
}
/** Cleans up an iPhone structure, then frees the structure itself.
* This is a library-level function; deals directly with the iPhone to tear
* down relations, but otherwise is mostly internal.
*
* @param
victim
A pointer to an iPhone structure.
* @param
phone
A pointer to an iPhone structure.
*/
void
free_iPhone
(
iPhone
*
victim
)
{
if
(
victim
->
buffer
)
free
(
victim
->
buffer
);
if
(
victim
->
device
)
{
usb_release_interface
(
victim
->
device
,
1
);
usb_reset
(
victim
->
device
);
usb_close
(
victim
->
device
);
void
free_iPhone
(
iPhone
*
phone
)
{
if
(
phone
->
buffer
)
free
(
phone
->
buffer
);
if
(
phone
->
device
)
{
usb_release_interface
(
phone
->
device
,
1
);
usb_reset
(
phone
->
device
);
usb_close
(
phone
->
device
);
}
free
(
victim
);
free
(
phone
);
}
/** Sends data to the phone
...
...
@@ -139,16 +166,15 @@ void free_iPhone(iPhone *victim) {
* @return The number of bytes sent, or -1 on error or something.
*/
int
send_to_phone
(
iPhone
*
phone
,
char
*
data
,
int
datalen
)
{
if
(
!
phone
)
return
-
1
;
int
bytes
=
0
;
// it may die here
if
(
debug
)
printf
(
"dying here?
\n
datalen = %i
\n
data = %p
\n
"
,
datalen
,
data
);
if
(
!
phone
)
return
-
1
;
if
(
debug
)
fprintf
(
stderr
,
"send_to_phone: Attempting to send datalen = %i data = %p
\n
"
,
datalen
,
data
);
bytes
=
usb_bulk_write
(
phone
->
device
,
BULKOUT
,
data
,
datalen
,
800
);
if
(
debug
)
printf
(
"noooo...?
\n
"
);
if
(
bytes
<
datalen
)
{
if
(
debug
&&
bytes
<
0
)
printf
(
"send_to_iphone(): libusb gave me the error %d: %s - %s
\n
"
,
bytes
,
usb_strerror
(),
strerror
(
-
bytes
));
fprintf
(
stderr
,
"send_to_iphone(): libusb gave me the error %d: %s - %s
\n
"
,
bytes
,
usb_strerror
(),
strerror
(
-
bytes
));
return
-
1
;
}
else
{
return
bytes
;
...
...
@@ -157,8 +183,7 @@ int send_to_phone(iPhone *phone, char *data, int datalen) {
return
-
1
;
}
/**
* This function is a low-level (i.e. direct to iPhone) function.
/** This function is a low-level (i.e. direct to iPhone) function.
*
* @param phone The iPhone to receive data from
* @param data Where to put data read
...
...
@@ -167,15 +192,16 @@ int send_to_phone(iPhone *phone, char *data, int datalen) {
* @return How many bytes were read in, or -1 on error.
*/
int
recv_from_phone
(
iPhone
*
phone
,
char
*
data
,
int
datalen
)
{
if
(
!
phone
)
return
-
1
;
int
bytes
=
0
;
if
(
debug
)
printf
(
"recv_from_phone(): attempting to receive %i bytes
\n
"
,
datalen
);
if
(
!
phone
)
return
-
1
;
if
(
debug
)
fprintf
(
stderr
,
"recv_from_phone(): attempting to receive %i bytes
\n
"
,
datalen
);
bytes
=
usb_bulk_read
(
phone
->
device
,
BULKIN
,
data
,
datalen
,
3500
);
if
(
bytes
<
0
)
{
if
(
debug
)
printf
(
"recv_from_phone(): libusb gave me the error %d: %s (%s)
\n
"
,
bytes
,
usb_strerror
(),
strerror
(
-
bytes
));
if
(
bytes
<
0
)
{
if
(
debug
)
fprintf
(
stderr
,
"recv_from_phone(): libusb gave me the error %d: %s (%s)
\n
"
,
bytes
,
usb_strerror
(),
strerror
(
-
bytes
));
return
-
1
;
}
return
bytes
;
}
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment