apple-data 0.1.0

Sign up to get free protection for your applications and to get access to all the features.
checksums.yaml ADDED
@@ -0,0 +1,7 @@
1
+ ---
2
+ SHA256:
3
+ metadata.gz: 364470e15839f7c778c71e079e71b390ce25f658badad6fa75dedd951f76aea8
4
+ data.tar.gz: b42d763751fba1422c89902c3b8291c368164e370db2ef473b931a34b8ed5f56
5
+ SHA512:
6
+ metadata.gz: ced7544c4aa23fc1f7fcfde68387726ce8aa7f636be4921deb020801a04b7c82cc25bd3221691c263ea1f8f9b9b0bb9d4f0c157c246aee21e3887fae65034f36
7
+ data.tar.gz: acef047056e1b709c6564c05c2dc59a285aeb5c9a5e9c5cf093676ee8f1567fcd572f436ef969666f65c532aac7d4d7cb1cc61b4a03c909a11eac9c338a56a3e
data/share/4cc.yaml ADDED
@@ -0,0 +1,295 @@
1
+ ---
2
+ - code: 0Cfg
3
+ description:
4
+ usage:
5
+ - SysCfg
6
+ - code: AAPL
7
+ description: Generic 4CC for Apple, often Creator Code
8
+ usage:
9
+ - Everywhere
10
+ - code: ADDA
11
+ description:
12
+ usage:
13
+ - SysCfg
14
+ - code: BNCH
15
+ description: Boot Nonce Hash
16
+ usage:
17
+ - APTicket
18
+ - code: BNDL
19
+ description: Loadable Bundle (plugin)
20
+ usage:
21
+ - macOS
22
+ - code: BORD
23
+ description: Board ID
24
+ usage:
25
+ - APTicket
26
+ - code: CEPO
27
+ description: Certificate Epoch
28
+ usage:
29
+ - APTicket
30
+ - code: CHIP
31
+ description: Chip ID
32
+ usage:
33
+ - APTicket
34
+ - code: CLHS
35
+ description:
36
+ usage:
37
+ - SysCfg
38
+ - code: CPRO
39
+ description: Chip Production Status
40
+ usage:
41
+ - Boot Policy
42
+ - code: CPRV
43
+ description: Chip Revision
44
+ usage:
45
+ - APTicket
46
+ - code: CSEC
47
+ description: Chip Security Mode
48
+ usage:
49
+ - APTicket
50
+ - code: ECID
51
+ description: Exclusive Chip ID
52
+ usage:
53
+ - APTicket
54
+ - code: EPRO
55
+ description: Effective Production Status
56
+ usage:
57
+ - APTicket
58
+ - code: ESEC
59
+ description: Effective Security Status
60
+ usage:
61
+ - APTicket
62
+ - code: MANB
63
+ description: Manifest Body
64
+ usage:
65
+ - APTicket
66
+ - code: MANP
67
+ description: Manifest Properties
68
+ usage:
69
+ - APTicket
70
+ - code: MOJO
71
+ description: Mojo Debug Flag
72
+ usage:
73
+ - SMC
74
+ - code: Mod#
75
+ description: Model Number
76
+ usage:
77
+ - FDR
78
+ - SysCfg
79
+ - code: Regn
80
+ description: Region
81
+ usage:
82
+ - FDR
83
+ - SysCfg
84
+ - code: SDOM
85
+ description: Security Domain
86
+ usage:
87
+ - APTicket
88
+ - code: SrNm
89
+ description: Serial Number
90
+ usage:
91
+ - SysCfg
92
+ - code: WSKU
93
+ description:
94
+ usage:
95
+ - SysCfg
96
+ - code: anef
97
+ description: Apple Neural Engine Firmware
98
+ usage:
99
+ - Firmware
100
+ - code: ansf
101
+ description: Apple NAND Storage Firmware
102
+ usage:
103
+ - Firmware
104
+ - code: aopf
105
+ description: Always-on-Processor Firmware
106
+ usage:
107
+ - Firmware
108
+ - code: appv
109
+ description:
110
+ usage:
111
+ - FDR
112
+ - SysCfg
113
+ - code: aubt
114
+ description:
115
+ usage: []
116
+ - code: auxi
117
+ description: Auxiliary Kernel Cache Image4 Hash
118
+ usage:
119
+ - Boot Policy
120
+ - code: auxp
121
+ description: User Authorized Kext List Hash
122
+ usage:
123
+ - Boot Policy
124
+ - code: auxr
125
+ description: Kext Receipt Hash
126
+ usage:
127
+ - Boot Policy
128
+ - code: avef
129
+ description: Audio / Video Encryption (DRM) Firmware
130
+ usage:
131
+ - Firmware
132
+ - code: bstc
133
+ description:
134
+ usage: []
135
+ - code: ciof
136
+ description:
137
+ usage:
138
+ - Firmware
139
+ - code: coih
140
+ description: CustomKC or fuOS Image4 Hash
141
+ usage:
142
+ - APTicket
143
+ - code: csys
144
+ description:
145
+ usage: []
146
+ - code: dCfg
147
+ description:
148
+ usage:
149
+ - FDR
150
+ - code: dcp2
151
+ description:
152
+ usage: []
153
+ - code: dcpf
154
+ description:
155
+ usage: []
156
+ - code: dtre
157
+ description: Device Tree
158
+ usage:
159
+ - Firmware
160
+ - code: eCfg
161
+ description:
162
+ usage:
163
+ - FDR
164
+ - SysCfg
165
+ - code: fCfg
166
+ description:
167
+ usage: []
168
+ - code: gfxf
169
+ description: Graphics Firmware
170
+ usage:
171
+ - Firmware
172
+ - code: ibdt
173
+ description: iBoot Data
174
+ usage:
175
+ - Firmware
176
+ - code: ibot
177
+ description: iBoot
178
+ usage:
179
+ - Firmware
180
+ - code: ispf
181
+ description: Image Signal Processor Firmware
182
+ usage:
183
+ - Firmware
184
+ - code: krnl
185
+ description: XNU Kernel
186
+ usage:
187
+ - Firmware
188
+ - code: ksku
189
+ description:
190
+ usage: []
191
+ - code: kuid
192
+ description: Key Exchange Key Group UUID
193
+ usage:
194
+ - Boot Policy
195
+ - code: logo
196
+ description: iBoot Apple Logo
197
+ usage:
198
+ - Firmware
199
+ - code: love
200
+ description: OS Version
201
+ usage:
202
+ - Boot Policy
203
+ - code: lpnh
204
+ description: Local Policy Nonce Hash
205
+ usage:
206
+ - Boot Policy
207
+ - code: lpol
208
+ description: Local Policy
209
+ usage:
210
+ - Firmware
211
+ - Boot Policy
212
+ - code: nsih
213
+ description: Next Stage Image4 Hash
214
+ usage: []
215
+ - code: pmpf
216
+ description: Power Management Processor Firmware
217
+ usage:
218
+ - Firmware
219
+ - code: rlg1
220
+ description: Restore logo
221
+ usage:
222
+ - Firmware
223
+ - code: rlg2
224
+ description: Restore logo
225
+ usage:
226
+ - Firmware
227
+ - code: ronh
228
+ description: RecoveryOS Policy Nonce Hash
229
+ usage:
230
+ - Boot Policy
231
+ - code: rpnh
232
+ description: Remote Policy Nonce Hash
233
+ usage:
234
+ - Boot Policy
235
+ - code: seal
236
+ description:
237
+ usage:
238
+ - FDR
239
+ - code: siof
240
+ description: Smart-IO Firmware
241
+ usage:
242
+ - Firmware
243
+ - code: sip0
244
+ description: System Integrity Protection (SIP Status)
245
+ usage:
246
+ - Boot Policy
247
+ - code: sip1
248
+ description: System Integrity Protection (Signed System Volume Status)
249
+ usage:
250
+ - Boot Policy
251
+ - code: sip2
252
+ description: System Integrity Protection (Kernel CTRR Status)
253
+ usage:
254
+ - Boot Policy
255
+ - code: sip3
256
+ description: System Integrity Protection (Boot Args Filtering Status)
257
+ usage:
258
+ - Boot Policy
259
+ - code: smb0
260
+ description: Secure Multi-Boot (Security Mode)
261
+ usage:
262
+ - Boot Policy
263
+ - code: smb1
264
+ description: Secure Multi-Boot
265
+ usage:
266
+ - Boot Policy
267
+ - code: smb2
268
+ description: Secure Multi-Boot (3rd Party Kexts Status)
269
+ usage:
270
+ - Boot Policy
271
+ - code: smb3
272
+ description: Secure Multi-Boot (User-allowed MDM Control)
273
+ usage:
274
+ - Boot Policy
275
+ - code: smb4
276
+ description: Secure Multi-Boot (DEP-allowed MDM Control)
277
+ usage:
278
+ - Boot Policy
279
+ - code: snon
280
+ description: Secure Enclave Processor Boot Nonce Hash
281
+ usage:
282
+ - APTicket
283
+ - code: tCfg
284
+ description:
285
+ usage:
286
+ - FDR
287
+ - SysCfg
288
+ - code: tmuf
289
+ description:
290
+ usage:
291
+ - Firmware
292
+ - code: vuid
293
+ description: Volume Group UUID
294
+ usage:
295
+ - Boot Policy
data/share/apns.yaml ADDED
@@ -0,0 +1,386 @@
1
+ # SPDX-FileCopyrightText: 2021 Nicolás Alvarez <nicolas.alvarez@gmail.com>
2
+ #
3
+ # SPDX-License-Identifier: GPL-2.0-or-later
4
+
5
+ # Legacy incoming commands (current client code seems to support them still):
6
+ # 0x01 connected
7
+ # 0x03 message received
8
+ # 0x06 keep-alive response
9
+
10
+ 0x07:
11
+ name: connect
12
+ label: Connect
13
+ direction: outgoing
14
+ items:
15
+ 0x01:
16
+ name: token
17
+ label: Token
18
+ 0x02:
19
+ name: state
20
+ label: State
21
+ 0x05:
22
+ # the bitfield is not decoded yet, and it doesn't seem easy,
23
+ # as there's several constant values.
24
+ name: flags
25
+ label: Flags
26
+ 0x06:
27
+ # 'interface' internally has values [0..4], but the number in this field
28
+ # is only 0/1 for cellular/WiFi
29
+ name: interface
30
+ label: Interface
31
+ type: FT_UINT8
32
+ base: BASE_DEC
33
+ strings: VALS(interface_string)
34
+ 0x07:
35
+ name: active_interval
36
+ label: Active Interval
37
+ 0x08:
38
+ name: carrier
39
+ label: Carrier
40
+ type: FT_STRING
41
+ 0x09:
42
+ name: software_version
43
+ label: Software Version
44
+ type: FT_STRING
45
+ 0x0a:
46
+ name: software_build
47
+ label: Software Build
48
+ type: FT_STRING
49
+ 0x0b:
50
+ name: hardware_version
51
+ label: Hardware Version
52
+ type: FT_STRING
53
+ 0x0c:
54
+ name: certificate
55
+ label: Certificate
56
+ 0x0d:
57
+ name: nonce
58
+ label: Nonce
59
+ 0x0e:
60
+ name: signature
61
+ label: Signature
62
+ 0x10:
63
+ # I *think* this is a protocol version. Values seen:
64
+ # macOS Sierra: 3
65
+ # iOS 12.4.8: 6
66
+ # iOS 13.7: 7
67
+
68
+ name: version
69
+ label: Protocol Version
70
+ type: FT_UINT16
71
+ base: BASE_DEC
72
+ 0x11:
73
+ name: redirect_count
74
+ label: Redirect Count
75
+ type: FT_UINT16
76
+ base: BASE_DEC
77
+ 0x13:
78
+ name: dns_time
79
+ label: DNS Resolve Time
80
+ 0x14:
81
+ name: tls_time
82
+ label: TLS Handshake Time
83
+ type: FT_RELATIVE_TIME
84
+
85
+ 0x08:
86
+ name: connected
87
+ label: Connected
88
+ direction: incoming
89
+ items:
90
+ 0x01:
91
+ name: connected_response
92
+ label: Response
93
+ type: FT_UINT8
94
+ base: BASE_HEX
95
+ 0x02:
96
+ name: server_metadata
97
+ label: Server Metadata
98
+ type: FT_STRING
99
+ 0x03:
100
+ name: token
101
+ label: Token
102
+ 0x04:
103
+ name: message_size
104
+ label: Message Size
105
+ type: FT_UINT16
106
+ base: BASE_DEC
107
+ 0x06:
108
+ name: capabilities
109
+ label: Capabilities
110
+ type: FT_UINT32
111
+ base: BASE_HEX
112
+ ## whole field: capabilities
113
+ ## bit0: dualChannelSupport
114
+ ## bit1: reportLastReversePushRTT
115
+ 0x07:
116
+ name: bad_nonce_time
117
+ label: Server Time For Bad Nonce
118
+ type: FT_UINT64
119
+ base: BASE_HEX
120
+ 0x08:
121
+ name: large_message_size
122
+ label: Large Message Size
123
+ type: FT_UINT16
124
+ base: BASE_DEC
125
+ 0x09:
126
+ name: redirect_reason
127
+ label: Redirect Reason
128
+ type: FT_STRING
129
+ 0x0a:
130
+ name: server_time
131
+ label: Server Time
132
+ type: FT_ABSOLUTE_TIME
133
+ base: ABSOLUTE_TIME_UTC
134
+ 0x0b:
135
+ name: geo_region
136
+ label: Geo Region
137
+ type: FT_STRING
138
+ # This is a timestamp but I don't know what it means
139
+ 0x0c:
140
+ name: unknown_ts
141
+ label: Unknown
142
+ type: FT_ABSOLUTE_TIME
143
+ base: ABSOLUTE_TIME_UTC
144
+
145
+ 0x09:
146
+ name: filter
147
+ label: Filter
148
+ direction: outgoing
149
+ items:
150
+ 0x01:
151
+ name: token
152
+ label: Token
153
+ 0x02:
154
+ name: enabled_hash
155
+ label: Enabled Topic Hash
156
+ 0x03:
157
+ name: ignored_hash
158
+ label: Ignored Topic Hash
159
+ 0x04:
160
+ name: opportunistic_hash
161
+ label: Opportunistic Topic Hash
162
+ 0x05:
163
+ name: paused_hash
164
+ label: Paused Topic Hash
165
+
166
+ 0x0a:
167
+ name: message
168
+ label: Message
169
+ direction: both
170
+ items:
171
+ # outgoing, 1 is topic hash, 2 is token
172
+ # incoming, 1 is token, 2 is topic hash
173
+ 0x1:
174
+ name: topic_hash
175
+ label: Topic Hash
176
+ 0x2:
177
+ name: token
178
+ label: Token
179
+ 0x3:
180
+ name: payload
181
+ label: Payload
182
+ 0x4:
183
+ name: message_id
184
+ label: Message ID
185
+ type: FT_UINT32
186
+ base: BASE_HEX
187
+ 0x5:
188
+ name: expiry
189
+ label: Message Expiry Time
190
+ type: FT_ABSOLUTE_TIME
191
+ base: ABSOLUTE_TIME_UTC
192
+ 0x6:
193
+ # this is nanoseconds since Unix epoch,
194
+ # but Wireshark doesn't yet support that
195
+ name: timestamp
196
+ label: Message Timestamp
197
+ type: FT_UINT64
198
+ base: BASE_HEX
199
+ 0x9:
200
+ name: storage_flags
201
+ label: Storage Fiags
202
+ type: FT_UINT8
203
+ base: BASE_HEX
204
+ 0xd:
205
+ name: priority
206
+ label: Priority
207
+ type: FT_UINT8
208
+ base: BASE_HEX
209
+ 0xf:
210
+ name: base_token
211
+ label: Base Token
212
+ 0x15:
213
+ name: tracing_uuid
214
+ label: Message Tracing UUID
215
+ 0x18:
216
+ name: correlation_id
217
+ label: Correlation Identifier
218
+ type: FT_STRING
219
+ 0x1a:
220
+ name: apn_flags
221
+ label: APN Flags
222
+ type: FT_UINT32
223
+ base: BASE_HEX
224
+ 0x1c:
225
+ name: push_type
226
+ label: Push Type
227
+ type: FT_UINT16
228
+ base: BASE_DEC
229
+ strings: VALS(push_type_string)
230
+ 0x19:
231
+ name: lastRTT
232
+ label: Last RTT
233
+ type: FT_UINT16
234
+ base: BASE_DEC
235
+
236
+ 0x0b:
237
+ name: ack
238
+ label: Acknowledge Message
239
+ direction: both
240
+ items:
241
+ 0x1:
242
+ name: token
243
+ label: Token
244
+ 0x4:
245
+ name: message_id
246
+ label: Message ID
247
+ type: FT_UINT32
248
+ base: BASE_HEX
249
+ 0x8:
250
+ name: response
251
+ label: Response
252
+ type: FT_UINT8
253
+ base: BASE_HEX
254
+
255
+ 0x0c:
256
+ name: keepalive
257
+ label: Keep-Alive
258
+ direction: outgoing
259
+ items:
260
+ 0x01:
261
+ name: carrier
262
+ label: Carrier
263
+ type: FT_STRING
264
+ 0x02:
265
+ name: software_version
266
+ label: Software Version
267
+ type: FT_STRING
268
+ 0x03:
269
+ name: software_build
270
+ label: Software Build
271
+ type: FT_STRING
272
+ 0x04:
273
+ name: hardware_version
274
+ label: Hardware Version
275
+ type: FT_STRING
276
+ 0x05:
277
+ name: interval
278
+ label: Keepalive Interval
279
+ type: FT_STRING
280
+ 0x06:
281
+ name: delayed_interval
282
+ label: Delayed Response Interval
283
+ type: FT_STRING
284
+
285
+ 0x0d:
286
+ name: keepalive_response
287
+ label: Keep-Alive Response
288
+ direction: incoming
289
+ items:
290
+ 0x1:
291
+ name: response
292
+ label: Response
293
+ type: FT_UINT8
294
+ base: BASE_HEX
295
+
296
+ 0x0f:
297
+ name: flush
298
+ label: Flush
299
+ direction: incoming
300
+ items:
301
+ 0x1:
302
+ name: want_padding
303
+ label: Want Padding
304
+ type: FT_UINT16
305
+ base: BASE_HEX
306
+
307
+ 0x10:
308
+ name: flush_response
309
+ label: Flush Response
310
+ direction: incoming
311
+
312
+ 0x11:
313
+ name: apptoken
314
+ label: App Token Generate Request
315
+ direction: outgoing
316
+ items:
317
+ 0x01:
318
+ name: base_token
319
+ label: Base Token
320
+ 0x02:
321
+ name: topic_hash
322
+ label: Topic Hash
323
+ 0x03:
324
+ name: appid
325
+ label: App ID
326
+ type: FT_UINT16
327
+ base: BASE_HEX
328
+
329
+ 0x12:
330
+ name: apptoken_response
331
+ label: App Token Generate Response
332
+ direction: incoming
333
+ items:
334
+ 0x01:
335
+ name: response
336
+ label: Response
337
+ type: FT_UINT8
338
+ base: BASE_HEX
339
+ 0x02:
340
+ name: token
341
+ label: Token
342
+ 0x03:
343
+ name: topic_hash
344
+ label: Topic Hash
345
+ 0x04:
346
+ name: appid
347
+ label: App ID
348
+ type: FT_UINT16
349
+ base: BASE_HEX
350
+
351
+ 0x14:
352
+ name: setstate
353
+ label: Set Active State
354
+ direction: outgoing
355
+ items:
356
+ 0x01:
357
+ name: state
358
+ label: State
359
+ type: FT_UINT8
360
+ base: BASE_DEC
361
+ strings: VALS(active_state_string)
362
+ # this is hardcoded to 0x258 ??
363
+ 0x02:
364
+ name: interval
365
+ label: Interval
366
+ type: FT_UINT32
367
+ base: BASE_HEX
368
+
369
+ 0x16:
370
+ name: keepalive_ack
371
+ label: Keep-Alive Ack
372
+ direction: incoming
373
+
374
+ 0x17:
375
+ name: redirect
376
+ label: Redirect # ??
377
+ direction: incoming
378
+ items:
379
+ 0x02:
380
+ name: server_metadata
381
+ label: Server Metadata
382
+ type: FT_STRING
383
+ 0x09:
384
+ name: redirect_reason
385
+ label: Redirect Reason
386
+ type: FT_STRING
data/share/backup.yaml ADDED
@@ -0,0 +1,45 @@
1
+ ---
2
+ domains:
3
+ - AppDomainGroup-group.com.apple.tips
4
+ - AppDomain-com.apple.Music
5
+ - AppDomain-com.apple.podcasts
6
+ - HomeDomain
7
+ - AppDomain-com.apple.mobilenotes
8
+ - AppDomainGroup-243LU875E5.groups.com.apple.podcasts
9
+ - AppDomainGroup-group.com.apple.notes
10
+ - WirelessDomain
11
+ - AppDomainGroup-group.com.apple.news
12
+ - AppDomainGroup-group.com.apple.Music
13
+ - AppDomain-com.apple.news
14
+ - SysSharedContainerDomain-systemgroup.com.apple.icloud.findmydevice.managed
15
+ - AppDomain-com.apple.mobilemail
16
+ - AppDomainPlugin-com.apple.weather.widget
17
+ - KeyboardDomain
18
+ - AppDomainGroup-group.com.apple.mail
19
+ - AppDomainPlugin-com.apple.news.widget
20
+ - AppDomain-com.apple.mobilesafari
21
+ - AppDomain-com.apple.ScreenshotServicesService
22
+ - AppDomain-com.apple.MobileSMS
23
+ - SysSharedContainerDomain-systemgroup.com.apple.lskdrl
24
+ - KeychainDomain
25
+ - AppDomain-com.apple.Maps
26
+ - SystemPreferencesDomain
27
+ - SysSharedContainerDomain-systemgroup.com.apple.nearbyd.datastore
28
+ - AppDomainGroup-group.com.apple.weather
29
+ - AppDomain-com.apple.SleepLockScreen
30
+ - AppDomain-com.apple.Passbook
31
+ - AppDomainGroup-group.com.apple.Maps
32
+ - SysSharedContainerDomain-systemgroup.com.apple.bluetooth
33
+ - ManagedPreferencesDomain
34
+ - NetworkDomain
35
+ - AppDomainPlugin-com.apple.Maps.GeneralMapsWidget
36
+ - AppDomainPlugin-com.apple.MobileSMS.MessagesNotificationExtension
37
+ - AppDomainPlugin-com.apple.Music.Messages
38
+ - AppDomainPlugin-com.apple.TestFlight.ServiceExtension
39
+ - RootDomain
40
+ - AppDomainPlugin-com.apple.AppleMediaDiscovery.AMDEngagementExtension
41
+ - MediaDomain
42
+ - AppDomain-com.apple.store.Jolly
43
+ - SysSharedContainerDomain-systemgroup.com.apple.configurationprofiles
44
+ - AppDomainPlugin-com.apple.AppStore.ProductPageExtension
45
+ - SysContainerDomain-com.apple.appstored
@@ -0,0 +1,4 @@
1
+ ---
2
+ description: various components of the UTRAN radio system
3
+ esim:
4
+ root_keys: