Commit e2ff1128 authored by Zach C's avatar Zach C Committed by Matt Colyer

First released version, 0.089.

parents
/*
* AFC.c -- contains functions for the built-in AFC client.
* Written by FxChiP
*/
#include "AFC.h"
extern int debug;
AFClient *afc_connect(iPhone *phone, int s_port, int d_port) {
if (!phone) return NULL;
AFClient *client = (AFClient*)malloc(sizeof(AFClient));
client->connection = mux_connect(phone, s_port, d_port);
if (!client->connection) { free(client); return NULL; }
else {
client->afc_packet = (AFCPacket*)malloc(sizeof(AFCPacket));
if (client->afc_packet) {
client->phone = phone;
client->afc_packet->packet_num = 0;
client->afc_packet->unknown1 = client->afc_packet->unknown2 = client->afc_packet->unknown3 = client->afc_packet->unknown4 = 0;
client->afc_packet->header1 = 0x36414643;
client->afc_packet->header2 = 0x4141504C;
client->file_handle = 0;
return client;
} else {
mux_close_connection(client->phone, client->connection);
free(client);
return NULL;
}
}
return NULL; // should never get to this point
}
void afc_disconnect(AFClient *client) {
// client and its members should never be NULL is assumed here.
if (!client || !client->connection || !client->phone || !client->afc_packet) return;
mux_close_connection(client->phone, client->connection);
free(client->afc_packet);
free(client);
}
int count_nullspaces(char *string, int number) {
int i = 0, nulls = 0;
for (i = 0; i < number; i++) {
if (string[i] == '\0') nulls++;
}
return nulls;
}
int dispatch_AFC_packet(AFClient *client, char *data, int length) {
char *buffer;
int bytes = 0;
if (!client || !client->connection || !client->phone || !client->afc_packet) return 0;
if (!data || !length) length = 0;
client->afc_packet->packet_num++;
client->afc_packet->entire_length = client->afc_packet->this_length = (length) ? sizeof(AFCPacket) + length + 1 : sizeof(AFCPacket);
if (!length) {
bytes = mux_send(client->phone, client->connection, (char*)client->afc_packet, client->afc_packet->this_length);
if (bytes <= 0) return 0;
else return bytes;
} else {
buffer = (char*)malloc(sizeof(char) * client->afc_packet->this_length);
memcpy(buffer, client->afc_packet, sizeof(AFCPacket));
memcpy(buffer+sizeof(AFCPacket), data, length);
buffer[client->afc_packet->this_length-1] = '\0';
bytes = mux_send(client->phone, client->connection, buffer, client->afc_packet->this_length);
free(buffer); // don't need it
if (bytes <= 0) return 0;
else return bytes;
}
return 0;
}
int receive_AFC_data(AFClient *client, char **dump_here) {
AFCPacket *r_packet;
char *buffer = (char*)malloc(sizeof(AFCPacket) * 4);
int bytes = 0, recv_len = 0;
bytes = mux_recv(client->phone, client->connection, buffer, sizeof(AFCPacket) * 4);
if (bytes <= 0) {
free(buffer);
printf("Just didn't get enough.\n");
*dump_here = NULL;
return 0;
}
r_packet = (AFCPacket*)malloc(sizeof(AFCPacket));
memcpy(r_packet, buffer, sizeof(AFCPacket));
if (r_packet->entire_length == r_packet->this_length && r_packet->entire_length > sizeof(AFCPacket) && r_packet->operation != AFC_ERROR) {
*dump_here = (char*)malloc(sizeof(char) * (r_packet->entire_length-sizeof(AFCPacket)));
memcpy(*dump_here, buffer+sizeof(AFCPacket), r_packet->entire_length-sizeof(AFCPacket));
free(buffer);
free(r_packet);
return r_packet->entire_length - sizeof(AFCPacket);
}
uint32 param1 = buffer[sizeof(AFCPacket)];
free(buffer);
if (r_packet->operation == 0x01) {
printf("Oops? Bad operation code received.\n");
if (param1 == 0) printf("... false alarm, but still\n");
else printf("Errno %i\n", param1);
free(r_packet);
*dump_here = NULL;
return 0;
} else {
printf("Operation code %x\nFull length %i and this length %i\n", r_packet->operation, r_packet->entire_length, r_packet->this_length);
}
recv_len = r_packet->entire_length - r_packet->this_length;
free(r_packet);
buffer = (char*)malloc(sizeof(char) * recv_len);
bytes = mux_recv(client->phone, client->connection, buffer, recv_len);
if (bytes <= 0) {
free(buffer);
printf("Didn't get it at the second pass.\n");
*dump_here = NULL;
return 0;
}
*dump_here = buffer; // what they do beyond this point = not my problem
return bytes;
}
char **afc_get_dir_list(AFClient *client, char *dir) {
client->afc_packet->operation = AFC_LIST_DIR;
int bytes = 0;
char *blah = NULL, **list = NULL;
bytes = dispatch_AFC_packet(client, dir, strlen(dir));
if (!bytes) return NULL;
bytes = receive_AFC_data(client, &blah);
if (!bytes && !blah) return NULL;
list = make_strings_list(blah, bytes);
free(blah);
return list;
}
char **make_strings_list(char *tokens, int true_length) {
if (!tokens || !true_length) return NULL;
int nulls = 0, i = 0, j = 0;
char **list = NULL;
nulls = count_nullspaces(tokens, true_length);
list = (char**)malloc(sizeof(char*) * (nulls + 1));
for (i = 0; i < nulls; i++) {
list[i] = strdup(tokens+j);
j += strlen(list[i]) + 1;
}
list[i] = strdup("");
return list;
}
AFCFile *afc_get_file_info(AFClient *client, char *path) {
client->afc_packet->operation = AFC_GET_INFO;
dispatch_AFC_packet(client, path, strlen(path));
char *received, **list;
AFCFile *my_file;
int length, i = 0;
length = receive_AFC_data(client, &received);
list = make_strings_list(received, length);
free(received);
if (list) {
my_file = (AFCFile *)malloc(sizeof(AFCFile));
for (i = 0; strcmp(list[i], ""); i++) {
if (!strcmp(list[i], "st_size")) {
my_file->size = atoi(list[i+1]);
}
if (!strcmp(list[i], "st_blocks")) {
my_file->blocks = atoi(list[i+1]);
}
if (!strcmp(list[i], "st_ifmt")) {
if (!strcmp(list[i+1], "S_IFREG")) {
my_file->type = S_IFREG;
} else if (!strcmp(list[i+1], "S_IFDIR")) {
my_file->type = S_IFDIR;
}
}
}
free_dictionary(list);
return my_file;
} else {
return NULL;
}
}
AFCFile *afc_open_file(AFClient *client, const char *filename, uint32 file_mode) {
if (file_mode != AFC_FILE_READ && file_mode != AFC_FILE_WRITE) return NULL;
if (!client ||!client->connection || !client->phone ||!client->afc_packet) return NULL;
char *further_data = (char*)malloc(sizeof(char) * (8 + strlen(filename) + 1));
AFCFile *file_infos = NULL;
memcpy(further_data, &file_mode, 4);
uint32 ag = 0;
memcpy(further_data+4, &ag, 4);
memcpy(further_data+8, filename, strlen(filename));
further_data[8+strlen(filename)] = '\0';
int bytes = 0, length_thing = 0;
client->afc_packet->operation = AFC_FILE_OPEN;
bytes = dispatch_AFC_packet(client, further_data, 8+strlen(filename));
free(further_data);
if (bytes <= 0) {
printf("didn't read enough\n");
return NULL;
} else {
printf("O HAI\n");
length_thing = receive_AFC_data(client, &further_data);
if (length_thing && further_data) {
printf("ARA\n");
file_infos = afc_get_file_info(client, filename);
memcpy(&file_infos->filehandle, further_data, 4);
printf("gr\n");
return file_infos;
} else {
printf("didn't get further data or something\n");
return NULL;
}
}
printf("what the fuck\n");
return NULL;
}
int afc_read_file(AFClient *client, AFCFile *file, char *data, int length) {
if (!client || !client->afc_packet || !client->phone || !client->connection || !file) return -1;
AFCFilePacket *packet = (AFCFilePacket*)malloc(sizeof(AFCFilePacket));
char *input = NULL;
packet->unknown1 = packet->unknown2 = 0;
packet->filehandle = file->filehandle;
packet->size = length;
int bytes = 0;
client->afc_packet->operation = AFC_READ;
bytes = dispatch_AFC_packet(client, packet, sizeof(AFCFilePacket));
if (bytes > 0) {
bytes = receive_AFC_data(client, &input);
if (bytes <= 0) {
return -1;
} else {
memcpy(data, input, (bytes > length) ? length : bytes);
return (bytes > length) ? length : bytes;
}
} else {
return -1;
}
return 0;
}
void afc_close_file(AFClient *client, AFCFile *file) {
char *buffer = malloc(sizeof(char) * 8);
uint32 zero = 0;
if (debug) printf("File handle %i\n", file->filehandle);
memcpy(buffer, &file->filehandle, sizeof(uint32));
memcpy(buffer, &zero, sizeof(zero));
client->afc_packet->operation = AFC_FILE_CLOSE;
int bytes = 0;
bytes = dispatch_AFC_packet(client, buffer, sizeof(char) * 8);
free(buffer);
if (!bytes) return;
bytes = receive_AFC_data(client, &buffer);
if (bytes<=0 && !buffer) printf("closefile: all went as expected\n");
else { printf("We have a buffer!??!?\nLength %i\n", bytes); fwrite(buffer, 1, bytes, stdout); printf("\n"); }
if (buffer) free(buffer); // we're *SUPPOSED* to get an "error" here.
}
/*
* AFC.h
* Defines and structs and the like for the built-in AFC client
* Written by FxChiP
*/
#include "usbmux.h"
#include "iphone.h"
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
typedef struct {
//const uint32 header1 = 0x36414643; // '6AFC' or 'CFA6' when sent ;)
uint32 header1, header2;
//const uint32 header2 = 0x4141504C; // 'AAPL' or 'LPAA' when sent ;)
uint32 entire_length, unknown1, this_length, unknown2, packet_num, unknown3, operation, unknown4;
} AFCPacket;
typedef struct {
usbmux_tcp_header *connection;
iPhone *phone;
AFCPacket *afc_packet;
int file_handle;
} AFClient;
typedef struct {
uint32 filehandle, unknown1, size, unknown2;
} AFCFilePacket;
typedef struct {
uint32 filehandle, blocks, size, type;
} AFCFile;
typedef struct __AFCToken {
struct __AFCToken *last, *next;
char *token;
} AFCToken;
enum {
S_IFREG = 0,
S_IFDIR = 1
};
enum {
AFC_FILE_READ = 0x00000002,
AFC_FILE_WRITE = 0x00000003
};
enum {
AFC_ERROR = 0x00000001,
AFC_GET_INFO = 0x0000000a,
AFC_GET_DEVINFO = 0x0000000b,
AFC_LIST_DIR = 0x00000003,
AFC_SUCCESS_RESPONSE = 0x00000002,
AFC_FILE_OPEN = 0x0000000d,
AFC_FILE_CLOSE = 0x00000014,
AFC_FILE_HANDLE = 0x0000000e,
AFC_READ = 0x0000000f
};
AFClient *afc_connect(iPhone *phone, int s_port, int d_port);
void afc_disconnect(AFClient *client);
int count_nullspaces(char *string, int number);
char **make_strings_list(char *tokens, int true_length);
int dispatch_AFC_packet(AFClient *client, char *data, int length);
int receive_AFC_data(AFClient *client, char **dump_here);
char **afc_get_dir_list(AFClient *client, char *dir);
AFCFile *afc_get_file_info(AFClient *client, char *path);
AFCFile *afc_open_file(AFClient *client, const char *filename, uint32 file_mode);
void afc_close_file(AFClient *client, AFCFile *file);
int afc_read_file(AFClient *client, AFCFile *file, char *data, int length);
gcc `xml2-config --cflags --libs` -o main usbmux.c main.c iphone.c plist.c lockdown.c AFC.c -lusb -lgnutls
/* iPhone.c
* Functions for creating and initializing iPhone structures
*/
#include "usbmux.h"
#include "iphone.h"
#include <usb.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
/* get_iPhone()
*
* Returns a structure with data on the first iPhone it finds.
* (Or NULL, on error)
*/
extern int debug;
iPhone *get_iPhone() {
iPhone *phone = (iPhone*)malloc(sizeof(iPhone));
usbmux_version_header *version = version_header();
// initialize the struct
phone->device = NULL;
phone->__device = NULL;
// Initialize libusb.
usb_init();
usb_find_busses();
usb_find_devices();
struct usb_bus *busses = usb_get_busses(), *bus;
struct usb_device *dev;
for (bus = busses; bus; bus = bus->next) {
for (dev = bus->devices; dev; dev = dev->next) {
if (dev->descriptor.idVendor == 0x05ac && (dev->descriptor.idProduct == 0x1290 || dev->descriptor.idProduct == 0x1291)) {
phone->__device = dev;
phone->device = usb_open(phone->__device);
usb_reset(phone->device);
}
}
}
phone->device = NULL; // :( sorry Daniel
phone->__device = NULL; // :( sorry Daniel
for (bus = busses; bus; bus = bus->next) { // do it again as per libusb documentation
for (dev = bus->devices; dev; dev = dev->next) {
if (dev->descriptor.idVendor == 0x05ac && (dev->descriptor.idProduct == 0x1290 || dev->descriptor.idProduct == 0x1291)) {
phone->__device = dev;
phone->device = usb_open(phone->__device);
usb_set_configuration(phone->device, 3);
usb_claim_interface(phone->device, 1);
break;
}
}
if (phone->__device && phone->device) break;
}
if (!phone->device || !phone->__device) { // nothing connected
free_iPhone(phone);
if (debug) printf("get_iPhone(): iPhone not found\n");
return NULL;
}
// Okay, initialize the phone now.
int bytes = 0;
bytes = usb_bulk_write(phone->device, BULKOUT, (char*)version, sizeof(*version), 800);
if (bytes < 20 && debug) {
printf("get_iPhone(): libusb did NOT send enough!\n");
if (bytes < 0) {
printf("get_iPhone(): libusb gave me the error: %s\n", usb_strerror());
}
}
bytes = usb_bulk_read(phone->device, BULKIN, (char*)version, sizeof(*version), 800);
if (bytes < 20) {
free_iPhone(phone);
if (debug) printf("get_iPhone(): Invalid version message -- header too short.\n");
if (debug && bytes < 0) printf("get_iPhone(): libusb error message: %s\n", usb_strerror());
return NULL;
} else {
if (ntohl(version->major) == 1 && ntohl(version->minor) == 0) {
// We're all ready to roll.
printf("get_iPhone() success\n");
return phone;
} else { // BAD HEADER
free_iPhone(phone);
if (debug) printf("get_iPhone(): Received a bad header/invalid version number.");
return NULL;
}
}
if (debug) printf("get_iPhone(): Unknown error.\n");
return NULL; // if it got to this point it's gotta be bad
}
/* free_iPhone(victim)
* This is a library-level function; deals directly with the iPhone to tear down relations,
* but otherwise is mostly internal.
*
* victim: a pointer to an iPhone structure
* Cleans up an iPhone structure, then frees the structure itself.
*/
void free_iPhone(iPhone *victim) {
if (victim->buffer) free(victim->buffer);
if (victim->device) {
usb_release_interface(victim->device, 1);
usb_reset(victim->device);
usb_close(victim->device);
}
free(victim);
}
/* send_to_phone(phone, data, datalen)
* This is a low-level (i.e. directly to phone) function.
*
* phone: the iPhone to send data to
* data: the data to send to the iPhone
* datalen: the length of the data
*
* Returns the number of bytes sent, or -1 on error or something.
*/
int send_to_phone(iPhone *phone, char *data, int datalen) {
if (!phone) return -1;
int bytes = 0;
// it may die here
if (debug) printf("dying here?\ndatalen = %i\ndata = %x\n", datalen, data);
bytes = usb_bulk_write(phone->device, BULKOUT, data, datalen, 800);
if (debug) printf("noooo...?\n");
if (bytes < datalen) {
return -1;
} else {
return bytes;
}
return -1;
}
/* recv_from_phone(phone, data, datalen):
* This function is a low-level (i.e. direct to iPhone) function.
*
* phone: the iPhone to receive data from
* data: where to put data read
* datalen: how much data to read in
*
* Returns: how many bytes were read in, or -1 on error.
*/
int recv_from_phone(iPhone *phone, char *data, int datalen) {
if (!phone) return -1;
int bytes = 0;
bytes = usb_bulk_read(phone->device, BULKIN, data, datalen, 3500);
return bytes;
}
/* iphone.h
* iPhone struct
* Written by FxChiP */
#ifndef IPHONE_H
#define IPHONE_H
#ifndef USBMUX_H
#include "usbmux.h"
#warning usbmux not included?
#endif
#include <usb.h>
#define BULKIN 0x85
#define BULKOUT 0x04
typedef struct {
char *buffer;
struct usb_dev_handle *device;
struct usb_device *__device;
} iPhone;
// Function definitions
void free_iPhone(iPhone *victim);
iPhone *get_iPhone();
int send_to_phone(iPhone *phone, char *data, int datalen);
int recv_from_phone(iPhone *phone, char *data, int datalen);
#endif
This diff is collapsed.
/*
* lockdown.h
* Defines lockdown stuff, like the client struct.
*/
#ifndef LOCKDOWND_H
#define LOCKDOWND_H
#include "plist.h"
#include <gnutls/gnutls.h>
#include <string.h>
typedef struct {
usbmux_tcp_header *connection;
gnutls_session_t *ssl_session;
iPhone *iphone;
int in_SSL;
char *gtls_buffer_hack;
int gtls_buffer_hack_len;
} lockdownd_client;
lockdownd_client *new_lockdownd_client(iPhone *phone);
int lockdownd_hello(lockdownd_client *control);
int lockdownd_recv(lockdownd_client *control, char **dump_data);
int lockdownd_send(lockdownd_client *control, char *raw_data, uint32 length);
void lockdownd_close(lockdownd_client *control);
// SSL functions
int lockdownd_start_SSL_session(lockdownd_client *control, const char *HostID);
ssize_t lockdownd_securead(gnutls_transport_ptr_t transport, char *buffer, size_t length);
ssize_t lockdownd_secuwrite(gnutls_transport_ptr_t transport, char *buffer, size_t length);
// Higher-level lockdownd stuff
int lockdownd_start_service(lockdownd_client *control, const char *service);
#endif
/*
* libiphone main.c written by FxChiP
* With much help from Daniel Brownlees
*/
#include <stdio.h>
#include <string.h>
#include <errno.h>
#include <usb.h>
#include "usbmux.h"
#include "iphone.h"
#include <libxml/parser.h>
#include <libxml/tree.h>
#include "plist.h"
#include "lockdown.h"
#include "AFC.h"
int debug = 1;
int main(int argc, char *argv[]) {
iPhone *phone = get_iPhone();
if (argc > 1 && !strcasecmp(argv[1], "--debug")) debug = 1;
else debug = 0;
char *response = (char*)malloc(sizeof(char) * 2048);
int bytes = 0, port = 0, i = 0;
if (phone) printf("I got a phone.\n");
else { printf("oops\n"); return -1; }
lockdownd_client *control = new_lockdownd_client(phone);
if (!lockdownd_hello(control)) {
printf("Something went wrong in the lockdownd client, go take a look.\n");
} else {
printf("We said hello. :)\n");
}
printf("Now starting SSL.\n");
if (!lockdownd_start_SSL_session(control, "29942970-207913891623273984")) {
printf("Error happened in GnuTLS...\n");
} else {
printf("... we're in SSL with the phone... !?\n");
}
port = lockdownd_start_service(control, "com.apple.afc");
if (port) {
printf("Start Service successful -- connect on port %i\n", port);
AFClient *afc = afc_connect(phone, 3432, port);
if (afc) {
char **dirs;
dirs = afc_get_dir_list(afc, "/eafaedf");
if (!dirs) dirs = afc_get_dir_list(afc, "/");
printf("Directory time.\n");
for (i = 0; strcmp(dirs[i], ""); i++) {
printf("/%s\n", dirs[i]);
}
free_dictionary(dirs);
AFCFile *my_file = afc_open_file(afc, "/iTunesOnTheGoPlaylist.plist", AFC_FILE_READ);
if (my_file) {
printf("A file size: %i\n", my_file->size);
char *file_data = (char*)malloc(sizeof(char) * my_file->size);
bytes = afc_read_file(afc, my_file, file_data, my_file->size);
if (bytes >= 0) {
printf("The file's data:\n");
fwrite(file_data, 1, bytes, stdout);
}
printf("\nClosing my file.\n");
afc_close_file(afc, my_file);
free(my_file);
free(file_data);
} else printf("couldn't open a file\n");
}
afc_disconnect(afc);
} else {
printf("Start service failure.\n");
}
printf("All done.\n");
free_iPhone(phone);
return 0;
}
/*
* plist.c
* Builds plist XML structures.
* Written by FxChiP
*/
#include <libxml/parser.h>
#include <libxml/tree.h>
#include <string.h>
#include "plist.h"
const char *plist_base = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\
<!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n\
<plist version=\"1.0\">\n\
</plist>\0";
xmlDocPtr new_plist() {
char *plist = strdup(plist_base);
xmlDocPtr plist_xml = xmlReadMemory(plist, strlen(plist), NULL, NULL, 0);
if (!plist_xml) return NULL;
free(plist);
return plist_xml;
}
void free_plist(xmlDocPtr plist) {
if (!plist) return;
xmlFreeDoc(plist);
}
xmlNode *add_child_to_plist(xmlDocPtr plist, const char *name, const char *content, xmlNode *to_node, int depth) {
if (!plist) return NULL;
int i = 0;
xmlNode *child;
if (!to_node) to_node = xmlDocGetRootElement(plist);
for (i = 0; i < depth; i++) {
xmlNodeAddContent(to_node, "\t");
}
child = xmlNewChild(to_node, NULL, name, content);
xmlNodeAddContent(to_node, "\n");
return child;
}
xmlNode *add_key_str_dict_element(xmlDocPtr plist, xmlNode *dict, const char *key, const char *value, int depth) {
xmlNode *keyPtr;
keyPtr = add_child_to_plist(plist, "key", key, dict, depth);
add_child_to_plist(plist, "string", value, dict, depth);
return keyPtr;
}
char **read_dict_element_strings(xmlNode *dict) {
// reads a set of keys and strings into an array where each even number is a key and odd numbers are values.
// if the odd number is \0, that's the end of the list.
char **return_me = NULL, **old = NULL;
int current_length = 0;
int current_pos = 0;
xmlNode *dict_walker;
for (dict_walker = dict->children; dict_walker; dict_walker = dict_walker->next) {
if (!xmlStrcmp(dict_walker->name, "key")) {
current_length += 2;
old = return_me;
return_me = realloc(return_me, sizeof(char*) * current_length);
if (!return_me) {
free(old);
return NULL;
}
return_me[current_pos++] = xmlNodeGetContent(dict_walker);
return_me[current_pos++] = xmlNodeGetContent(dict_walker->next->next);
}
}
// one last thing...
old = return_me;
return_me = realloc(return_me, sizeof(char*) * current_length+1);
return_me[current_pos] = strdup("");
return return_me;
}
void free_dictionary(char **dictionary) {
if (!dictionary) return;
int i = 0;
for (i = 0; strcmp(dictionary[i], ""); i++) {
free(dictionary[i]);
}
free(dictionary[i]);
free(dictionary);
}
/* plist.h
* contains structures and the like for plists
* written by fxchip
*/
#ifndef PLIST_H
#define PLIST_H
#include <libxml/parser.h>
#include <libxml/tree.h>
xmlNode *add_key_str_dict_element(xmlDocPtr plist, xmlNode *dict, const char *key, const char *value, int depth);
xmlNode *add_child_to_plist(xmlDocPtr plist, const char *name, const char *content, xmlNode *to_node, int depth);
void free_plist(xmlDocPtr plist);
xmlDocPtr new_plist();
void free_dictionary(char **dictionary);
#endif
#include <sys/types.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include "usbmux.h"
extern int debug;
usbmux_tcp_header *new_mux_packet(uint16 s_port, uint16 d_port) {
usbmux_tcp_header *conn = (usbmux_tcp_header*)malloc(sizeof(usbmux_tcp_header));
conn->type = htonl(6);
conn->length = 28;
conn->sport = htons(s_port);
conn->dport = htons(d_port);
conn->scnt = 0;
conn->ocnt = 0;
conn->offset = 0x50;
conn->window = htons(0x0200);
conn->nullnull = 0x0000;
conn->length16 = 28;
return conn;
}
usbmux_version_header *version_header() {
usbmux_version_header *version = (usbmux_version_header*)malloc(sizeof(usbmux_version_header));
version->type = 0;
version->length = htonl(20);
version->major = htonl(1);
version->minor = 0;
version->allnull = 0;
return version;
}
/* mux_connect(phone, s_port, d_port)
* This is a higher-level USBMuxTCP-type function.
* phone: the iPhone to initialize a connection on.
* s_port: the source port
* d_port: the destination port -- 0xf27e for lockdownd.
* Initializes a connection on phone, with source port s_port and destination port d_port
*
* Returns a mux TCP header for the connection which is used for tracking and data transfer.
*/
usbmux_tcp_header *mux_connect(iPhone *phone, uint16 s_port, uint16 d_port) {
if (!phone || !s_port || !d_port) return NULL;
int bytes = 0;
// Initialize connection stuff
usbmux_tcp_header *new_connection;
new_connection = new_mux_packet(s_port, d_port);
usbmux_tcp_header *response;
response = (usbmux_tcp_header*)malloc(sizeof(usbmux_tcp_header));
// blargg
if (new_connection) {
new_connection->tcp_flags = 0x02;
new_connection->length = htonl(new_connection->length);
new_connection->length16 = htons(new_connection->length16);
if (send_to_phone(phone, (char*)new_connection, sizeof(*new_connection)) >= 0) {
bytes = recv_from_phone(phone, (char*)response, sizeof(*response));
if (response->tcp_flags != 0x12) return NULL;
else {
new_connection->tcp_flags = 0x10;
new_connection->scnt = 1;
new_connection->ocnt = 1;
return new_connection;
}
} else {
return NULL;
}
}
// if we get to this point it's probably bad
return NULL;
}
/* mux_close_connection(phone, connection)
* This is a higher-level USBmuxTCP-type function.
* phone: the iPhone to close a connection with.
* connection: the connection to close.
*
* Doesn't return anything; WILL FREE THE CONNECTION'S MEMORY!!!
*/
void mux_close_connection(iPhone *phone, usbmux_tcp_header *connection) {
if (!phone || !connection) return;
connection->tcp_flags = 0x04;
connection->scnt = htonl(connection->scnt);
connection->ocnt = htonl(connection->ocnt);
int bytes = 0;
bytes = usb_bulk_write(phone->device, BULKOUT, (char*)connection, sizeof(*connection), 800);
bytes = usb_bulk_read(phone->device, BULKIN, (char*)connection, sizeof(*connection), 800);
free(connection);
}
/* mux_send(phone, connection, data, datalen)
* This is a higher-level USBMuxTCP-like function.
* phone: the iPhone to send to.
* connection: the connection we're sending data on.
* data: a pointer to the data to send.
* datalen: how much data we're sending.
*
* Returns number of bytes sent, minus the header (28), or -1 on error.
*/
int mux_send(iPhone *phone, usbmux_tcp_header *connection, char *data, uint32 datalen) {
if (!phone || !connection || !data || datalen == 0) return -1;
// connection->scnt and connection->ocnt should already be in host notation...
// we don't need to change them juuuust yet.
int bytes = 0;
if (debug) printf("mux_send(): client wants to send %i bytes\n", datalen);
char *buffer = (char*)malloc(sizeof(*connection) + datalen + 2); // allow 2 bytes of safety padding
// Set the length and pre-emptively htonl/htons it
connection->length = htonl(sizeof(*connection) + datalen);
connection->length16 = htons(sizeof(*connection) + datalen);
// Put scnt and ocnt into big-endian notation
connection->scnt = htonl(connection->scnt);
connection->ocnt = htonl(connection->ocnt);
// Concatenation of stuff in the buffer.
memcpy(buffer, connection, sizeof(*connection));
memcpy(buffer+sizeof(*connection)/*+sizeof(datalen)*/, data, datalen);
// We have a buffer full of data, we should now send it to the phone.
if (debug) printf("actually sending %i bytes of data at %x\n", sizeof(*connection)+datalen, buffer);
bytes = send_to_phone(phone, buffer, sizeof(*connection)+datalen);
// Now that we've sent it off, we can clean up after our sloppy selves.
free(buffer);
// Re-calculate scnt and ocnt
connection->scnt = ntohl(connection->scnt) + datalen;
connection->ocnt = ntohl(connection->ocnt);
// Revert lengths
connection->length = ntohl(connection->length);
connection->length16 = ntohs(connection->length16);
// Now return the bytes.
if (bytes < sizeof(*connection)+datalen) {
return -1; // blah
} else {
return bytes - 28; // actual length sent. :/
}
return bytes; // or something
}
/* mux_recv(phone, connection, data, datalen)
* This is a higher-level USBMuxTCP-like function
* phone: the phone to receive data from.
* connection: the connection to receive data on.
* data: where to put the data we receive.
* datalen: how much data to read.
*
* Returns: how many bytes were read, or -1 if something bad happens.
*/
int mux_recv(iPhone *phone, usbmux_tcp_header *connection, char *data, uint32 datalen) {
char *buffer = (char*)malloc(sizeof(*connection) + sizeof(datalen) + datalen);
int bytes = 0, my_datalen = 0;
if (debug) printf("mux_recv: datalen == %i\n", datalen);
bytes = recv_from_phone(phone, buffer, sizeof(*connection) + datalen);
if (debug) printf("mux_recv: bytes == %i\n", bytes);
if (bytes < datalen) {
if (bytes < 28) {
// if they didn't do that annoying thing, something else mighta happened.
if (debug) printf("mux_recv: bytes too low anyway!\n");
free(buffer);
return -1;
} else if (bytes == 28) { // no data...
free(buffer);
return 0;
} else { // bytes > 28
my_datalen = ntohl(buffer[4]) - 28;
connection->ocnt += my_datalen;
memcpy(data, buffer+28, bytes - 28);
free(buffer);
if (debug) printf("mux_recv: bytes received: %i\n", bytes - 28);
return bytes - 28;
}
} else {// all's good, they didn't do anything bonky.
my_datalen = ntohl(buffer[4]) - 28;
connection->ocnt += my_datalen;
memcpy(data, buffer+28, datalen);
free(buffer);
if (debug) printf("mux_recv: bytes received: %i\n", bytes - 28);
return bytes - 28;
}
return bytes;
}
#include <sys/types.h>
#include <stdlib.h>
#include <stdint.h>
#ifndef USBMUX_H
#define USBMUX_H
#ifndef IPHONE_H
#include "iphone.h"
#endif
typedef uint16_t uint16;
typedef uint32_t uint32;
typedef uint8_t uint8;
typedef struct {
uint32 type, length;
uint16 sport, dport;
uint32 scnt, ocnt;
uint8 offset, tcp_flags;
uint16 window, nullnull, length16;
} usbmux_tcp_header;
usbmux_tcp_header *new_mux_packet(uint16 s_port, uint16 d_port);
typedef struct {
uint32 type, length, major, minor, allnull;
} usbmux_version_header;
usbmux_version_header *version_header();
usbmux_tcp_header *mux_connect(iPhone *phone, uint16 s_port, uint16 d_port);
void mux_close_connection(iPhone *phone, usbmux_tcp_header *connection);
int mux_send(iPhone *phone, usbmux_tcp_header *connection, char *data, uint32 datalen);
int mux_recv(iPhone *phone, usbmux_tcp_header *connection, char *data, uint32 datalen);
#endif
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment