apple-data 1.0.603 → 1.0.605

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 6481d521a2e38a707f359222233661bd1732d032d4db3b04951e0b9c7ed80038
4
- data.tar.gz: b03d824d4282dfbd6ea02badd95b7a65dc6c32efffa2a7e35a3d57f82cd86b54
3
+ metadata.gz: 79e93b4822f94100e4d0301f262650fdcb796733f273aaada9118cb9697f86af
4
+ data.tar.gz: 862835de00f4e23034b44b90cd0055c20ccb718b1a6f4185dec9c5b8d9f81bd8
5
5
  SHA512:
6
- metadata.gz: 07ef65c955be0b50e3b7cb3c749107f3d2e7e438c27d88ab566431b155caa921089d32eb218634ddf6034ac1b38576c386f29b7ea256182fa93a9f07737c99a5
7
- data.tar.gz: 468030029f6c6572d4f4a5567d817542e493385a8ffe0cce9872095e3cce0a346918cf28dd9185c193671ad67ca7cba060b7949fc5f1b271e4c64cce2a4cb905
6
+ metadata.gz: 9885e73df3a36d75970463e472a8fa9b005f7e818a42a39a44f09ba9dfcf6d12b1e233f276bc5758b804b3cdd571082fafd2615a23212bb4c53fc946275061f2
7
+ data.tar.gz: 0efa4c7738f69416488ee3bdba6ba7c46733436f9cc8ee7c180f4a800413b3ea34cc7de2f1e86f00f7c91270d0ae0781c39f6d1e117acc78dbb0423ab6ef628d
@@ -1,5 +1,5 @@
1
1
  # frozen_string_literal: true
2
2
 
3
3
  module AppleData
4
- VERSION = '1.0.603'
4
+ VERSION = '1.0.605'
5
5
  end
data/share/img4.yaml CHANGED
@@ -2,6 +2,32 @@
2
2
  metadata:
3
3
  description:
4
4
  credits:
5
+ types:
6
+ digest-object:
7
+ description: Digest Objects are Firmare or Other Hashable Datastreams.
8
+ They will exist in NOR, Disk, or be received over USB. These objects
9
+ will contain a `DGST` value that is the cryptographic hash of the contents.
10
+ They can contain additional properties per object, some of which are standard
11
+ and others that are object specific.
12
+ common_properties:
13
+ ESEC: Effective Security Mode - The security mode after evaluating the chip and any demotion request
14
+ EPRO: Effective Production Mode - The peoduction mode after evaluating the chip production and demotation request
15
+ EKEY: Effective Key Access - The effective access to teh SEP, used to protect data during demotion
16
+ subtypes:
17
+ local-boot-object:
18
+ trust-measurement:
19
+ description: A trust measurement is requested from the processor to ensure that
20
+ the boot flow has not changed since a prior time that measurement was taken.
21
+ To date the trust measurement is commonly found on SEP firmware images.
22
+ ssv-root-hash:
23
+ description: Root Hash values are used to validate the Signature of an APFS Signed
24
+ volume or snapshot. They will be paired to a coresponding disk image. Some also
25
+ are paired with `ssv-merkle-tree` which includes the metadata for the volume.
26
+ trust-cache:
27
+ img4-disk-image:
28
+ description: Disk images are often signed IMG4 payloads used for USB boot or as the
29
+ arm64BaseSystem.dmg. IMG4 is used for smaller disk images that can be entirely
30
+ validated "single shot" unlike larger disks which use SSV and validate on read.
5
31
  img4_tags:
6
32
  acfw:
7
33
  description:
@@ -16,18 +42,26 @@ img4_tags:
16
42
  agfi:
17
43
  description:
18
44
  almo:
19
- description:
45
+ description: Some internal iBootable image. Unknown purpose
20
46
  AMNM:
21
47
  description: allow mix-n-match
48
+ When set to true, img4s can be any valid signed version, allowing for unusual AP tickets where some
49
+ components may be from a prior verson
22
50
  type: boolean
23
51
  anef:
24
52
  description: Apple Neural Engine Firmware
53
+ type: digest-object
54
+ roots:
55
+ - ManifestKey-DataCenter
25
56
  anrd:
26
57
  description:
27
58
  aofi:
28
59
  description:
29
60
  aopf:
30
61
  description: Always on processor firmware
62
+ type: digest-object
63
+ roots:
64
+ - ManifestKey-DataCenter
31
65
  apmv:
32
66
  description:
33
67
  ater:
@@ -37,9 +71,14 @@ img4_tags:
37
71
  auac:
38
72
  description:
39
73
  aubt:
40
- description:
74
+ description: Auxiliary
41
75
  augs:
42
- description: Included in APTicket CA extensions
76
+ description:
77
+ Auxiliary User System Image
78
+ Included in APTicket CA extensions, as well as factory manifests.
79
+ roots:
80
+ - ExtraContent
81
+ - ManifestKey
43
82
  aupr:
44
83
  description:
45
84
  auxi:
@@ -85,13 +124,16 @@ img4_tags:
85
124
  opt in to a more restrictive AuxKC inclusion. The auxp field is a prerequisite for setting the auxr
86
125
  field in the LocalPolicy. Users change the auxr value implicitly when they build a new AuxKC from
87
126
  the Security & Privacy pane in System Preferences.
88
- type: binary
127
+ type: digest-object
89
128
  subtype: sha2-384
90
129
  access:
91
130
  write:
92
131
  - macOS
93
132
  avef:
94
133
  description: AV Encryption (DRM) Firmware
134
+ type: digest-object
135
+ roots:
136
+ - ManifestKey-DataCenter
95
137
  bat0:
96
138
  description: battery image 0
97
139
  bat1:
@@ -100,11 +142,14 @@ img4_tags:
100
142
  description: battery full image
101
143
  BLDS:
102
144
  description:
103
-
104
145
  prid:
105
146
  description: Encrypted Private Key / Private Key Info
106
147
  bles:
107
148
  description:
149
+ rtmu:
150
+ description: Restore TMU for AP
151
+ type: digest-object
152
+ recovery: true
108
153
  BNCH:
109
154
  description: Boot Nonce Hash - based on the values of com.apple.System.boot-nonces
110
155
  BORD:
@@ -118,28 +163,39 @@ img4_tags:
118
163
  alias:
119
164
  - board-id
120
165
  bstc:
121
- description:
166
+ description: Base Sysetm Static Trust Cache
167
+ type: digest-object
168
+ subtype: trust-cache
122
169
  bsys:
123
- description:
170
+ description: Base System Seal Root Hash
171
+ type: digest-object
172
+ subtype: ssv-root-hash
124
173
  CEPO:
125
174
  description: |-
126
175
  Certificate/Chip Epoch. This is a unit of roll-forward time (monotonic) that allows for any security issues
127
176
  in the prior epoch to be fixed by a anti-rollback scheme.
177
+ nullable: true
178
+ type: boolean
128
179
  alias:
129
180
  - chip-epoch
130
181
  cfel:
131
182
  description:
132
183
  chg0:
133
184
  description: Charging Image 0
185
+ type: digest-object
186
+ subtype: graphic
134
187
  faic:
135
188
  description:
136
189
  type: integer
137
190
  default: 0
138
191
  chg1:
139
192
  description: Charging Image 1
193
+ type: digest-object
194
+ subtype: graphic
140
195
  CHIP:
141
196
  description: Unique identifier for a single Apple designed application processor
142
197
  sharing the same GID key
198
+ type: integer
143
199
  width: 2
144
200
  nsph:
145
201
  description: preboot splat manifest hash
@@ -151,14 +207,17 @@ img4_tags:
151
207
  description:
152
208
  cmsv:
153
209
  description:
210
+ rans:
211
+ description: Restore Apple NAND Storage Firmware
212
+ type: digest-object
154
213
  coih:
155
214
  title: CustomOS Image4 Manifest Hash (coih)
156
215
  description: >
157
216
  The `coih` is an SHA384 hash of CustomOS Image4 manifest. The payload for that manifest is used
158
217
  by iBoot (instead of the XNU kernel) to transfer control. Users change the `coih` value implicitly when
159
218
  they use the `kmutil` configure-boot command-line tool in 1TR.
160
- type: binary
161
- subtype: sha2-384
219
+ type: digest-object
220
+ subtype: IM4M
162
221
  access:
163
222
  write:
164
223
  - 1TR
@@ -166,31 +225,71 @@ img4_tags:
166
225
  description: Chip promotion fuse value (what is burned in)
167
226
  alias:
168
227
  - certificate-production-status
228
+ nullable: true
169
229
  type: boolean
170
230
  CSEC:
171
231
  description: Burned-in chip security mode
232
+ type: boolean
233
+ nullable: true
172
234
  alias:
173
235
  - certificate-security-mode
174
236
  csys:
175
- description:
237
+ description: Install / Restore SSV Root Hash
238
+ type: digest-object
239
+ subtype: ssv-root-hash
176
240
  dali:
177
241
  description:
178
242
  data:
179
243
  description:
244
+ casy:
245
+ description: App Cryptex SSV Root Hash
246
+ type: digest-object
247
+ subtype: ssv-root-hash
248
+ roots:
249
+ - ExtraContent
250
+ cssy:
251
+ description: System Cryptex SSV Root Hash
252
+ type: digest-object
253
+ subtype: ssv-root-hash
254
+ roots:
255
+ - ExtraContent
180
256
  DGST:
181
257
  description: payload digest
182
258
  diag:
183
259
  description:
260
+ trca:
261
+ description:
262
+ type: digest-object
263
+ roots:
264
+ - ExtraContent
265
+ csos:
266
+ description:
267
+ type: digest-object
268
+ roots:
269
+ - ExtraContent
270
+ trcs:
271
+ description:
272
+ type: digest-object
273
+ roots:
274
+ - ExtraContent
184
275
  disk:
185
276
  description:
186
277
  DPRO:
187
- description:
278
+ description: Demote from Production Request
279
+ Value is used by TSS sever to issue EPRO values, or effective AP prodctuion state.
188
280
  DSEC:
189
- description:
281
+ description: Demote from Secure Request
282
+ Value is used by TSS server to issue ESEC values, or effective AP Security Mode should the
283
+ requester be authorized. These requests are not available to consumers, only to Apple Internal.
190
284
  dtre:
191
285
  description: device tree
286
+ type: digest-object
287
+ subtype: device-tree
192
288
  dtrs:
193
289
  description: device tree for recovery
290
+ type: digest-object
291
+ subtype: device-tree
292
+ recovery: true
194
293
  ECID:
195
294
  description: Exclusive chip identifier. This is burned into an eFuse at time
196
295
  of manufacture and unique across all devices sharing the same CHIP
@@ -211,10 +310,16 @@ img4_tags:
211
310
  description:
212
311
  EKEY:
213
312
  description: Effective chip promoted
313
+ nullable: false
314
+ type: boolean
214
315
  EPRO:
215
316
  description: Effective chip promotion / demotion state (if CPFM 03 this must be 0 to set ESEC)
216
317
  alias:
217
318
  - effective-production-status-ap
319
+ nullable: false
320
+ type: boolean
321
+ secb:
322
+ description: Sets a security value such as `trst` or the FDR signing trust object. "security blob?"
218
323
  esca:
219
324
  description:
220
325
  hrlp:
@@ -231,6 +336,7 @@ img4_tags:
231
336
  - macOS
232
337
  esdm:
233
338
  description: Extended Security Domain fuses
339
+ type: integer
234
340
  alias:
235
341
  - esdm-fuses
236
342
  styp:
@@ -238,6 +344,42 @@ img4_tags:
238
344
  type: u32
239
345
  alias:
240
346
  - cryptex subtype
347
+ roots:
348
+ - ExtraContent
349
+ acid:
350
+ stID:
351
+ description: Station IDentifier
352
+ AcID:
353
+ description: Apple Account DSID
354
+ type: integer
355
+ WSKU:
356
+ description: Wireless SKU
357
+ WMac:
358
+ description: Wireless MAC Address
359
+ TMac:
360
+ description: Thunderbolt MAC Address
361
+ manifest: true
362
+ BMac:
363
+ description: Bluetooth MAC Address
364
+ manifest: true
365
+ SrNm:
366
+ description: Unit Serial Number
367
+ manifest: true
368
+ ptrp:
369
+ snuf:
370
+ description: Staged next update firmware?
371
+ Regn:
372
+ description: Region Code
373
+ example: LL/A
374
+ type: string
375
+ manifest: true
376
+ Mod#:
377
+ CLHS:
378
+ HmCA:
379
+ FSCl:
380
+ ADCL:
381
+ clid:
382
+ hop0:
241
383
  oppd:
242
384
  description: Unknown, used by `stg1`/`sepi` - sha384 hash sized
243
385
  ESEC:
@@ -247,25 +389,49 @@ img4_tags:
247
389
  euou:
248
390
  description: engineering use-only unit
249
391
  clas:
250
- description: product class (often used in FDR specificatons)
392
+ description: Class for Key / Object - Found in FDR objects
393
+ examples:
394
+ roots:
395
+ - ExtraContent
251
396
  psmh:
252
397
  description: previous stage manifest hash
398
+
253
399
  fchp:
254
- description: Cryptex1,ChipID
400
+ description: Cryptex1,ChipID - Mask
401
+ roots:
402
+ - ExtraContent
255
403
  fdrs:
256
404
  description:
405
+ rvok:
406
+ description: Trust object revocation list
407
+ trpk:
408
+ description: Trust public keys
409
+ rssl:
410
+ description: The valid CA used for secure communications with the FDR server to obtain the FDR objects. This
411
+ differs from the `trst` object as `rssl` is in transit and `trst` is at rest.
257
412
  fdrt:
258
413
  description:
259
414
  file:
260
415
  description:
261
416
  fpgt:
262
417
  description:
418
+ ftab:
419
+ description: >
420
+ Factory Trust - Auto Boot
421
+ FTAB images (used for devices such as AirPods, etc) are "hacktivated" or pre-APTicket'ed devices as they
422
+ lack either a restore connection, or persistet memory. Common early usage of this was the Heywire dongles
423
+ used for video conversion on the Mac. It was simplest for the device to lack NAND and simply receive the
424
+ firmware from a host on powerup. FTAB files are fully ready to run blobs often including RTKit OS based
425
+ memory images.
263
426
  ftap:
264
- description:
427
+ description: >
428
+ Factory Trust - Application Processor
429
+ type: hash
265
430
  ftot:
266
- description:
431
+ description: Factory Trust - Other
267
432
  ftsp:
268
- description:
433
+ description: Factory Trust - SEP
434
+ type: hash
269
435
  fuos:
270
436
  description: Fully Unsigned OS
271
437
  gfxf:
@@ -273,7 +439,7 @@ img4_tags:
273
439
  ging:
274
440
  description:
275
441
  glyc:
276
- description:
442
+ description: Gyroscope Calibration
277
443
  glyp:
278
444
  description:
279
445
  hash:
@@ -286,14 +452,36 @@ img4_tags:
286
452
  description:
287
453
  homr:
288
454
  description:
289
- hrlp:
290
- description:
455
+ cnch:
456
+ roots:
457
+ - ExtraContent
458
+ ndom:
459
+ roots:
460
+ - ExtraContent
461
+ pave:
462
+ description: XNU version string?
463
+ type: string
464
+ roots:
465
+ - ExtraContent
291
466
  hypr:
292
467
  description: Hypervisor
293
468
  iBEC:
294
469
  description: iBoot Epoch Change
295
- iBoot:
470
+ ibot:
296
471
  description: iBoot
472
+ ibdt:
473
+ description: iBoot Data
474
+ ibd1:
475
+ description: iBoot Data Stage 1
476
+ glyP:
477
+ ibss:
478
+ dven:
479
+ dcp2:
480
+ ciof:
481
+ batF:
482
+ ansf:
483
+ rfcg:
484
+ type: boolean
297
485
  iBSS:
298
486
  description: iBoot Second Stage
299
487
  ienv:
@@ -315,19 +503,21 @@ img4_tags:
315
503
  ispf:
316
504
  description: Image Signal Processor Firmware
317
505
  isys:
318
- description: iBridge System
506
+ description: Install System SSV Root Hash
319
507
  itst:
320
508
  description:
321
509
  iuob:
322
510
  description:
323
511
  iuos:
324
- description:
512
+ description: Internal Use Only Software
325
513
  iuou:
326
- description:
514
+ description: Internal Use Only Unit
327
515
  kdlv:
328
516
  description:
329
517
  krnl:
330
518
  description: Kernel
519
+ acdc:
520
+ description:
331
521
  kuid:
332
522
  title: Key encryption key (KEK) Group UUID (kuid)
333
523
  description: >
@@ -348,7 +538,8 @@ img4_tags:
348
538
  LNCH:
349
539
  description:
350
540
  lobo:
351
- description: Local Boot
541
+ description: Local Boot Object. Indicates that the object is to be used as the target of a local boot only
542
+ and not provided by the server for remote / DFU boots.
352
543
  logo:
353
544
  description: Apple logo image
354
545
  love:
@@ -363,16 +554,25 @@ img4_tags:
363
554
  - 1TR
364
555
  - recoveryOS
365
556
  - macOS
557
+ roots:
558
+ - ManifestKey-DataCenter
366
559
  prtp:
367
560
  description: Product ID String
368
561
  type: string
369
562
  example: iPhone16,2
563
+ roots:
564
+ - ManifestKey-DataCenter
370
565
  sdkp:
371
- description: SEP Product Type
566
+ description: SDK for Product
372
567
  type: string
373
- example: iphoneos
568
+ roots:
569
+ - ManifestKey-DataCenter
570
+ values:
571
+ - iphoneos
572
+ - macos
374
573
  lphp:
375
574
  description:
575
+ mspr:
376
576
  lpnh:
377
577
  title: LocalPolicy Nonce Hash (lpnh)
378
578
  description: >
@@ -401,7 +601,7 @@ img4_tags:
401
601
  magg:
402
602
  description:
403
603
  MANB:
404
- description:
604
+ description: Manifest B
405
605
  MANP:
406
606
  description: Manifest Payload
407
607
  manx:
@@ -421,7 +621,7 @@ img4_tags:
421
621
  msec:
422
622
  description:
423
623
  msys:
424
- description:
624
+ description: Merkle Tree Metadata for System Disk
425
625
  mtfw:
426
626
  description:
427
627
  name:
@@ -433,7 +633,8 @@ img4_tags:
433
633
  nsrv:
434
634
  description:
435
635
  OBJP:
436
- description:
636
+ description: Object Properties - Values that may be assigned per "object" (firmawres) that contain a `DGST`
637
+ type: sequence
437
638
  omer:
438
639
  description:
439
640
  ooth:
@@ -462,6 +663,8 @@ img4_tags:
462
663
  description:
463
664
  pmpf:
464
665
  description: Power Management Processor Firmware
666
+ type: digest-object
667
+ subtype:
465
668
  pndp:
466
669
  description:
467
670
  prot:
@@ -472,8 +675,8 @@ img4_tags:
472
675
  over time (because nonces like lpnh are frequently updated). The prot field, which is found only in each
473
676
  macOS LocalPolicy, provides a pairing to indicate the recoveryOS LocalPolicy that corresponds to the
474
677
  macOS LocalPolicy.
475
- type: binary
476
- subtype: sha2-384
678
+ type: digest-object
679
+ subtype: trust-measurement
477
680
  access:
478
681
  write:
479
682
  - 1TR
@@ -481,18 +684,25 @@ img4_tags:
481
684
  - macOS
482
685
  rbmt:
483
686
  description:
687
+ mtpf:
484
688
  rddg:
485
689
  description:
486
690
  rdsk:
487
- description: Restore Disk Image
691
+ description: Restore Disk Image / ramdisk
488
692
  rdtr:
489
693
  description:
490
694
  recm:
491
695
  description:
696
+ rcfg:
697
+ description: >
698
+ Appears in certificates issues by factory such as `T6031-SDOM1-TssLive-ManifestKey-RevA-Factory`.
699
+ Potentially indicates that the policy is for a recovery boot only.
700
+ type: boolean
492
701
  rfta:
493
702
  description:
494
703
  rfts:
495
704
  description:
705
+ rdcp:
496
706
  rkrn:
497
707
  description: restore kernel
498
708
  rlgo:
@@ -501,6 +711,7 @@ img4_tags:
501
711
  description:
502
712
  rolp:
503
713
  description: recoveryOS local policy
714
+ type: boolean
504
715
  ronh:
505
716
  title: recoveryOS Nonce Hash (ronh)
506
717
  description: >
@@ -533,6 +744,8 @@ img4_tags:
533
744
  change the nsih value implicitly when they perform a software update.
534
745
  type: binary
535
746
  subtype: sha2-384
747
+ context:
748
+ lpol:
536
749
  access:
537
750
  write:
538
751
  - 1TR
@@ -541,9 +754,10 @@ img4_tags:
541
754
  spih:
542
755
  description: Cryptex1 Image4 Hash
543
756
  stng:
544
- description: Cryptex1 Generation
757
+ description: Cryptex1 Generation / Cryptex type?
545
758
  auxh:
546
759
  description: User Authorized Kext List Hash
760
+ context:
547
761
  rpnh:
548
762
  title: Remote Policy Nonce Hash (rpnh)
549
763
  description: >
@@ -559,15 +773,19 @@ img4_tags:
559
773
  - macOS
560
774
  RSCH:
561
775
  description: Research mode
776
+ rcio:
777
+ description: Restore CIO
562
778
  fgpt:
563
- description: factory pre-release global trust
779
+ description: factory glob al pre-release trust
564
780
  UDID:
565
781
  description: universal device identifier
566
782
  rsch:
567
783
  description: research mode
568
784
  vnum:
569
- description: maximum restore version
785
+ description: Version Number - Update Maximum
570
786
  type: string
787
+ roots:
788
+ - ExtraContent
571
789
  rsep:
572
790
  description: Restore SEP Image, paired with oppd/tbms
573
791
  type: string
@@ -622,21 +840,21 @@ img4_tags:
622
840
  slvn:
623
841
  description:
624
842
  smb0:
625
- description: Secure Multi-Boot 0 - Security Mode - Full Security, Reduced, Disabled
843
+ description: Secure Multi-Boot 0 - Security Mode - Full Security, Reduced, Disabled - Setting to 1 sets to reduced
626
844
  smb1:
627
- description: Secure Multi-Boot 1
845
+ description: Secure Multi-Boot 1 - Setting to 1 allows Permissive
628
846
  smb2:
629
847
  description: Secure Multi-Boot 2 - 3rd Party Kexts Status
630
848
  smb3:
631
849
  description: Secure Multi-Boot 3 - User-allowed MDM Control
632
850
  smb4:
633
851
  description: Secure Multi-Boot 3 - DEP-allowed MDM Control
852
+ smb5:
853
+ description: Unknown - but known to exist in Factory signing
634
854
  SNON:
635
855
  description: SEP Nonce
636
856
  snon:
637
857
  description: SEP Nonce
638
- snuf:
639
- description:
640
858
  srnm:
641
859
  description:
642
860
  ster:
@@ -644,12 +862,14 @@ img4_tags:
644
862
  svrn:
645
863
  description: Server nonce
646
864
  tbmr:
647
- description: Trusted Boot Measurement (Root?)
865
+ description: Trusted Boot Measurement (Recovery/Root?)
648
866
  tbms:
649
867
  description: Trusted Boot Measurement (Signature?)
650
868
  notes: Likely encrypted by the SEP and opaque to the AP
651
869
  tatp:
652
- description: Board Name (such as d84)
870
+ description: Board Name (such as d84) - Target AP Test
871
+ roots:
872
+ - ManifestKey-DataCenter
653
873
  tery:
654
874
  description:
655
875
  test:
@@ -657,11 +877,19 @@ img4_tags:
657
877
  tics:
658
878
  description:
659
879
  trst:
660
- description: Trust Cache
880
+ description: Trust Object
661
881
  tsys:
662
882
  description:
663
883
  type:
664
884
  description: Cryptex Type
885
+ type: integer
886
+ roots:
887
+ - ExtraContent
888
+ caos:
889
+ description:
890
+ type: digest-object
891
+ root:
892
+ - ExtraContent
665
893
  ucer:
666
894
  description: User Cert
667
895
  ucon:
@@ -671,6 +899,8 @@ img4_tags:
671
899
  uidm:
672
900
  description:
673
901
  type: boolean
902
+ roots:
903
+ - ManifestKey-DataCenter
674
904
  vice:
675
905
  description:
676
906
  vkdl:
@@ -689,6 +919,9 @@ img4_tags:
689
919
  - macOS
690
920
  ware:
691
921
  description:
922
+ sski:
923
+ description: SHA2 os some kind
924
+ type: binary
692
925
  inst:
693
926
  descryption: The key or file to install
694
927
  wchf:
data/share/pki.yaml CHANGED
@@ -5,10 +5,10 @@ metadata:
5
5
  certificate_names:
6
6
  dcrt: device certificate
7
7
  dcrt-oid: device owner certificate
8
- lcrt: local certificate?
8
+ lcrt: Lynx / Secure Storage for SEP Certificate
9
9
  pcrt: product/production certificate?
10
10
  rcrt: remote/recovery certificate?
11
- scrt: server certificate?
11
+ scrt: SEP Certificate
12
12
  tcrt: test certificate?
13
13
  ucrt: user certificate (mapps to a single iCloud account)
14
14
  vcrt: virtual certificate?
@@ -47,17 +47,23 @@ oids:
47
47
  example:
48
48
  PUT/FSCl:sik-FXFYFXFFYFFEX-QQRRRDEETFEFYCEIESLIREILCILESCLSELRESERSER
49
49
  - oid: 1.2.840.113635.100.6.1.15
50
+ name: TSS Signing Delegation Constraints
50
51
  description:
51
- To be signed certificate...
52
- Contains the boot policy of the machine during certificate issuance
53
- based on boot policy. includes BORD, ronh, lobo, SDOM, lpnh, rpnh
54
- BNCH, CSEC, CHIP, ECID, CPEO, OBJP, EPRO, DPRO, ESEC, DSEC and DGST
52
+ Constriction on values that can be specified or signed by this certificate. Conatins two sub-sequesnces, the MANP (Manifest Properties)
53
+ and the OBJP (Object Properties). Manifest properties are at the issued IM4M, and object properties are per signed object (firmware).
54
+ Values of NULL mean tha tthis certificate can sign any value for that property, values that are set are values that must be signed
55
+ with that value by this certificate. This is how for example `T6031-SDOM1` is enforced. The certificate for that set of servers
56
+ have a null value for ECID (meaning it can be used for any ECID) and have fixed values for CHIP / Security Domain SDOM.
57
+
58
+ This is how Live TSS for customers differs from factory signing in what properties it can include. Factory only manifest properties
59
+ include `augs`, `uidm`
55
60
  found_in:
56
61
  - ucrt
57
62
  - dcrt-oid
58
63
  issuers:
59
64
  - Basic Attestation User Sub CA2
60
65
  - FDRDC-UCRT-SUBCA
66
+ - T6031-SDOM1-TssLive-ManifestKey-RevA-Factory
61
67
  ous:
62
68
  - BAA Certification
63
69
  - ucrt Leaf Certificate
@@ -80,7 +86,7 @@ oids:
80
86
  - oid: 1.2.840.113635.100.7.1.1
81
87
  apple_description: 'Apple FairPlay certificate extended Application Authentication & Authorization: Policy'
82
88
  - oid: 1.2.840.113635.100.8.4
83
- description: contains 3 integer values in ASN1, the second of which seems to be a 64bit mask of 0xFE000000
89
+ description: Contains a sequence of integer values. Some are 0, some are 1, others appear to be int32 bitmasks.
84
90
  is_asn_body: true
85
91
  is_extension: true
86
92
  found_in:
@@ -91,6 +97,7 @@ oids:
91
97
  ous:
92
98
  - BAA Certification
93
99
  - oid: 1.2.840.113635.100.8.5
100
+ description: Similar in nature to `1.2.840.113635.100.8.4`. Non-integer values observed of `ssca`.
94
101
  is_asn_body: true
95
102
  is_extension: true
96
103
  found_in:
@@ -190,3 +197,28 @@ known_symbols:
190
197
  - _oidAppleTVOSApplicationSigningProdQA
191
198
  roots:
192
199
  FDR-CA1-ROOT-CM:
200
+ FDR-DC-SSL-ROOT:
201
+ FDR Sealing Server CA 1:
202
+ subordinate_cas:
203
+ FDR-SS-CM-E1:
204
+ Basic Attestation User Root CA:
205
+ subordinate_cas:
206
+ Basic Attestation User Sub CA2:
207
+ description:
208
+ Issues `ucrt` subordinate CA's that are used for user level signing. Under this `BAA Certification`
209
+ certs are issued.
210
+ Apple Secure Boot Root CA - G6:
211
+ subordinate_cas:
212
+ T6031-SDOM1-RecoveryBoot-RevA-Factory:
213
+ description:
214
+ T6031-SDOM1-TssLive-ManifestKey-RevA-Factory:
215
+ Apple X86 Secure Boot Root CA - G1:
216
+ subject_key_id: 301680147D73CE0A3B41A1A352D2B1141EF6F5B4DD76E6E8
217
+ subordinate_cas:
218
+ T6031-SDOM1-TssLive-ManifestKey-Global-RevA-DataCenter:
219
+ subject_key_id: 0414D8B9E3E9C4A1C542ECB72FC2CF0C2F861E1B3EEF
220
+ Apple Extra Content Global Root CA - G1:
221
+ subject_key_id: 30168014AA63251D082C72A381536C94D2864995881CB0D0
222
+ subordinate_cas:
223
+ ZFF10-SDOM1-TssLive-ManifestKey-ExtraContent-Global-RevA-DataCenter:
224
+ subject_key_id: 041442FEAB470561CE2A7471B55AC0D81AB7536F4B36
data/share/terms.yaml CHANGED
@@ -11,12 +11,40 @@ terms:
11
11
  description:
12
12
  aop:
13
13
  - title: Always-On Processor
14
+ AID:
15
+ - title: Apple ID
16
+ AltDSID:
17
+ DvF:
18
+ nbAc:
19
+ - title: Nearby Action
20
+ nbIF:
21
+ - title: Nearby Interface Type
22
+ DsFl:
23
+ AMfD:
24
+ nbAf:
25
+ DSID:
26
+ MRI:
27
+ MRtI:
28
+ IDS:
29
+ - title: Identity Services
30
+ RSSI:
31
+ - title: Receive Signal Stength Indicator
32
+ XPC:
33
+ RemoteXPC:
34
+ eOS:
35
+ - title: embeddedOS (Touch Bar OS for T1)
36
+ bridgeOS:
37
+ - title: bridgeOS (Touch Bar / Security OS for T2)
14
38
  AP:
15
39
  - title: Application Processor
16
40
  aps:
17
41
  see:
18
42
  - apns
19
43
  APTicket:
44
+ Md:
45
+ - title: Model
46
+ Nm:
47
+ - title: User Assigned Name
20
48
  mach:
21
49
  tfp0:
22
50
  gcd:
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: apple-data
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.0.603
4
+ version: 1.0.605
5
5
  platform: ruby
6
6
  authors:
7
7
  - Rick Mark
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2024-02-15 00:00:00.000000000 Z
11
+ date: 2024-02-19 00:00:00.000000000 Z
12
12
  dependencies: []
13
13
  description: |2
14
14
  This package includes machine readable data about Apple platforms maintained by hack-different.